Resell White-Label SAT & ASM Across Your Client Portfolio

Why MSSPs run HailBytes SAT

Every MSSP client buying SOC 2 Type II, NIST CSF, HIPAA, PCI-DSS, or cyber-insurance compliance support (and ISO 27001 for international clients) is required to demonstrate periodic security awareness training and phishing simulation. The auditor demands it, the cyber-insurance carrier demands it, and increasingly the client’s board demands it. That means the SAT line item is one of the highest-attach, highest-renewal SKUs an MSSP can carry, provided the platform underneath it has the right cost structure.

Per-seat SaaS platforms like KnowBe4 and Proofpoint Security Awareness price for direct enterprise sales, not for white-label resale. By the time you mark up their per-seat license enough to cover your program-management cost, the client is netting numbers that do not justify the program.

HailBytes SAT prices per vCPU, not per seat. One marketplace instance handles unlimited users and hosts many client organizations, so the cost basis is the instance divided across your book. Adding seats to an existing client costs you nothing, and your gross margin on a 500-seat client looks nothing like it does on a per-seat reseller agreement.

The platform deploys to your AWS or Azure account (or the client’s, depending on your service model) in minutes via the marketplace listing, and tears down cleanly when a client churns. Two shapes, chosen against the client MSA:

• Dedicated instance. In the single-instance and HA per-client topologies each client gets a clean VM and database boundary: no shared infrastructure, and no risk of campaign data crossing client lines.
• Consolidated instance. One instance carries multiple client organizations when you operate the platform, with row-level data isolation, per-client sending identities, and per-client hostnames. Clients receive scheduled reports and certificates rather than logins. This shape is materially cheaper per client, and isolation is enforced in the application rather than by separate VMs and databases.

A client that requires its own branding, its own identity provider, or self-service administration needs a dedicated instance. Review your client MSA requirements before choosing a shape; the topology comparison below has the detail. Reporting is CSV-exportable either way and feeds whatever client-facing template you already use.

4 minutes - explore HailBytes SAT →

Why MSSPs run HailBytes ASM

Attack surface management is the other half of the managed-service book: continuous external recon that surfaces a client’s exposed subdomains, ports, services, and vulnerabilities between point-in-time pen tests. For MSSPs it carries the same economics as SAT: priced per vCPU, not per asset or per seat, so one instance covers a client’s entire attack surface no matter how many domains they run.

The resell economics mirror SAT: a flat per-instance software fee (plus your own cloud bill, which the marketplace meter does not cover) with your managed-service fee on top, and AWS CPPO / Azure MPO margin on the platform itself. Adding ASM to a compliance bundle alongside SAT turns a single client engagement into two high-attach, high-renewal SKUs on the same deployment substrate. Model both on the portfolio calculators below, and see the ASM Solution Brief for per-client architecture and operations detail.

The two conversations to have first

Most MSSPs evaluating HailBytes SAT need answers to two specific questions before they’ll commit to standing up the first client instance. We wrote articles on both:

• What does the white-label margin actually look like at scale? Concrete tier math, a sample 200-seat P&L showing why small clients are loss leaders without the right tier mix, and the renewal mechanics that make a compliance-driven SAT line item one of the stickiest SKUs in a managed-service book.
• How do you run multi-client deployments operationally? Multi-client deployment architecture, template management across clients, role-based access for client security teams, and the reporting cadence that scales without burning analyst time.

If you’d rather scope white-label terms on a call than read about it, the HailBytes SAT product page has a 15-minute demo slot. We’ll walk through your client portfolio and build a tier-mix recommendation on the call.

Which deployment topology fits your service model?

The shape follows the client MSA. All four come out of the official Terraform modules at github.com/HailBytes/hailbytes-terraform-modules (MPL-2.0): consolidation is a matter of how many organizations you create on an instance, not a different module.

The meter rate is identical across all four ($0.24/vCPU-hour); what changes is how many vCPU you run and what sits underneath them. The marketplace meter is a software fee only: deployments are Bring-Your-Own-Cloud, so the VM, database, storage and networking land on your own AWS or Azure bill. Cross-cloud parity is intentional, and AWS HA and Azure HA land within ~6% of each other at procurement-grade sizing. Full topology comparison and customer-shape examples →

Software fees are the published marketplace list rate at $1.92/hour for 8 vCPU. Annual commitments take 30% (1-year, paid upfront), 35% (2-year), or 40% (3-year) off list via private offer. The cloud column is your own bill, estimated at ~$35/vCPU/month for the whole stack (VM, PostgreSQL, Redis, storage) and varying by region and reserved-instance pricing.

Sizing on this ladder is throughput, not a client-organization cap: we do not publish a maximum number of client organizations per instance, because we have not measured one. Size to your aggregate send volume and target count. This is the SAT ladder; the same “no published count” rule applies to ASM, where a client that logs in or needs its own brand takes its own instance, typically 8 vCPU.

