Network Box USA
MSP Partner Conversation

Cybersecurity.
Done for you.

Managed cybersecurity for MSP partners, built on more than 20 years of operating the security behind the technology.

Network Box USA•Operating since 2000
01
Official service families

A broad managed stack,
available a la carte.

Edge DefenseManaged perimeter and SASE-aligned controls.
  • Secure SD-WAN
  • Secure Web Gateway
  • UTM+
  • Web Application Firewall
NBX / MDRDetection, investigation, response, and reporting.
  • SIEM+
  • SOC
  • EDR
  • XDR / MDR / IDS / IRR
More ProtectionAdditional client-ready services around the stack.
  • Managed Cloud Email Security
  • DWM+ reputation monitoring
  • IP and domain reputation
  • Pen testing
  • SAT / Security Awareness Training
02
The trust layer

All Network Box USA SASE services
are powered by:

Operations backboneGlobal network of 16 fully staffed Security Operations Centers (SOC)with Incident Response Services
IntelligenceBest in class Threat Intelligence
ResponseSelf-Operated Security Response Center (SRC)
Unified administrationUnified GUIAdminister across services with status, KPIs, dashboards, tickets, pre-built & custom reports
Credentials Highest level of certifications and awards
ISO/IEC 9001ISO/IEC 20000ISO/IEC 27001ISO/IEC 31000ISO/IEC 15408PCI DSS v4.0.1SOC
03
Why we are different

We are the vendor and the MSSP.
One service provider owns the work.

Edge Defense, MDR, email, reputation monitoring, reporting, and response are built to work together and managed by the same security operation.

Edge DefenseSD-WAN / SWG / UTM+ / WAF
NBX & MDRSIEM+ / SOC / EDR / XDR / IDS / IRR
More ProtectionEmail / DWM / reputation
Security Response CenterSelf-operated SRC
Threat IntelligenceSignals become controls
Unified GUIStatus / KPIs / tickets / reports
04
How the platform grew

We started with managed UTM.
Then kept adding the service around it.

01 · UTM roots

Perimeter protection is where we began.

Managed UTM remains a core entry point, with hardware included as part of the service and kept patched and updated.

02 · PUSH technology

Threat updates are pushed continuously.

Patented PUSH technology distributes new protection automatically, with more than 10,000 global pushes per day.

03 · Human testing

Pen testing is performed by real practitioners.

Adversarial testing is not just an automated scan. A person tries to find the paths an attacker would use.

05
Patented push technology

New threats should become
new protection quickly.

Threat activity is researched, translated into controls, and pushed automatically across the managed platform, not just released on a timer.

More than 10,000 global pushes per day: protection updates flow continuously from threat intelligence into managed controls.
06
A complete operating loop

“Managed” should mean more than
sending you an alert.

Configure

Preconfigured services, security policies, and included hardware where the service requires it.

Maintain

Central management, patches, signatures, and policy updates handled continuously.

Monitor

24/7 visibility, detection, validation, and investigation.

Respond

Containment, intervention, and escalation within policy.

Remediate

If it’s something we can remediate, corrective action happens within agreed scope.

Report

Clear visibility for the partner, the client, and compliance needs.

07
The 2 a.m. test

When something happens,
who owns what happens next?

1The event is detected and validated.
2The SOC investigates context and impact.
3Response or containment begins within policy.
4The partner is informed when action or context is needed.
08
The category difference

A security product is not the same as
a security operation.

Typical DIY stack
Network Box USA model
Tools and licenses
Managed controls and services
MSP configures and maintains
Network Box configures and maintains
Alerts require MSP investigation
SOC validates, investigates, and responds
Multiple consoles and support paths
Integrated platform and accountable operator
Separate vendors can multiply spend
Integrated service can cost up to 3x less than gluing equivalent services together
09
Unified visibility

A true single pane of glass is more than
a pretty dashboard.

Partners need one place to see what is happening, what the SOC is doing, and what the client can understand, without chasing separate vendor consoles first.

StatusSee service health and high-priority security activity across the managed stack.
TicketsConnect SOC action, escalation, and partner communication in one support path.
10
The partnership promise

You own the relationship.
We operate the security.

A channel-focused model designed to expand what you can deliver, without forcing you to build another department.

Free to joinDeal registrationNo quotas or minimums
11
Clear answers. No tricks.

