Cybersecurity · 01 · Answer

Should a cybersecurity vendor sell direct or through MSSPs?

The category has already decided and it decided against direct — 92% of global cybersecurity spending ran through the channel in Q4 2025, while channel share of all IT spend is falling. The open question is not whether to use partners. It is a dependency none of the vendors we examined discloses at all.

The evidence

Security is moving opposite to the rest of IT.

92% of global cybersecurity spending went through the channel in Q4 2025 — $24.2B, up 10.3% year over year — and over 90% of the roughly $310B expected in 2026. From the same research house, channel share of all global IT spend is falling: 69% in 2025, 65% in 2026, 63% forecast for 2027.

Every documented vendor move went toward partners.

Across 2025–26 we found no vendor moving toward direct. CrowdStrike's MSSP business grew from under $100M to more than $1.3B in just over three years, against company ARR of $5.25B. Proofpoint, SonicWall, Sophos, ThreatDown and Rapid7 all restructured toward partners in the same window.

The partner is building a business on top of yours.

MSPs average $1.34 of their own security sales per $1 of vendor security sales, rising to around $1.9–2.0 in some categories. 46% of MSPs say customers rely on them to act as their CISO, and 84% expect demand for that to rise.

No margin figure appears in this answer, and that is deliberate.

No deal-registration discount rate, distributor discount, or direct-versus-channel gross-margin comparison is publicly sourceable for any security vendor. Partner programme guides say “margin uplift” without numbers. Any figure here would be a guess.

The dependency nobody discloses.

Of six vendors examined — SentinelOne, Palo Alto, Fortinet, Tenable, Varonis, Netskope — not one carries a risk factor naming cloud-marketplace distribution dependence. Zscaler passed $1B cumulative through AWS Marketplace and reached $900M in nine months of FY2026, roughly $100M a month. Cybersecurity marketplace spend is forecast at $31B by 2030.

What would have to be true for this to be wrong

If you sell to a small number of very large enterprises who procure directly and run their own security operations, the 92% is somebody else's base rate. It describes a market whose mid-tier buys security as a managed service.

Sources: SEC EDGAR full-text search and company filings, with each figure's period stated above. AI-answer measurements are CULT+MATH primary research, criteria registered before retrieval. Published 2026-10-21 by Ipalibo Da-Wariboko, CULT+MATH LLC. Figures carry the date they were pulled; where a number could not be sourced, this page says so and gives none.

This is one of six decisions covered in the cybersecurity decision brief — each with the evidence behind it, who owns it, who it is contested with, and what would have to be true for the answer to flip.

See the brief →