Three acronyms crowd the search results when a New York business goes looking for help: MSP, MSSP and MDR. Vendors use them loosely. They name three different jobs, done by different people, with different failure modes when you buy the wrong one. National explainers skip the New York part: for many firms here, obligations settle the question before preference gets a vote. One disclosure first: Stedholm sells IT operations and security operations together, so read the conclusion with that in mind. What a combined scope contains is on the Cybersecurity page.
Three terms, three jobs
MSP: managed service provider
An MSP runs IT operations: help desk, looking after laptops and servers, patching, Microsoft 365 administration, backups, vendor management, joiners and leavers. It is measured on whether systems stay up and requests get resolved. Most MSPs include a security baseline of antivirus, a firewall, mail filtering and a patch schedule. That is hygiene, and it matters; watching for an intrusion in progress and acting on it is a different job.
MSSP: managed security service provider
An MSSP runs security operations. It gathers the activity records your systems already produce (who signed in and from where, what ran on each laptop and server, what left the mail system, what crossed the network), watches them for signs of a break-in, tracks known weaknesses, and produces the reporting an auditor or an insurer asks for. It generally does not reset passwords or administer your file server, because it assumes someone else runs IT. That assumption is where buyers get hurt: security findings without an operations team to act on them become a backlog.
MDR: managed detection and response
MDR is a specific service, usually sold by MSSPs and security vendors. Detection and response means a named team is accountable for reading those records, warnings are sorted by people rather than left in a console, and the provider steps in when something is real, such as cutting a machine off the network or switching off an account, and writes down what it did. If MSSP is the category, MDR is the product inside it that most buyers are shopping for.
| MSP | MSSP | MDR | |
|---|---|---|---|
| Core job | Run IT operations | Run security operations | Detect and contain active threats |
| Typical deliverables | Help desk, patching, backups, user management | Monitoring, vulnerability management, compliance evidence | Alert triage, containment, incident reports |
| Measured on | Uptime and request resolution | Coverage and the quality of evidence | Who reads the alerts, what they may contain without a call, and what is recorded |
| Leaves to others | Hunting intrusions in your logs | Fixing the printer | Patching systems and running backups |
| Fails by | Discovering the breach through its consequences | Producing findings nobody acts on | Containing the same weakness again and again |
One phished mailbox, three outcomes
Take an ordinary workday: a partner’s password is phished, the attacker signs in over an ordinary home internet connection, creates a mailbox rule that files anything mentioning invoices into a hidden folder, and starts reading. No malware, and nothing for antivirus to catch.
| Model in place | What happens | Where it ends |
|---|---|---|
| MSP only | Nothing fires. The mailbox rule is a supported Outlook feature, and nobody is reading identity logs. | Discovered later, when a client pays a fraudulent wire instruction. |
| MSSP or MDR only | Two things get flagged and read by a person: a sign-in from a place the account cannot plausibly have traveled to, and the new hidden-filing rule. Microsoft’s own tooling names both of those detections. | The account is shut down; the underlying gap, such as an older sign-in method that cannot ask for a second factor and was never switched off, stays open because fixing it belongs to another vendor. |
| Both, separately contracted | Detection is good. The handoff is the variable: who has authority to disable the account after the office closes, and who tells the other vendor. | Usually fine, occasionally very expensive, depending on what the two agreements say. |
| One accountable team | Detection, containment and the configuration fix are one ticket with one owner. | One owner for the detection, the containment and the configuration fix, with the tradeoff in the last section: one vendor grading its own work. |
Where buyers get burned
- An MSP alone does not give you detection. Antivirus and patching are prevention, and if nobody reads the records of what ran on the computers and who signed in, a break-in is discovered by its consequences.
- An MSSP with nobody to remediate produces vulnerability reports that accumulate unless an operations team owns the fixes. Two vendors pointing at each other is the standard version of this failure.
- MDR on a neglected network contains each incident while the same shared admin passwords and unpatched hosts keep producing the next one. Detection finds them; hygiene stops them recurring.
- Detection software sold as if it were a service is its own trap, and the guide to MDR sets out the distinction and the questions that expose it.
What New York adds
For many Tri-State firms the choice is settled by obligations before preference. If you are licensed under New York’s Banking, Insurance, or Financial Services Law, NYDFS Part 500 applies regardless of size; the regulator keeps its own resource center for it. The rule requires multi-factor authentication, a second proof of identity beyond the password, for any individual accessing any information system of a covered firm. The smallest firms still qualify for a limited exemption, and even then they owe that second proof on three things: remote access to their own information systems; remote access to third-party applications, including cloud-based ones, from which nonpublic information is reachable; and all privileged accounts other than service accounts that prohibit interactive login. Separately, New York’s SHIELD Act requires reasonable safeguards from any business holding New York residents’ private information. Healthcare practices, and CPA and tax firms, answer to their own regimes, and the guide to MDR sets out which text obliges what.
The practical way to read those regimes is to ask what artifact each one obliges someone to produce, and which discipline produces it.
| Obligation | Artifact someone must produce | Which discipline owns it |
|---|---|---|
| NYDFS Part 500, MFA (500.12) | Evidence that a second proof of identity is enforced on access to information systems, or, for an exempt firm, on remote access, on remote access to third-party applications holding nonpublic information, and on privileged accounts other than non-interactive service accounts | IT operations configures it; security evidences it |
| NYDFS Part 500, incident response (500.16) | A written, tested incident response plan with named roles | Security operations |
| NYDFS Part 500, certification (500.17(b)) | The certification filing of material compliance, or an acknowledgment with a remediation plan | The covered entity, on evidence from both disciplines |
| FTC Safeguards Rule, 314.4(d) | “Continuous monitoring, or periodic penetration testing and vulnerability assessments”, in the rule’s own words | Security operations |
| HIPAA Security Rule, 164.308(a)(1) | A current, documented security risk analysis and risk management plan | Security, on the list of systems IT maintains |
| Cyber insurance renewal | A statement that the second proof of identity is in place, how much of the fleet runs detection software, evidence that backups were restored and tested, an incident response plan | Both, and the seam between them is where renewals stall |
The renewal application is where that seam is tested, because it asks for the evidence in the row above and does not care which vendor produces it.
Which one you need
- Under roughly 50 staff, with nobody in-house running IT and light regulatory exposure, the fit is a competent MSP with an honest security baseline, adding MDR as budget allows.
- A regulated small firm, whether a registered investment adviser, a CPA practice or a medical or dental group, needs both disciplines from the start. The regimes above assume monitoring and evidence, and a help desk cannot produce them.
- Above roughly 50 staff with an internal team, keep operations in-house and buy security operations as a co-managed layer. That keeps the help desk where the staff are and buys the monitoring discipline from people who do only that.
- If you have an MSP you already like, keep them, add detection and response, and put in writing who acts on findings and who calls the carrier. Split accountability works when it is explicit.
- One vendor holding both operations and detection is grading its own work, which is the argument for a structural check. When an intrusion starts with a firewall rule that vendor wrote, a separate security provider has every reason to say so. If that check matters more to you than a single accountable owner, split the roles and write the seam into both agreements, accepting the coordination cost.
If you are unsure which of the three you are paying for now, a scoped IT and security assessment reads your current coverage against your obligations, and the findings are yours either way. The plain-English guide to MDR covers the detection layer in more depth, and what managed IT costs in New York sets out what each purchase tends to cost.