Security Posture as a Service (SPaaS): What It Is, What It Isn't, and Who's Actually Selling It

What Security Posture as a Service actually means

Security Posture as a Service — SPaaS — is an emerging managed-service category where a provider continuously assesses, reports on, and improves a client's security posture across frameworks, controls, risks, vulnerabilities, and policies. It's delivered on an ongoing subscription rather than as a one-time audit engagement or a tool license.

The buyer is usually a 50-to-500-person company with a real compliance obligation but no in-house CISO. They want someone to own security posture as a monthly line item — the same way they already outsource MDR, IT support, or payroll. In return they get continuous framework status, a live risk register, evidence collected automatically from their stack, policies kept current, and a report their board can actually read.

The short version: SPaaS turns security posture from an annual project into a monthly service.

Where the SPaaS term came from

"Security Posture as a Service" didn't emerge from a Gartner quadrant or a NIST publication. It arrived from two directions at once.

From the left — posture and ASM vendors. Attack Surface Management tools (Cyble, CYE, Cycognito) started framing their offerings as posture services when customers pushed for ongoing delivery rather than scan reports. The "aaS" suffix was natural marketing gravity.

From the right — MSSPs extending beyond MDR. Providers like Arctic Wolf, Expel, eSentire, and hundreds of regional MSSPs spent the last five years scaling MDR revenue. Clients loved the monthly detection outcome, and increasingly asked: can you also tell me whether we're secure, not just whether we're under attack? That's posture. MSSPs extended their service lines accordingly.

Both groups arrived at roughly the same offering through different doors. The category name hasn't settled. Most providers label their version "Managed Compliance," "Continuous Compliance Monitoring," "vCISO-as-a-Service," or "Managed Security Program" — all neighbors to SPaaS, and in practice often identical.

What Security Posture as a Service is NOT

Before defining what SPaaS includes, it's worth being sharp about what it excludes. A lot of vendors stretch the label.

SPaaS is not CSPM. Cloud Security Posture Management tools scan cloud configurations. They don't deliver framework compliance, policy authorship, or risk decisions.

SPaaS is not GRC software. A GRC platform is a tool. SPaaS is a service. Drata and Vanta are GRC platforms; a consultancy that delivers SOC 2 readiness on top of Drata is arguably selling SPaaS.

SPaaS is not a dashboard service. A portal with a posture score and a monthly PDF isn't SPaaS unless there's a practitioner behind it with accountability for the outcome.

SPaaS is not MDR with compliance reports bolted on. An analyst watching for alerts isn't the same as a program owner accountable for your Security Risk Analysis or your Statement of Applicability.

SPaaS is not vCISO by another name — but it's the closest adjacent category. vCISO is about leadership and strategy; SPaaS is about continuous program ownership. In practice the best vCISO retainers include SPaaS delivery as the operating component.

The six components of a real SPaaS offering

Strip the marketing away and any credible SPaaS provider delivers six things:

1. Continuous framework assessment. Not an annual Excel ritual. The client's framework of record (SOC 2, ISO 27001, HIPAA, NIST CSF, CMMC) has a live, maintained control status reflecting current reality — not the state as of last quarter's audit prep.

2. Risk register ownership. The provider maintains the risk register: adds risks as they surface, scores them on a consistent model, tracks mitigation, and surfaces the critical ones in reporting. No risk sits orphaned in a spreadsheet nobody opens.

3. Evidence automation from the client's security stack. Access reviews from Okta or Azure AD, vulnerability data from Tenable or Qualys, endpoint posture from CrowdStrike or SentinelOne, policy exceptions from ITSM — the provider configures integrations so evidence flows continuously, not via manual collection the week before an audit.

4. Policy lifecycle. Authorship, version control, approval workflows, annual review cadence, and revisions when the environment changes. Policies stay accurate — when a new system is introduced, the relevant policy updates alongside it.

5. Vendor and third-party risk. Business Associates, sub-processors, critical suppliers — each one tracked with current risk score, contract status, and questionnaire responses. Expiring BAAs surface before they lapse.

6. Executive reporting. A monthly report the client's board, insurance carrier, or auditor can actually read. Posture score, trend, top risks, framework progress — in plain language, not CVSS vectors.

A provider missing any of these six is offering something narrower than SPaaS. A provider delivering all six via spreadsheets is offering SPaaS unprofitably — which is the real reason the category depends on the platform layer.

