The vCISO Tool Is Dead. MSPs Now Need a Security Growth Platform.
What started as assessment-and-report software has to grow up — or get replaced by something that actually runs a security practice.
Three years ago, if you were an MSP building out a cyber practice, the buying conversation was simple: which vCISO platform do I pick? The category made sense at the time. You needed an assessment engine, a reporting layer, maybe a half-baked compliance module stapled to the side. Ship a pretty PDF to the customer, charge a retainer, move on.
That shorthand has aged badly.
In practice, the work an MSP signs up for now barely resembles what those tools were built to do. The customer doesn't want a risk report. They want someone to tell them whether their Microsoft 365 tenant is going to get drained next quarter, whether their CMMC assessor is going to fail them, and whether the EDR alerts piling up in the SOC queue mean anything. That is not assessment software. That is a practice.
The failure mode here is familiar to anyone who's watched a category mature. Vendors that nailed the v1 problem — turn a NIST CSF spreadsheet into a client-facing deliverable — are now trying to retrofit ticketing, continuous monitoring, attack surface data, and compliance evidence collection into a tool that was architected for quarterly reviews. It shows. Integrations are brittle. The data models assume point-in-time snapshots. Anything resembling actual operational telemetry gets bolted on through a partner API and prayed over.
The more honest label for what the market actually needs is a Security Growth Platform. Not vCISO software. Not GRC-lite. Something that runs the full lifecycle an MSP sells against: assess, advise, implement, monitor, prove, renew. With the data plumbing to back it up.
What that looks like operationally:
- Continuous evidence collection from the tenants the MSP already manages (Entra, Defender, Workspace, AWS Organizations), not annual questionnaire theater.
- A workflow layer that turns findings into engineering work the MSP's own techs execute, with margin attached.
The vendors that figure this out won't be the ones with the slickest risk-register UI. They'll be the ones who treat the MSP as an operator, not a consultant generating decks. One thing the post-mortem on this category will say, eventually: the tools that called themselves vCISO platforms optimized for the sales motion, not the delivery motion. That gap is where churn lives.
Operational takeaway: if your vCISO tool can't tell you the current MFA coverage across every client tenant without a human exporting a CSV, it's not a platform. It's a reporting layer with ambitions.
