Managed security service providers: who they are, what they sell and how CISOs compare them

What managed security service providers sell

A managed security service provider (MSSP) runs security technology for a customer, such as firewalls, identity systems or monitoring, under a managed contract. The customer buys an ongoing operating service, not a product licence or a one-off project. A definition Splunk attributes to Gartner describes MSSPs as entities that provide outsourced monitoring and management of security devices and systems.

What is in scope

Scope runs from narrow device management to a complete security operation. Optiv says an MSSP might provide anything from security monitoring, vulnerability management and tier-one support to SIEM co-management or a fully staffed security operations center. Vendors on our record show the spread. Proximus NXT sells round-the-clock monitoring and management of a customer's security environment. Telia sells filtering of denial-of-service traffic. Infosys sells a managed identity and access service.

The model is older than most of today's security tooling. Fortinet dates the first MSSPs to the late 1990s, when internet service providers began offering and managing firewall appliances for their customers.

How it differs from its neighbours

The closest neighbour is the general managed service provider (MSP). CISA defines MSPs as entities that deliver, operate or manage ICT services for customers under a contractual arrangement such as a service level agreement. Cybersecurity is one of several offerings in that definition. Splunk draws the line this way: MSPs handle general IT operations, while MSSPs focus on cybersecurity work such as threat detection, SOC operations and incident response.

Advisory and engineering work that ends with a report or a finished build sits beside the category, not inside it. Several firms on our record sell both kinds of work, so a buyer should check which one a given contract covers.

Delivery models

Most engagements take one of two forms. Vistrada describes scope set in a statement of work, either co-managed, where the provider runs tools alongside the customer's team, or fully managed, where the provider owns day-to-day execution.

In a co-managed setup, Meriplex says the MSSP handles monitoring, alert validation and escalation, and the customer's internal team handles remediation and response. In a fully managed engagement, the provider takes on operational responsibility for responding to threats, not only for alerting the customer.

Whichever model applies, CISA advises customers to make sure the contract states whether the provider or the customer owns specific responsibilities, such as hardening, detection and incident response.

What the standards, agencies and public evaluations say

No single standard certifies a provider as an MSSP. What applies is a mix of agency guidance, risk frameworks, contract clauses and audit reports. Each one touches the provider, the customer, or the contract between them.

Agency guidance

CISA and partner agencies issued a joint advisory setting out actions MSPs and their customers can take to reduce the risk of intrusion. Its tactical list tells both sides to enforce MFA on MSP accounts that reach into the customer environment and to watch for unexplained failed logins. It also asks customers to understand the supply chain risk of their MSP, including risk from third-party vendors and subcontractors.

Risk frameworks

The NIST Cybersecurity Framework 2.0, published in 2024, describes outcomes rather than methods. It does not prescribe how those outcomes should be achieved. Its Tiers run from Partial (Tier 1) through Risk Informed, Repeatable and Adaptive (Tier 4). At Tier 3, an organization's risk strategy accounts for its suppliers and acts on that risk through written agreements that set baseline requirements. For many buyers, a managed security contract is that written agreement.

US federal and defence contracting

The FedRAMP 2026 rules cover how cloud service offerings obtain and keep certification. Providers remain accountable for the accuracy of their certification package even when a third party supplies the information.

• Defence contractors' systems must meet NIST SP 800-171.
• A cloud provider handling covered defence information must meet requirements equivalent to the FedRAMP Moderate baseline.
• "Rapidly report" a cyber incident means within 72 hours of discovery.

A monitoring provider working for such a contractor operates inside that reporting clock. State and local buyers may also ask about StateRAMP/GovRAMP, which is modeled on FedRAMP.

Attestations buyers request

SOC 2 is based on the AICPA Trust Services Criteria. It is an attestation built on an audit of controls, while FedRAMP is an authorization that requires ongoing monitoring. A SOC 2 report can take 6 to 12 months and needs 3 to 12 months of operational evidence.

Buyer checklists ask for an MSSP to complete an annual audit covering the security, availability and confidentiality of customer data. They also suggest requesting SOC 2 Type II or ISO 27001 for the provider.

Who the managed security service providers are

The groups follow what each vendor sells, not size or quality. Names within each group are in alphabetical order.

Monitoring, detection and response

• Blue Mantis: a coordinated program combining baseline protection, unified detection and response, threat hunting and GRC as a service.
• Cyderes: detection and response where analysts and agentic AI act with full environmental context.
• Forte Technologies: a bundle of managed detection and response, security awareness training and identity protection.
• Fortified Health Security: monitoring of extended detection and response telemetry across a healthcare client's environment.
• Integrity360 (Ireland): a set of managed detection services.
• Optiv (United States): monitoring and management of a customer's security stack, from basic monitoring up to a fully staffed security operations center.
• Orange Cyberdefense (France): managed security, threat detection and response delivered to organizations globally.
• Proximus NXT: round-the-clock monitoring and management covering governance, detection, response and operations.
• Trustwave: monitoring that detects, investigates and responds to threats in customer environments.
• UST: cloud-based security operations covering threat detection and response.

