Key takeaways
- Compare providers on outcomes and responsibilities, not feature lists.
- Insist on written response times, clear limits on actions and transparent reporting.
- Run a short trial or assessment before a long contract.
Why the choice matters
A managed security provider becomes part of how you operate. They hold privileged access, see sensitive logs and are the people you call on your worst day. A careful choice now saves painful switching later.
Twelve questions
- 1What exactly is covered: devices, cloud, identity, email, network? What is extra?
- 2What are your written response times, from alert to investigation to action?
- 3What can you do for us without approval, and what do you always ask about first?
- 4Who will be on call outside business hours, and are they your staff or subcontractors?
- 5How do you use AI, and how do analysts check its work?
- 6What do we receive each month, and will our leaders understand it?
- 7How do you handle our data and logs, and where are they stored?
- 8What independent assurance do you hold for your own security?
- 9How do you onboard us, and how long until coverage is complete?
- 10Can you help with compliance evidence such as ISO 27001 or SOC 2?
- 11What happens during an incident: who leads, who communicates, what is included in the price?
- 12How do we leave, and can we take our data and configuration with us?
Red flags
- Vague promises such as full protection with no detail on what is covered.
- No written response times, or response times that only measure when an alert is acknowledged.
- Dashboards full of alerts but no one who investigates or acts.
- Unwillingness to explain how AI makes decisions.
- Long lock-in with no trial or assessment.
- No clear answer on who has access to your systems.
Comparing proposals fairly
| Question | What good looks like |
|---|---|
| Coverage | A named list of systems and data sources, with gaps stated |
| Response | Time to start investigating and time to act, both written down |
| Authority | Clear list of actions allowed without approval |
| Reporting | Monthly summary in plain language plus detail on request |
| Exit | Data and configuration returned in usable form |
Start with an assessment
A short security assessment lets you see how a provider thinks before you commit. Our security advisory team can help you compare proposals, and our guide to what MDR is explains the service in more detail.
Further reading
Independent sources we recommend for more detail.