A managed security service is bought on a promise that somebody is watching, and the buyer's real question is what happens next. Watching is a service that can be delivered well and cheaply by software, and the expensive part - the part a schedule either commits to or carefully does not - is what a human does at three in the morning when the software says something. That is where managed security providers differ from one another, and it is almost never on the front of the proposal.
Managed cyber security solutions: monitor, respond and remediate are three different contracts
The market uses managed security for three service levels that cost very different amounts. Monitoring means alerts are collected and you are told. Response means somebody triages the alert and takes a defined action, usually isolating a machine. Remediation means somebody fixes the underlying cause and puts the estate back. Most proposals price the first, describe the second and imply the third. Ask which of the three the fee covers, what the defined actions are, and what is billed on top when an incident turns into a week of work.
The MSSP and the MSP are not the same security IT services contract
An MSP runs your IT and an MSSP watches it for attack, and a business can end up with both, one, or one firm claiming both. The combination that goes wrong quietly is an MSSP watching an estate the MSP controls, because the alert lands with a firm that cannot act on it and has to ask permission. If you buy both from one provider, ask how the two teams are separated and who wakes whom. If you buy them from two, get the escalation path between them written down before an incident writes it for you.
What managed cyber security services watch, and what they do not
Coverage is defined by what feeds the platform, and every gap is a place an attacker is invisible. The usual set is endpoints, the identity provider and the firewall. The usual gaps are software as a service applications outside the identity provider, anything on a personal device, and operational technology. Ask for the list of sources ingested, not the list of things the platform is capable of ingesting, and ask what it costs to add one, because per-source pricing is where a flat monthly fee quietly stops being flat.
SOC vs SIEM, and what this record can and cannot tell you about the price
Managed security is priced per user, per endpoint, per source or per volume of data ingested, and of the 29 IT providers read for this site none publishes a security rate separately from its managed IT figure. That absence is the finding, and it is consistent: providers that publish an IT support band still send you to a form for security. So the comparable number has to be asked for, and the question that gets one is which unit the quote is in and what happens to the fee when that unit doubles.
Questions people ask about managed security services providers
What is the difference between an MSP and an MSSP?
An MSP runs the IT. An MSSP watches it for attack. One firm can sell both, and the question worth asking is which team acts on an alert and who wakes whom.
Does managed security include fixing what it finds?
Often not. Monitoring, response and remediation are three service levels at three prices. Ask which one the fee covers and what a week-long incident is billed at.
What does a managed security service cost?
It is priced per user, per endpoint, per log source or per volume ingested. None of the 29 providers read for this record publishes a security rate on its own pages.
What is SOC as a service?
A security operations centre bought as a subscription rather than staffed in-house. The same monitor, respond or remediate question decides what it is really worth.
Are security as a service providers the same as an MSSP?
Broadly, and the label tells you nothing about the scope. Ask which of monitor, respond and remediate the contract covers, because the three are sold separately and a service that watches and reports is a different purchase from one that acts.
What does a computer security service cover that an MSP does not?
An MSP keeps the estate running and patched; a security service watches for an intruder in it. The words overlap and the bills do not, so ask whether the monitoring in the proposal is availability monitoring or threat monitoring, and who answers at two in the morning.