The Economics of the Last Mile: The Margin MSSPs Give Away for Free
Most MSSPs price identity like a deployment and deliver it like an operation. The gap between those two is margin you're giving away — or risk you're leaving with the client.
This one isn't about architecture; it's about your P&L. If you run an MSSP that touches identity, there's a line of work you are almost certainly doing, almost certainly not pricing, and therefore either eating as cost or quietly leaving undone. Either way it's money — yours or your exposure. Let's put numbers-thinking on it.
Deployment is a project; the mile is an annuity
Identity gets sold the way it gets bought: as a project. You scope it, deploy the IdP, integrate the apps, migrate the accounts, hand over a runbook, and invoice for the engagement. Clean, boundable, one-time revenue.
But identity doesn't stay deployed. The actual cost — the continuous work of keeping it under control as it drifts — is an operation, not a project: enforcing MFA on the account that appeared last week, reviewing the OAuth grant that showed up this morning, verifying the help-desk reset this afternoon, decommissioning the tenant nobody remembers. That work recurs forever. You priced a project and signed up for an annuity of labor.
When the pricing model (one-time) and the cost model (continuous) don't match, the difference doesn't vanish. It comes out of your margin.
Three ways the margin leaks
In practice the mismatch resolves one of three ways, and two of them cost you:
- You do the work and don't bill it. The operational mile gets absorbed into "support" or goodwill. Your engineers spend hours a month per client on drift you never quoted. That's direct margin erosion, and it scales with your client count — the more you grow, the more unbilled operation you carry.
- You don't do the work, and it becomes the client's risk. The mile goes unowned. It holds until it doesn't, and when a client is breached on a gap you could have closed, you don't get to be the neutral observer — you were their identity provider. That's churn, liability, and reputational cost, which is margin too, just realized violently and all at once.
- You priced it right and own it deliberately. Rare, because it requires treating the mile as a recurring service with its own SKU, not a freebie attached to a deployment.
Most shops live in some blend of 1 and 2: a slow bleed of unbilled hours, punctuated by the occasional expensive surprise. Both are the same root cause — value delivered, not captured.
Why it stays invisible
This leak hides better than most because the work is diffuse. There's no single big invoice line for "the last mile"; it's an hour here and an hour there, smeared across support tickets, after-hours fixes, and "while I'm in there anyway." Diffuse cost is the hardest kind to see and the easiest to under-price, because no one event is big enough to trigger a pricing conversation. So it accretes, quietly, against your margin, until you do the math across all clients and notice you've been running a continuous identity operation for free.
The reframe that captures it
The fix isn't to work harder; it's to recognize what you're selling. You are not selling an identity deployment. You are selling continuous ownership of the identity mile — the thing that keeps the client actually under control between the events everyone else only reacts to. That's a recurring, high-value service, and it deserves recurring, priced-in revenue:
- Name the service. Make "we own your identity posture, continuously" an explicit, recurring line, not an implied freebie.
- Price the annuity as an annuity. The cost recurs monthly; the revenue should too.
- Measure what you deliver. Time-to-close, coverage, gaps prevented — so the value is legible to the client and defensible at renewal.
- Make the operation efficient enough to have margin. The reason shops give this away is that done manually it has no margin. The leverage is in making continuous ownership cheap to deliver per client, so it's a profit center instead of a cost sink.
The takeaway
The last mile of identity is real work, you're probably already doing it, and if you priced a project while delivering an operation, you're giving away the most valuable and most defensible thing you do. The margin isn't lost to competition or to cost of goods — it's lost to a pricing model that doesn't match the work. Name the operation, price it as the annuity it is, and make it efficient enough to keep the margin. The alternative is bleeding it a quiet hour at a time, or all at once on the day a client gets breached.
Making continuous ownership of the mile cheap enough to be a margin line rather than a cost sink is exactly why I build Aurelion. If the math here looks like your business, I'd genuinely like to compare notes.