Managed Security Service Providers in Germany: A Structured Selection

What is a managed security service provider?

A managed security service provider, or MSSP, runs defined security functions of a company on a permanent, contractual basis. It does not deliver a product but an operating state: systems are monitored, anomalies are assessed, incidents are handled according to agreed rules.

The distinction from neighbouring models matters because it shapes the contract. A classic system integrator sells projects and licences and bills support by effort. A managed service provider (MSP) operates IT infrastructure, often including individual security components, but without dedicated analysis of attack patterns. An MSSP puts exactly that analysis at the centre and maintains the people, processes and tooling to deliver it.

Within the MSSP world, managed detection and response (MDR) has established itself as a separate model. MDR focuses on detection and response across endpoints, cloud and network, but frequently excludes the operation of security infrastructure. Anyone looking to outsource a firewall, a VPN or a SASE platform needs more than pure MDR.

What does an MSSP actually deliver?

Managed security is an umbrella term, not a scope of work. Only the service description tells you what you are actually buying. In practice, offers are assembled from these building blocks:

• Log collection and correlation (SIEM): events from firewalls, servers, cloud services and endpoints are consolidated into a single situational picture.
• Security operations centre (SOC): analysts assess alerts, separate false positives from genuine incidents and trigger the response.
• Detection and response (MDR, XDR): detection and active containment on endpoints, in identities and across cloud workloads.
• Operation of security infrastructure: firewalls, secure web gateway, zero trust network access, SASE platforms, email security.
• Vulnerability and patch management: regular scans, prioritisation by exploitability, tracking through to remediation.
• Incident response: forensics, containment and recovery in an emergency, frequently sold as a separate retainer.
• Compliance reporting: evidence for ISO 27001, BSI IT-Grundschutz or the reporting obligations under the BSIG.

Two building blocks are routinely overestimated. First, a SIEM without agreed use cases produces volume rather than insight. Second, incident response is rarely included in the base price. Clarify before signing whether a team turns up in an emergency or only a ticket appears.

Make or buy: when does an in-house SOC pay off?

Staffing an in-house security operations centre around the clock realistically requires eight to twelve full-time positions. The reason is arithmetic rather than technology: three shifts across seven days already amount to more than four full-time equivalents, before holiday, sickness, training and a second pair of eyes so that nobody analyses a night shift alone.

The labour market adds to this. Experienced security analysts are scarce and expensive, and attrition in shift operations is high. For most companies below roughly one thousand employees, a dedicated full-time SOC is therefore not economically viable, regardless of how strong the security requirement is.

The pragmatic middle ground is a hybrid model. The provider handles monitoring, first-level analysis and out-of-hours cover. The internal team keeps governance, prioritisation and the decision on disruptive interventions such as taking a production system offline. That model only works if both sides know in writing who decides what and when.

What NIS2 changes about provider selection

Germany’s NIS2 implementation act has applied since 6 December 2025, with no transition period. Around 29,500 entities with at least 50 employees or 10 million euros in annual revenue across 18 sectors are in scope, compared with only a few thousand operators previously supervised by the BSI.

The statutory registration deadline with the BSI expired on 6 March 2026. Because only around 18,500 entities had registered by the end of May 2026, the BSI communicated a grace period until 31 July 2026. That grace period is not a new deadline, it is leniency in enforcement. A missed registration alone can attract fines of up to 500,000 euros, while breaches of risk management and reporting duties can reach 10 million euros or 2 percent of global annual revenue.

Two consequences follow for MSSP selection. First, Section 30 BSIG explicitly requires supply chain security measures. Your provider therefore becomes part of your own risk management, and its certificates and processes belong in your documentation. Second, Section 38 BSIG anchors personal responsibility with executive management. You can delegate tasks, but the duty to supervise remains with you. We have broken down what this means for networks, sites and carrier supply chains in our article on NIS2 implementation for telecom infrastructure.

In practical terms: ask every bidder for a section on how they support you with reporting obligations. The 24-hour initial notification to the BSI is a process, not a form.

Which provider types exist in the German market?

The German MSSP market sorts into five provider types that differ in origin, pricing logic and closeness to the customer. No type is inherently better, but each suits a different requirement profile.

A note on market research: analyst houses such as ISG assess the German market regularly in dedicated studies for the mid-market segment. Such overviews help with the shortlist, but they do not replace testing against your own requirement profile.

What managed security services cost

Reliable list prices do not exist in this market, but typical ranges do. For mid-sized companies, comprehensive managed security packages frequently sit between 1,000 and 5,000 euros per month. MDR offerings are usually calculated per monitored endpoint and range from roughly 15 to 40 euros per endpoint per month, depending on provider and depth of service.

The billing model matters more than the entry price, because it determines how costs scale with your growth. Four logics are common: per endpoint, per user account, per data volume ingested into the SIEM, and a flat fee against a defined baseline. Volume-based models look cheap while few log sources are connected and become expensive as soon as cloud services are added.

Watch four line items that rarely sit in the base price: onboarding and integration, log retention beyond the standard period, incident response as a retainer, and additional hours for ad hoc analysis. These positions decide the real total cost of a contract.

Why MSSP projects fail in practice

Most disappointments come from vague agreements rather than weak technology. Five patterns recur.

The service boundary stays open. The provider detects an incident and reports it. Who isolates the affected system is written down nowhere. In an emergency, hours are lost clarifying responsibilities.

Alerts without a recipient. Notifications land in a mailbox that nobody reads at night or at the weekend. An escalation matrix with names, phone numbers and deputies belongs in the contract, not in a wiki.

Response times without a definition. A promised response within 15 minutes is worthless until it is clear whether that means the automated acknowledgement or human analysis.

The network is forgotten. Detection and response assume that sites, cloud access and remote connections are properly connected. Where connectivity is unstable, the SOC produces blind spots instead of security. Our article on highly available internet as the key to IT resilience explains why the underlay is the foundation of any detection strategy.

No exit planned. Contracts with 36-month terms and no agreed data export turn a provider change into a project. Clarify before signing in which format you get your logs and configurations back.