Checklist · 8 min read
12 questions to ask before signing with any MSSP
The questions that separate a real security operation from a ticket-forwarding service — including the ones vendors hope you won't ask.
By One Circle Solutions · Published
Most MSSP disappointment traces back to questions nobody asked before signing. The glossy deck looks the same from every provider; the operational reality does not. These twelve questions surface the difference — and any provider worth hiring will answer them without flinching.
Coverage and people
- 1. Who actually looks at my alerts at 3 a.m. — your employees, or a subcontracted SOC? Where are they?
- 2. What is your analyst-to-client ratio, and how many alerts does one analyst triage per shift?
- 3. Will a named person know my environment, or does every ticket start from zero?
- 4. What happens to my coverage when your best analyst quits?
Response and authority
- 5. What actions will you take on my behalf without waking me up — and where is that agreed in writing?
- 6. What is your actual median time from alert to human triage? Show me last quarter's numbers.
- 7. Walk me through your last real incident (redacted). What did the first hour look like?
- 8. If we part ways, what do I keep — detections, runbooks, historical data?
Operations and honesty
- 9. Which of my alerts will you NOT handle? Every provider has a scope boundary — find it now, not during an incident.
- 10. How do you tune out noise, and how often do detections get reviewed or retired?
- 11. Can I see the same dashboards your analysts see?
- 12. Tell me about a miss. If a provider claims they've never missed anything, they're either new or not being straight with you.
What good answers sound like
Good providers answer with specifics: named people, real numbers, written playbooks, and at least one honest story about something that went wrong and what changed afterward. Evasive answers on questions 5, 6, and 12 are the strongest predictor of regret twelve months in.
Ask every provider the same twelve questions and take notes. The comparison usually makes the decision for you.