# How Identity Drives MSP Profitability: An Analyst’s Perspective > Source: > Published: 2026-08-14 16:17:36+00:00 Forward by Gary Hall, VP, Global Ecosystem Strategic Partnerships The security landscape for managed service providers has fundamentally shifted as identity has become the primary control surface. We are now in an era where AI-assisted social engineering and stolen credentials allows attackers to bypass traditional defenses by logging in rather than breaking in. This makes protecting the identity plane the single highest priority for SMB and midmarket customers, particularly as the rise of machine identities creates a new, ungoverned attack surface. For current managed security providers, the primary challenge is the operational tax of vendor sprawl. Managing a fragmented stack of security tools drains engineering hours and hinders profitability. Cisco’s Secure MSP Center resolves this by providing a single, multi-tenant operating layer that allows you to consolidate telemetry and manage diverse tenants from one interface, directly improving your gross margin by reducing the cost to serve. For those primarily focused on managed networks, this transition is the most significant opportunity to move up the value chain. By integrating Cisco Duo into your service offering, you can deliver phishing-resistant MFA and identity-first defense that layers seamlessly over existing customer environments, addressing the urgent need to govern both human and the rapidly growing number of non-human machine identities. By leveraging consumption-based models and NFR licensing, you can prove value immediately and build a predictable, high-margin revenue annuity. This shift also aligns with the recent launch of the Cisco 360 Partner Program, which prioritizes operational maturity and capability over raw volume. I encourage you to read the following article from one of our valued analyst collaborators, Anurag Agrawal at Techaisle for more detailed market insights and to understand how to structure your practice for this next phase of growth. **The Identity Profit Stack: How Cisco’s Secure MSP Center Turns the SMB Security Imperative into Recurring Margin** By: Anurag Agrawal, Founder and Chief Global Analyst, Techaisle For partners serving the SMB and midmarket, the security conversation has changed in a way that resets the profit equation. Security has stopped being a discretionary line item that customers fund when they get around to it. The reason is not abstract. Identity-related attacks have moved to the center of how breaches happen, and attackers armed with stolen credentials and AI-assisted social engineering increasingly bypass multi-factor authentication by logging in rather than breaking in. The control surface that buyers most need to defend has shifted from the network to the identity itself, and the budget is following suit. Techaisle’s 2026 SMB and Midmarket Security study shows that the organizations these partners serve are not only spending more on security, but also restructuring how they buy it. Over 60% of Core Midmarket organizations plan to increase security budgets by 5% or more in 2026, and 28% of the Upper Midmarket plan to increase budgets by more than 15%. The pattern reads as a structural reset rather than a fear-driven spike. Buyers have accepted that breach inevitability has moved downmarket, and that identity is now the control surface that matters, which is why protecting the identity plane ranks as the single highest security priority across the SMB market. For the smaller partner and the MSP, that reset is the largest unclaimed annuity in the channel. The question is whether the partner has the architecture to capture it. **Trusted Identity Is the New Anchor for Managed Services** For 20 years, the partner economic model leaned on the network. The new model leans on the user, the device, and increasingly the agent. MFA is now table stakes, present at 71% of small businesses, 87% of Core Midmarket, and 94% of Upper Midmarket. A partner can no longer lead with the fact that they have MFA and expect to be paid a margin for it. The growth layer sits one tier above. Privileged access management (PAM), which controls and audits the high-value administrative accounts attackers most want, and identity threat detection and response (ITDR), which watches the identity system itself for signs of compromise, are climbing fast alongside identity governance. ITDR alone has moved from 9% adoption in small businesses to 49% in the Upper Midmarket. Risk-based access has crossed 50% in the Core Midmarket. Passwordless sits at 32% in Core Midmarket and 48% in Upper Midmarket, with another 30% planning. These are budget-funded production rollouts with named operational owners, not pilots. Above all of it sits the line that will define 2027: machine identity. Only 4% of small businesses, 