Managed Security Services

A managed security service provider for Canadian small and midsize businesses.

QuantM runs 24/7 monitoring and response alongside the security services around it, so one accountable team owns the security work your IT provider does not.

Book a 15-minute M365 posture review Back to all services

What is included

Security services QuantM can run beside your IT provider.

Start with the service that has the clearest owner or consequence. Scope, platforms, and responsibilities are confirmed in writing before service begins.

  1. 01Managed detection and response

    Human-led monitoring, investigation, and escalation for the systems agreed in scope.

  2. 02Microsoft 365 security

    Identity, access, and configuration review for the tenant your business runs on.

  3. 03Email security

    Protection and investigation for phishing, impersonation, and account compromise.

  4. 04Vulnerability management

    Findings prioritized against business context and tracked to a decision.

  5. 05Firewall management

    Policy, change control, and monitoring for the agreed firewall environment.

  6. 06Backup and recovery

    Backup operations and recovery planning built around business priorities.

Definition

What is a managed security service provider (MSSP)?

A managed security service provider (MSSP) is an outside company that takes on security work for you on an ongoing basis. The work usually includes watching for threats, investigating alerts, operating security controls, and coordinating the response when something is real. You pay a monthly fee instead of hiring and equipping a security team.

The term covers a wide range, from providers that only forward alerts to providers that investigate and act. For a small or midsize business without an in-house security team, the useful question is not the label. It is who looks at an alert at 2 a.m., what they are allowed to do, and who you hear from.

QuantM delivers managed security services with managed detection and response (MDR) at the core. It is a cybersecurity-focused partner, not a general IT provider, and it can run beside the IT provider you already have.

MSSP vs MSP

MSSP vs MSP: what each one is responsible for.

Most small businesses already have an MSP. The gap is usually security monitoring, not IT support. This table shows where the two roles differ.

Main job
MSP (managed IT)Keep users, devices, accounts, and vendors running
MSSP (managed security)Watch for threats, investigate alerts, and coordinate response
Typical work
MSP (managed IT)Help desk, onboarding, patching, device and account administration
MSSP (managed security)Monitoring, triage, investigation, security control operation, reporting
Who looks at security alerts
MSP (managed IT)Often whoever is available, alongside other tickets
MSSP (managed security)Analysts whose job is alert review and escalation
What you get back
MSP (managed IT)Tickets resolved and systems maintained
MSSP (managed security)Escalations with context, containment, and incident reports
Where QuantM fits
MSP (managed IT)Managed IT is available separately, or your current MSP continues
MSSP (managed security)QuantM owns the agreed security scope as the managed security partner

What QuantM covers

The managed security services QuantM can run beside your IT provider.

Each service has its own page. You can start with one and add others as your priorities change.

Managed detection and response
What it doesMonitors the agreed sources, investigates alerts, escalates, and takes the containment actions you pre-approve
Where it helps firstNo one is reviewing alerts from identity, email, and endpoints
Microsoft 365 security
What it doesReviews tenant identity, access, and configuration, and prioritizes findings
Where it helps firstMicrosoft 365 is central to work and tenant security has no owner
Email security
What it doesStrengthens protection and investigation for phishing, impersonation, and account compromise
Where it helps firstPayment requests or impersonation attempts depend on whoever notices first
Vulnerability management
What it doesFinds weaknesses, prioritizes them against business context, and tracks remediation
Where it helps firstScan results pile up without owners or decisions
Firewall management
What it doesMaintains firewall policy, change control, monitoring, and escalation
Where it helps firstRule changes and vendor requests move between providers
Backup and recovery
What it doesMonitors backup operations and plans recovery around business priorities
Where it helps firstNo one can say which systems must return first

Responsibilities

How responsibility is split.

The split is written down per service before work starts. This is the typical shape, and the final version reflects your team and your providers.

