MSP or MSSP: which do you need?

MSP and MSSP sound alike, and many providers blur them. Choose the wrong one and you either leave security gaps or pay for capabilities you do not need.

What an MSP does

A managed service provider (MSP) runs your IT day to day, like an outsourced IT department.

• Help desk support for staff.
• Monitoring systems and fixing problems early.
• Patching operating systems and software.
• Backup and recovery.
• Onboarding, offboarding and permissions.
• Buying hardware and software.
• Routers, switches, firewalls and Wi-Fi.
• Coordinating your technology vendors.

An MSP gives baseline security through patching, endpoint protection and access controls. Security is not its main focus.

What an MSSP does

A managed security service provider (MSSP) only protects you from threats.

• A security operations centre (SOC) watching your systems around the clock.
• A SIEM that collects and analyses security logs.
• Detecting and responding to active attacks.
• Scanning for and fixing vulnerabilities.
• Incident response to contain and recover from breaches.
• Meeting regulatory security requirements.
• Penetration testing.
• Security awareness training.

An MSSP does not run your help desk or fix printers.

Side by side

Capability	MSP	MSSP
Help desk	Yes	No
Monitoring	System health	Security threats
Patching	Yes	Sometimes, for security patches
Backup and recovery	Yes	No, though it may connect
24/7 SOC	Rarely	Yes
SIEM and log analysis	Basic	Advanced
Incident response	Basic escalation	Full response
Vulnerability scanning	Basic or an add-on	Core
Penetration testing	No	Yes
Compliance	General	Deep
Endpoint protection	Standard antivirus	EDR or XDR
Threat intelligence	No	Yes
Team	IT generalists	Security specialists

An MSP keeps your technology working. An MSSP keeps it secure.

What each costs

These are typical NYC-area ranges.

• MSP. Most charge $85 to $200 per user a month. A 50-person firm pays about $4,250 to $10,000 a month for managed IT.
• MSSP. Specialists and tools cost more, and pricing is by endpoint, user or environment. For 50 to 200 employees, expect $3,000 to $15,000 a month, with a full 24/7 SOC at the top.
• Both. Two firms cost more. Many MSPs now sell security add-ons, and some MSSPs run IT too. Check that a combined provider is strong at both, not just ticking a box.

Which you need

Probably an MSP if you:

• Have fewer than 100 employees and no IT staff.
• Face no strict compliance rules.
• Mainly need systems running and staff productive.
• Need onboarding, troubleshooting and vendor management handled.
• Need standard security, such as endpoint protection, email filtering and basic monitoring.

Probably an MSSP if you:

• Already have IT staff or an MSP for operations.
• Work in financial services, healthcare or government.
• Have had a security incident.
• Must prove security to clients or partners.
• Hold personal data, financial records or intellectual property.
• Face cyber insurance requirements.

Probably both if you:

• Have 100 or more employees, with real operational and security needs.
• Work in a heavily regulated industry that demands dedicated security skills.
• Want a specialist for each.
• Carry enough risk to justify both.

Spotting a real MSSP

Many MSPs now call themselves “security-first”, and some call themselves MSSPs without the depth. Ask four things.

• The SOC. A real MSSP has trained analysts watching in real time. A help desk glancing at a dashboard between tickets is not a SOC.
• Incident response. Ask them to walk through their process and real incidents. An MSP may hand off to a third party, and an MSSP handles it in house.
• Threat intelligence. An MSSP follows threat feeds and researches threats to your industry.
• Certifications. Look for SOC 2 Type II or ISO 27001, and staff with CISSP, GIAC or OSCP. CompTIA A+ suits IT staff but not security specialists.

Five common mistakes

1. Assuming your MSP covers security. Antivirus, firewalls and patching are necessary but not enough against ransomware, business email compromise and supply chain attacks.
2. Buying too much security. A 20-person agency with no regulation rarely needs a 24/7 SOC. A strong MSP and a yearly security assessment may serve it better.
3. Choosing on price. A cheap provider that misses ransomware costs far more than it saved.
4. Leaving responsibilities vague. With both, decide who handles a phishing email that is also a ticket. Decide who owns firewall rules and who leads incident response.
5. Rushing the transition. Allow 30 to 90 days, and expect a good provider to document and discover carefully.

Making the choice

You can start with an MSP and add security as you grow.

1. Assess the IT support you have today and its gaps.
2. Decide what you protect and what a breach would cost.
3. Check what your industry and clients require.
4. Set a realistic budget for IT and security.
5. Get proposals from both MSPs and MSSPs.
6. Get advice from an IT advisor who earns no commission.

Questions people ask

Can one provider be both?

Yes, if it has built separate operations and security teams. The risk is one side bolted on as an afterthought. Meet the security team on its own, and judge its credentials separately.

Is our MSP’s security enough?

Ask for its tools, monitoring frequency, incident response process and certifications. Compare them with the CIS Controls or the NIST CSF. Gaps in detection, response or vulnerability management mean you need more help.

What size company needs an MSSP?

Usually firms of 50 or more, regulated firms and firms with sensitive data. A 20-person financial firm may need one more than a 200-person retailer. Risk matters more than headcount.

One provider or two?

One provider simplifies management and removes gaps between firms. Two give you specialists, and the team that builds systems is not the one securing them. It depends on finding one provider that truly excels at both.

How long does onboarding take?

An MSP takes 30 to 60 days for documentation, tools, users and handover. An MSSP takes 60 to 90 days for a security baseline, SIEM setup, log sources and tuning out false alarms. Plan an overlap with your current provider.