A Practical Guide to Understanding What Your MSP Actually Protects
Managed IT services should include cybersecurity protections across user identities, computers, email, Microsoft 365, networks, vulnerabilities, security monitoring, and backup and recovery. The agreement should also identify who monitors those protections and what happens when suspicious activity is detected.
For most businesses, cybersecurity now extends well beyond antivirus software. Employees sign into cloud applications from multiple locations. Microsoft 365 contains email and company data. Remote workers connect from outside the office. Firewalls protect network traffic. Computers need continuous protection and patching. Backups need to remain available if production data is encrypted or deleted.
The important question when evaluating a managed IT provider is whether each of those areas has a defined security control and a person or team responsible for managing it.
Identity and Access Security
User accounts are an important part of a company’s security environment because they provide access to email, files, applications, cloud platforms, and business data.
Multi-factor authentication should be used for important business systems wherever practical. MFA adds another verification requirement beyond the employee’s password and can reduce the usefulness of a stolen password by itself.
Administrative accounts deserve additional attention. An employee who needs to read email and work in Microsoft 365 generally does not need the same privileges as someone responsible for changing security settings or managing the environment. Separating administrative access can reduce the amount of damage possible when a standard employee account is compromised.
Employee onboarding and offboarding are part of identity security as well. When an employee leaves, the organization needs a defined process for disabling accounts, terminating active sessions where appropriate, removing application access, preserving required business data, and recovering company equipment.
An MSP should be able to explain how these identity and access responsibilities are managed.
Endpoint Protection Needs Active Monitoring
Every employee computer creates another place where malicious software, stolen credentials, unsafe downloads, or other security activity can occur.
Traditional antivirus remains useful, but modern business environments often require more visibility into what is happening on the device. Endpoint Detection and Response, or EDR, monitors endpoint activity for suspicious behavior and provides additional information for investigating potential threats. MDR, or Managed Detection and Response, adds people and processes around security monitoring and response. XDR, or Extended Detection and Response, can bring information together from multiple security sources rather than looking only at an individual endpoint.
The terminology can become confusing quickly for a business owner comparing MSP proposals, so instead let’s ask:
What happens when the security software detects something suspicious?
Someone needs responsibility for reviewing the alert, determining whether it represents a real threat, and deciding what action should be taken. Installing the software is only the beginning of that process.
Who Responds When a Security Tool Finds Something?
What if an employee receives an unexpected MFA request at 9:40 p.m. and approves it because they believe it is connected to something they did earlier?
A security platform may detect unusual sign-in behavior shortly afterward, but the business needs to know what happens next.
Does the event generate an alert that waits in a dashboard until someone reviews it the following morning? Does a security resource investigate it after hours? Who determines whether the employee’s account should be disabled or sessions terminated? Who communicates with the company if additional action is required?
The answers depend on the security services included in the agreement. That is why AT-NET provides an internally staffed 24/7/365 help desk, and managed IT clients have access to 20+ engineers. Businesses evaluating any provider should understand the distinction between support availability and the specific security monitoring and incident-response services included in their agreement.
Email Security Needs Its Own Protection
Email remains one of the primary ways employees communicate with customers, vendors, coworkers, and outside organizations which also makes it a useful path for attackers.
Phishing emails may attempt to steal passwords, convince an employee to approve an MFA request, redirect a payment, deliver malicious files, or impersonate someone the employee already knows. Email security can help identify malicious messages, suspicious links, dangerous attachments, impersonation attempts, and other threats before they reach the employee.
Saying all of that, employee awareness still matters because no technical control will identify every malicious message.
Your managed IT provider should be able to explain which email security protections are in place, how suspicious messages are handled, and what employees should do when they believe they have interacted with a malicious email.
Microsoft 365 Requires Security Management
Using Microsoft 365 does not eliminate the need to manage security. The platform may contain email, documents, Teams conversations, SharePoint data, OneDrive files, employee identities, administrative accounts, and other company information.
Security settings need to be configured according to the organization’s requirements. That can include multi-factor authentication, administrative access, account policies, conditional access where appropriate, email security, auditing, and other controls.
Licensing matters as well as different Microsoft 365 plans provide different security capabilities, so the organization’s security design needs to account for what its licenses actually support.
Configuration should also be reviewed over time. A Microsoft 365 environment that was appropriate for a 20-person company may need changes after the organization grows to 75 employees, adds remote workers, opens another location, or introduces new security requirements. Cloud platforms still require active administration.
Firewalls and Network Security
The firewall sits at an important boundary between the company’s internal environment and outside networks. Business firewalls need ongoing management. Firmware and security updates need attention. Configuration changes should be controlled. VPN and remote-access settings need to be reviewed. Hardware eventually reaches end-of-support and requires replacement.
