Managed Security Services
MSSP Services Explained: What Each One Covers, How They Fit Together and What They Cost
A US data breach averaged $11.5 million in IBM's 2026 report. Get managed security through us: the providers that fit price your requirement at the same time, and we negotiate the contract.
Price My Security ServicesManaged security is a menu, not a single product. A company with a firewall it has no time to patch needs something different from one that just failed an audit. This page explains each service, how it is priced, and which of our six detailed guides to read next. We source every one of these services for you from the providers that fit, and we recommend only what your problem needs.
Sources: IBM Cost of a Data Breach Report 2026, via the Baker Donelson summary (time to contain; breaches contained within 200 days averaged $4.32 million against $5.65 million for longer ones, a gap of $1.33 million, MCA calculation); 2026 Data Breach Investigations Report (DBIR), executive summary (remediation of CISA known exploited vulnerabilities, median 43 days to full resolution).
Why Companies Buy Managed Security Services
The breach data explains the menu. The most common ingredients of a breach line up with the services companies buy, and the cost of getting it wrong is highest in the United States, more than twice the global average.
Sources: 2026 Data Breach Investigations Report (DBIR), executive summary (breach factors; exploitation is the initial access vector, the others are factors present); IBM Cost of a Data Breach Report 2026 (global average); Baker Donelson summary of the IBM 2026 report (US average). Factors overlap, so the shares do not add to 100. The service mapping is Metro Colo Advisory's. Figures as of October 2026. Free to cite with a link to this page.
One requirement goes to the providers that fit on the same day. Once you have asked a provider for pricing yourself, it usually will not register an advisor on the deal, and you negotiate alone.
Each provider prices the same users, devices, sites and log sources, with onboarding, retention and response included, so you compare what you will pay.
Who contains a threat, how fast, what is in the price, who owns the logs, and how you leave, in writing before you sign.
The provider you choose pays us, so it costs you nothing. You'll hear back within 24 hours from the person who will run your search.
What Is an MSSP, and What Does an MSSP Do?
A managed security service provider (MSSP) is a company that monitors, manages or runs part of another company's security for a recurring fee, usually from its own security operations center (SOC) staffed around the clock. What an MSSP does day to day depends on the services bought, but they stack in layers. The table shows how the layers fit together and where each one is covered in depth.
| Layer | Managed service | What the provider does | Usually bought when |
|---|---|---|---|
| SeeLogs from every system in one place | SOC as a service and managed SIEM | Collects and stores logs, watches them 24/7, triages alerts and escalates real incidents | An auditor or insurer asks for log retention and monitoring, or alerts go unread |
| Detect and respondEndpoints, identity, cloud | Managed detection and response (MDR) | Hunts for threats and acts on them: isolates a laptop, disables an account, stops a process | Ransomware is the main worry and nobody is awake to respond at night |
| Protect the edgeOffices, data centers | Managed firewall and firewall as a service | Configures, patches and monitors firewalls, and manages rule changes | Firewalls are out of date, rules have piled up, or the person who knew them has left |
| Control accessUsers, branches, remote staff | SASE and managed SD-WAN | Connects sites and remote users through a managed network with security checks built in, replacing old VPNs | An MPLS contract or a VPN is up for renewal, or staff work from anywhere |
| ComplyDefense contracts, controlled data | GCC High and CMMC enclaves | Builds and runs a separate, compliant environment for controlled unclassified information | A defense contract involves controlled unclassified information and CMMC Level 2 |
| Move securelyWorkloads leaving a server room | Cloud migration services | Plans and runs the move to cloud with identity, network and logging controls set up from the start | Hardware is at end of life or a lease is ending |
| RecoverAfter the worst day | Backup as a service and DRaaS | Keeps immutable copies of data and ready-to-run replicas of systems at the provider | Ransomware recovery has never been tested, or a single site holds everything |
Few companies buy every layer at once. Mid-market companies usually start with two or three and add the rest over time; larger companies often keep a small internal team and buy the 24/7 layers around it. Network services such as SD-WAN also tie into data center connectivity, so we price them together when both are on the table.
MSSP Services: Start With the Problem You Have
Each of these services has its own guide with pricing, comparisons and the questions to ask. Pick the one closest to the problem in front of you; the guides link to each other where the services overlap.
SOC as a Service
A 24/7 security operations center and managed SIEM you rent instead of build: log collection, monitoring, triage and escalation.
