The most common question from SMB owners shopping for an MSSP isn't about price or scope — it's some version of: "What do you actually do all day?"Fair question. The work is mostly invisible by design. When the MSSP is doing its job, very little reaches you directly. Here's what's happening behind the scenes.
The Five Categories of MSSP Work
Every activity an MSSP does fits one of five buckets:
- Prevent — deploy and tune controls (EDR, email security, MFA, training)
- Detect — 24/7 monitoring of endpoints, email, identity, network
- Respond — contain threats in real time, kick attackers out, preserve evidence
- Recover — restore from backup, rebuild compromised systems
- Report — translate technical activity into business language for leadership
Prevent and report are scheduled work. Detect is continuous. Respond and recover are situational — sometimes weeks pass without triggering them, sometimes both run hard for 48 hours straight.
A Quiet Week — What's Actually Happening
On a week with no incidents, an MSSP is still working continuously on your behalf. The cadence:
Continuous (24/7)
SOC analysts triage incoming alerts from EDR, email security, identity systems, and network sensors. Most are false positives or low-severity events that get quickly closed; a handful require investigation.
Daily
Sign-in audit (any logins from unusual geographies or impossible-travel patterns), backup verification, patch coverage check, new vulnerability disclosure review.
Weekly
External vulnerability scan, phishing simulation deployment to a subset of users, configuration drift check across cloud tenants, threat-intel review for your industry.
Monthly
Authenticated internal scan, training module rollout, MFA coverage audit, OAuth app review, executive report drafted and delivered.
Quarterly
Configuration review across M365 / Workspace / endpoint baseline, tabletop incident exercise (rotating scenarios), risk register update, leadership review meeting.
If you total this up across a year for a 25-person SMB, it's hundreds of hours of work — most of which prevents an incident from ever happening, which is precisely why you don't notice it.
An Active Incident — Hour by Hour
When something real fires, the cadence changes immediately. Here's a real timeline structure for a ransomware detection event:
EDR fires a high-confidence alert — ransomware encryption pattern on a Windows laptop.
SOC analyst confirms the detection. EDR auto-isolates the device from the network.
IR lead paged. Initial triage starts. Affected user contacted by phone (not email, in case email is compromised).
Investigation: how did it land, what else might be affected, is it spreading. Scope expanded to nearby devices for proactive containment.
Client owner briefed by phone. Insurance carrier notified per playbook. Forensic snapshots taken.
Root cause identified — phishing email + credential reuse. Eradication starts: kill processes, remove persistence, reset credentials.
Containment confirmed. Recovery begins: rebuild the affected device, restore data from clean backup, verify integrity.
Device back in service. Post-incident review meeting scheduled. Written incident report delivered to insurer and client.
Heightened monitoring continues. Lessons-learned session updates runbooks, training, and controls. Phishing simulation specifically targeting the failure pattern.
What You Should Expect to See as a Client
A well-run MSSP relationship feels like this from your side:
- Quarterly review meetings — short, focused, with a clear report and three priorities
- Monthly executive summary in your inbox — readable in 10 minutes
- Occasional phone calls about user-facing events (a phishing test failed, a password needs reset, suspicious login flagged)
- Immediate notification of significant events — never via email when something is on fire
- Updates after any incident with what happened and what changed as a result
- A "here's what we found, here's what we're doing" rhythm — never radio silence
What you should notsee is a dashboard URL you're supposed to interpret yourself. If your security partner's primary deliverable is "here's a link, log in whenever", that's software, not service.
The Bottom Line
A good MSSP does a lot of work you never see, runs hard when something burns, and tells you about it in clear language afterwards. The point isn't the activity volume — it's the absence of surprises. You should know roughly what's being done, why it matters, and what your role is in the loop.
Related reading: the complete MSSP guide for SMBs, how to choose a cybersecurity partner, and the first 24 hours after a breach.
Frequently Asked Questions
What does an MSSP do?
An MSSP runs five categories of work for your business: prevent (deploy and tune controls), detect (24/7 monitoring of endpoints, email, identity, network), respond (contain threats in real time), recover (restore from backup, rebuild compromised systems), and report (translate technical activity into business language). All without you having to hire and manage a security team.
Is the MSSP active every day, even when nothing happens?
Yes. Even on quiet weeks, the SOC reviews alerts, tunes detections, applies patches, runs vulnerability scans, manages MFA exceptions, audits new logins, and reviews mailbox rule changes. Quiet weeks are quiet because the work is being done.
What happens when there's an active incident?
Within minutes of detection, the SOC isolates affected systems, revokes compromised sessions, and stops lateral movement. An IR lead briefs leadership. The team works the incident — sometimes hours, sometimes days — until contained, eradicated, and recovered.
How will I know what the MSSP is doing?
You get a monthly executive report showing threats blocked, incidents handled, vulnerabilities fixed, and trend over time. Plus quarterly reviews with leadership and immediate notification of significant events. The work doesn't happen in a black box.
Does the MSSP replace my MSP or IT person?
Usually no — MSP and MSSP are different jobs. MSP keeps IT working; MSSP keeps it secure. Many SMBs work with both. Some providers integrate the two, but the underlying disciplines remain distinct.
See What We'd Do for Your Business
Free 30-minute assessment. We'll walk through what active managed security would look like for your specific environment.
Get Free Assessment