What Is an MSSP? Managed Security Services Explained (And What They Cost).

"MSSP" shows up constantly in security sales material and almost never gets defined. Here is the plain version, including the part vendors tend to skip: what it costs, and where the scope stops.

What an MSSP is

A Managed Security Service Provider runs your cybersecurity as a service. Instead of buying security products and hoping someone internally has time to configure, monitor and act on them, you pay a recurring fee and the provider owns the outcome.

The model exists because of a simple mismatch. Security tooling has become genuinely good and genuinely affordable — but it produces alerts continuously, and alerts are worthless without someone competent reading them. Hiring that person is the expensive part. A single mid-level security analyst costs more than most small businesses spend on their entire IT budget, and one analyst cannot cover nights and weekends anyway.

What is normally included

Scope varies more than anyone admits, so treat this as the checklist to hold a proposal against rather than a guarantee.

• Endpoint protection and EDR on every laptop, desktop and server
• 24/7 monitoring and response through a security operations centre — see what MDR is, which is the response half of this
• Email security — spam, phishing, malicious attachments and impersonation
• Identity protection for Microsoft 365 or Google Workspace, where account takeover now starts
• Vulnerability and patch management — finding unpatched software and actually patching it
• Security awareness training and simulated phishing for staff
• Logging and compliance reporting for auditors, insurers and client questionnaires
• Incident response — a plan, a named contact, and help with notification duties

Commonly not included, and worth confirming explicitly: backup and disaster recovery, firewall hardware, and mobile device management. Those are separate line items with almost every provider, because no single security vendor covers them — our managed cybersecurity page has the vendor-by-vendor matrix showing exactly where each one stops.

MSSP vs MSP vs MDR

MDR is not a competitor to MSSP — it is usually the most important thing an MSSP sells.

The MSP/MSSP split matters more. Historically they were different companies, and the seam between them caused real problems: the MSSP flags a compromised laptop, the MSP has to rebuild it, and the customer sits in the middle relaying messages. Most small businesses are better served by one provider who does both, so that detection and remediation are the same phone call. That is how we structure it — managed IT and managed cybersecurity on one plan, one number to call.

What it costs

Published vendor list prices give you the floor. At a 100-unit tier, Huntress publishes Managed EDR at $7.99 per endpoint per month, Managed ITDR at $3.60 per identity, Managed SIEM at $3.50 per source and Managed security awareness training at $1.75 per learner. CrowdStrike publishes Falcon Go at $7.99 per device per month, Falcon Pro at $14.99 and Falcon Enterprise at $19.99, with its managed Falcon Complete tier quote-only. Sophos publishes no per-endpoint price at all.

Those are licence costs before anybody manages anything. Realistic delivered pricing:

Three things that move the number: how many of your staff have multiple devices, whether Microsoft 365 and email are in scope or endpoints only, and how long you must retain logs — retention is the quiet cost driver in any regulated environment.

Watch for minimum commitments. Several vendors require 50 units for direct purchase. Below that threshold, buying through a provider who already holds licensing is usually cheaper than going direct, which is counterintuitive but consistently true.

How to choose one

Most MSSP proposals look identical because they list the same product names. These are the questions that actually differentiate:

"Will you contain a threat without calling me first?" The single most useful question in the whole evaluation. Response that waits for your approval at 3am is not response.

"What is explicitly out of scope?" Any honest provider names backup, firewall hardware and MDM. Someone claiming to cover everything is either confused or hoping you are.

"Is the SOC yours?" Reselling someone else's SOC is normal and fine. Not knowing whose analysts are watching your network is not.

"What does leaving look like?" Do you own the Microsoft 365 tenant? Do you keep your logs? Can you take the EDR licences with you? Ask this before you sign, because it is unanswerable once you want out.

"Can you show me a real report?" Redacted is fine. It tells you whether you will get intelligence or a PDF of alert counts.

Do you need one?

The forcing function is usually external rather than internal. Small businesses rarely wake up wanting an MSSP — they get pushed into it by:

• a cyber-insurance renewal that now asks whether you run EDR and enforce MFA, and prices accordingly
• a client security questionnaire from a larger customer, where the contract depends on the answers
• a compliance requirement — HIPAA, PCI DSS, CMMC
• an actual incident, which is the expensive way to arrive

The controls those demand are the same controls that genuinely reduce risk, which is the rare case where the compliance-driven purchase and the correct purchase are the same thing.

---

We provide managed security services to Houston businesses and remotely nationwide — managed EDR, a 24/7 SOC, email and identity protection, awareness training and tested backups, on one flat per-user plan alongside managed IT. Start with a free security assessment: we tell you what is actually running in your environment and where the gaps are, at no cost.