MSP vs. MSSP vs. vCISO: Who Does What
Growing companies often assume their IT provider "handles security." Sometimes that's true. Often it means antivirus is installed and nobody is watching. Here is how the three roles differ.
MSP: managed IT
A managed service provider keeps day-to-day IT running:
- Help desk and password resets
- Setting up laptops, printers and new hires
- Keeping systems working and fixing what breaks
An MSP's day is driven by tickets. Security work can end up waiting behind the help desk queue.
MSSP: managed security
A managed security services provider runs your security:
- Deploying and running security tools, such as ransomware protection, email security and endpoint detection and response
- Monitoring for threats and stepping in when one hits
- Managing security vendors and licenses
- Training staff and running phishing tests
- Keeping the evidence you need for insurers, clients and auditors
An MSSP's day is driven by threats, not tickets. Elevaire Managed Security is an MSSP.
vCISO: security leadership
A virtual CISO is a part-time senior security leader:
- Owns your security program and priorities
- Writes and maintains policies, including framework-specific ones
- Makes and documents risk decisions
- Handles long-form vendor and client assessments
- Reports to leadership and the board
- Leads audits and tabletop exercises
A vCISO decides what should be done and proves it to others. An MSSP does it every day. Many companies need both, and a virtual CISO pairs naturally with managed security.
How they fit together
| MSP | MSSP | vCISO | |
|---|---|---|---|
| Focus | Day-to-day IT | Running security | Leading security |
| Driven by | Tickets | Threats | Risk and strategy |
| Typical output | Working systems | Protected systems, monitored | Policies, decisions, reports |
You don't have to replace your MSP to add security. Elevaire works alongside your existing IT provider or internal team. If you have no IT at all, our Complete package brings in help desk support through a partner we manage.
Which do you need?
- No one owns security day to day: start with an MSSP.
- Security runs, but clients, auditors or the board want leadership and proof: add a vCISO.
- No IT support at all: you need an MSP too, or a package that includes one.
Not sure? The free security scorecard shows where your gaps are in three minutes.
See Where Your Security Stands
Take the free 3-minute scorecard for your top security risks, or book a 30-minute Risk Snapshot to talk it through.