Resell White-Label SAT & ASM Across Your Client Portfolio

Why MSSPs run HailBytes SAT

Every MSSP client buying SOC 2 Type II, NIST CSF, HIPAA, PCI-DSS, or cyber-insurance compliance support (and ISO 27001 for international clients) is required to demonstrate periodic security awareness training and phishing simulation. The auditor demands it, the cyber-insurance carrier demands it, and increasingly the client’s board demands it. That means the SAT line item is one of the highest-attach, highest-renewal SKUs an MSSP can carry, provided the platform underneath it has the right cost structure.

Per-seat SaaS platforms like KnowBe4 and Proofpoint Security Awareness price for direct enterprise sales, not for white-label resale. By the time you mark up their per-seat license enough to cover your program-management cost, the client’s netting numbers that don’t justify the program. HailBytes SAT prices per vCPU, not per seat: one AWS or Azure marketplace instance handles unlimited users, and one instance hosts many client organizations. The cost basis is the instance, divided across the book — so adding seats to an existing client costs you nothing, and your gross margin on a 500-seat client looks completely different than it does on a per-seat reseller agreement.

The platform deploys to your AWS or Azure account (or the client’s, depending on your service model) in minutes via the marketplace listing. In the single-instance and HA per-client topologies, each client gets a clean VM and database boundary — no shared infrastructure, no risk of campaign data crossing client lines — and the instance tears down cleanly when a client churns. One instance carries multiple client organizations when you operate the platform — row-level data isolation, per-client sending identities, and per-client hostnames, with clients receiving scheduled reports and certificates rather than logins — and that shape is materially cheaper per client. Isolation there is row-level and enforced in the application rather than by separate VMs and databases, and a client that requires its own branding, its own identity provider, or self-service administration needs a dedicated instance; review your client MSA requirements before choosing that shape (details in the topology comparison below). The reporting is CSV-exportable and feeds into whatever client-facing report template you already use.

4 minutes - explore HailBytes SAT →

Why MSSPs run HailBytes ASM

Attack surface management is the other half of the managed-service book: continuous external recon that surfaces a client’s exposed subdomains, ports, services, and vulnerabilities between point-in-time pen tests. For MSSPs it carries the same economics as SAT — priced per vCPU, not per asset or per seat, so one instance covers a client’s entire attack surface no matter how many domains they run.

ASM is a one-instance-per-client product today, and we would rather say so here than on your first PoC. Work is organized into Projects, each with a hard ProjectQuota (targets, concurrent scans, scans-per-day, monthly compute budget) and its own findings, exposure graphs, scheduled reports, and per-Project SIEM destinations. But recurring scheduled scans running across multiple client Projects on a single instance are not supported today, operator roles are instance-wide rather than Project-scoped, and the /billing/projects/ rollup is not access-gated per client. So for managed multi-client delivery, deploy one ASM instance per client — which is also the clean VM-and-database boundary most client MSAs ask for. Your own branding carries over from the SAT side, on the same instance-wide basis. Consolidating a book onto one shared instance is the SAT shape, not the ASM shape.

The resell economics mirror SAT: a flat per-instance software fee — plus your own cloud bill, which the marketplace meter does not cover — with your managed-service fee on top, and AWS CPPO / Azure MPO margin on the platform itself. Adding ASM to a compliance bundle alongside SAT turns a single client engagement into two high-attach, high-renewal SKUs on the same deployment substrate. Model both on the portfolio calculators below, and see the ASM Solution Brief for per-client architecture and operations detail.

The two conversations to have first

Most MSSPs evaluating HailBytes SAT need answers to two specific questions before they’ll commit to standing up the first client instance. We wrote articles on both:

• What does the white-label margin actually look like at scale? Concrete tier math, a sample 200-seat P&L showing why small clients are loss leaders without the right tier mix, and the renewal mechanics that make a compliance-driven SAT line item one of the stickiest SKUs in a managed-service book.
• How do you run multi-client deployments operationally? Multi-client deployment architecture, template management across clients, role-based access for client security teams, and the reporting cadence that scales without burning analyst time.

