What Is a Managed Security Service Provider (MSSP)? Services, Pricing and How to Choose

Two quotes land on your desk. Same headline price, same list of tools, same "24/7 monitoring" line. One provider will lock a stolen account at 2am without calling you. The other will send an email to a shared inbox and wait until someone reads it at 9. Nothing in either proposal tells you which is which.

That's the real problem with buying managed security. So here's the answer first.

A managed security service provider (MSSP) is a company that monitors your systems for attackers around the clock and responds when it finds one, under a contract that says what it watches, what it's allowed to do, and how fast. It runs the security operations work most mid-sized firms can't staff themselves: log monitoring, threat detection, managed firewalls, vulnerability management and incident response. You pay monthly, usually per endpoint, per user or as a flat retainer.

That's what a managed security service provider is. The rest of this guide covers the parts vendor glossaries skip: what these services actually cost in 2026, the question that sorts providers faster than any feature list, the risks nobody lists, and the Canadian rules that change what you should ask for.

A note on where this comes from. We run managed security services for Canadian firms ourselves, so read this as a builder's view. We've also said plainly below when an MSSP is the wrong thing to buy.

What is a managed security service provider?

A managed security service provider is an outside team that does your security operations for you, continuously, on a subscription. Not a one-off audit. Not a firewall you bought from a reseller. An ongoing service, with people watching and a contract that says what happens when they see something.

Three things separate a real MSSP from a vendor who sells you security products:

• It's staffed 24/7. Attackers don't keep office hours, and they know yours. A business-hours watch covers 40 of the 168 hours in a week.
• It owns detection. The MSSP writes and tunes the rules that decide what counts as suspicious in your environment, then triages what fires.
• It has agreed authority to respond. Isolating a laptop, disabling an account, blocking an IP. What it can do without phoning you should be written down before go-live.

Take away the third and you've bought an alerting service. That's worth something. It just isn't the thing most buyers think they're paying for.

What is MSSP in cyber security, and what does MSSP mean?

In cyber security, MSSP stands for managed security service provider. Fortinet dates the first MSSPs to the late 1990s, when internet service providers started selling managed firewalls to business customers. Today the term covers any provider that runs security operations for you under contract.

One quirk worth knowing if you're searching in Canada: type the bare acronym into Google and you'll mostly get a comedy podcast. Google's own AI Overview asks which one you meant. Spell it out when you brief a board.

What are managed security services?

Managed security services are the individual security functions an MSSP runs for you. Most providers sell them as a bundle with a core of monitoring and response, plus add-ons. Here's what's usually on the menu, and what each one really means in practice.

Two services often get sold as "managed" that really aren't. Penetration testing is a point-in-time exercise, not a watch. Security awareness training is a programme your staff go through. Both are worth buying, and both sit beside managed security rather than inside it. We run penetration testing as its own engagement for that reason.

Not sure which of these you're already paying for? Our managed security services page lays out what we watch, what we're allowed to act on, and what the monthly review covers.

What does an MSSP do when an alert fires at 2am?

Definitions only get you so far. Here's what a working MSSP actually does, hour by hour, on a bad night.

Picture a 140-person accounting firm in Mississauga. It's a Saturday in tax season. At 2:14am the identity logs show the finance manager, Daniel, signing in from a country he's never been to, seconds after a sign-in from Toronto. Then a new mailbox rule appears, forwarding anything with "invoice" in the subject to an outside address.

A working MSSP handles it like this:

1. 2:14am, detection. A rule tuned to this firm's normal fires. Impossible travel plus a new forwarding rule is a known business email compromise pattern, so it goes straight to a human rather than a queue.
2. 2:21am, triage. An analyst checks the sign-in details, the device and the mailbox rule. It's not Daniel on a VPN. It's real.
3. 2:26am, containment. Using authority agreed in writing months earlier, the analyst kills Daniel's sessions, resets his credentials, removes the forwarding rule and blocks the sender domain.
4. 2:40am, notification. The on-call contact gets a phone call, not an email, with what happened and what's already been done.
5. Monday, follow-up. A short report: how the attacker got the password, which mail left the building, and whether anything triggers a privacy breach assessment.

