What Is a Managed Security Service Provider (MSSP)

Years ago, I completed a large industry analysis project where I researched the managed security business.  At the time, MSSP was rapidly gaining traction with new providers sprouting up everywhere.  Fast forward seven years.  I am starting a new MSSP research project, and wondering what changed in the intervening years.

Surprisingly, not that much.

The most notable changes are the influence of cloud and AI technologies on MSSPs.  However, these factors have not altered the constituent parts of an MSSP.  

To understand what makes an MSSP, consider Gartner’s definition:

A managed security service provider (MSSP) provides outsourced monitoring and management of security devices and systems. Common services include managed firewall, intrusion detection, virtual private network, vulnerability scanning and anti-viral services. MSSPs use high-availability security operation centers (either from their own facilities or from other data center providers) to provide 24/7 services designed to reduce the number of operational security personnel an enterprise needs to hire, train and retain to maintain an acceptable security posture.

There is nothing wrong with this definition, but it describes what an MSSP does, not what they are.  There is a big difference between those two things.  If you are looking to hire (or build) an MSSP, you must evaluate not only what an MSSP can do, but what they are made of as well.  

Based on my research, an MSSP consists of four components:

• Platform
• People
• Process
• Scale

Let’s explore each of these components and how they contribute to an MSSP.  

Platform

This is the collection of technologies, tools, and products the MSSP uses to deliver their services.  Platform technologies may be developed in-house or sourced from third party vendors.  Many MSSPs use repurposed open-source products as their proprietary platforms.

An MSSP’s platform is important, but not as important as you may think.  Buyers do not, necessarily, select an MSSP because it offers an ultra-sophisticated platform (nor should they).  Rather, an MSSP’s platform is a “ticket to ride.”  When buyers evaluate MSSPs, they look at the platform first.  If it appears capable, then they move on to evaluate the other components.

The key components of an MSSP Platform include:

Component	Description	Commentary
Platform Technologies	The component technologies of the platform.	This can be a wide-range of proprietary and third-party products.
Infrastructure	The architecture, hosting, and supportive components of the platform.	This not only includes where the platform is hosted, but also infrastructure components such as authentication, connectivity, and redundancy.
Automation	How the platform responds to incidents, implements remediations, and manages configurations.	Automation allows an MSSP to react more quickly and consistently to incidents.  Highly automated platforms are fundamentally more effective at protecting an environment. Automation capabilities may include some AI functions. However, be careful when evaluating any AI usage, since many MSSPs claim to have AI integrated into their platform, when in reality it is merely that their analysts are using AI to perform management functions.
Service Capability	These are the services the platform delivers.	Typical services include: Firewall / NGFW Endpoint security, XDR, MDR Vulnerability scanning, penetration testing Configuration / change management Security information and event management (SIEM) Incident handling Compliance reporting Threat intelligence and scoring Email security Security orchestration, automation, and remediation (SOAR)
Data Providence	This refers to where and how the platform stores its data.	How a platform stores customer data is critical, especially if there are any compliance requirements.  Many compliance frameworks (such as FedRAMP) do not allow any co-mingling of data with non-compliant environments.  MSSPs that co-mingle customer data are typically unable to meet compliance requirements. Some MSSPs have taken to only storing meta-data, while leaving the raw log data contained within the customer environment.  This is preferrable, from a security perspective, but still will run afoul of some compliance regimens.

People

Even with automation and AI, MSSPs are completely dependent upon people to run everything and support customers.  The team that runs, manages, and monitors the platform are what makes an MSSP function.  Without them, there is no MSSP.

MSSP teams usually include analysts, support staff, engineers, and developers. 

Analysts are the primary service delivery people. They operate the platform, perform security scans, respond to incidents, and deliver reports.  Some MSSPs also employ analysts to perform adjacent professional services such as penetration testing or virtual CISO services.  Analysts form the backbone of an MSSP.

Support staff handle the logistics and customer management functions.  This team may include project managers, customer success representatives, and other non-technical people.  Effective MSSPs use the support team as a “buffer” to allow the analysts and engineers to focus on service delivery. 

