MSSP & Vendor Risk · Interactive Tool
Three views of every security service. Four kinds of gap.
Most MSSP relationships do not fail loudly. They fail at 2 a.m., mid-incident, when "monitoring" turns out to mean "notification" — in the space between what the contract says, what the SOC actually runs, and what you believed you bought during the demo. The MSSP Gap Analyzer makes that space visible, service by service.
Runs entirely in your browser. Nothing is uploaded, ever.
Four gap types
Every service is scored from three angles — Contracted (what the agreement says, in writing), Delivered (what the evidence shows: queryable log sources, timestamped alert timelines, real hunt reports), and Perceived (what the client believes). Comparing the three classifies each service automatically:
Expectation gap
Believed covered; the contract says otherwise. The MSSP classic: “they'd isolate the host at 2 a.m.” — when the contract says monitoring and notification only. Fix: amend the contract, or accept the risk in writing.
Delivery gap
Contracted, but not evidenced. Coverage “of your environment” that means the log sources onboarded two years ago — cloud, SaaS, and the identity provider never made it in. Fix: remediation plan with dates.
Awareness gap
Delivered, but the client does not know. Monthly threat hunts and thousands of auto-blocked attacks, reported nowhere — so the client under-prices the service and starts shopping. Fix: make delivery visible.
Coverage gap
Nobody contracted it, nobody delivers it, and the client needs it. Tabletops, IR plan integration, attack-surface monitoring — each side assumed the other had it. Fix: add scope, add a provider, or document the acceptance.
For businesses with an MSSP
You sign the invoice. This tells you what would actually happen at 2 a.m. — who acts, who calls, and what "incident response included" turns out to mean — before the worst day of the year answers it for you.
For MSSPs
Self-audit an account before the client finds the gaps first. The awareness gaps it surfaces — hunts, tuning, blocked attacks nobody reports — are the renewal conversation you're currently losing silently.
Try it — sample assessment loaded.
This is the real tool running on a fictional credit union. Click around, change scores, watch the gaps reclassify. The full version adds contract upload and scanning, saving, and exports.
Organisation: Kestrel Credit Union (sample) · Provider: Meridian CyberDefense (sample) · Perspective: Independent assessment
How to read this: the three tabs — Expectations, Contract, Evidence — each capture one view of every security service. The Gap Matrix compares them and classifies each row. The Report rolls everything up. Any change in the three views flows through instantly.
The full version reads the contract stack for you.
Drop in the MSA, the service descriptions, and the SLA schedule — PDF, Word, or text. The scanner flags candidate clauses for every service and quotes them with citations, so the notify-only clause hiding in §2.1 surfaces in the first hour, not in the incident bridge. Parsers are embedded in the file: it works offline, and your contract never leaves your machine.
"Provider's obligations are limited to monitoring and notification. Provider shall not take containment actions, including isolating hosts or disabling accounts, without prior written authorization…"
Get the kit.
One download. The complete methodology, not just the tool.
- The MSSP Gap Analyzer (offline HTML app with contract scanner)
- The six-phase process guide
- Five stakeholder interview guides (including the SOC-manager evidence interview)
- The Excel gap-analysis workbook
One company assessing its own MSSP, or one MSSP self-auditing its own accounts.
Use across unlimited client engagements, internal or billable.
Prices in USD. Instant download. The tool runs from a single file — no accounts, no subscription, no telemetry.
Assessing a general IT MSP instead? → MSP Gap Analyzer
Want this run for you — with the client interviews, the SOC evidence requests, and the findings workshop handled by an independent third party? That is the engagement version.
Book a gap assessment