How to Choose an MSSP in 2025: 4 Costly Mistakes to Avoid (and Why an In-House SOC Costs 5x More)

Cyber threats now change faster than fashion trends. In that environment, deciding how to protect your company is a strategic imperative, not just another line in the IT budget.

A growing number of Polish companies are outsourcing security to specialized Managed Security Service Providers (MSSPs). The problem is that the market is full of traps, and the most "obvious" choices often turn out to be expensive mistakes.

We reviewed strategic trends and industry documents and pulled out four counterintuitive lessons you need to know before you sign a contract.

---

1. An In-House SOC Costs 5-6 Times More Than You Think

If you are thinking about building an in-house Security Operations Center (SOC), take your estimate for one analyst position and multiply it by 5 or 6.

Why? Attackers don't take weekends off or worry about overtime. Statistics show that critical attacks often start on Friday afternoons. Running operations 24/7/365 means hiring at least 5-6 analysts to cover a single full-time seat on a shift rotation that accounts for vacations, training and absences. That creates huge fixed costs and a serious retention problem, given the severe talent shortage in the market.

(For a detailed TCO breakdown, see our report: SOCaaS or an In-House Team? A Cost Analysis)

"Thanks to economies of scale, an MSSP can deliver the same or better monitoring quality for a fraction of the cost of the in-house model."

MSSPs spread these costs across many clients and can offer specialists better career paths. Paradoxically, that makes them the cheaper and more stable option for most organizations with fewer than 2,000-3,000 employees.

2. An MSP Is Not an MSSP: The Conflict-of-Interest Trap

Many decision makers confuse Managed Service Providers (MSPs, which focus on IT) with Managed Security Service Providers (MSSPs). That mistake can have serious consequences.

The difference is in their DNA:

• An MSP (NOC) is measured on uptime (business continuity).
• An MSSP (SOC) is measured on security and integrity (protecting assets).

When the same IT administrator (the MSP) both configures a system and monitors it for security, it creates a dangerous conflict of interest. The administrator may have configured the system insecurely for convenience (for example, by opening a port), and may then overlook that mistake in the logs, or even try to hide it. An MSSP acts as an independent watchdog (Segregation of Duties) and actively looks for errors, including those made by your internal IT team.

3. NIS2: Outsourcing Doesn't Remove the Board's Personal Liability

Now that the NIS2 Directive is being written into Polish law through the amended National Cybersecurity System Act (KSC), choosing an MSSP is also a legal decision. The most important change is that the new rules make board members directly and personally liable for failing to put adequate security measures in place.

What does this mean in practice? Outsourcing to an MSSP does not release you from liability. It only changes your role from executing security to overseeing it. You still have to actively verify and audit the partner you trust with your protection.

You have to audit your auditor. You also need to confirm that the provider meets regulatory requirements itself, for example by holding ISO 27001 and, most importantly, a SOC 2 Type II report. SOC 2 Type II is the gold standard because it proves that security controls actually worked over the past 12 months, rather than offering a one-time "snapshot."

4. "15 Minutes" Is a Myth: What Matters Is the 1-10-60 Rule

The standard SLA (Service Level Agreement) promise of a "15-minute response time" is worthless in most cases. Often it only measures how long it takes an automated system to confirm that it has received an alert.

The real measure of an MSSP's value is not "response time" but Time to Meaningful Response, along with its ability to eliminate threats quickly. This is where the industry benchmark comes in: the 1-10-60 Rule:

• 1 minute to detect a threat.
• 10 minutes to fully investigate it and confirm its scope.
• 60 minutes to remediate it (isolate the compromised system and remove the intruder).

When choosing an MSSP, reject offers built on "vanity" metrics, such as log volume processed or ticket acknowledgment time. Demand guarantees based on MTTD/MTTR (Mean Time to Detect/Respond) and the ability to actively contain attacks (the MDR model, Managed Detection and Response), which goes well beyond passively forwarding notifications.

---

Looking for the Right Managed Security Provider?

If you are choosing an MSSP, planning to outsource cybersecurity or want to audit your current provider, contact us. We'll help you choose the right model (full outsourcing, co-managed or MDR) for your budget, infrastructure and NIS2 obligations.