If you’d rather scope white-label terms on a call than read about it, the HailBytes SAT product page has a 15-minute demo slot. We’ll walk through your client portfolio and build a tier-mix recommendation on the call.

Which deployment topology fits your service model?

MSSPs land on one of four shapes depending on the client portfolio and what the client MSAs require. All of them deploy from the official Terraform modules at github.com/HailBytes/hailbytes-terraform-modules (MPL-2.0) — consolidation is a matter of how many organizations you create on the instance, not a different module:

• Consolidated (one instance, multiple client organizations) — the entry shape and the margin shape, and it works when you operate the platform and clients receive reports rather than logins. One 8 vCPU instance is $1,400/mo in software fees plus roughly $280/mo of cloud infrastructure; a 32 vCPU instance is $5,610/mo plus roughly $1,120/mo of cloud. Consolidated, per-client cost lands at roughly $1,100–$3,400/year in software fees plus your own cloud bill (about 20% on top at $35/vCPU/month) — the same range at every rung, because the meter and the cloud bill both scale linearly with vCPU. Isolation is row-level: separate organizations for campaigns, templates, landing pages, users and reporting, with per-client sending identities and hostnames, but a shared VM, a shared database, and one instance-wide branding and SSO configuration. Choose this only where client MSAs do not require database- or VM-level separation, and where no client needs its own brand, its own identity provider, or its own admins. We do not publish a maximum organization count per instance: there is no measured basis for one.
• Single instance per client ($1,400/mo software fee + ~$280/mo cloud ≈ $1,680/mo all-in) — Terraform: sat-aws-single / sat-azure-single. The isolation shape: a clean VM and database boundary per client, in either your AWS/Azure account or theirs, tearing down on churn via terraform destroy. A dedicated 8 vCPU instance is $16,800/year in software fees whether it serves one client or several, so reserve it for clients whose MSA requires physical separation, whose contract comfortably clears ~$1,680/month on its own, or who need their own branding, their own identity provider, or self-service administration — those three are only deliverable on a dedicated instance. It is also the shape we deploy for ASM.
• HA hot-hot per client ($2,800/mo software fee for the 2 × 8 vCPU pair, plus ~$560/mo cloud before the load-balancer and Multi-AZ database premium) — Terraform: sat-aws-ha / sat-azure-ha. For clients with formal uptime SLAs in their MSA (regulated industries, healthcare, financial services). Adds an ALB / Standard LB, Multi-AZ RDS / Zone-Redundant Postgres Flex, and shared Redis. Pre/post-patch SSM verifiers ship with the module so your rolling-update cadence is documented and auditable.
• Auto-scaling (one shared tenant, many clients — application-layer isolation) (from $2,800/mo software fee at the two-node baseline of 8-vCPU nodes — 16 metered vCores — plus ~$560/mo cloud before read replicas; each further node adds $1,400/mo of meter) — Terraform: sat-aws-autoscale / sat-azure-autoscale. Consolidation with elasticity, for regional MSSPs whose aggregate send volume outgrows a single node. Read replicas, rolling instance refresh with auto-rollback on 5xx, ElastiCache shared session store. Same row-level isolation posture as the consolidated shape above. Common for MSSPs running 100+ campaigns/month.

The rate is identical across all four shapes ($0.24/vCPU-hour); what changes is how many vCPU you run and the cloud infrastructure underneath them. The marketplace meter is a software fee only — deployments are Bring-Your-Own-Cloud, so the VM, database, storage and networking land on your own AWS or Azure bill, at roughly $35/vCPU/month for the whole stack. Cross-cloud parity is intentional: AWS HA and Azure HA land within ~6% of each other at procurement-grade sizing. Full topology comparison and customer-shape examples →

Software fees are the published marketplace list rate at $1.92/hour for 8 vCPU; annual commitments take 30% (1-year, paid upfront), 35% (2-year), or 40% (3-year) off list via private offer. Cloud infrastructure is your own bill, estimated at ~$35/vCPU/month for the whole stack (VM, PostgreSQL, Redis, storage) and varying by region and reserved-instance pricing. Sizing on this ladder is throughput, not a client-organization cap: we do not publish a maximum number of client organizations per instance, because we have not measured one. Size to your aggregate send volume and target count. The ladder above is the SAT ladder; ASM is deployed one instance per client at 8 vCPU, and an ASM instance larger than 8 vCPU does not scan faster without a configuration change to the scan worker’s CPU and memory limits.

