So how did we come about offering this service. 

We had been building websites since 2006. We had a good handle on security, worked with hoster guidelines. However, a particular type of threat crept into several of our VPS servers causing eventually more than 200 of our own websites being hacked. Once they got into one of the VPS servers we were forever restoring backups. They could at will attack any website on the server, even ones that had just been fixed. 

What would they do ? Most of the time they would create a separate malicious website under the guise of the normal one so it went undetected. Then they would change .htaccess and index.php files. Not to mention the copious amount of email spam that was sent out. Very difficult to know, until you get hit and investigate it yourself.