The masses are often confused by the terms "MSP" and "MSSP". They may think there's no difference because the two are differentiated only by an extra letter.

Adding to the confusion, many services do overlap between the two classifications.

Let's start by defining each term and then digging into the similarities and differences between them.

What is the role of an MSP?

Traditionally, an MSP (managed service provider) has been the replacement for your internal IT department.

The MSP is focused on the day-to-day IT operations, including service desk, installing software patches, and data backup and disaster recovery.

What is the role of an MSSP?

A traditional MSSP (managed security service provider) focuses on security and security only. Common services include security operations center (SOC), managed detection and response (MDR), and security information and event management (SIEM).

What is the difference between an MSP and MSSP?

The traditional MSP is not interested in the risk associated with security services, which may be outsourced to an MSSP. Security seeps into every aspect of technology, so it's not as if an MSP can draw a line in the sand and refuse to touch anything security-related. But an MSP's focus remains on IT, not on security.

The traditional MSSP relies on an MSP or internal IT to handle the day-to-day operations so that the MSSP can focus on security.

Many MSPs have partnership agreements with MSSPs (and vice versa) so that they can work together to serve all their clients' needs.

What are the similarities between MSP and MSSP?

As MSPs grow, they are able to take on more MSSP responsibilities, giving their clients more value with fewer vendors.

Many modern MSPs perform the duties of an MSSP but still call themselves only an MSP, creating more confusion about these terms.

Is Sagiss an MSP or an MSSP? 

Sagiss started as an MSP over 25 years ago.

But in 2018, we began adding more security services to our portfolio. We focused on the services that added the most value for our clients, being:

• End user security training.
• Next-generation antivirus.
• Vulnerability management.
• Multi-factor authentication.
• Password managers.