Managed Security Service Provider (MSSP)
Definition
A third-party organisation that delivers security monitoring, tooling, and analyst coverage as a contracted service. Used in fully outsourced and co-managed SOC arrangements.
- Role
- Outsourced security monitoring and analyst coverage
- Typical services
- SIEM management, alert triage, 24x7 coverage
- Arrangement types
- Fully outsourced or co-managed with an in-house team
- Contract basis
- Service level agreement (SLA) defining response times
Common questions
How does a co-managed MSSP arrangement differ from full outsourcing?+
In a co-managed model the organisation keeps an internal security team that retains investigation and response authority while the MSSP supplies tooling, monitoring, and first-line alert triage; in full outsourcing the provider also owns escalation and response, with the client mainly reviewing reports and approving major actions.
What is the main risk of relying on an MSSP for incident response?+
Response speed and context depend on the SLA and on how well the provider understands the client's environment, so a poorly scoped contract can leave gaps in coverage for custom applications or during handoffs between the MSSP and the internal team, especially during an active incident.
Related terms
- Escalation Path
- The predefined chain of notification and decision-making authority that an incident follows as its severity increases. Documented in the IR plan before...
- Playbook
- A documented step-by-step procedure for responding to a specific type of security event. Playbooks standardise analyst behaviour, reduce response time, and ensure...
- Security Operations Centre (SOC)
- The dedicated team and technology platform responsible for continuous monitoring, detection, analysis, and coordinated response to security events. May be in-house, co-managed,...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...
- Threat Hunting
- A proactive, human-led process that searches for evidence of adversary activity in an environment under the assumption that automated controls have been...