For Cyber Security Firms
Run Üsta's Indicative Snapshot on a company you are selling to, and put an independent estimate of its cyber exposure, in Rand, in front of the buyer before the first meeting. Where Üsta's own assessments point to work in your specialism, that work comes to the partners who implement, remediate and build out what the assessment names. Either way, the client arrives having seen what the problem is worth.
Request a Partnership ConversationThe one page a partner hands a prospect: expected annual loss as a range in Rand, and what improving the partner's own control area would take off it. Illustrative figures.
How The Relationship Runs
Most partner programmes move business one way. Ours moves it in both directions over the same relationship, and gives you a tool of your own to use in between, which is what makes a partner's interest in Üsta standing, not occasional.
An annual licence to run Üsta's Indicative Snapshot on the companies you are selling to, so your proposal carries an independent figure in Rand. You choose the company and the moment, so it does not wait on anyone else's pipeline.
Every assessment produces a ranked list of recommended actions: the control improvements that would cut a client's modelled exposure the most, priced in Rand. Where an action sits inside your specialism and the client agrees, they are introduced to you already convinced there is a problem, and already shown what closing it is worth. A standard referral fee applies, on the same terms Üsta pays when you bring a client in.
If your work already puts you in front of African enterprises carrying real cyber risk intensity, financial services or otherwise, you can introduce clients who need that exposure quantified ahead of an insurance renewal, a credit decision, a supplier assessment, a funding round, or a board report. You make the introduction. Üsta runs the assessment itself.
The Indicative Snapshot
Your proposal competes for budget with projects that arrive with a number: a payback period, a cost per head, a valuation. The Snapshot puts the client's own cyber exposure on the same page, in Rand, produced by someone who is not selling the fix and with its basis stated. A buyer discounts a figure the seller built. This one they can question, reproduce and forward to their CFO.
Expected annual loss as a range in Rand, with the reason for its width set out on the page. Only the loss scenarios Üsta can stand behind carry a figure; the rest are reported as findings.
Each partner sets one control area. Every Snapshot shows an indicative range for how much improving it to the highest maturity level would reduce the client's expected loss, which is the figure your proposal sits beside.
Run it with the client on a short form, or from public information only for an RFP or a proposal. Each run records why it was run, and a client who books a discovery call through your Snapshot is attributed to you.
The model does not know who is selling what, and nobody can edit the result. Your control area is a view of the same result any partner would see. Üsta's name stays on the number, and your firm is named as the partner who provided it.
The Reviewed Snapshot covers every control area, ranks the remediation and shows what closing each gap is worth. The client buys it from Üsta, you earn a referral fee for bringing them in, and the remediation work stays yours.
The licence is open to implementation partners: security consultancies, MSSPs, identity specialists, incident response and advisory firms. We are taking on up to three design partners, paid, at a design-partner rate, with the proof phase credited in full against the first-year licence.
Work We Route To You
An Üsta assessment ends at a ranked list of the control improvements that would cut a client's expected loss the most, priced in Rand. A well-resourced enterprise can hand that list straight to an in-house security team. Most of the market Üsta serves can't.
The missing middle carries real cyber risk intensity whatever the sector it sits in, and it is exactly the segment least likely to have a team on staff that can execute a finding on its own. That is where the diagnosis stalls, and it is where a partner with the right delivery capability turns it into a signed engagement.
What Partners Get
One of the hardest parts of selling a security engagement is proving the spend is worth it. A client referred by Üsta has already seen that case, in their own numbers, made by an independent third party, before you say a word.
Üsta is a platform business with a specialised advisory layer around it, built on actuarial method, not a security audit. A figure carrying that basis gives your proposal a credibility a generic scope document doesn't have.
Licence and referral terms are set out plainly before either side commits. The licence fee, the referral fee and your own remediation work are separate payments that never net off.
Who We're Looking For
Full-stack remediation and managed security operations: network security, endpoint detection, patch and vulnerability management, email security, data protection and backup, and availability resilience. The broadest lane, and the one most Üsta recommendations land in first.
Identity and access is one of the heaviest-weighted control domains we assess and one of the most frequent recommendations we make, which puts it among the highest-volume referral lanes we have.
Secure development, DevSecOps and penetration testing, for clients whose exposure sits in the software they ship more than the network they run.
The domain a severity finding points to most directly: firms who put a client in a defensible, response-ready position before an incident, not only after one.
Supplier and supply-chain risk is one of the most consequential domains we assess and one of the hardest for a client to manage alone, especially where a single critical supplier concentrates most of the exposure.
Where cyber exposure quantification is a natural extension of a fraud-control, mobile-security or identity-verification workflow your clients are already running.
How Partnership Works
A first call to establish fit: what you do, who you serve, and which of the three streams above actually applies to your business.
The Snapshot licence if you will run it yourself, referral terms, and certification where your implementation work feeds back into a client's numbers, agreed once and set out in writing before either side commits.
A working session on running the Snapshot and recording a run, what a referral looks like when it reaches you, and how to configure things correctly wherever your work touches a client's result.
Assessed clients with a recommendation in your lane are introduced to you. Clients you bring in are set up as a new Üsta engagement.
Where you deliver the remediation, the next assessment shows the exposure fall in Rand: the evidence that earns the next engagement, for both of us.
Every partnership is shaped around what you already do and who you already serve. A conversation is the right place to start.