MSSP vs MDR: which do you need?

Two definitions

Managed detection and response (MDR) is a service in which a security operations centre watches your security telemetry around the clock, investigates suspicious activity, hunts for hidden threats and takes agreed response actions, such as isolating a device or disabling an account. Many of the best-known MDR services are run by security vendors on their own platforms: Sophos MDR, Check Point MDR, CrowdStrike Falcon Complete Next-Gen MDR and WatchGuard MDR, for example. For a full explanation of how MDR works, see our guide to managed detection and response on Cloud Security.

A managed security service provider (MSSP) is a provider that takes responsibility for running some or all of your security. That can include MDR, but also the management of endpoint, email, firewall and identity tools, vulnerability management, SIEM and log retention, incident response arrangements and compliance reporting. See what is an MSSP? for the full definition.

MSSP vs MDR compared

Why the line has blurred

The two terms grew up separately. Early MSSPs were often log-monitoring and device-management services: they watched firewall and server logs and forwarded alerts to the customer, who was left to decide what to do. MDR emerged as a response to that model. Its promise was that analysts would not just notify you, they would investigate and act.

Today the line is less clear. Many MSSPs deliver MDR, and many MDR services have grown to cover identity, email, cloud and network data, which is sometimes called managed XDR. If you are comparing offers, ignore the label and look at what is actually included: who watches, what they can see, what they are allowed to do, and what else the provider manages around it. Our managed XDR page covers the cross-layer services, and MDR vs SOC vs SIEM separates the service, the team and the tool.

MSP vs MSSP vs MDR

If you are also weighing up your IT provider, this is how the three relate:

For the IT side of the comparison, see MSSP vs MSP.

How we combine vendor MDR with MSSP management

Forever Systems does not run its own SOC. Instead, we put a vendor MDR service at the centre and manage everything around it:

1. Choose the MDR service. We recommend one that fits your tools and size, for example Sophos MDR, Check Point MDR, WatchGuard MDR, Blackpoint, CrowdStrike Falcon Complete Next-Gen MDR, SentinelOne Vigilance, Todyl MXDR, ThreatDown MDR or Acronis MDR.
2. Set the response authority. Each service lets you decide how much the analysts can do without asking. Sophos MDR, for example, offers Authorize, Collaborate and Notify Only modes. We help you pick a level you are comfortable with.
3. Connect the right data. Agents, Microsoft 365, identity, firewall and email integrations decide what the SOC can see. We deploy and connect them, and check coverage.
4. Write the escalation runbook. Who the SOC contacts, in what order, and what happens when they cannot reach anyone. We act as an escalation point alongside your named contacts.
5. Manage the rest of your security. Email, firewall, identity and vulnerability management sit outside many MDR services; we can manage those too.
6. Review and improve. Regular reviews of incidents, coverage gaps and recommendations, with changes made through us.

The split of responsibilities is written down and confirmed at quote. You get the depth of a vendor SOC and one provider who knows your environment.

What an MDR service usually leaves to someone else

MDR services are deliberately focused. That focus is their strength, but it leaves a set of jobs that someone still has to own. Depending on the service and tier, these are commonly outside MDR:

• Firewall management: rule changes, firmware updates, VPN and web filtering policy; see managed firewall
• Email security administration: quarantine release requests, policy tuning, phishing report handling and domain authentication; see managed email security
• Patching and vulnerability remediation: the MDR team may flag a weakness, but fixing it is usually your job or your provider's; see vulnerability management
• Long-term log retention: many MDR services keep telemetry for a limited period, which may not satisfy auditors or investigators; see SIEM as a service
• Full incident response: some tiers contain the threat and hand over, leaving investigation and recovery to a retainer; see incident response retainers
• Compliance evidence: mapping what the service does to ISO 27001, the DSPT or FCA rules; see UK cyber security compliance

This is where the MSSP part of the arrangement earns its keep: making sure each of these has an owner, so nothing falls between the vendor's SOC and your team.

Which do you need?

Start from the problem rather than the label. If the worry is an attack that starts at night and has spread by the morning, the answer centres on MDR. If the worry is that nobody has the time to look after the firewall, the email filter and the endpoint policies, the answer centres on management. Most organisations have both worries, which is why the two are so often bought together. A few common situations:

• You mainly need someone watching at night: an MDR service, set up and managed properly, is likely to be the core of what you need
• You need the controls themselves looked after: firewall rules, email quarantine, endpoint policy and patching are MSSP work, alongside or instead of MDR
• You have a capable IT team: a co-managed arrangement keeps your team in control; see co-managed SOC
• You need long log retention or compliance reporting: add SIEM as a service, which many MDR services do not include by default; see SIEM as a service
• You run Microsoft Defender already: an MDR service that works on Defender may avoid replacing your agents; see MDR for Microsoft Defender

If you are still deciding which tools you need underneath, the guide EDR vs XDR vs MDR explains how they fit together. Or contact us and we will suggest a starting point.