RMM vendors must reckon with the new economic narrative

Kaseya, an IT vendor that operates primarily in the MSP space, announced a bundled product strategy called Kaseya 365 at its global conference at the end of April 2024. The announcement had been hyped by its CEO, Fred Voccola, for months beforehand and he was touting the news as being a “game-changer” for all MSPs.

Kaseya 365 will offer remote monitoring and management (RMM), along with some cybersecurity and backup products for an introductory price of US$3.99 per endpoint/month. There is also a lower-cost option that omits managed detection and response (MDR) for US$1.75 per endpoint/month. These are both subject to annual inflation- plus- a 5% rise, according to Kaseya.

According to Canalys estimates, the RMM and professional services automation (PSA) markets (in which Kaseya operates) were worth US$1.4 billion in 2023. With global revenue for managed services delivered by MSPs alone worth US$73 billion in 2023, the value of capturing more of that market through product bundling and price competition is clear.

Notwithstanding the details of Kaseya 365, this move is a good opportunity to examine what it will mean for vendors in the MSP space more broadly and how the economics of the MSP model could change moving forward.

MSP in a box is not new but is now a battleground

One of the most striking elements of Kaseya 365 is the fact that it is doing something that already exists. ConnectWise and N-able, Kaseya’s two biggest competitors in RMM technology, are already offering discounts for partners to purchase multiple products, either explicitly or not.

As many have already pointed out, Microsoft launched Office Suite in the mid-90s, bundling its productivity software and becoming the de facto global workplace solution. The difference between these two examples is Microsoft’s products were Word, Excel and PowerPoint, not RMM, MDR, and backup.

However, the move sparks questions. Can this packaged model change the way MSPs buy from their core vendors? Platforms are a common battleground now. There are two types of such platforms: the integration and third-party platform, which brings together multiple vendors on “one pane of glass”, or a vendor that has multiple products and is looking to convince partners to consolidate around those solutions.

The latter usually benefits from native integration and this can lead to better automation for partners, which also improves productivity for customers. Pricing is often more attractive because it is under the control of one company and does not require coordination among multiple billing platforms and APIs. One key benefit of the third-party option is that while a partner might be locked into one platform, it can technically swap out products for others and is not beholden to one vendor. Vendor lock-in is not a universal objection. Partners that have never been negatively affected by a vendor’s go-to-market strategy or pricing changes tend to be less concerned about the downside of a single vendor platform.

Many MSPs are small and around 25% struggle to be profitable. There are benefits to Kaseya’s open approach and creating product bundles makes sense from an economic standpoint. MSPs who are struggling on low margins can use this to help boost profit in the short term. However, as some MSPs have pointed out, if a partner is relying on this kind of offer to help them with profitability, their business model needs more serious changes.

Cybersecurity is a service, not a product, and MSPs need to be careful about commoditized MDR

Cybersecurity is an increasingly vital part of any partner’s managed services offering. Small business customers sometimes struggle with the cost of cybersecurity beyond anti-virus software and some basic training. They are also now going through the wave of cyber insurance growth, which means some small businesses are having to be audited for and buy insurance either due to supply chain compliance or growing regional and government regulations. All this means small business customers are being squeezed and their service providers need cost-effective ways to protect them and keep them compliant.

Kaseya 365 risks commoditizing MDR at a time when the detection and remediation elements need much more investment and education to build customer awareness. There is a fine line between devaluing MDR and making it more available to MSPs in the SMB sector through product bundles. One of the problems is that MDR is not an SKU, but an ongoing relationship between the vendor, their partners and the end customers. MSPs need to be very careful about their responsibilities when it comes to outlining the offerings from vendors.

If MDR is viewed as a product rather than a service who is responsible for the out-of-hours detection? Will there be an automated text alert or does the MSP get real, dedicated SOC analysts monitoring, detecting, and (crucially) helping you remediate in the event of an attack? What happens if the MSP buys the MDR, deploys it and then a breach occurs, and they find the customer suing them because the terms of the contract left all the responsibility on the MSP to do the things it was trying to outsource because it could not afford to provide them in the first place?

Companies in the RMM space have been put on alert and now is the time to get out or double down

One can easily see a future in 10 or 20 years where, as long as MSPs and endpoints still exist, Kaseya becomes the Microsoft of small business RMM (if Microsoft has not already done that first), and where its main rivals have been decimated or forced to shift into niche areas. It has happened time and again in different markets, and there are countless examples of companies dominating or even monopolizing markets despite lower levels of product and/or service capability and investment.

For competitors like ConnectWise, N-able, NinjaOne, Atera or Syncro there is a real danger they could become completely irrelevant. Not because Kaseya is doing anything unprecedented or outstanding, but because its investors are willing to go all in to win the market and have the money to do so. ConnectWise’s investors have been trying to sell it for a long time to recover their investment but are struggling to get the price they want.

These competitors will have to switch strategies very quickly or spend a lot of money to compete. NinjaOne has just seen US$232 million come in from its series C funding round in February 2024, where investors included Frank Slootman (current Chair of the Board of Snowflake) and Amit Agarwal (President of Datadog). It is unlikely they would have invested in a company that was looking to operate solely in a crowded space of vendors backed by large PE investments.

NinjaOne is smaller than ConnectWise and has time to specialize and break away from the rapidly commoditizing RMM space, perhaps by focusing on its data analytics opportunities. Equally, N-able offers backup and EDR as well as RMM, and can succeed by being an attractive alternative to Kaseya and others but will need to stay ahead of the curve and may become an acquisition target for a vendor with a much broader portfolio looking to compete in the MSP space.

AI for customer data and lead generation is the next frontier for RMM and PSA

The reality of these approaches is usually that the unit price of the bundled product gets more expensive over time but is hidden within the product package, especially if the company uses the bundled offering to price competitors of the market and take a significant market share.

There are obvious questions to be answered regarding the cost of cybersecurity services for small business customers as they get squeezed by IT price rises on one side and regulation and cyber insurance on the other. For example, can it be made cheaper without compromising on its value, either in practice or in the eyes of the customer? The list price for a managed EDR offering can be US$3 per endpoint/month for low volumes and less than half of this for 10,000 endpoints or more. The saving provided by an offering like Kaseya 365 is clearly aimed at smaller MSPs that struggle with profitability and who cannot get access to volume discounts. These partners must not be ignored and the “Express” option which includes just the RMM and backup for US$1.75 per endpoint/month will be the most attractive to such partners.

Looking further into the future, it is clear that Kaseya is on a path to dominate the small business managed services market. Not because it offers great products or services (its feedback from MSPs is legendarily bad), but because it and its investors have decided now is the time to start playing hardball and get into some classic market economics.

The key for all vendors right now is to look deeper into their customer data. The opportunities for AI models in analyzing customer data to build demand profiles and then mapping this existing customer data to new customers are massive. Creating a much more in-depth profile of existing and potential new customers will be vital as we move into a more heavily regulated era of data privacy. Partners regularly list new customer acquisition as one of their greatest business challenges. Any vendor that helps its partner ecosystem crack this code will be hugely successful.