What We Offer

• MSSP strategy consulting - needs assessment and a recommendation for the right model (in-house SOC vs. outsourcing vs. hybrid)
• RFP (Request for Proposal) preparation - help writing an effective request for proposal for MSSP vendors
• Audit of your current MSSP - review of service quality, procedures and certifications (ISO 27001, SOC 2 Type II)
• Proof of Concept (PoC) - vendor testing before you choose a final partner
• MSSP relationship management - optimization of SLAs, reporting and the working model
• NIS2 compliance support - aligning security outsourcing with regulatory requirements

📧 Talk to an MSSP expert →

Related Reading

Security Operations Articles

• SOCaaS or an In-House Team? Cost and ROI Analysis - A detailed TCO comparison for Polish companies
• Security Operations Center (SOC): The Complete 2026 Guide - How to build your own SOC or choose a co-managed model with an MSSP
• SIEM vs. XDR: Which Is Right for Your Business? - A comparison of the technologies MSSPs offer
• SOAR: Security Operations Automation - How MSSPs use automation to work more efficiently
• Threat Hunting: An Advanced Guide - Proactive threat hunting as a premium MSSP service

Compliance and Risk Management

• NIS2 in Poland: The Complete Guide - How outsourcing to an MSSP supports NIS2 compliance
• Incident Response Plan: How to Prepare Your Company for a Cyberattack - The MSSP's role in incident response under NIS2

Aleksander

Sources:

• MSSP vs In-House SOC: A Full Comparison - Corsica Technologies
• MSSP vs. SOC: 6 Key Differences and How to Choose - Cynet
• Fighting Cybercrime: New Obligations for Businesses Under the NIS2 Directive | Biznes.gov.pl
• The 1/10/60 Minute Challenge: A Framework for Stopping Breaches Faster - Splunk .conf
• ISO 27001 vs. SOC 2: Understanding the Difference - StrongDM

FAQ

What is the difference between an MSSP and an MSP?

An MSP (Managed Service Provider) is a managed IT provider that handles day-to-day infrastructure operations: servers, networks, workstations and the help desk. An MSP runs a NOC (Network Operations Center), whose main goal is uptime, meaning systems keep running. An MSSP (Managed Security Service Provider) is a specialized security provider that runs a SOC (Security Operations Center), a 24/7 security monitoring center whose goal is detecting and neutralizing threats. The key difference: an MSP aims for "everything works," while an MSSP aims for "everything is secure." The conflict of interest: the same IT administrator who configured a system (perhaps poorly, for convenience) should not monitor it for security, because there is a risk they will hide their own mistakes. An MSSP acting as an independent auditor (Segregation of Duties) removes this problem.

How much does a 24/7 in-house SOC really cost?

Building an in-house SOC costs far more than one analyst salary. You need at least 5-6 analysts to cover one full-time seat on a shift rotation, because 24/7/365 coverage has to include weekends, nights, vacations, sick leave and training. A sample breakdown of annual costs: Staff: 5-6 Tier 1/2 SOC analysts at PLN 120-180k each = PLN 600-900k/year; 1-2 Tier 3 experts at PLN 200-250k each = PLN 200-500k/year; 1 SOC Manager at PLN 180-250k = PLN 180-250k/year. Infrastructure: SIEM/XDR licenses PLN 200-800k/year, Threat Intelligence feeds PLN 100-300k/year, training and certifications (SANS, GCIA) PLN 50-150k/year. TOTAL: PLN 1.3-2.9 million/year for a small to mid-sized SOC. An MSSP delivers comparable quality for 20-40% of that cost (PLN 300-800k/year) because it spreads economies of scale across many clients. For companies with <2,000-3,000 employees, an in-house SOC makes no economic sense.

Does outsourcing to an MSSP release me from NIS2 liability?

Absolutely NOT. The NIS2 Directive (implemented in Poland through the amended National Cybersecurity System Act, or KSC) makes board members directly and personally liable for cybersecurity negligence. Outsourcing to an MSSP does not remove that liability. It only shifts your role from execution to oversight. You remain responsible for: (1) Due diligence when selecting a provider (verifying certifications, references and compliance with Article 8 of the Act), (2) Overseeing contract performance: regular audits, report reviews and tests of incident response procedures, (3) Vendor risk management: the MSSP itself has to be audited as part of your supply chain, (4) Verifying effectiveness: PoCs, penetration tests and tabletop exercises. You have to audit your auditor! Failing to provide oversight means personal liability for the board, even if it was the MSSP that failed.

How do I verify that an MSSP is trustworthy?

You verify an MSSP through a combination of certifications, audits and hands-on testing. Certifications (must-have): (1) SOC 2 Type II: the gold standard. It proves that security controls actually worked over the past 12 months, rather than only existing on paper as with SOC 2 Type I. Type II verifies effectiveness over time, not just design. (2) ISO 27001: information security management. (3) ISO 9001: process quality (optional). Due diligence: Check references from clients in your industry and visit the provider's SOC (does it physically exist? What does it look like?). Check the team: what is the analyst turnover rate? What certifications do they hold (GIAC, OSCP, GCIH)? Proof of Concept (PoC): Before signing, run a 30-90 day test with real data, carry out a simulated attack (Red Team) and check whether the MSSP detected it and responded according to the 1-10-60 rule. A PoC is mandatory, not optional.

