Managed security services defined
Managed security services (MSS) is an umbrella term used to describe any cybersecurity service or solution offered by a third-party provider or managed security service provider (MSSP).
MSS offerings run the full gamut of cybersecurity, encompassing everything from baseline system monitoring to comprehensive SOC as a service (SOCaaS) offerings that fully manage a customer’s entire security function.
Importance of managed security
Managed security has emerged as a practical approach for understaffed security teams to rapidly build, maintain, and scale a strong cybersecurity function in a fast-paced and ever-evolving landscape. Organizations increasingly rely on MSS offerings to support some, or all, of their cybersecurity needs because of the following:
The increasing number of adversaries
The CrowdStrike 2023 Global Threat Report revealed that there are more than 200 adversaries actively attacking organizations around the globe. Perhaps more importantly, these actors are relying on a variety of techniques and methods to carry out their attacks.
The CrowdStrike 2023 Threat Hunting Report showed a 583% increase in Kerberoasting attacks — highlighting the growing use of identity-based intrusions — and a 3x spike in adversary use of legitimate remote monitoring and management (RMM) tools.
At the same time, attackers are getting faster, with the average eCrime breakout time hitting a new low of 79 minutes.
These stats underscore the idea that organizations need to be able to defend against a wide range of attacks, monitor every endpoint continuously, and respond quickly if and when an attack occurs.
The cost of a data breach
In addition to facing an ever-growing array of threats, companies are also being saddled with high recovery costs in the event of an attack.
The IBM Cost of a Data Breach Report 2023 found that the average cost of a data breach was $4.45 million globally. In the United States, the average was $9.44 million in 2022, more than double the global average.
At a time when margins in many industries are razor thin, bearing the cost of a breach could create significant financial hardship or possibly jeopardize the organization’s future.
The rise of remote working, which requires more cyber protection
For most organizations, their IT environment has become far more complex in recent years. The sudden rise in remote work, spurred in part by the COVID-19 pandemic, resulted in a huge influx of personal devices and the use of personal networks.
As a result of this shift, companies needed to develop a more comprehensive approach to cybersecurity, targeting protection of user identities, devices, and networks.
Part of the appeal of MSS is that companies can leverage turnkey solutions to quickly deploy detection and prevention tools across any device or network without relying on employees to download software or even restart their devices.
The cybersecurity skills gap
Cybersecurity skills have been in short supply for years, and this global skills gap keeps getting worse, not better. In fact, the latest ISC2 report found that there’s currently a global shortage of 4 million security workers.
Needless to say, it’s more difficult than ever for security leaders to hire, train, and retain security talent to staff their programs and run their SOCs.
24/7 security coverage is essential to defend against today’s advanced, opportunistic adversaries and keep them at bay — especially since attackers increasingly aim to strike organizations during off-hours, weekends, and holidays when security teams are likely to be stretched to their thinnest.
MSS offerings solve these challenges for organizations by providing organizations with the skilled cybersecurity professionals they desperately need without the costs or hassle of doing it on their own.
Benefits of managed security
In addition to addressing a number of landscape challenges, managed security also offers organizations many important benefits. These include:
Fully managed cybersecurity services
The premise of MSS is that all cybersecurity services are fully managed by the MSSP. This means that internal IT teams, many of which are not skilled in cybersecurity, can focus their efforts elsewhere in the business. At the same time, the company enjoys strong prevention, detection, response, and remediation capabilities, depending on the terms of their agreement.
Access to cybersecurity expert knowledge
MSSPs employ some of the best and brightest minds in the cybersecurity field. When companies partner with these third-party organizations, they gain access to specific solutions and tools as well as the expertise and knowledge of their staff. This helps protect the organization in the immediate term while potentially building cybersecurity skills among the company’s broader IT team over time.
Data protection
MSSPs offer advanced data solutions — which protect data from breaches, theft, modification or destruction (a set of services commonly referred to as data security) — and develop the underlying policies, procedures, and technologies to ensure its lawful and ethical use (data protection).
Data protection also involves compliance with privacy laws, data minimization, obtaining consent for data processing, and giving individuals control over their data.
Optimal security tool management
Just as adversaries and threats evolve, so does cybersecurity technology. MSSPs often provide their own suite of tools and related expertise to protect an organization, with recommendations for the best and latest software to invest in based on a customer’s unique needs.
Regulatory compliance
Most MSSPs also offer guidance on relevant regulations and the specific steps companies must take to comply with applicable laws. They may also support reporting requirements and submit additional documentation in the event of an investigation.
Reduced IT cost
Though managed security constitutes a third-party expense, this model is typically more cost-effective than establishing a comparable internal capability, which requires continuous 24/7 staffing and the purchase of a tool set and corresponding licenses.
In addition, engaging a trusted and reputable MSSP is a form of insurance against costly and disruptive data breaches. Though no solution is perfect, working with a competent vendor is one of the best ways to reduce the overall risk of falling victim to an attack and improve the likelihood of detecting a breach before significant damage is done.
Types of managed security services
Within the overarching managed security services category, there are many different approaches, offerings, and delivery models — and a variety of service providers who provide these capabilities to organizations.
We detail several of the most common types of MSS models and providers below:
Managed service providers
Managed service providers (MSPs) deliver IT services and are primarily focused on administration and business efficiency. Though they can provide security services, their primary focus is on the management of an organization’s infrastructure and IT systems for day-to-day business operations.
