Why will your clients ask you for cybersecurity?
Because European regulation has turned supplier security into a requirement, not a nice-to-have. The NIS2 directive obliges in-scope entities to manage supply chain risk — its Article 21 expressly lists the security of relationships with direct suppliers among the required measures. In practice, that means regulated companies are pushing cybersecurity requirements onto their service providers, starting with their IT provider.
The cascade effect is direct: the SMB that falls under NIS2 — or that works for someone who does — asks its IT maintenance company about monitoring, incident response, audits and compliance evidence. And the IT provider that cannot answer faces two outcomes: losing the client to someone who can, or partnering with someone who already has that capability.
The real risk to your business. The client who takes cybersecurity to another provider rarely leaves only cybersecurity there: whoever comes in through the security door ends up competing for the maintenance, cloud and workplace contracts too. Defending your client base means being able to say "yes" when they ask for security.
What is Hard2bit's white-label cybersecurity?
White-label cybersecurity means you sell and invoice the service under your brand while Hard2bit operates it behind the scenes: the white-label SOC watching your clients 24/7, the pentesters auditing their systems, the team that responds when an incident hits. Your client has a single point of contact — you — and you have a complete cybersecurity capability behind you without having built it.
It is designed for the profile we meet most often: IT companies, MSPs and integrators with a consolidated base of maintenance or managed-services clients, no real cybersecurity practice, and a desire to offer one without hiring SOC analysts, pentesters and GRC consultants — expensive, scarce profiles that are hard to retain.
- You keep the relationship: the contract, the invoicing and the client's trust remain yours.
- We provide the operation: people, platform, procedures and proven experience.
- Confidentiality is agreed in writing: agreements that protect your client base and define who appears in front of the client.
And if pure white-label does not fit a specific client, that is fine: as you will see in section 04, we also work co-branded and by referral. Cybersecurity for MSPs does not fit a single mould, and neither does the programme.
Which services can you offer your client base as a partner?
The catalogue you can deliver through the programme covers the five requests that most often reach an IT provider:
1. 24/7 SOC/MDR
Managed monitoring, detection and response for the clients in your portfolio, operated from our managed SOC. This is the service that turns a maintenance contract into a managed-security contract — the heart of our MSSP offering, and the core of a SOC as a service partner relationship.
2. Pentesting and technical audits
Pentesting of applications, infrastructure and cloud environments, with reports you hand to your client. Ideal for one-off requests you are currently turning down or subcontracting without control.
3. Incident response
When one of your clients suffers ransomware or an email compromise, having an incident response team behind you turns your client's worst week into the moment you deliver the most value.
4. GRC: compliance and governance
Support with ISO 27001, ENS, NIS2 and DORA for clients that need to certify, adapt or demonstrate compliance to their own clients and regulators.
5. Training and awareness
Cybersecurity training by role and phishing simulations: the simplest recurring service to introduce into a maintenance portfolio.
How does the partnership model work?
We do not believe in partner programmes with rigid tiers and small print. The commercial model is flexible and adapts to each partner and each client — these are the three usual ways of working, combinable within a single portfolio:
The specific terms — margins, commissions, scope — are sized with each partner, based on volume, services and the type of portfolio. That is why this page publishes no percentages: the first conversation exists precisely to design the agreement that fits your business.
What about the ENS and ISO certifications?
Let us be clear about this from the start, because it is the most important question in the model — and where a serious programme differs from an improvised one.
Hard2bit holds ENS certification at HIGH category and is certified to five ISO standards (ISO 27001, ISO 9001, ISO 14001, ISO 20000-1 and ISO 22301). Those credentials vouch for the quality of the engine operating behind your offering: audited processes, managed security and continuous improvement verified by independent third parties.
However: the certifications belong to Hard2bit and are not inherited. Delivering white-label work does not make the partner a certified company, and our agreements reflect that. It is a matter of rigour — the same rigour you will want from us when we operate for your clients.
The usual case
The client does not require the provider's credentials
The vast majority of cases. The service is delivered white-label or co-branded as normal, backed by the quality of a certified engine — without the credentials forming part of the end client's contract.
