A customer asks whether you can add one more service to their monthly IT agreement. You already manage their devices, cloud accounts or phone system, and they trust your team. The opportunity is attractive, but the question that decides whether it works is practical: who will own the service after the sale?
A value added reseller earns its place by doing more than passing on a product or licence. The reseller makes the offer useful, supports it in operation and charges for the work involved. That can create dependable recurring revenue, but only when delivery has a clear owner and a realistic scope.
What a Value Added Reseller Does
A value added reseller (VAR) buys products or licences from a vendor or distributor, then adds something the customer can't get from the box alone, such as installation, configuration, training, integration, helpdesk support or ongoing management.
Think of the difference between a shop counter and an installer. A standard reseller hands over the product. A VAR fits it, sets it up, makes it work with the customer's other systems and stays available when something needs attention. The product is still part of the sale, but the customer is paying for a working result.
The reseller sells an outcome
Suppose a small firm is moving into a new office and needs hosted phones. A transactional seller might quote the licences and hand over the order. A VAR can assess the users' needs, configure the system, move numbers, explain how to use the phones and provide support after go-live. The customer gets a functioning service and a supplier who knows how it was put together.
The UK Government identifies software resellers as the largest category of companies in the UK software market by number of businesses. Many describe themselves as VARs because they combine third-party software with implementation, integration, support and other ongoing services. In the government's analysis, 23% of surveyed software vendors used VARs as a route to market, compared with 30% using managed service providers and 88% using direct sales. The figures show that resellers are an established channel, while direct sales remain dominant, as set out in the UK Government's software market analysis.
The model suits MSPs, IT support companies, telecoms and VoIP providers, hosting firms, web agencies and technology resellers. Each may already have a customer relationship, a service desk or a recurring contract that can support an additional offer.
The commercial difference
The core benefit is that the reseller can earn from delivery over time, not just from the first product sale. The customer relationship stays with the reseller, who can connect the new service to existing support, account reviews and renewals.
Try this quick test:
- Do you install or configure what you sell?
- Do you support it after the sale?
- Do you bill for that support every month?
If you answer yes to all three, you're already operating much like a VAR. The next task is to make sure the ongoing work is defined and priced, rather than absorbed into a general support agreement.
How a Value Added Reseller Differs From a Standard Reseller
| Aspect | Standard reseller | Value added reseller | Distributor |
|---|---|---|---|
| Main role | Sells vendor products to end customers | Sells products plus implementation and ongoing services | Supplies resellers with stock, licences and logistics |
| Revenue pattern | Mostly one-off sales and product margin | Product margin plus recurring service fees | Volume margin on supply to other resellers |
| Customer relationship | Transactional and often short-term | Ongoing and service-led | Usually indirect, through resellers |
| Support after sale | Limited, usually passed to the vendor | Provided by the reseller under contract | Limited to logistics and vendor coordination |
| Typical sales route | Catalogue or quote | Consultative, based on a needs assessment | Trade accounts and volume ordering |
The table highlights where the work sits. A standard reseller mainly earns through a product sale. A distributor supplies other resellers at scale, usually without owning the end customer relationship. A VAR combines product margin with implementation and service fees, and stays accountable for the customer-facing delivery it has agreed to provide.
The UK Government's 2025 cyber-security sector analysis distinguishes businesses that package and resell cyber-security solutions, usually through licensing agreements, from managed-security providers that deliver monitoring, management and threat detection for monthly or annual fees. A VAR can sit between those models by adding a defined operating layer around a licence: onboarding, configuration, alert handling, reporting and customer support. The government analysis estimates 2,165 UK cyber-security firms, with 71% mainly engaged in service provision, including managed services and reselling. Service providers generated approximately £7.4 billion in cyber-security-related revenue, according to the UK Cyber Security Sectoral Analysis 2025.
One customer, two offers
A customer can buy a software licence once and receive access to the product. If the customer needs help later, support may sit with the vendor or be charged separately. A VAR contract can instead include the licence, a defined setup, a monthly support fee and scheduled account reviews. The recurring fee pays for specific work, not the expectation that the reseller will be available.
That distinction matters when setting up the business behind the offer. A reseller needs to know which revenue is one-off, which recurs and what the recurring charge covers. Clear financial reporting can help separate those lines; a business reviewing its accounting approach may find a partner for clearer financial reporting a useful starting point.
If the customer would stop paying the monthly fee the moment support stops, the business is already operating as a VAR. Put that service into a clear contract.
Where a Reseller Adds Value Beyond the Licence
A reseller can add value in stages, from a defined installation project to a continuing service. The best starting point is usually a customer need the team already understands, rather than a new product looking for a buyer.
| Value layer | What the customer gets | Revenue type | Example |
|---|---|---|---|
| Implementation | Set-up, configuration and data migration | One-off project fee | Deploying a hosted phone system for a new office |
| Support contracts | Helpdesk, patching and fault repair | Monthly or annual fee | Business support plan for a 40-seat office |
| Managed services | Ongoing monitoring and management of the environment | Monthly fee per user or device | Managed IT with backups and monitoring |
| Co-managed services | Reseller works alongside the customer's in-house team | Monthly fee plus project work | Support for an internal IT team during a cloud migration |
| White-label products | Partner's platform delivered under the reseller's brand | Monthly subscription per customer | Dark web monitoring sold under the reseller's own name |
A common sequence is to win the account through project work, then offer a support contract that keeps the environment stable. Once the customer trusts the team and understands how it works, the reseller can attach managed services or a white-label product. Each step should solve a recognisable problem and have a named delivery owner.