Managed Detection and Response
Threat hunting and hands-on containment across endpoints, identity and cloud. The service most aimed at ransomware.
Managed Firewall Services
Firewalls configured, patched, monitored and changed for you, on premises or delivered from the cloud as firewall as a service.
SASE and SD-WAN
One managed network for offices and remote staff with security built in, replacing MPLS circuits and aging VPNs.
GCC High and CMMC Enclaves
A compliant environment for controlled unclassified information, for defense contractors working to CMMC Level 2.
Cloud Migration Services
Moving workloads to the public cloud with security controls in place from day one. The reverse move is covered in cloud repatriation.
Disaster Recovery as a Service
Replicas of your systems kept ready at a provider, so you can run from its copy while your own site is rebuilt.
Backup as a Service
Immutable, offsite copies of your data that an attacker with your passwords still cannot delete.
Tell us the problem: an audit finding, a firewall nobody patches, no one watching alerts at night. We tell you which service fits, then put it in front of the providers that fit. You'll hear back within 24 hours.
MSSP vs MSP: What Is the Difference?
An MSP (managed service provider) keeps a company's IT running: devices, accounts, patches, the help desk. An MSSP keeps it secure: it watches for attacks and manages the security tools. Many MSPs now sell security, and many MSSPs offer some IT support, so the useful question is what the contract makes the provider responsible for.
| Question | MSP | MSSP | MDR provider |
|---|---|---|---|
| Main job | Keep IT working | Monitor and manage security | Find and stop active threats |
| Typical services | Help desk, device management, patching, email and network support | SOC monitoring, managed SIEM, managed firewall, vulnerability scanning, compliance reporting | Threat hunting, investigation and containment on endpoints, identity and cloud |
| When something looks wrong | Opens a ticket | Raises an alert and escalates to you, sometimes acts within agreed limits | Acts: isolates the device or disables the account, then tells you |
| Hours | Business hours, with on-call | 24/7 SOC | 24/7 analysts |
| Usually priced | Per user or per device, flat monthly | Per device, per site or by log volume | Per endpoint or per user |
MSSP Pricing: How Managed Security Services Are Priced
Managed security has no standard price list. Trade press coverage of MSSP packaging names five common models: per user, per device or endpoint, flat rate, usage based and custom (MSSP Alert, June 2026). Log services are usually priced on usage, by data volume; network services are often priced per site or device; and a quote covering several services mixes models. We have not found a neutral, current survey of MSSP prices, so this page gives the models and what drives each, not a dollar range we cannot source.
| Pricing model | How it is billed | Common for | What moves the price |
|---|---|---|---|
| Per user | Monthly fee per employee or mailbox | Identity monitoring, email security, security bundles for offices | Headcount, and whether contractors and shared accounts count |
| Per device or endpoint | Monthly fee per laptop, server or virtual machine | MDR, managed EDR, vulnerability management | Servers often cost more than laptops; cloud workloads may be counted separately |
| Per site or device under management | Monthly fee per location, firewall or circuit | Managed firewall, SD-WAN, SASE | Bandwidth, hardware included or not, high-availability pairs |
| Per log volumeA form of usage pricing | Gigabytes ingested per day, or events per second | Managed SIEM, SOC as a service | Which log sources are in scope and how long logs are retained |
| Flat-rate tiers | Flat monthly fee for a package of services | Small and midsize businesses, standardized services | What the tier leaves out, and what an upgrade costs mid-term |
| Custom and retainers | Scoped fee or prepaid hours | Incident response retainers, compliance projects, advisory work | Hours included, response time commitments, rollover of unused hours |
Beyond the model, five things move a managed security quote most: the number of users, devices and sites; how much log data is collected and how long it is kept; whether the provider only alerts or also contains threats; one-time onboarding fees; and the contract term and any annual price increase. Two quotes at the same per-user rate can differ widely once those are written out, which is why we ask each provider to price the same scope line by line.
Send your user, device and site counts, the services you are considering and any compliance needs. The providers that fit price the same scope at once, before any of them has your name from a direct inquiry. The provider you choose pays us, so it costs you nothing, and you'll hear back within 24 hours.
In-House SOC vs MSSP: What 24/7 Coverage Costs
The alternative to an MSSP is hiring. A seat staffed around the clock is 8,736 hours a year, and one analyst works about 1,776 of them after leave, holidays and training, so a single 24/7 seat takes about 4.9 people. Here is that arithmetic with public pay data.