A provider without response authority does steps 1 and 2, then emails the firm's shared inbox. The forwarding rule runs until Monday morning. That's two days of client invoices going to someone else, during tax season.

The tools in both versions can be identical. The difference is who's awake and what they're allowed to do.

MSSP vs MSP vs MDR: what's the difference?

These terms get used as if they mean the same thing. They don't, and two quotes can use different words for the same service, or the same word for very different ones.

The short version: an MSP keeps your IT running, an MSSP keeps attackers out. Many firms use both, and that's fine, as long as someone writes down who owns detection, who owns response and who owns the phone call to you.

If you already have an internal IT team and want an outside provider to cover nights and weekends only, that's a co-managed IT arrangement. It's common, and it works well when the handover rules are written down.

What does SOC as a service mean?

SOC as a service means renting a security operations centre instead of building one. A SOC is the team, tooling and process that watches your environment and responds to threats. As a service, you get the analysts, the SIEM and the shift coverage for a monthly fee, without hiring five people to cover nights.

The catch is in the word "service". Some SOC-as-a-service offers are a full managed SOC with response authority. Others are a monitoring desk that forwards alerts. The label doesn't tell you which. The contract does.

Where does managed detection and response fit?

Managed detection and response (MDR) is a narrower, deeper service focused on finding and containing active threats, usually starting from endpoint agents. Where a traditional MSSP might manage your firewalls and forward alerts, an MDR provider hunts for threats and contains them directly.

In 2026 the line has mostly blurred. Good MSSPs include MDR-style response, and most MDR providers have grown beyond endpoints into identity and cloud. So stop asking which label a provider uses. Ask what they do after the alert.

How much does a managed security service provider cost?

Most mid-sized organisations pay between US$5K and US$25K a month for a managed SOC, or roughly US$8 to US$25 per endpoint per month for a service that actually detects and responds. Those are 2026 market ranges published by US security firms, in US dollars. We haven't found a reliable Canadian-only dataset, so treat them as a starting point. Canadian quotes usually come in CAD, so convert before you compare, and ask whether Canadian log residency is in the price.

Here's how the published 2026 pricing breaks down by model:

Sources: BD Emerson, "SOC as a Service Pricing in 2026", published 2026-07-18; Meriplex, "How Much Do Managed Security Services Cost in 2026?". Meriplex puts full-scope managed security at US$4K to US$12K a month for 50 to 100 users, and US$8K to US$30K for 100 to 250.

What moves the number inside every model comes down to five things:

• Log volume. SIEM costs scale with how much data you send, often priced per GB.
• Coverage hours. True 24/7 human coverage costs more than business hours plus automation.
• Scope. Endpoints only, or endpoints plus identity, cloud, email and firewalls.
• Response depth. Notification only, guided response, or full containment.
• Compliance reporting. Audit-ready evidence for SOC 2, PIPEDA or sector rules adds work.

For scale, the average Canadian data breach cost a record CA$7.11M in 2026 and took 205 days to find and contain, according to IBM's 2026 Cost of a Data Breach report. Organisations using AI in their security operations detected breaches in 124 days and contained them in 57, against 154 and 71 for those without. Speed is most of what you're paying an MSSP for.

Now the in-house comparison. Covering 24 hours, seven days a week, with sick days and holidays, takes at least five analysts. BD Emerson puts a minimal round-the-clock internal SOC at over US$1M a year in salaries alone, before any tooling. That's why most firms under 1,000 staff buy this rather than build it.

Why do two MSSP quotes at the same price differ?

Because the headline price almost never shows response authority. Two providers can both quote US$15 per endpoint. One contains threats. The other forwards alerts. The difference only shows up at 2am.