Network design matters inside the environment as well because not every device necessarily belongs on the same network. Guest wireless devices, business computers, servers, security cameras, production equipment, building systems, and other connected technology can have different access requirements. Network segmentation can reduce unnecessary communication between systems and help limit exposure when a device is compromised.
The appropriate design depends on the business. A professional office with 30 employees has different requirements from a manufacturer with production equipment, vendor remote access, and legacy systems. Your MSP should understand those differences rather than applying an identical network design to every customer.
Patching and Vulnerability Management
Software vulnerabilities are discovered continuously which means that operating systems, browsers, business applications, servers, network devices, and other technology require updates over time. Patch management provides a process for deploying updates across supported systems. That helps reduce exposure to known vulnerabilities while keeping devices consistent.
Vulnerability management goes further by identifying weaknesses that need attention. A vulnerability scan may identify an unsupported operating system, outdated application, missing update, insecure configuration, or network device requiring remediation.
The next step is prioritization. A critical vulnerability on an internet-facing system deserves different attention from a low-risk finding on an isolated device.
Businesses should ask whether their managed IT agreement includes both patching and vulnerability management and how identified issues are prioritized.
Unsupported Technology Creates Security Problems
Security becomes more difficult when equipment or software has reached end-of-support. A computer may continue working after its operating system is no longer supported. A firewall may continue passing traffic after the manufacturer stops releasing security updates. A legacy application may remain important to the business even though the platform underneath it has aged.
But, the fact that something still works does not mean it can still be maintained securely. This is where cybersecurity and IT lifecycle planning overlap.
Businesses should maintain an inventory of important technology, including operating systems, warranty information, vendor-support dates, and expected replacement periods. A 12-, 24-, and 36-month technology roadmap gives leadership time to plan replacements before end-of-support becomes an emergency.
Some legacy systems cannot be replaced immediately. In those cases, additional controls such as segmentation, restricted access, monitoring, or other safeguards may be needed while the business develops a longer-term plan.
Backup and Recovery Are Part of Cybersecurity Planning
Cybersecurity needs to account for what happens when prevention fails. A company may experience ransomware, accidental deletion, hardware failure, malicious activity, application corruption, or another event that damages important data.
Backups provide a recovery path. The backup strategy should identify which systems and data are protected, how frequently backups occur, where copies are stored, how long data is retained, and how recovery is performed.
For important systems, businesses may also use immutable backup storage. Immutability helps prevent protected backup data from being changed or deleted during its configured retention period. Backup success should be monitored rather than assumed. A backup job that has silently failed for three weeks provides little protection when the company needs to recover.
Recovery testing is equally important. The organization needs confidence that protected data can actually be restored and that the recovery process supports its business requirements.
Security Monitoring Needs Human Responsibility
Security platforms can generate a large amount of information. A firewall may create alerts. Endpoint software may identify suspicious behavior. Microsoft 365 can produce sign-in and security events. Vulnerability tools identify findings. Email systems detect suspicious messages.
Someone needs to determine which events require action and that responsibility should be clear in the managed IT agreement.
Businesses should ask who monitors alerts, what hours monitoring occurs, how events are investigated, when the customer is notified, and how serious incidents are escalated. This is particularly important when a provider uses several security products.
Five security tools generating alerts do not automatically create a complete security program. The value comes from how those tools are configured, monitored, maintained, and used together.
What Happens During a Cybersecurity Incident?
A cybersecurity incident can require action across several parts of the technology environment.
- A compromised employee account may require password changes, session termination, MFA review, email investigation, and analysis of other sign-in activity.
- A compromised computer may need to be isolated from the network while security resources investigate what occurred.
- A ransomware event could involve endpoints, servers, backups, network infrastructure, identity systems, outside cybersecurity resources, legal counsel, cyber insurance, and company leadership.
The MSP’s role should be established in advance. Businesses should understand what incident-response capabilities are included in the recurring agreement, what requires a separate engagement, and which outside resources may become involved during a significant incident. Cyber insurance requirements should be considered as part of that planning as well.
Cybersecurity Requirements Vary by Industry
A cybersecurity program that works will reflect the organization’s actual business requirements.
Healthcare organizations may need controls connected to HIPAA. Businesses working with payment card data may have PCI DSS requirements. Manufacturers and contractors working in certain government supply chains may encounter NIST SP 800-171, CMMC, or DFARS requirements.
Customers may also impose their own cybersecurity requirements through contracts or security questionnaires. Compliance does not automatically create security, and security tools alone do not automatically create compliance.
The business needs to understand which requirements apply and determine whether its technical controls, policies, procedures, documentation, and evidence satisfy those requirements. A managed IT provider can support many of the technical components, but the scope should identify which compliance responsibilities are included.
What Cybersecurity Services May Cost Extra?
Managed IT providers structure cybersecurity services differently.