MCA calculation. A seat staffed around the clock is 8,736 hours a year (52 weeks × 168 hours). One analyst works about 1,776 hours after vacation, sick leave, holidays and training (2,080 hours less 38 days: 23 days of vacation and sick leave from the BLS National Compensation Survey, plus 10 holidays and 5 training days, our assumption). 8,736 ÷ 1,776 = 4.9 analysts per seat. At the BLS median pay of $129,180 (May 2025), that is about $635,000 a year in salary, or about $928,000 with benefits at the BLS ratio of total compensation to wages of 1.46 (Employer Costs for Employee Compensation, June 2026). Free to cite with a link to this page.
Managed Security Services for Small Business
Small companies are hit hardest by ransomware. The 2026 DBIR says small organizations are disproportionately affected, and the 2025 DBIR put ransomware in 88% of breaches at small and midsize businesses, against 39% at larger organizations. In the 2026 report, 69% of ransomware victims did not pay, which only works if there is a clean copy to restore from. A small business rarely needs a full SIEM on day one. Three services cover most of the risk:
Detection and response on every device
Managed EDR or MDR, so someone acts on a compromised laptop at night, not the next morning.
Backups an attacker cannot delete
Immutable, offsite copies through backup as a service, tested by restoring from them.
A managed edge
A managed firewall that is patched for you, or SASE if most staff work remotely.
How to Choose an MSSP: What the Best MSSPs Put in Writing
Lists of the top MSSP companies rank size and marketing, not fit. The best MSSP for you is the one that answers these six questions in writing for your environment, at a price that holds for the full term.
What the provider will do on its own authority, such as isolating a device or disabling an account, and how fast.
Which endpoints, cloud accounts, identity systems and log sources are in the price, and what costs extra.
The provider's own analysts around the clock, where its SOC sits, and the escalation path to a senior responder.
How long logs are kept, who owns them and the tool licenses, and how you take both with you if you leave.
The provider's own SOC 2 Type II report, reports your auditors accept, and a HIPAA business associate agreement or CMMC support where you need them.
Term length, onboarding fees, annual increases, incident response hours included, and what growth in users or data costs.
We write them into the requirement before any provider prices it, so every quote you compare carries the same response times, data rights and exit terms.
Six Mistakes When Buying Managed Security Services
Calling one provider first
Once you have asked a provider for pricing directly, it usually will not register an advisor on the deal, and you negotiate alone. Send the requirement to the market once, at the same time.
Comparing per-user headline rates
The rate is one line. Onboarding, log retention, extra log sources, incident response hours and annual increases decide the total over the term.
Buying alerts when you need response
An alert at 3 a.m. helps only if someone acts on it. If nobody on your side is awake, the contract has to give the provider authority to contain.
Paying twice for the same tool
Many services bundle their own endpoint or SIEM licenses. Check what you already own before you sign, and drop the overlap.
Assuming the MSP has security covered
An IT support contract keeps systems running. Unless it names 24/7 monitoring and response, nobody is watching for attackers.
Forgetting the exit
Logs, detection rules and tool licenses can stay with the provider when you leave. Agree ownership and transition help before you sign, not at renewal.
How We Place Managed Security Services
You send the requirement
Users, endpoints and servers, sites, cloud accounts, the tools you already own, compliance needs, and what you want the provider to handle. Rough numbers are fine.
We run the providers that fit, at once
The same scope goes to the providers that fit on the same day, so each one prices against the others rather than against nobody.
We compare totals line by line
Monthly fees, onboarding, retention, response commitments, incident response hours and price increases over the full term, side by side.
We negotiate, you sign
Price, response terms, log ownership and exit terms, while they are still negotiable. You sign directly with the provider you choose, and that provider pays us.
If security is part of a wider question, such as where workloads should run, whether to leave a server room, or how to merge two environments after an acquisition, start with IT infrastructure consulting. That is a paid engagement, and we tell you the fee before it starts. Owners and developers of facilities are served by data center consulting.
Security services and the place your systems live have to pass the same audit. See compliance colocation for SOC 2, PCI and similar requirements, and HIPAA compliant hosting and colocation for healthcare. If the move out of a server room comes with it, the colocation pricing guide and data center cost guide carry the numbers.
Managed Security Services: Frequently Asked Questions
What is an MSSP?
An MSSP, or managed security service provider, is a company that monitors, manages or runs part of another company's cybersecurity for a recurring fee. Most run a security operations center staffed 24/7. Common services include log monitoring, managed firewalls, threat detection and response, and compliance reporting.
