Break-fix
You call when something stops working and pay by the hour. It looks cheap until the server fails on a Monday morning. Nobody is watching your systems between calls, so problems are found by your staff, and the provider earns more when things go wrong.
Managed service provider (MSP)
You pay a flat monthly rate, and the provider takes responsibility for keeping everything running: monitoring around the clock, installing updates, managing backups, answering the help desk and planning ahead. The provider does better when you have fewer problems, so your interests line up.
Managed security service provider (MSSP)
An MSSP focuses on stopping attacks. It runs the security tools, watches alerts 24 hours a day, responds when something looks wrong and keeps the records that regulators and insurers ask for. A general IT company may install antivirus; an MSSP is the team that is awake at 2 a.m. when it fires.
Which do you need?
- A very small office with no sensitive data can sometimes get by with break-fix.
- Any office that would lose money in a day of downtime should have managed IT.
- Any office that holds patient, legal or financial records needs managed security as well.
- One provider that does both avoids the gap where IT and security each assume the other is handling it.
Questions to ask a provider
- What is your guaranteed response time for an outage?
- Is security included in the monthly rate, or sold separately?
- Do you test restoring our backups?
- Do you own your infrastructure or resell someone else's?
- Have you been independently audited, for example SOC 2 Type II?