A hot trend in the Managed Service Provider (MSP) space is emerging, transforming from an MSP to a Managed Security Service Provider (MSSP). Typically, MSPs act as an IT administrator, however, the rapid rise of cloud-based Software-as-a-Service (SaaS) is reducing margins for MSPs. This change is forcing MSPs to compete on price, causing buyers to become less loyal. Many MSPs are looking to add cybersecurity and IT compliance practices to their offerings for customers that are aware of the implications of a breach.

The statistics are remarkable. Gartner Inc. predicts worldwide information security spending will climb to $93 billion in 2018. In addition, Cybersecurity Ventures predicts that by 2021, global cybersecurity spending will exceed $1 trillion.

Customers recognize the necessity for better cybersecurity, which increases demand for your solutions, and are willing to pay for it, which increases your margin. Once you get to know their network and compliance requirements, customers are much more apt to stay put and not shop around on price alone. It’s no surprise that MSPs are actively seeking ways to get in on the ground floor in cybersecurity.

So how would you go about this? The classic approach is to frame the problem as a technical one. After all, most MSPs are, at their heart, technical people. All too often, MSPs seeking to become MSSPs approach the problem by reviewing available technologies and seek the best fit from a features viewpoint. And that's where you would be wrong.

It’s About People, Platform, and Process

74% of organizations are only reviewing logs weekly. The simple reason is, that while you can buy security tools, you simply cannot buy security monitoring capability. The "big hero" approach is neither scalable nor effective. To successfully implement a 24/7 security monitoring service aside of acquiring tools, an MSP would need to:
a) Hire and train a team of at least 6 staff members
b) Create and refine the security operations processes
c) Provide both lateral and top-down support

From our own experience, given full commitment plus the necessary budget and tools, this is a year-long process. Expect to be in the red during this year with costs far outstripping revenue. Tool vendors leave these "problems" for you to solve which makes for a high time-to-value (TTV) and lower probability of success.

Don't let your (technical) heart overrule your (business) head. It may sound exciting to get low-cost tools, maybe even one that is open source, allowing you to roll up your sleeves as a Linux guru, but that approach will put you in a world of hurt.

Why Drive Your Cybersecurity When You Can Uber?

The good news is that it’s the age of Uber. Compare Hertz rental car, the equivalent of buying software, versus Uber ride share, the equivalent of a co-managed security and compliance service. There are numerous advantages to adopting a co-managed approach. These include proven technology backed by a robust team of experts. Most important, low TTV, a minimal upfront investment, and a high probability of success.

When seeking a partner as an MSP or MSSP, keep these evaluation criteria in mind:

• Do they offer top of the line, industrial strength technology including multi-tenancy, broad features, and support for popular log sources and compliance standards?
• Is the software backed by a certified 24/7 Security Operations Center (SOC)?
• Is the SOC ISO 27001 or a PCI DSS service provider?
• Does your potential new partner require an upfront investment in hardware or software licenses?
• Does the service provider have established processes and incident response procedures?
• Will the SOC escalate incidents with detailed context and remediation recommendations so you can act?
• Does the business model support monthly payments?
• Will the service provider grow with you?
• What is the TTV?

MSPs can and should definitely consider adding a security and compliance practice. Your customers are asking for it and your stockholders will thank you for it. Accelerate your TTV by partnering with a service provider, not buying more tools, that allows you to focus on your core competency.