How Cybersecurity Consultants Get Client Referrals from IT Service Providers and MSPs

I spent my first three years as an independent cybersecurity consultant chasing leads the hard way: responding to RFPs, cold-emailing businesses after breach headlines, and hoping my website would rank for “penetration testing near me.” Some of that worked, occasionally. What actually built my practice was something I did not plan for: managed service providers started sending me their clients.

It happened naturally at first. A local MSP had a 40-person manufacturing client who needed a vulnerability assessment for a cyber insurance renewal. The MSP handled their servers, workstations, and backups, but they did not have a security specialist on staff. One of their techs knew me from a previous job and passed my name along. I did the assessment, delivered the report, and the MSP’s client renewed their policy. Two months later, the same MSP called me with another client who needed help with a compliance gap. That pattern (MSP encounters a security need beyond their scope, MSP calls me) became the foundation of my business.

Today, about 70% of my engagements come through MSP referrals. Here is how I built those relationships, what I have learned about keeping them productive, and the specific mechanics that make the arrangement work for both sides.

Why MSPs Refer Security Work Instead of Handling It Themselves

Understanding this is essential to getting the relationship right. MSPs are not sending you work because they cannot figure out security. They are sending it because the economics and liability profile of security engagements are fundamentally different from what they do day to day.

A typical MSP earns recurring monthly revenue by managing endpoints, patching servers, maintaining backups, handling help desk tickets, and keeping networks running. Their business model is built on predictability: monthly contracts, standardized toolsets, and repeatable processes across their client base. Security work, by contrast, is project-based, high-stakes, and requires deep specialization that changes constantly.

Here is what MSPs regularly encounter that falls outside their core competency:

• Penetration testing and vulnerability assessments. A client needs one for cyber insurance, a compliance audit, or a board mandate. The MSP cannot test their own environment impartially, and most do not have the tools or certified staff to do it properly.
• Incident response. A client gets hit with ransomware or discovers unauthorized access. The MSP can isolate affected systems, but the forensic investigation, evidence preservation, and remediation planning require a different skill set.
• Compliance and framework implementation. Clients in manufacturing, government contracting, or financial services need to meet CMMC, NIST 800-171, SOC 2, or PCI DSS requirements. The MSP can implement technical controls, but scoping the gaps, writing policies, and guiding the client through the audit process is specialized consulting.
• Security awareness training programs. Beyond basic phishing simulations that come bundled with their security stack, clients sometimes need structured security awareness programs with executive reporting, simulated social engineering, and tailored content for their industry.
• Virtual CISO services. Small and mid-sized businesses that need executive-level security guidance but cannot justify a full-time hire. The MSP manages the technology; the vCISO manages the security strategy.

When an MSP refers this work to you, they are not losing revenue. They are protecting it. If they try to handle a security engagement they are not qualified for and it goes badly, they risk losing the entire client relationship. If they bring in a trusted specialist, the client gets taken care of, the MSP looks good for making the connection, and the monthly managed services contract stays intact.

Building Trust with MSPs Who Do Not Know You Yet

MSPs will not refer their clients to someone they have not vetted. Their reputation is on the line with every introduction they make. A bad referral does not just cost you a deal. It costs the MSP credibility with a client they have spent years building a relationship with. So the trust-building process matters more here than in almost any other referral relationship I have seen.

Start where you already have overlap

The easiest path to an MSP relationship starts with existing connections. Think about the clients you have already worked with. Who manages their IT infrastructure? If you did a penetration test for a 50-person engineering firm, there is an MSP behind the scenes keeping their network running. You have already demonstrated competence to a shared client. That is your introduction.

After an engagement, I ask my client if they would be comfortable introducing me to their IT provider. The framing matters: “I want to make sure the remediation steps from our assessment align with how your MSP manages your environment. Would you mind connecting us?” That positions the introduction as being in the client’s interest, not mine. And it usually leads to a call with the MSP where I walk them through what I found, how I recommend fixing it, and what I need from them to get it done.

That call is the real audition. If you communicate clearly, respect their existing work, and make the remediation process easier rather than harder, you have just demonstrated everything they need to see.

Show up where MSPs already gather

Most metro areas have local IT professional groups, MSP peer communities, and vendor events where managed service providers network. I attend two or three of these a year, not to pitch, but to be present and useful. I have given short talks on topics like “what your clients are going to ask you about after the next major breach” and “how CMMC requirements will affect your DOD contractor clients.” The goal is to position yourself as someone who understands their world and can help them serve their clients better.

