Managed Security Services: What They Include

Last updated: 13 November 2026

Most small businesses know they need to take cyber security seriously. Fewer know what “seriously” actually involves, and almost none can justify employing someone to do it full time. That gap is what managed security services are designed to fill.

Put simply, a managed security service (sometimes called managed IT security) means a specialist provider runs your protection for you: choosing and configuring the right tools, keeping them up to date, watching for warning signs, and acting when something looks wrong. This guide explains what a good service should include, so you can judge what you’re being offered.

Managed Security at a Glance

• What it is: security tools, expertise and monitoring provided as an ongoing service, rather than software you install and forget.
• What it covers: devices, email, accounts, updates, backups and the people using them.
• Why it matters: most attacks exploit gaps that nobody was watching, not clever technology.
• How it’s priced: usually monthly, per user, per device or by organisation size.
• The key question: who is watching for problems, and what do they do when they find one?

Managed Security vs Buying Security Software

Buying antivirus and switching it on is not the same as being protected. Software needs configuring properly, updating, checking, and someone to act on what it reports. An alert that nobody reads protects nobody.

The difference with a managed service is responsibility. The provider is accountable for the protection actually working, not just for supplying the licence. That’s the part most small businesses are missing, and it’s usually the part that matters most when something goes wrong.

What a Good Managed Security Service Should Include

Packages are worded differently, but a service worth paying for should cover the following. If something is missing from a proposal, ask whether it’s included elsewhere, or why it isn’t needed.

1. Endpoint protection that’s actively managed

Modern protection on every computer, laptop and server that detects suspicious behaviour, not just known viruses, and can isolate a device if it’s compromised. It should be managed centrally, so the provider can see every device’s status in one place. Our managed Sophos page explains how this works in practice.

2. Email security

Email is still the most common way in. Filtering should block phishing, malicious attachments and impersonation attempts, including emails pretending to come from your own directors or suppliers, before they reach anyone’s inbox.

3. Account and identity protection

Multi-factor authentication on every account that supports it, separate admin accounts used only when needed, and alerts for unusual sign-ins. Stolen passwords are behind a large share of breaches, and these controls make a stolen password far less useful.

4. Security updates, applied quickly

Updates for operating systems, software and equipment such as firewalls, applied on a schedule and checked afterwards. Cyber Essentials now requires high-risk and critical updates to be installed within 14 days, which is a sensible standard for everyone.

5. Monitoring and response

Someone watching the alerts your protection generates, investigating anything suspicious, and acting on it. This is where services differ most, so ask exactly who watches, during which hours, and what happens if something is detected overnight or at a weekend.

6. Backups that ransomware can’t reach

Backups stored separately from your main systems, so an attacker who gets in can’t encrypt or delete them too, and tested regularly to prove they restore. See Acronis cloud backup and disaster recovery for how we approach this.

7. Vulnerability scanning and testing

Regular scans of your systems for weaknesses, and periodic testing to see whether they could be exploited, so gaps are found by your provider rather than by an attacker.

8. Dark web monitoring

Checks for your business’s email addresses and passwords appearing in leaked data, so affected accounts can be secured before the details are used against you.

9. Staff awareness

Short, practical guidance for your team on spotting phishing and handling data safely, sometimes with simulated phishing emails to show where extra help is needed. People are part of your defences, and the cheapest to improve.

10. Reporting, certification and a plan

Regular reports showing what’s protected, what’s been blocked and what needs attention, support with Cyber Essentials, and an agreed plan for what happens if an incident occurs. If something does go wrong, our guide to accidental data breaches at work covers what to do next.

How It Fits With Managed IT Support

There’s a lot of overlap. A good managed IT support service will already include some of the essentials (our guide to what managed IT support should include covers that side), such as endpoint protection, updates and backups. Managed security builds on that with the deeper layers: testing, dark web monitoring, more detailed monitoring and reporting, and certification.

When comparing providers, check which items sit in the IT support contract and which are extra, so nothing falls between the two and you don’t pay twice for the same protection.

What Managed Security Costs

Most managed security services are priced monthly, either per user, per device or as a bundle based on the size of your organisation. Prices vary widely because services include very different things, so compare what’s covered rather than the headline figure.

A cheaper service that leaves out monitoring, testing or protected backups may cost far more if it fails when you need it. The useful comparison is not between quotes, but between the monthly cost and what a week without your systems would cost your business.

Questions to Ask a Provider

• Who watches for alerts, during which hours, and what happens out of hours?
• How quickly will you act if you detect something, and what will you do?
• Is incident response included, or charged separately?
• How are our backups protected from ransomware, and when were they last test-restored?
• How often do you scan and test our systems, and will we see the results?
• Do you hold Cyber Essentials yourselves, and will you help us achieve it?
• What exactly is included, and what costs extra?

Signs Your Business Needs Managed Security

• Nobody could tell you today whether every device is protected and up to date.
• Customers, tenders or insurers are asking about your security.
• You hold personal or financial data that would be damaging to lose.
• You’ve had a near miss, such as a convincing phishing email or a compromised account.
• Your backups have never been tested.

Frequently Asked Questions

What is the difference between antivirus and managed security?

Antivirus is a single tool that blocks known threats on a device. Managed security is a service: a provider runs a range of protections across your devices, email and accounts, keeps them up to date, watches for warning signs and acts on them, so the protection is looked after rather than just installed.

Do small businesses really need managed security?

Most do. Smaller businesses are targeted because they usually have weaker defences and no one watching for problems, and a single successful attack can stop a small team working for days. Managed security gives you protection and expertise you couldn’t justify employing full time.

Is managed security the same as a security operations centre?

Not necessarily. A security operations centre is a team watching alerts around the clock, which some providers include and others offer as an extra. Always ask who watches for alerts, during which hours, and what happens if something is detected overnight or at the weekend.

How much do managed security services cost?

Most are priced monthly, either per user, per device or as a bundle based on the size of your organisation. The total depends on what is included, so compare what each service actually covers rather than the headline price.

Does managed security help with Cyber Essentials and cyber insurance?

Yes. Most of what Cyber Essentials checks, such as malware protection, timely security updates and multi-factor authentication, is exactly what a managed security service looks after, and insurers ask about the same controls when you apply for cover.

How CCSW Can Help

CCSW provides managed cyber security for businesses across Cardiff and South Wales, alongside our managed IT support. That includes managed Sophos endpoint protection, email filtering, multi-factor authentication, prompt security updates and monitored Acronis backups.

For the deeper layers, CCSW Cyber Secure adds monthly vulnerability scanning and penetration testing, dark web monitoring and a monthly cyber report, and takes care of your Cyber Essentials certificate every year with the assessment fee included. It starts from £100 a month (excluding VAT) for organisations with up to nine staff.

We’re Cyber Essentials certified ourselves and a trusted Sophos partner. To talk through where your business stands, get in touch or call 0333 014 4544.