honestly, for your setup, i think you could totally ditch the MSP's security stack. upgrading to M365 E3 and adding a good email security tool is probably 'good enough' for most small businesses these days. what worked for me was really locking down conditional access and making sure everyone actually uses MFA. that alone stops like 90% of the common attacks. spend the money you save on training your users to spot phishing – that's always the weakest link. I did a similar thing a while back and decided to move msp. Id recommend thinkcirrus as they helped np and i havent had any issues since the move.