In short
A managed security service provider (MSSP) runs security monitoring and controls on an organisation's behalf. Forever Systems works as an MSSP by supplying 24/7 MDR and SOC services from vendors such as Sophos, Check Point, Cisco and WatchGuard, then setting them up, managing them and handling escalation, so you get vendor-scale monitoring with one point of contact.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What a managed security service provider does
Most organisations now own more security tools than they have people to watch them. Endpoint protection raises alerts, Microsoft 365 logs suspicious sign-ins, the firewall flags odd traffic, and the email filter quarantines phishing. Someone has to look at all of it, decide what matters and act, including at night, at weekends and over bank holidays, which is when attackers like to work.
A managed security service provider takes on that work. Depending on the service you choose, an MSSP can:
- Monitor endpoints, identities, email, cloud services and network devices for signs of attack
- Investigate alerts and separate real threats from noise
- Contain confirmed threats within limits you agree in advance, such as isolating a laptop or disabling a compromised account
- Manage the security controls themselves: policies, exclusions, updates, integrations and reporting
- Find and prioritise vulnerabilities, and support you through an incident and its aftermath
If you are new to the term, our guide what is an MSSP? explains it from first principles, and MSSP vs MSP sets out how a security provider differs from an IT support company. The full list of what we can run for you is on our managed security services page.
How our model works
We are open about how this works, because it affects what you are buying. Forever Systems does not run its own 24/7 security operations centre (SOC). The round-the-clock monitoring, investigation and response come from the managed detection and response and SOC services that established security vendors already run at scale: Sophos MDR, Check Point MDR, Cisco XDR, WatchGuard MDR, Blackpoint, CrowdStrike Falcon Complete, SentinelOne Vigilance, Todyl MXDR, ThreatDown MDR and Acronis MDR, among others.
Our job is everything around that service, so it fits your organisation and keeps working:
| Task | Vendor SOC service | Forever Systems | Your organisation |
|---|---|---|---|
| Recommend the right service for your tools, size and risk | - | Yes | Agrees the choice |
| Deploy agents and connect integrations | Provides the platform | Yes | Grants access |
| 24/7 monitoring, triage and investigation | Yes | - | - |
| Response actions within the authority you set | Yes | Helps you set the authority | Approves the rules |
| Policy, exclusion and integration management | Provides the console | Yes | Raises changes |
| Escalation contacts and runbook | Uses them | Yes, and acts as your escalation point | Named contacts |
| Service reviews and recommendations | Provides reports | Yes | Decides on actions |
The exact split of responsibilities is written down and confirmed at quote, so everyone knows who does what before anything goes wrong. Using vendor SOCs means your alerts are handled by analysts who work across many organisations and draw on the vendor's own threat intelligence, while you deal with one provider who knows your environment.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Managed security services we set up and run
Each service below has its own page explaining what it covers, which vendor services sit behind it and where Forever Systems fits.
- Managed SOC services: SOC as a service from vendor operations centres, with our setup, tuning and escalation
- SIEM as a service: cloud SIEM for log collection, detection and retention without running the platform yourself
- Managed XDR: detection and response across endpoint, email, identity, network and cloud
- MDR for Microsoft Defender: keep your Defender licences and add a vendor SOC to watch them
- Managed ITDR: identity threat detection and response for Microsoft 365, Entra ID and Active Directory
- Cyber security monitoring: what gets monitored, by whom and how alerts reach you
- Incident response retainers: expert help agreed before you need it
- Managed endpoint security: deployment, policy and alert routing across leading endpoint platforms
- Managed email security: policy, quarantine, phishing reports and account takeover protection
- Managed firewall: rules, firmware, VPN and logging on the firewalls we supply
- Vulnerability management: scan, prioritise, patch and verify
Vendor services we work with
We are not tied to one SOC. The table shows the main vendor services we supply and manage; it describes how each works and is not a ranking. Our vendors page goes into tiers, coverage and licensing units.
