White-Label SOC vs MSSP vs Co-Managed SOC

White-label SOC vs MSSP compares a service delivered under a partner’s brand with a type of managed security provider. Co-managed SOC describes how a provider and an MSP or client team share security operations.

These arrangements can overlap, so choosing a model means deciding which work the MSP will retain, how clients will experience the service, and what authority the provider needs.

Download the guide Request a Demo

The Main SOC Delivery Models

The main models are white-label delivery, resale, co-management, referral, and an in-house SOC. An MSP can use different arrangements for different clients rather than choosing one for its entire business.

White-label SOC

A specialist provider supplies agreed SOC capabilities under the MSP’s brand. The MSP generally holds the client relationship, while the provider’s role and responsibilities remain documented.

Resold MSSP or MDR

The MSP sells another provider’s security service, usually with that provider’s branding visible. Contracting, billing, and client contact depend on the resale arrangement.

Co-managed SOC

The MSP or client team shares operational work with a provider. The arrangement can also be white-labeled or sold under the provider’s brand.

Referral

The MSP introduces a client to a security provider that generally contracts and delivers directly. The MSP may remain involved in related IT work.

In-house SOC

The MSP operates the security service with its own team and procedures. External platforms or specialists may still support parts of the operation.

White-Label SOC vs MSSP

A white-label SOC describes how a service is presented, while an MSSP, or managed security service provider, describes the business supplying security services. An MSSP can serve clients directly, support channel partners, or offer both white-label and co-managed delivery.

For an MSP comparing white-label SOC vs MSSP options, the useful distinction is usually between delivering a partner-supported service under its own brand and reselling a visibly separate provider’s service.

Under white-label delivery, clients generally use the MSP’s branded portal and receive its reports. Under resale, the provider’s identity is usually visible, but that does not automatically mean the provider handles client communication or holds the client contract.

Neither arrangement establishes how much response is included. A service may investigate and advise, carry out authorized containment, or provide broader incident support, regardless of whose logo appears.

Technology requirements also vary independently of branding. Some services work with existing tools; others require particular agents or platforms, which can affect both adoption and a later provider change.

MDR describes a detection and response service rather than a branding model. See MSSP vs MDR for that distinction.

Compare the Delivery Models

White-label, resale, and co-managed arrangements differ mainly in presentation and participation, with the actual service defined separately. The table shows typical arrangements rather than guarantees attached to each label.

Consideration	White-label SOC	Resold MSSP or MDR	Co-managed SOC
Visible brand	Usually the MSP’s.	Usually the provider’s, sometimes alongside the MSP’s.	Either brand or both.
Client contract	Generally held by the MSP.	Held by the MSP or provider.	Depends on the commercial arrangement.
Operational participation	Provider supplies the agreed SOC work.	Provider supplies its defined service.	Internal and provider teams each retain agreed work.
Internal capability	Service ownership and client coordination are still needed.	Resale may still require technical and operational support.	Staff need the skills and availability for their assigned work.
Operational control	Depends on configuration access and agreed procedures.	Depends on the provider’s service and partner access.	Shared within defined areas of authority.
Future changes	Branding may stay consistent while the provider changes.	Provider changes may be more visible to clients.	Responsibilities may change without replacing the platform.

Pricing and margin depend on service scope and the work the MSP retains. See White-Label SOC Pricing Models for the commercial comparison.

What Is a Co-Managed SOC?

A co-managed SOC shares security operations between a provider and an MSP’s or client’s team. Both contribute to the service, with access to the records needed for their work through a shared platform or connected systems.

Co-management suits teams that want external capacity or specialist support while retaining operational involvement.

Share Coverage by Time

The internal team may cover business hours while the provider covers nights, weekends, and public holidays. Some arrangements retain provider monitoring throughout the day, with internal analysts joining investigations when available.

Divide Work by Complexity

The provider may handle initial investigation while internal specialists address cases requiring detailed client knowledge. The reverse can also work, with the provider supporting investigations beyond the internal team’s expertise.

Separate Investigation and Approval

A provider can investigate and prepare recommendations while an authorized internal person retains decisions affecting the business. Permission to investigate does not automatically grant permission to change systems.

