A Cybersecurity Partner for MSPs, MSSPs, VARs, and Systems Integrators
MSPs, MSSPs, VARs, and systems integrators can refer or resell penetration testing, vCISO, and compliance work with Breach Craft through the partner portal.
Breach Craft partners deliver real cybersecurity work to clients who came to them first: penetration tests, vCISO engagements, gap assessments, tabletop exercises. This post covers how the organization side of our partner portal works for MSPs, MSSPs, VARs, systems integrators, and other technology businesses whose clients ask for security work the partner doesn’t deliver in-house.
The problem MSPs/MSSPs/VARs run into
You hear it from a client. “We need a pen test.” Or “We’re starting our SOC 2 audit.” Or “Our cyber insurance carrier is asking about our incident response plan.”
You don’t deliver any of that in-house. Your team is doing what your team is good at: keeping infrastructure running, deploying tooling, integrating systems, managing security operations. But the client is asking, and they’re asking you because they trust you. Saying “I don’t know, ask someone else” sends them shopping. They might find a great firm. They might find a bad one. Either way, the relationship you’ve built starts to fade.
So the standard move is to partner. Find a firm that does the work, refer or resell, take a cut, keep the client. In theory it’s clean. In practice it’s frequently a mess. The terms are stiff and skewed against you. The pricing is opaque. The firm’s account team treats your client like their lead from the moment of warm handoff. Co-selling is “available” on paper but never actually shows up. Reports get delivered late, recommendations get phoned in, and the first you hear about an issue is when your client emails you asking what’s going on.
We’ve been on every side of that table. We were the consultancy doing the work, the MSP routing it out, and the client receiving subpar deliverables. So when we built the Breach Craft Partner Program, we built it the way we wished it had worked when we were on the other end.
What an organization partnership looks like
The Breach Craft organization partnership is built on a few principles.
You stay in the room. We don’t disappear from your client conversation after the warm handoff. We co-sell on calls when that helps, attending your scoping meetings, technical discussions, and presentations. We provide subject-matter authority without taking the relationship from you. If you’d rather quarterback the engagement yourself with us in the background, that works too. The level of involvement is your call.
Your account is protected. Deal registration in the portal locks in the partner who registered the opportunity for a defined window. Our internal team can’t bypass it. If two partners surface the same opportunity, the one who registered first wins. No fights, no surprise channel conflict.
Commissions are transparent and tracked in real time. Every deal you register has a visible commission attached, accruing as the engagement moves through its stages. You can see what’s earned, what’s accrued, and what’s been paid at any moment. For resale work, the partner discount is baked in and the partner transacts on their own paper.
Deliverables hold up. Our pen test reports include an attack narrative, framework-mapped findings (CIS Top 18 by default), and positive observations alongside risks. You can hand them to your client with your name attached and not have to qualify the work. Our methodology is documented and consistent across engagements, so you know what your client is getting before they get it.
We’re responsive. Comments in the portal get answered. Status changes get explained. We don’t go dark for a month and then drop an 80-page PDF on your client’s desk.
Enablement is built in. The portal includes a library of service descriptions, our approach to each engagement type, our differentiators, and guidance on scoping. Beyond the portal, partners with active pipeline can collaborate with us on co-marketing (joint campaigns, content, events, co-branded assets), and we can run on-site or virtual enablement sessions for your team and your partner reps so they can speak fluently to the work. We add to the library over time.
Walking through the portal: deal registration to deal close
The flow is the same end-to-end whether you’re signed in as a one-person org or a 50-person sales team. The difference is who can do what, and how visibility rolls up.
When an org admin signs in, they land on a dashboard scoped to the organization. Active deals across every team member, recent activity, commissions earned and pending across the org. From here, an admin can see the full pipeline. An individual rep sees only the deals they own.
Team management is where org admins spend most of their setup time on day one. Invite users by email, assign roles, set who can register deals on which accounts. Roles range from full admin to deal-registration-only. We support the common org structures and you can adjust as your team changes.
To register a deal, any team member with the right role clicks “Register a Deal.” The form pulls from our offering catalog so you don’t have to guess at the right service name or scope. Pick a network pen test, a vCISO engagement, a HIPAA gap assessment, or any combination, then layer in the client details. Budgetary pricing returns on the spot, scoped to your org’s pricing if you have a resale arrangement, so you walk into your next conversation with a number.
