Technology services distributors are roadtesting partnerships with cybersecurity software vendors, as partners and customers demand a wider list of vendors and service models.
In April, TSD Avant hailed its partnership with managed detection and response vendor Arctic Wolf. It was a milestone for a nascent TSD market that is rounding out vendor portfolios to satiate midmarket and enterprise customers. Arctic Wolf provides MDR services that are already common in the average TSD portfolio, but it uses its own tech stack rather than borrowing a platform from another vendor, offering self-service capabilities for internal cybersecurity teams.
Self-service options are a key distinction and a sign of the expanding vendor options in the broker model. TSDs are courting OEM vendors with technology customers looking to purchase and manage directly, rather than consume through a service provider. The technology advisors that sell through TSD supplier contracts are also asking for those options. Several blue chip OEMs have already signed partner agreements, including content delivery network providers Akamai and Cloudflare, but many TAs have a wishlist of potential vendors.
“We're starting to have these kinds of conversations,” Accelerate Partners CEO JP Panzica told Channel Dive. “If we had the OEMs in the channel, we could then look to source those and become more successful in the enterprise market.”
It’s no simple transition. Cybersecurity product providers typically go through resellers, skipping the TSD and TAs’ broker model. They traditionally leaned on value-added resellers to bill and manage clients. In order to join with TSDs, vendors must embrace a longtail commission model that is foreign to their leaders. Staffing channel management and operations roles is also essential.
“It's been incredibly rewarding and exciting, but there's also been some tears shed, because it's been a lot of work to succeed focusing in an area that is kind of a new frontier of the TSD channel,” Mark Stackpoole, CEO of GTS, a Detroit-based TSD, said.
TSDs are working in the background to promote their model to vendor leaders and train their partner base to sell cybersecurity products. The distributors need selling partners to attract the vendors, and a deep line card of vendors to attract the partners.
“You need a balance of both,” Avant Chief Strategy Officer Alex Danyluk said. “They grow together, and they build on each other. It’s really an exciting time where the TA and TSD industry is just on an acceleration path with that flywheel.”
Some TSDs hope that successful sales with initial software vendors will draw reactions from rival vendors.
“Collectively, we generate more new logos for suppliers than any other approach. Period,” Telarus SVP National Partnerships Koby Phillips said. “So as long as that holds true, there's always going to be an attractiveness here.”
The strength of TAs and TSDs for new client acquisition is widely recognized.
“It is, bar none, the fastest growing portion of our partner ecosystem to produce new customer acquisition for Akamai,” Akamai VP and Geo Sales Leader Dave Allen told Channel Dive last year.
Scraped knees
The challenge for the TSD market is maintaining relevancy after a sale, as vendors seek to offload the services component onto partners and CFOs question residual commissions.
“Sometimes our distribution model is like cake. It's really good on the front end, but you've got to pay for it on the back end,” Phillips said.
When channel and sales leadership changes or the vendor de-emphasizes top-line revenue, TSD agreements face scrutiny.
Coro Cybersecurity’s recent move away from direct TSD agreements is one example. The SMB-focused cybersecurity provider invested heavily in the broker model three years ago, adding channel managers and sponsoring TSD conferences. However, the company informed TSDs in October 2025 that it would no longer sell through them. Coro continued to pay commissions for deals already sourced, but funneled future deals through VARs and managed services providers that bill the customer directly.
Stackpoole said TAs and TSDs established sales momentum with Coro just a little too late.
“We talked to other TSDs that said, 'We were just on the precipice of closing 20 deals a month,’” he said. “I think if they would have had six more months of metrics and financials on this, they would have never looked back.”
There’s still a pipeline between Coro and agency-based partners, albeit an indirect one. The company has agreements with service provider Adaptiv Networks and P2, a TSD. TAs now go through those intermediaries to access Coro. But Moving away from direct agreements doesn’t mean nixing TSDs, according to Coro CEO Joe Sykora.
“As Coro has evolved into a 100% channel-focused company, new TSD opportunities are now supported through our channel partner ecosystem rather than through a direct TSD sales motion,” Sykora said in an email. “TSDs continue to play an important role in our channel strategy, and we remain committed to supporting and enabling those opportunities through our partners. Our focus is on creating a model that makes it easier for partners to do business with Coro while maintaining a strong emphasis on the MSP and reseller community. While the structure has evolved, our commitment to supporting TSD-driven business has not.”
The overlay model
Coro's playbook could pick up momentum as MSPs and MSSPs become more relevant to vendors.
Five years ago, Cisco tested the TSD model for its unified communications and contact center service offerings, but ultimately rolled it back. The alternative, which other key cyber providers are considering, is to appoint technical overlays who specialize in supporting MSP partners that sell through agents.
This model would prevent the impression that TSDs are competing with their MSP and MSSP vendor partners, which is one of the reasons many TSDs have stayed away from signing up as Microsoft resellers – with AppDirect and Intelisys notable exceptions throughout their marketplaces. In fact, many of their suppliers are already Microsoft CSPs.
“It allows for at least some lines of sanity right now,” said William Madison, managing member of consultancy Innovative Networx.
Nevertheless, Madison said OEM vendors may take dual routes and balance the ecosystem approach with a direct-to-TSD approach.
“The more those particular underlying technology providers invest in this space, the better off they'll be to capture a lot of different routes to market,” Madison said.
A multi-pronged approach will be easier for bigger companies that have the option to pilot new sales models. Helping small vendors feel confident will be integral for the TSD market, which is known for aligning with challenger brands.
“The smaller versions of those OEMs have to be a little bit more thoughtful, and as long as they can handle that part of it, I think you're going to see more of them trying to get into this motion,” Phillips said.
GTS has endeavored to meet OEMs halfway, requiring fewer upfront investments and fill gaps in channel management. The firm has emerged as a unique incubator for relationships between cyber vendors and TSDs, according to Madison.
That approach isn’t the industry standard. Larger TSDs opt for a “show-me” model where the vendor commits to the full criteria investments.
“Dedicated resources, sponsorship budget, active participation in our events,” Managing Director Alan Sandler and CRO Justin Marano said in an email. “That's a condition now, not a preference. A short list of providers who are genuinely invested in the channel will always outperform a long list of names on a line card.”
Sandler Partners describes its approach as more conservative compared to other TSDs. The firm is recruiting SaaS and cybersecurity vendors for direct relationships but wants to avoid overlap in its line card, and it needs to quantify demand for a product from partners.
