An MSP (managed service provider) runs your IT: help desk, devices, Microsoft 365 or Google Workspace, networks and patching. An MSSP (managed security service provider) runs your security: monitoring, email and endpoint protection, vulnerability management and compliance. MDR (managed detection and response) is a specific security service: 24/7 threat detection with analysts who investigate and contain attacks. Growing companies usually need IT and security together, with MDR as the core of the security layer.
Side-by-side comparison
| MSP | MSSP | MDR | |
|---|---|---|---|
| Main job | Keep IT running | Keep the organisation secure | Detect and stop active threats |
| Typical services | Help desk, user and device management, patching, backups, networks, M365/Google admin | Security monitoring, email security, EDR, vulnerability scanning, awareness training, dark-web monitoring, compliance support | 24/7 monitoring of endpoint, identity and cloud telemetry; threat hunting; investigation; containment |
| Who they talk to | Employees with IT issues | IT lead, leadership, auditors | Your security owner, during incidents |
| Measured by | Ticket response and resolution times, uptime | Risk reduction, control coverage, audit outcomes | Time to detect, time to contain |
| Gap if used alone | Security often limited to "antivirus and backups" | May not fix the IT hygiene that causes incidents | Detects attacks, but doesn't manage IT or governance |
How to choose
- No internal IT team: you need an MSP that builds security in from day one, not as an upsell. At Defensible this is the Standard or Premium MSP tier.
- Internal IT team, no security team: you need an MSSP layered over your IT, often called co-managed. This is our MSSP Only tier.
- Regulated, or selling to enterprise: add 24/7 MDR and a vCISO who owns the program and answers auditors and customers.
- Recent incident or near miss: start with a compromise assessment, then put MDR in place.
Why the split causes incidents
Many breaches we investigate happen in the gap between providers. The MSP thinks security owns the alert; the security vendor thinks IT owns the misconfiguration. Typical examples are a disabled EDR agent nobody notices, an MFA exception added "temporarily" and never removed, or a firewall rule opened for a vendor years ago. That's why Defensible runs IT, security and incident response under one owner. See why we built it that way.
Questions to ask any provider
- Who is accountable when an alert fires at 2 a.m. on a Saturday, and what happens next?
- Do your analysts contain threats (isolate a device, disable an account), or only notify us?
- What baseline controls are included in every plan (MFA, EDR, email security, backups)?
- How do you handle incident response if a breach happens, and is it in-house or outsourced?
- Which compliance frameworks do you support with evidence, not just advice?
How pricing usually works
| Model | Common pricing basis | What to check |
|---|---|---|
| MSP | Per user per month (sometimes per device), with projects billed separately | Is after-hours support included? Are onboarding and projects extra? Which security tools are bundled? |
| MSSP | Per user or per endpoint per month, plus platform fees for tools such as SIEM | What's monitored (endpoint, identity, email, cloud)? Who responds? Are compliance reports included? |
| MDR | Per endpoint or per user per month; sometimes by data volume ingested | Response actions included, mean time to respond, threat-hunting frequency, IR hours |
For reference, Defensible publishes its entry tier: Standard MSP at $150 per user per month, which includes 24x7 help desk, device and patch management, endpoint and email security, security monitoring and awareness training. See the full plan comparison.
Signs you've outgrown your current provider
- Customers or auditors ask security questions your provider can't answer.
- Security alerts go to an inbox nobody watches at night or on weekends.
- Your provider recommends tools but no one owns the risk decisions.
- Incident response would be "call someone else".
- Your headcount, offices or cloud footprint have doubled since you signed.
Our guide to switching MSPs without disruption covers how to transition safely.
Where a vCISO fits
MSPs, MSSPs and MDR providers run operations. A vCISO owns the strategy: setting risk tolerance, choosing frameworks, reporting to the board, answering auditors and enterprise buyers, and directing the providers. Many growing companies need a managed provider for execution and a vCISO for accountability.
Frequently Asked Questions
Is an MSSP the same as MDR?
No. MDR is one service, focused on detection and response. An MSSP usually offers a broader set of managed security services, which may include MDR.
Can one company be both an MSP and an MSSP?
Yes. Some providers, including Defensible, deliver managed IT and managed security as one integrated program.
Do small businesses need MDR?
Most attacks on small businesses happen outside office hours. If no one is watching alerts 24/7, MDR is the most direct way to close that gap.
What is co-managed IT?
An arrangement where your internal IT team keeps some responsibilities and a provider handles others, typically security monitoring, after-hours support or specialist projects.
Not sure which model fits? Compare Defensible's Standard MSP, Premium MSP and MSSP Only plans, or talk to us about a co-managed setup. See Pricing.
