Glossary
MSSP (managed security service provider)
Also called: Managed security service provider
In one sentence
An MSSP is a company that provides ongoing, outsourced security services — such as threat monitoring, log analysis and incident response — rather than general IT support.
An MSP looks after your IT as a whole: help desk, devices, Microsoft 365, networks, backups. An MSSP focuses specifically on security operations — running a SOC, monitoring a SIEM, managing firewalls or intrusion detection, vulnerability management and sometimes penetration testing. MDR providers are a closely related category focused on detecting and responding to threats on endpoints and in the cloud.
The lines between these have blurred. Many MSPs now include strong security tooling and partner with an MDR or MSSP for round-the-clock security monitoring; some MSSPs offer general IT help too. What matters is clarity about who does what.
Why it matters for a small organization: you likely don't need to hire an MSP and a separate MSSP. But you do need to know who watches security alerts outside business hours, who can isolate a device or lock an account, and who leads the response in an incident. If those answers involve two companies, they need to work together, with a shared incident response plan.
Questions to ask: Is security monitoring staffed by people at all hours, or is it automated alerting? What actions can the team take without calling you? What's excluded? Will they sign a BAA if they can see patient data?
Example: a medical practice's MSP handles daily IT and partners with an MDR provider for overnight endpoint monitoring. When an alert fires at 3 a.m., the MDR analysts isolate the device; in the morning, the MSP cleans it up and talks the practice manager through what happened.
Related terms
- MSP (managed service provider)An MSP is an outside company that runs and supports your IT on an ongoing basis — help desk, monitoring, updates, security and planning — usually for a predictable monthly fee.
- MDR (managed detection and response)MDR is a service where a team of security analysts watches your security tools' alerts, investigates them, and takes action to contain threats on your behalf.
- SOC (security operations center)A SOC is a team — in-house or outsourced — whose job is to watch an organization's security alerts, investigate them and respond to attacks.
- SIEM (security information and event management)A SIEM is a system that collects logs from across your environment in one place, keeps them, and analyzes them to spot and investigate security problems.
- SLA (service level agreement)An SLA is the part of a service contract that defines measurable commitments — such as how quickly a provider responds to and resolves problems — and what happens if they miss them.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.