How To Start An MSSP?
Abstract
MSSP : This acronym stands for “Managed Security Service Provider.” It’s basically any company that provides proactive security services to their customers using many different tools and techniques.
For example, endpoint protection, vulnerability management, web application firewalls are all examples of areas where an MSSP may focus their efforts. Some companies have taken this one step further by offering security-as-a-service or SIEM as a service. The majority of MSSPs take a hybrid approach, providing onsite agents for their clients while also pushing out specific security services to the cloud.
Tools and Techniques
The tools and techniques used by an MSSP can vary greatly. It’s important to understand the customers you will be serving before choosing a product or service that best fits their needs. However, there are some commonalities that most if not all MSSPs use to provide proactive security services for their clients.
Some of these include:
* Wired & Wireless Networks (IoT)
* Endpoint Protection Platforms
* Vulnerability Management Tools(Nessus, Saup e t c.)
* SIEM/Logging Tools (Splunk, ArcSight et c.)
* Email and Web Security (Prolexic, Cloudflare et c.)
Membership
The membership requirements of an MSSP varies greatly between organizations. Some require their clients to be members of ISACA or other such organizations. Others will take any client as long as they can pay the monthly fees and comply with any regulatory/legal issues that may arise from the services being provided.
The more common requirement is that you must have at least two employees who are network security professionals who are both physically located in your office space full-time, along with being named on your business license.
Client Base:
Due to the nature of these relationships, customer size varies very widely among MSSPs. You won’t find many small businesses looking for these services, primarily because the level of expertise required to provide them is beyond what most small-to-medium sized businesses can afford. You do however have a great opportunity with large companies who are already using many of the tools you will be providing. Typically MSSPs focus their efforts on Fortune 1000 companies.
Forecast:
As previously mentioned, MSSPs typically work in very specialized fields within information technology. Many companies are focused on specific areas such as endpoint protection or SIEM while others take a more broad approach utilizing many different security services offered by 3rd parties and perhaps even developing some in-house if desired/needed. Due to this, it’s difficult to forecast how much revenue may be generated from these types of services.
Future Outlook:
The future outlook for this industry is by no means bleak. The amount of data breaches in the news has increased significantly over the last few years, so much so that it’s become difficult to keep up with them all. It seems every other day you hear about another large company being hacked and their customer base information being leaked online. This has only increased the demand for these services, especially within Fortune 1000 companies who are looking to minimize any chance of becoming a statistic. Any company that provides proactive security measures against cyber-attacks stands to benefit from this rising trend in information security awareness throughout businesses worldwide.
How to Start MSSP:
Here’s a step-by-step guide for starting your own MSSP:
Step 1: Define A Clear Vision of What You Want to Accomplish.
This is the most important step of all, and yet it’s also one that many companies tend to overlook. Before you get started, you should sit down with a few of your employees and really think about what exactly an MSSP means to you. Here are some questions I would recommend asking yourself at this stage:
– How much money do I have available to invest in security services?
– In order for us to be successful, how many clients do we need to service per month? What percentage of them will pay on a monthly basis?
– What would I like to see MSSP turn into in 2 years? 5 years? 10 years?
– Do we need access to any specific technologies or services that will help us get there?
– How many employees do I think the MSSP will require in order to accomplish all of these goals on a daily basis?
Step 2: Create A Plan of Action
Once you’ve figured out where you want to go in the next 5-10 years, it’s time to create a plan of action for what your MSSP will look like when it gets there. Here are some questions I would recommend asking yourself at this stage:
– Which aspects of the vision do we need to accomplish in year 1?
– What areas and services can we begin offering right away? How much revenue will we be able to generate from these core offerings each month?
– What other products and services can we begin selling immediately so that we can start generating additional revenue streams as well? Are they or supplemental items that our clients will need?
Step 3: Do Your Research and Find Your Target Customers
Now that you’ve got a fairly clear vision and plan of action, it’s time to do some research on your target customer base. Here are some questions I would recommend asking yourself at this stage:
– What are the biggest pain points that my potential clients have with their current security providers?
– How can I effectively demonstrate the value proposition for our MSSP in order to get them interested in doing business with us?
Step 4: Put Together Your Marketing Strategy And Sales Process
Now that you’ve done your research, it’s time to create a solid marketing strategy and sales process for bringing in new clients. Here are some questions I would recommend asking yourself at this stage:
– How much revenue can we generate by selling our MSSP services directly to small businesses?
– What kind of enterprise deals will be most difficult to win? Why?
– How can we successfully differentiate ourselves from other MSSPs in the same industry sector?
– How can we effectively demonstrate a value proposition for those interested in getting them to toSP in our MS in doing business with us?
Step 5: Take On Your First Client(s) And Make Sure You Properly Onboarding Them
Assuming you have a solid marketing strategy in place, it’s now time to take on your first client(s). Once again, here are some questions I would recommend asking yourself at this stage:
– How can we successfully onboard these new customers?
– Do any of our current clients have security needs that will be better suited for another MSSP?
– Which project(s) do they want us to start working on right away? What is the total value of the contract?
-What is the total value of our services?
Step 6: Market Your Services To All Potential Customers (With Focus On Target Segments)
Now that you’ve taken on your first client(s), it’s time to increase marketing efforts and grow your customer base with greater velocity. Here are some questions I would recommend asking yourself at this stage:
– What marketing channels are currently bringing in most of our leads?
– What kind of services do we need to start offering in order to win more deals from target segments?
– How can we help our current customers with additional security needs without losing focus on the primary project(s) they want us to complete first?
Conclusion
If you’re wondering how to run an MSSP business with greater success, then I hope this post has given you some ideas on what matters most when running your own company.
Your Managed Service Provider business doesn’t have to be difficult. The most important thing at this point is to develop a strong marketing plan and focus on nailing the product-market fit.
This will allow you to start gaining traction, getting some positive feedback loops going, and finding out what’s working (and what isn’t) when it comes to bringing in new customers for your business.