Monitoring
QuantMWatches the sources agreed in scope and reviews alerts
Your team or MSPKeeps systems connected and tells QuantM about changes
Investigation
QuantMInvestigates escalated alerts and confirms whether they are real
Your team or MSPProvides business context about users, systems, and normal activity
Containment
QuantMTakes the actions you pre-approved, such as isolating an endpoint or revoking sessions
Your team or MSPApproves anything more disruptive and owns the business decision
Recovery
QuantMProvides the timeline, evidence, and recommended steps
Your team or MSPCarries out recovery and system changes unless they are in QuantM's scope
Day-to-day IT
QuantMNot included unless Managed IT is in scope
Your team or MSPSupport, onboarding, and device administration
Legal and notification
QuantMProvides facts and evidence from the incident
Your team or MSPDecides on legal advice, regulator contact, and notifying customers

Working with your MSP

How QuantM works with an existing MSP.

You do not have to change IT providers to add security monitoring. The usual path keeps your MSP in place and gives security a defined owner.

  1. Map ownership

    Step 1: List who owns what today: IT support, Microsoft 365 administration, firewalls, backups, and security alerts. Gaps are usually easy to see once written down.

  2. Agree the scope

    Step 2: Decide which security services QuantM will own, which tasks stay with the MSP, and who approves changes to production systems.

  3. Set up access

    Step 3: Grant the access QuantM needs for the agreed scope. The MSP keeps administrative control of systems it manages.

  4. Write the handoffs

    Step 4: Document who is contacted for what, in what order, and what QuantM may do before anyone answers.

  5. Review together

    Step 5: Review findings and open decisions on an agreed cadence, so security items reach the people who can fix them.

Scope

What managed security services include, and what stays with you.

Managed security reduces exposure and improves response speed. It does not replace the people who run your business.

In scope

  • Monitoring and investigation for the sources agreed in scope
  • Escalation to named contacts with plain-language context
  • Containment actions you have pre-approved
  • Operation of the security services you choose to add
  • Written reporting and evidence for reviews, insurers, and clients
  • Regular service reviews against the agreed scope

Not included

  • Day-to-day IT support unless Managed IT is part of the agreement
  • Systems and data sources that are not connected or not listed in scope
  • Legal advice and decisions about notifying customers or regulators
  • Insurance coverage, eligibility, and underwriting decisions
  • Any promise that incidents will never occur

Choosing a provider

Questions to ask any MSSP.

These questions separate a provider that forwards alerts from one that takes responsibility for them.

  • Who reviews an alert at night or on a holiday, and what do they do next?
  • What can the provider do without calling you, and what needs your approval?
  • Which systems and data sources are covered, and where is that written down?
  • How does the provider work with your current IT provider?
  • What reports and evidence do you receive, and how often?
  • What happens to your data and your tools if you leave?

Who this helps

Value for whoever owns each security job.

The service starts from the decision each stakeholder needs to make, not from a fixed list of tools.

Owner, COO, or CFO

When this matters

A client questionnaire, an insurance renewal, or a near-miss shows that no one clearly owns security, and the IT provider handles IT rather than monitoring.

What changes

One provider is accountable for the agreed security services, with written responsibilities, named contacts, and reports leadership can read.

Internal IT lead

When this matters

Security work such as alert review, hardening, and vulnerability follow-up competes with user support and projects.

What changes

QuantM can take the agreed security workload or co-manage it, while your team keeps administration and approval authority.

MSP or IT provider

When this matters

The provider runs IT but does not want security monitoring and response to stay an informal add-on.

What changes

QuantM can own a defined security scope beside the provider, with handoffs, access, and client communication agreed in advance.

Delivery model

Who runs which security service, and who approves.

QuantM can take full responsibility for managed IT, cybersecurity, and AI operations, co-manage them with your team, or own a defined specialist scope beside another provider. The engagement documents who owns each function, decision, and escalation.

Fully managed by QuantM

QuantM operates the agreed IT, cybersecurity, and AI services as your managed provider, including the day-to-day responsibilities defined in scope.

