Managed Cyber Security Services
Managed cyber security services put an outside team in charge of watching your systems and handling alerts under a contract. The key question isn't whether a provider monitors, but what it may do on its own when something looks wrong.
On this page
Monitoring, investigation, escalation, and response
These four words often appear in one sales sentence, but each is a separate job. Monitoring services may stop at the second step.
| Stage | What happens | Common gap |
|---|---|---|
| Monitoring | Tools collect activity and raise alerts | Systems outside the agreed scope produce no alerts at all |
| Investigation | An analyst decides if the alert matters | Hours of coverage may differ from the sales description |
| Escalation | Someone at your organization is contacted | Out-of-date contact lists; no one answers at night |
| Authorized response | The provider acts, such as isolating a device | No written authority, so action waits for your approval |
CISA defines managed service providers as firms that deliver or manage technology functions under a contractual arrangement such as a service level agreement, and advises customers to verify that their contracts include security measures matching their own requirements. Providers also hold powerful access, so treat their accounts as a risk you manage too.
Example: an after-hours alert
A login alert at 2:10 a.m.
This scenario is invented to show the steps. It doesn't describe a real incident or provider.
- Monitoring, 2:10 a.m.A tool flags a staff email login from an unusual location.
- Investigation, 2:25 a.m.An analyst sees a new mail-forwarding rule and judges it likely account compromise.
- Escalation, 2:40 a.m.The provider calls the on-call contact in the agreement. No one answers, so it tries the backup.
- Authorized response, 2:50 a.m.The agreement allows account lockout, so the analyst disables the session and account, and logs it.
- Morning handoffThe customer resets credentials, reviews the mail rule, and decides what to tell affected people.
If the agreement did not authorize lockout, step four would wait until someone answered. That gap is what you are negotiating.
Who is responsible for what
| Task | Provider | Customer | What the agreement must specify |
|---|---|---|---|
| Coverage | Monitors listed systems | Keeps the list current | Exact systems, accounts, and cloud services in scope |
| Hours | Staffs agreed hours | Staffs its own contact roster | Coverage hours, holidays, and response-time targets |
| Containment | Acts within granted authority | Grants or withholds authority | Which actions need no approval, and who approves others |
| Fixes | Advises, unless contracted to fix | Usually owns patches and changes | Whether remediation is included or billed separately |
| Reporting | Produces agreed reports | Reads them and acts | Report frequency, content, and access to raw logs |
| Legal notices | Supplies facts | Decides on notifications | Evidence handling and how fast incident facts are shared |
Before signing, compare managed service costs and use the provider comparison table. If you don't yet know what needs watching, an assessment may come first.
Questions to ask before you sign
- Monitored systems: Which systems, accounts, and locations are covered, and what happens when we add one?
- Hours: Are people on shift all hours, or on call? What are the target response times?
- Response authority: What can you do without calling us, and what if you can't reach anyone?
- Reporting: What will we receive, how often, and can we export our logs when we leave?
- Extra charges: What costs extra, such as incident response hours, onboarding, or new devices?
Not sure what this should cost? Separate recurring fees from setup and incident work before comparing quotes.
Compare managed service costs