MSP M&A spotlight: Harbor IT

Harbor IT is building its MSP platform around cybersecurity, backed by long-term capital and in-house security capabilities. Its acquisition strategy focuses on compliance expertise, vertical specialization, and scale. This blog explores what that approach reveals about competition in the MSP M&A market.

Harbor IT Bets on MSSP Demand Growth

Omdia predicts that global cybersecurity managed services revenue will grow by 14.4% in 2026, reaching $106bn. Harbor IT is one of many managed security service providers (MSSPs) in North America helping customers address rising cyber risk. Its M&A strategy signals that investor dollars will continue to flow into an industry where the impact of breaches and regulatory pressure continues to intensify. Harbor IT is betting that cybersecurity is no longer an add-on service, but the structural foundation of modern managed services.

Backed by the Worklyn Partners fund, which draws capital from family offices and operator-aligned investors rather than a traditional blind-pool private equity structure, Harbor IT was formed following the acquisition of Quadrant Information Security. Quadrant was a managed XDR and cybersecurity advisory firm with a US-based security operations center (SOC). Harbor IT is building a cyber platform around these capabilities, using its own SIEM platform, Sagan. Harbor IT has also acquired eight other MSPs across the US, focused on cybersecurity depth, compliance expertise, and vertical specialization. Quadrant now operates as Harbor IT’s in-house cybersecurity arm, providing XDR and SOC capabilities across the broader platform.

Harbor’s Acquisition Model Differs From Other Federated MSPs

Harbor IT’s acquisitions have been concentrated in New England and California, with employees distributed across the US. The company is taking a geographically agnostic approach to future acquisitions within the US.

Its acquisition targets include MSPs with approximately $10 million or more in annual recurring revenue, a diversified customer base, and core revenue concentrated in managed IT and cybersecurity services. Harbor IT prefers MSPs serving regulated, mission-critical, and hard-to-serve industries, including healthcare, financial services, and critical infrastructure sectors such as agriculture, oil and gas, and OT-IT environments.

Harbor IT operates under a unified brand with standardized offerings, tools, and shared systems. Acquired brands are retired, and businesses adopt Harbor IT processes while preserving local expertise and customer relationships. Core shared services include finance, HR, sales, SOC, NOC, cybersecurity, and business intelligence.

Service delivery is organized through a vertical-aligned pod model. Each pod consists of 8 - 12 employees aligned to a specific industry vertical, designed to preserve customer intimacy while enabling scale.

Harbor IT has not articulated a defined exit strategy and says it is not operating on a traditional private-equity five- to seven-year timeline. Instead, its investor base is oriented toward longer-term operational value creation and deeper integration, leaving exit options open based on future market conditions.

Competition In MSP M&A Is Tough

AI-led MSP platforms may be drawing the headlines right now, but Harbor IT reflects a different consolidation thesis. Cybersecurity is now table stakes. For regulated and compliance-heavy industries, security capability is assumed. The differentiation increasingly comes from how that capability is embedded into the operating model.

Harbor IT is betting that vertically aligned delivery teams, centralized cyber infrastructure, and in-house SOC depth create a more defensible platform than simply layering security services onto a traditional MSP base. That bet narrows the acquisition pool. The company is targeting MSPs with roughly $10 million or more in recurring revenue that also demonstrate compliance specialization and industry focus. Those businesses are uncommon - and competition for assets with that profile is already fierce.