Questions to ask a managed security provider before signing

Compare managed security providers by the work they are accountable for. A long product list is less useful than a precise description of coverage, decisions, response and reporting.

Ask for the service boundary in writing

List the users, devices, identities, applications and sites included. Ask whether the offer covers assessment, initial configuration, recurring management or a combination. The word “managed” can conceal very different levels of involvement.

Record customer responsibilities alongside provider duties. The business may retain staff-change notifications, authorisation of disruptive actions, licence ownership and decisions about operational downtime. A supplier cannot reliably perform work that depends on information nobody has agreed to provide.

Use an evidence-based comparison

Question	Useful evidence
What is covered?	Asset or account scope with exclusions.
Who handles alerts?	Named operating role, hours and escalation process.
Which actions are included?	An authority matrix for review, restriction and other agreed work.
How are gaps reported?	A sanitised sample report with owners and next steps.
What requires a separate project?	Clear exclusions and quotation process.
How does handover work?	Account ownership, configuration records and exit responsibilities.

Verify specialist claims separately

Terms such as SOC, MDR, penetration testing, forensics and emergency incident response imply particular activities. Ask for the actual capability, scope, personnel or provider arrangement and evidence relevant to the offered service. Do not infer those activities from an endpoint licence.

A vendor’s certification or partnership claim should have a verifiable basis and clear relevance. A badge is not proof that every proposed activity is covered. Request confirmation without asking for another customer’s confidential records.

Read the reporting example critically

A useful report identifies coverage gaps, material observations, actions taken and unresolved decisions. Ask whether a green status means a setting was enabled, a device checked in or a business outcome was verified. Those are different claims.

Check how the report distinguishes an alert from a confirmed event and a completed response. A high score should not hide an unsupported system or an untested recovery assumption. The supplier should be able to explain the practical consequence and next action.

Compare the full commercial model

• One-off setup and recurring fees.
• Licence ownership, renewals and changes in user or device count.
• Human hours and any separately contracted response commitments.
• Customer approval duties and escalation contacts.
• Exit, access removal and configuration handover.

Use the same worksheet for each proposal before comparing price. Foxbyte’s service pages describe scoped responsibilities; they do not assert a staffed 24/7 SOC, MDR or specialist capability without separate confirmation.