COMMENTARY: MSSPs are facing a security economics problem: the same AI capabilities being sold to make security operations more efficient are also making some security platforms harder for smaller customers to afford.
Security vendors are adding AI-assisted investigation, exposure analytics, automated remediation, and data correlation across endpoint, asset management, vulnerability management, and SIEM platforms. Many of those capabilities have operational value. The problem begins when the cost of those capabilities changes the economics of the service underneath them.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
For an MSSP, rising tool costs eventually force a decision about what gets passed on to the customer.
A tool that once made sense financially can come up for renewal at a price that no longer works for smaller customers. At that point, the MSSP must decide whether to absorb the increase, pass it on, scale back the service, or find a replacement. None of those are easy choices.
The requirement does not disappear
Small and midsized businesses and organizations operating OT or industrial control systems feel this pressure first.
Their environments differ, but the economic problem is similar. Security budgets are restricted, staffing is limited, and technology investments compete with production, maintenance, modernization, and basic business operations.
Related reading:
Small businesses may still need endpoint protection, asset inventory, vulnerability management, identity controls, centralized logging, backups, and incident response. A manufacturer may need many of the same capabilities while also accounting for PLCs, HMIs, engineering workstations, embedded systems, and legacy hosts.
Cyber insurance, compliance obligations, and customer requirements do not disappear because the preferred security platform becomes too expensive.
The MSSP still must produce a defensible security program.
The best tool may no longer be the right tool
Consider an asset-management platform originally purchased to answer a straightforward question: what exists in the environment?
Over time, that platform may expand into exposure management, AI-assisted prioritization, analytics, and automation. Those capabilities can be useful, but the customer may still only need reliable asset visibility.
MSSPs are increasingly being pushed toward premium capabilities that smaller customers do not always need.
We do not need every customer on a luxury-tier security stack.
If a higher commercial minimum makes the platform uneconomical, paying for functionality that will rarely be used does not automatically improve security. It can instead force the MSSP to replace a control that was already working.
Cost must be part of the design discussion. If the customer cannot afford to maintain control, that control will eventually be lost.
OT and ICS add another constraint
Industrial environments make the tradeoff harder.
PLCs, embedded controllers, legacy operating systems, and specialized industrial devices may not tolerate the same active discovery or automated probing techniques used in enterprise IT.
AI-driven scanning can increase the speed or scope of those interactions. That may be acceptable on standard corporate endpoints. In an industrial environment, aggressive or poorly controlled probing can affect equipment availability or behavior.
In OT and ICS environments, passive visibility is often the safer and more practical option. MSSPs can gain significant value from network telemetry, segmentation, supported endpoint controls, targeted vulnerability management, and focused logging without pushing every customer toward the same high-cost platform.
SMBs may take a similar approach by using capabilities already included in Microsoft, cloud services, network infrastructure, or existing endpoint platforms before adding another standalone product.
That is not automatically a downgrade.
It is architecture under constraint.
Define the minimum viable security stack
The objective should be to preserve security outcomes rather than specific products.
The provider needs to know what assets exist. Privileged access must be controlled. Critical systems need appropriate segmentation. Useful telemetry must reach the SOC. Endpoints should be protected where technically feasible. Vulnerabilities require prioritization and remediation. Backups must remain recoverable. Someone must be able to respond when those controls fail.
Insurance questionnaires and compliance frameworks vary, so there is no universal minimum stack. The MSSP must map each requirement to a control, identify lower-cost ways to satisfy it, and document the residual risk when premium capabilities are removed.
That engineering work becomes part of the managed provider's value.
AI should improve the economics of managed security by reducing repetitive analyst work and accelerating investigations. The contradiction appears when those gains are offset by licensing costs that smaller customers cannot absorb.
For MSSPs supporting SMB and OT/ICS environments, the next architecture challenge may not be finding the most capable platform.
It may be finding the minimum effective stack that the customer can sustain.