Who's actually selling Security Posture as a Service today

Few providers use the literal term "SPaaS" yet. Many more deliver the functional offering under adjacent labels. A non-exhaustive landscape:

Large MSSPs with explicit posture or compliance offerings:

• Arctic Wolf — Managed Risk (posture scoring + vuln management) alongside MDR
• Expel — expanding beyond MDR into Managed Phishing and broader posture work
• eSentire — MDR + Exposure Management; adds compliance packaging at enterprise tier
• Red Canary, Huntress — MDR core; compliance story is secondary but growing

vCISO-first practices that deliver SPaaS as their primary offering:

• BlueRadius (disclosure: parent of Radius360) — vCISO retainers with SPaaS-style continuous delivery
• Cynomi — vCISO platform positioning; sells through MSPs
• Hundreds of independent fractional CISO and vCISO practices delivering the same service model

Compliance-focused providers at the low end:

• Drata and Vanta resellers / service partners — many consultancies deliver SOC 2 SPaaS on top of these platforms
• Secureframe services tier — platform plus a human delivery layer
• Scrut Managed Services — continuous compliance as a delivered service

Pure-play posture and ASM vendors stretching into SPaaS language:

• CYE, Cyble, Cycognito — posture-first framing; compliance delivery is lighter

The pattern: most credible SPaaS delivery is done by MSSPs and vCISO practices sitting on top of a platform. A pure-software play can't deliver SPaaS because software isn't accountable when the regulator calls. A practitioner is.

Why the platform layer decides whether SPaaS scales

Here's the unit economics most SPaaS sales decks skip.

A skilled vCISO delivering SPaaS manually — with Excel, Word, Confluence, a handful of scripts, and the client's security tools — can profitably serve maybe 4 to 8 clients at $5,000 to $12,000/month each. Revenue caps somewhere around $500K–$1M per practitioner. Margins get eaten by hours spent on evidence collection, policy rewrites, and SRA updates.

The same practitioner sitting on a multi-tenant platform that automates evidence, maps controls across frameworks, and generates policies grounded in live environment data serves 20 to 40 clients at the same retainer. Revenue scales to $2–5M per practitioner. Margins expand because the platform absorbs the repetitive work.

This is why SPaaS as a category depends on platform architecture — not feature lists. The specific capabilities that matter:

Capability	Why it matters for SPaaS delivery
Multi-tenant by design	One login serves every client. Switching is a dropdown, not a re-login.
Practice-based pricing	One subscription covers the full book. Client 31 doesn't trigger procurement.
Cross-framework control mapping	Evidence added to SOC 2 auto-satisfies ISO/NIST/HIPAA equivalents. No duplicate work.
Deep stack integrations	Evidence flows from the client's actual tools — Okta, CrowdStrike, Tenable, M365, Sentinel.
AI grounded in client data	Policies, SoAs, and reports reference the real environment, not generic templates.
White-label output	Client-facing deliverables carry the provider's brand, not the platform vendor's.

Without these, one practitioner doing SPaaS for 30 clients is an unsustainable math problem. With them, it's a business.

The SPaaS buyer's shortlist: four questions before you sign

If you're on the buying side — a 50-to-500-person company evaluating SPaaS offers — these are the four questions that separate real providers from dashboard-with-a-bow offerings.

1. Who owns the outcome? Ask for the named practitioner. If the answer is "our team" or "your dedicated analyst" with no human attached, the accountability layer is missing. Real SPaaS has a name on the relationship.

2. What's the response time when we have a posture decision to make? Not the SLA for a platform ticket — the response time for a real judgment call. "We just got sued and OCR wants our SRA" should get an answer in hours, not after the next roadmap call.

3. Show me the monthly deliverable from an existing client. Anonymized. If the provider can't produce a real monthly report from an active engagement, they're pitching the concept, not delivering the service.

4. What platform is your delivery built on, and can we see a live tenant? The platform is the artifact you'll touch. If the provider can't walk you through a live client instance showing framework progress, risk register, and board report, delivery is informal and the service is fragile to practitioner turnover.

The honest positioning: Radius360 isn't SPaaS — it's what SPaaS runs on

This piece started as a sales post and ended as a definition post. That's deliberate.

Radius360 is a platform, not a SPaaS provider. We don't deliver the service layer. MSSPs, vCISOs, and consulting practices do. What we build is the platform they deliver on: multi-tenant architecture, 20+ frameworks with cross-mapping, 23 deep integrations, AI policy and report generation grounded in live client data, white-label output per tenant.

If you're a practitioner or firm building a SPaaS offering, Radius360 is where your delivery runs. If you're a company evaluating SPaaS providers, one of the questions in the buyer's shortlist — what platform is the delivery built on — often has Radius360 as the answer. And if you happen to have a competent in-house security owner, you can run the platform directly and get ~70% of what SPaaS promises without the retainer.

The category is still forming. The label is still up for grabs. What's clear is that SPaaS at any real scale requires a platform, and we're building ours specifically for the practitioners who deliver it.

---

If you're a vCISO or MSSP building a SPaaS practice, start a free 7-day trial of Radius360 and stand up a tenant for your first client in under a day. If you're on the buyer side evaluating managed posture services, ask your shortlist what platform their delivery runs on — the answer tells you more than their pitch deck.