What to avoid when choosing a managed security provider
Choosing a managed security provider should make your business feel clearer, safer and better supported – not buried in jargon, dashboards and vague promises.
Black Swan Cyber Security Solutions helps small businesses, schools, care providers, parish councils and professional firms across Chesterfield, Derbyshire, Sheffield and South Yorkshire understand what good managed cyber security should look like.
This guide explains the warning signs to watch for before choosing an MSSP, from unclear 24/7 monitoring and one-size-fits-all packages to services that ignore Microsoft 365, backups, patching, staff training and real-world response.
What to avoid when choosing a managed security provider
A plain English guide for small businesses. Choosing an MSSP is not just about buying tools. It is about knowing who is watching, what happens when something triggers, and whether the service actually fits your business.
- Red flags to spot before you sign
- Questions worth asking any provider
- What genuine 24/7 monitoring looks like
- How to check Microsoft 365 is actually covered
Why this guide exists
A lot of small businesses around Derbyshire and South Yorkshire have told us the same thing. They got a quote, did not understand half of it, and did not know what questions to ask. This page is designed to help you buy sensibly, not just quickly.
Good cyber security should make things clearer, not more confusing
A good managed security provider should make cyber security easier to understand, easier to manage and easier to evidence. If a service creates more confusion, more noise or more blind spots, something is wrong. Most local cyber security pages say the same thing: protect your business, 24/7 monitoring, advanced protection, peace of mind. Very few explain what a buyer should watch out for. That gap is where poor decisions happen. These are the things worth looking out for before you commit.
Red flags to watch for when comparing providers
These are not hypothetical. They are the patterns that come up regularly when small businesses describe what went wrong with a previous provider - or what stopped them from buying at all.
They lead with product names, not outcomes
Some providers open with a list of tool names, dashboards and licence tiers. That is not what most business owners actually need to hear. What matters is whether threats can be spotted, who checks the alerts, what happens after detection, and whether you will get plain English advice when something goes wrong.
If a provider cannot explain what their service does in plain language without a product brochure, that is worth noting.
Vague claims about "24/7 monitoring"
Lots of providers say 24/7. Fewer can explain what it actually means. Who is monitoring? Is it a real SOC? Is it outsourced? Is it automated alerts only, or does someone investigate? What happens at 2am? Who contacts the client? What is included in the response?
Ask them what happens step by step if a suspicious sign-in appears at 11pm on a Sunday.
The service creates more noise, not less
Small businesses do not need another inbox full of alerts they do not understand. A good MSSP should reduce noise, not add to it. If your team is expected to triage dozens of notifications a week without context or guidance, that is not managed security. That is outsourced confusion.
Ask how many alerts your team would typically need to action each week, and what support is provided to help interpret them.
One-size-fits-all packages
A sole trader, a care provider, a parish council, a nursery and a professional services firm do not all need the same thing. If every business gets the same package regardless of size, sector, compliance requirements or risk appetite, the service has not been designed with your business in mind.
Ask whether the service can be tailored to your specific risk, sector and compliance requirements - such as Cyber Essentials, DSPT or insurance readiness.
No mention of Microsoft 365 identity risk
Many small businesses think they are protected because they have antivirus installed. But a significant amount of real-world risk now sits inside Microsoft 365. Stolen passwords, MFA fatigue attacks, session token theft, suspicious inbox rules, OAuth app abuse, impossible travel sign-ins and compromised accounts are all common - and often invisible without identity-level monitoring.
Ask whether their service monitors Microsoft 365 identity signals, not just endpoint activity.
Ransomware talk with no mention of backup
If a provider leads with ransomware risk but never asks about your backup setup, that is a significant gap. Prevention matters. So does recovery. A backup strategy that has not been tested, does not cover Microsoft 365 data, or has no clear recovery time target is not a backup strategy. It is a liability with a false sense of security attached to it.
Ask when the backup was last tested, what the recovery time target is, and whether Microsoft 365 mailboxes and SharePoint are included.
No clear escalation or containment process
Not every business needs full incident response retained. But every business deserves to know what happens after something is detected. Who contains the issue? What evidence is captured? If an endpoint needs isolating, who does that? If a mailbox is compromised, what is the process? If a provider cannot answer this clearly, the response plan exists on paper only.
