MSP vs MSSP: what is the difference, and which do you need?
What is the difference between an MSP and an MSSP?
A managed service provider runs your IT - devices, infrastructure, service desk, cloud. A managed security service provider runs security monitoring and response - detection, alert triage, threat hunting and incident support. An MSP keeps IT working. An MSSP watches for the people trying to break it. Many businesses need both functions, whether or not they buy them from two firms.
What an MSP does
Service desk and end-user support
Device management, builds, onboarding and offboarding
Infrastructure, networks and cloud administration
Microsoft 365 or Google Workspace administration
Backup, patching and updates
Procurement and vendor management
Projects and migrations
Most MSPs also provide security controls: endpoint protection, MFA, email filtering, patch management. That is preventive security, and it is not the same as monitoring.
What an MSSP does
24-hour security monitoring, often via a security operations centre
Log collection and correlation across your estate
Alert triage - separating real incidents from the noise
Managed detection and response
Threat intelligence and hunting
Incident response support
Vulnerability management and reporting
Compliance evidence for audits
An MSSP typically does not run your service desk, rebuild laptops or manage your Microsoft tenancy.
The overlap, and the gap
Capability | MSP | MSSP |
|---|---|---|
Endpoint protection deployed | ● | ○ |
Alerts from that tool watched at 2am | ○ | ● |
Patching | ● | ○ reports on it |
Vulnerability scanning and prioritisation | ○ | ● |
Identity administration | ● | ○ |
Detecting misuse of a valid identity | ● | |
Backup | ● | |
Ransomware detection before backups are affected | ● |
The gap sits in a predictable place. The MSP deploys the tools. Nobody is contracted to watch the alerts they generate outside business hours. Alerts accumulate, and are read after an incident rather than during one.
Which do you need?
An MSP alone may be sufficient if you are small, hold no sensitive data, have no compliance obligations and accept the risk consciously.
An MSP plus an MSSP is the common enterprise pattern, and it works - provided the two are contractually joined. Detection without the ability to act is an expensive notification service.
One provider covering both removes the co-ordination problem. The team that detects the incident is the team that can isolate the device, reset the credentials and rebuild the machine. That matters at 2am.
The question that exposes the gap
Ask your current provider: *at 2am on a Sunday, an unusual sign-in succeeds from an unfamiliar location on a finance account. Who sees it, how quickly, and what do they do next?*
If the answer involves someone reading a report on Monday, you have preventive security and no detection.
What to check in either contract
What data sources are monitored - endpoints only, or identity, cloud and email as well?
Is response included, or only notification?
What are the notification timeframes by severity?
Who can take containment action, and are they authorised in advance?
Is there an incident response retainer, and what does it include?
Is the provider certified itself, and can you verify it?
On that last point, NVOY holds ISO/IEC 27001:2022 certification for the provision of IT managed services, professional services and supply of IT equipment - certificate 21497ISMS001, issued by Alcumus ISOQAR under UKAS accreditation, and independently verifiable.
How NVOY covers both
Security and IT operations sit in the same team rather than in two contracts. Detection, containment and remediation are handled by people who already hold the estate, so there is no handover in the middle of an incident.
See IT Security and MDR vs SIEM vs antivirus.
BLOGS
