A managed security service provider (MSSP) is an IT service provider that provides an organization with some amount of cybersecurity monitoring and management, which may include virus and spam blocking, intrusion detection, firewalls and virtual private network (VPN) management. An MSSP can also handle system changes, modifications and upgrades.
What managed security service providers are used for
Organizations may either outsource all or aspects of their IT security functions to MSSPs. MSSPs will typically provide some level of continuous security monitoring, vulnerability risk assessment, threat intelligence and intrusion management. Some MSSPs offer services to support organizations in regulated industries that must meet compliance requirements, such as the Health Insurance Portability and Accountability Act (HIPAA) or Europe's General Data Protection Regulation (GDPR).
In some cases, working with a managed security service provider will offer cost savings to an organization. For example, acquiring in-house cybersecurity staff can be expensive, so working with an MSSP can present a more cost-effective option. Using an MSSP can also save organizations money on equipment, software tools and other operational costs.
But some organizations are reluctant to give up complete control over the security of their systems. Furthermore, there may be considerable variability in competence among MSSPs.
History of MSSPs
MSSPs have evolved in various ways. Some traditional service providers, noting the seemingly ever-increasing demand for internet security, have added managed security to their portfolios. Other traditional channel partners, such as a value-added reseller (VAR), will resell vendors' cloud-based security services. Still other MSSPs have come into existence as brand new entities focused solely on cybersecurity offerings.
Some industry observers have asserted that every channel company is a "security provider" to some extent, as nearly every aspect of a customer organization's operations features some cybersecurity component.
MSSPs have long targeted large enterprises, but as security threats evolve, many are focusing on providing managed security offerings to the small and medium-sized business (SMB) market as well.
The demand for security services is only expected to grow, according to several market research reports. Research firm MarketsandMarkets, for example, forecast the security services market will reach about $34 billion by 2021.