Data residency, per client

A single MSSP book can hold a HIPAA-covered US client, a GDPR-subject EU client, and a NYDFS-regulated financial client at the same time — and each will ask “where is our data stored?” on the first procurement call. Because HailBytes is a Bring-Your-Own-Cloud marketplace image, you can answer all three cleanly:

• Region per deployment. Each client’s instance deploys into the AWS or Azure region you pick — a marketplace parameter, or the region variable on the Terraform module. An EU client lands in an EU/EEA region; a US/HIPAA client in a US region (including AWS GovCloud and Azure Government); Latin-American clients in sa-east-1 or brazilsouth.
• Isolation guarantee. The full stack runs inside your — or the client’s — own cloud account. After deployment, scan data, target lists, and campaign results never transit HailBytes infrastructure, and residency is verifiable from that account’s own CloudTrail or Activity Log. The instance boundary is the data boundary.
• Certifiable per client. Because residency is a property of each client’s own tenant, you can certify to each client that their data stays in-jurisdiction — the precondition behind the GDPR, HIPAA, and NYDFS 500 evidence the compliance reports produce.

This mirrors the data-sovereignty model on the enterprise page (“Your Cloud Account. Your Data.”); GDPR DPA terms for client data you process are in the HailBytes DPA.

Resell through AWS CPPO or Azure Multiparty Private Offer

The marketplace path most MSSPs miss until late in evaluation is the channel-partner private-offer flow on both clouds. It is what lets you mark up the platform itself, capture the resale margin, and have the customer’s purchase still count toward their EDP or MACC commit — without the customer having to onboard HailBytes as a new vendor:

• AWS Channel Partner Private Offers (CPPO) — HailBytes (ISV / seller of record on the marketplace listing) issues you a resale authorization keyed to your AWS account, scoped to SAT and/or ASM, with a minimum acceptable price. You create a private offer at your resale price (typically wholesale + up to 20% margin, taken off the post-discount net the customer pays rather than off list), the customer accepts from their AWS account, and AWS splits proceeds: wholesale share to HailBytes, resale margin to you. Customer purchase decrements their AWS EDP commit.
• Azure Multiparty Private Offer (MPO) — the Microsoft equivalent, launched on Azure Marketplace in 2024. Three parties on a single private offer: HailBytes + you + the customer. Microsoft Marketplace splits proceeds the same way, and the customer’s purchase decrements their MACC commit. The Microsoft account team gets co-sell credit, which keeps them aligned with you on growing the deal.

What that looks like in unit economics: a 32 vCPU consolidated instance carries $67,300/year in HailBytes software fees at list, or $47,110 on a 1-year commitment. Resale margin is up to 20%, taken off the post-discount net the customer actually pays — so ~$9,400/year on the committed net, or ~$13,400 if the customer buys at list. That is layered on top of your managed-service ARR with zero incremental service-delivery cost. Margin scales with what the customer spends, so a book of dedicated per-client instances carries proportionally more of it — and costs the customer proportionally more. Customer sees one cloud invoice; their CFO sees committed-spend drawdown; you keep the platform margin as well as the service margin. Note that CPPO/MPO margin is earned on the HailBytes software fee only; the cloud infrastructure underneath is the customer’s own spend and is not resellable through the private offer.

Register on the partner program page with your AWS account ID or Azure tenant ID and we’ll issue resale authorization. First private offer usually ready within one business day. Full mechanics, worked examples, and procurement-language scripts are in the SAT Partner Brief (PPTX, download) and the ASM Partner Brief (PPTX, download).

Model your portfolio margin

Plug in your own numbers. HailBytes prices per vCPU on a shared instance, not per seat, so the cost basis is the instance divided across your book while a per-seat platform scales with every client’s headcount. All math runs in your browser — nothing is sent anywhere.