Engineers operate the infrastructure for the platform. They may also serve as a second-tier support for analysts. Engineers typically operate in background, and only interact with the customers for more complex or bespoke needs, such as assisting with incident response.  

Developers design, built, and deploy the platform and relevant infrastructure components.  Some MSSPs do not differentiate between engineers and developers, and unite them into a common platform group.  Developers often have their own supporting staff of project managers and testing engineers.  

For buyers, it is difficult to assess the skillset of an MSSPs people.  You are not going to be able to meet many of the analysts and engineers working on your account.  However, you can assess the team that engages you in the sales process.  Savvy MSSPs place technical resources early in the sales process.  This ensures the MSSP is building credibility with prospective customers, rather than merely explaining their capability.

Process

Process is the assortment of procedures, practices, policies, and internal culture that operates an MSSP.  Process makes an MSSP sparkle.  Good MSSPs have well defined, well documented, well-maintained processes.  Moreover, they are constantly revising, adapting, and updating them to suit the perpetually shifting threat landscape.

In contrast, bad MSSPs have … nothing.  It is not uncommon for companies to charge into the MSSP business, believing that as long as they have the correct technologies and people to staff the SOC, they are good.  An MSSP is largely useless without effective processes.

Moreover, Process is what gives an MSSP its value.  MSSPs get acquired for their processes, not for their platform or people.  If you are evaluating an MSSP, you want to look closely at the processes they use to conduct their services.

Scale

Scale is not a discreet component, but rather a factor of an MSSP’s overall strategy and tactical execution.  Scale is how effectively an MSSP handles change.

For an MSSP to be successful, it must be able to put its platform, people, and processes in motion.  This means designing those components to be agile and adaptable.  It also means having the organizational maturity to accommodate a growing customer base.

Scale is where immature MSSPs implode, and savvy MSSPs explode.  Once they begin to acquire customers, the MSSP reaches a critical point where the platform, processes, and people must rapidly change.  This stresses those components, particularly the people.  If the organization lacks effective leadership or empowers people who are uncomfortable with change, the MSSP will begin to struggle.  The company will become unable to handle increased customer load, which will cause customers to become dissatisfied.

Change is discomfort, and savvy MSSPs embrace this discomfort.  They have internal DevOps-style practices that integrate change, growth, and adaptability into everything.

Customers evaluating an MSSP should consider how the MSSP has adapted to the changing threat landscape.  As a customer, constant change can be frustrating. However, if an MSSP can manage this change effectively, it demonstrates and organizational strength and maturity, which is something you want as a customer.

Factors Influencing MSSPs

As I mentioned in the introduction of this article, there are number of influential factors on MSSPs at this time.  In this section, I will address some of the more prevalent influences and how they have changed the MSSP landscape in the past few years.  

Cloud

Ten years ago, MSSP was an “on-premise” business.  In other words, their products were concentrated on managing and monitoring traditional, on-premise technologies (firewalls, IDS, endpoint, etc.).  Today, nearly all MSSPs are cloud-based.  Their platform resides in the cloud and even the management of on-premise equipment, such as firewalls, is handed through cloud products.

AI

Likewise, ten years ago AI was nothing.  Now it dominates every discussion about anything.  Currently, the use of AI in MSSPs is inconsistent.  Much of the AI messaging among MSSPs feels like marketing hype, and not substantive, technical improvement.  Where AI tends to land first is inside the third-party products that use some kind of AI detection method for malware.

Slowly AI is making it into SIEM platforms. However, AI use for threat hunting remains nascent.  Most MSSPs lack the internal expertise to fully integrate AI into their platforms.  Moreover, training an AI to analyze log data is difficult.  Without a sizable set of “positive” (or wanted) events, it is difficult for an AI to identity what constitutes “negative” (or unwanted) events.  Since most SIEM platforms do not store “non-events” this blinds the AI.

Where AI is making a difference is with analysts.  Use of AI for generating scripts, tools, and automations can dramatically accelerate an analysts efforts.  What used to require hours of painstaking coding, testing, and revising of automation scripts can be done in seconds with a prompt to ChatGPT.

