How MSPs are winning with enhanced.io
How Onsite Technologies built a smart-building security practice and won large multi-year property contracts
The MSP serving commercial property operators turned a coverage gap into the differentiator winning enterprise smart-building deals.
In short: Onsite Technologies, an MSP serving commercial property operators, could not secure building management systems with an endpoint-only stack. With enhanced.io, Onsite now monitors IoT and OT alongside network, cloud and identity in one correlated SOC service, and wins multi-year smart-building contracts that endpoint tools cannot support.
Modern buildings run on technology. HVAC connected to the network. Access control managed through software. Lighting, elevators, fire suppression, fire detection: all integrated, all networked, all exposed.
Onsite Technologies had built its business around managing these environments for commercial property operators across the UK. The team understood building management systems, operational technology, and the rules of working inside live buildings. What they did not have was a security practice built for those environments.
The problem sharpened when clients started asking for cybersecurity assurance. One of Onsite’s direct clients is a financial institution regulated under the Digital Operational Resilience Act (DORA), which took effect in January 2025, with a building estate across Europe. Under DORA, financial entities have to manage ICT risk across their operations and their critical service providers. The operational technology inside those buildings is part of that estate, so the security of the building systems became part of the client’s own regulatory obligation, not an optional extra.
Onsite had a choice. Walk away from these contracts because the security gap made them unwinnable. Or build a practice good enough to win them.
The first route they explored was traditional IT security providers. It did not work.
Why did Onsite Technologies choose enhanced.io?
Endpoint security is built for laptops, servers and managed user devices. Building management systems are none of those things. A BMS controller running proprietary firmware does not host an EDR agent. A lighting controller does not run Defender. The standard MDR playbook fails in OT environments because the standard MDR playbook assumes endpoints to instrument.
Onsite evaluated several providers. Endpoint-led MDR vendors were fast to deploy on the office IT side but blind to the building network. Network detection providers with OT capability tended to require expensive sensor hardware and lengthy deployments. Few combined network coverage with a managed SOC that understood the operational constraint of live building environments.
enhanced.io offered 3 things that mattered to Onsite. Network detection across the building OT environment, not only the IT side. A managed SOC delivering 24/7 monitoring with a single named lead for Onsite to work with. And an integration model designed to overlay existing tooling without forcing a rip-and-replace.
The commercial structure mattered too. Channel-only commitment meant no competing direct motion. Ingestion pricing absorption changed what was financially viable to offer clients. And having a named Fractional Security Director assigned from day one gave Onsite someone who could sit on client calls, support the security narrative in commercial conversations, and act as the security lead Onsite did not have in-house.
enhanced.io
Your Team
Your Clients
Toby Sillett
Managing Director, Onsite Technologies
Microsoft Defender, ingested by enhanced.io for cross-surface correlation
enhanced.io network detection and response across building OT environments
Microsoft 365 and Azure telemetry monitored for account, configuration and access anomalies
Identity monitoring across the client’s identity provider and directory, covering sign-in activity, account takeover, credential and MFA abuse, and privilege misuse
enhanced.io OT-aware detection on building management systems, BMS, access control, HVAC, lighting and life safety systems
enhanced.io 24/7 SOC: alert triage, incident response, named Fractional Security Director providing ongoing advisory, client call support and commercial security narrative
What results has Onsite Technologies achieved with enhanced.io?
Won large multi-year smart-building security contracts
Before partnering with enhanced.io, Onsite had no meaningful security revenue stream. Today, security capability is the differentiator winning the largest new smart-building deals in the portfolio. The contracts they were losing because they could not answer the security question are now the contracts they are winning because they can.
OT coverage that endpoint vendors could not deliver
Onsite serves building environments where endpoint agents do not work. enhanced.io's network detection across building automation systems gave Onsite SOC-level visibility across surfaces that were previously dark. The monitoring now covers the same layer of the building the attackers target.
A commercial model that works for an MSP practice
The channel-only commitment and ingestion pricing structure meant Onsite could build a security service line without the margin uncertainty that comes with per-device or per-seat models. The named Fractional Security Director sits on client calls and supports the commercial conversation without Onsite needing to hire a security director internally.
DORA-aligned coverage for regulated-industry clients
For Onsite’s DORA-regulated client, enhanced.io’s monitoring, incident reporting and response support the ICT risk documentation the client has to maintain under DORA, covering the building systems inside its estate. Onsite can now credibly serve regulated financial clients that its competitors cannot.
Detection example: lateral movement on a building automation network
In one engagement, enhanced.io's SOC identified lateral movement on a building automation network within 15 minutes. The affected network segment was isolated before the activity reached the wider property management layer. Onsite was briefed by its named Fractional Security Director within the same response window.
A partnership that expands with the portfolio
Onsite has stayed with enhanced.io since onboarding in 2025. Coverage has expanded across the estate since the start of the partnership, and it grows with each new property contract.
Toby Sillett
Managing Director, Onsite Technologies
What would Onsite Technologies say to other MSPs facing the same problem?
Toby Sillett's advice is direct.
For Onsite, the lesson was about where an MSP should and should not build. Running a security practice for live building environments is a specialist job, and buying that capability through a partner was faster and more credible than hiring for it.
Related content
Frequently asked questions
Questions we get asked
What is OT security and why does it matter for smart buildings?
Operational technology (OT) security covers the systems running physical infrastructure: building management systems, access control, HVAC, lighting, fire and life safety, elevators and IoT sensors. Smart buildings increase the OT attack surface because more building functions sit on the network. An attacker reaching the OT layer affects the physical environment, not only the data. For commercial property operators, an OT incident takes down a building, not a laptop.
Can an MSP serve smart-building clients without specialist OT security expertise?
How does DORA apply to building and OT systems?
What does a smart-building SOC actually monitor?
How does the Fractional Security Director model work for an MSP?
How long does it take to onboard a smart-building portfolio to enhanced.io?
Does enhanced.io replace existing building management system security?
