For small business owners with a limited cybersecurity budget, it can be difficult to determine where to invest time, funds and other resources to best protect the business. Those decisions can be made even more complex when solutions like managed detection and response (MDR) and managed security services providers (MSSPs) are used imprecisely and interchangeably by vendors, IT professionals, journalists and others.

In this post, we explore these two services, outline their key differentiators and help organizations decide which option is best for their business.

What is MDR?

Managed detection and response (MDR) is a cybersecurity service that combines advanced technology and human expertise to perform threat hunting, monitoring and incident response. The main differentiator of MDR is that it includes response capabilities — meaning the service provider will work with their customers in the event of a breach to resolve that issue and recover from the event. However, this means MDR response capabilities can vary vendor by vendor. Some MDR services offer full response, others offer limited/guided response.

What are the benefits of MDR?

MDR solutions, while not always equal from vendor to vendor, most often offer organizations the follow set of benefits:

1. Speed: Organizations using an MDR solution can immediately reduce their time to detect (and therefore, time to respond) from months to mere minutes. This helps the business contain the threat and dramatically reduce its impact.
2. Continuous protection: MDR provides 24/7 protection against hidden, sophisticated threats through continuous managed threat hunting and response resource in the case of a security event.
3. Cost: Because MDR relies on a service model, organizations generally do not need to hire additional staff to oversee detection and response tasks. Further, the cost of hiring, training and outfitting threat hunters and incident responders — professionals who are expensive and in high demand in today’s market — are shared across the client base by the MDR service provider.
4. Oversight and maintenance: In an MDR model, the service provider or vendor is responsible for operating and maintaining all tools and technologies associated with the service. This means that the IT team need not be concerned with the intricacies of the tool itself or the underlying artificial intelligence (AI) and machine learning (ML) technology and algorithms. In some cases (depending on customer requirements) MDRs can also work with MSSPs to provide complete oversight of security tools.
5. Workforce optimization: Using MDR to manage routine, repetitive incident response work allows members to focus on higher-value tasks and more strategic projects.
6. Resiliency: MDR improves security posture and helps businesses become more resilient to potential attacks by optimizing security configuration and eliminating rogue or high-risk systems.

What is MSSP?

Managed security services provider (MSSP) is a term used to describe an IT service provider that offers cybersecurity solutions and services. MSSPs typically provide broad monitoring of the network for events and send validated alerts to other tools or to the organization’s security team. They may also provide a range of other services such as technology management, upgrades, compliance and vulnerability management.

The main difference between MSSP and MDR is that the MSSP generally does not actively respond to threats. Instead, the MSSP will send credible alerts to the customer’s in-house IT team to investigate and solve. This requires highly specialized expertise and 24/7 availability on the part of the customer, which makes it impractical for many small businesses.

The Relationship Between MSSP and MDR

The difference between MSSP and MDR becomes clearer when using the terms in full — managed security services provider and managed detection and response — as opposed to the acronyms. In this way, the services become easier to categorize: As the name implies, an MSSP is a vendor that provides security services, whereas MDR is a specific service that includes both threat detection and response.

While all MDR services would be provided by an MSSP, not all MSSPs offer MDR. (Think of it like any sector/subsector categories: All Dalmatians are dogs, but not all dogs are Dalmatians!)

Advantages and Disadvantages of MSSP

Relying on security services provided by a reputable MSSP is a great option for companies that are in the process of building their IT function and cannot hire a cybersecurity team or invest in a wide array of cybersecurity tools. By using an MSSP, in-house IT teams can focus on non-security tasks, such as customer service and support or business transformation initiatives, like cloud migration and data management.

Yet the MSSP model can come with some disadvantages. Most notably, many MSSPs offer a broad selection of core security services but lack deep expertise in any one area. The MSSP may also limit the organization in terms of tools or solutions based on what the MSSP can support or integrate with other services.

Finally, some MSSPs offer what is sometimes referred to as a “blackhole service.” This means that the vendor does not provide data from their monitoring services to the client — which means that customers cannot incorporate these insights into other aspects of the cybersecurity strategy.

Key Differences Between MDR and MSSP

Even though we have established that MDR and MSSP are two different cybersecurity services, some people within the industry may use these terms interchangeably. This is not correct.

We have developed the following chart to help break down the key differences in a simple way.

	MDR	MSSP
Event response	Yes. As the name implies, MDR includes managed detection and response services.	No. The MSSP will alert the customer to the breach, but generally does not provide response support.
Solution set	The MDR solution set includes both detection and response capabilities. Most offerings include support from a 24/7 security operations center (SOC), as well as a team of human threat hunters and incident responders.	The MSSP solution set is largely preventative. It may include antivirus solutions, firewalls, web gateways, intrusion prevention systems and other tools that prevent breaches.
Proactive/reactive	Proactive and reactive. MDR is a comprehensive service that relies on both indicators of attack (IOA), which occur before the breach, and indicators of compromise (IOC), which are present after the fact, to determine if the organization is at risk.	Reactive. MSSPs are largely reactive in nature. They alert the organization to a breach or security event only after the fact using IOCs.
Human oversight	Yes. MDR services are provided by a combination of advanced technology and human threat hunters and incident responders.	Limited human oversight. MSSPs generally rely on technology alone to detect threats within the customer’s IT environment.
24/7 monitoring	Yes. MDR includes 24/7 monitoring services.	Limited monitoring. In most cases, MSSPs offer more limited monitoring services.
Cost	$$ Since MDR offers more robust services, including remediation capabilities, the cost is usually higher as compared to an MSSP.	$ The cost of an MSSP is generally lower than that of an MDR since the MSSP does not provide remediation services or round-the-clock monitoring.

How to choose which solution is best for your business?

When it comes to choosing between MSSP and MDR, there are several practical considerations that organizations must take into account — especially for small businesses that have lower IT budgets and are still building maturity within their tech stack.

MDR may make sense if your business:

• Does not have an internal SOC or in-house cybersecurity team to help manage and respond to alerts
• Is not prepared to onboard or train cybersecurity staff or operate and manage the cybersecurity toolset in house
• Requires round-the-clock monitoring and fast incident response and remediation in order to maintain business operations
• Is required by law to maintain robust security measures to protect customer data

MSSP may be a good fit if your organization:

• Already has a full-service SOC or highly capable incident response team in house
• Has a relatively low risk profile — meaning it does not have a significant digital footprint, rely heavily on digital assets to carry out work, or store sensitive customer data or IP
• Has significant budget constraints, making MDR out of your price range
• Only wants to outsource basic security tasks, such as software patching and system upgrades

Access Market-Leading MDR Service with Falcon Complete for Service Providers

Get the best of both worlds with Falcon Complete for Service Providers. A partnership that enables service providers to build customized services on top of CrowdStrike’s industry-leading and pioneering MDR service to provide customers 24/7 comprehensive and specialized threat detection, threat hunting, integrated intelligence and full-cycle remediation across endpoints, identities and cloud workloads.

Learn more about the benefits of CrowdStrike^® Falcon Complete and how it can help your business.

Schedule Demo