White-Label SAT Margin Economics: How MSSPs Price Phishing Simulations Profitably

The most common reply we get from MSSP buyers evaluating HailBytes SAT is some variation of: “What does the white-label margin actually look like at scale?” It’s the right question. An MSSP isn’t buying a security awareness training platform to run on their own staff. They’re buying a billable line item they can attach to every SOC 2, HIPAA, and cyber-insurance compliance package they sell. The platform earns its place in that bundle on margin and renewal mechanics, not feature checklists.

What follows is the unit economics. Concrete pricing tiers, a sample 200-seat P&L, the 30/35/40% annual-commitment ladder that sets your wholesale cost basis, the renewal dynamics that make SAT one of the stickiest add-ons in an MSSP catalog, and the cost structure that lets you bid against KnowBe4 and Proofpoint without compressing margin to zero.

Why the per-seat SaaS model breaks for MSSPs

KnowBe4 and Proofpoint Security Awareness sell direct to enterprises at an estimated $18–$30 per user per year. Neither publishes list pricing, so treat that as a benchmark from reseller listings and buyer-reported deals rather than a price sheet — our own comparison matrix carries a higher $25–$50 band, and the maths below deliberately uses the low end because that is the end that favours the competitor. When an MSSP tries to resell at those rates the math falls apart fast: you’re paying roughly $18 in cost to sell something at $25 to your client, netting maybe $5–$7 per seat with all of the program-management cost coming out of that thin slice. At 500 client seats that’s $2,500–$3,500 of gross margin annually, and you still have to write the campaign calendar, build the report, sit on the kickoff call, and answer the auditor questions.

HailBytes SAT prices on infrastructure, not seats. The marketplace meter is $0.24/vCPU-hour on both AWS Marketplace and Azure Marketplace, the smallest configuration we sell is 8 vCPU ($1,400/month, $16,800/year at list), and one instance handles unlimited users. Just as importantly, one instance handles more than one client: one instance carries multiple client organizations when the MSSP operates the platform, with row-level data isolation, per-client sending identities, and per-client hostnames. That is what makes the unit economics work — the platform line divides across your book rather than being paid once per client.

Know the boundary before you build a pricing model on it. Clients that require their own branding, their own identity provider, or self-service administration need a dedicated instance. A shared instance carries one brand and one directory, both of them yours, and your clients receive reports rather than logins. That is not a tuning question, so sort your book into “happy to receive reports” and “needs their own portal” first, then price the two groups differently.

Run one client per instance and the numbers are unfriendly. $16,800 of software plus roughly $3,360/year of cloud infrastructure is $20,160/year all-in for the smallest deployment, or $15,120 on a one-year commitment paid upfront, and $18 × 500 seats is only $9,000. On that all-in basis, per-seat SaaS is genuinely cheaper than a dedicated HailBytes instance below roughly 1,120 seats at list, or 840 on a one-year commitment. Consolidate instead and the allocated platform cost lands at roughly $1,320–$4,080 per client per year all-in — $1,100–$3,400 of software plus infrastructure in the same proportion — which beats $18/seat somewhere between about 75 and 230 seats per client, and then stops scaling with headcount entirely. That band does not depend on which rung of the ladder you sit on: the tenancy relationship is linear, so a larger instance carrying more organizations lands in the same per-client range. We do not publish an organizations-per-instance number, because we have no measured basis for one.

That is the structural reason white-label SAT can be sold at margins per-seat SaaS vendors cannot match — but only on the consolidated shape. They can’t cut their own pricing to your reseller cost without nuking their direct-sales motion. You can charge what the market bears and keep the spread, provided you are not paying for an idle instance per client.

Three pricing tiers MSSPs actually win with

The following tiers come from what we see MSSPs successfully selling on HailBytes SAT today. Adjust the numbers to your market, but the structure holds.

Tier 1: Compliance Baseline ($2–$4 per user/year)

Quarterly phishing campaigns, standard template library, summary report sized for an auditor. This is the SKU you attach to every SOC 2 Type II and HIPAA engagement automatically. Most clients in this tier never log into the platform. They just need an evidence packet at audit time. Low touch, high attach rate, and margin that lives in volume.

Tier 2: Active Program ($5–$8 per user/year)

Monthly campaigns, industry-specific templates (healthcare, finance, SaaS), department-level reporting, repeat-offender tracking, and a recurring quarterly readout call with the client’s security or IT lead. This is the pricing tier where MSSPs build real recurring revenue. The client feels actively managed; you feel like you’re running a service, not just resending CSV exports.

Tier 3: Premium / Executive Coverage ($10–$15 per user/year)

Everything in Tier 2, plus targeted spear-phishing campaigns for executives and finance teams, custom-branded templates per client, one-on-one remediation coaching for repeat offenders, and audit-ready evidence packages mapped specifically to SOC 2, HIPAA, ISO 27001, NIST CSF, or PCI DSS controls. This is the tier you sell into regulated industries and clients with cyber-insurance carriers asking pointed questions about user training.

