The Ashimmy Blog: Why MSSPs are going to rule the SMB/SME roost

I don't think there are too many people who disagree agree that the MSSP model of providing security is a valid and growing segment of the security business. Recently, I have been giving a lot of thought as to whether this is just a pendulum type of swing that will soon swing the other way or if it is more fundamental. I am coming to the conclusion that it is more fundamental. To be clear I am not talking about SaaS. I think there is a big difference between what a company like Qualys does in SaaS and what a true MSSP does. When I say MSSP, I mean actively managing the security, not just providing software over the web.

Here is a great illustration of why I think the MSSP model is fundamentally here to stay and right for a certain segments of the market. Last night we went over a friends house for a social gathering. I was speaking to one of the guys there who I see maybe once or twice a year. He again asked me what it is I do for a living (how many security people get that question often). That brought up the whole topic of computer security.

This gentleman runs a business that signs up people for satellite TV services among other things and than is certified installer for these services. Some of us I am sure have received spam from some of the less scrupulous in that field. This guy has been at it for many years and has a very successful business. He told me because he "takes credit cards and all that" he was told he needed to have security. "You know firewall and intrusion prevention and all that", was what he told me. He looked into using open source security tools that were "free". His tech people couldn't make that work. He looked at commercial products too. Besides the cost of buying the product, the time and expertise needed to make them run was beyond his IT people and not really what he wanted them working on. Through the data center where he hosted his web servers he was turned onto an MSSP. For between 500 and 1000 dollars a month "they protect him 24/7 and he doesn't have to worry about it". For this businessman, it was a no brainer. You know what, given this set of facts, it is a no-brainer. Unless or until something fundamental changes in that equation, the MSSP model is here to stay.