This is a conversation I have regularly with companies that are growing out of the "we have an IT guy" phase and into the "we need real security" phase.
Most small and mid-size companies use a Managed Service Provider for IT. The MSP sets up laptops, manages the network, handles email, deals with printers, and keeps the lights on. They're valuable. They solve real problems. And for many companies, the MSP relationship is the first time they've had any kind of structured IT support.
But most MSPs are not equipped to manage your security program. That's not a knock on MSPs. It's a different skill set, a different set of tools, and a fundamentally different operating model.
The confusion between IT operations and security operations is one of the most expensive misunderstandings in small business cybersecurity. And it shows up at the worst possible time: when something goes wrong, when a customer asks a hard question, or when an auditor walks in the door.
What MSPs typically do well
MSPs are IT operations companies. Their core competency is keeping your technology running and your users productive.
- Deploy and manage devices — provisioning laptops, installing software, managing the device fleet, and handling new hire IT setup (and some offboarding).
- Set up and maintain networks — configuring routers, switches, access points, VPNs, and firewalls, and troubleshooting connectivity and bandwidth.
- Manage email and collaboration platforms — administering Microsoft 365 or Google Workspace, email accounts, distribution lists, and shared drives.
- Handle day-to-day IT support — password resets, printer issues, and the general help desk function.
- Patch operating systems — running automated OS patching and, in some cases, application patching.
- Handle basic security tooling — deploying antivirus and basic endpoint protection, and offering basic firewall management and network monitoring.
This is legitimate, necessary work. A good MSP makes your company more productive and reduces the IT burden on your team. Every company needs IT operations.
What MSPs typically don't do
Security is a different discipline. The skill set, tools, frameworks, and mindset are different from IT operations. Here's what falls outside most MSPs' capabilities:
Build and manage a security program. A security program includes risk assessment, policy development, control design, compliance framework alignment, and ongoing governance. This requires knowledge of security frameworks (SOC 2, ISO 27001, HIPAA, HITRUST), risk management methodology, and how to build controls that satisfy both security objectives and audit requirements. Most MSP engineers are trained in IT infrastructure, not security frameworks.
Run compliance. SOC 2, ISO 27001, HIPAA, and HITRUST require someone who understands the requirements, can map controls to criteria, prepare evidence, coordinate with auditors, and manage the ongoing compliance program. Companies that ask their MSP to handle SOC 2 readiness often end up with a control matrix that doesn't map to the criteria correctly, and pay twice: once for the MSP's attempt, again for a qualified advisor to do it correctly.
Respond to security incidents. An MSP can re-image a machine, reset passwords, and restore from a backup. What they typically can't do: run a forensic investigation into what data was accessed and how the attacker got in, coordinate legal counsel and regulatory obligations, determine whether the incident triggers breach notification requirements, or manage customer communications during an active incident.
Conduct risk assessments. A meaningful risk assessment requires understanding your business context, identifying threats relevant to your industry and size, evaluating likelihood and impact, and recommending controls that balance security, cost, and operational impact. Most MSPs can tell you what vulnerabilities exist in your network. They can't contextualize those vulnerabilities against your business risk and regulatory requirements.
Answer security questionnaires. The MSP can answer the technical questions (antivirus, network configuration, patching schedule) — maybe 30% of a typical questionnaire. The other 70% requires knowledge of your risk assessment methodology, vendor risk management, incident response process, and tabletop exercise history. That's not the MSP's job.
Manage vendor risk. Evaluating the security posture of third-party vendors, reviewing SOC 2 reports, assessing BAA compliance, and maintaining a vendor risk register is security program work, not IT operations work.
Advise leadership on security investment. When the CEO asks “are we secure?” the MSP can say the systems are patched and antivirus is up to date. They can't say whether the company's overall risk posture is appropriate for its size and industry, or where the next dollar of security investment will have the most impact.
Where the gap shows up in practice
The gap between IT operations and security operations usually becomes visible in one of four ways. And it's always at an inconvenient time.
A customer sends a security questionnaire. The sales team forwards it to the MSP. They can fill in the technical specs, but the governance and program questions go unanswered or get marked “N/A” — which signals you don't have a program at all.
An auditor shows up. During a SOC 2 or ISO 27001 audit, the auditor asks about control design, policy implementation, and operating effectiveness. The MSP can provide technical evidence but can't speak to how the controls were designed, why they were chosen, or how they're monitored for effectiveness.
A security incident occurs. The MSP runs their standard playbook: isolate the machine, run a scan, re-image if necessary. But the business questions go unanswered — what data was affected, do we need to notify customers, is this a reportable breach, what do we tell the board.
A prospect or partner asks about your security posture. Not a formal questionnaire, just a conversation: “How do you handle security?” If the answer is “we have an MSP,” that tells the prospect you have IT support. It doesn't tell them you have a security program.
The right model
IT operations and security operations are complementary but distinct. You need both. The best setup for most companies between 10 and 100 employees is an MSP for IT operations and a vCISO or security advisor for the security program.
The MSP keeps your systems running. The vCISO keeps your security program running. They work together, share information, and coordinate on implementation, but they own different things.
The MSP deploys the MDM. The vCISO defines the device security policy that the MDM enforces. The MSP configures the firewall. The vCISO evaluates whether the configuration meets compliance requirements and aligns with the company's risk profile. The MSP resets passwords and manages user accounts. The vCISO ensures there's an access management process with reviews, documentation, and audit-ready evidence. The MSP deploys endpoint protection. The vCISO monitors the alerts, triages findings, and manages the response process.
This model gives you operational IT efficiency from the MSP and strategic security leadership from the vCISO. Neither is trying to do the other's job. Both are working in their area of expertise.
How to test whether you have a gap
If you're currently relying on an MSP and you're not sure whether your security needs are covered, here's a simple test:
Ask your MSP to answer a security questionnaire from one of your customers. Give them the full questionnaire, not just the technical sections. See how much they can answer completely and accurately.
If they can answer 80% or more with specific, defensible responses, you have an unusually capable MSP with real security expertise. That's rare, but it exists.
If they can answer the technical sections but struggle with governance, risk management, compliance, and program-level questions, you have a typical MSP doing a great job at IT operations. You need a security advisor to handle the rest.
If they can't answer much of it at all, you have an IT support provider, not an MSP with security capabilities. That's fine for what it is, but you need to be honest about what's covered and what's not.
The cost comparison
A common objection: "I'm already paying my MSP $8,000 a month. I can't afford a vCISO on top of that."
But the question isn't whether you can afford it. The question is what it costs you to not have it.
A failed security questionnaire that kills a $200,000 deal costs more than a year of vCISO services. A ransomware incident without proper response and cyber insurance coordination costs $50,000 to $200,000 in recovery. A SOC 2 audit that has to be redone because the readiness work was done incorrectly costs double. A customer data breach without a proper incident response plan costs everything.
Most vCISO engagements for companies this size run $3,000 to $8,000 per month. That's a fraction of the MSP spend and it covers a fundamentally different set of capabilities. The vCISO pays for itself the first time you close a deal that required a credible security posture, or the first time you avoid an incident that would have cost you six figures.
The bottom line
Your MSP is valuable. Keep them. They solve real problems and they make your company more productive. But stop assuming that IT operations equals security operations. They're different disciplines with different skill sets, and your company needs both.
If you're paying an MSP and assuming security is handled, test that assumption. The result will tell you whether you have a gap. And if you do, it's better to find out now than during a customer audit, a security incident, or a sales process where the answer to "how do you handle security" determines whether you get the contract.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.