Pricing Models, Comparisons and 2026 Rules
MSSP vs MDR vs SOC-as-a-service: what each includes and how it is priced
MSSP, MDR and SOC-as-a-service compared: what each includes, who responds, how each is priced and which fits a Canadian SME.
An MSSP (managed security service provider) runs security tools and services for you, such as endpoint protection, firewalls, email filtering and monitoring. MDR (managed detection and response) focuses on one outcome: people watching for threats around the clock and acting on them, for example isolating an infected laptop. SOC-as-a-service gives you an outsourced security operations centre that collects and analyses logs from many systems, usually through a SIEM, and escalates or responds. The labels overlap and providers use them loosely, so the decision is less about the name and more about four questions: what is monitored, who responds, how fast, and how it is billed.
This guide is part of managed cybersecurity service pricing in Canada. Prices are illustrative ranges, not any provider's price.
The three models side by side
| MSSP (managed security) | MDR | SOC-as-a-service / managed SIEM | |
|---|---|---|---|
| Core idea | Operate and maintain security controls | Detect and stop active threats 24/7 | Centralise and analyse logs from many sources |
| Usual data sources | The tools they manage (endpoint, firewall, email) | Endpoint agents, often identity and cloud apps | Firewalls, servers, cloud, identity, applications, endpoints |
| Response | Often configuration changes; alerting | Remote containment: isolate host, kill process, disable account | Ranges from notification only to full response |
| Typical pricing basis | Per user or per device per month, tiers | Per endpoint or per user per month | Per GB per day or events per second, plus retention |
| Illustrative CAD range | $40–$110 per user per month for a bundle | $12–$35 per endpoint per month | $120–$350 per GB of daily volume per month |
| Strength | One provider, broad coverage | Fast action on the most common attacks | Visibility and evidence across the whole environment |
| Weak spot | Monitoring depth can be thin | Blind to what has no agent | Can drown in alerts if nobody acts |
Many Canadian providers sell a mix: for example an MSSP bundle that includes MDR from a specialist partner, or a SOC service that includes an EDR tool. National telecom carriers, IT managed service providers (MSPs) that added security, regional security firms, large consultancies and international MDR specialists all sell in this market. Their names say nothing about scope; the statement of work does.
What "response" really means
The word that separates cheap from expensive services is response. Ask the provider to say which of these they do, without phoning you first:
- Isolate a device from the network.
- Kill a malicious process or quarantine a file.
- Disable or force a password reset on a compromised account.
- Block an IP address or domain at the firewall.
- Revoke active cloud sessions or tokens.
- Restore from backup.
- Carry out forensic investigation and write a report usable for regulators or insurers.
An MDR service usually covers the first three or four. Restoring systems and full forensics are often incident response, billed separately or covered by a retainer; see incident-response retainer pricing. A SOC that only notifies is cheaper, but someone on your side then has to act at 3 a.m.
How to tell which one you need
| Your situation | Likely starting point | Why |
|---|---|---|
| 10–50 staff, mostly laptops and Microsoft 365 or Google Workspace, no IT team | MDR covering endpoints and identity, or an MSSP bundle that includes it | The most common attacks start with email and stolen credentials |
| Office with servers, firewall and a line-of-business application, part-time IT | MSSP bundle with managed firewall and MDR | Someone must maintain the infrastructure as well as watch it |
| Several sites, regulated clients, need for evidence and long log retention | SOC-as-a-service with SIEM plus MDR for endpoints | Correlation across sources and searchable history |
| Strong in-house IT that wants night and weekend coverage | MDR or SOC with clear hand-off to your team | Fills coverage gaps without replacing staff |
| Client or insurer asked for "24/7 monitoring" | Check exactly what they mean before buying | The wording in the questionnaire decides what counts |
Use the provider due-diligence checklist to keep the comparison on the same footing, and how to choose a managed security provider for the full method.
Worked comparison (illustrative)
A 30-person Calgary engineering office has 30 laptops, 3 servers and one firewall. It receives three proposals, all invented for illustration:
| Proposal | Monthly calculation | Monthly | Yearly |
|---|---|---|---|
| A: MDR only | 33 endpoints × $22 | $726 | $8,712 |
| B: MSSP bundle | 30 users × $65 + firewall $250 | $2,200 | $26,400 |
| C: SOC with SIEM | 8 GB/day × $200 + MDR 33 × $18 | $2,194 | $26,328 |
Proposal A is cheapest but does not manage the firewall, patch the servers or collect firewall logs. B includes patching, firewall management and awareness training. C gives the deepest visibility but no patching. B and C cost almost the same yet buy different things. The right choice depends on whether the office's gap is maintenance (B) or visibility and evidence (C). Many businesses solve it with A plus an IT provider for maintenance.
Contract terms that differ between models
- MDR: response authority, list of included data sources, cap on the number of investigations, what happens to devices without an agent.
- MSSP: change-request limits, patching windows, who owns the firewall configuration, which tools are bundled.
- SOC: log sources included, daily volume cap, overage price, retention period, who writes detection rules, export of logs at exit; see exiting a provider without losing your logs.
Frequently asked questions
Is MDR the same as EDR?
No. EDR (endpoint detection and response) is software on each device. MDR is a service in which people use EDR and other data to detect and respond for you.
Can an MSP provide security?
Many IT managed service providers offer security services or resell MDR. Ask who actually monitors alerts at night, and whether that is their own team or a partner.
Do I need a SIEM?
Not always. Smaller businesses with few systems often get more value from MDR covering endpoints and identity. A SIEM becomes useful when you have many log sources or need long, searchable retention for evidence. See SIEM and log-volume pricing.
What is XDR?
Extended detection and response is a marketing term for detection across endpoints, identity, email and cloud in one platform. Treat it like MDR: ask which sources are included and who responds.
Sources
- Canadian Centre for Cyber Security — guidance on managed services and outsourced IT security
- Office of the Privacy Commissioner of Canada — responsibilities when a service provider handles personal information
- Innovation, Science and Economic Development Canada — small business cyber security resources