What is a co-managed SOC?

A co-managed SOC (hybrid model) is one where responsibility for security is shared between the client's internal team and an external MSSP. A typical split: The MSSP (outsourced) handles Tier 1 (24/7 monitoring, alert triage, first response), the technology platform (SIEM/XDR/SOAR infrastructure, licenses and maintenance) and Threat Intelligence (threat feeds and detection rule updates). The client (in-house) keeps Tier 2/3 (advanced analysis, threat hunting, strategic incidents), domain expertise (deep knowledge of the business, applications and infrastructure) and escalation decisions (when do we take a production server offline? Do we pay a ransomware demand?). Advantages: Lower cost than a fully in-house SOC (you need only 1-2 senior analysts instead of 5-6 junior ones), control over strategic decisions, and better knowledge of the environment than with full outsourcing. Best for: Mid-sized and large companies (500-5,000 employees) that need flexibility and don't want to give up control entirely.

What does full outsourcing (Full MSSP) look like?

Full outsourcing (Full MSSP / MDR, Managed Detection and Response) means the MSSP takes full operational responsibility for security, so the client doesn't need its own SOC analysts. The MSSP provides: 24/7/365 monitoring across all layers: endpoints (EDR/XDR), network (NDR), cloud (CSPM/CWPP) and identity (UEBA); Platform as a service: SIEM/XDR delivered and managed by the MSSP (often as SaaS); Detection and response: alert analysis, incident investigation and active response (isolating endpoints, blocking IPs, removing malware); Reporting: periodic executive and compliance reports (NIS2, GDPR); Threat Intelligence: access to global threat feeds. Advantages: The lowest cost for small and mid-sized companies (20-40% of the cost of an in-house SOC), no analyst hiring or retention problems, immediate access to experts, and scalability. Disadvantages: Less control, dependence on the provider, and potentially slower response to incidents that require business context. Best for: Small and mid-sized companies (<500 employees), companies without in-house SOC expertise, and NIS2-regulated entities that need to reach compliance quickly.

What is the 1-10-60 rule, and why does it matter more than a "15-minute response"?

The 1-10-60 rule is an industry benchmark for SOC effectiveness (cited at Splunk .conf). It defines how quickly an organization should detect, investigate and neutralize a threat: 1 minute is the maximum time to detect the threat (detection), 10 minutes is the maximum time to fully investigate it and confirm the scope of the incident (investigation, triage), and 60 minutes is the maximum time for remediation: isolating the compromised system and fully removing the intruder. Why does this matter more than a "15-minute response" SLA? Because standard SLAs often only measure the time it takes for an automated system to acknowledge an alert, not the time to a MEANINGFUL response by a human. The real measures are MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). When choosing an MSSP, require a commitment to the 1-10-60 rule or a similar SLA based on time to remediation, not time to acknowledgment. Otherwise, you may get "acknowledgment within 15 minutes" while the intruder isn't removed for 48 hours.

Which KPIs should I track with my MSSP?

Measure your MSSP with specific, measurable operational and business KPIs, not vanity metrics such as "number of logs processed." Operational KPIs: (1) MTTD (Mean Time to Detect): average time to detect a threat [target: <10 min for critical alerts], (2) MTTR (Mean Time to Respond): average time to respond and remediate [target: <60 min, in line with the 1-10-60 rule], (3) False Positive Rate: share of false alarms [target: <15%, ideally <10%], (4) Dwell Time: average time an intruder stays undetected in the network [target: <24h, ideally <4h], (5) Alert Closure Rate: share of incidents closed within a set time (e.g. 95% in <4h). Business KPIs: (6) NIS2-reportable incidents: the number of incidents that had to be reported to a CSIRT (did the MSSP help you meet the 24/72-hour deadlines?), (7) SLA Compliance: the percentage of agreed SLAs met, (8) Analyst Availability: whether a senior (Tier 3) analyst is available during a critical incident. Report monthly and escalate to the board quarterly. Require the MSSP to provide a dashboard with live KPIs.

Can I use an MSSP and keep my own IT team?