Ask each provider to put three things in writing: what they'll do without calling you, how fast they'll do it, and what happens if they miss that window. The answers usually explain the price gap better than the feature list does.

How much does a managed service provider cost next to an MSSP?

A general MSP is usually priced per user or per device for IT operations, and a security add-on from that MSP is often cheaper than a dedicated MSSP. That's fine for basic hygiene: antivirus, MFA, patching. It's not the same as a staffed security operations function, and the price gap usually reflects that.

Want a number for your environment instead of a range? Book a 30-minute call and we'll map what you'd actually need to monitor, and what we'd be allowed to act on, before anyone talks price.

What are the risks of using an MSP or MSSP?

Outsourcing security doesn't outsource the risk. The Canadian Centre for Cyber Security says it directly in its guidance for buyers of managed services: protecting your information remains your responsibility, even when a provider runs the technology.

Here are the risks we see most, roughly in order of how often they bite.

1. The provider becomes the way in. An MSP or MSSP holds admin access to dozens of clients at once. That makes it a prize target, and the Cyber Centre has published a specific warning about attackers going after managed service providers for exactly that reason. IBM's 2026 Cost of a Data Breach report found supply-chain compromise added CA$367,899 to the average Canadian breach. Ask how the provider protects its own admin accounts, not just yours.

2. Alerts with nobody to act on them. The most common failure isn't a missed detection. It's a real detection buried in a queue of 400 false positives, or sent to an inbox nobody checks on weekends.

3. Coverage gaps nobody told you about. If the cloud tenant, the firewall or the backup server isn't sending logs, the MSSP can't see it. Good providers show you a coverage map, including the gaps. Weak ones let you assume.

4. Lock-in through the logs. If the provider owns the SIEM and the detection rules, leaving can mean losing a year of history. Agree in the contract who owns the logs, the rules and the documentation, and how they come back to you when it ends.

5. Data leaving the country. Security logs are full of personal information: names, email addresses, IP addresses, sometimes message content. If they're stored outside Canada, they're subject to other countries' laws. The Cyber Centre recommends keeping sensitive data inside Canada's borders.

6. Unclear responsibility. When a breach happens, who calls the insurer, the privacy regulator, the affected clients? If the contract doesn't say, you'll work it out in the middle of an incident.

None of these are reasons to avoid an MSSP. They're reasons to read the contract before you sign it.

Which Canadian rules change what you need from an MSSP?

This is the part almost every guide on page one skips, including the Canadian ones. Your MSSP will often be the first to know about a breach, and Canadian law puts clocks and record-keeping duties on you from that moment.

PIPEDA (federal private sector privacy law). If a breach creates a real risk of significant harm, you must report it to the Privacy Commissioner and notify affected people as soon as feasible. You must also keep a record of every breach for 24 months, whether or not it was reportable, according to the Office of the Privacy Commissioner. Your MSSP's incident reports are the raw material for those records. Ask for them in a format you can file. We cover the details on our PIPEDA compliance page.

Quebec Law 25. If you handle personal information about people in Quebec, confidentiality incidents with a risk of serious injury must be reported to the Commission d'accès à l'information and the affected people. Every incident goes into a register you keep for at least five years. Penal fines reach $25M or 4% of worldwide turnover, according to Osler's summary of the enforcement regime. See our Quebec Law 25 compliance page for what that means day to day.

Bill C-8, the Critical Cyber Systems Protection Act. It received royal assent on 2026-06-15 and applies to designated operators in finance, telecommunications, energy and transportation, according to Public Safety Canada. It's coming into force in phases. If you're in one of those sectors, or you supply one, your incident reporting has to be fast and well documented, and your MSSP's playbook needs to match. Our Bill C-8 and CCSPA page tracks what's in force.

Your suppliers' rules become yours. If a large client asks you to fill in a security questionnaire, it usually asks who monitors your environment outside business hours. A third-party risk review works both ways: you'll assess your MSSP, and your clients will assess you.

How do you choose the best managed security service provider?

