What Managed Security Services Cover, and What They Do Not

Two managed security quotes land on the same desk. Both open with 24/7 monitoring, both list a security operations center, both name a platform you have heard of, and one is roughly twice the price of the other. Nothing in either document explains the difference, because the difference is not in the capability list. It is in which of your systems get connected, what happens between an alert firing and somebody picking up a phone, and which jobs the contract expects you to keep doing yourself.

Buyers who get burned on managed security rarely get burned on the part they bought. They get burned on the part they assumed was included. The provider was watching firewall and endpoint logs; nobody was watching the identity provider, which is where the intrusion started. The provider raised the alert correctly at 1am; the contract said notify, not act, so nothing happened until 8am. The provider reported the unpatched server every month for a year; approving the reboot window was always going to be your job, and nobody did it.

This page is written for the person choosing between quotes. It sets out what the service normally includes, what it almost never includes, how an engagement actually runs from the first call to the last log export, and the contract terms that decide whether the money was worth spending.

What Are Managed Security Services?

Managed security services is an umbrella term for any security function a company rents rather than staffs. The company selling it is a managed security service provider, shortened to MSSP, and the two terms get used interchangeably in sales conversations even though one is a service and one is a vendor.

The umbrella is wide on purpose. A contract labeled managed security can mean a provider running your firewall rules and nothing else, or a provider operating the whole security operations center function on your behalf. Both are sold under the same phrase, which is why the phrase settles almost nothing.

What you are actually renting breaks into four parts, and providers are rarely strong at all four.

Tooling. Log collection, detection content, a scanner, a ticketing workflow. Sometimes the provider brings licenses; sometimes it operates the ones you already pay for.

Watching. Somebody looking at what the tooling produces, at three in the morning and on the Friday of a holiday weekend. This is the part that cannot be automated away and the part that sets the floor on price.

Judgment. Deciding that a sign-in from a new country plus a new mail forwarding rule is an incident, while the same sign-in on its own is a salesperson at a conference. Every provider claims this. Few will describe how it is staffed.

Authority. What the provider may do inside your environment without asking first. This is the single largest difference between two services that share a name, and it is a contract term rather than a technical capability.

What Managed Security Services Cover

Scope varies by provider and by tier, but the market has settled into five recognizable blocks of work. A quote that does not clearly land in these blocks is a quote you cannot compare.

Security device and platform management. Firewalls, secure web and email gateways, VPN concentrators, endpoint agents. The provider owns configuration, rule changes, version upgrades and health monitoring. This is the oldest form of managed security and still the largest by contract volume.

Log collection, monitoring and alerting. Your systems feed events to the provider, usually into a SIEM that the provider operates and you never log into. Detection rules fire, an analyst triages, and something that clears the bar becomes a ticket or a phone call. The number that matters here is not how many alerts were processed. It is how many reached a human, and how quickly.

Vulnerability and exposure work. Recurring vulnerability scanning of internal and internet-facing systems, prioritization of what came back, and a report showing what changed since last month. Providers scan and prioritize. Almost none of them patch.

Compliance evidence and reporting. Monthly metrics, log retention that satisfies a standard, control narratives, and answers to auditor questions. For companies carrying PCI DSS, HIPAA or a customer security questionnaire, this block is often the real reason the contract gets signed.

Incident support. Anything from an email that says "we saw this, over to you" through to a provider that isolates the machine, disables the account and calls you afterward. Three very different products live inside one heading, and the heading never distinguishes them.

What Managed Security Services Do Not Cover

This is the part of the conversation providers hold until the third meeting. None of the exclusions below are unreasonable, and all of them are normal. They are only a problem when a buyer assumed otherwise.

Patching and change approval. A provider will tell you a server is missing an update and rank it by severity. Someone inside your company still has to schedule the reboot, absorb the risk of the application breaking, and tell the finance team their system is down for an hour. Managed vulnerability reporting without an internal owner for remediation produces a tidy monthly list of the same findings.

Identity administration. Creating accounts, removing them when people leave, reviewing who has administrator rights. Providers monitor identity events; they do not run your joiner, mover and leaver process, and dormant accounts belonging to former employees stay your problem.

Backups and recovery. Detection tells you an attack is happening. Restoring the file server afterward is a different job with different tooling, and unless you bought backup as a service from the same vendor it is not in the contract. The plan for what happens after containment belongs in your own incident response plan.