However, buyers of MSSP services need to be mindful of this difference.  Merely because an MSSP says they use AI, does not mean it is integrated into the platform (or accessible to the customer).  Analysts using AI to develop scripts or automation is a good thing. However, that does not make the MSSP “AI enabled.”  This is where marketing fluff and process reality can diverge.

Co-Management

Another perpetual challenge with MSSPs is the co-management conundrum.  On the one hand, customers often demand access to the controls the MSSP manages.  On the other hand, giving a customer control creates a race-condition where the customer and MSSP can conflict on management styles or discipline.  Co-management is not necessarily good for customers or MSSPs.  Customers should be prepared to pay more for co-managed platforms vs full-managed ones.

Platform Images

This MSSP platform strategy is special to me, as it was a strategy I played a hand inventing.  In 2017 when I began my research, most MSSPs used a single, monolithic platform where they co-mingled all customer data.  This presented several challenges for using MSSP services in highly regulated environments, where data co-mingling is not permitted per compliance requirements.

My innovation was to use the automation capabilities of cloud environments to deploy an MSSP platform into customer’s own cloud accounts.  This functioned much in the same way as using an Linux or Windows image from a repository.  The image is instantiated independently in each customer’s environment.  Once deployed, it is then customized to suit the customer’s unique needs.  This deployment strategy eliminates all co-mingling issues and will support restrictive compliance requirements.

In 2018 when I built this platform, it was a novel concept.  Today, it is everywhere.  Many MSSP have fully embraced this deployment strategy, as it unlocks lucrative compliance funded opportunities. These types of environments are also more adaptable to customer needs.  

Buyer’s Guide

For companies considering an MSSP, here are some questions you ask to evaluate each dimension of the MSSP:

Component	Questions
Platform	Describe the architecture of your platform. How is the platform deployed (automation, images, hardware, etc.)? What services (capabilities) does it offer? What software (agents, etc.) must we install in our environment? How does this software communicate with the platform? What access do we have to the platform and its components? What third-party products does your platform use? How do you update the platform? How is the platform licensed? Where is the data stored?  Is the data co-mingled? What reports / data analysis is provided? If AI is used, describe how and where.
People	How is your SOC organized? What teams do you have? Describe how you on-board analysts? What kinds of training, education, or career development does the team receive?  Who responds to my tickets or phone calls? Who manages my account? How often can I expect to hear from an analyst? Are there any regular meetings, check-ins, or reviews If there is an emergency, who do I call?  How will I be contacted in the event of an incident?
Processes	Describe how my company will be onboarded to the platform. Define the data flow within your environment. How are access rights assigned, managed, and monitored? Describe how your team manages an incident?  Does your company perform “post-mortems” on incidents?  If vulnerabilities are detected (if this is part of the service), how will I be notified?  What role does your company have in remediating vulnerabilities?
Scale	What kinds of performance metrics do you have for your platform? How do you measure success among your teams? How often do you revise internal processes?  How is your platform updated, revised, or adapted to changing conditions? How does the organization manage change? What is the experience and background of the leadership?  Does the leadership have information security expertise? What is the roadmap for the MSSP?

A savvy MSSP can answer these questions (and more).  An immature one may struggle, or resort to marketing fluff.

Conclusion

MSSPs are an integral part of the information security landscape.  In the past decade they have transformed from simple firewall management, to full-service outlets that can accommodate a diverse set of security services.

There are numerous benefits to engaging an MSSP.  The most significant is that an MSSP can focus on security.  Unless your company intends to build a robust, in-house information security practice, it makes sense to outsource some (if not all) security functions to an MSSP.

For marketing and sales teams, your go to market efforts should focus on explaining the benefits of your four components.  Why is your platform unique? How is your team effective?  What practices or processes make your MSSP special?  And how do you adapt, change, and grow with the volatile security landscape.

While the MSSP market has evolved in the past few years, it has not fundamentally changed.  AI and automation are helping MSSPs scale, but they are not altering what makes an MSSP function.  If you are looking to hire, or build and MSSP, then it is important to evaluate the four primary components of an MSSP.