Cybersecurity has long been on the menu of managed service providers (MSPs). But as protecting IT assets grew into one of the most complicated and consequential risks facing modern businesses, what MSPs could offer wasn’t enough in many cases. Managed service providers focused specifically on cybersecurity (MSSPs) emerged as a result, promising to make their client’s digital defenses both manageable and formidable.
For the many companies struggling to handle cybersecurity, which is fast-moving, resource-intensive, and high-stakes, MSSPs are a lifesaver. They offer the benefits of robust cybersecurity without the costs of acquiring, implementing, and managing the technology and recruiting a security team or the daily challenge of handling security in-house. MSSPs level the playing field in cybersecurity. So it comes as no surprise that 70% of companies relied on a security service provider in recent years. In fact, Gartner predicts security services will be the largest single category of cybersecurity spending in 2023 – projected to top $75 billion.
Gaps in Service = Gaps in Security
Beneficial as outsourcing security responsibilities to MSSPs may be, the depth, breadth, and quality of service offerings vary considerably, from providers that “bolt on” a service or two all the way up to completely outsourced security.
Like any industry with strong and growing demand, the managed security services market has attracted many new providers. And while some are innovators bringing fresh perspectives and overdue improvements to the industry, many more offer basic, minimal, or similar services. Those offerings can be fine (even great) on their own – but many don’t come anywhere close to providing the comprehensive, seamless cybersecurity that drives clients to seek out an MSSP in the first place. If there are gaps in the service, there are gaps in the security too.
Before committing to any MSSP, it’s important to know where those gaps do or don’t exist. Bottom line – be choosy and vet thoroughly. Start with these five common shortcomings:
- Reaction – Traditionally, MSSPs focus on defensive cybersecurity through things like device monitoring, intrusion detection, and firewall management. Some newer innovators offer offensive cybersecurity services based around thinking like a hacker to find vulnerabilities and fix them before they get exploited. Most rare, however, are MSSPs that blend offensive (proactive) and defensive (reactive) measures to provide clients with complete 360-degree coverage of their security posture. One-sided service providers, no matter how exceptional they are, ignore half the equation, forcing in-house security teams and tools to pick up the slack or else leave the door open to attack.
- Relevance – MSSPs measure their efforts in terms of metrics like the number of attacks blocked or the amount of network uptime. But cybersecurity is no longer just an IT issue – it’s one that affects every part of a business for better or for worse. Therefore, cybersecurity strategies and performance must be measured in the context of business risk and measurable outcomes that will result in cyber risk mitigation. Most MSSPs are not aligned this way, they either can’t – or won’t – tie their security activities to specific business outcomes so that decision-makers (especially non-technical ones) understand how cyber risk impacts the organization. As a result, cybersecurity remains a liability that’s hard to monitor or manage even with the help of a typical MSSP.
- Resonance – Cybersecurity involves people, processes, and technology, and yet many providers are set up to provide just one or maybe two. Unfortunately, it takes an equal commitment to all three for cybersecurity to be effective in any way – a missing piece brings down the whole effort. Likewise, most MSSPs are laser-focused on abiding by SLAs, but that’s not sufficient for the dynamic threats and existential business risks that characterize today’s cybersecurity. Anything short of a true risk-reduction mentality that extends from the security team to the board of directors isn’t enough.
- Remediation – While MSSPs go to great lengths to see and stop incoming attacks, many are nowhere to be found when an attack takes hold and the hard and urgent work of remediation begins. Few MSSPs offer remediation services. And, when they do, those services are often limited to host containment or advising the client how to handle the remediation themselves, which may go wrong (or not happen at all) without having the necessary time, staff, and skills in-house. The frustrating fact is that many security services end exactly when clients need them most – in an emergency.
- Resolution – Even more unusual than providers that offer true remediation services are MSSPs that will resolve the underlying issue. After the fire is reported, the vast majority wash their hands. But that means whatever allowed the attack to take hold in the first place is still vulnerable, making a repeat of the same attack possible, even likely. Without resolution included in the service contract, the responsibility falls on the client, and many lack the resources to keep one-time problems from becoming reoccurring issues.
A Quality Service Provider = A True Security Partner
Taking a critical look at what most MSSPs offer uncovers alarming and unacceptable service and security gaps that undermine all the benefits those same MSSPs promise to deliver. And while providers without gaps are likened to a cybersecurity unicorn, they do exist.
Reveald is one of them. We started our firm with an acute understanding that cybersecurity involves fighting on many fronts in a coordinated way. Well-aware of the service gaps that exist at other providers and the risks these create for clients, our team set out to create a cybersecurity managed services firm that not only fills those gaps but provides a holistic cybersecurity solution (not just a service) for each of our clients.
By combining offensive plus defensive strategies, building services that extend from exposure management to detection, and moving beyond remediation all the way to resolution, Reveald offers what no other MSSP can – a seamless cybersecurity solution across the continuum designed to drive business outcomes and reduce cyber risk. Access world-class cybersecurity on-demand. Contact Reveald