The special case
The client contractually requires the credentials
A tender that requires the provider to hold ENS, a contract demanding the security provider's ISO 27001. In that scenario, the engagement can switch to direct contracting with Hard2bit — and you receive a commission or an equivalent arrangement. Bringing the client never works against you.
What if you only want to refer clients?
The programme has a second, simpler door for organisations that do not deliver IT services: the referral programme. If you are a Hard2bit client, a consultancy, a law firm or an advisory firm and you spot a cybersecurity need around you, you can introduce the opportunity to us. We handle it directly and you receive a commission for every referral that becomes a client.
- No volume commitments: one referral a year or one a month — you set the pace.
- No exclusivity: we do not ask you to stop working with anyone.
- Full transparency: the commission scheme is agreed in writing before the first referral.
Why Hard2bit as the engine behind your offering?
When you put your brand in front of a service someone else operates, the right question is not "what do I earn?" but "who stands behind it?". These are our answers:
- 13 years of track record as a Spanish cybersecurity company, headquartered in the Madrid region, with our own operation — we do not resell a third party's service.
- A certified engine: ENS HIGH category and five ISO standards (27001, 9001, 14001, 20000-1, 22301), audited by independent bodies.
- A complete catalogue: from the managed SOC to pentesting, incident response and training — your client will not need to look elsewhere for what you cannot offer.
- Aligned incentives: your client base is your asset and the programme is designed to protect it — agreed confidentiality, flexible models and the guarantee that bringing a client never plays against you.
How do we start working together?
No certification forms and no endless onboarding. Three steps:
- A conversation. You tell us about your client base, what your clients are asking for and what you want to offer. We tell you how we would operate it.
- Designing the agreement. Together we choose the model — white-label, co-branded, referral or a combination — and set terms, confidentiality and the commercial scheme in writing.
- First client. We start with a concrete case from your portfolio. No volume commitments: the programme grows if it works for both of us.
Frequently asked questions
I run an IT company with 40 managed-services clients and several are asking for cybersecurity we cannot deliver — how does working with you work?
That is exactly the case the programme was built for. You keep the commercial relationship and the contract with your client; Hard2bit operates the service behind the scenes — SOC, pentesting, incident response or compliance — white-label or co-branded, as you prefer. We start with a meeting to review your client base, identify which services fit and define the model. Your client gets professional-grade cybersecurity and you keep the account.
We are an MSP and one of our clients requires their security provider to hold ENS certification — what happens then?
In that scenario the engagement can switch from white-label to direct contracting: the client signs with Hard2bit, which holds ENS certification at HIGH category, and you receive a commission or an equivalent arrangement agreed with you. Bringing the client never works against you. It is the route designed for tenders and contracts that require the provider's own credentials, without forcing a white-label setup that would not meet the requirement.
Will my client know the service is delivered by Hard2bit?
It depends on the model you choose. Under white-label we operate under your brand, with confidentiality agreements that protect your client relationship. Under co-branding we appear together — something many partners prefer, because Hard2bit's credentials strengthen the proposal. Under the referral model, the client contracts directly with us. You decide, client by client.
If we deliver white-label work, does my company become ENS or ISO 27001 certified?
No. The certifications — ENS at HIGH category and the five ISO standards — belong to Hard2bit: they vouch for the quality of the engine operating behind your offering, but they are not inherited or transferred. Delivering white-label work does not make the partner a certified company. If your client contractually requires those credentials, the correct route is direct contracting with Hard2bit, with a commission for you.
What commission or margin do you offer partners?
We do not publish percentages because we do not work with off-the-shelf terms: the commercial model adapts to each partner and each client. White-label, co-branded or referral with commission, with margins and schemes we size together based on volume, service type and the relationship. The first conversation exists precisely to design the agreement that makes sense for your business.
We are a consultancy that does not sell IT — can we simply refer clients to Hard2bit?
Yes. The referral programme is designed for organisations — clients, consultancies, law firms, advisors — that spot cybersecurity needs around them but do not want to deliver the service. You introduce the opportunity, Hard2bit handles it directly and you receive a commission for every referral that becomes a client. No volume obligations and no exclusivity.