Sales pages use these four terms as if everyone knew the difference. They are not interchangeable, and buying the wrong one leaves a gap you will only notice during an incident.
Quick answer: An MSP keeps your IT working (helpdesk, devices, network). An MSSP runs security for you: tools, monitoring, response and reporting. MDR is a service where human analysts actively detect, investigate and contain threats. A vCISO is a part-time security leader who owns your security program and compliance. In our view, a small business without a security team usually needs an MSP with security built in, or MDR, before a vCISO.
Key takeaways
- MSP = IT support. Security may be an add-on, so ask what it includes.
- MSSP = security operations. It can cover monitoring and response, but the term is used loosely.
- MDR = active response. CyberMark says MDR contains confirmed threats without waiting for your approval, while MSSPs typically notify you.
- vCISO = leadership, not tools. It builds your program; it usually does not watch your network.
- Prices vary widely and every figure here is provider-published, not independent.
On this page: Definitions · Compared · Cost · MSSP vs MDR · Which to buy · Combining them · FAQ
What are an MSP, an MSSP, MDR and a vCISO?
- MSP (managed service provider). Kapacyber says an MSP “keeps your IT working”: helpdesk, device management, network, email setup and software installs. Its focus is infrastructure, not hunting threats.
- MSSP (managed security service provider). Per Kapacyber, an MSSP “runs the security function for businesses that don’t have a security team,” operating tools, monitoring, response and reporting.
- MDR (managed detection and response). CyberMark describes MDR as combining technology, threat intelligence and human analysts to actively detect, investigate and respond.
- vCISO (virtual chief information security officer). SideChannel calls a vCISO a fractional security executive who owns your security program, manages compliance requirements and leads incident response.
MSP vs MSSP vs MDR vs vCISO at a glance
| MSP | MSSP | MDR | vCISO | |
|---|---|---|---|---|
| Main job | Keep IT running | Run security operations | Detect and actively respond to threats | Lead security strategy |
| Typical work | Helpdesk, patching, devices, email | Monitoring, tools, reporting | 24/7 analysts, containment | Policies, risk, compliance, insurer and customer questions |
| Watches for attacks? | Sometimes, if security is bundled | Yes | Yes | No (advises) |
| Acts on a threat? | Depends on the contract | Often notifies you | Yes, contains it | No (directs the response plan) |
| Best when | You need IT support | You have no security team | You have devices and want 24/7 response | You need a plan and someone to face insurers and auditors |
The last row is our editorial summary of the definitions above. Providers blur these lines, so always ask what is actually included.
How much does each cost?
Published ranges, all from providers that sell these services:
| Service | Published range | Source |
|---|---|---|
| MSP (fully managed IT, 15–75 users) | $100–$175 per user per month | Serenit (May 2026) |
| MSSP, SMB-focused | $25–$100 per employee per month; from $425 a month | Kapacyber (May 2026) |
| MSSP, per user | $100–$150 (basic) to $225–$350 (premium) per user per month | Digacore (Apr 2026) |
| MDR | $10–$30 per endpoint per month; $200–$1,500 a month for 25–50 endpoints | CyberMark (June 2026) |
| vCISO, 1–50 employees | $1,500–$4,000 (SideChannel); $1,500–$5,000 (ZipSec) per month | SideChannel, ZipSec (2026) |
| vCISO, 50–200 employees | $3,000–$7,000 (SideChannel); $4,000–$8,000 (ZipSec) per month | SideChannel, ZipSec (2026) |
The MSSP row shows how far providers disagree: $25 to $350 per user a month depending on who you ask and what is bundled. Details on each: security services cost and vCISO and consulting cost.
MSSP vs MDR: what is the difference?
The practical difference is who acts. CyberMark says that when an MDR team identifies a confirmed threat it isolates the endpoint, blocks the malicious IP and contains the threat without waiting for your approval, while an MSSP typically notifies your team and leaves the investigation to you. Treat that as a vendor description of the ideal case: read each contract for who has authority to act and how fast.
MDR also differs from EDR. EDR is software on your computers. MDR adds the human analysts who watch it and respond. CyberMark describes entry-level MDR as EDR deployed, automated alert triage and basic containment such as device isolation, and mid-tier MDR as adding 24/7 SOC coverage with human review, threat hunting, defined response times (typically 30 minutes to four hours) and quarterly reviews.
Which one should a small business buy first?
Our editorial guide, based on the definitions above:
| Your situation | Start with |
|---|---|
| No one handles IT; laptops, email and Wi-Fi are a mess | An MSP, and confirm it includes EDR, MFA enforcement, patching and tested backups |
| You have IT help but nobody watches for attacks | MDR (or an MSSP) on top of your existing IT |
| 10 to 50 staff, no IT and no security staff | An MSP with security included, or a bundled MSSP |
| Insurers, customers or auditors ask for policies and evidence | A vCISO or a one-off consultant, plus the controls above |
| Under about 10 staff, tight budget | Start with the basics: MFA, EDR, backups and training; see our checklist |
Can you combine them?
Yes, and many do. Common combinations:
- MSP + MDR. The MSP runs IT; MDR watches for threats.
- MSSP only. One provider handles both, if its scope covers day-to-day IT.
- MSP + vCISO. The vCISO sets policy and answers insurers; the MSP carries it out.
When you combine providers, ask each one who owns the incident. Gaps and overlaps between providers are where response slows down. Kapacyber also suggests asking for named services, clear in- and out-of-scope items, and no data lock-in.
Insurers ask about the same controls whichever provider you choose: see cyber insurance requirements and run our readiness check.
Frequently asked questions
What is the difference between an MSP and an MSSP?
An MSP keeps IT working (helpdesk, devices, network). An MSSP runs security: monitoring, response and reporting. Some providers do both.
Is MDR the same as an MSSP?
No. MDR centers on human analysts who actively investigate and contain threats. An MSSP is a broader security operations provider that may only alert you.
Is MDR the same as EDR?
No. EDR is software on your devices. MDR adds a team that monitors it and responds.
What is a vCISO?
A part-time outsourced security executive who owns your security program, policies and compliance, and speaks to insurers and auditors.
Do I need both an MSP and an MSSP?
Not always. Some MSPs include security; some businesses add MDR on top. Ask what overlaps before paying twice.
Which is cheapest?
Published ranges overlap, so it depends on scope. A vCISO retainer pays for guidance, not monitoring, so it is not a cheaper substitute for MDR or an MSSP.
Which one do cyber insurers prefer?
Insurers ask about controls (MFA, EDR, backups, training), not provider type. Evidence matters more than the label.
Sources
- Kapacyber: MSSP for Small Business, 2026 Buyer’s Guide (May 15, 2026)
- CyberMark: Managed Detection and Response Cost in 2026 (June 29, 2026)
- Serenit: MSP Pricing Guide 2026 (updated May 18, 2026)
- Digacore: 2026 Budget Guide, Managed Security Services Provider (Apr 2026)
- SideChannel: vCISO Pricing in 2026 (Apr 22, 2026)
- ZipSec: vCISO Pricing in 2026 (Jul 9, 2026)
Last updated October 5, 2026. Definitions and prices come from providers that sell these services; they are not independent surveys and change often. SMB Security HQ provides general information, not legal, financial or professional security advice. See our Affiliate Disclosure and How We Test.