Start with the customer base you have
Existing customers provide natural opportunities to discuss another service. An IT support review may reveal a need for monitoring; a cloud project may prompt a conversation about account exposure; a hosting renewal may be a sensible moment to review domain and email risks. Connectivity, telecoms systems and web services can also provide a route into a practical discussion about security.
For example, an MSP already supporting a firm's cloud accounts can introduce domain and credential monitoring as a separate monthly line. The account manager explains what the service checks. The service desk lead handles alerts according to an agreed process. The customer sees the offer as an extension of a relationship it already has, rather than an unrelated tool purchase.
Service fees are generally more predictable than product margin because they recur while hardware and licence sales depend on new orders. That doesn't make recurring revenue automatic: support still takes staff time, and customers need to see what they're paying for. A monthly service with no defined activity, reporting or response process can become an open-ended obligation.
Every layer needs a written scope, a named owner and a clear price basis. Without those, a useful add-on can turn into unpaid work: customers ask for help, staff respond, but nobody has agreed whether the task is included or billable.
Packaging and Selling a White-Label Service
A white-label service lets a partner present a technology provider's platform as its own offer. The customer sees the reseller's brand and buys through the reseller, while the underlying technology is supplied by a provider. For a VAR, the commercial case is strongest when the offer is easy to explain and fits the service operation already in place.
Dark web monitoring checks for compromised email addresses, exposed passwords and information associated with breached domains, then sends early alerts when relevant information appears. The customer needs clear findings and sensible next steps, not a complicated dashboard they have to interpret without support.
The UK Government's 2025 managed-service-provider study estimates 12,867 active MSPs in the UK. It reports that 22% of active MSPs perform cyber-security activities and 55% offer cloud services. Those existing support relationships and cloud estates give many providers a practical way to attach monitoring to services customers already use, as described in the UK MSP market study.
The sales case is ongoing exposure, not a promise that every business will suffer an attack. The UK Government's Cyber Security Breaches Survey 2025–2026 found that 43% of businesses identified a cyber security breach or attack in the previous 12 months. It also found that 69% of large firms experienced breaches or attacks, while 29% of firms experienced them at least once a week, according to the Cyber Security Breaches Survey 2025–2026. These findings support a recurring conversation about visibility and early warning, not a claim that monitoring prevents every incident.
Build a service people can deliver
Audit the customer base. List customer domains, business email users and accounts already covered by IT support or hosting agreements. Identify which customers have a clear contact for security alerts.
Pilot with trusted accounts. Start with a manageable group, such as 20 to 30 customers, and track who accepts the offer, what questions they ask and how the team handles alerts.
Set a tier for each segment. Smaller businesses may need domain and credential monitoring with an account manager as their contact. Larger customers may need broader coverage, alert handling and a named security lead.
| Segment | Offer | Sales hook | Owner |
|---|---|---|---|
| Smaller firms | Monthly domain and credential monitoring | Staff email addresses exposed in a breach | Account manager |
| Mid-sized firms | Wider monitoring with alert handling | Evidence for their own compliance questions | Service desk lead |
| Large accounts | Broader coverage with incident support | Board-level risk visibility and escalation | Account director with a security lead |
- Make renewal useful. Ask a straightforward question during account reviews: are your staff's business email addresses in any breach? The conversation should lead to a clear explanation of what the service checks and what the customer should do with an alert.
A single dashboard can help the reseller keep oversight across accounts. GoSafe's dashboard lets MSPs and IT providers track risk scores, view breach history, detect dark web threats and receive real-time alerts for all their customers in one platform. GoSafe is fully white-labelled, so MSPs and IT providers can offer it under their own brand. A consistent customer experience matters too; agencies managing email campaigns, for example, may need separate sending identities for agency clients to keep each client's communications clearly attributed.
The operating promise should be simple: no complex setup, no need to build security tools internally, and no requirement to pretend the reseller is running a security operations centre. The partner owns the customer relationship. Position the service as early warning, visibility and peace of mind, not full protection. A managed IT provider, for instance, can add domain monitoring to existing plans and review relevant alerts at its monthly account meeting. For more on the commercial model, see SaaS reseller pricing and benefits.
Pricing the Monthly Fee for Margin
Set the price before pitching. A monthly subscription creates useful recurring revenue only if it covers the platform charge and the work your team will perform. Don't price the service as if every customer will generate no questions or alerts.
Begin by estimating delivery time for each tier. Include alert triage, customer contact, investigation, reporting and routine account review. A planning example might allow 30 minutes a month for a smaller firm and two hours for a larger account with incident support. Those are costing assumptions, not universal service standards; replace them with the time your own scope requires.
