partners make money on the services around your product, so design for them

A partner adds your product when it can build a profitable practice around it. The licence margin alone, typically 10% to 20% after registration discounts and competitive pricing, rarely covers the partner’s selling and presales effort. The money is in implementation, integration, training, health checks and running the product for the customer. So design the services before you recruit the partners: two or three priced service packages per product, effort guidance, and a quote that shows the service line next to the licence.

where the partner’s profit comes from

1. Implementation and configuration.
2. Integration with the customer’s environment: directory, SIEM, ticketing.
3. Training the customer’s administrators.
4. Support beyond the vendor’s own.
5. Managed operation: running the product for the customer.
6. Compliance work built on the product: policies, documentation, audit evidence.

If your product leaves no room for any of these, partners will sell it reluctantly, or as a favour to a customer who asked by name.

the best public number, and what it can’t carry

Public data on services attach in security is thin. The most cited figure comes from a Canalys study announced by CrowdStrike in September 2025: partners can generate up to USD 7 of services revenue for every USD 1 customers spend on the Falcon platform, and managed services were nearly 46% of the total value of related services.

Don’t put that number in a partner pitch as an expectation. It is a best case, from one large platform with large deployments, announced by the vendor that benefits from it. The 46% managed-services share also shows that much of the value is recurring operation, not one-off projects. The same announcement named breadth of service offerings and partner maturity among the drivers of the return. Those are the useful part.

attach varies by product type

identity governance0.8 to 2.0

SIEM0.5 to 1.5

privileged access management0.4 to 1.0

user activity monitoring0.3 to 0.8

endpoint privilege management0.2 to 0.6

email security, EDR0.1 to 0.3

Products that change a process, such as identity governance, SIEM and privileged access, carry the most services and need the most capable partners. Products that deploy fast, such as email security and EDR, carry little. For those, the partner’s recurring income has to come from a managed service, or it has little reason to prefer your product over the next one.

Over a three-to-five-year customer life, recurring services matter more than the first implementation:

Recurring service	Pricing	Why it matters
Extended support, partner first line	Annual fee, often 10% to 20% of licence value	Public tenders often require it
Health checks	One to three days a year, fixed fee	Low effort, high effect on renewal
Upgrade services	Per upgrade	Your release cycle drives demand
Managed operation	Monthly fee	The partner’s most stable income on your product
Compliance reporting	Quarterly fee	NIS2 and DORA evidence for the customer

build service blueprints

A service blueprint is a documented, priced package a partner can sell and deliver: scope, prerequisites, steps, deliverables, effort, roles, acceptance criteria and exclusions. Build two or three per product, for example a quick start, a standard deployment and an annual health check. Blueprints let a small partner sell a service it has delivered once, because the thinking is already done.

Partners often underprice services to win the licence, lose money on delivery, and blame the product. Publish effort guidance and recommended price ranges per blueprint. Recommended prices are allowed in the EU. Fixing a partner’s resale price is a hardcore restriction under the vertical agreements regulation, so keep it a recommendation, in writing.

When you or your distributor prepare a quote for a partner, put the recommended service package on it as a separate line with effort. It reminds the partner to sell it, and the customer to budget for it.

measure attach both ways

Two definitions are in use, and they answer different questions. The attach rate is the share of product deals with at least one paid service. The attach ratio is services value divided by licence value on the same deals. A partner can attach a service to every deal, a 100% rate, and still sell almost nothing, a ratio of 0.1. Capture both on the registration form for deals above a size threshold, and report them by partner type and by product every quarter. After a year you will have the benchmark nobody publishes.

deliver it yourself only as a bridge

Sometimes no partner can deliver yet: a new product, a complex first project, a tender demanding certified engineers that partners don’t have.

1. 1is a certified partner able and willing?Yes: enable only. Train, support, stay out of the contract.
2. 2is there a partner who will sell and wants to learn?Yes: co-deliver, or subcontract to the partner under its brand, priced with a partner margin of 15% to 25%.
3. 3is it a direct account under your written rules?Yes: deliver directly. No: find a partner before you take the project.
4. alwaysrecord who delivered and whySo you can see each quarter whether you are building partner capability or replacing it.

Expect a partner engineer to need two to four deployments, roughly six to twelve months, to deliver a complex product such as privileged access management alone. Plan your own engineers’ time for that.

Training can become a service of its own. MSSP Alert’s 2025 research on the Top 250 MSSPs found that 76% deliver security awareness training in-house. Admin training for customers and certification training for partner engineers can be sold, and they make partners better at the services that matter more.

the question for your partners

What does a partner earn in year two on a customer that bought your product in year one?