Sample P&L: 200-seat client at the Active Program tier

Concrete numbers, mid-market client, annualized, at list prices, running in the MSSP’s own AWS or Azure account. Two shapes side by side, because the choice between them now dominates the result: the client as one organization among several on a shared instance, and a dedicated 8-vCPU instance for that client alone (m6i.2xlarge / Standard_D8s_v5). The shared column uses the top of the per-client band — $3,400 of software and $680 of infrastructure — because that is the pessimistic end and we would rather understate the margin than overstate it; the note under the table gives the other end. Cloud infrastructure is the whole-stack rate of roughly $35/vCPU/month covering VM, managed database, cache and storage; deployment shapes per COST_SHAPES.md in the Terraform modules repo. Instance families and prices drift, so revalidate before you quote.

Two sensitivities worth running. At the optimistic end of the consolidation band — $1,100 of software and $220 of infrastructure — the shared column improves to −$1,780. And a one-year commitment paid upfront takes 30% off the software line, delivered as a private offer, moving the shared column to −$3,520 (or −$1,450 at the optimistic end) and the dedicated column to −$15,580. A three-year commitment takes 40% off instead. All of that narrows the gap; none of it closes it at 200 seats.

That math says loudly what every MSSP service-line lead already knows: small clients do not work at $6/user/year if you carry the marketplace meter yourself, and they are catastrophic on a dedicated instance. There are three ways out, and most MSSPs blend them:

1. Pass the marketplace meter through to the client via AWS CPPO or Azure MPO. The client buys the marketplace subscription on their own AWS / Azure invoice (under your resale authorization), pays the per-vCPU meter from their EDP/MACC committed spend, and you charge a clean managed-service fee on top. That removes the entire platform line — both the meter and the infrastructure — from your P&L. Your gross margin on the 200-seat client goes from −$4,540 to −$460 ($1,200 revenue + $500 setup − $2,160 analyst time), so the setup fee is what lands you positive in year one and you need to recover the analyst line in year two. Note the trade-off: pass-through means the instance runs in the customer’s account, so this client cannot also sit on your shared instance. You get the resale margin or the consolidation saving, not both.
2. Move 200-seat clients to Tier 1 ($3/user/year, quarterly campaigns, automated reporting) and pass the meter through. Revenue $600 + $500 setup − $1,080 analyst time (1 hr/mo at the same $90/hr loaded rate) = +$20 in year one and −$480 in year two once the setup fee is gone. An earlier version of this list showed $380 here by quietly using a $60/hr rate for this tier only; on one consistent rate, Tier 1 at 200 seats does not carry itself. Either automate the hour out of it, charge a recurring rather than one-off onboarding fee, or set a seat floor.
3. Run Tier 2 at ~1,000+ seats on the shared instance when you absorb the meter: 1,000 × $6 = $6,000 revenue against the allocated platform cost and 2 hr/mo analyst time ($2,160). At the pessimistic end of the consolidation band ($4,080) that nets −$240 — effectively breakeven — and +$2,520 at the optimistic end ($1,320); on a one-year commitment the pessimistic case turns positive at +$780. On a dedicated instance the same breakeven does not arrive until roughly 3,720 seats at list, or 2,880 on a one-year commitment, which is why consolidation is not optional. With CPPO/MPO pass-through the platform line disappears entirely and you net +$3,840 gross at 1,000 seats.

Where the model really earns its keep is at 2,000+ seats with the meter passed through via CPPO/MPO: 2,000 × $6 = $12,000 in annual managed-service revenue, the same fixed analyst-time line ($2,160), and the customer carries the per-vCPU meter on their committed cloud spend. Net margin is $9,840 per client, and every client at this tier is a multi-year compliance customer.

For clients that need an uptime SLA (regulated industries, healthcare, financial services), step up to the HA hot-hot shape — two 8-vCPU nodes, 16 metered vCPU, so $2,800/mo of software plus ~$560/mo of infrastructure, about $3,360/mo all-in — and price the bundle higher to match. For MSSPs consolidating a book onto shared infrastructure, the auto-scaling shape starts at a two-node baseline of identical 8-vCPU nodes (16 metered vCPU, $2,800/mo software plus ~$560/mo infrastructure before read replicas, about $3,360/mo all-in, with each further node adding $1,400/mo of meter) and amortizes the platform line across the book rather than per client, and the per-client outcome lands in the same $1,320–$4,080/year band as any other rung. The right shape is a function of the SLA the client wants, not the seat count.

The renewal mechanics no one talks about

Most MSSP product lines have a renewal-rate problem. Endpoint detection, SOC monitoring, vulnerability scanning: clients churn out when budget tightens or a competitor underbids you on a renewal. Phishing simulation is structurally different.