Some providers include a broad security stack in their standard managed service. Others separate cybersecurity into additional service tiers or individual products. Specialized work may also require separate scoping.
Some examples can include penetration testing, formal compliance assessments, specialized security assessments, major remediation projects, forensic investigations, advanced incident-response engagements, and certain security platforms or licensing. Businesses should not assume those services are included simply because the provider offers cybersecurity.
The proposal should identify what is included in the recurring monthly agreement and what would require additional approval. That makes competing proposals easier to compare.
How to Compare the Cybersecurity in Two MSP Proposals
Two managed IT proposals may both contain the word “cybersecurity” while providing very different levels of protection.
Here is a useful comparison that looks at actual responsibilities.
| Question | Provider A | Provider B |
|---|---|---|
| Is MFA managed? | ||
| Is endpoint protection included? | ||
| Is MDR/XDR included? | ||
| Is email security included? | ||
| Is Microsoft 365 security managed? | ||
| Are firewalls managed? | ||
| Is vulnerability management included? | ||
| Are backups monitored? | ||
| Who investigates security alerts? | ||
| Is after-hours security response included? | ||
| What incident response is included? | ||
| What services cost extra? |
Businesses can fill in this table using the actual language from each proposal and blank spaces should lead to questions before the agreement is signed.
Questions to Ask an MSP About Cybersecurity
A business evaluating a managed IT provider should understand who owns the major security responsibilities.
Here are some questions to ask:
- Which cybersecurity tools are included in the monthly agreement?
- Who monitors security alerts and during what hours?
- What happens when endpoint protection detects suspicious activity?
- How do you secure Microsoft 365 and employee identities?
- Are email security and MFA included?
- How are vulnerabilities identified and prioritized?
- Who manages firewall security?
- How are backups monitored and tested?
- What happens if we experience a cybersecurity incident?
- Which cybersecurity or compliance services would cost extra?
The answers should be specific enough that leadership knows what will happen when a security problem occurs.
Frequently Asked Questions About Cybersecurity and Managed IT
Is cybersecurity included with managed IT services?
Cybersecurity is often included to some degree, but the scope varies considerably between providers. Businesses should verify exactly which identity, endpoint, email, Microsoft 365, network, vulnerability, monitoring, backup, and incident-response services are included.
Is antivirus enough for a small or midsized business?
Antivirus addresses only part of the security environment. Businesses also need to consider identity security, MFA, email protection, network security, patching, vulnerability management, monitoring, backups, and response procedures.
What is MDR?
Managed Detection and Response combines security technology with people and processes responsible for monitoring, investigating, and responding to suspicious activity. Businesses should ask providers exactly what monitoring and response are included in the MDR service being proposed.
Does Microsoft 365 need additional security management?
Yes. Microsoft 365 security depends on licensing, configuration, identity controls, administrative access, email protection, monitoring, and other settings. Using Microsoft 365 does not remove the need to actively manage its security.
Are backups considered part of cybersecurity?
Backups are an important part of cyber resilience because they can provide a recovery path after ransomware, malicious deletion, account compromise, or other destructive incidents. Backup monitoring, protection, and recovery testing should be included in security planning.
Does an MSP handle cybersecurity incidents?
Many MSPs provide some level of security investigation and response, but capabilities and contractual scope vary. Businesses should determine what the MSP handles internally, what is included in the agreement, and when specialized incident-response resources would be required.
What cybersecurity questions should I ask before hiring an MSP?
Ask which security controls are included, who monitors them, when monitoring occurs, how alerts are investigated, how incidents are escalated, what backup and recovery protections are provided, and which security services require additional fees.
Final Thoughts
Cybersecurity inside a managed IT agreement should have clearly defined responsibilities.
Businesses need protection across employee identities, endpoints, email, Microsoft 365, networks, vulnerabilities, and backups. They also need people responsible for monitoring those controls and responding when suspicious activity occurs. The specific products matter, but the operating process matters just as much.
Before choosing an MSP, leadership should understand what is protected, who manages it, who monitors alerts, what happens after hours, how incidents are escalated, and which services fall outside the recurring agreement.
About AT-NET
AT-NET provides managed IT, cybersecurity, cloud, infrastructure, backup and disaster recovery, and strategic technology services for businesses throughout North Carolina, South Carolina, Florida, and Eastern Tennessee.
AT-NET has served businesses since 1999. Managed IT clients receive an internally staffed 24/7/365 help desk with less than 60-second response, access to 20+ engineers, a dedicated Technical Alignment Manager, and a dedicated vCIO.
Review Your Cybersecurity Coverage With AT-NET
AT-NET can review your existing IT and cybersecurity environment to identify how identities, endpoints, email, Microsoft 365, networks, vulnerabilities, and backups are currently protected.
The review can also help clarify which security responsibilities are being handled today and where additional controls or processes may be needed.
