Why the MSSP model is broken, and how to fix it

Can small Managed Security Service Providers (MSSPs) outcompete the world’s biggest Systems Integrators (SIs)? It might sound like a fool’s errand. But SIs have a glaring weakness: a generic, heavily standardized approach that fails to move in step with the rapidly evolving threat landscape. There’s an opportunity for smaller, more agile MSSPs, if they’re bold enough to take it.

Unfortunately, many are failing to take advantage. In fact, they’re making it harder for CISOs to differentiate their offerings by citing inaccurate metrics. These do nothing but confuse prospective customers. But for those MSSPs willing to go against the status quo, the market is there for the taking.

Why bigger doesn’t mean better in cybersecurity

The threat landscape stands still for no one. Over the past couple of years, we’ve witnessed an unprecedented weaponization of new technologies by threat actors. AI is being used in victim reconnaissance, social engineering, malware generation, and vulnerability research and exploit development.

According to Verizon, the median threat actor researched or used AI assistance in 15 different documented techniques last year, with some using as many as 50. Researchers are warning that the exploitation window is collapsing as a result. Google’s most recent M-Trends report puts mean-time-to-exploitation at less than seven days.

This means that SecOps teams live in a world of constant flux. One in which continuous improvements need to be made to the SOC — to swap in and out services and evaluate and reevaluate vendors in order to maintain a good security posture. Now think of a typical SI. They may have deep domain knowledge and plenty of smart people on the books. But their business model is scale, not agility. In fact, they tend to charge punitive fees for any change requests outside the original scope of work.

Rigid contracts and multiple management layers are a recipe for inertia. That’s bad news for CISO customers at a time when IT infrastructure and threat actor innovation are moving at pace. If you can’t afford to mitigate new risks around agentic AI data leakage or prompt injection, what do you do? Delay investment in the technology? Or accept increased risk? There are no good options.

Missing an open goal

This business opportunity should be an open goal for MSSPs. But the truth is that many also adopt a cookie-cutter approach in order to efficiently service as wide a bank of customers as possible. This ultimately erodes the value of a potentially powerful differentiator.

They make things worse by resorting to disingenuous tricks to outcompete their rivals. They might claim to respond to alerts within 30 minutes, for example. But in reality, that metric is only applied to critical-severity alerts. Those deemed less urgent may take many more hours to respond to. That’s not only insincere. It could be a major security risk at a time when attackers go to deliberate lengths to hide in low-level activity. It’s critically important to spot and stop living-off-the-land techniques like these before they escalate.

There’s more. It’s also become accepted industry practice today for MSSPs to include automatically assigned and closed alerts when working out Mean Time to Acknowledge (MTTA) and Mean Time to Close (MTTC) — artificially shrinking these values. MSSPs may exclude alerts that weren’t handled within SLA parameters, like those at the weekend. And they may even reset the clock when an alert is escalated between tiers, to make it appear as if SLA targets were met.

This isn’t just bad practice. It means CISOs can no longer trust the sales pitch. That’s bad news for those who operate differently.

Honesty and agility

Yet if they can get their message out, there is an opportunity for more dynamic MSSPs. They must be honest about SLAs, clearly define the terminology they use, and resist the urge to manipulate metrics. But just as importantly, they should offer services that move in step with the needs of their customers and the changing nature of the threat landscape, to outcompete their larger SI rivals.

It can be done. Think: red teaming for rogue behavior. Continuous risk reporting that maps findings to best-practice compliance standards. And AI posture management that integrates with SOC playbooks and exposure management dashboards to mitigate risk across the AI attack surface.

There are some fantastic solution providers out there offering cutting-edge capabilities—from real-time runtime detection to observability and model provenance checks. But no single vendor offers the whole package a SOC needs. That’s where the MSSP can add value. It’s about continuously evaluating what’s out there on the market, and integrating it into a seamless, 24/7 managed service offering.

Protection for today and tomorrow

The MSSP space has never been more important for customers. The accelerating pace of industry regulation, infrastructure, and threat innovation is a testament to that.

For IT security leaders, the question to ask is not just whether your service provider is good enough right now. It’s whether they have a convincing vision of where security is heading in the future.

For many organizations, that’s not going to be an SI where only 80% of what they do might be “good enough.” In cyber, 80% is no longer good enough. CISOs need a more dynamic partner to protect their business: for today and tomorrow.