Guide
A plain guide to managed security services
What to ask before you buy managed security, managed SOC coverage, or a retainer that claims to include both.
Published May 19, 2026 · 1 min read
Managed security services is a wide label. It can mean a tool with a logo on your slide, a mailbox that receives alerts, or a team that knows your environment and will act at night. The contract should say which one you are buying.
Questions that sort the offer
- Which systems are in scope, and which are explicitly out?
- Do you bring the tooling, or operate what we already own?
- Who is allowed to contain an incident, and who must they call first?
- What does the monthly review contain, in writing?
- How are after-hours severities defined, with examples?
- What happens to our data and runbooks if we leave?
A healthy split
Advisory work, implementation, and ongoing monitoring are different jobs. Cybersecurity consulting can design the program. A project can put the controls in. Managed SOC services can watch them. Folding all three into one vague retainer makes it hard to tell whether you are staffed for an incident. Ask for the split even if one company, including ours, can do all three.
Bring this list to any provider. If the answers are clear, you can compare them. If they are theatrical, you have learned something before the signature.