Share Engineering Responsibilities

Co-management can include platform administration and detection engineering as well as alert handling. An MSP may retain investigation while the provider maintains integrations and detection content, or retain its platform while buying analyst coverage.

The arrangement should preserve meaningful participation. A portal containing finished reports gives visibility, but operational co-management also requires a defined area in which the internal team can contribute and make decisions.

Compare SOC and IT Services

White-label SOC and white-label IT services use a similar partner delivery structure but perform different operational work. A helpdesk or network operations center supports reliable IT services, while a SOC investigates suspected threats and supports security response.

Purpose

IT operations maintain availability and user productivity. Security operations assess malicious activity and its effect on the organization.

Evidence

IT teams work with service tickets, configuration, and performance records. SOC analysts connect security evidence across accounts, endpoints, applications, and networks.

Skills

Systems administration and troubleshooting underpin IT support. Threat investigation requires additional expertise in attacker behavior, detection engineering, and evidence interpretation.

Urgency

Both services can require 24x7 coverage. Security urgency depends on the threat and potential impact, rather than whether a user has reported a fault.

Coordination

An incident may require both teams, with the SOC establishing the security findings and IT staff helping restore systems under an agreed plan.

Build Your Own Agentic SOC

Building your own SOC gives you control over investigations, response, and service delivery. Choose an AI SOC platform that helps your team investigate more alerts and manage clients without adding manual work at every step.

Look for AI triage, investigation, and response alongside multi-tenant case management, reusable skills, and reporting. Your analysts should be able to review the evidence, direct agents, and set approval rules for each client.

Add Support Where You Need It

Running your own SOC does not mean doing everything yourself. Use a provider for overnight coverage, detection engineering, or specialist incident response while your team leads the service. A shared platform lets both teams work on the same cases.

Choose the Right Model for Your MSP

Choose a model that fits your team’s capabilities and the security service you want to build. Consider who will investigate alerts, authorize response, and support clients, alongside the platform and expertise needed to deliver consistently.

MSP situation	Arrangement to consider	Reason
Wants its own security service without staffing a SOC.	White-label SOC with defined provider support.	Delivers the service under your brand with external analysts handling agreed operations.
Wants to offer an established provider’s service.	Resold MSSP or MDR.	Adds an established security offering to your services.
Has engineers who should remain involved.	Co-managed SOC.	Combines your team’s client knowledge with external coverage and expertise.
Serves clients with specific operating requirements.	A configurable managed or co-managed service.	Adapts procedures, approvals, and response to each client.
Does not intend to operate a security practice.	Referral.	Gives clients access to a specialist provider while your team focuses on IT.
Wants to build and run its own SOC.	An in-house agentic SOC on an AI SOC platform, with optional external support.	Gives your analysts control, supported by AI triage, investigation, and response capabilities.

The platform matters whichever model you choose. Check that it supports your clients’ tools, keeps tenant data separate, and gives your team visibility into investigations and response. For an in-house SOC, AI capabilities help expand coverage and reduce repetitive work.

Once the model is clear, evaluate partners against your service requirements. How to Choose a White-Label SOC Provider covers provider selection and trials.

Review Liability and Disclosure

Liability depends on the agreements, each party’s actions, and applicable law, rather than on the service’s branding alone. Under a typical white-label arrangement, the MSP holds the client agreement, but that does not make every incident solely the MSP’s responsibility or remove the provider’s obligations.

Client commitments need to reflect the provider’s actual support. White-label branding does not turn a monitoring-only service into a response service.

Matching commitments

Compare client obligations with provider coverage, exclusions, and liability limits. Differences can leave the MSP responsible for work or losses the provider has not agreed to cover.

Insurance coverage

Ask the insurer how the policy treats subcontracted security services and the MSP’s retained activities. Provider insurance should be reviewed separately rather than assumed to cover the MSP.

Incident notification

Establish how each party supports assessment and any required notifications. Provider involvement does not automatically transfer the client’s legal reporting obligations.

Provider disclosure

White-label presentation does not override privacy or procurement requirements. A provider processing personal data on an MSP’s behalf may be a sub-processor, depending on the processing relationship and applicable law.

Legal and insurance review should address the actual operating arrangement, including shared work. A co-managed service needs particular clarity where one party’s investigation depends on information or decisions from another.

