MSP vs MSSP comes down to the job each is paid for. An MSP runs a client's everyday IT for a recurring fee. An MSSP runs security services, such as threat monitoring and incident response, often from a security operations center that runs nonstop. A business can use both.
The labels overlap. An MSP may offer cybersecurity services, alone or with other providers. So ask who watches for attacks, who answers at 2 a.m., and what the contract says.
We build SherpaDesk, a helpdesk and PSA (professional services automation) a small IT team can run alone. That puts us on the MSP side of this page, not the security side.
Key takeaways
Definition
A managed service provider (MSP) is a company that runs part or all of another organization's IT for a recurring fee, mostly remotely. A contract, usually a service level agreement (SLA), sets what is covered and the performance the client can expect.
MSPs typically manage infrastructure, support users, add cybersecurity software, manage access privileges, and support compliance and risk management. The client pays a flat fee on a schedule, often monthly, counted per device, per user, or as a bundle.
Hourly repair work is a different model, covered in Break/Fix vs. Managed Services.
Security is on that list, but not always at its center: not all MSPs offer security measures, and many have no major focus on cybersecurity. The full model is in What Is An MSP?
Definition
A managed security service provider (MSSP) is an outside company that runs specialized security services for its clients, such as remote firewall administration, threat monitoring, and incident response. They may be delivered from a security operations center (SOC) that runs nonstop, with analysts in shifts.
Day to day, a SOC team watches traffic, networks, endpoints, servers, and applications for signs of an incident. It works from raw data that firewalls, intrusion detection systems, and a security information and event management (SIEM) system collect. A SIEM is software that centralizes many types of logs in one place.
Companies without the staff or resources to run their own SOC can outsource some or all of it. Three options:
Tier 1 analysts triage alerts; threat hunters and incident responders take it from there. That bench of specialists, more than any tool, is what you pay for.
MSPs and MSSPs differ less in tools than in their job: one runs IT, the other watches for threats and acts as the contract allows.
| Question | MSP | MSSP |
|---|---|---|
| Main job | Run IT infrastructure and end-user systems | Run specialized security services |
| Operations center | Helpdesk; some also run a network operations center (NOC), whose staff are mostly network engineers | May use a security operations center (SOC) staffed by security analysts |
| What the team watches for | Uptime and user requests; a NOC handles performance, reliability, and availability | Signs of a potential or actual security incident |
| Hours | Whatever the SLA sets; after-hours only if contracted | As the contract sets; 24/7 if you buy that service |
| Core tools | RMM (remote monitoring and management) and PSA | SIEM, EDR (endpoint detection and response), intrusion detection |
| How it's priced | Flat fee per device, per user, all-inclusive, or tiered, often monthly | Recurring contract; an outsourced SOC can be sold as a subscription |
| What the contract should commit | Services bought and not bought, service levels, and which security duties it owns | Services bought and not bought, monitoring hours, response duties, and incident notice |
| Compliance support | Supports compliance and risk management | Security services a rule may call for, such as monitoring and response |
| Your role as the client | Own risk decisions and oversee the provider | Own risk decisions and oversee the provider |
Read it as two halves of one defense. Patching and configuration, usually MSP work, are a necessary part of it; monitoring and response are the other.
Neither label settles who does which security task. CISA tells customers to make sure the contract says whether the provider or the customer owns duties such as hardening, detection, and incident response.
The NIST Cybersecurity Framework (CSF) 2.0 gives a neutral grid: six functions, from Govern to Recover. NIST doesn't assign functions to providers. Here's one workable split; your contracts decide the real one.
| Function | What it covers | You (the client) | MSP | Security provider |
|---|---|---|---|---|
| Govern | Risk strategy, expectations, policy, and roles | Owns it: sets risk appetite, signs off policy | Advises | Advises |
| Identify | Understanding current risks, assets, and suppliers | Approves the risk list | Keeps the asset inventory | Assesses security risk |
| Protect | Safeguards: access control, training, data and platform security | Enforces training and access rules | Patching, MFA, backups, configuration | Security tool policy |
| Detect | Finding and analyzing possible attacks | Reports anything odd | Infrastructure alerts | Owns it: SOC monitoring |
| Respond | Containing, analyzing, and reporting incidents | Pre-authorizes containment; makes business calls | Isolates devices or disables accounts in its hours; fixes | Leads the investigation; contains out of hours if pre-authorized |
| Recover | Restoring affected assets and operations | Sets restore priorities | Restores systems and data | Helps verify the restore is safe |
Close the night gap first: who isolates an endpoint or disables an account when the MSP is off shift, and who approved it in advance. Our Managed Services Agreement guide covers the security clauses.
Answer all three questions before you decide.
The result: an IT gap only means an MSP. A security gap with in-house IT that works means an MSSP. Both gaps mean both, or one MSP with a security partner.
Example
Say you run a tax preparation firm. The FTC's Safeguards Rule covers tax preparation firms. Your Qualified Individual may work for a service provider, but you keep responsibility for compliance and name a senior person to oversee them.
You must regularly test or monitor your safeguards. With customer information concerning 5,000 or more consumers, use continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months. Assessments are also due after material changes or circumstances that may materially affect your security program. The rule ties continuous monitoring to detecting changes that may create vulnerabilities, which isn't the same as a SOC. Ask counsel whether a provider's service satisfies §314.4(d)(2).
If you need a roadmap and budget more than monitoring, that role is closer to a vCIO.
Subscribe to the SherpaDesk Blog.
Get Tips for Running IT With a Small Team.
Loading form…
The form couldn’t load. Please try again.