Once a deal is registered, it gets a dedicated page. Status updates, file uploads, and a comment thread your team and ours both have access to. You can pull supporting docs (org charts, infrastructure diagrams, prior reports) into the thread to scope faster. We respond there. No siloed email chain.
Commissions are visible by deal and rolled up at the org level. An admin can see what each rep has earned and what’s accrued versus paid. Reps see their own. The math is the math. No reconciliation calls, no surprise adjustments.
The whole experience works on mobile. Org admins can review pipeline from a phone in the rideshare on the way back from a client meeting. Reps can register opportunities mid-conversation. We built it that way because partner work doesn’t happen at desks.
Security and trust
This is a portal we built for ourselves first, and made available to partners second. We’re a security firm. We do penetration testing, vCISO engagements, gap assessments, and incident response work for clients in regulated industries. The standard we hold our clients to is the standard we hold the portal to.
Authentication is multi-factor by default. Role-based access controls scope what each user, on each org, on each account, can see and do. An org admin manages their own team without ever touching another org’s data. Audit logs track sensitive actions across users, deals, and configuration changes. Data is encrypted in transit and at rest. The whole stack runs on Cloudflare with defense-in-depth from the edge through the application.
Partner agreements and NDAs get signed in the portal through our RabbitSign integration, so onboarding doesn’t bottleneck on a PDF that’s been sitting in someone’s inbox for a week.
Of course we built it this way. We’d be the first to flag the issues if you put a cybersecurity firm’s portal in front of one of our pen tests. The portal isn’t a hypothetical here, it’s a system we trust to handle real partner data, real client information, and real money. We built it accordingly.
Real partner work we’ve delivered
The two case studies linked here represent the two patterns most common in our org partnerships, but they’re not the universe of our partner work. We only publish engagements we get the green light to discuss, and even those are typically anonymized given the sensitivity. Plenty more partner-delivered projects never become public.
CISA CPG 2.0 across a national water utility, delivered through an MSP partner. A national water utility needed CISA Cybersecurity Performance Goals 2.0 alignment across many distinct PWSIDs (Public Water System IDs), each with its own infrastructure profile and risk posture. Rather than flatten the variation with a single enterprise-wide assessment, we scoped per-PWSID. Each site got its own discovery, control mapping, gap identification with severity, and prioritized remediation roadmap. The MSP partner kept the client relationship and added differentiated value without staffing internal CISA CPG expertise.
Penetration testing at a US city government, delivered through an MSSP partner. A US city government engaged through their MSSP for a network and application penetration test. We worked through the attack chain, demonstrated the realistic risk to administrative systems, and delivered a framework-mapped report the MSSP could hand to the city’s leadership and IT director with their name on it. Reproducible methodology, no theatrics, and a remediation path that fit the city’s operational realities.
These are the kinds of engagements the portal is built to support. Register the deal, scope the work, deliver the result, share the credit.
Tier structure and commissions
The standard partner commission ranges from 5% to 20%, scaling with your annual referred revenue and your level of commitment to the program. For resale work, the model is different: the partner discount is baked into the price, and the partner transacts on their own paper rather than collecting a commission from us.
We deliberately don’t put the full tier breakdown on a public page. Specific breakpoints, multipliers for higher-commitment levels, and progression requirements are visible to active partners inside the portal. As you register and close deals, you can see your current tier, the requirements to move up, the incentives at each level, and how much of those requirements you’ve already met. There’s no haggling, no surprise reclassification, and no “we’ll get back to you on that.” The math is in the portal.
The partners page covers the high-level model and is a reasonable starting point if you want to see the basics before you sign up. Anything beyond the basics, you’ll see once you’re inside.
How to get started
Sign up at the partner portal. The first time through takes a few minutes: profile, partner agreement signed in-portal, organization details, and your first team member invites if you want them. Most partners register their first deal within a day of being approved. Some register one before they finish onboarding because a client conversation that morning made it urgent.
If you have questions before signing up, reach out through our contact form and choose “Partner Program (Organization)” from the service dropdown.
The pen tests, the vCISOs, the gap assessments, and the tabletop exercises are happening anyway. The clients are asking. Your team is fielding the questions. The portal exists so you can stop sending those clients elsewhere and start being the partner who delivers.