After an incident, the case record can help establish what each party knew and did. A missed detection, delayed decision, and action outside approved authority raise different questions and should not be treated as the same failure.

Adapt Your SOC as You Grow

Your operating model can change as your team and client base grow. You might bring investigations in-house, add provider support overnight, or launch your own branded service. Choose an AI SOC platform that supports those changes without forcing you to rebuild your operations.

Changing who does the work is different from changing the technology. Your analysts may take over investigations on the same platform, keeping client context and case history available. Moving to another platform requires a broader transition.

Define Responsibilities

Agree who will handle monitoring, investigations, approvals, and response after the change. Confirm that your team can cover its new responsibilities before reducing provider support.

Update client agreements where the service or contracting party changes. Branding alone does not transfer contractual responsibilities.

Keep Knowledge Available

Preserve detection tuning, approved exceptions, investigation skills, client procedures, and open cases. These help the incoming team build on work already done.

If you change platforms, check what can be exported and imported, including historical evidence. See White Label SIEM for MSSPs for data handling and retention considerations.

Maintain Coverage

Test the incoming service before switching off existing coverage. Confirm that alerts arrive, agents can query the required sources, and response actions follow the correct approval rules.

During the overlap, give each active case one owner. Hand over unresolved findings, pending actions, and client communications so teams avoid duplicated or conflicting responses.

Complete the Handover

Confirm that the incoming team has accepted responsibility and demonstrated the required coverage. Update permissions, remove obsolete access, and keep a recovery plan if the transition encounters problems.

An AI SOC platform can make the change easier by keeping agents, analysts, and providers working from the same cases. Responsibilities and autonomy settings can then evolve as your team takes on more of the service.

How to Choose a White-Label SOC Provider covers assessing a partner’s ability to support future changes.

Choose How You Run Your SOC

ThreatDefence lets you run your own agentic SOC, use our 24x7 analysts, or combine both on one AI SOC platform. Change responsibilities as your team grows without moving clients to new technology.

AI agents investigate every alert, with your team and ours working the same cases under each client’s procedures. The portal, reports, and notifications carry your brand, and incident response is included.

Partner-branded client portal showing alerts investigated, confirmed incidents, median time to acknowledge, security score, and open cases

A co-managed case where AI triage, a ThreatDefence analyst, the partner's engineer, and the client's IT manager work the same incident

Become a Partner

See It in Action

By submitting this form, you accept the terms in our privacy policy.

Frequently Asked Questions

What is the difference between a white-label SOC and an MSSP?

A white-label SOC describes a service delivered under a partner’s brand, while an MSSP is a managed security service provider. An MSSP can supply white-label services, serve clients directly, or do both.

What is a co-managed SOC?

A co-managed SOC shares operational work between a provider and an MSP’s or client’s team. The arrangement may divide coverage, investigations, approvals, or engineering, with records available to the people performing each role.

Is a white-label SOC the same as MDR?

No, white-label describes branding and delivery, while MDR describes managed detection and response. A white-label SOC may include MDR, but the actual monitoring and response scope needs to be confirmed.

Should an MSP build its own SOC?

Build your own SOC when you want control over investigations, response, and service delivery. An AI SOC platform with triage, investigation, and multi-tenant case management keeps the workload manageable, and a provider can cover overnight monitoring, detection engineering, or specialist incident response while your team leads the service.

Who is liable if a white-label SOC misses an incident?

Liability depends on the agreements, the parties’ conduct, and applicable law. The MSP should align its client commitments with provider support and have legal and insurance advisers review the remaining exposure.

Does a white-label SOC provider count as a sub-processor?

A provider may be a sub-processor when it processes personal data on behalf of an MSP acting as a processor. The actual processing roles and applicable privacy law determine the classification and disclosure requirements, regardless of branding.

Can an MSP move from reselling to a white-label SOC later?

Yes, where the provider arrangements and client agreements allow the change. The MSP needs to address any changes to contracts, responsibilities, technology, and active cases while maintaining coverage.

Which model is best for a small MSP?

A white-label SOC can suit a small MSP that wants its own security service while relying on external SOC operations. Referral may fit better when security delivery sits outside its strategy, while co-management requires people able to perform the retained work.