What Makes a Great MSSP?

Ask any MSSP what makes them different and you will hear the same six things, usually in the same order. SOC 2. Twenty-four-seven monitoring. MDR bundled in. An incident response retainer. Detections mapped to MITRE ATT&CK. A named senior analyst who'll get on the phone. I built a worksheet along exactly those lines a while back, because those questions are still the fastest way to separate a provider worth talking to from one that isn't. They work. Every business evaluating an MSSP should ask them, in writing, before signing anything.

Here is the part that only shows up on the worst week of the year. Two providers can answer every one of those questions identically, hand you the same ATT&CK coverage map, quote you almost the same retainer, and still be completely different companies the night it matters. One has someone with real authority on the phone inside minutes, ready to act. The other has a pager rotation that notifies you correctly, slowly, and calls it twenty-four-seven. The worksheet got both of them in the door. It never told you which one was actually going to answer at 2 a.m.

I've sat in enough rooms in the weeks after a real incident to know how that gap gets discovered, and it's never gently. It's a client describing what they thought their MSSP did, and the provider's own logs describing what actually happened, and the two accounts not lining up. By the time anyone is in that room, it's too late to renegotiate.

The checklist gets you to average

The reason the checklist stopped being a real differentiator is that the capital chasing this market rewards exactly the words on it. Cybersecurity services M&A hit roughly 398 disclosed deals in 2025 worth about $102 billion, and 2026 is tracking toward the highest deal count the sector has ever recorded. Buyers pay a real premium for it, too: platforms with genuine MDR capability trade two to three turns of EBITDA higher than monitoring-only shops, and the marquee deals show why everyone wants to be one — Sophos paying $859 million for Secureworks, Thoma Bravo taking Darktrace private at roughly $5.3 billion, Arctic Wolf picking up Cylance for $160 million. When "MDR" and "twenty-four-seven" and "containment" are literally what the exit multiple is priced on, every provider has a financial reason to claim all three, whether or not the 2 a.m. staffing actually backs it up. The checklist converges right along with the money that funds it.

None of this makes the consolidation itself the problem, and I want to argue against my own drift here for a paragraph, because the honest version is more useful than the tidy one. Some of the most capable SOCs I've reviewed sit inside PE-backed platforms, for an unglamorous reason: the threat intel feeds, the ATT&CK tooling, and the bench of senior analysts a real SOC needs are expensive, and a platform can spread that cost across forty clients in a way a boutique shop with a dozen accounts cannot. Scale can buy real capability. The failure mode isn't the ownership structure. It's what happens to authority and speed in the handoff — whether the senior analyst who could actually make a call on your environment is still reachable, or whether you've been quietly routed into a shared tier-one queue that reads a runbook and pages someone.

Where the difference actually lives

So if the checklist is necessary but no longer sufficient, what changed to make the rest of it matter this much? Mandiant's M-Trends 2026 has the number that reframes the whole question: the median time between an attacker's initial access and handing that access off to whoever runs the rest of the intrusion fell from more than eight hours in 2022 to twenty-two seconds in 2025. Global median dwell time is still measured in days — fourteen of them, up from eleven the year before — but the window in which a human has to notice, decide, and act before the attack has already moved on has collapsed to almost nothing. A service built around "we'll notify you and you decide" was a reasonable design when the attacker was also going to take hours. It is not a reasonable design now.

That is where the good providers and the average ones actually split. A good MSSP has containment authority in writing, not as an aspiration in the sales deck but as a specific, pre-agreed list of actions — isolate this host class, disable this account, block this egress — that they are authorized to take before they've reached a human on your side. An average one still requires a phone call to someone at your company before anything happens, which was an acceptable design against an eight-hour attacker and is closer to theater against a twenty-two-second one.

The same split shows up in what the SLA actually measures. A good provider tracks time to a useful action, not time to acknowledge — an analyst clicking a ticket open is not the same event as a decision getting made, and a contract that only measures the click is measuring the part that was never in doubt. And a good provider shows you the coverage map honestly: which MITRE ATT&CK techniques they have real telemetry for, which they don't, updated as your environment changes, in greys and reds rather than a reassuring wash of green. Detected is not the same claim as covered, and delivered is not the same claim as contracted. A provider willing to show you the gap is telling you something true. One that shows you an all-green dashboard is usually telling you what you want to hear.

What I would do about it

Ask the checklist questions, but treat a clean scorecard as a floor, not a verdict. SOC 2, an ATT&CK map, and an IR retainer get a provider onto your shortlist. None of it tells you which one on that shortlist can actually act inside a minute of a real alert.

Ask for containment authority in writing, with the specific actions pre-approved and the specific actions that still require your sign-off. A provider with a real answer has already thought through the twenty-two-second world. A provider that describes a phone call as the response plan is still selling you the eight-hour version.

Ask to see the ATT&CK coverage map with the gaps left in, not painted over, and ask when it was last updated against your actual environment. A map that's never changed since onboarding is a map of what they sold you, not what they're watching now.

Ask what their SLA measures, specifically, and get the definition of each stage in writing. "Time to acknowledge" and "time to a senior analyst taking action" are different promises, and only one of them tells you anything about the night that matters.

If your provider has changed hands, treat the following ninety days as a checkpoint. Confirm the named analyst, the containment authority, and the escalation path are still what they were before the acquisition, in writing, rather than assuming continuity because nobody told you otherwise.

A great MSSP is not the one with the cleanest coverage map on the sales call. Plenty of average ones have learned to build an impressive one. A great MSSP is the one still acting inside your twenty-two seconds, with real authority and no phone call required, on the night three years from now when it actually counts.

Sources

*Mandiant, M-Trends 2026 (Google Cloud, 2026), on the compression of initial-access handoff time and global median dwell time; CT Acquisitions, MSSP and Cybersecurity Services M&A Multiples Report (2026), on 2025–2026 cybersecurity services deal volume, MDR valuation premiums, and named acquisitions. Figures reflect public reporting available as of mid-2026.*

A great MSSP is not the one with the cleanest coverage map on the sales call. It's the one still acting inside your twenty-two seconds, with real authority and no phone call required, on the night three years from now when it actually counts.