Managed Security Services

What managed security services include

Managed security services cover the day-to-day security work most companies under 500 people cannot staff themselves: watching for attacks around the clock, stopping them, and keeping defenses tuned. A typical MSSP contract is built from some or all of these services:

• Managed detection and response (MDR). Software on every laptop and server plus analysts who investigate alerts and isolate infected machines. This is the core of most small business contracts. See managed detection and response.
• SOC and managed SIEM. A security operations center that collects logs from firewalls, Microsoft 365, cloud systems and servers and watches them in one place. See SOC as a service.
• Email security. Filtering for phishing, malicious attachments and look-alike domains on top of what Microsoft or Google provide.
• Vulnerability management. Regular scanning, with patching tracked until fixed, plus an annual penetration test by a separate team.
• Security awareness training. Short lessons and simulated phishing emails, with reports on who clicked.
• Managed firewall and remote access. Firewall rules, firmware updates and VPN settings handled for you. See managed firewall services.
• vCISO. A part-time security leader who writes policy, answers insurer and customer questionnaires and owns the roadmap. See vCISO services.
• Incident response retainer. Pre-arranged hours with a response team, so you are not shopping for help during an attack. See incident response.

Not every company needs all of it. A 20-person office with Microsoft 365 and laptops usually needs MDR, email security, training and someone checking that backups can actually be restored. A SIEM and a full-time SOC usually come later, when logs from many systems or a regulator demand it.

MSP vs MSSP: which one you need

An MSP keeps your IT running; an MSSP watches for attackers and acts when it finds one. A managed service provider handles the help desk, devices, Microsoft 365, patching and backups. An MSSP specializes in detection, response and security program work, and many sell only to companies that already have IT support.

The line has blurred. In Kaseya's 2026 survey of 1,061 MSPs, about 71% said their cybersecurity revenue grew ¹², and many MSPs now resell MDR from a security vendor under their own name. That can work well. Three questions tell you what you are getting:

1. Who watches alerts at night and on weekends? If the answer is a security vendor's SOC behind your MSP, ask for the vendor's name and what it is allowed to do without calling anyone.
2. Who checks the people with admin access? When the same team runs your systems and also watches for misuse, nobody independent is watching the admins. An outside review, such as a yearly penetration test or a cybersecurity risk assessment, closes that gap.
3. What does an incident cost? Some contracts include response work; others bill it hourly once an incident is declared.

If you have in-house IT staff, a co-managed IT arrangement can add the security layer without replacing your team. Our managed IT services guide covers the MSP side in more depth.

What managed security costs

Most small and midsize businesses spend a few hundred to a few thousand dollars a month on managed security, priced mainly per endpoint and per user. Published ranges by service:

• MDR: $8 to $25 per endpoint per month for mainstream service ¹. Huntress, for example, lists Managed EDR at $8.99 per endpoint per month MSRP ⁷.
• Full MSSP bundles: averages of $45 per endpoint per month for basic and $73 for premium services in MSSP Alert's 2024 benchmark ².
• Email security: $2 to $5 per user per month; Microsoft lists Defender for Office 365 at $2.00 (Plan 1) and $5.00 (Plan 2) ⁴, and third-party tools have a median list price near $5 ⁵.
• Awareness training: $1.50 to $4 per user per month; KnowBe4 lists $2.40 to $3.75 for 25 to 50 seats ⁶ and Huntress lists $2.08 ⁷.
• SOC or managed SIEM: mostly $5,000 to $25,000 per month for companies with 100 to 1,000 employees ¹.

Worked example (our calculation). A 40-person firm with 45 laptops and servers, paying the published ranges above, would spend about $360 to $1,125 a month on MDR, $80 to $200 on email security, $60 to $160 on training and $50 to $300 on a managed firewall ⁸. That totals roughly $550 to $1,785 a month before a vCISO or a penetration test. The 2024 bundle averages would put the same 45 endpoints at about $2,025 to $3,285 a month, which usually buys more coverage, such as log monitoring and response hours.

Compare that with hiring. The median information security analyst earned $129,180 in May 2025 ¹³. With benefits at 30% of total compensation ¹⁴, that is about $184,500 a year including benefits, based on BLS data (our calculation), and one person cannot watch alerts 168 hours a week. For full pricing context across IT services, see our managed IT pricing guide.

Why companies with 10 to 500 staff buy managed security now

Attackers now go after smaller companies routinely, and insurers and customers are asking for proof of monitoring. The numbers from the main annual reports:

• The FBI's IC3 received 1,008,597 complaints reporting $20.877 billion in losses in 2025, with business email compromise alone at about $3.05 billion ¹⁵.
• Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of breaches, and exploited vulnerabilities became the top way in, at 31% of breaches ³. Third parties were involved in 48% of breaches ¹⁶.
• IBM's 2026 report put the average US breach at $11.5 million ¹⁷ and the global average at $4.99 million; organizations that used security AI and automation extensively cut average costs by $1.93 million ¹⁸.

Insurers have turned this into a checklist. Marsh lists twelve controls insurers look for, including endpoint detection and response, logging and monitoring, email filtering, tested backups and incident response plans ¹⁹. Our cyber insurance requirements page walks through each one.

Regulation pushes the same way. The FTC Safeguards Rule requires covered financial firms, including tax preparers, to name a Qualified Individual to run the security program ²⁰. Those firms must also either monitor continuously or run annual penetration tests and vulnerability assessments at least every six months ²⁰. Firms holding data on fewer than 5,000 consumers are exempt from the testing provision ²⁰. Healthcare, defense and financial firms should read our pages on HIPAA compliance services, CMMC and the written information security plan. Confirm your own obligations with counsel or your assessor.

How to evaluate managed security service providers

Judge an MSSP on what happens during an attack, not on the length of its tool list. Ask every provider the same questions and get the answers in writing:

• Coverage. Which systems are watched: laptops, servers, Microsoft 365 or Google accounts, cloud workloads, firewalls? Identity matters: Sophos found 79% of ransomware attacks in its 2026 study started with compromised identities ²¹.
• Authority to act. Can analysts isolate a laptop or disable an account at 2 a.m. without reaching you? Who do they call, and in what order?
• Response limits. Where does their work stop and an incident response firm's work start? Is response time billed separately?
• Reporting. What will you see each month, and will the report help with insurance renewals and customer security questionnaires?
• Ownership and exit. Who owns the security tools, logs and configurations, and how are they handed over if you leave?
• Fit. Do they already work with firms in your industry and under your rules (HIPAA, FTC Safeguards, CMMC)?
• Contract terms. Get the response commitments, term length and price increases written into the agreement rather than the proposal.

Our guide to choosing an MSP covers contract terms that apply to both kinds of providers. If you are a small office deciding where to start, our cybersecurity for small business guide lists the controls to put in place first.

Cybersecurity consulting vs managed security

Cybersecurity consulting is project work with an end date; managed security is a monthly service that keeps running. Most companies need both at different times.

Typical consulting projects are a risk assessment, a penetration test, writing policies, preparing for a HIPAA or CMMC review, or answering a large customer's security questionnaire. Published vCISO and security advisory rates run about $200 to $400 an hour ¹¹, and penetration tests are usually quoted as a fixed project. A sensible order for a company starting from scratch:

1. A risk assessment to find the biggest gaps.
2. Fix the basics: MFA everywhere, which Microsoft research found cut account compromise risk by 99.22% ²², plus patching and tested backups.
3. Add MDR and email security as a managed service.
4. Bring in a vCISO when insurers, customers or regulators start asking for written policies and evidence.
5. Test the result with a yearly penetration test from a firm that does not manage your systems.