What does an MSSP do?
An MSSP watches your systems for attacks, manages security tools such as firewalls and SIEM, and escalates or contains incidents, depending on the contract. It works around the clock from its own SOC. The exact scope is whatever the contract names, so read the response terms before signing.
What is the difference between an MSP and an MSSP?
An MSP keeps IT running, with help desk, devices and patching, while an MSSP keeps it secure, with monitoring, security tools and incident handling. Many firms now offer both. Unless an MSP contract names 24/7 security monitoring and response, assume it does not include them.
What is the difference between MDR and an MSSP?
An MSSP typically manages security tools and alerts you to threats, while an MDR provider is hired to investigate and contain threats itself, for example by isolating a device. Many MSSPs now sell MDR as one of their services. Our MDR guide covers the comparison in depth.
What services do MSSPs offer?
The core MSSP services are SOC as a service and managed SIEM, managed detection and response, managed firewall and firewall as a service, SASE and managed SD-WAN, compliance environments such as CMMC enclaves, and vulnerability management. Many also offer backup, disaster recovery and incident response retainers. Few companies buy them all at once.
How much do managed security services cost?
It depends on the pricing model and scope: MSSP services are billed per user, per device or endpoint, per site, by log volume, as bundled tiers, or as custom retainers. We have not found a neutral, current price survey, so we do not quote a range. Onboarding fees, log retention, response scope and contract term move the total as much as the headline rate does.
Is an MSSP cheaper than an in-house SOC?
For most mid-market companies, yes. Staffing one security seat around the clock takes about 4.9 analysts, about $928,000 a year with benefits at the national median before any tools, by our calculation from BLS data. A managed service spreads that staffing across many customers, so compare its full-term total against that figure.
Do small businesses need managed security services?
Most do, because ransomware hits smaller companies hardest: the 2025 Data Breach Investigations Report (DBIR) found it in 88% of breaches at small and midsize businesses, against 39% at larger organizations. A practical starting set is managed detection and response, immutable backups and a managed firewall or SASE.
How do I choose the best MSSP?
Choose on fit, not on rankings. Ask each provider to state in writing what it will do on its own authority and how fast, which systems and log sources are in the price, who owns your logs, what audit evidence it provides, and how the price changes over the term.
Who are the top MSSP companies?
Lists of top MSSP companies usually rank size or marketing, not suitability for your environment. The right provider depends on your mix of endpoints, cloud, sites and compliance needs, and on the terms it will accept. We put your requirement in front of the providers that fit and let them compete on the same scope.
Can managed security services help with compliance?
Yes, for the monitoring, logging and reporting parts of frameworks such as HIPAA, PCI DSS, SOC 2 and CMMC. The provider should supply its own SOC 2 Type II report and sign a business associate agreement where HIPAA applies. Compliance still depends on your own policies, so a provider supports an audit rather than passing it for you.
What should an MSSP contract include?
The services and systems in scope, response actions and time commitments, log retention and ownership, onboarding fees, incident response hours, price increases, the term, and exit and transition terms. Anything not written down is not included. These are the terms we negotiate before you sign.
Does Metro Colo Advisory provide managed security services?
No. We do not run a SOC, manage firewalls or perform migrations. We are an independent advisor: we take your requirement to the providers that fit, negotiate price and terms, and the provider you choose pays us, so it costs you nothing.
Price Your Managed Security Services
Send what you need covered: users, devices and servers, sites, cloud accounts, the tools you already own, and any compliance requirements. Rough numbers are fine. You'll hear back within 24 hours from the person who will run your search. If your current setup or an in-house team is the better answer, we will say so. Everything runs by email, so there is no sales call to book.
Once you have asked a provider for pricing yourself, it usually will not register an advisor, and you negotiate alone. Sent first, the providers that fit compete for your business. The provider you choose pays us, so it costs you nothing. If you have already spoken to one provider, tell us which; we can still run the rest of the market.
Security services: SOC as a service, managed detection and response, managed firewall services, SASE and SD-WAN and GCC High and CMMC enclaves.
Recovery: DRaaS, backup as a service and disaster recovery colocation.
Cloud and network: cloud migration services, cloud repatriation, hybrid cloud colocation, managed private cloud and data center connectivity.
Decisions and compliance: IT infrastructure consulting, data center consulting, compliance colocation and HIPAA compliant hosting.