Build the price from the work
- Cost the monthly delivery hours. Multiply the expected hours per customer by your internal hourly rate, including the cost of the staff who will own the work.
- Add the platform fee. Use the applicable reseller cost per domain or user, and confirm the current terms before quoting. Don't make up a platform cost or rely on an old proposal.
- Allow for the service around the tool. Include onboarding, customer questions, reporting and renewal activity, then set a margin that gives the service room to operate.
- Write down the basis. The contract should define what the customer receives, the named owner, the escalation hours and any work billed separately.
For a 40-seat office on a smaller tier, calculate the delivery time for routine checks and customer contact, then add the actual platform charge. For a 250-seat firm with incident support, cost the additional triage, escalation and reporting time separately. The larger account should not inherit a price scaled from the smaller one if it requires a different level of service.
Price the service you can deliver, not the service you hope will take no time.
A useful comparison is the full cost of a service rather than only its headline monthly charge. The same habit applies when evaluating other software subscriptions, as illustrated in UI Lib's guide to POS costs. For an MSP-focused view of packaging and charging, review MSP pricing with GoSafe Dark Web monitoring. Before launch, check that one lost renewal won't erase the margin across the rest of the portfolio.
Who Owns Alerts, Escalation and Evidence
A white-label service either works as an organised process or becomes an unmanaged alert forwarder. A customer receiving an alert without context may not know whether it matters, who should investigate or what to do next. The reseller needs an operating procedure before the first alert arrives.
A repeatable alert procedure
Set a triage window. Decide how quickly the team will review an alert, such as within the same business day, and name the person responsible. Put that commitment in the service scope so customers know what response to expect.
Confirm the customer and affected account. Check whether the exposed information belongs to a live customer and identify the associated domain, user or system. Don't treat a match as proof that an account has been accessed or that a breach is ongoing.
Contact the customer with clear findings. Use plain English to explain what was identified, when it was detected and what action the customer should consider. Route the message to the customer's agreed contact rather than sending an unexplained alert to a general mailbox.
Record the timeline. Log detection, review, customer notification and actions taken. Keep enough detail for the customer to understand what happened and for its internal team to continue the investigation.
Agree the next escalation. The customer, its legal adviser or data protection lead should assess whether the incident is reportable. Name an out-of-hours route for situations where waiting until the next working day would be inappropriate.
The Information Commissioner's Office says an organisation must notify it without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach likely to create a risk to individuals' rights and freedoms. If the breach presents a high risk, affected individuals must also be informed without undue delay. The ICO also explains that organisations can provide information in stages rather than waiting for every part of an investigation to finish, as set out in its personal data breach guidance. Monitoring can help identify information earlier, but it doesn't make the legal assessment or notification decision for the customer.
Responsibilities that stay with the reseller
Resellers can offer GoSafe to their own customers and remain responsible for those customers' compliance. Resellers act as independent data controllers for their own customers, and GoBig Online LTD has no direct contractual relationship with reseller end users. The reseller must ensure that any end user for whom it performs searches has a lawful basis for that processing and has received appropriate notices.
That responsibility includes explaining the service accurately, controlling who can search and keeping a record of the process used to handle results. GoBig Online LTD isn't liable for decisions, actions or inaction taken by resellers or end users based on GoSafe results or omissions. A reseller should therefore make its role and the customer's role clear in the contract and operating procedure.
After an alert, give the customer an evidence pack that records the finding, the relevant domain or account, the detection and notification times, the person who reviewed it, the customer contact and the actions agreed. Include the status of any follow-up and identify who owns the next step. That record helps the customer investigate and decide what to do; it doesn't substitute for legal advice or the customer's own incident-response responsibilities.
Decide Whether the VAR Model Fits Your Business
The VAR model fits a business that already has customer contracts, some delivery capacity and at least one service it can standardise. It's a poor fit if the sales team can make promises but nobody can own delivery once the customer signs.
Use three checks before adding a new offer:
- Renewals: Do you already run a regular renewal or account-review cycle with customers?
- Ownership: Can you name the person who will handle alerts during the working day?
- Explanation: Can you describe the service in one sentence to a non-technical buyer?
If you can answer yes, move in order. Review your customer list for domains and relevant accounts, choose a pilot group of 20 to 30 trusted customers, and price the monthly fee against the time required for triage and support. Then decide how the offer will appear under your own brand. A GoSafe customer says the service is built specifically for resellers, making it easy to roll out, and that its margins are strong. Another says it gives customers a simple, affordable way to stay protected against data breaches and adds real value to monthly services. GoSafe helps MSPs protect over 15,000 businesses worldwide.
View the dark web monitoring reseller program to assess whether the model fits your customer base and delivery capacity.
GoSafe Dark Web monitoring gives service providers a fully white-label way to offer continuous dark web scanning, with clear alerts for compromised email addresses, exposed passwords and breached domains. Add it as a defined monthly service under your brand, and visit GoSafe Dark Web monitoring to explore how it can fit your reseller offer.