Cybersecurity · Software and SaaS
Cybersecurity resale, managed service and testing, each with its own margin
A cybersecurity firm can grow fast on licence resale and still earn most of its margin from a small managed-service and testing practice. We separate the streams, settle how resold licences should be presented, and cost each service contract from the analysts who deliver it.
In one paragraph
Cybersecurity firms come in three broad shapes: product resellers and system integrators, managed security providers running security operations centres, and testing and assessment practices. Most turn over ₹10–250 crore. Their owners and finance heads have to manage the mix. Low-margin, high-value licence resale sits beside high-margin, people-heavy services, and blending the two hides which business the firm is really in.
Founder or managing director, often with the finance head
The economics
How the money moves in this trade
Resale of firewall, endpoint and identity licences moves large sums for a thin margin. The firm buys from the OEM or a distributor, often in foreign currency or on back-to-back terms. It invoices the customer, sometimes for multi-year subscriptions paid upfront. Whether that revenue is shown gross or as the margin alone depends on who controls the product and carries the risk. The answer changes reported revenue considerably.
Managed security and testing work the other way. Invoices are modest, and most of the cost is skilled analysts who are expensive and hard to retain, round-the-clock shift rosters and tooling licences shared across customers. A managed-service contract priced on device count or log volume can turn unprofitable as the customer's estate grows. Nobody notices until the analysts are stretched.
The problem
Where the numbers usually break down
Resale presented without a principal-versus-agent view
Licence sales are shown gross by habit, with no documented basis for whether the firm acts as principal or agent.
Multi-year licences recognised at once
Upfront multi-year subscriptions are booked as revenue on invoice, while the support obligation runs over the full term.
Shared analyst and tooling cost unallocated
Security operations centre salaries and platform licences sit in overhead, so no managed-service contract shows its real margin.
Contract scope outgrows contract price
Devices, users and log volume grow inside fixed monthly fees, and the extra cost of monitoring them is never compared with the price.
OEM rebates and deal registrations untracked
Back-end rebates, marketing funds and deal-registration discounts arrive irregularly and are booked as other income, not against the deals that earned them.
What we do
The work, and the result each part produces
Revenue streams separated
Resale, managed services, testing and implementation reported as distinct streams, each with its own cost of revenue.
The margin of each line of business is visible.
Principal-versus-agent review
Each resale arrangement assessed on control, pricing discretion, inventory risk and credit risk, with the presentation documented for the auditor.
Reported revenue rests on a stated, defensible basis.
Term-licence recognition
Multi-year licences and bundled support split and recognised over the right period, with vendor cost matched to them.
Revenue and cost of multi-year deals move together.
Managed-service contract costing
Analyst shifts, tooling and platform cost allocated to contracts by monitored devices, log volume or alert count.
Each managed-service contract shows its margin as the estate grows.
Engagement costing for testing
Effort on assessments and penetration tests booked against each engagement and compared with the fixed fee.
Under-priced engagements are identified before they are repeated.
OEM rebate tracking
Rebates, deal registrations and marketing funds recorded against the deals and periods that earned them, with claims followed up.
Vendor money due is collected and attributed.
Where we start
The first steps of an engagement
OEM agreements and licence invoices
We ask for OEM and distributor agreements, licence purchase and sales invoices, managed-service contracts, analyst rosters and the device or log volumes your platform reports.
Revenue split by stream
Revenue and direct cost are separated into resale, managed services, testing and implementation. Multi-year licences are checked for deferral.
Principal-versus-agent position documented
Each resale arrangement is assessed on control, pricing discretion and risk, and the presentation is written up for the auditor.
Margin by stream and contract
The first report shows revenue and gross margin by stream, with managed-service margin by contract and OEM rebates outstanding.
How it is measured
The reports the work is judged on
Each is recorded as a baseline before the work starts, so later reports have an honest comparison.
- Revenue and gross margin by stream
- Resale margin by OEM and customer
- Managed-service margin by contract
- Analyst utilisation across monitoring and testing
- Deferred revenue on multi-year licences
- OEM rebates claimed, received and outstanding
Who it suits
Written for, and not the right fit for
- You need a security assessment or certification of your own controls; that is a security assessor's work, not ours.
- You need the statutory audit signed; an independently engaged CA does that.
- Security resellers and integrators adding managed and professional services.
- Managed security providers running a security operations centre for several customers.
- Firms preparing for investment or a bank limit in which reported revenue will be scrutinised.
Services
Services this work draws on
Costing and profitability
What each product, line and customer really contributes.
Explore service ↗Outsourced accounting
Your books kept current and reconciled, closed to a published calendar.
Explore service ↗MIS and financial planning
Reporting built around the questions you actually need answered.
Explore service ↗Internal controls and risk
Controls sized to your business, documented and actually tested.
Explore service ↗Every other service, also available in this trade
Common questions
Questions owners in this trade ask
Will showing licence resale net make us look smaller?
Reported revenue may fall, but margin percentages become meaningful and the business is judged on what it actually earns. More to the point, the presentation follows the facts of each arrangement. It isn't a free choice, and investors and auditors will test it either way.
How should security operations centre cost be allocated to contracts?
On a driver that tracks the work, such as monitored devices, log volume or alerts handled. The basis is agreed once, documented and applied consistently, so contract margins can be compared month to month.
Do you need access to customer security data?
No. We work from contracts, rosters, licence invoices and the volume metrics your platform already reports. We don't need access to customer logs or systems.
Explore further