What the math looks like

Estimates only, for internal modeling — not a quote. The per-client software default of $280/mo is the upper (most expensive) end of the published consolidated range, $1,100–$3,400 per client per year; the cloud default of $56/mo is the ~20% your own AWS or Azure bill adds at $35/vCPU/month. Your actual cost depends on topology, how many client organizations you put on an instance, and whether you take an annual commitment (30/35/40% off list). The per-seat default of $3/seat/mo ($36/seat/year) sits at the $35/seat blended rate in the indicative competitor range published on our pricing page — no vendor in that comparison publishes list per-seat pricing, so treat it as an assumption and replace it with your own quote. Resale margin is calculated on the HailBytes software fee only — a partner cannot earn CPPO/MPO margin on the customer’s own cloud spend.

Like the numbers? Book a scoping call to pressure-test them against your portfolio, or see the partner resell page for the annual commitment discount tiers and CPPO/MPO mechanics.

Value delivered per client (ASM)

Margin is the supply side of the story; the demand side is the answer to the question you get at every QBR: “What did this give us?” Each automated ASM scan replaces roughly two analyst-hours of manual recon — subdomain enumeration, port sweeps, screenshot review, and vulnerability triage. That heuristic is the same 2h/scan default ASM uses internally to compute usage ROI, and it is operator-tunable, so adjust it to your team’s reality. Pair it with cost-per-finding and you have a defensible answer that beats per-seat or per-engagement framing.

Estimates only, for internal modeling — not a quote. The 2h/scan default mirrors ASM’s internal MANUAL_HOURS_PER_SCAN heuristic. The $75/hr blended analyst rate is an editable placeholder, not a rate HailBytes publishes or stands behind — put your own loaded cost in. ASM’s billing dashboard also reports per-project attributed cost and cost-per-finding, on the operator-only screen described below.

Budget ceilings & alerts

Margin only survives if a runaway scan doesn’t quietly consume compute you already priced into a fixed fee. ASM ships a per-Project budget control built for exactly this: set a monthly budget ceiling per Project and the billing engine tracks its attributed cost (allocated by scan-time share) against it.

• Configurable ceiling per Project. Each Project carries its own monthly budget; spend is attributed proportionally by scan-time-seconds, so you get a defensible “share of compute” line for invoicing.
• Threshold alert before overage. Projects flag amber when spend crosses your alert threshold and red once it exceeds the ceiling, so you can right-size a misconfigured recurring scan before month-end billing, not after the margin is gone.
• Operator-only visibility. Budget utilisation shows alongside last-scan status and open critical/high counts in the All Projects view. That view is not access-gated per client — any account that reaches it sees every Project’s name and spend — so treat it as your console, never as something a client logs into.

This is an operational cost control, distinct from the ROI value metrics above. The full portfolio mechanics live in the ASM Solution Brief.

Why bundle ASM and SAT for the same client?

HailBytes is one of the only vendors that ships both an attack-surface-management platform and a security-awareness-training platform. For an MSSP selling compliance bundles, that means you can hand a single client’s auditor one evidence package that covers both the human layer and the technical layer — from one vendor, with consistent audit-log formats, under your white-label branding. Same per-vCPU marketplace meter, same CPPO/MPO resale path, one renewal conversation.

When you run both products for a client, the combined branded PDF reports and structured audit logs go straight to the auditor — no reformatting, no second vendor to onboard. Read the full SOC 2 + PCI-DSS evidence walkthrough →

Both product walkthroughs are embedded higher up this page. The 4-minute SAT walkthrough runs the campaign lifecycle end to end — templates, sending profiles, the campaign wizard, post-click training, certificates, RBAC, SSO, white-label, and the audit log. The 11-minute ASM walkthrough covers running recon as a managed service: Projects, scoping, cost attribution, and scheduled reporting. It was recorded with several clients as Projects on one instance; read it alongside the tenancy note above, because we deploy ASM one instance per client today. Both are click-to-play — nothing loads until you start them.

Inside the operator console

Unmodified screenshots of the shipping UI, at the places an MSSP evaluator usually wants proof rather than prose. Open any of them full-size in a new tab.

Sample deliverables

The claims further up this page — branded PDF reports, audit-trail CSVs, SARIF and REST exports — are configuration screens and export buttons in the product, so here they are: