For MSPs and agencies
Attack surface monitoring, under your brand.
You already answer for your clients' security. Bastion's MSP plan puts continuous external monitoring behind your name: every client estate watched from one console, every report branded as yours, and alerts landing where your team already works. No agents to deploy across client infrastructure — verify each domain and monitoring starts.
25 domains across your clients, unlimited scans, daily scheduled scanning, 25 seats. Two months free on annual billing.
What the MSP plan includes
Your brand on every report
Set your firm's name, logo and accent color once, and every generated PDF — scan reports and compliance evidence packs — carries them. Bastion stays in the engine room; the report you attach to a QBR looks like it came from the people they pay for security, because it did.
Every client estate in one place
File each client's domains under their own workspace: one console for your team, a dashboard grouped by client, and clean separation when you hand something over. Twenty-five domains across your book, scanned daily.
Alerts routed per client
Scope a notification channel — email, Slack, or a webhook into your PSA — to a single client, and it only ever hears about that client's domains. A certificate about to expire becomes a ticket in the right queue, not an email nobody claims.
Pricing that leaves room for margin
$149/month flat across your whole book of clients — under $6 per domain fully loaded, billed to you in one invoice. You set what monitoring is worth to your clients; the unit economics have to work for a service you resell, and we price like we know that.
Honest scoping: the monitoring engine — TLS, headers, DNS, email authentication, subdomain discovery, exposed services, change alerts — is the same one every Bastion plan runs. PSA and ticketing integrations ride the generic webhook today; if your stack needs something more specific, tell us below and we'll give you a straight answer on timing.
Questions before you commit?
Bigger book than 25 domains, a PSA integration you can't live without, or procurement that needs paperwork — a few sentences is plenty, and a person replies within a business day.
What to expect
A reply from a person, not a sequence. MSP customers talk directly to the people building the product, and feature asks from working MSPs decide what ships next. If Bastion isn't the right engine for what you're describing, we'll say so plainly.
Partner questions
Can MSPs white-label Bastion?
Yes — white-label is a shipping feature of the MSP plan ($149/month, or $1,490/year with two months free). It includes PDF reports branded with your logo, name and accent color, client workspaces that group domains per end customer, notification channels scoped to a single client, 25 verified domains, unlimited scans and daily scheduled scanning. See pricing for the full comparison.
What does white-label mean here?
Your clients see your brand, not ours. Reports carry your logo and firm name, alerts reach your team through your tooling, and you remain the security provider your client deals with. Bastion is the monitoring engine underneath: passive external checks of TLS, security headers, DNS, email authentication and exposed services, re-run on a schedule with change alerts.
How does domain ownership verification work for client domains?
The same rule that applies everywhere in Bastion applies to MSPs: a domain is scanned only after control of it is proved with a DNS TXT record. For an MSP that usually means having the client add one record — or adding it yourself where you already manage their DNS. Monitoring a client without their knowledge is not something the platform supports, deliberately.
What if I manage more than 25 domains?
Talk to us — that is Enterprise territory, with unlimited domains, SSO and a countersigned authorization-to-scan agreement. The form below reaches a person who will give you a straight answer on price, usually within one business day.