| Vendor service | What the vendor's team does | Read more |
|---|---|---|
| Sophos MDR and MDR Plus | 24/7 monitoring and response on Sophos and third-party tools; MDR Plus adds full-scale incident response | Sophos MDR |
| Check Point MDR, MDR 360 and MXDR 360 | Check Point analysts monitor endpoint, email, network, cloud and identity, with incident response included | Check Point MDR |
| Cisco XDR Premier | Cisco XDR delivered as a managed detection and response service run by Cisco's security experts, including Talos Incident Response and a Technical Security Assessment | Cisco XDR |
| WatchGuard MDR | WatchGuard's SOC watches WatchGuard endpoints, Microsoft Defender, the wider WatchGuard stack or third-party tools, depending on tier | Vendors |
| Blackpoint (CompassOne) | Human-led, AI-assisted SOC for endpoints and identities, with vulnerability management and SIEM in higher packages | Vendors |
| CrowdStrike Falcon Complete Next-Gen MDR | CrowdStrike's team monitors, investigates and remediates on the Falcon platform | Vendors |
| SentinelOne Vigilance (Wayfinder MDR) | SentinelOne analysts cover endpoints, cloud workloads, identity and supported integrations | Vendors |
| Todyl MXDR | Analysts monitor Todyl SIEM, endpoint and SASE data, including Microsoft 365 account takeover | Managed XDR |
| ThreatDown MDR | Analysts hunt, investigate and contain threats on ThreatDown-protected endpoints | Vendors |
| Acronis MDR | Standard or Advanced service on Acronis EDR or XDR, with recovery from backup in Advanced | Vendors |
| Perception Point | A 24/7 managed incident response team included with its email, browser and Microsoft 365 collaboration protection | Managed email security |
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Why work with Forever Systems
A vendor SOC is only as useful as the setup behind it. Agents missing from half the laptops, integrations left switched off and escalation contacts who left two years ago are common reasons a service underperforms. That is the gap we fill.
- Independent choice: because we supply several vendor services, we can recommend the one that fits the tools you already own, rather than the only one we sell
- One point of contact: we manage the vendor relationship, the onboarding and the escalation path, so you do not have to learn each vendor's portal and processes
- Security and IT under one roof: Forever Group also supplies Microsoft 365, connectivity, telephony and cloud backup, so security decisions can take the rest of your estate into account
- Compliance in mind: we can map the service to what Cyber Essentials, ISO 27001, the NIS Regulations, the DSPT or FCA operational resilience ask of you; see UK cyber security compliance
- Cisco expertise: Forever Systems is a Cisco Partner, and we can bring Cisco XDR and Talos services together with the Cisco networking and security you may already run
- Right-sized: services for a ten-person firm look different from those for a multi-site organisation, and we scope accordingly
Who we help
We work with UK organisations that want 24/7 detection and response without building a security team. Common starting points include an insurer's questionnaire asking about monitoring, a customer or supply chain requirement such as the NHS supplier charter, a near miss with a phishing attack, or an IT team that is stretched too thin to watch alerts properly.
| If you are | Start here |
|---|---|
| A small or growing business | Managed security services for small business |
| An FCA-regulated firm | Cyber security for financial services |
| A supplier to the NHS | Cyber security for NHS suppliers |
| A law firm | Cyber security for law firms |
| Working out what regulation asks of you | UK cyber security compliance |
| Comparing providers | How to choose an MSSP |
Getting started
A first conversation usually covers what you have today and what is worrying you. From there:
- We review your current endpoint, identity, email, firewall and Microsoft 365 security and how alerts are handled now.
- We shortlist one to three vendor services that fit your tools, size and the response authority you are comfortable with.
- We agree escalation contacts, response permissions and the responsibilities split with you, in writing.
- We deploy, connect integrations and work with the vendor through onboarding and tuning.
- We stay involved: managing changes, acting as your escalation point and reviewing the service with you.
Pricing depends on users, devices, data sources and the service tier, so ask us for a quote; our MSSP pricing guide explains what drives the cost. Contact us to talk it through.
Explore managed security services
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What does a managed security service provider do?
A managed security service provider monitors and manages an organisation's security on its behalf. That typically means watching endpoints, identities, email and network devices for attacks, investigating alerts, containing confirmed threats within agreed limits, managing security tools and supporting incident response.
Do you run your own SOC?
No. The 24/7 monitoring and response comes from the vendor services we supply, such as Sophos MDR, Check Point MDR, Cisco XDR Premier or WatchGuard MDR, each run by the vendor's own security operations centre. Forever Systems recommends the service, sets it up, manages it and handles escalation with you.
Can an MSSP work with the security tools we already have?
Often, yes. Several vendor services work with tools you may already own: for example WatchGuard Core MDR for Microsoft watches Microsoft Defender for Endpoint, Blackpoint MDR integrates with Microsoft Defender, and Sophos MDR integrates with third-party products. We check what you have before recommending anything.
Is an MSSP worth it for a small business?
If nobody in your organisation can respond to a security alert at night or at weekends, a managed service is usually the most practical way to get that cover. Services aimed at smaller organisations keep onboarding and scope simple; see our page on managed security services for small business.
What is the difference between an MSSP and MDR?
MDR is a service focused on detecting and responding to threats, often delivered by a vendor's own SOC. An MSSP manages a wider set of security controls and can deliver MDR as one part. Our MSSP vs MDR guide explains how the two fit together.
How much does an MSSP cost?
It depends on the number of users and devices, the data sources monitored, log retention, the service tier and whether incident response is included. Ask us for a quote and we will scope it with you.
Still have a question about managed security?
Ask us and a member of our team will reply by email.