August 6, 2026

Tool sprawl for MSPs: the per-user tax on your margin

Estimated reading time: 5 minutes

MSP tool sprawl doesn’t announce itself, so start by counting. Count your tools — not the ones on the sales sheet, the ones actually running in production right now across your client base. SIEM here, EDR there, a vulnerability scanner from a different vendor, an email security add-on you picked up for one client and never rolled out everywhere, a compliance tracker somebody bought before you got there. Now count the logins. The renewal dates. The per-seat invoices that show up on different days of the month from different billing portals.

That’s the part nobody puts in the pitch deck. Every tool you add to solve one client’s problem becomes a line item you’re managing across your entire book, whether the rest of your clients need it or not.

Here’s the quiet tax on your margin.

Here’s the quiet tax on your margin. A five-tool stack doesn’t cost five times what a one-tool stack costs. It costs more than that, because the hidden expense isn’t the licenses, it’s the integration tax. Somebody has to make these tools talk to each other, or manually stitch together what they’re each reporting. Somebody has to know all five well enough to troubleshoot at 2am. Somebody has to onboard a new tech on all five instead of one. That somebody is either you, or a headcount you’re carrying that doesn’t show up as a line item on any client’s invoice. Build-vs-buy analyses like Todyl’s State of MSP Security Maturity Report put numbers on what that in-house capability actually costs to stand up.

Tool sprawl doesn’t show up as a security problem first. It shows up as a margin problem. Eventually it shows up as both: IT Pro, citing IBM and Palo Alto Networks research, reports organizations run an average of 83 security tools from 29 vendors, and that fragmented stacks take 72 days longer to detect threats and 84 days longer to contain them. You feel it as “we can’t take on another client without hiring,” or “onboarding a new account takes three weeks instead of three days,” or “half our stack is running because someone bought it two years ago and we never turned it off.”

It’s rarely one bad decision. It’s a hundred reasonable ones, made under pressure, one client renewal or one lost deal at a time. A prospect asks if you cover X, you say yes, you go find a tool that covers X, and six months later X is a permanent fixture in your stack whether it earns its keep or not. Nobody sits down quarterly and asks whether the tool from 2024 still deserves a seat.

This is how a stack grows by accretion instead of by design. And accretion has a direction: it only ever adds. Nobody’s incentive structure rewards removing a tool. Removing a tool is work with no visible payoff, while adding one closes a deal. So the stack ratchets upward, quarter after quarter, until someone finally sits down and does the margin math on what it’s actually costing to run.

It’s worth breaking the integration tax into its actual components, because “integration tax” can sound abstract until you see what it’s made of.

  • There’s the setup cost: someone has to configure each tool per client, which multiplies as the book grows.
  • There’s the maintenance cost: every vendor ships updates on its own schedule, and someone has to make sure those updates don’t break whatever fragile connection was holding two tools together.
  • There’s the training cost: every new hire has to learn every tool in the stack, and the onboarding curve gets steeper with each addition.
  • And there’s the failure cost, the one that shows up at the worst time: when something goes wrong at 2am, the analyst on shift has to know which of five dashboards to check first, and a wrong guess costs response time that a client is paying for.

None of these show up as a single line item anywhere. They show up distributed across payroll, across onboarding timelines, across the hours your best people spend on plumbing instead of on clients.

This isn’t an argument for fewer capabilities. It’s an argument for a converged operating model instead of a pile of point solutions. The fix isn’t ripping and replacing everything you run. It’s running detection, response, and governance through one coordinated system instead of five disconnected ones, so adding a new client doesn’t mean adding a new tool, and adding a new capability doesn’t mean adding a new vendor relationship, a new invoice, and a new person who has to learn it.

That’s the difference between a stack that scales with your headcount and one that scales without it. One workflow, run the same way across every client, is what actually protects your margin as the book grows. Not a tighter procurement process. A different operating model.

A converged approach doesn’t mean abandoning the tools your clients already trust. It means the correlation, the reporting, and the operational overhead of running multiple capabilities live in one place instead of being rebuilt from scratch every time a new tool joins the stack. The per-tool integration tax stops compounding, because the integration work isn’t happening per tool anymore, it’s already built into how the platform runs.

If your stack has grown by accretion instead of by design, the fastest way to see where the sprawl actually is isn’t a tools audit, it’s a margin audit. Look at what you’re spending per client on tools versus what you’re actually billing, and see where the gap opened up. Ask which tools in your stack are running because a client asked for them once, versus which ones are actually driving outcomes across your whole book. Ask who on your team can troubleshoot each tool, and what happens if that person is out.

The honest version of this exercise usually surfaces at least one tool that’s been quietly costing more than it’s worth for longer than anyone wants to admit. That’s not a failure of discipline. It’s what happens to any stack that grows one reasonable decision at a time without anyone stepping back to look at the total.

Book a working session ⇾

CONTENTS

Related Articles