Mercury vs Relay: Banking for a Managed Security Provider

The clients paying your recurring monitoring retainer expect you to show up fast when something goes wrong, and showing up fast sometimes means pulling contractors onto overtime or bringing in outside forensic help before the client's incident-response fee has cleared. Relay's free sub-accounts make it easy to set aside a dedicated incident reserve, funded by a slice of your recurring retainer revenue, that exists specifically to cover a surge in response cost without dipping into payroll. Mercury supports the same structure through its own multiple accounts, and a firm running a PSA or ticketing system can use Mercury's API to pull that reserve balance into an internal dashboard next to open incident tickets.

SOC 2 audits, penetration testing engagements and cyber insurance renewals land on a predictable annual or semiannual schedule, but MSSPs often treat them as one-off surprises because they're paid from general operating cash instead of a dedicated account. Route a fixed amount from every recurring contract into a compliance sub-account monthly, sized against your actual audit and insurance renewal costs from the prior cycle, so the bill lands against money that's already set aside rather than against whatever happens to be in checking that week.

Set up a compliance sub-account with these steps:

1. List the recurring costs that land on a schedule: SOC 2 audits, penetration testing engagements and cyber insurance renewals.
2. Size a monthly amount against your actual audit and renewal costs, not a rough guess.
3. Route that fixed amount from every recurring contract into a dedicated compliance sub-account each month.
4. Pay audits, tests and insurance premiums from that account rather than general operating cash, so renewals are never a surprise.

A firm that needs a short-term credit line to staff up for a large incident is borrowing at a cost set by the bank prime rate, currently 6.75%¹. Build that cost into your incident-response pricing rather than treating financing cost as a hidden loss, since a rate environment like this one makes carrying even a short draw meaningfully more expensive than it would have been a few years ago. If your incident reserve is sized correctly, you should rarely need to draw on credit for a routine incident at all, and the line becomes a true backstop for the rare event that outstrips reserve.

A well-funded incident reserve sits unused for long stretches between real incidents, and that idle cash is worth earning something on. The 10-year Treasury yield is currently 4.44%², and Mercury's automated Treasury sweep captures yield near that level on cash sitting above your day-to-day operating buffer, which describes an incident reserve almost exactly: money that needs to stay liquid and safe, but doesn't need to sit flat in checking. Relay's savings sub-accounts also pay a published rate, just without the same automated sweep into short duration Treasury instruments.

Most MSSPs resell or pass through third-party security tooling, SIEM licenses, endpoint protection, vulnerability scanning platforms, as part of a client contract. Mixing that pass-through cost into general operating cash makes it hard to see true margin on a client relationship once tooling costs creep up over a renewal cycle. A dedicated sub-account for tooling pass-through, funded by the portion of each contract that covers it, keeps that margin visible month to month instead of buried until the annual review. Review that margin at every contract renewal, not just once a year at budget time, since a vendor's list price for a SIEM or endpoint platform tends to climb steadily, and a client contract priced two renewal cycles ago may no longer cover the current tooling cost plus a reasonable markup.

Once incident reserve, compliance funding and tooling pass-through are each sitting in their own sub-account, the choice between Mercury and Relay mostly comes down to whether your team wants API access into those balances and how much yield you want on the reserve, so compare each provider's current features, rates and account limits before you decide.serve or simpler manual control over it. A larger MSSP running a real PSA or SIEM-adjacent internal tool tends to prefer Mercury for the API and the automated sweep. A smaller shop still running client and incident tracking out of a shared spreadsheet usually gets more immediate value from Relay's instant, free sub-accounts and its native bookkeeping integrations, and can revisit Mercury once the operation has grown past what a spreadsheet comfortably tracks.