3 Keys To ‘SOC Away’ Money as an MSSP

There’s no doubt customers are running scared: Gartner expects the global security market to be worth $93 billion by the end of this year. MSPs are naturally looking to grab some of that business.

To become a true managed security service provider, however, you need a 24/7 security operations center, or SOC. That’s an expensive proposition — the capex and staffing issues are enough to stop some MSPs from adding that extra “S” to their acronyms.

MSPs typically have three options to establish a SOC: DIY their own branded service, partner with an established player with a turnkey service, or resell a vendor’s white-label offerings. Each of these brings challenges when it comes to profitability.

Let’s look at the overall management complexities of operating as an MSSP, whichever SOC model you go with. To serve customers properly, you will need to:

• Analyze a steady stream of threat data flowing into the SOC in real time;
• Select and provision a variety of security capabilities per customer via technologies like SIEM, firewall, detection and response, endpoint monitoring and a seemingly endless list of other, specialty products;
• Figure out the best way to triage a hailstorm of network alerts and provide analysis to sift real threats from hundreds to thousands of false positives;
• Decide whether to specialize or figure out how to serve customers with bespoke SLA requirements across diverse sectors and verticals;
• Understand complex regulatory and compliance rules, all with their own privacy and reporting requirements;
• Find, hire and retain highly skilled, and highly paid, SOC staff and security analysts.

Much has been written about these. Let’s dig into what I see as the key to MSSP profitability: simplifying SOC operations wherever possible while ensuring that your services are scalable. MSPs always need to flex their business models in order to add new specialties; increase the number of users supported; and ramp-up the volume of data, processing and network resources consumed.

They also need to be able to scale down and avoid wasting money by paying for more resources than business volume demands. That’s an issue across managed IT services, and it affects security as well. 

Data costs can also be a drag on SOC profitability. With the annual boom in data volume continuing unabated, monitoring and analyzing all the information moving in and out of corporate networks has become a huge money-maker for traditional vendors that supply SOC infrastructure. With pricing for core SOC technologies typically based on data volume, vendors basically have embedded steadily rising costs into the managed-security services business model.

Have I made you think twice about making the leap to manged security? Good, because this isn’t a business to enter into lightly. Customers trust MSSPs with their business reputations. But if you’re still reading, there are ways to overcome these challenges and benefit from the surging demand for cybersecurity:

1. Focus on technologies and minimize dependence on staff: A SOC should be built around systems rather than people. Technology can be reconfigured, replaced, augmented or upgraded when you need to scale. Staffing your SOC and ensuring the right skill sets are in place can be difficult and very expensive due to the demand for cybersecurity experts. Don’t hire someone to do a task that a tool can do. That said, highly skilled people will always be an important part of a managed-security services business, and technology can’t fully replace the human element. Ensuring that the latest technologies are in place will make the people more effective and help ensure that threat detection and remediation happen faster.
2. Automate wherever possible: Along the same lines, if core SOC capabilities like real-time monitoring and analysis of security alerts generated by all customers’ applications and network hardware are automated, it is much easier to scale clients’ requirements quickly. If you can automate something, do. Machine learning is becoming a real enabler for MSSPs, and AI is on its way. Automation can also make the SOC a source of intelligence that clients rely on to make better decisions. The latest tools can recommend approaches for defending against threats while helping improve workflow to make the SOC faster and more effective.
3. Demand pricing that ensures visibility of SOC costs: MSSPs need predictability of costs. Pricing around core SOC infrastructure technologies like threat intelligence, monitoring and SIEM should be based on, for example, the number of network nodes in need of protection, not the amount of data moving through them. 

Making the leap from MSP to MSSP means operating scalably and efficiently. Clients demand detection and response to attacks in real-time with zero tolerance for error. MSPs that add security services to their portfolios but don’t optimize their SOC operations will struggle to sustain profitability in a lucrative but increasingly crowded market.

Russell Poole is managing director, U.K. and Ireland, for LogPoint. Having been at the forefront of the cybersecurity industry for well over 10 years, Russell is using his experience to expand LogPoint’s presence in the United Kingdom and Ireland. After spending more than two decades working in IT for some of the leading brands in the U.K., Russell’s focus is working with organizations to not only ensure IT security is aligned to business goals, but also to ensure secure working practices can be leveraged as a growth driver and key differentiator.