The key detail: do not present yourself as an alternative to the MSP. You are not competing with them. You are the specialist they call when the situation requires skills outside their operational model. If an MSP senses that you are trying to displace their relationship with their client, the conversation is over.

Be easy to refer

MSPs are operationally focused people. They do not want to explain your services to their client from scratch. Make it simple for them to make the introduction:

• Have a one-page service summary they can forward to their client without modification. Not a glossy brochure: a clean document that says what you do, what it costs approximately, and how long it takes.
• Give them a sentence they can use in an email: “I work with a security consultant who specializes in [your focus area]. He has done this for several of our other clients. Want me to connect you?”
• Respond quickly when the introduction happens. An MSP who connects you with their client and then does not hear from you for a week will not do it again.

Positioning Yourself as the Go-To Security Specialist for IT Generalists

The cybersecurity market is crowded. Large firms like CrowdStrike and Palo Alto have consulting divisions. Every MSP tool vendor is adding “security” to their product name. And there are dozens of other independent consultants in any metro area. So why would an MSP choose to send their clients to you?

In my experience, MSPs refer to the person they trust, not the person with the most impressive website. But trust is not enough on its own. You also need to be specific about what you do. An MSP needs to be able to match your capabilities to a client’s problem in about five seconds.

Pick a lane

“I do cybersecurity” is not referable. It is too vague. MSPs need to know exactly when to think of you. The consultants who get the most MSP referrals are the ones with a clear specialty:

• “I do penetration testing and vulnerability assessments for companies with 50 to 500 employees, mostly in manufacturing and professional services.”
• “I help government contractors get CMMC Level 2 certified. I handle the gap assessment, the remediation plan, and I coach them through the audit.”
• “I run virtual CISO programs for mid-market companies that need board-level security reporting and policy development but are not ready for a full-time hire.”

Each of those descriptions triggers a specific client scenario in the MSP’s mind. When that scenario shows up (and it will), you are the person they call.

Complement the MSP’s stack, do not compete with it

Most MSPs already run some security tooling: endpoint detection and response, email filtering, managed firewall, maybe a SIEM. If your pitch starts with “your current security stack is inadequate,” you have just insulted the person who chose and manages those tools. Instead, frame your work as the layer above their operational security:

• They run the day-to-day tools. You test whether those tools are actually working as intended.
• They deploy the technical controls. You design the policies and frameworks that determine what controls are needed.
• They respond to alerts. You investigate incidents that go beyond a standard alert response playbook.

This framing makes the MSP look better, not worse. It tells their client: your IT provider is doing their job, and they also have the judgment to bring in a specialist when the situation calls for it.

Structuring Referral Fees That Keep MSPs Sending You Clients

Once an MSP starts referring security work to you, the question of compensation comes up naturally. Some MSPs will refer without any fee arrangement. They do it because it serves their client and strengthens their own relationship. But for consistent, ongoing referral volume, a financial arrangement gives the MSP a concrete reason to think of you every time a security need surfaces.

What cybersecurity referral fees typically look like

Referral fees in the cybersecurity consulting space generally work in one of three ways:

1. Percentage of the engagement value. The most common structure I have seen and used. Typical range is 10% to 15% of the total project fee. On a $15,000 penetration testing engagement, that is $1,500 to $2,250 for the MSP. This works well because the fee scales with the size of the work: bigger engagements justify bigger referral fees, and neither side needs to renegotiate for different project types.
2. Flat fee per engagement. A fixed dollar amount regardless of project size. This works for standardized services with predictable pricing. If you always charge $5,000 for a small-business vulnerability assessment, a flat $500 referral fee is clean and simple. The MSP knows exactly what they will earn for each introduction.
3. Recurring fee on ongoing services. For vCISO engagements or long-term compliance programs where you bill monthly, you might pay the MSP a percentage of revenue for the first 6 or 12 months. On a $3,000-per-month vCISO retainer at 10%, that is $300 per month to the MSP, $3,600 over a year. This makes the MSP’s referral income predictable and gives them a strong incentive to refer their higher-value clients.

