Managed security services: when outsourcing makes sense for SMEs

The short answer: when outsourcing makes sense

Outsourcing security operations makes sense when security tasks come up regularly but nobody in the company has the time or expertise to handle them reliably. Typical signs are a lack of dedicated security staff, a growing number of tools and alerts, and requirements from NIS2, insurers or customers that call for evidence.

With managed security services, a provider, often called an MSSP (managed security service provider), takes over the ongoing operation and monitoring of your security systems within an agreed scope. What it does not take over is responsibility for your risks. That stays with the company, and a good contract makes the split explicit.

Five signs it is time to outsource

• No dedicated security staff: IT is handled alongside another job, or your IT provider mainly covers the helpdesk.
• More tools, more alerts: firewall, endpoint protection, backup and Microsoft 365 each send their own messages, and nobody has the full picture.
• Updates keep slipping: there is no fixed schedule, and patches are installed whenever someone happens to find the time.
• External requirements: NIS2, cyber insurance questionnaires or supplier audits by your customers ask for evidence you cannot easily provide.
• Growth or a near miss: new sites, more staff or an incident that only ended well by luck have exposed gaps.

If several of these apply, it is worth taking a serious look at outsourcing. The aim is not to hand over everything, but to make sure that recurring tasks are done reliably.

What managed security services typically include

The scope varies from provider to provider, but most offerings are built from the same components:

• Monitoring: firewall, endpoint protection and backup are monitored, including health, licences and configuration.
• Alert triage: alerts are sorted by relevance, suspicious activity is investigated and agreed steps are initiated. Our article on antivirus, EDR, XDR and MDR explains how the detection technologies differ.
• Patch management: operating systems, applications and firmware are updated to a plan. Our article on patch management explains what matters.
• Backup checks: backups are monitored and restores are tested regularly.
• Vulnerability scans: recurring scans reveal new gaps, which are then closed by priority.
• Reporting: regular, plain-language reports show what has happened and what is still open.

Common extensions include round-the-clock MDR from specialised providers, central log analysis with a SIEM, awareness training and the inclusion of cameras or access control systems on the network. Round-the-clock monitoring is a separate service component, so ask for it explicitly if you need it.

What stays with the company

Outsourcing transfers tasks, not responsibility. Management remains accountable for information security, and for organisations within the scope of NIS2 this responsibility of the management body is even set out explicitly. In practice, the following stay with you:

• Decisions on risks, priorities and budget.
• Approval of maintenance windows and of changes that affect day-to-day operations.
• Telling the provider who joins, who leaves and who needs different access rights.
• Decisions in an emergency, such as taking systems offline or involving the insurer and the police. Reporting obligations, for example under the GDPR, also remain with you as the controller.
• Staff awareness and compliance with internal rules.

How to evaluate a managed security provider

A good proposal answers the following points in writing and in concrete terms:

1. Clear scope: which systems, sites and devices are included, and which are explicitly excluded?
2. Service levels in the contract: service hours, response times by severity and contact channels are set out in the contract, not just promised verbally.
3. Escalation: there is an emergency contact list, a clear order of who is informed when, and an agreement on which actions the provider may take without asking first, such as isolating a device.
4. Reports: content, frequency and language are defined. A sample report before you sign shows whether management can actually work with it.
5. The provider's own security: remote access is protected with MFA, assigned to named individuals and logged. A provider with access to many customers is an attractive target in its own right.
6. Data protection: a data processing agreement under the GDPR governs how the provider handles personal data.
7. Exit: when the contract ends, documentation, configurations, credentials and licences are handed over in an orderly way. Admin accounts and licences should be registered to your company.

Fully managed or co-managed: two operating models

In a fully managed model, the provider handles all security operations. This suits businesses without their own IT staff. In a co-managed model, internal IT or your existing IT provider keeps day-to-day support, and the security provider takes on defined security tasks. In both cases, responsibilities should be written down, ideally in a simple table showing who does what.

A sensible start is an assessment of the current state. Urgent gaps, such as missing MFA or an untested backup, are closed first. After that, the scope is agreed and extended step by step, beginning with the most important systems.

Conclusion: outsource the tasks, keep the responsibility

Managed security services help when security tasks are piling up and nobody has the time to deal with them properly. They work best when scope, service levels and responsibilities are clearly agreed and the company stays involved. If you would like to find out which tasks are worth outsourcing in your case, Q-entra starts with an assessment and then agrees the scope of managed security with you.