• The auditor demands it. SOC 2 Type II, HIPAA Security Rule, PCI DSS 12.6, ISO 27001 A.7.2.2, NIST CSF PR.AT: every framework your clients comply with explicitly requires periodic security awareness training. The client cannot drop the line item without a control-failure finding at their next audit.
• The cyber-insurance carrier demands it. Since 2022, every major cyber-insurance carrier has added phishing simulation and user training as a required control on policy renewals. Dropping it means a higher premium or a denied claim, both of which cost the client more than the SAT line item.
• The CFO can’t cut it without their CISO objecting on the record. Unlike most security spend, SAT has visible compliance evidence attached to every campaign. Cutting it requires the CFO to override the CISO in writing, which almost never happens.

Add it up and the picture is clear: MSSPs running HailBytes SAT report renewal rates above 95% on the SAT line item specifically, even when other parts of the bundle churn. That makes SAT one of the highest-LTV add-ons an MSSP can attach. The platform cost is fixed, the revenue is multi-year, and the only way the client leaves the line item is by leaving you for another MSSP, at which point they’re a churn problem rather than a SAT problem.

Cost basis: why the marketplace billing path matters

The HailBytes SAT marketplace listing on AWS and Azure puts the platform cost into a billing channel your clients (and your own finance team) already accept. Three things this gets you that direct vendor billing doesn’t:

• AWS EDP / Azure MACC committed-spend credits apply to the marketplace subscription. If your client has committed cloud spend they need to draw down, the SAT per-vCPU meter burns it down instead of coming out of discretionary opex. That alone closes deals that would have stalled at procurement.
• Procurement gets out of the way. No new vendor onboarding, no security review for a new SaaS app, no MSA negotiation. The cloud provider has already done that work. Net deal velocity for the line item goes from weeks to a click.
• Per-instance billing is predictable. Unlike per-seat SaaS where a client adding 50 users mid-year quietly increases your cost, an instance is an instance. You quote the client a per-seat rate and the unit economics don’t change underneath you.

The CPPO / MPO move: where the real MSSP margin lives

The biggest unlock for MSSPs running HailBytes SAT isn’t the per-vCPU price — it’s the channel-partner private-offer path on both clouds. AWS Channel Partner Private Offers (CPPO) and Azure Multiparty Private Offer (MPO) let HailBytes (the ISV / seller of record on the marketplace listing) authorize you as a reseller to extend a private offer to your end customer. You set the resale price — HailBytes wholesale plus your margin — and the term. The term is where the discount lives: a private offer written for one year paid upfront takes 30% off the meter, two years 35%, three years 40%. A publisher cannot discount a published marketplace metered rate, so the private offer is the only mechanism that delivers it. The customer transacts through their own AWS or Azure account, the purchase decrements their EDP / MACC committed spend, and the cloud provider splits the revenue: HailBytes gets the wholesale share, you keep the resale margin.

What this means for the unit economics:

• The per-client platform line in the P&L above moves to the customer’s cloud invoice. On a dedicated 8-vCPU deployment that is $20,160/yr of software plus infrastructure off your books per client; on the shared instance it is the $1,320–$4,080 allocated share, and that client leaves your instance.
• You add up to a 20% resale margin inside the private offer — taken off the post-discount net the customer actually pays, not off list. On a 20-client portfolio where each client buys an 8-vCPU one-year commitment ($11,760 net each), that is up to $47,040/year of resale margin with no service delivery work behind it. Written at the three-year rate ($10,080 net) the same 20% is $40,320/year — less margin per client, longer contracted term.
• You keep your managed-service ARR on top of that — campaign management, reporting, remediation coaching. Those services bill on your own MSA, not through the marketplace.
• The customer sees one cloud invoice with one private-offer line item. The Microsoft or AWS account team gets co-sell credit, which makes them allies on growing the deal. Procurement sees committed-spend drawdown rather than a new vendor relationship.

Setting up CPPO / MPO authorization is the lowest-effort, highest-leverage operational change an MSSP running HailBytes SAT can make. Register on the partner program page with your AWS account ID or Azure tenant ID and we’ll issue resale authorization — first private offer usually ready within one business day.

What this means for your sales motion

Three concrete operational changes most MSSPs need to make to capture the margin this product structure makes available:

1. Stop selling SAT à la carte. The product is a bundle attachment, not a standalone SKU. Every SOC 2 readiness engagement, every HIPAA program, every vCISO retainer should include SAT as a default line item the client opts out of, not into.
2. Tier by client size, not feature. Use Tier 1 for sub-1,000-seat clients (compliance-driven, low-touch, meter passed through). Use Tier 2 from roughly 1,000 seats up, which is where absorbing the meter on a shared instance reaches breakeven at the pessimistic end of the band and real contribution at the optimistic end. Use Tier 3 for any client in a high-regulation industry (healthcare, financial services, defense supply chain) regardless of size.
3. Charge a setup fee. A $500–$1,500 one-time setup fee covers your first-year analyst-time exposure on smaller clients and signals that you’re running a managed service, not a tool license. Clients who balk at a setup fee are the ones who will burn analyst time later in the relationship.