Buying Sophos + Zscaler + Cisco Umbrella as one bundle: how a Brisbane CBD MSP cut its vendor sprawl

A security product bundle is buying several point tools — endpoint, secure web gateway, DNS-layer filtering — through one accountable partner on a single contract instead of signing three separate vendor agreements. A managed service provider in Brisbane’s CBD did exactly that with AB7: Sophos for endpoints, Zscaler for the secure web gateway, and Cisco Umbrella for DNS filtering, licensed at vendor-list pricing with no markup, monitored by one Mohali SOC pod from $4,500/month. This is what that looked like in practice.

The full service sits on the AB7 Cybersecurity page, and the engagement tiers are on the AB7 pricing page.

The problem: three products, three contracts, three renewal dates

The client is a 40-seat MSP running its own office near Eagle Street in Brisbane’s CBD, reselling IT support to roughly 60 small-business accounts across Queensland. The IT director had already chosen the products — Sophos Intercept X for endpoint, Zscaler Internet Access for the secure web gateway, Cisco Umbrella for DNS-layer filtering — because each one fit a specific gap. The problem was never the products. It was the operational tax of owning them.

Three vendor portals. Three renewal dates spread across the year. Three support queues, each pointing at the other two when something broke at the seam between them. And no single team watching all three at once, which meant a Sophos detection and an Umbrella block on the same endpoint sat in two different dashboards that nobody correlated until Monday.

For a 40-person shop, that is real overhead. The IT director was spending a chunk of every week on license administration that produced zero security value.

The fix: one bundle, vendor-list pricing, one accountable team

AB7 is a reseller across 26+ security vendors — Sophos, Zscaler, and Cisco among them — which meant all three products could be licensed on a single AB7 contract. The pricing point that mattered to the IT director: AB7 charges no markup on the vendor products. The MSP pays Sophos, Zscaler, and Cisco list pricing through AB7; what AB7 charges for is the work — a managed SOC pod that watches all three tools as one stack.

That SOC pod runs from the Mohali HQ on Splunk Cloud and Microsoft Sentinel, starting at $4,500/month for a multi-person team with a shared QA layer. For this MSP, the pod handled the parts the IT director used to do badly between other jobs: tuning Sophos policies, managing the Zscaler URL categories that kept over-blocking the client base, keeping Umbrella’s DNS policies aligned with the same rules, and — the part that actually moved the needle — correlating alerts from all three into one queue instead of three.

Why bundle these three specifically

The three products were chosen to overlap deliberately, not by accident:

Cisco Umbrella stops a threat at the DNS layer before a connection is ever made — the cheapest place to block something. Zscaler Internet Access inspects the traffic that does get through, applying web-gateway policy and TLS inspection. Sophos Intercept X catches what lands on the endpoint anyway. Each layer assumes the one in front of it will miss something, which is the entire point of defence in depth.

The catch is that three layers only work as a system if someone watches them as a system. A DNS block in Umbrella that correlates with a Sophos behavioural detection on the same machine is a far stronger signal than either alert alone — but only if the same team sees both. That correlation is what the MSP was paying AB7 for, and it is the thing three separate vendor support desks structurally cannot provide.

The numbers the IT director cared about

Licensing moved to a single AB7 invoice at vendor-list pricing — the products cost the MSP exactly what they would have cost direct, with the three renewal dates consolidated to one. The Mohali SOC pod came in from $4,500/month, which for a 40-seat MSP undercut the cost of hiring even one local Brisbane security analyst, let alone the 24×7 coverage three tools need.

By the end of week two, the pod had Sophos, Zscaler, and Umbrella policies aligned and the correlated alert queue live. The IT director got back the weekly hours previously lost to portal-juggling and redirected them to client work — which, for an MSP, is the only thing that bills.

When a bundle is the wrong call

A bundle is not always right. If a buyer has a mature in-house SOC already correlating tools, the managed layer is redundant — pay for licenses direct and skip it. If the requirement is a single product with no plan to add layers, there is nothing to bundle. AB7 says so on the first call rather than pushing a stack nobody needs. The AB7 vs CrowdStrike partner comparison lays out where a 26-vendor reseller beats a single-vendor partner and where it does not.

The bottom line

Buying Sophos, Zscaler, and Cisco Umbrella as one bundle did not change the products the Brisbane MSP used — it changed who owned them. One contract instead of three, vendor-list pricing with no markup, and a Mohali SOC pod from $4,500/month watching all three tools as a single correlated stack. For a 40-seat shop with no room for a full-time security hire, the win was not a new tool. It was getting the IT director’s week back and finally having one team accountable across the whole security stack.

Get a fixed monthly number for your security stack

If you already know the products you want — Sophos, Zscaler, Cisco Umbrella, CrowdStrike Falcon, Palo Alto, Fortinet, or any of the 26+ vendors AB7 resells — AB7 will license them at vendor pricing and scope a managed SOC pod against your seat count, with seniority, SLAs, and coverage hours in writing. See the AB7 Cybersecurity page and pricing page, then call +1 (321) 341-7733, email director@ab7solutions.com, or book a 30-minute call with Ashok.

---