Setting terms before the first referral

The single biggest mistake I see cybersecurity consultants make with MSP referrals is waiting until after the engagement to figure out the financial arrangement. You do the work, send the invoice, collect payment, and then have an awkward conversation about whether the MSP is owed anything. By that point, the MSP may feel like they have been taken advantage of, even if you fully intended to pay them.

Set the terms upfront. Before the MSP shares their client’s contact information, agree on the fee structure, when payment is triggered (typically upon your collection from the client), and how you will keep them informed about the engagement status. Put it in writing, even a brief email confirmation works. The point is that both sides know exactly what to expect before any client information changes hands.

What makes an MSP stop referring

I have talked to MSP owners who tried referral relationships with security consultants and stopped. The reasons are almost always the same:

• Late or missing payments. The engagement finished, the consultant got paid, and the MSP had to chase them for the referral fee. This is the fastest way to end a partnership.
• Poor communication during the engagement. The MSP introduced the consultant to their client and then heard nothing until the project was done. The MSP had no idea how things were going and could not answer their client’s questions about the security work.
• Making the MSP look bad. Missed deadlines, sloppy reports, or condescending communication with the client. Every interaction reflects on the MSP who made the introduction.
• Scope creep into MSP territory. The security consultant starts recommending infrastructure changes, suggesting new tools that compete with the MSP’s stack, or building a direct relationship with the client that cuts the MSP out. This is the cardinal sin of the MSP referral relationship.

Working the Engagement Without Stepping on the MSP’s Toes

The engagement itself is where you either build a long-term referral source or destroy one. How you handle the client relationship during a referred engagement is different from how you would handle a client you acquired directly.

Keep the MSP in the loop

The MSP introduced you to their client. They need to know what is happening. I send the MSP a brief status update at the beginning and end of each phase of the engagement, nothing detailed enough to violate client confidentiality, but enough that the MSP can tell their client “I checked in with our security consultant, and the assessment is on track” when the client asks.

When I deliver the final report to the client, I always ask: “Would you like me to walk your IT team through the findings and the remediation steps?” That “IT team” is usually the MSP. This debrief accomplishes two things: it makes the remediation smoother because the people who manage the infrastructure understand what needs to change, and it reinforces to the MSP that you are a collaborative partner, not a competitor.

Deliver remediation recommendations the MSP can execute

A vulnerability assessment report full of findings like “implement network segmentation” and “deploy multi-factor authentication across all systems” is not helpful if the MSP does not know which specific systems you are talking about or how to prioritize the work. I structure my remediation recommendations with the MSP in mind:

• Prioritized by risk, with clear categories (critical, high, medium, low) and realistic timelines.
• Mapped to specific systems and configurations the MSP already manages.
• Written in language that an MSP technician can act on, not just language that impresses a CISO.

The MSP who receives a report they can actually execute on will remember that when their next client needs a security assessment. The one who receives a 90-page document full of jargon and no actionable steps will find a different consultant.

Route infrastructure conversations back to the MSP

During a security engagement, the client will sometimes ask you questions that are really IT operations questions. “Should we upgrade our firewall?” “Can you help us move to a new email platform?” “We are thinking about switching to a different backup solution.”

These are MSP conversations. When they come up, I say: “That is a great question, and your IT provider is the right person to evaluate that with you. I can flag it in my report as a security consideration, and your MSP can assess the operational side.” This keeps you in your lane, respects the MSP’s role, and shows the client that there is a clear division of responsibility between their IT operations and their security posture.

Maintaining the Relationship After the Engagement Ends

The engagement is done. The client is happy. The MSP got paid their referral fee. Now what? This is where most cybersecurity consultants drop the ball. They move on to the next project and forget about the MSP until they need more work. The consultants who build real referral pipelines treat the post-engagement period as an investment in the next referral.

Send the referral payment promptly

This sounds obvious, but it is the most common failure point. When your client pays you for the engagement, send the MSP their referral fee within a few days. Do not wait for the MSP to ask. Do not wait until the end of the month. Prompt payment communicates that you value the relationship and that you are reliable. An MSP who gets paid quickly after making a referral is far more likely to make the next one.

Share relevant threat intelligence

Every quarter, I send a brief email to the MSPs in my referral network with information relevant to their client base. Not a generic newsletter: something specific. A new ransomware variant targeting the type of backup systems their clients use. An update to a compliance framework that affects their government contractor clients. A real-world incident that illustrates why a particular security control matters.