19% of Core Midmarket, and 38% of Upper Midmarket manage non-human identities today. Every API call, automated workflow, and agentic AI deployment mints a new non-human identity that is highly privileged and rarely governed. This is where identity sprawl goes next, and the gap between how quickly these identities are being created and how slowly they are being governed is what should worry an operator. This is the point at which Cisco Duo stops being a product line in the catalog and becomes a foundational offer that the partner can build a practice on. Duo is a security-first identity platform, which is to say that the protections that matter most, phishing-resistant MFA and device trust, are part of the base rather than premium add-ons bought later. It can run as a customer’s primary identity provider or sit on top of one they already operate, adding strong authentication and trust signals to a directory the partner does not have to replace. Techaisle’s 2026 channel research shows that 54% of security-relevant partners already offer some form of IAM service, yet adoption of advanced identity controls falls off sharply in the small-business segment once SSO is in place. The demand is real. What has been missing is a low-friction way to package, deliver, and scale the offer without having to rebuild the stack every 12 months. That low-friction path is what makes Duo workable for the customer, and an SMB-focused partner actually has: brownfield, mixed, and rarely tidy. Duo layers onto existing environments without a rip-and-replace, works alongside whatever identity provider is already in place, securing the directory the customer already runs, rather than competing with it. As an external authentication method, it can extend strong, phishing-resistant authentication to BYOD and unmanaged endpoints without requiring every device to undergo heavier enrollment first. In February 2026, Cisco added Active Directory Defense, which closes one of the most stubborn gaps in this segment by bringing MFA and identity visibility to on-premises Active Directory and the legacy protocols, Windows Logon, RDP, Kerberos, and NTLM, that modern controls have historically struggled to reach. On-premises identity is where attackers concentrate precisely because it is the hardest surface to cover, so for partners serving customers still anchored to that infrastructure, this is a concrete reason to lead the conversation, and the deeper posture visibility that rides with it in the Advantage tier gives the partner something to sell past the first deal. Most of this can be stood up in days rather than months. For the MSP, that is the difference between a one-time identity sale and a multi-year managed identity practice. **The Margin Drain Inside Point-Solution Sprawl** Identity is the front door. Margin actually leaks in the back office of the MSP business. Techaisle’s research shows that 38% of Upper Midmarket organizations now manage more than 13 distinct security vendors, and 78% are actively working to cut that number over the next 12 to 24 months. Two-thirds of the Core Midmarket is moving in the same direction. This is an operational forced move, driven by alert fatigue, integration cost, and license overlap, and it is ending the era of the isolated point product. For the MSP, vendor sprawl on the customer side shows up as tool sprawl on the operator side, and every additional management console is a tax. The partner pays it twice: once in license fees and once in the engineer hours that should be billable, but instead disappear into context switching between dashboards. Techaisle’s MSP segment reports mean security revenue at 26.1% of total revenue, the highest of any partner type. The revenue is real. The margin profile underneath it is held back by exactly this operational drag. This is the structural reason Secure MSP Center, Cisco’s multi-tenant management program for MSPs, matters. It gives the partner a single operating layer to manage diverse tenants and stack multiple Cisco security services in one place. Combined with Security Cloud Control, the partner can see across customers, deploy consistent policies, and consolidate operational telemetry without buying yet another aggregation tool to sit atop the ones already in place. When the cost to serve drops, gross margin on the same managed contract rises, and the MSP earns more on revenue it has already won. Multi-tenant architecture also enables the delivery of customer activation milestones at scale, and 80% of MSPs in Techaisle’s 2026 channel study rate solution adoption bonuses tied to those milestones as critical or very important. **The Consumption Lever and the NFR On-Ramp** Here is the mechanism that turns identity into margin rather than another line on the invoice. Cisco’s usage-based buying programs let the MSP attach identity to a customer and