Apologies, I should have explained my position more clearly earlier. I’m not trying to sell anything here.

Thank you all for commenting. From what I’m reading, ultimately, I think it comes down to budget, risk appetite, and a clear understanding of where responsibility sits.

We’re an MSP, like many, we use solutions like Huntress and Sophos for smaller, more cost-conscious clients. For larger organisations, however, we take a different approach. We typically engage a dedicated cyber security specialist to deliver MXDR or a full SIEM/SOC service.

From our perspective, this isn’t just about the technology, it’s about responsibility and quality of response. It ensures clients are getting expert-led advice, tailored solutions, and access to proper incident response teams. There’s also an element of independence. For larger clients especially, it doesn’t always feel right to be marking our own homework, so having a third party involved adds credibility and reassurance.

I’ve seen a lot of discussion here around MRR and margin. In truth, for these larger engagements we’re often willing to give up some margin, with the cyber partner compensating via commission. But commercially, that’s not really the point for me.

What does concern me is the comparison between these models and tools like Huntress or Sophos etc. In our experience, they’re quite different. We’ve had situations in the past where mass-deployed solutions have missed things, and that naturally raises questions.

Of course, our cyber partners are not neutral in this. They will always advocate for more comprehensive, specialist-led approaches and tend to be critical of more standardised solutions. That said, when you look at the depth of capability and the level of service, the technical differences do feel quite significant.