Managed Security Service Providers (MSSPs): What They Do and 15 Compared

Every provider here runs a 24/7 security operations center (SOC) that responds (isolating a device, killing a process, disabling an account), not one that only alerts. Thirteen are MDR-led; LevelBlue and Optiv are full-service MSSPs that also co-manage SIEM and run services such as managed firewalls (LevelBlue) and vulnerability management (Optiv). We left out resellers without their own SOC. None of these companies pays us.

What is an MSSP?

A managed security service provider is an outside team that runs some or all of your day-to-day security operations, 24 hours a day, under a monthly contract. Most small and mid-size buyers use an MSSP for one reason: nobody on staff can watch alerts at 3 a.m. and act on them.

The services an MSSP typically runs:

• Managed detection and response (MDR): analysts watch endpoint, identity and cloud alerts and contain real threats; see how MDR differs from EDR.
• SOC monitoring and managed SIEM: collecting and reviewing your logs, and keeping them for audits.
• Managed firewall and VPN: rule changes, updates and monitoring.
• Vulnerability management: scanning, then tracking fixes; a manual penetration test is usually bought separately.
• Identity monitoring: watching for stolen logins and risky sign-ins in Microsoft 365 or Google Workspace.

MSSP vs MSP vs MDR vs SOC-as-a-service

An MSP runs your IT, an MSSP runs your security, and MDR and SOC-as-a-service are specific security services an MSSP may sell. The labels overlap in vendor marketing, so read the contract for what the provider will actually do when something goes wrong.

Many small businesses keep their MSP and add MDR on top. Huntress and Blackpoint are built for exactly that: your MSP resells and manages the service.

The 15 managed security service providers

The providers below are listed with published prices first, then quote-only providers A–Z.

ThreatDown Elite MDR

ThreatDown, Malwarebytes’ business brand, is the cheapest published MDR we found: $495 a year for 5 devices on the Elite MDR bundle, which works out to $99 per device per year (checked October 24, 2026 in the pricing-page calculator). ThreatDown describes Elite MDR as “24/7 human-led threat monitoring and response.” The Ultimate MDR Plus bundle, which adds identity coverage, costs $745 a year for 5 devices. Skip it if you want MDR on top of a different EDR: the service runs on ThreatDown’s own agent.

Huntress Managed EDR

Huntress publishes an MSRP of $8.99 per endpoint per month for Managed EDR, with Managed ITDR (Microsoft 365 identity monitoring) at $4.80 per identity and Managed SIEM at $4 per data source. Huntress calls itself “channel-first”: MSPs buy with no minimum, while resellers and direct buyers need 50 seats per product. Volume discounts exist but aren’t published; see our Huntress pricing breakdown. Best for a business whose MSP already offers Huntress. Skip it if you have fewer than 50 devices and no MSP.

Arctic Wolf

Arctic Wolf sells MDR on its own platform and describes “guided 24×7 threat detection” with containment by its SOC. Its own site publishes no price, but its AWS Marketplace listing shows MDR Basic at $44,000 for 12 months for up to 100 users (list price on AWS Marketplace; private offers vary). That is a bundle price, not a per-endpoint price, so we don’t rank on it.

Blackpoint Cyber

Blackpoint runs a “24/7 human-led, AI-accelerated SOC” and is built partner-first for MSPs, though it also offers demos and a free trial. No price is published.

CrowdStrike Falcon Complete

CrowdStrike publishes prices for its Falcon Go, Pro and Enterprise endpoint bundles, but none of those includes 24/7 MDR. Falcon Complete, the MDR service, is “contact sales.” Best for organizations already standardizing on CrowdStrike.

eSentire

eSentire offers “24/7 SOC-as-a-Service with unlimited threat hunting and incident handling” in three MDR packages. Its site has a quote builder but no list prices.

Expel

Expel’s MDR works on top of the tools you already own, with more than 160 integrations including Microsoft, CrowdStrike and SentinelOne. Expel states a 14-minute mean time to respond on critical and high incidents with auto-remediation; that is Expel’s own figure. Pricing is by request across three packages (Starter, Select, Premium).

Field Effect

Field Effect sells MDR with a 24x7 SOC on its own platform, direct or through an MSP partner program. Pricing is by request.

LevelBlue

LevelBlue sells a full managed security catalog: 24/7/365 managed detection and response, co-managed SOC for SIEM (including Microsoft Sentinel), managed next-gen firewalls, managed SASE and DDoS defense. LevelBlue calls itself the first pure-play MDR provider with FedRAMP certification. Pricing is by request. Best for larger organizations that want one provider for network and detection.