This keeps me visible as someone who is paying attention to the threat landscape and gives the MSP something they can use in their own client communications. It also creates natural opportunities for the MSP to say to a client: “I was talking to our security consultant about this, and he recommends we take a look at your environment.”

Help the MSP sell security to their clients

Most MSP owners I work with know that security is a growing concern for their clients but struggle to position it effectively. They are IT operations people, not security salespeople. When I help an MSP articulate the value of a security assessment to their client, I am making it easier for them to generate referrals for me.

This might look like helping them draft an email to clients about why annual vulnerability assessments matter, giving them talking points for when a client asks “do we really need this?”, or providing a summary of what their clients’ cyber insurance carriers are starting to require. The easier you make it for the MSP to initiate the security conversation, the more often that conversation leads to an engagement for you.

Be the first call for incidents

Nothing cements an MSP referral relationship faster than being available when something goes wrong. When an MSP’s client has a security incident, the MSP needs someone they can call immediately, not someone who will respond in 48 hours with a proposal. If you have built the relationship, that call comes to you.

I tell every MSP I work with: “If one of your clients has a security incident, call me. Even if it turns out to be nothing, I would rather get the call and help you triage it than have you scrambling to find someone at 10pm on a Friday.” I have gotten two significant incident response engagements from those calls. But more importantly, the MSPs who know they can call me at any time are the ones who refer me most consistently for proactive work too.

The Numbers: What MSP Referrals Look Like Over a Year

Here is a rough breakdown of my MSP-sourced business over the past twelve months to give you a sense of what consistent MSP referral relationships can produce:

• Active MSP referral partners: 4 MSPs with agreements in place.
• Total referrals received: 14 client engagements across those 4 MSPs.
• Average engagement value: $12,000 (ranging from $4,000 vulnerability assessments to $36,000 annual vCISO retainers).
• Total revenue from MSP referrals: roughly $168,000.
• Referral fees paid: approximately $18,500 (averaging about 11%).
• Client acquisition cost per engagement: about $1,320 in referral fees, compared to $3,000 to $5,000 per lead from paid advertising and lead generation services I used previously.
• Client retention rate: 9 of 14 clients engaged for follow-up work or ongoing services within 12 months.

The math is straightforward. MSP-referred clients cost less to acquire, close at a higher rate because trust is already established, and are significantly more likely to become repeat clients. Every other client acquisition channel I have tried (advertising, directory listings, conference sponsorships) produced lower-quality leads at a higher cost.

Getting Started: Your First 60 Days

If you are an independent cybersecurity consultant who has been relying on your own marketing to find clients, here is what I would do over the next two months to start building MSP referral relationships:

1. Identify the MSPs behind your existing clients. Look at your last 10 engagements. Who manages those clients’ IT infrastructure? You already have credibility with the shared client. Use that to open a conversation with the MSP.
2. Write a one-page service summary. List your specific services, typical engagement sizes, timelines, and the types of clients you serve best. Make it something an MSP owner can forward to a client without modification.
3. Reach out to one MSP this week. Start with the one where you have the strongest existing connection. Ask for a 20-minute call to talk about how you can help their clients with security needs that fall outside their day-to-day operations.
4. Agree on referral terms before the first referral. When the conversation turns to working together, propose a simple fee structure. A percentage of engagement value, paid upon client payment, with a brief written confirmation. Do not overcomplicate it.
5. Deliver the first engagement exceptionally well. The first referred engagement is your audition for every future referral from that MSP. Communicate proactively, deliver a report the MSP can act on, and pay the referral fee promptly when the client pays you.

Building an MSP referral pipeline is not fast, but it compounds. One solid MSP relationship that sends you three or four engagements a year is worth more than any advertising campaign. Four of those relationships, and you have a practice that is booked consistently with high-quality clients who arrive already trusting your expertise.

If you want a straightforward way to set referral terms with your MSP partners and track referral payments as engagements close, take a look at what PureIntro offers for tech and digital professionals.

This post reflects one professional’s experience and is for informational purposes only. It is not business, legal, financial, or professional advice. Results described are individual and not guaranteed. Referral fee arrangements may be subject to state and local regulations. Consult a qualified professional for guidance specific to your situation. PureIntro facilitates referral tracking and payment processing but does not guarantee payments between users or any particular business outcome.