Managed security services are now a board-level line item, and the market is crowded. Nine out of ten MSSP contracts we review are priced on volume of alerts, not outcomes — which is why buyers are quietly unhappy and providers are quietly profitable.
This is the buyer’s guide we use with clients before they sign a managed security services contract. Use it to separate serious partners from resellers dressed up as SOCs.
What managed security services should actually deliver
- Continuous monitoring across endpoint, identity, network, cloud and email — not just one surface.
- Investigation and triage by humans, not tickets with canned responses.
- Threat hunting on a defined cadence, not on request.
- Incident response with rehearsed playbooks and named on-call engineers.
- Executive reporting tied to business risk, not alert volume.
Three coverage models — and when each fits
Co-managed SOC
Your team owns strategy and escalations; the MSSP owns 24/7 coverage, tooling operations, and first-line triage. Best for mid-to-large enterprises with a security leader but not enough headcount for overnight cover.
Fully managed SOC
The MSSP owns the security operations function end-to-end. Faster to stand up, but demands tight reporting or you lose organisational muscle.
Targeted managed services
The MSSP runs one domain — e.g. cloud security, identity, or endpoint — while you own the rest. A good starting point, and often the most cost-effective.
Pricing traps to watch
If the MSSP is paid by alert count or log volume, they are financially rewarded for noisy environments. Prefer outcome-based or seat-based pricing with clear SLAs.
Ten questions that separate serious MSSPs from resellers
- Who are the named engineers covering our account, and what is their experience?
- How is the SOC staffed overnight and on weekends?
- What is your mean time to detect and contain by severity?
- Show us a recent incident report — redacted is fine.
- What tools do you operate, and which do you insist we bring?
- How do you handle threat hunting on custom apps and cloud infrastructure?
- What is your escalation path to us, and do we have a red-phone number?
- What reporting do we get weekly, monthly, quarterly?
- How do we exit this contract, and what happens to our data?
- How do you measure and improve false-positive rates over time?
Red flags
- Ticket-heavy sales demos that avoid showing real investigations.
- Pricing that scales linearly with alerts, logs, or assets with no tiering.
- No named senior engineers attached to the account.
- No adversary emulation, red teaming, or threat-hunting calendar.