Cybersecurity
The proposal says around-the-clock coverage; the contract decides which assets, who may act and how long your logs last. We source the providers whose terms match the risk you carry.
Book a conversationWhat Security Services Cover, and When You Need Them
The market uses MSSP, MDR and managed SOC loosely, and the labels overlap, so the service description tells you more than the name. What a provider can see and act on depends on the tools it supports, the assets that report to it and the response authority you give it in advance. SASE, which a standards body defines as security and connectivity delivered as one service, needs the same reading. We also source DDoS protection and firewalls, and read their terms the same way.
When it makes sense
- Nobody on your team watches for threats around the clock, or the team you have needs more hours or skills.
- Administrators still sign in with text message codes or push prompts without number matching, which CISA ranks among the weakest forms of MFA.
- Your mail domains are not yet at DMARC enforcement, or a large mailbox provider's sender rules now apply to your outbound mail.
- No incident response firm is under contract, and you don't know which firms your cyber insurer will accept.
When it does not
In our judgment, a full MDR or SASE contract may be more than you need when:
- You already run a staffed 24x7 SOC with your own tools. Targeted services such as threat hunting, an incident response retainer or overflow coverage may serve you better than a full MDR contract.
- Your MDR contract already includes uncapped response for the incidents you worry about, and your insurer's panel covers forensics. A separate retainer adds less. Check both before you buy one.
- Your WAN contract runs for years more. Start with SSE and bring the WAN into a SASE design when that contract comes up.
If your current provider's terms already fit the risk, the right move is a renewal, not a new search.
Where Security Services Fall Short of the Proposal
Most of these gaps surface during an incident, which is the worst time to find them.
Coverage that stops at the agent
In one provider's service description, detection and service levels apply only to licensed endpoints that run its agent and actively report. Anything without the agent or a supported integration sits outside the service. Count what will report before you sign.
Response that waits for your approval
One provider acts only after written authorization, unless you build pre-authorized containment playbooks with it. Another investigates, then hands remediation back to you. Decide who may isolate a laptop at 3 a.m. before the night it matters.
Containment limited to assets the provider knows
One provider's MDR service contains only devices and accounts with known user or asset context. A thin asset inventory limits what any provider can stop.
Log volume that drives the bill
One provider licenses by daily log volume and charges overages above it. Filtering sources to fit the license can cut what the provider sees, so size the license to the sources you need watched.
Logs that expire before the investigation ends
Retention inside a service can be tiered and finite, and archived logs can take days to restore. One major identity platform keeps sign-in logs for as little as a week by default. Logs you don't export are gone, and a later upgrade won't bring them back.
Strong MFA with a weak fallback
CISA names push bombing and SIM swap among the attacks that defeat weaker MFA. In our judgment, a phishing-resistant method protects less if users can still fall back to a text message code, so check which fallbacks stay switched on.
DMARC enforcement before every sender is ready
Moving a domain to quarantine or reject before every legitimate sender is aligned, such as your marketing platform and ticketing system, can block real mail. Start at a policy of none, with reporting, and enforce once the reports are clean.
Penetration tests outside the cloud's rules
Major cloud providers publish their own testing rules, and some prohibit denial-of-service testing outright. Agree scope and rules of engagement before testing starts, and tell your MDR provider when a test is planned.
What a Well-Read Security Contract Changes
For IT and security leaders: response agreed in advance
- Response authority and containment playbooks in writing before the first incident.
- Log retention and export that fit the investigations you expect to run.
- Your analysts work on threats; TREU handles the security vendors and their renewals.
For finance: no surprises in the response bill
- Caps on included response hours found before signature, not during an incident.
- Billing that starts when coverage does, written into the contract.
- Retainer expiry and renewal dates tracked, so unused hours are not lost by default.
What to Watch For in a Security Services Contract
These clauses are specific to buying security services. Breach notice, audit rights, liability caps and exit terms sit with contract negotiation.
-
Risk reduction, not prevention.
MDR terms can state that the service reduces risk without guaranteeing that intrusions won't occur. Read the service levels for what the provider does commit to.
-
What starts the clock.
