MSSPVulnerability Management
26.10.26
5 min read
Vulnerability management means different things to different clients. One expects you to patch everything. Another expects a monthly report. A third patches its own servers and wants you for the rest. If the scope is not written down, the first unpatched server becomes an argument. The cure is to sell three clear levels, find, coordinate and fix, and put the level in the contract.
I'm Richard Daly, Partner Lead for the UK and Ireland at Nanitor. This is the third post in a series on what stalls MSP vulnerability management. The first post covers all five problems. This one is about scope.
The words sound the same but promise different things. It can mean scanning, ticketing, patching or all three. Clients fill the gap with their own assumptions, and the assumptions are usually generous.
There is a commercial side too. If the contract only pays you to find problems, then finding problems is all you can do. Clients then ask why they pay for something they could run themselves. Scope fixes both. You say what you will do, they pay for it and everyone knows what happens next.
| Level | What the MSP does | What the client does | Proof you give |
|---|---|---|---|
| Find | Discovers assets, scans and reports exposures | Decides and fixes | Asset list and exposure report |
| Coordinate | Ranks the work, raises projects and tracks them to closure | Approves changes and fixes some items | Projects with owners, dates and progress |
| Fix | Remediates within agreed windows | Approves downtime and exceptions | Before and after evidence |
Price each level separately. A client who starts at Find can move up as trust grows, and that growth is recurring revenue. VISO, a Dublin-based security firm, runs three managed tiers (Foundation, Core and Advanced) on one Nanitor platform, billed on recurring contracts.
Co-managed means shared responsibility, and shared responsibility fails without names. Use a RACI for each step. RACI stands for responsible, accountable, consulted and informed.
Cover at least these steps:
Agree the rules once, together. Nanitor's technical policy lets you record security baseline settings, with built-in CIS and NIST benchmarks as a starting point, so both sides sign up to the same definition of acceptable. The final baseline is still yours and the client's to decide.
Find. The asset inventory discovers devices on the network, including ones without a Nanitor sensor, and flags devices that are unmonitored or have stopped reporting.
Coordinate. Remediation management groups work into projects with one owner and a due date, and updates progress when it detects a fix.
Fix. Your RMM or patching tool applies the update. Nanitor does not. It confirms that the issue is gone.
That split is deliberate. Each tool does what it is good at, and the contract says who owns each step.
Clients buy levels, not scans.
Want to see how each level looks in practice? The quickest way is to try it on your own estate. There is no commitment. Qualified MSPs can get a proof of concept or trial directly from our partner team, and we can usually get someone on the phone with you today. Tell us you are an MSP and the team takes it from there.
Prefer to look around first?
Define the service level (find, coordinate or fix), the assets covered, fix windows by severity, how exceptions are approved, the reporting rhythm and what is out of scope. Writing these into the contract prevents disputes about who is responsible when a system stays unpatched.
It depends on what the contract says, which is why a RACI matters. List each step, from discovery to verification, and name who is responsible, accountable, consulted and informed. Include who approves downtime and reboots, because that is where most disputes start.
No. An MSP can offer a find-only service, a coordinate service that tracks fixes to closure, or a fix service that remediates within agreed windows. The level should match what the client pays for and be written into the contract.
Nanitor detects automatically when an issue is fixed and updates the remediation project's progress, so there is no manual check-off. The MSP can then show the client a project with an owner, a due date and a completion status.
