How to Evaluate and Select a Managed Security Service Provider (MSSP)

An MSP keeps your technology working. An MSSP assumes someone is actively trying to break it, and is built to catch them.

That difference sounds small on a proposal and is enormous in practice. An MSP is measured on uptime, tickets closed, and how fast a laptop gets replaced. A security provider is measured on whether an intrusion is detected, contained, and provable after the fact. The tools overlap. The job does not.

Most providers now market both. The useful test is not what the website says — it is who at the firm does security full time, what they did before this, and what they would have caught during your last incident.

An IT-first partner starts from the assumption that your systems are yours. A security-first partner starts from the assumption that someone else may already be inside.

Every design decision follows from that. IT-first thinking optimizes for access, convenience, and recovery. Security-first thinking optimizes for detection, containment, and evidence. Both are legitimate. Only one of them is security.

This is where most small businesses get hurt. Owners believe they are buying cybersecurity from the company that manages their IT, and they have no practical way to check. They trust the provider, the invoice has a security line on it, and nothing appears to be wrong until something is.

It is usually not dishonesty. Most IT providers do not see the distinction clearly themselves, so they cannot explain it to you. Ask yours to explain it out loud. The answer tells you what you have.

Because the largest line item is your own people's time, and it never appears on an invoice.

Add up who at your company coordinates the alarm company, chases the IT provider, manages the camera and access vendor, answers the compliance consultant's questionnaire, and fields the insurance renewal application. In an organization under 250 people that work usually lands on an owner, an office manager, or a controller — people whose hours are worth considerably more than the task.

Then add the cost of the seams. When four vendors each hold part of your security, no one holds the whole picture, and the gaps between them are invisible until something crosses one.

The number that matters is total cost: invoices, plus internal hours, plus the tools you buy separately, plus the work nobody is doing because it belongs to no one.

A longer service catalog is worthless if no one owns the outcome.

Capability is easy to list on a proposal. Accountability is what you find out you bought at 2:00 a.m. When responsibility is split across vendors, each one can point at the others, and each one will be technically correct.

One clarification worth being precise about: your business always owns its own security. That obligation is legal and it cannot be signed away to a provider. What you can buy is a partner accountable for the work, and one number to call when something is wrong.

Ask who is accountable by name, what they are accountable for, and what happens when they miss.

Consolidate, unless you have someone on staff whose job is to manage the seams between vendors. Below 250 employees, almost nobody does.

Every handoff between providers is a place where responsibility can be disclaimed. The alarm company does not talk to the IT provider. The IT provider does not talk to the compliance consultant. Each of them is doing their job, and the space between their jobs is where you get hurt.

The honest counterargument: consolidation concentrates risk. One provider covering more of your environment means one provider whose failure matters more.

That risk is managed with paperwork, not faith — written scope, written exclusions, defined escalation, a term you can live with, and exit terms that return your data and access to you.

Cybersecurity is one layer. An attacker only needs the weakest one.

The rest of the picture is physical access, people, governance, and continuity. Who has keys. Who is on the access list six months after they left. Whether your team knows what to do when something looks wrong. Whether your policies exist anywhere other than a folder. Whether your backups have ever actually been restored.

Attackers do not respect your org chart or your vendor list. A cloned badge, a convincing phone call, and a phishing email are all doors into the same building.

A cyber-only provider leaves the remaining layers to you. That may be fine — as long as you decided it, rather than discovered it.

Everything you would want to be true during an incident.

At minimum, get these in the contract:

• Scope — what is covered, device by device and layer by layer.
• Exclusions — what is explicitly not covered. This matters as much as the scope.
• The definition of "respond" — whether that means alert triage and containment, or full breach response including forensics and notification support. These are different services and are almost always priced separately.
• Coverage versus staffing — 24/7 is a claim about hours, not about who is awake. Ask how long between an alert firing and a human seeing it.
• Escalation — who is contacted, in what order, within what time.
• Data and exit — who owns your logs, configurations, and documentation, and what you get back if you leave.
• Term and termination — length, renewal, and what it takes to get out.
• Price mechanics — what counts as a billable unit, and what triggers an increase.

These seven. Ask all of them, ask your current provider too, and make them answer in writing.

1. What does "respond" mean in our contract? Where exactly does alert response end and breach response begin, and how is each billed?
2. Are you selling outcomes or a tool list? If a better tool exists in two years, can you move to it, or are you locked in?
3. Do you monitor the inside, or only the perimeter? How do you detect a legitimate account doing something it shouldn't — stolen credentials, a compromised mailbox, an employee who clicked once?
4. Are you our IT provider and our security provider? Explain the difference between the two.
5. Who answers at 2:00 a.m. on a Sunday? Who is awake, where are they, and how do we reach a person?
6. How do you prove any of this? What reporting do we get, how often, and could we hand it to our insurer or largest client without a translator?
7. What is the real number? What's excluded, what does onboarding cost, how is the count calculated, how long is the term, and what does it take to leave?

Walk away when the answers make you feel worse instead of clearer.

• They explain things in a way that makes you feel stupid. Condescension is not a personality quirk in this industry — it is a warning about how you will be treated during a crisis.
• They will not put exclusions in writing.
• Security is a line item on an IT contract rather than a service with its own scope and its own owner.
• They cannot tell you what they would have caught during your last incident.
• The proposal is a list of product names.
• There is no reporting you could show anyone outside the company.
• The contract is long and there is no way out if it isn't working.

Most use one of five models: per seat, per device, flat monthly, consumption-based, or hourly blocks.

Per seat is the most predictable for organizations under 250 people, because it scales with headcount rather than with an asset inventory you probably don't maintain accurately.

Whatever the model, the price is only meaningful once you know the mechanics. What counts as a unit. What is excluded. Whether onboarding is billed separately. Whether breach response is inside the monthly fee or billed as a separate engagement — for nearly every provider, it is separate.

For reference, managed security for regulated small and mid-sized businesses commonly lands between roughly $175 and $250 per seat per month. TRINSEC 7 charges $250 per seat, per month, which includes 24/7 cybersecurity and unlimited help desk. A seat is one person and their computer. Additional identities such as shared mailboxes are $10 each, and mobile devices are $6 each. Incident response and digital forensics are a separate engagement, priced to scope.

It starts with someone showing you what an attacker can already see, and ends with you knowing exactly who to call.

A good onboarding runs roughly in this order: an outside-in look at your organization the way an attacker would approach it; a prioritized list of what is actually exposed, in plain language; an agreed sequence for closing it; deployment across the agreed layers; documented escalation with named contacts; and a written record of what changed.

Timelines vary with scope. Core monitoring and endpoint coverage typically begin within days. Broader work — physical security, policy and compliance, training — runs longer.

The thing to insist on is proof inside the first month. TRINSEC 7 commits to it directly: in your first 30 days we will find and close at least one meaningful security exposure, and show you the evidence. If we don't, you get your first month back and you can walk away from the agreement.

By what got closed, not by how many alerts got generated.

Useful measures: how long it takes to detect and contain something, what exposures were found and fixed this quarter, whether the help desk is actually responsive to your team, and whether you can hand your reporting to an insurer, an auditor, or a client without explaining it.

Unhelpful measures: dashboard counts, alert volume, and any metric that goes up when nothing improves.

Ask for a review on a fixed cadence, in language you understand, with a list of what changed. If you cannot tell from the report whether you are better off than last quarter, the report is not for you.