Managed security service providers
Managed security service providers are IT service providers that offer cybersecurity expertise in a continual service delivery model to support or fully run critical operational functions on behalf of their customer organizations.
MSSPs typically provide cybersecurity services that cover broad monitoring of data and network traffic, investigating and responding to new threats and security alerts to protect organizations from targeted attacks and adversaries. Many MSSPs also offer additional managed security services, such as ongoing technology development, automation customization, and support. They also offer more comprehensive managed offerings for organizations looking to outsource entire security functions, such as , compliance and vulnerability management, managed security information and event management (SIEM), SOCaaS offerings, and more.
Learn More
Though MSPs and MSSPs are both outsourced services, MSSPs exclusively focus on cybersecurity. MSPs, on the other hand, provide a wider array of managed IT and security services. MSSPs typically operate out of designated SOCs to provide customers with around-the-clock monitoring, investigation, and response for security threats. Due to growing business demand for cybersecurity expertise, many MSPs have expanded their managed service portfolios to include MSS offerings as well.
Managed detection and response
Managed detection and response (MDR) is a cybersecurity service that combines technology with human expertise to rapidly identify and limit the impact of threats by performing threat hunting, monitoring, and response. The main benefit of MDR is that it quickly helps in limiting the impact of threats without the need for additional staffing, which can be costly.
Learn More
The main difference between MSSPs and MDR is that the MSSP generally does not actively respond to threats. Instead, the MSSP will send credible alerts to the customer’s in-house IT team to investigate and solve. This requires highly specialized expertise and 24/7 availability on the part of the customer, which makes it impractical for many small businesses.
Managed extended detection and response
Managed extended detection and response (MXDR), sometimes referred to as extended detection and response as a service (XDRaaS), is a holistic security service that provides advanced detection and response capabilities using a combination of digital technologies and outsourced human-led expertise. It is considered a transformative approach to cybersecurity because it addresses the limitations posed by traditional security models and provides protection across security sources like email, cloud servers, and networks.
Expert Tip
MXDR builds on the existing capabilities of MDR and extended detection and response (XDR). It combines both human expertise and the latest digital tools to enable robust data collection and correlation capabilities in addition to continuous threat hunting, threat monitoring, and incident response — all delivered as a service. At the moment, MXDR is considered the highest protection standard available in the market.
Co-managed IT services
Co-managed IT services (Co-MIT) is a service model where a client organization maintains some IT service capabilities while outsourcing others to an MSSP. Every Co-MIT agreement is different, and the breakdown of services will vary depending on the skills, resources, and expertise of the internal IT team.
MSS capabilities
MSS capabilities will vary depending on the vendor selected and the terms of the contract they agree to with their clients. Typically, MSSPs can provide the following services:
Managed detection and response
As previously discussed, MDR services augment security teams with the 24/7 expertise they need to monitor, investigate, and respond to cyber threats, protecting organizations against advanced attacks.
Managed cloud security
Managed cloud security protects an organization’s digital assets through advanced cybersecurity measures, performing tasks like constant monitoring and threat detection. An organization that uses managed cloud security delegates its cloud security strategy and operations to a third-party MSSP.
Managed endpoint security
Managed endpoint security, or managed endpoint protection, is a term now synonymous with MDR. Though many MDR services deliver far more today, endpoint security is where MDR offerings first started, providing the technical skills and security expertise needed to effectively monitor and defend the thousands of devices, systems, servers, and workloads used across today’s modern enterprise..
Managed identity protection
Managed identity protection, also known as managed identity security, is a comprehensive service that helps security teams monitor and protect all types of identities within the enterprise — human or machine, on-premises or hybrid, regular or privileged. Ultimately, the primary purpose of managed identity protection is to continuously monitor and mitigate identity-based threats (e.g., insider threats, abuse of compromised credentials, etc.), applying a range of proactive and preventive techniques and controls to minimize the chances of successful intrusions and lateral movement..
Security command center
Most MSSPs establish a security operations center to centralize their efforts and often refer to the room and physical space as their “command center.” This is where security experts monitor, detect, analyze, respond to, and report security incidents. SOCs are typically staffed 24/7 by representatives from the MSSP, including security analysts, engineers, and other IT personnel who use the security tools and techniques outfitted in the SOC to detect, analyze, and respond to security threats.
#1 MDR leader and pioneer
CrowdStrike Falcon® Complete MDR is the #1 MDR leader and pioneer. We combine the power of our cloud-native CrowdStrike Falcon® platform with the efficiency, expertise, and 24/7 protection of CrowdStrike’s global team of security experts.
CrowdStrike was recently named a Leader in The Forrester Wave™: Managed Detection and Response (MDR), Q2 2023 report. Our solution received the best score possible in 12 out of 23 criteria — including managed detection and managed response — and scored the highest in overall strategy.
Nick Hayes is the Senior Manager of Product Marketing for CrowdStrike’s managed detection and response (MDR) and proactive threat hunting solutions, Falcon Complete and Falcon OverWatch. Prior to joining CrowdStrike, Nick led product and content marketing at cybersecurity and threat intelligence startups. He also spent 10 years at Forrester as a security industry analyst and thought leader focused on digital risk, threat intelligence, and security analytics technology markets. He’s spoken at industry conferences worldwide, including RSA Conference, Black Hat, and Infosecurity Europe.