grow the license as the customer book grows, so cost follows revenue instead of running ahead of it. The partner connects identity into the broader Cisco portfolio without committing to capacity it has not yet sold, and the rebate engine compounds as consumption scales. Predictability replaces the capacity gamble that once sat at the front of every deal. The market data explains why this matters more than a discount. Techaisle’s lifecycle incentive analysis ranks consumption-based rebates as critical or very important for 67% of MSPs. Higher renewal and upsell commissions outrank front-end discounts as a margin driver across every partner type, and the MSP segment rates them at 77%, while only 13% of MSPs consider front-end discounts differentiating at all. The channel has been clear about what actually moves the margin, and it is not the price at deal close. The NFR licensing layer is the underused multiplier. Not-for-resale licensing lets the partner set up the environment, run live demos, and deliver proof of value before the customer commits a dollar. For an SMB buyer trained by years of overpromising to distrust the pitch, a working proof of value is the fastest path to trust. After that, scaling is mechanical. As the customer book grows, the consumption license grows with it, and the rebates accumulate on top. **Connecting Back to 360 and the Path to Maximum Profitability** The Cisco 360 Partner Program rewards capabilities, engagement, and validated maturity rather than raw bookings volume, and leading the customer conversation with an identity-led security stack moves a partner through that index faster, in ways that specifically favor smaller partners. Foundational identity work creates clean entry points into the Onboard, Adopt, and Expand engagement metrics. Multi-tenant management proves out Managed Services Practice Maturity sooner, because the operational evidence already lives in the platform. Consumption-based motions fuel the booking growth and customer expansion lines against which the Cisco Partner Incentive is paid. And because Duo drops into brownfield environments and layers on top of what the customer already runs, the partner does not have to wait for a full architecture refresh to start. The engagement clock starts on the next renewal cycle, not 5 years out. The Partner Experience Platform is the visibility layer that makes the progression legible. I had the chance to see PXP up close, including the partner value index dashboards, the eligibility view across portfolios, the index navigator that shows how each metric is calculated, and the trending heat maps that tell a partner exactly where they are gaining or losing index points month over month. The platform was co-designed directly with partners, and the next-generation experience adds AI agents that surface risks and opportunities rather than making partners dig for them. For the smaller partner, this matters more than it does for the large integrator. Visibility into program standing used to be a luxury reserved for partners big enough to staff a dedicated program operations team. Cisco has made it the default infrastructure. Techaisle’s research shows 72% of MSPs rate real-time dashboard visibility into earned incentives as critical or very important, and 74% rate transparency into how incentives are calculated and who is eligible at the same level. PXP answers both. **The Smarter Partner Plays the Whole Stack** For the SMB and midmarket, the security imperative is already here, priced into this quarter’s pipeline rather than waiting in a forecast. The buyer has crowned identity the new perimeter. Vendor consolidation has moved from hypothesis to an active 12-to-24-month execution plan within three quarters of the Upper Midmarket. And the consumption-based, lifecycle-rewarded partner economy is the model the rebate engines are now built around. For the smaller Cisco partner and the MSP, the move is not to fight the largest integrators on breadth. It is to lead with the deepest and most defensible offer the SMB and midmarket actually want to buy: a foundational identity layer in Duo, a multi-tenant operating model in Secure MSP Center and Security Cloud Control, a consumption-based on-ramp that protects cash flow, and a 360 alignment that pays the partner for the operational maturity it is already building. The partners who assemble that stack in 2026 are not chasing a security trend. They are constructing the recurring revenue annuity that will set their valuation in 2028. We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with #CiscoPartners on social! [Cisco Partners Facebook](https://www.facebook.com/CiscoPartners?dtid=oblgzzz001087) | [@CiscoPartners X](https://twitter.com/CiscoPartners?dtid=oblgzzz001087) | [Cisco Partners LinkedIn](https://www.linkedin.com/showcase/cisco-partners?dtid=oblgzzz001087)