A specific function or technology

• Deutsche Telekom: an incident response team that contains and limits damage for the company and its customers.
• GuidePoint Security (United States): AppSec tooling expertise to identify vulnerabilities, with remediation recommendations.
• Infosys: management of user identities and access to enterprise systems.
• Leidos (United States): a tool that discovers, validates and prioritizes software vulnerabilities across mission-critical systems.
• Rackspace Technology: protection of web applications against breaches and threats.
• Tamnoon: investigation of exposure findings from a customer's CNAPP and EDR tools, then either a validated fix through the customer's change process or a declined fix with the reason attached.
• Telia: filtering of malicious traffic during a distributed denial-of-service attack.

Consulting and advisory alongside managed work

• Accenture (Ireland): consulting and services across prepare, protect, detect, respond and recover.
• Coalfire: advisory and engineering that build security into products and systems to help meet compliance requirements.
• Cybolt: consulting and technology for operational technology and industrial environments.
• Fujitsu: proactive cyber defense for systems, data and assets.
• Kudelski Security (Switzerland): consulting, technology engagements and managed security services.
• NCS: advisory and strategy services to mitigate cyber threats.
• NTT DATA: a service line for managing cyber risk and meeting regulatory requirements.
• SAIC (United States): processes, tools and services to adopt zero trust and keep missions running during cyber events.
• Wipro: strategy-first advisory and implementation through an integrated risk and security platform.

Broad service lines with little detail on record

Our record holds only a general description for these four. Readers should ask each one what it runs day to day.

• CISO Global: a platform described as providing real-time security intelligence.
• PwC: a managed cybersecurity service line within its professional services.
• Tata Consultancy Services: a service line within its enterprise technology and consulting portfolio.
• Vodafone: a managed service intended to make a business resilient against cyber threats.

How CISOs compare managed security service providers

Most buyers compare providers on the same eight points: coverage, delivery model, data custody, integrations, reporting, pricing model, contract terms and exit. The sources below supply specific checks for several of them. Where none do, what follows is common practice.

Evaluation criteria

Coverage and delivery model. Start with the statement of work. A provider's scope is set in a Statement of Work and can be co-managed or fully managed. In a co-managed split, the provider monitors, validates and escalates while internal IT handles remediation and response. Test what "24/7" covers, because some lower-tier offerings alert around the clock but do not respond or contain around the clock.

Data custody. Confirm data retention, chain of custody for investigations, and who owns the portal of record. CISA also tells customers to understand the access their provider has to their network and the data it houses.

Integrations and reporting. One vendor-written checklist asks for an ITSM tool for case management and workflow automation. It also asks for customization of use cases, reports, dashboards and escalation rules. Another guide looks for exportable reports on weekly, monthly and quarterly cycles, mapped to audit frameworks.

Pricing model. One provider says per-user licensing is the most common model in 2026, and notes that some providers price per endpoint instead. Ask which unit applies and how the price moves as headcount, devices and log volume grow.

Questions for a proof of concept

• Run a live alert through the full process. Who calls whom, and how long does each step take?
• Who is responsible for containing ransomware at 2:00 AM?
• Are remediation efforts included or billed hourly?
• Can your own analysts see the same case records and raw logs that the provider's analysts see?

What to check in the contract

• Service-level agreements are documented and enforceable.
• The contract allows for surge capacity, reasonable change control, an exit plan, and pricing without surprise overages.
• The exit terms say how logs, detection content and case history are returned to you, in what format and how quickly.
• The provider commits to removing its access at termination. This matches CISA's advice to identify and disable accounts no longer in use.

Have counsel review liability, termination and data clauses.

What changed for managed security service providers in 2025 and 2026

Federal cloud rules

FedRAMP officially launched its Consolidated Rules for 2026 on 24 June 2026. A provider may not seek both Rev5 and 20x certification for the same cloud service offering and must pick one. The rules also keep the provider accountable for the accuracy and completeness of its certification package when a third party, including an advisory service, supplies information on its behalf. This matters for MSSPs that prepare packages for clients or run monitoring inside an authorized cloud offering.

Defense contracting

The clause text itself is dated May 2024. It requires a contractor using an external cloud service provider for covered defense information to ensure security equivalent to the FedRAMP Moderate baseline. It defines rapid reporting as within 72 hours of discovery of a cyber incident. Defense contractors that hand monitoring to an MSSP still need to know who meets that clock.

Market research and pricing

ENISA published a 2025 analysis of the managed security services market. A Splunk explainer summarizing it says organizations rely on MSSPs mainly against malware, phishing and advanced persistent threats. A 2026 pricing guide from the provider Meriplex puts typical fees at $50 to $200+ per user per month. The same guide says cyber insurance carriers are tightening underwriting requirements. These are a seller's figures and claims, not audited data.

What the sources do not show

The pages given for this section record no acquisitions, public incidents or new evaluation rounds in the category for 2025 or 2026. We have not added any from outside them.