The partner model is
simple by design.

Client ownership

We do not steal or undercut your clients.

You own client communication, billing, and strategy. Deal registration keeps the opportunity tied to your MSP.

Partner commitment

Free to join. No license pre-buys.

Start with one client, one service gap, or one bundle that makes sense. Growth comes from fit, not forced minimums.

Pricing and margin

Our price goes to you. Your client price is yours.

The pricing basis depends on the service, such as endpoints, mailboxes, WAF traffic, or selected bundles, so the proposal matches the opportunity.

Aligned incentives

When you make money, we make money.

The program is designed around shared growth, not pressure to buy licenses before a real client opportunity exists.

12
Pricing model basics

Price the service by
the meter that matters.

Full catalogue pricing stays behind the partner NDA, but the model is straightforward: each service is scoped by its natural usage driver.

Partner pricing: Ask us for a quote based on the services and usage that fit your client. Detailed pricing is shared through the partner NDA process.
UTM / SWGPer device, tiered by number of users.
SD-WAN / FWPer device, based on required bandwidth.
MCESPer total users, with MSP bulk purchasing.
WAFBased on expected requests or hits per second.
MDR / SIEMPer endpoint and data-ingest profile.
SAT / ReputationSAT per user; reputation by email tier, IP, or domain.
13
Fit signals

Where this matters
inside your client base.

Client fit

The strongest case for clients

  • Regulated clients: HIPAA, government, financial, PCI
  • Clients with web applications or public-facing services
  • Clients where after-hours security coverage is thin
  • Clients with mail, MDR, firewall, or reporting gaps
Partner fit

Value for your MSP

  • Reduce vendor handoffs
  • Use technical depth to help win larger clients
  • Scope the first use case
  • Use a technical walkthrough to decide
14
Compliance and legal readiness

Operational discipline creates
evidence.

Controls

Managed policies and records

Documented configuration, security policy, and ongoing management support governance requirements.

Visibility

Audit-friendly reporting

Centralized logs, incident records, and reporting help clients prepare for audits and insurance reviews.

Credentials

Verified assurance

ISO-certified operations and PCI-related attestation provide third-party evidence.

15
Service in practice

Sometimes the win is not another tool.
It is someone taking ownership.

  • A WAF that was not ours was already in place, but an attack needed management.
  • The SOC studied the live attack, tuned the defense, and changed the controls around what attackers were actually doing.
  • The customer could hand off the problem instead of babysitting dashboards, alerts, and tuning work.
  • The commercial value is fewer specialist hours spent stitching and managing separate services.
16
Stories from the field

More stories, same point:
service beats tool sprawl.

Long-time UTM clients

Prevention changes what the MSP has to chase.

Quiet networks came from continuously managed gateway protection, not from a forgotten appliance sitting in place.

Point of the story: if the perimeter is actively managed, fewer problems become endpoint fire drills.
The FBI call

Remote access created the opening.

A breach trail led back to exposed VPN management access created by one architectural shortcut.

Point of the story: managed configuration matters because the service controls how access is exposed, changed, and audited.
The bank lobby

The signal looked small until it found the source.

Reputation monitoring traced recurring IP blacklisting to an infected visitor PC using the bank's connection.

Point of the story: useful monitoring does more than raise alarms. It helps locate the cause so the client can change the setup.
17
What the client actually buys

Security technology is the machinery.
These are the outcomes.

↓
Less downtime
Faster validation and response reduce the time an incident can keep spreading.
24/7
Coverage without hiring
Extend the service beyond business hours without building a round-the-clock team.
1
Accountable operator
A unified SOC and support path reduce vendor finger-pointing.
✓
Audit readiness
Logs, reporting, policies, and incident records support client obligations.
18
From conversation to operation

A straightforward path
from need to coverage.

STEP 01

Confirm interest

Decide whether there is enough partner value to keep going.

STEP 02

Send the NDA

Use the NDA path when pricing or deeper commercial details are needed.

STEP 03

Review the proof

Walk through the UI, KPI reports, incident examples, and technical scope.

STEP 04

Choose the partnership

Decide whether Network Box USA is the right partner to help operate security for your clients.

19
The only question that matters

Is there value here for you
as a partner?

Would more technical detail help?When is a good time to follow up?
20