For small business owners with a limited cybersecurity budget, it can be difficult to determine where to invest time, funds and other resources to best protect the business. Those decisions can be made even more complex when solutions like managed detection and response (MDR) and managed security services providers (MSSPs) are used imprecisely and interchangeably by vendors, IT professionals, journalists and others.
In this post, we explore these two services, outline their key differentiators and help organizations decide which option is best for their business.
What is MDR?
Managed detection and response (MDR) is a cybersecurity service that combines advanced technology and human expertise to perform threat hunting, monitoring and incident response. The main differentiator of MDR is that it includes response capabilities — meaning the service provider will work with their customers in the event of a breach to resolve that issue and recover from the event. However, this means MDR response capabilities can vary vendor by vendor. Some MDR services offer full response, others offer limited/guided response.
What are the benefits of MDR?
MDR solutions, while not always equal from vendor to vendor, most often offer organizations the follow set of benefits:
- Speed: Organizations using an MDR solution can immediately reduce their time to detect (and therefore, time to respond) from months to mere minutes. This helps the business contain the threat and dramatically reduce its impact.
- Continuous protection: MDR provides 24/7 protection against hidden, sophisticated threats through continuous managed threat hunting and response resource in the case of a security event.
- Cost: Because MDR relies on a service model, organizations generally do not need to hire additional staff to oversee detection and response tasks. Further, the cost of hiring, training and outfitting threat hunters and incident responders — professionals who are expensive and in high demand in today’s market — are shared across the client base by the MDR service provider.
- Oversight and maintenance: In an MDR model, the service provider or vendor is responsible for operating and maintaining all tools and technologies associated with the service. This means that the IT team need not be concerned with the intricacies of the tool itself or the underlying artificial intelligence (AI) and machine learning (ML) technology and algorithms. In some cases (depending on customer requirements) MDRs can also work with MSSPs to provide complete oversight of security tools.
- Workforce optimization: Using MDR to manage routine, repetitive incident response work allows members to focus on higher-value tasks and more strategic projects.
- Resiliency: MDR improves security posture and helps businesses become more resilient to potential attacks by optimizing security configuration and eliminating rogue or high-risk systems.
What is MSSP?
Managed security services provider (MSSP) is a term used to describe an IT service provider that offers cybersecurity solutions and services. MSSPs typically provide broad monitoring of the network for events and send validated alerts to other tools or to the organization’s security team. They may also provide a range of other services such as technology management, upgrades, compliance and vulnerability management.
The main difference between MSSP and MDR is that the MSSP generally does not actively respond to threats. Instead, the MSSP will send credible alerts to the customer’s in-house IT team to investigate and solve. This requires highly specialized expertise and 24/7 availability on the part of the customer, which makes it impractical for many small businesses.
The Relationship Between MSSP and MDR
The difference between MSSP and MDR becomes clearer when using the terms in full — managed security services provider and managed detection and response — as opposed to the acronyms. In this way, the services become easier to categorize: As the name implies, an MSSP is a vendor that provides security services, whereas MDR is a specific service that includes both threat detection and response.
While all MDR services would be provided by an MSSP, not all MSSPs offer MDR. (Think of it like any sector/subsector categories: All Dalmatians are dogs, but not all dogs are Dalmatians!)
Advantages and Disadvantages of MSSP
Relying on security services provided by a reputable MSSP is a great option for companies that are in the process of building their IT function and cannot hire a cybersecurity team or invest in a wide array of cybersecurity tools. By using an MSSP, in-house IT teams can focus on non-security tasks, such as customer service and support or business transformation initiatives, like cloud migration and data management.
Yet the MSSP model can come with some disadvantages. Most notably, many MSSPs offer a broad selection of core security services but lack deep expertise in any one area. The MSSP may also limit the organization in terms of tools or solutions based on what the MSSP can support or integrate with other services.
Finally, some MSSPs offer what is sometimes referred to as a “blackhole service.” This means that the vendor does not provide data from their monitoring services to the client — which means that customers cannot incorporate these insights into other aspects of the cybersecurity strategy.
Key Differences Between MDR and MSSP
Even though we have established that MDR and MSSP are two different cybersecurity services, some people within the industry may use these terms interchangeably. This is not correct.
We have developed the following chart to help break down the key differences in a simple way.
|
| MSSP | |
|---|---|---|
| Event response | Yes. As the name implies, MDR includes managed detection and response services. | No. The MSSP will alert the customer to the breach, but generally does not provide response support. |
| Solution set | The MDR solution set includes both detection and response capabilities. Most offerings include support from a 24/7 security operations center (SOC), as well as a team of human threat hunters and incident responders. | The MSSP solution set is largely preventative. It may include antivirus solutions, firewalls, web gateways, intrusion prevention systems and other tools that prevent breaches. |
| Proactive/reactive | Proactive and reactive. MDR is a comprehensive service that relies on both indicators of attack (IOA), which occur before the breach, and indicators of compromise (IOC), which are present after the fact, to determine if the organization is at risk. | Reactive. MSSPs are largely reactive in nature. They alert the organization to a breach or security event only after the fact using IOCs. |
| Human oversight | Yes. MDR services are provided by a combination of advanced technology and human threat hunters and incident responders. | Limited human oversight. MSSPs generally rely on technology alone to detect threats within the customer’s IT environment. |
| 24/7 monitoring | Yes. MDR includes 24/7 monitoring services. | Limited monitoring. In most cases, MSSPs offer more limited monitoring services. |
| Cost | $$ Since MDR offers more robust services, including remediation capabilities, the cost is usually higher as compared to an MSSP. | $ The cost of an MSSP is generally lower than that of an MDR since the MSSP does not provide remediation services or round-the-clock monitoring. |
Nick Hayes is the Senior Manager of Product Marketing for CrowdStrike’s managed detection and response (MDR) and proactive threat hunting solutions, Falcon Complete and Falcon OverWatch. Prior to joining CrowdStrike, Nick led product and content marketing at cybersecurity and threat intelligence startups. He also spent 10 years at Forrester as a security industry analyst and thought leader focused on digital risk, threat intelligence, and security analytics technology markets. He’s spoken at industry conferences worldwide, including RSA Conference, Black Hat, and Infosecurity Europe.
