Headline finding · measured 2026-09-08
Only 4.8% of US IT providers present as an MSSP — and the ones that do are more than three times as likely to show a SOC 2.
Both sell security. The difference that shows up in the data is proof: an MSSP is far likelier to publish a third-party audit than an MSP is.
of the 39,188 firms in this market are classified as MSSPs
n = 39,188 published US firms in the IT services market, classified into four categories: msp, mssp, it_consulting and var_telecom. Certification and service shares are quoted against the whole 39,188 with an unknown counting against the share — certifications are listed by only 6,159 of the 39,188, and services by 35,215. Within-category shares are against that category and are named as such. Measured 2026-09-08 in one snapshot.
The published statistic behind this
MSP Signal tracks 40,647 active IT service providers, classified into 13 categories.
n = 40,647 active providers · measured 2026-09-17. The figures on this page are frozen at their own measurement date and are not recomputed from that table.
Providers tracked by category ▸The short answer
An MSP is a managed service provider: it runs a company's IT for a recurring fee. An MSSP is a managed security service provider: the same recurring model, but the thing being run is security monitoring, detection and response.
In this market the MSSP is the rare one. 1,897 of 39,188 firms — 4.8% — are classified as MSSPs, against 16,455 MSPs at 42.0%. The largest category is neither: 18,779 firms, 47.9%, are IT consultancies.
The overlap is the confusing part, and it is large. 9,497 of the 16,455 MSPs, 57.7% of them, already name cybersecurity as a service. So the question a buyer is really asking is not who mentions security but who can prove it.
The difference that shows up in the data is proof
224 of the 1,897 MSSPs — 11.8% — publish a SOC 2. Among MSPs it is 608 of 16,455, or 3.7%. That is more than a three-fold difference in the single most-requested audit in the category.
The pattern repeats on every certification we check. CMMC: 13.2% of MSSPs against 5.1% of MSPs. Any certification at all: 33.4% of MSSPs against 20.9% of MSPs, 10.4% of IT consultancies and 6.4% of VAR and telecom resellers.
Read those as floors, not rates. Certifications are listed by only 6,159 of the 39,188 firms in this market, so 84.3% of the directory does not show us one. "33.4% of MSSPs show a certification" means exactly that — they show us one — and says nothing about what the other 66.6% hold.
What it does not mean: bigger, better rated, or higher ranked
MSSPs are not the premium tier of this market on any measure we hold. The median MSSP carries 3 Google reviews against 7 for the median MSP. Average MSP Signal score is 42.9 for MSSPs and 46.2 for MSPs.
They are not the biggest either, though the gap runs the other way: median headcount is 10 at an MSSP and 7 at an MSP, with IT consultancies at 12 and VAR and telecom firms at 13.
And they are not over-represented at the top. Of the 100 highest-scoring firms nationally, 67 are MSPs, 23 are IT consultancies, 7 are MSSPs and 3 are VAR or telecom. An MSSP is a specialization, not a rank.
Price is the question neither side answers
276 MSPs publish a per-user, per-month rate. Only 18 MSSPs do. That is far too small a base to quote a median for, so we do not give one — with 18 firms a single outlier moves the middle by more than the difference anyone is trying to measure.
What can be said is that the two published sets do not sit on top of each other. Among the 18 MSSPs the median entry rate is $62.45 and the median top-of-range rate is $133.50; among the 276 MSPs the same two figures are $89.50 and $125.00. Treat the MSSP pair as an indication and nothing more.
Both figures count only rates quoted per user per month between $10 and $500, taking each firm's own lowest and highest such rate. Hourly labor, per-device, per-server, flat monthly and setup fees are excluded, because pooling those units into one number is how three earlier pricing figures on this site went wrong.
How to tell which one you are talking to
Ask what they monitor and who watches it overnight. An MSSP sells a security operations function — detection, triage, response — and 14.1% of them name incident response as a service against a far smaller share of MSPs.
Ask for the audit, not the adjective. 84.3% of this market shows no certification at all, so a firm that can hand you a SOC 2 report has already separated itself from the field, whatever it calls itself.
Ask whether security is the product or a line item. 63.6% of MSSPs name cybersecurity and 46.8% name compliance; for an MSSP those are the business, and for most MSPs they are two entries in a bundle of five.
What this number can't tell you
- ·The four categories are MSP Signal's own classification, derived from what each firm publishes. There is no registry of MSSPs and no firm is asked to self-identify, so a security-led MSP and a small MSSP can sit on either side of the line.
- ·Certifications are listed by only 6,159 of the 39,188 firms, so every certification share is a floor. Read them as "shows us one", never as "holds one".
- ·Certification tokens are matched to a controlled vocabulary and unioned across spellings where the same credential is recorded two ways — SOC 2 counts both `soc2` and `soc_2`, CMMC counts both `cmmc` and `cmmc_l2`. Without that union the SOC 2 counts would each be understated.
- ·Services are on file for 35,215 of the 39,188 firms, so service shares are floors too.
- ·The pricing comparison rests on 18 MSSPs and 276 MSPs. No median is quoted for the MSSP side and the figures given are each set's median of per-firm minimum and per-firm maximum, not a pooled median of all rates.
- ·Review counts and headcount are medians over the firms where we hold that field, not over the whole category.
- ·The top-100 split is by MSP Signal score, which is our own ranking and not a measure of security capability.
What to do about it
- ▸Buying security: ask for the audit. 84.3% of this market shows no certification, so "we do security too" is the default claim, not a differentiator. A SOC 2 or CMMC on file puts a firm in the top tenth of what buyers can actually verify.
- ▸Buying general IT: you probably do not need an MSSP. 57.7% of MSPs already name cybersecurity, and MSSPs do not score better or carry more reviews — pick on proof and response commitment rather than on the label.
- ▸Selling as an MSSP: 11.8% of your own category publishes a SOC 2 and only 18 of you publish a price. Both are cheap ways to be the legible option in a market where almost nobody is.
Questions this finding answers
- What is the difference between an MSSP and an MSP?
- Both sell security. The difference that shows up in the data is proof: an MSSP is far likelier to publish a third-party audit than an MSP is.
- How was this measured?
- n = 39,188 published US firms in the IT services market, classified into four categories: msp, mssp, it_consulting and var_telecom. Certification and service shares are quoted against the whole 39,188 with an unknown counting against the share — certifications are listed by only 6,159 of the 39,188, and services by 35,215. Within-category shares are against that category and are named as such. Measured 2026-09-08 in one snapshot.
- What can't this number tell you?
- The four categories are MSP Signal's own classification, derived from what each firm publishes. There is no registry of MSSPs and no firm is asked to self-identify, so a security-led MSP and a small MSSP can sit on either side of the line.
Where does your firm sit on this?
Claim your MSP with a magic link from your company email to see your own certifications, reviews, web footprint and local rank measured against every provider we track.
Claim your MSP ▸Related markets
More findings
- 1,8971,897 US firms present as MSSPs — and only 7.4% of them name managed security services as a service.
- 9.1%Project work is listed almost twice as often as managed work: 53.0% of US IT firms name a project service, 28.6% name a managed one.
- 15.5%6,083 US IT providers name education — 15.5% of the market.
- 32.1%4,027 US IT providers name construction — and they are the best-credentialed vertical group we measure.