As competition intensifies, managed service providers (MSPs) and managed security service providers (MSSPs) are under growing pressure to expand their value, differentiate beyond infrastructure and support, and evolve as trusted technology partners. In a recent survey, 43% of MSPs ranked customer acquisition as their top challenge, while 37% pointed to revenue growth and 36% to profitability.1
Although cybersecurity is in high demand, a significant protection gap exists because many clients of MSPs lack incident response (IR) plans. In 2024, the global incident response services market was valued at US$35.4 billion2. By 2033, it’s projected to grow at a compound annual growth rate (CAGR) of 17% to reach US$157 billion3. The estimated growth is driven by increasing cyberattack sophistication and the demand for robust response solutions.
By adding robust IR capabilities to their portfolios, MSPs can create a high-value, revenue-generating service line that strengthens customer resilience and deepens trust, leading to higher retention rates and profitability.
The Unit 42® Partner Retainer Service is a channel-focused program that enables service providers to deliver enterprise-grade IR quickly and cost-effectively. This service augments your existing IR with our global team, without you needing to build in-house teams. It offers two flexible partnership options that you can align with your business model. They enable scalable services and position your firm as a trusted security advisor. This service delivers cost efficiencies and a boost in predictable revenues and customer retention.
Partner Benefits
- Predictable, recurring revenues and increased retention with world-class services.
- Flexible credits for response, services, or training, maximizing value.
- A tech-agnostic approach, where Unit 42 works with existing customer resources.
- No-cost deployment of Palo Alto Networks tools during incident response, as needed.
- Use of prepaid credits anytime throughout the term of multiyear retainers.
Partnership Options
Reseller Program
You can resell Unit 42 Retainers directly as part of your cybersecurity portfolio. In this currently offered program, you own the client relationship and can bundle the retainer with your own offerings. The client uses the credits as needed for Unit 42 Incident Response, Cyber Risk Management services, or both. Unit 42 handles service delivery and case management under defined SLAs based on the service tier.
Partner Retainer
This new offering is intended to align with your business model and provides flexibility. It enables you to purchase Unit 42 Retainer credits for your own use, distribute them across multiple clients in the region as needed, or do both.
You can use the credits, which are available as part of service Tiers 3 and 4, for both reactive and proactive services with your clients. You can also apply them toward a Unit 42 Incident Response Bootcamp to strengthen and upskill your internal teams. Both you and your clients receive priority access to Unit 42 responders and forensic experts, backed by tier-based SLAs (table 1).
Incident Response Bootcamp
The Incident Response bootcamp is a training program that teaches your security team the best professional practices from the initial stages of an incident up to performing incident response at scale.
Table 1. Partner Retainer Tiers |
||
|---|---|---|
Tier |
Credits |
Response Time (SLA) |
3 |
1,250–2,250 |
2 hours |
4 |
2,500+ |
2 hours |
Why Partner with Unit 42
Augment Your Incident Response Capacity
The Partner Retainer is designed to be a seamless extension of your team, filling the critical gap in deep 24/7 incident response coverage. You retain your status as the client’s trusted primary point of contact, while Unit 42 handles the entire technical execution, end-to-end. You receive instant access to elite responders, who manage over 1,000 global investigations annually, with guaranteed 24/7 coverage across all major time zones.
Predictable, Recurring Revenues While Boosting Retention
Partnering with Unit 42 enables you to benefit from world-class incident response and cybersecurity services, without needing to build an in-house team, and to generate a predictable, recurring revenue stream. By using our team of threat hunters and responders, you strengthen client trust, boost retention, and gain a distinct competitive edge.
Flexible Credit Utilization to Maximize Value
Apply our flexible credit model across reactive incident response, proactive risk assessments, and partner-focused incident response bootcamp. This way, every credit drives measurable value and no credits go unused.
Technology-Agnostic Approach
Unit 42 can use the Palo Alto Networks comprehensive technology stack or seamlessly operate with the partners’ and customers’ existing tools. Both deliver enterprise-grade protection, incident response, and peace of mind for you and your clients. When needed, the Unit 42 team can supplement existing technology by deploying Palo Alto Networks products at no additional cost during the investigation.
Powered by Global Threat Intelligence
Unit 42 continuously analyzes global adversary activity, correlating telemetry from millions of endpoints across more than 70,000 customers, and threat feeds across industries. We ensure the latest adversary tactics in the context of the organization inform every response.
Trusted by Insurers and Law Firms
More than 50 cyber insurance carriers and over 150 global law firms recommend Unit 42. Your clients will gain confidence in our ability to deliver coverage, compliance, and defensible response.
Transform Your Business with Unit 42
Differentiate and Enhance Your Security Offering
Use the retainer with SOC or endpoint protection offerings to provide guaranteed SLAs, forensic support, and regulatory-grade reporting. This combination positions your brand as both a complete security partner and a monitoring provider.
Elevate Your Clients’ Cyber Resilience
Apply retainer credits to any number of proactive assessment services. Demonstrate measurable readiness improvements, boost client confidence, and drive recurring revenue.
Secure Cloud Environments
Navigate the complexity of hybrid and multicloud infrastructures, bringing enterprise‑grade incident response to your clients’ cloud infrastructure.
About Unit 42
Palo Alto Networks Unit 42 brings together world-renowned threat researchers, elite incident responders, and expert security consultants to create an intelligence-driven, response-ready organization that’s passionate about helping you proactively manage cyber risk. Together, our team serves as your trusted advisor to help assess and test your security controls against the right threats, transform your security strategy with a threat-informed approach, and respond to incidents in record time so that you get back to business faster. Visit paloaltonetworks.com/unit42.
1 State of the MSP Industry 2025 Look Ahead: Trends, Growth and Strategies for Success, Datto–A Kaseya Company, March 4, 2025.
2 Incident Response Services Market Report, IMARC Group, January 2025.
3 Ibid.