Or start your free trial →SHERPADESK · FREE TRIAL
Resolve tickets.
Turn time into revenue.
Bring support tickets, billable time, and invoicing into one place. Built for small IT teams and MSPs.
After your trial, keep your first agent free forever.
SHERPADESK · LIVE DEMO
See tickets, time,
and billing work together.
Walk through ticketing, time tracking, and billing with a product specialist. See how SherpaDesk fits the way your team works.
A live walkthrough tailored to your team.
Yes. An MSP may deliver cybersecurity services itself or together with other providers. For a small MSP, the staffing math decides which of three routes fits.
| Route | What you run | What the partner runs | Who answers at night |
|---|---|---|---|
| Resell security tools | Deployment, configuration, alerts in business hours | The software only | Nobody, unless you staff it |
| Partner with an MSSP or MDR provider | The client relationship, patching, hands-on fixes | Monitoring, investigation, response guidance | The partner, if you buy a 24/7 service |
| Build your own SOC | Everything, including a 24/7 analyst roster | Nothing | Your own shift |
The first route matches what MSPs typically do already: add cybersecurity software to clients' systems. The gap is the night. In one r/msp member's opinion, a part-time security service carries liability "through the roof since you aren't 24/7." Another asked: "who handles the breach when it happens?"
The third route is a staffing problem. One seat watched around the clock is 168 hours a week: 4.2 people working 40 hours, before leave. US information security analysts, a broad occupation, earned a median $129,180 in 2025, and may have to be on call outside business hours. Put your own numbers in.
Annual analyst wages
people × annual wage. Five is an example input. Default: BLS 2025 US median, information security analysts. Wages only: not a SOC budget or a 24/7 coverage check. Your numbers stay in the browser.
For a small shop, the second route is the practical one. You keep the client and the hands-on work; the partner covers nights if you buy a 24/7 service. One r/msp member put the order plainly. Compliance needs "a properly architected environment first, built with security in mind, that you start adding MSSP services on top of."
Partnering works when the handoffs are in writing. The first four steps come from CISA's joint advisory for MSPs and their customers; the fifth is ours.
CISA tells MSPs to explain the services a customer is buying, the services it isn't buying, and every contingency for incident response and recovery. Put the security partner's scope in the same document.
Contracts should say how and when the client is told about an incident in its environment. Decide whether the partner calls the client directly or calls you first.
MSPs should use MFA on every account that reaches customer environments and treat those accounts as privileged.
Incidents can go undetected for months, so the agencies behind the advisory recommend storing the most important logs for at least six months. Agree who keeps them: you, the client, or the partner.
The partner investigates; your technicians do the hands-on fix. Log each escalation as a ticket with a priority and an owner, and log the hours against it so billable work reaches the invoice.
Clients won't always ask for this. "I have never had a business owner ask about backups, cyber security, cloud servers, etc.," one r/msp member wrote; they want computers, email, and phones working. Another said running an MSP without security "is a disservice to clients". Their security focus made growth "a bit more difficult" but brought "great client retention".
How this works in SherpaDesk
You get a helpdesk and PSA a small IT team can run alone. When your partner's SOC escalates, forward the email to your support address with "FW:" in the subject, and it becomes a ticket. You become the ticket's user, so check it sits on the right client account before logging time. Give it a priority, and the ticket carries that priority's SLA response and completion goals.
Your technician logs the remediation hours on that ticket as billable or not. Uninvoiced time collects in "Ready to Invoice".
Base Camp is $45 per agent per month ($40 billed annually), and your first agent is free, forever, so three technicians pay $90 a month ($80 billed annually). No contract. No implementation project. No dedicated admin.
Who this isn't for
You get a helpdesk and PSA, not a SOC, a SIEM, an EDR tool, or an MDR service. Nothing in it watches your clients' networks for attacks, so pair it with the security partner you choose.
We don't build RMM. We integrate with yours, and the stack stays yours. The NinjaOne integration needs High Camp, $55 per agent per month.
Ask these before signing, not after the first incident.
MSSP stands for managed security service provider: an outside company that runs specialized security services for clients, such as remote firewall administration and other security-as-a-service offerings.
It may run monitoring and response from a SOC that works nonstop. See the Full Definition.
An MSP runs a client's IT infrastructure and end-user systems; an MSSP runs specialized security services. The MSP's team watches for outages and requests. A security provider's SOC, where it runs one, watches for threats, usually around the clock.
A business can use both. The Comparison Table sets them side by side.
MSP services cover the day-to-day IT a business would otherwise staff itself: infrastructure, user support, security software, access, and compliance support.
The client pays a flat fee on a schedule, often monthly. Our guide What Is An MSP? covers the model in full.
You need both when you have two gaps: nobody runs your IT, and nobody watches for attacks around the clock. A rule or a customer contract that sets security duties can decide it.
An MSP may deliver security together with a partner, so one contract can cover both. The Decision Path walks through it.
Yes. The practical route is partnering with an MSSP or MDR provider instead of building a SOC. A round-the-clock seat needs about 4.2 full-time people before leave, and US information security analysts earned a median $129,180 in 2025.
The MSP keeps the client and the hands-on work; the partner runs monitoring. See The Three Routes.
No. A SOC is a team and facility that monitors, analyzes, and protects an organization from cyberattacks. An MSSP is a company that may run one for you.
Most large organizations keep one in-house; others outsource some or all of it.
Patrick co-founded SherpaDesk and has led it as CEO since 2013. He has worked with IT service providers since 1998, first on network projects for schools and government offices, then on the helpdesk software their technicians use every day.