Regulatory notification and legal work. State breach notification deadlines, regulator filings, customer letters, and the decision about whether an incident is reportable at all. A provider supplies the forensic facts. The filing and the liability are yours.

Anything not connected. A managed service sees the log sources it is fed. The finance SaaS application nobody mentioned during onboarding, the branch office switch, the developer's cloud account paid for on a personal card: none of it is monitored, and none of it will appear on a report as a gap unless you asked for an inventory.

Accountability. The most expensive misunderstanding in this market. You can outsource the work. You cannot outsource the consequence, and your customers, your regulator and your insurer will address their questions to you.

MSSP vs MSP vs MDR

Three acronyms, three different purchases, and a market that blurs them because most providers now sell more than one.

An MSP, a managed service provider, runs your IT. Helpdesk, laptops, servers, patching, the network. Security is one line in a broader contract and is usually delivered as a bundle of products rather than as a watched service. MSPs typically operate a network operations center focused on availability.

An MSSP runs security specifically, out of a security operations center rather than a network one, and sells the five blocks above. The traditional MSSP model is device management plus monitoring plus escalation: it tells you what happened and hands the incident back.

MDR, managed detection and response, is narrower and deeper. It is bought for one outcome, finding intrusions and containing them, usually across endpoint, identity, cloud and email telemetry, with the provider acting inside your environment under agreed authority. It is priced per endpoint or per user, where MSSP work is more often priced per device or per data volume.

Plenty of companies need both, and many providers sell both under one invoice. The useful question is not which acronym a firm claims. It is whether anyone at the provider is permitted to stop an attack, or only to describe one.

What a Managed Security Engagement Looks Like

Vendor pages describe capabilities. Nobody describes the calendar, which is what actually determines whether the first year goes well.

Onboarding is longer than the sales cycle suggested. Connecting log sources means finding out what you own, which is a discovery project nobody budgeted for. Two to eight weeks is normal for a mid-sized company, longer where cloud accounts are scattered across teams. Coverage does not begin at signature; it begins when the last source is flowing, and the contract usually starts billing at the first.

The tuning period is real and it is noisy. For the first 30 to 90 days a new service produces alerts about your own backup job, your own scanner and your own systems administrator. This is normal and it is also the period when internal patience runs out. The fix is one named person inside the company who owns the relationship, answers "is this expected", and keeps the asset list honest.

The first real incident is the audit. Everything you negotiated gets tested at once: whether the phone number in the runbook reaches a person, whether the provider had the authority to act, whether the logs that mattered were being collected, and whether anyone had rehearsed the handoff back to your team for recovery.

Quarterly reviews are where scope drifts. New offices, new SaaS tools and new cloud accounts appear all year. If nobody reconciles them against the monitored list, coverage silently narrows while the invoice stays the same.

How Managed Security Providers Differ From Each Other

Capability lists converge. These are the differences you can actually check, and each one is a question with a verifiable answer.

Whose operations center is it. Some providers staff their own. Some resell another company's platform and analysts under their own brand. Neither is disqualifying, but a white-labeled service means your escalation path has an extra company in it, and the firm you signed with may not control response times.

Staffed hours and location. "24/7" sometimes means an on-call rota with a pager. Ask how many analysts are on the overnight shift, in which country, and what happens to your ticket at shift handover.

Attestations you can verify. A SOC 2 report, ISO 27001 certification, CREST accreditation for testing work, PCI QSA status, FedRAMP authorization for federal work. A provider holding your logs should be able to hand you a current report without a negotiation.

Whose licenses. Providers that resell their own platform lock you into it; providers that operate what you already own do not, but charge more for the complexity. Ask what happens to the tooling if you leave.

Telemetry sources supported. Endpoint only, or endpoint plus identity, cloud, email and network. This determines what the service can possibly see, and it is a coverage question rather than a quality question.

Response authority offered. Notify only, act with approval, or act first and report after. Three products, one heading.

Named experience in your sector. A provider that has handled a HIPAA breach notification, a PCI forensic investigation or a manufacturing plant outage knows what the next hour looks like. Ask for the sector, the year and the outcome.

What to Ask Before You Sign a Managed Security Contract

Take the same questions to every provider on the shortlist. The differences in the answers are the differences in the service.

The answers that should slow you down: a scope described as "your environment" rather than as a list, a service level measured only in time to acknowledge, an attestation that is "in progress", and any reluctance to put the log export commitment in writing.