Yes, and this is the recommended model for most companies. The MSSP handles security (SOC) and your internal IT team or MSP handles operations (NOC), so there is no conflict. Division of responsibilities: Your IT team/MSP (NOC): infrastructure management (servers, networks, workstations), systems administration (Active Directory, Exchange, cloud), help desk and user support, updates and patching (coordinated with the MSSP), and backup and disaster recovery. The MSSP (SOC): 24/7 security monitoring (logs, alerts, behavioral anomalies), threat detection and incident investigation, attack response (isolation, blocking, malware removal), incident reporting (NIS2 compliance), and threat hunting and vulnerability management. How they work together: The MSSP audits the IT team's work (Segregation of Duties), for example by detecting that an administrator opened a dangerous port or misconfigured a firewall. This eliminates the conflict of interest and improves security. The IT team and the MSSP should work together regularly on remediation (for example, the MSSP detects an issue and IT applies the patch).

How long does MSSP onboarding take?

Onboarding time depends on the service model and the complexity of your environment, but typical timelines are: MDR/full outsourcing (small or mid-sized company): 2-6 weeks. Phase 1 (weeks 1-2): kickoff, environment discovery (inventory of assets, applications and integrations), and installation of EDR/XDR agents on endpoints. Phase 2 (weeks 3-4): integration setup (SIEM, firewall, cloud logs), baselining normal activity (training AI/ML models), and tuning detection rules to the client's environment. Phase 3 (weeks 5-6): PoC testing (simulated Red Team attacks), training the client's team (escalation procedures, collaboration), and go-live with full 24/7 monitoring. Co-managed/hybrid model (mid-sized or large company): 2-4 months. Added complexity includes integrating with the client's existing SOC/SIEM, defining Segregation of Duties (who is responsible for what?), adapting processes and playbooks, and training the internal Tier 2/3 team. The critical factor: The more complex the environment (OT/ICS, multi-cloud, legacy systems), the longer baselining and tuning take, sometimes 6+ months. Question to ask the MSSP: "What is your typical time to value for a client my size?"

What should I do if my MSSP is failing?

If your MSSP isn't meeting expectations, act quickly, because every day of weak monitoring raises the risk of an undetected attack. PHASE 1 - Diagnosis (weeks 1-2): Gather concrete evidence of problems (missed alerts, delayed responses, missing reports), compare actual KPIs with the agreed SLAs (MTTD, MTTR, FPR, availability), run a control test such as a simulated attack (did the MSSP detect it?), and hold an escalation meeting with the provider's Account Manager and SOC Manager. PHASE 2 - Remediation (weeks 3-4): Require a Corrective Action Plan (CAP) from the MSSP with specific steps and a timeline, consider temporarily moving critical alerts to internal triage (if you have a team), and tighten oversight with daily check-ins and weekly KPI reviews. If nothing improves, escalate to the provider's C-suite. PHASE 3 - Exit strategy (months 2-3): Start an RFP for alternative providers in parallel (don't wait for a complete breakdown!), run a Proof of Concept with 2-3 new candidates, plan a smooth migration (avoid monitoring gaps: the new MSSP must be in place before the old one leaves), and terminate the contract in line with the notice period (typically 30-90 days). Remember: An MSSP contract should include exit clauses: audit rights, KPI benchmarking, and the right to terminate without penalty if SLAs are missed for 2-3 months.

Do small businesses need an MSSP?

Yes. Small businesses often need an MSSP MORE than large ones, because: (1) They have no SOC analysts of their own: building an in-house SOC costs at least PLN 1.3-2.9 million/year, which makes no sense for companies with <500 employees, (2) They are just as attractive a target: ransomware hits everyone, not just large enterprises, and small businesses are easier targets, (3) NIS2 requirements: many small and mid-sized companies (50+ employees, EUR 10 million+ in revenue) fall under the directive and need 24/7 monitoring, (4) Lack of expertise: a typical IT administrator at a small company is not a cybersecurity analyst. Recommended model for small businesses: MDR as a Service, a fully outsourced MSSP offering 24/7 monitoring, EDR/XDR, detection and response, and compliance reporting. Cost: USD 2,000-5,000/month (PLN 8-20k/month), depending on the number of endpoints and complexity. That is 20-30% of the cost of hiring one analyst, and you get an entire 24/7 SOC team with access to Threat Intelligence and experts. Alternative: "MDR lite" for micro businesses (<50 employees), simplified protection (EDR plus a managed service) for USD 1-2k/month. Bottom line: For small businesses, an MSSP is a necessity, not a luxury, especially under NIS2.

---

Conclusion: You're Buying a Partnership, Not a License

In 2025, security is a battle of speed and expertise, and an internal team often can't deliver either around the clock. The right MSSP becomes a strategic extension of your company and shifts your security from passive prevention to active defense.

Remember that your RFP should focus on processes and people (L1/L2/L3 staff turnover, report quality), not just license pricing. Always insist on verification through a Proof of Concept (PoC). Success depends on trust, but that trust has to be backed by certifications and measurable metrics.