IT glossary
MSSP (Managed Security Services Provider)
An MSSP, or managed security services provider, runs your cybersecurity monitoring and response, watching for suspicious activity and acting on it.
In practice that means three things: watching your systems continuously, deciding which alerts matter, and doing something about the ones that do. The third is the part that separates a real service from a subscription.
Why it matters to you
Security tools generate a very large number of alerts, the overwhelming majority of which are noise. Buying the tools is the easy part. Having someone competent look at the output at 2am on a Sunday is the part that actually protects you, and it is the part most organizations cannot staff internally, it takes a rota, not a person.
MSP or MSSP?
An MSP (managed service provider) runs your IT: helpdesk, servers, networks, devices. An MSSP runs your security monitoring. Many providers do both, which is usually simpler, the team that answers your helpdesk already knows your environment.
The question worth asking any MSSP is who is actually watching, and from where. A lot of the market resells a monitoring platform and outsources the watching. Ask where the analysts sit, whether they are employees, and what happens between an alert firing and someone phoning you.
What to expect in a real agreement
- A defined list of what is monitored, and what is not
- A stated response time for each severity level
- A named escalation path with real names on it
- Regular reporting you can actually read
- Clarity on who does the containment when something happens