One MDR service level runs from the provider's own investigation timestamp, as measured by the provider, and covers a single investigation type. Ask what starts the clock, who measures it and what the credit is worth.
-
Caps on included response.
Included response can be capped in analyst hours per incident, or offered only when strict criteria are met. Matters that involve your counsel or your cyber insurer may go to a separate engagement. Find the cap before you sign.
-
Retention, retrieval and export.
Retention periods, retrieval times and deletion after the window are written into the service terms. Agree in the contract how your logs come back to you if you leave.
-
Billing that starts before coverage.
One MDR service starts billing when platform logins are sent, not when coverage is complete. Tie the billing start to the coverage you are paying for.
-
Terms that change by posting.
One service description lets the provider revise the service by posting a new version, so long as overall function is not materially reduced. Fix the version you signed, or require notice of changes.
-
Your data in the provider's intelligence.
One provider's guide includes your consent to its use of collected data, aggregated and anonymized, to improve its services. Decide whether you agree before you sign, not after.
-
Retainer hours that expire.
Unused retainer hours can expire at the end of the term, and one retainer limits when hours can go to proactive work such as tabletop exercises. One commits only to remote response, with onsite help at its discretion.
-
Insurer consent and privilege.
Cyber policies commonly require the insurer's consent before you use a firm outside its panel. Courts have also ordered forensic reports produced where the firm worked under an ordinary business retainer. Settle both with your counsel and your broker before the retainer is signed.
-
Identity licensing tiers.
On one major identity platform, policy-based access needs a paid tier and risk-based policies need the top tier. Check that the tier you buy includes the controls your design assumes.
This list is a starting point for your review. TREU is not a law firm. Your counsel gives the legal advice.
How a Security Services Purchase Runs With TREU
See how we work-
Supplier identification
We take the requirements from your security strategy to providers across the market, and find out early which ones support your tools, keep logs as long as you need and will put response authority in writing.
-
Buying cycle
We compare proposals clause by clause and negotiate the commercial terms alongside your counsel: coverage, response caps, retention, billing start and renewal. Your security team judges the technical fit.
-
Implementation oversight and accountability
We hold the provider to the scope and dates in the signed agreement through onboarding and acceptance, and check the first invoice against it.
-
Client and supplier lifecycle management
We track the terms and renewal dates, including when retainer hours lapse, join business reviews and renegotiate at renewal, for the life of the agreement. In an incident, your team, your MDR provider and your response firm lead.
Questions Buyers Ask About Security Services
What is the difference between MDR, an MSSP and a managed SOC?
The labels overlap. A traditional MSSP monitors and manages security devices, while MDR is sold as human-led detection, investigation and containment. Because the market uses the terms loosely, compare service descriptions, not names.
Will the MDR provider stop an attack, or just tell us about it?
It depends on the contract. Some providers contain only after your written approval, some act within playbooks you agree in advance, and some investigate and hand remediation back to you. Included response can also be capped per incident.
How long will our logs be kept, and can we get them back?
As long as the contract says, which can be shorter than an investigation needs. Retention can be tiered and finite, archived logs can take days to restore, and data past the window can be deleted. Export anything you need to keep.
What is the difference between SASE and SSE?
SASE delivers security and networking as one service. SSE is commonly described as the security half without the WAN: web filtering, control of cloud applications and zero trust access to applications.
Which MFA should we buy?
CISA calls phishing-resistant MFA, built on FIDO or PKI, the gold standard, and urges administrators and other high-value targets to move first. Text message and voice codes rank weakest.
Do we need an incident response retainer if we have MDR?
In our judgment, often yes. MDR response can be capped or limited by criteria, and matters involving counsel or your insurer may go to a separate engagement. A retainer's committed response time exists only if you sign it before the incident. Check your insurer's panel first.
Will our forensic report be privileged?
Not automatically. Courts have ordered forensic reports produced, including where the firm worked under an existing business retainer. How the firm is engaged and directed matters. TREU is not a law firm. Your counsel gives the legal advice.
Does TREU respond to incidents or watch our alerts?
No. We source the providers and negotiate the terms. Your team and those providers run security operations and respond to incidents, and your security team reviews each supplier's evidence against the requirements in your security strategy.