Managed Security Contract Terms That Matter

The security industry sells on capability and delivers on contract language. These are the clauses that decide what you actually own.

Service level definitions. Time to acknowledge is when a ticket is opened. Time to respond is when a human starts working. Time to contain is when the attack stops. A 15 minute service level attached to the first of those is close to worthless, and it is the most commonly quoted number in the market.

Response authority, written down. Which actions are pre-approved, which systems are exempt because isolating them stops production, who gets called, and at what hour. CISA's advisory for managed service provider customers tells buyers to make providers spell out both the services being purchased and the services not being purchased, along with the contingencies for incident response and recovery.

Visibility of the provider's own activity. The same advisory tells customers to require contractual visibility into provider logging, including the provider's presence, activities and connections to your network, to keep provider accounts out of internal administrator groups, and to disable those accounts when the contract ends. That last one is forgotten more often than any other item on this page.

Notification of incidents at the provider. Your contract should say how and when the provider tells you about a compromise of its own infrastructure. A provider with privileged access to hundreds of customers is a supply chain target for exactly that reason.

Data ownership, retention and export. Who owns the logs, how long they are kept, what the export looks like, and how long you have to collect it after termination. NIST's Cybersecurity Framework 2.0 is unusually direct here: GV.SC-05 puts security requirements into supplier contracts, GV.SC-08 includes suppliers in incident response planning, and GV.SC-10 asks for plans covering what happens after the agreement ends.

Term, notice and auto-renewal. Three year terms with 90 day notice windows are common, and a missed window renews the contract. Where a provider's own licenses are bundled, check whether they survive the relationship.

Subcontracting. Whether analysis, after hours coverage or scanning is performed by another company, and where.

Liability. Caps are usually set at some multiple of monthly fees, which is a fraction of what a breach costs. Read this clause next to your cyber insurance policy, not on its own.

How Much Do Managed Security Services Cost?

Published prices are rare, and the variables move the number more than the provider does. Contracts are priced per device, per user, per endpoint, per gigabyte of log data ingested, or as a flat monthly fee against a defined asset count. Data volume pricing is the one that surprises people, because connecting the log source that finally gives you coverage also raises the bill.

What moves a quote: how many sources are connected, how long logs are retained, whether response authority is included, how tight the service levels are, whether compliance reporting is bundled, and whether an incident response retainer sits alongside the monitoring.

The comparison that actually decides it is not provider against provider. It is the contract against the alternative, which is hiring. Continuous coverage takes five or six analysts once vacation, sickness and turnover are accounted for, plus the tooling they operate, plus the manager who keeps them.

That first pair of numbers is the honest framing for this purchase. Managed security is associated with a lower breach cost, and the effect is real but moderate. It is not the largest lever available, and a provider that presents itself as one is selling harder than the evidence supports.

The same report measures who finds breaches and how long they run. Internal IT and security teams identified 38 percent of breaches and MSSPs identified 31 percent, with 17 percent disclosed by the attacker and 14 percent found by a third party such as a partner or law enforcement. When an internal team found the breach, identifying and containing it took 209 days on average. When an MSSP found it, 230 days. When a third party did, 280 days. Against a global average of 247 days, a provider moves the clock in the right direction and does not beat a well staffed internal team, which is the promise worth holding a quote to.

Do You Need Managed Security Services?

The service solves a staffing problem. If your problem is something else, it is the wrong purchase, and the honest answer for a company below a certain size is to spend the money on controls first.

If you land on "not yet", there is work worth doing at no cost. CISA's Cyber Hygiene services provide free recurring vulnerability scanning of internet-facing systems and web application scanning to US federal, state, local, tribal and territorial governments and to public and private critical infrastructure organizations. It covers part of what an entry level managed contract charges for, and the report it produces makes a much better starting point for a conversation with a provider.

Verizon's 2026 Data Breach Investigations Report puts breaches with third-party involvement at 48 percent of the total, a 60 percent rise on the previous dataset, and found that only 23 percent of third-party organizations fully remediated missing or improperly secured multi-factor authentication on their cloud accounts. Every provider you hire is also a supplier you now have to assess, which is an argument for asking to read their attestations rather than an argument against hiring anyone.

How to Choose a Managed Security Provider

Shortlist three providers of comparable size, take the nine questions to each of them, and compare the answers rather than the brochures. Ask each one to write the monitored system list into the contract as an appendix, and treat any refusal as the answer to a different question.