MSP or MSSP: who keeps your systems running and who watches for attacks

The short answer

An MSP (managed service provider) runs your IT day to day: help desk, computers, Microsoft 365 or Google Workspace, backups, updates and vendors. An MSSP (managed security service provider) does one job: it watches for and responds to security threats, usually from a security operations center that reviews alerts from your systems.

The simplest way to remember it: an MSP keeps things working, an MSSP looks for signs that someone is breaking in. Most businesses with 25 to 100 employees need everything an MSP does plus a core set of security controls. Fewer need a separate MSSP. The right answer depends on your data, your insurer and your regulators, and the rest of this article gives you a way to decide.

What an MSP does

A managed service provider takes over the routine work an internal IT department would do. For a small or midsize business that usually means:

• Help desk support by phone, email and screen share
• Setting up, updating and retiring computers
• Administering Microsoft 365 or Google Workspace accounts, licenses and permissions
• Adding new staff and removing leavers
• Backups, plus restore tests that prove the backups work
• Network, Wi-Fi, firewall and printer management
• Calling your internet provider, phone company and software vendors for you
• Planning hardware replacement and budgets

A good MSP also covers baseline security, because you cannot run IT well without it: multi-factor authentication, endpoint protection, patching, email filtering and access reviews. The difference is that an MSP’s security work is mostly preventive and configuration-based. It sets things up correctly and keeps them that way.

What an MSSP does

An MSSP specializes in detection and response. Its services typically include:

• Security monitoring. Collecting logs and alerts from computers, firewalls, email and cloud accounts, then having analysts review them.
• SIEM management. Running a security information and event management system that correlates events across your environment.
• Threat detection and response. Investigating suspicious activity and isolating a compromised laptop or account.
• Vulnerability scanning. Regular scans for missing patches and weak configurations.
• Compliance reporting. Evidence for audits and frameworks such as PCI DSS or HIPAA security reviews.
• Incident response support. Help containing and investigating a breach.

What an MSSP usually does not do is fix your printer, onboard a new hire or migrate your email. It assumes someone else runs IT.

Where MDR and other acronyms fit

You will see a few related terms in proposals. They overlap, so it helps to know what each one usually means.

• MDR (managed detection and response). A narrower service than a full MSSP. It focuses on watching endpoints, and sometimes email and cloud accounts, and taking action when it sees an attack. Many MSPs resell or partner with an MDR provider rather than running their own security operations center.
• EDR (endpoint detection and response). The software on each computer that records activity and can stop malicious behavior. MDR is people watching EDR.
• SOC (security operations center). The team of analysts who review alerts. Some MSSPs own one, many rent one.
• VAR (value-added reseller). A company that sells and installs hardware and software. It may not manage anything after the sale.

When a proposal uses these terms, ask a direct question: who looks at an alert, how fast, and what are they allowed to do without calling you first?

MSP vs MSSP side by side

Not sure whether your current setup covers both sides? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Does a small business need both?

Use these decision rules. They are a starting point, not a substitute for advice from your insurer or compliance adviser.

1. No one runs IT today. Start with an MSP that includes baseline security. An MSSP watching a poorly managed network mostly generates alerts nobody acts on.
2. You have an internal IT person who is stretched. Add an MSP alongside them for help desk and coverage, or add MDR so someone watches alerts when your IT person is away.
3. You handle sensitive data. Patient records, legal files, payment card data or financial accounts raise the stakes. Ask whether your MSP provides or partners for MDR, and whether that meets your obligations.
4. Your cyber insurer asks for it. Many applications ask about endpoint detection and response and monitoring. Read the questionnaire before you shop. Our guide to cyber insurance requirements covers the common questions.
5. You have had an incident. A breach, business email compromise or ransomware scare is a strong signal to add continuous monitoring.

For most 25 to 100 person companies, the practical answer is one MSP that covers operations and baseline security, with MDR added where the risk justifies it. That keeps one party accountable instead of two vendors pointing at each other.

Gaps to watch when you use two providers

If you do hire both, the risk is not missing tools. It is missing handoffs. CISA’s guidance for MSP customers stresses agreeing responsibilities and access levels with every provider in writing. Check these points:

• Who can isolate a computer or disable an account at 2 a.m., and do they need approval?
• Who restores data after an attack, and from which backups?
• Who owns the admin passwords and the documentation?
• Who updates the written recovery plan when something changes?
• Who answers the cyber insurance questionnaire, and who signs it?
• How do the two providers share tickets and escalate to each other?

If nobody can answer these in one sentence each, you have a gap, regardless of how many providers you pay.

Questions to ask any provider

1. Which security controls are included in the monthly fee, and which are add-ons?
2. Do you run your own security operations center, or partner with one? Who is the partner?
3. What do you do when you see a suspicious sign-in to a Microsoft 365 or Google Workspace account?
4. How often do you test restores, and can you show me the last result?
5. How fast do you reply, and how fast does someone start working on the problem?
6. What happens to our data, passwords and documentation if we leave?

JLB USA provides managed IT for businesses with roughly 25 to 100 employees, with security built in: MFA, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores and a written recovery plan. See our cybersecurity services for details. We reply within 5 minutes by email or phone, offer on-site support in Atlanta, Birmingham and Chattanooga, and support clients remotely everywhere else.

Keep reading

• Fractional CIO: what they do, what drives the cost and when you need one
• IT assessment checklist: what to review and how to score it
• IT support for nonprofits: how to get good IT on a tight budget
• Managed IT services in Birmingham, AL: a practical guide for growing businesses

Related services

• Managed IT services
• Cybersecurity services
• Outsourced IT vs in-house IT