How to Choose a VM MSSP Provider


Having the right group of people to run your vulnerability management program is just as important as the actual program itself. Let’s face it; not all companies can keep up-to-date with the latest security trends as technologies continue to advance, all while bringing on more threats.  Most organizations understand this and choose to bring on a Managed Security Services Provider (MSSP) to better their security team (if one already exists) and take over services such as running a vulnerability management program. Choosing a great MSSP is essential to the success of the programs the provider will run – in our case, vulnerability management program.

A Lasting Relationship

There are several essential points to consider when going through the process of choosing an MSSP. First and foremost, an indispensable part of bringing on a team is understanding that this isn’t just a case where you meet and greet, perform a job, and then go separate ways. The relationship between an organization and an MSSP should be long-term as there is never an end to vulnerability scanning. When talking with different providers, you should focus on whether or not the company is taking the time to get to know you and your business. A better understanding of what your company does, your goals for future growth, and what aspects of your business are most will only lead to a better-managed security service. If they aren’t interested in getting to know you, then you should look elsewhere.

An important piece to finish off the remediation process is to rescan the system in order to ensure your fix was effective. One of the last things you want to do is fall under the impression that you have eliminated the risk while it is still secretly lurking in the shadows.

Get to Know the Team

On the other hand, you should always make sure you know the people’s credentials that you propose to run your program. It should go without saying, but you want to bring on a team expert in the security field. Don’t be afraid to ask about members of the team and their respective security skills/expertise and any certifications they hold. If you have a specific area of your business that you know will need more attention, you want to ensure that the team you bring on will effectively handle those responsibilities. Ensure the team keeps up with the latest industry trends and never shies away from regular training to update their skills.

Up to Date Technology Stack

The technology that the team operates on is equally as crucial as the team members themselves. Your MSSP provider should be using the latest technology with advanced analytics designed to catch all of the relevant threats it may come across. Obtain a better understanding of all steps of the system from vulnerability scanning to the remediation process. The relationship between the team and the technology they operate should produce real results with very few hiccups along the way.


A vital part of the relationship between your company and the MSSP is understanding the processes they will take to support your organization. The first thing you should do is discover where they are based. If you are a U.S. based company and can find a provider based out of the U.S., then that is great! However, a lot of MSSPs operate out of India or somewhere else. In addition to this, you should find out how they will handle communicating with your team. You should consider if they will come onsite for face-to-face meetings or will everything take place remotely. If remote communication turns out to be the answer, you need to understand the method they will use to communicate and interact with your team. Always ask questions about their technical and operational processes. Discover if they have a way to exclude devices or hosts that are considered too sensitive to scan. Along with exclusions of devices, you should determine if the MSSP has a process to include specific devices or hosts based on security assessments or reviews necessary to certify them before they’re considered operational. Finally, you should learn more about how they pass on information to you. The importance of the vulnerability management program and remediation results means that monthly summary reports and status update meetings will be crucial to your program’s success. You should understand if they only communicate if there is something important to report. Find out how you can provide your feedback and insert comments or requests if necessary. Uncovering the answers to these questions before picking an MSSP can be the difference between a lasting relationship between the two parties and a relationship that leaves your organization unsatisfied and disappointed with their provider. 

Check Their Reviews

As with just about any physical product or service you may buy in today’s world, reputation and reviews are something that should be checked before forking over the cash. An MSSP that hesitates to provide you with references (if you ask for them) is a provider to avoid. But just getting the references is only the first step in understanding their previous work. Take the time to reach out to their past and current business partners to find out how the relationship with that MSSP has been going. Try to discover if the provider is as reliable as they say they are and if they truly possess the skills and expertise needed to protect an organization’s systems. Get a better understanding of the MSSP team’s responsiveness and how long it takes to contact them if there is ever a problem. Most importantly, find out more about their remediation process and whether or not they have been able to resolve any threats that have been detected. What would that process look like for your organization, and did it seem like the MSSP team saw the threat’s remediation as a top priority are both questions that you should be asking all of the references you contact.

MSSP Customer Base

Along with talking with existing and past customers of the MSSP, make sure most of the MSSP’s customers are similar in company size and industry niche (to an extent) as your own company. The majority of MSSPs are often more effective and efficient in specific fields due to a similarity across the organization servers, common types of breaches, and stored data locations. If you are a smaller sized company, it may be beneficial to avoid MSSPs who primarily work with larger organizations. These larger organizations pay the provider more money, so naturally, the MSSP will prioritize them and any issues they incur ahead of you and your own. If you are a larger company, you don’t want to select an MSSP who only has smaller sized companies as their customers. You may think doing this is a good idea since your organization’s needs should be a priority, but there is a learning curve for MSSP teams that protect larger companies rather than smaller ones. Not that it can’t work out, but in most cases, you don’t want to be the guinea pig for the MSSP.


Always know what the cost of the services is when in talks with an MSSP. But don’t just see the cost. Instead, understand what you will get for that price and how you might terminate the contract. You should always weigh out the cost between competing MSSP teams, but keep in mind that the cheapest doesn’t always mean it’s the worst, and most expensive doesn’t always mean it’s the best. It is essential to find an outstanding balance between the provider’s cost and its value from the relationship you form with them and their services.


Speaking of value, getting a better understanding of the areas of expertise that the MSSP can bring to the table is a great way to discover if that team is right for your organization. Finding out if they are knowledgeable in any particular technology that would result in better service/recommendations is not something that you should overlook. You should also dive in a little deeper and see what they can tell you about your organization’s industry and vulnerability management best practices. They should walk you through the process while explaining areas like API work, scan scheduling, and integrations with other technologies that may be required. If they can’t walk you through this or seem to struggle with doing so, it may be best to look elsewhere. 


There are quite a few steps that go into selecting the best MSSP for your organization. Even though this may seem like a lot of work, passing up on these steps could be detrimental to your company’s security and lifespan. Remember that the relationship built between your organization and the MSSP is a partnership that you intend to last for several years to come. Take the extra time now to know the exact qualities of who you are trusting with your system’s security.

Other Vulnerability Management Articles

How to Choose a VM MSSP Provider

If you are going to do something, you may as well do it right. A poorly designed and constructed vulnerability management program is essentially like having no program at all. Why spend the time, money, and resources putting together a program that won’t meet or exceed the expectations you have in place for it? Read More →

How to Have an Effective Vulnerability Management Process

If you are going to do something, you may as well do it right. A poorly designed and constructed vulnerability management program is essentially like having no program at all. Why spend the time, money, and resources putting together a program that won’t meet or exceed the expectations you have in place for it? Read More →

Why Vulnerability Management is Important

Year after year, cybercriminals take advantage of more opportunities to infiltrate a system’s vulnerabilities. These attackers feast on the systems that show no real signs of cyclical security maintenance and prevention techniques. Read More →

The Best Vulnerability Management Program in 2020

Vulnerability Management is essential. It needs investments in tactics, techniques, and procedures to be a successful program. Read More →