How to Choose a Managed Security Provider (Without Getting Burned)

For most small and mid-sized businesses, building an in-house security operations team isn't realistic. A single experienced security analyst costs $90,000 to $130,000 per year, and you'd need at least two for meaningful coverage. Add the cost of security tools, training, and management overhead, and you're looking at a half-million-dollar annual investment before you even start.

That's why managed security service providers (MSSPs) exist. A good MSSP gives you access to enterprise-grade security capabilities at a fraction of the in-house cost. A bad one gives you a false sense of security and a recurring bill for services that don't actually protect you.

The difference between the two is harder to spot than you'd think.

This guide walks you through the evaluation process, from understanding what to look for to spotting the red flags that should send you running.

What a Managed Security Provider Actually Does

Before evaluating providers, make sure you understand the different service tiers available:

Some providers specialize in one area. Others offer comprehensive packages that bundle multiple services. The right fit depends on what you already have in-house and where your gaps are.

The 10 Questions You Must Ask

Before you sign anything, get clear answers to these questions. How a provider responds tells you as much as what they say.

1. What is your analyst-to-customer ratio?

This is the single most revealing question you can ask. If one analyst is responsible for monitoring hundreds of clients, the quality of threat detection drops dramatically. Look for providers with ratios that allow for meaningful human analysis, not just automated alerting.

2. What does "24/7 monitoring" actually mean?

Some providers have staffed SOCs around the clock. Others have analysts during business hours and automated systems overnight with on-call escalation. Both models can work, but you need to know which one you're paying for.

Ask specifically: "If a critical alert fires at 2 AM on a Saturday, what happens? Who sees it, how quickly, and what actions can they take without calling me first?"

3. What is your mean time to detect (MTTD) and mean time to respond (MTTR)?

These are the two most important metrics in security operations. MTTD measures how quickly they identify a threat. MTTR measures how quickly they contain it. Get specific numbers and ask how they're measured.

4. What technology platform do you use, and do I own the data?

Some providers build on well-known platforms (CrowdStrike, SentinelOne, Microsoft Defender). Others use proprietary tools. Neither approach is inherently better, but you need to understand:

• Can you take your data and detection rules with you if you leave?
• Does the provider have lock-in mechanisms that make switching expensive?
• Are you paying for the provider's service, or are you also paying inflated licensing costs for tools you could buy directly?

5. How do you handle incidents that require response actions?

There's a critical difference between monitoring and response. Some providers will only alert you to threats and leave the response to your team. Others will take active containment actions, isolating compromised devices, blocking malicious traffic, disabling compromised accounts.

Understand the scope of response actions your provider is authorized and able to take. If your internal team needs to execute every response, you're paying for monitoring, not managed detection and response.

6. What does your onboarding process look like?

A credible provider will invest significant time in understanding your environment before they can effectively protect it. Be wary of providers who promise full coverage within days. A proper onboarding should include:

• Asset and network discovery
• Baseline establishment for normal behavior
• Integration with your existing tools
• Tuning to reduce false positives
• Runbook development for common scenarios

Expect onboarding to take 30-60 days for meaningful coverage.

7. How do you report to us, and how often?

You should receive regular reporting that you can actually use. Ask for sample reports and evaluate whether they're actionable or just data dumps.

Good reporting includes:

• Executive summary in plain language
• Threat activity trends
• Incidents detected and resolved
• Recommendations for improvement
• Metrics tracking (MTTD, MTTR, alert volume, false positive rate)

8. Can you provide customer references in our industry?

Ask for three references from companies similar in size and industry to yours. When you call those references, ask:

• How responsive is the provider when you need them?
• Have they detected any real threats?
• How well do they communicate during incidents?
• Would you choose them again?

9. What certifications and compliance frameworks do you maintain?

Credible MSSPs typically maintain certifications that demonstrate operational maturity:

• SOC 2 Type II, Validates their own security controls and operational processes
• ISO 27001, Information security management system certification
• Industry-specific compliance, If you're in healthcare, does the provider understand HIPAA? Financial services? PCI DSS?

Ask for copies of their SOC 2 report. Read it, or have your auditor review it.

10. What happens if we want to leave?

Exit terms matter more than most leaders realize. Understand:

• Contract length and auto-renewal terms
• Termination fees and notice requirements
• Data portability, can you take your logs, detection rules, and configurations?
• Transition support, will they cooperate with your new provider?

Red Flags That Should Disqualify a Provider

Not every warning sign is subtle. Here are the ones that should stop the conversation immediately.

Contract Terms That Matter

Once you've narrowed your options, pay close attention to these contract terms:

Service Level Agreements (SLAs). Get specific commitments on response times. An SLA should specify:

• Time to acknowledge a critical alert (target: 15 minutes or less)
• Time to begin investigation (target: 30 minutes or less)
• Time to provide initial assessment (target: 1-2 hours)
• Penalties if SLAs are missed consistently

Scope of services. Define exactly what's covered. Which systems are monitored? What actions can the provider take? What requires your approval? Ambiguity in scope leads to finger-pointing during incidents.

Liability and indemnification. Understand what happens if the provider makes a mistake. Most MSSPs cap their liability at the contract value, which may not cover your losses. Review this section with legal counsel.

Data ownership and retention. You should own your data. Period. Clarify how long the provider retains your logs, what happens to your data at contract end, and whether they can use your anonymized data for their own purposes.

Your Evaluation Checklist

Use this checklist to score each provider you evaluate. The one with the most consistent strength across all categories is your best fit.

Making the Decision

Choosing an MSSP is one of the most consequential security decisions you'll make. Take the time to do it right. Get proposals from at least three providers. Run each through the evaluation checklist. Call the references. Have your legal counsel review the contracts.

And remember: the cheapest option is rarely the best value. A provider that charges less but misses a critical threat costs far more than the premium option that catches it. Evaluate on capability and fit, not just price.

Key Takeaways

For more on building your security team, whether in-house, outsourced, or hybrid, see Cybersecurity for CEOs.