Co-managed with your team

QuantM and your internal team divide operational responsibilities based on your people, capabilities, and priorities.

Specialist scope

QuantM owns a defined service beside your MSP or other providers, with explicit handoffs and escalation paths.

Expected outcomes

Clear ownership across the security work.

The service is designed to improve visibility, response speed, and the quality of the next decision. It does not promise that incidents will never happen.

  • One accountable owner for the security work your IT provider does not cover
  • A written split of responsibility across QuantM, your team, and your MSP
  • Alerts that reach a named person with the context to act
  • Evidence for insurers, clients, and leadership from the services in scope

How it works

From first review to a written responsibility split.

  1. Step 01

    Assess

    Review the environment, current providers, and the security work that has no owner. The free 15-minute Microsoft 365 posture review is the usual starting point.

  2. Step 02

    Define

    Agree which services are in scope, who owns each decision, what QuantM may do without calling you, and how escalation works.

  3. Step 03

    Operate

    Run the agreed services and connect them to the people who will act, whether that is your team, your MSP, or both.

  4. Step 04

    Review

    Review findings, open decisions, and the next priority on an agreed cadence, with written reporting.

Related services

Security services to add next.

Managed detection and response (MDR) services24/7 security operations centre (SOC) as a serviceFree 15-minute Microsoft 365 posture reviewMicrosoft 365 security servicesManaged email securityManaged vulnerability managementManaged firewall servicesManaged backup and recoveryManaged IT servicesManaged cybersecurity in TorontoManaged cybersecurity in MississaugaManaged cybersecurity in Hamilton

MSSP and MDR guides

Read more on choosing a managed security provider.

Managed Detection and Response for SMBsWhy small businesses need MDR: five triggersMDR vs. SIEM for small business: who owns what
FAQ

Common questions, answered.

Questions about scope, ownership, onboarding, and what happens next.

Discuss your situation

A managed security service provider (MSSP) is an outside company that runs part or all of your security operations for you. That usually means monitoring, investigation, and response, plus the operation of security controls such as email security, firewalls, and vulnerability management. The aim is to give a business without a security team a defined, accountable owner for those jobs.

A managed service provider (MSP) runs day-to-day IT: support, devices, accounts, and vendors. An MSSP is focused on security: watching for threats, investigating alerts, operating security controls, and coordinating response. Many businesses need both, and the two work best when the split of responsibility is written down.

No, not unless you want it to. QuantM can own the security scope beside your current MSP, co-manage security with your internal team, or run the whole service as a fully managed provider. Handoffs, access, and escalation contacts are agreed before the service begins.

Managed detection and response, Microsoft 365 security, email security, vulnerability management, firewall management, and backup and recovery. Each one has its own service page, and you can start with one and add others as priorities change.

No. Each service can stand alone. Most buyers start with the one that has the clearest owner or consequence, often monitoring and response, and sequence the rest over time.

MDR is the core of what QuantM does, and it has its own service page for the detail. This page covers the wider set of managed security services around it. If your main question is who watches, investigates, and responds to alerts, start with the MDR page.

Responsibilities are documented per service before work begins: what QuantM monitors, what actions it may take without calling you, what needs your approval, and who owns recovery. Business decisions, legal questions, and breach-notification choices stay with you.

Timing depends on the services in scope, the platforms involved, and how quickly access is granted. QuantM confirms the plan after a short review of your environment instead of applying one timeline to every business.

Yes. Monitoring, reporting, and evidence from the services in scope can support insurance renewals and client questionnaires. QuantM also has a cyber insurance readiness service. Coverage, eligibility, and underwriting decisions stay with your broker and insurer.

Book the free 15-minute Microsoft 365 posture review. It looks at identity, email, sharing, app permissions, and who owns monitoring today, and it shows which managed security service would help first.

Next step

See which managed security service would help first.

Book the free 15-minute Microsoft 365 posture review. It covers identity, email, sharing, app permissions, and who owns monitoring today.

Book a 15-minute M365 posture review