Optiv

Optiv runs managed security “24/7/365,” with co-managed SIEM (detection content mapped to MITRE ATT&CK), MDR, managed vulnerability services and managed privileged access (PAM). No price is published; you contact sales. Best for enterprises that want an MSSP to co-manage tools they already own.

Rapid7 MDR

Rapid7 MDR covers endpoint, cloud, identity, email and network data and feeds its vulnerability findings into investigations. Rapid7 advertises incident response “without limits,” unlimited data ingestion and asset-based pricing, but publishes no figure.

Red Canary (Zscaler)

Red Canary is now part of Zscaler, and redcanary.com redirects to Zscaler’s MDR page. Zscaler describes 24/7 experts who can isolate endpoints and suspend users. No price is published.

SentinelOne MDR

SentinelOne publishes endpoint prices (Singularity Complete and Commercial) but lists managed detection and response as a contact-sales add-on. Best for teams already running SentinelOne.

Sophos MDR

Sophos describes “fully managed, 24/7 detection and response” and sells through its site and partners, with no public price. Secureworks is now part of Sophos: secureworks.com redirects to sophos.com. One AWS Marketplace listing (sold by Carahsoft, private offers only) shows $239.69 for 12 months of “Central MDR EP Complete,” but it doesn’t state the unit, so we don’t rank on it.

UnderDefense

UnderDefense advertises 24/7 detection and response, with an online cost calculator instead of a list price.

How much does an MSSP cost?

Published managed detection prices start around $99 per device per year (ThreatDown) and $8.99 per endpoint per month (Huntress MSRP), both checked October 24, 2026. Thirteen of the 15 providers we compared quote instead.

Not every product on the market. Links go to each vendor’s official site unless marked as partner links. How we rank Not ranked: Arctic Wolf (quote only on its own site; its AWS Marketplace list price is per bundle of up to 100 users, not per endpoint); Blackpoint Cyber (quote only); CrowdStrike Falcon Complete (quote only); eSentire (quote only); Expel (quote only); Field Effect (quote only); LevelBlue (quote only); Optiv (quote only); Rapid7 MDR (quote only (asset-based pricing, no figure)); Red Canary (Zscaler) (quote only); SentinelOne MDR (quote only); Sophos MDR (quote only; an AWS Marketplace private-offer listing does not state its unit); UnderDefense (quote only (online cost calculator, no list price)).

What moves a quote:

• Count of endpoints, users and data sources. Most providers price per unit.
• Response vs. alerting. A provider that isolates devices and resets accounts costs more than one that emails you.
• Log volume and retention, if the service includes SIEM.
• Whether you bring your own tools. Expel-style services sit on your EDR; others require theirs.
• Incident response retainer. Some contracts include breach investigation hours; others bill them separately.

How to choose an MSSP: 8 questions to ask

Ask every provider the same eight questions, in writing, before you sign.

1. Will you contain a threat yourselves, or only notify us?
2. What are your response times, and are they in the contract?
3. Do we use your tools or ours, and what happens to them if we leave?
4. Who owns our logs and data, and how do we get them back on exit?
5. How long is the contract, and what does early termination cost?
6. Is incident response included, or billed hourly after a breach?
7. Which reports do you produce for SOC 2, HIPAA or CMMC evidence?
8. Which responsibilities stay with us? Ask for a shared-responsibility table.

The last question matters most. CISA warns that outsourcing “does not absolve an organization from risk management responsibilities,” and recommends writing a shared responsibility model into the vendor agreement (CISA Insights, September 2021). Cyber insurers also ask about managed detection on applications; our cyber insurance guide covers what they require.

Do small businesses need an MSSP?

A small business needs 24/7 managed detection when nobody on staff can respond to an alert at night, and an insurer, customer or contract expects it. Many small businesses don’t need a full MSSP: managed EDR from their existing MSP covers the most common attacks on laptops and servers.

Add a full MSSP when you need log monitoring for compliance, cover for cloud and identity systems, or a provider that runs your firewalls too. If your bigger worry is staff leaking files rather than outside attackers, compare data loss prevention tools instead. For protection software you manage yourself, see our small business antivirus picks or the wider endpoint security section.

Correction, October 25, 2026: we added Arctic Wolf’s AWS Marketplace list price; this page previously said Arctic Wolf published no price.