Data residency, per client

A single MSSP book can hold a HIPAA-covered US client, a GDPR-subject EU client, and a NYDFS-regulated financial client at the same time, and each will ask “where is our data stored?” on the first procurement call. Because HailBytes is a Bring-Your-Own-Cloud marketplace image, you can answer all three cleanly:

• Region per deployment. Each client’s instance deploys into the AWS or Azure region you pick: a marketplace parameter, or the region variable on the Terraform module. An EU client lands in an EU/EEA region; a US/HIPAA client in a US region (including AWS GovCloud and Azure Government); Latin-American clients in sa-east-1 or brazilsouth.
• Isolation guarantee. The full stack runs inside your, or the client’s, own cloud account. After deployment, scan data, target lists, and campaign results never transit HailBytes infrastructure, and residency is verifiable from that account’s own CloudTrail or Activity Log. The instance boundary is the data boundary.
• Certifiable per client. Because residency is a property of each client’s own tenant, you can certify to each client that their data stays in-jurisdiction: the precondition behind the GDPR, HIPAA, and NYDFS 500 evidence the compliance reports produce.

This mirrors the data-sovereignty model on the enterprise page (“Your Cloud Account. Your Data.”); GDPR DPA terms for client data you process are in the HailBytes DPA.

Resell through AWS CPPO or Azure Multiparty Private Offer

The marketplace path most MSSPs miss until late in evaluation is the channel-partner private-offer flow on both clouds. It is what lets you mark up the platform itself, capture the resale margin, and have the customer’s purchase still count toward their EDP or MACC commit, without the customer having to onboard HailBytes as a new vendor:

• AWS Channel Partner Private Offers (CPPO): HailBytes, as seller of record on the listing, issues you a resale authorization keyed to your AWS account, scoped to SAT and/or ASM, with a minimum acceptable price. You set the resale price, AWS splits proceeds (wholesale to HailBytes, margin to you), and the purchase decrements the customer’s EDP commit.
• Azure Multiparty Private Offer (MPO): the Microsoft equivalent. One private offer across three parties, decrementing the customer’s MACC commit, with co-sell credit to the Microsoft account team.

What that looks like in unit economics, on a 32 vCPU consolidated instance:

• $67,300/year in HailBytes software fees at list, or $47,110 on a 1-year commitment.
• Up to 20% resale margin, taken off the post-discount net the customer actually pays: about $9,400/year on the committed net, or ~$13,400 if the customer buys at list.
• Zero incremental service-delivery cost, layered on top of your managed-service ARR.

Margin scales with what the customer spends, so a book of dedicated per-client instances carries proportionally more of it, and costs the customer proportionally more. The customer sees one cloud invoice, their CFO sees committed-spend drawdown, and you keep the platform margin as well as the service margin.

Register on the partner program page with your AWS account ID or Azure tenant ID and we’ll issue resale authorization. First private offer usually ready within one business day. Full mechanics, worked examples, and procurement-language scripts are in the SAT Partner Brief (PPTX, download) and the ASM Partner Brief (PPTX, download).

Model your portfolio margin

Plug in your own numbers. HailBytes prices per vCPU on a shared instance, not per seat, so the cost basis is the instance divided across your book while a per-seat platform scales with every client’s headcount. All math runs in your browser, nothing is sent anywhere.

What the math looks like

Like the numbers? Book a scoping call to pressure-test them against your portfolio, or see the partner resell page for the annual commitment discount tiers and CPPO/MPO mechanics.

Value delivered per client (ASM)

Margin is the supply side of the story; the demand side is the answer to the question you get at every QBR: “What did this give us?” Each automated ASM scan replaces roughly two analyst-hours of manual recon: subdomain enumeration, port sweeps, screenshot review, and vulnerability triage. That heuristic is the same 2h/scan default ASM uses internally to compute usage ROI. In the product it is a fixed constant, surfaced alongside the numbers it produces so you can sanity-check it against your own time studies; the input below is where you replace it with your team’s reality. Pair it with cost-per-finding and you have a defensible answer that beats per-seat or per-engagement framing.

Estimates only, for internal modeling, not a quote. The 2h/scan default mirrors ASM’s internal MANUAL_HOURS_PER_SCAN heuristic, which is fixed in the product and editable here. The $75/hr blended analyst rate is an editable placeholder, not a rate HailBytes publishes or stands behind: put your own loaded cost in. ASM’s billing dashboard also reports per-project attributed cost and cost-per-finding, on the operator-only screen described below.

Why bundle ASM and SAT for the same client?

HailBytes is one of the only vendors that ships both an attack-surface-management platform and a security-awareness-training platform. For an MSSP selling compliance bundles, that means you can hand a single client’s auditor one evidence package that covers both the human layer and the technical layer: from one vendor, with consistent audit-log formats, under your white-label branding. Same per-vCPU marketplace meter, same CPPO/MPO resale path, one renewal conversation.

When you run both products for a client, the combined branded PDF reports and structured audit logs go straight to the auditor, no reformatting, no second vendor to onboard. Read the full SOC 2 + PCI-DSS evidence walkthrough →

Both walkthroughs are embedded higher up this page and are click-to-play, so nothing loads until you start them: the 4-minute SAT walkthrough and the 11-minute ASM walkthrough. The ASM one was recorded with several clients as Projects on one instance, which is the shape we run where clients receive reports rather than logins; read it alongside the tenancy note above.

Inside the operator console

Unmodified screenshots of the shipping UI, at the places an MSSP evaluator usually wants proof rather than prose. Open any of them full-size in a new tab.

Sample deliverables

The claims further up this page (branded PDF reports, audit-trail CSVs, SARIF and REST exports) are configuration screens and export buttons in the product, so here they are: