A managed security services provider (MSSP) runs your security program for you: it deploys and configures the controls, monitors them around the clock, responds when something fires, and produces the evidence you hand to an auditor, an insurer, or a client’s security questionnaire. The difference from a managed service provider (MSP) is scope. An MSP keeps your technology working. An MSSP is accountable for keeping it defended.

Be Structured is both, which is why most of our Los Angeles clients buy one relationship instead of two.

Los Angeles based since 2007 · Channel Futures MSP 501 ranked · CA License #1140088

What does an MSSP actually do?

Four functions, in this order:

Implement. Put the controls in place and configure them properly. Most environments we inherit have licensed capability nobody turned on.

Monitor. Watch the output continuously, including nights and weekends. Anomalies generate a prioritized ticket within 60 seconds of detection.

Respond. Act on the alerts that are real, with containment authority agreed in writing in advance so nobody is waiting on a decision at 2 a.m.

Evidence. Produce the logs, reports and documentation that prove the first three happened.

Our MSSP work covers the implementation, configuration and supervision of the following, on top of our all-inclusive managed services:

Alongside those controls, the ongoing service covers management of all security systems, log monitoring, device management, solution research and implementation, audits and reports, consultancy, security updates, and protection for remote workers.

We also run controls most providers leave out: penetration testing services, advanced endpoint protection, privileged access management, endpoint detection and response, and zero trust network architecture.

MSP vs. MSSP: what actually changes

The clue is the extra S. An MSP includes security as part of a general package. An MSSP is organized around it: an MSP typically runs a network operations center to keep systems available, while an MSSP runs a security operations center to keep them defended. Different queue, different skill set, different definition of a good day.

MSP MSSP
Primary goal Keep technology working Keep technology defended
Core function Network operations center Security operations center
Typical alert A server is down An account signed in from two countries in an hour
Deliverable to a third party Uptime reporting Compliance and incident evidence
Who asks for it Your staff Your insurer, your auditor, your clients

Be Structured is both an MSP and an MSSP. If you need both, everything stays under one roof and there is no argument about whose ticket it is.

Who needs an MSSP, and who is better served by an MSP alone?

You need the MSSP layer if you hold regulated data (healthcare, financial services, legal, taxpayer records), if clients or prime contractors send you security questionnaires, if you are renewing cyber insurance and the application asks about 24/7 monitoring and incident response, or if you have already had an incident and need to demonstrate that something changed.

Managed IT alone is enough if you are a small team on cloud-only tools with no servers, no regulated data, and no third party auditing you. Buy multi-factor authentication, managed endpoint protection and tested backups, and revisit when one of those conditions changes.

We would rather tell you that at the scoping call than sell you a security program you do not need yet.

What does an MSSP cost compared with hiring security staff?

Be Structured prices managed security per device, commonly $50 per device per month for the full stack: EDR with 24/7 SOC monitoring, multi-factor authentication, Windows Defender hardening and LAPS, spam and outbound email filtering, SPF, DKIM and DMARC management, dark web monitoring, quarterly internal and external vulnerability scanning, and Microsoft 365 backup with disaster recovery. Managed IT sits underneath at $125 to $300 per user per month depending on headcount and coverage depth. Project work outside the recurring scope is quoted in advance. The full breakdown is on our managed IT services cost page.

The hiring comparison is not one salary against one subscription. Round-the-clock coverage is 168 hours a week, which is 4.2 full-time people before anyone takes a vacation day, and security specialists in Los Angeles do not come at general IT rates. Below a few hundred employees the arithmetic rarely favors building it.

The subscription model also scales in both directions. Because it follows a per user and per device model, adding seasonal staff or pulling back after a project is a line change, not a hiring decision.

What changes on day one?

  1. Assessment. We count users, devices and servers, review your Microsoft 365 tenant and current security posture, and give you a written scope and a fixed monthly price before you commit.
  2. Deployment. Agents and monitoring go on every endpoint and server, usually inside one business day, with no disruption to your team.
  3. Escalation agreement. We agree in writing who we call at 2 a.m., and what we are pre-authorized to do without asking: isolate a host, disable an account, block an address.
  4. The first report. Within the first month you get a written picture of what is actually happening on your network, which is usually the first time anyone has looked.

Response commitments are in the service level agreement, not in the brochure. Ours documents response times by severity and what happens if a breach occurs.

How to evaluate an MSSP

  1. Ask what they do after hours, specifically. A dashboard is not a SOC. Ask for a target time to first human touch on a critical alert.
  2. Ask for the containment authority in writing. What can they do without you, at what severity.
  3. Ask what is included and what is billed separately. Penetration testing, compliance assessments and incident response hours are common carve-outs. Get the list before you compare two quotes.
  4. Ask for a sample monthly report. If you cannot read it, you will not read it.
  5. Ask about the compliance role. A good answer sounds like “we help you meet the requirements and document the controls; we are not the certifying body.” An answer that promises certification is a warning.
  6. Ask what happens on exit. Your log history, your agent licensing, and your documentation should not be hostage to a renewal.

Your Los Angeles MSSP

Be Structured has supported Los Angeles businesses since 2007 from 500 S. Grand Avenue, 22nd Floor, in Downtown LA, alongside the surrounding cities. We tailor security by industry, whether that is healthcare or the extra requirements financial services carry, and our other managed IT services in Los Angeles run from cloud migration to hardware installation under the same agreement. If you are weighing us against another provider, our page on outsourced IT support services lays out what the engagement includes.

➤ Get Your Free IT Assessment: contact Be Structured for a no-cost scoping assessment and a fixed monthly price, or call (323) 331-9452.

Frequently Asked Questions About Managed Security Services

What does a managed security services provider (MSSP) do?
An MSSP runs your security program: it implements and configures the controls, monitors them around the clock, responds to real alerts under a containment authority agreed in advance, and produces the evidence you hand to an auditor, an insurer, or a client’s security questionnaire. The controls typically include firewalls, SIEM, endpoint detection and response, email security, identity and access management, multi-factor authentication, and vulnerability scanning.

What is the difference between an MSP and an MSSP?
An MSP keeps your technology working and typically runs a network operations center. An MSSP keeps it defended and runs a security operations center. An MSP’s alert is that a server is down; an MSSP’s alert is that an account signed in from two countries in an hour. Be Structured is both, so clients who need both keep everything under one agreement.

Do we need an MSSP, or is managed IT enough?
You need the MSSP layer if you hold regulated data, if clients or prime contractors send you security questionnaires, if your cyber insurance application asks about 24/7 monitoring and incident response, or if you have already had an incident. Managed IT alone is enough for a small cloud-only team with no servers, no regulated data and no third party auditing them. In that case buy multi-factor authentication, managed endpoint protection and tested backups first.

How much does an MSSP cost?
Be Structured prices managed security per device, commonly $50 per device per month for the full stack, which includes EDR with 24/7 SOC monitoring, multi-factor authentication, Windows hardening, email filtering, dark web monitoring, quarterly internal and external vulnerability scanning, and Microsoft 365 backup with disaster recovery. Managed IT sits underneath at $125 to $300 per user per month. Project work outside the recurring scope is quoted in advance.

Is an MSSP cheaper than hiring security staff?
Below a few hundred employees, usually yes, and the reason is arithmetic rather than salary comparison. Round-the-clock coverage is 168 hours a week, which is 4.2 full-time people before anyone takes vacation, and security specialists do not come at general IT rates in Los Angeles. The subscription also scales down again when a project ends, which a hire does not.

Can an MSSP work alongside our existing IT team?
Yes, and that is a common arrangement. Your team keeps the help desk and its admin rights; the MSSP takes the security queue, the monitoring, and the evidence. What has to be settled in writing at the start is escalation: who gets called at what severity, and what the provider is pre-authorized to do without asking.

What does an MSSP do about compliance?
It produces the technical safeguards and the documentation that HIPAA, PCI DSS, CMMC and the FTC Safeguards Rule ask for: access controls, encryption, multi-factor authentication, continuous monitoring and logging, tested backups, and a written record of what is actually in place. To be clear about the role: we help you meet the requirements and document the controls. We are not a certifying body or an auditor.

How fast does an MSSP respond to an incident?
Monitoring generates a prioritized ticket within 60 seconds of detecting an anomaly, and critical incidents escalate immediately to an on-call engineer regardless of the hour. Our Network Operations Center triages after-hours issues in about 10 minutes, and when hands are needed on a device we reach most of the Los Angeles area in roughly 30 minutes. Response times by severity are documented in the service level agreement, not left to a general availability claim.

What should we ask an MSSP before signing?
What happens after hours, with a target time to first human touch on a critical alert. What containment they are pre-authorized to perform without calling you. What is included and what is billed separately, since penetration testing, compliance assessments and incident response hours are common carve-outs. Whether you can see a sample monthly report. How they describe their compliance role. And what happens to your log history and documentation if you leave.

How does an MSP work day to day?
It acts as your IT department while working mostly remotely: monitoring your network around the clock, patching and maintaining systems, running the help desk, managing backups and data recovery, and handling network and infrastructure support. The point of the model is that prevention is the provider’s job, so problems get caught before a user reports them.