There's no single best managed security service provider. There's the best fit for your size, your stack and your rules. Rankings and "top 10 MSSP" lists measure marketing reach, not whether a provider will act at 2am in your environment.

Instead, ask these eight questions. The first is the one that matters most.

1. At 3am on a Sunday, what can you do without calling us? Look for specific actions (isolate a host, disable an account, block an IP), agreed in writing before go-live. "We'll notify you" is not an answer.
2. What do you watch, and what can't you see? Ask for a coverage map that shows the gaps, not just the list of sources.
3. Where do our logs live, and who can access them? Canadian data residency, named admin locations, and separate privileged accounts, as the Cyber Centre recommends.
4. Who writes the detection rules, and how often are they tuned? Vendor default rule packs are a starting point. Ask how they tune to your normal and how they track false positives.
5. What does the monthly report measure? Alert counts show how busy they were. Look for time to contain, false-positive rate and the coverage gaps they've closed.
6. How do you protect your own access to our systems? MFA on every admin account, privileged access tooling, and a clear answer on subcontractors.
7. What happens to our data, rules and history if we leave? Get the exit terms in the contract, including format and timeline.
8. Can you work with the tools we already have? A good provider can usually work with your existing firewalls, endpoint agents or Microsoft security stack rather than forcing a rip-and-replace.

Here's how that plays out. Consider a 300-person logistics company in Laval. Its first MSSP answered question 1 with "our analysts will escalate to your team." In year two a compromised VPN account sat active for 31 hours over a long weekend, because the escalation went to an IT manager on holiday. When the company went back out to market, it put all eight questions into the RFP. Two of the five bidders couldn't answer question 1 in writing. That cut the shortlist before anyone looked at price.

When is an MSSP the wrong purchase?

Sometimes the honest answer is "not yet". An MSSP probably isn't the right first step if:

• You haven't got basics in place. No MFA, no patching, flat network, untested backups. Monitoring an environment like that mostly produces alerts about problems you already know you have. Fix the foundations first, starting with network segmentation and tested backup and recovery.
• You don't know what you're protecting. If you can't say which systems hold the sensitive data, start with a threat and risk assessment. It'll tell you what an MSSP should watch first.
• You need a one-off answer. If a client or insurer wants proof of testing, a penetration test may be what's actually being asked for.

A lot of firms get more from fixing the network design than from watching a weak one.

Should you build your own SOC team instead?

For most firms under 1,000 staff, no, at least not for 24/7 coverage. The numbers above explain the cost. The staffing problem is worse.

The ISC2 2025 Cybersecurity Workforce Study found 59% of security teams report critical or significant skills gaps, up from 44% in 2024, and 95% have at least one. IBM's 2026 report put the cost of a security skills shortage at an extra CA$314,500 per Canadian breach. Hiring five analysts is hard. Keeping them on night shifts is harder.

What does work well is a co-managed model. The MSSP covers nights, weekends and the tooling. Your in-house security engineer owns the context: which systems matter, what normal looks like, and which alerts need a business decision. In our experience it's the setup that works most often at mid-market size, and it gets better the more your own people understand the tools.

Bottom line

A managed security service provider watches for attackers 24/7 and responds when it finds one. That's the job. Everything else is detail.

What to take away:

• The label doesn't matter. The authority does. MSSP, MDR, SOC as a service: ask what they'll do at 3am without calling you, and get it in writing.
• Budget realistically. Most mid-market firms land between US$5K and US$25K a month, or US$8 to US$25 per endpoint for real detection and response.
• Read the contract for the risks. Admin access, log ownership, data residency and exit terms are where things go wrong.
• Canadian law adds clocks. PIPEDA, Law 25 and Bill C-8 all shape what your provider's incident reports need to contain.

If you're comparing providers now, start with question one from the list above and see who answers it straight.

Want to hear our answer to the 3am question for your environment? Our managed security services team will walk you through the coverage map and the response authority we'd sign up to, in writing, before any pricing conversation. Book a call with an architect.