Ask them to walk you through a realistic scenario - a compromised account or suspicious endpoint - and explain exactly what happens and who does what.
Security you cannot evidence
Increasingly, businesses need to demonstrate sensible cyber controls - not just have them in place. Cyber insurance applications, client contracts, tender requirements and frameworks like Cyber Essentials all require evidence. A good provider should help you build and maintain that paper trail, not just deploy tools and walk away.
Ask whether their service supports Cyber Essentials, helps with insurance readiness or provides any form of documented security posture reporting.
Scare tactics instead of clear advice
Fear might get attention. It rarely helps a business make a sensible buying decision. If a provider's pitch relies heavily on worst-case statistics, alarming headlines or pressure to act quickly without time to think, that says more about their sales process than their security capability. Good cyber security advice should feel calm, practical and proportionate.
If you leave a sales meeting feeling frightened rather than informed, take that as a signal.
What a good managed security provider should be able to tell you
On protection and monitoring
- Exactly who monitors alerts and when
- What the difference is between automated and human-led response
- How Microsoft 365 accounts and identities are protected
- Whether email threats are handled separately or as part of the service
- How endpoint, identity and email security work together
On response and recovery
- What happens when a threat is detected out of hours
- Who is the named contact during an incident
- Whether backups are tested and what the recovery time looks like
- How a compromised account or device is contained
- What evidence is captured and reported after an incident
On fit and flexibility
- Whether the service can be adjusted as the business grows or changes
- How the package maps to your sector's specific requirements
- What is included in the monthly cost and what sits outside it
- Whether Cyber Essentials or insurance readiness is supported
On communication
- How often you will hear from them - not just when things go wrong
- Whether reports will make sense to a non-technical reader
- How they explain incidents to staff, leadership or trustees
- Whether they help with staff awareness, not just technical controls
Six questions worth asking any provider before you sign
Take these into any provider conversation. The answers - or the absence of clear answers - will tell you a great deal.
Many small businesses do not need a faceless enterprise provider
A lot of organisations around Chesterfield, Derbyshire and South Yorkshire do not need an enterprise-grade MSSP with a hundred-page contract and a ticketing system they never quite understand. They need someone who can explain the risks clearly, recommend the right level of protection, help them avoid buying more than they need - or less than they actually require - and be reachable when something goes wrong. That is the kind of service Black Swan Cyber Security Solutions was built to provide.
Useful next steps
If this page has been helpful, these are the natural places to go next - whether you want to understand specific services, check your current setup or start a conversation.
Huntress Managed EDR
Human-led detection and response that investigates threats rather than just alerting on them. Includes out-of-hours coverage and plain English reporting.
Huntress ITDR
Microsoft 365 identity threat detection. Covers suspicious sign-ins, rogue inbox rules, OAuth app abuse and early signs of account takeover.
Email Security and Phishing Protection
Reduce dangerous emails reaching the inbox and strengthen protection against impersonation, phishing and account compromise.
Heimdal NGAV and DNS Filtering
Next-generation endpoint protection with DNS-layer filtering and patch management built in - reducing the attack surface across devices and networks.
Cyber Essentials Support
Understand what Cyber Essentials requires, close the gaps in your setup and get certified without unnecessary complexity.
Cyber Insurance Readiness
Understand what insurers are asking for, map your controls to the application requirements and build the evidence you need to answer confidently.
Not sure where you stand? Let's take a look together.
Whether you are comparing providers, reviewing an existing service or starting from scratch, we can help you understand what you actually need - and what you probably do not. No pressure. No jargon. Just a clear conversation about your current setup and what sensible next steps look like.
Backed by the world's leading cyber defenders
Meet Kevin: Founder & lead security consultant
Kevin has spent over 20 years solving real-world IT and cyber security challenges for organisations like yours. His approach is refreshingly straightforward: listen first, understand your constraints, then build security that actually works within your budget and compliance requirements.
Beyond technical expertise, Kevin brings a deep understanding of how organisations really operate, gained through years serving as a Parish Councillor, school governor, and charity trustee. He knows what it’s like to balance competing priorities, stretch budgets, and maintain public trust.
Whether you’re dealing with a security incident or simply want an honest assessment of your current protection, Kevin provides clear guidance without the sales pitch.
Ready to discuss your security needs?
Contact Kevin directly – no lengthy sales process, just practical advice from someone who genuinely wants to help.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.