EASM for MSPs and MSSPs: What to Look For
Why is EASM a natural MSP service?
Most SME clients do not know what they expose to the internet — forgotten subdomains, old staging sites, expired certificates, exposed admin panels. An MSP is already trusted to manage that infrastructure, so attack-surface monitoring is a low-friction add-on that produces a visible, recurring deliverable. Both the UK’s National Cyber Security Centre and the US Cybersecurity and Infrastructure Security Agency treat knowing your internet-facing footprint as a foundational control — which makes it an easy service to justify to clients.
What do MSPs need from EASM? A 5-point framework
- Client separation. Each client’s assets, findings, and reports must be strictly isolated. One client should never see — or be mixed with — another’s data. This is non-negotiable for any tool you run across a book of clients.
- Presentable reporting. The findings need to be something you can put in front of a client. Plain-English findings matter here: your account managers, not just engineers, should be able to walk a client through what was found and why it matters.
- Predictable per-client cost. Costs need to map cleanly to clients so you can price the service per account and protect your margin. A flat per-client price is far easier to build a package around than metered billing that swings with asset counts — especially when discovery is the whole point and you cannot predict what it will find.
- Fast onboarding. Adding a new client should be fast — ideally point the tool at their root domain and let discovery do the rest, rather than manually cataloguing assets. The faster onboarding is, the more clients you can cover profitably.
- Alerting your team actually sees. New exposures need to reach your team promptly, so a critical finding for any client surfaces to the engineer responsible rather than sitting unread in a dashboard.
Where does SurfaceLoop fit for MSPs?
SurfaceLoop is an EASM platform built for businesses up to around 200 employees, and that makes it a strong fit for smaller MSPs managing a portfolio of SME clients. Discovery is included as standard, so onboarding a client starts from their root domain and SurfaceLoop finds the rest, monitoring everything across seven scan categories. Plain-English findings mean your account managers can present results without a security background. And the pricing is one flat, published £149/mo — with everything included and no per-asset metering — so costing the service per client is simple arithmetic, invoiced by AMVIA with never a card on file.
To be honest about the fit: SurfaceLoop is not a dedicated large-scale MSSP platform with a partner console and automated white-label billing across hundreds of tenants. If you run a big security operations centre serving enterprise clients, you may need purpose-built multi-tenant tooling. For a smaller MSP adding attack-surface monitoring as a recurring service, SurfaceLoop covers the essentials without enterprise overhead.
How SurfaceLoop handles this
Prove the value before you sell it: start a 14-day free trial on a real client’s domain — no card details, no sales call — and see what SurfaceLoop discovers across all seven scan categories. If the findings land, you have your case study for the whole client base.
See External Attack Surface Management feature →How do you get started as an MSP?
A practical rollout is simple: pick two or three clients, run trial scans to surface real exposures, and use those findings to package attack-surface monitoring as a recurring service. At a flat £149/mo per client, the economics are easy to model against what you charge for the service. For the full picture of what EASM covers, see our pillar guide to external attack surface management.
Frequently asked questions
- Can an MSP use SurfaceLoop across multiple clients? +
- SurfaceLoop is built and priced per business, so the clean model for an MSP is one SurfaceLoop plan per client at the flat £149/mo -- each client's assets and findings stay fully separate, and the cost maps one-to-one to the account. If you manage a larger portfolio, talk to us about how to structure it before you commit.
- Does SurfaceLoop offer white-label reporting for MSPs? +
- SurfaceLoop's findings are written in plain English and prioritised, which makes them easy to walk a client through as part of your service. It is not sold as a white-label MSSP platform with rebranded portals -- larger MSSPs needing dedicated partner tooling should confirm current capabilities with us first.
- How does per-client pricing work for an MSP? +
- SurfaceLoop is one flat price -- £149 per month per client with everything included, on a 12-month agreement invoiced by AMVIA. There is no per-asset or per-target metering, so the cost of serving each client is fixed and known before discovery runs, which makes packaging and margin calculations straightforward.
- How quickly can I onboard a new client? +
- Onboarding starts from the client's root domain: SurfaceLoop's automated discovery maps their internet-facing assets from there and monitors them continuously across seven scan categories. No agents or network changes are required, since everything runs from the outside -- and you can prove it on a 14-day free trial first.