An MSP runs a dealership’s day-to-day IT: the help desk, network, PCs, printers, and backups. An MSSP watches for cyberattacks around the clock from a security operations center. Most stores need both jobs covered, by people who actually talk to each other.
Last updated: October 18, 2026
The letters are the easy part. One extra S, and it stands for security.
What dealers really want to know is simpler than the acronyms. When an alarm goes off at 2 a.m. on a Tuesday, who sees it? And when the security team finds something wrong, who actually fixes it before the service drive opens at 7:30?
I’ve seen that question from both sides of the counter. I came up on a dealership service drive, worked parts and service, and then spent years at DMS companies building training for the people who use the software every day. Now I work with dealer teams at Helion Technologies. Hunting attackers on a network isn’t my job, and our security engineers would be the first to tell you so. What I watch is what happens to the people on the floor when two vendors each own half of a problem and nobody owns the whole thing.
Bias, disclosed up front. Helion does both jobs under one roof, as managed IT for dealerships with cybersecurity for dealerships built into the same contract. You can still use everything below to grade whatever setup you have now, and I’d encourage you to.
MSP vs MSSP, in Plain Dealership Terms
A managed service provider (MSP) runs your IT for a monthly fee: help desk calls, the network, PCs and printers, Microsoft 365 accounts, backups, and calls to your other vendors. A managed security service provider (MSSP) does one job, security, usually from a security operations center (SOC) where analysts watch your systems for signs of an attack.
Both are outside companies, both bill you every month, and both will tell you they protect your store, which is exactly why the overlap between them is where so many dealers get confused. Plenty of MSPs sell some security on the side, and plenty of MSSPs will tell you exactly which patches are missing without ever installing one. If you want the longer case for outside security monitoring, our earlier piece on why MSSPs matter for dealerships lays it out.
| MSP (managed service provider) | MSSP (managed security service provider) | |
|---|---|---|
| Main job | Keeps the store’s technology running | Spots and stops attacks |
| Who starts the call | Your staff, when something breaks | The provider, when an alert looks real |
| Hours | Business hours, sometimes extended | Around the clock |
| What it touches | PCs, printers, network, Wi-Fi, phones, Microsoft 365, backups | Security alerts from computers, servers, accounts, and firewalls |
| What you get from it | Working equipment and closed tickets | Alerts, reports and a list of findings |
| Who fixes the problem | The MSP, for anything in its contract | Often you, or your MSP |
Simple enough on paper. One keeps the lights on. The other watches the doors.
Who Answers at 2 a.m.
Let’s walk one through. I’ll use the parts counter, mostly because I’ve stood behind one and I know how loud it gets at 7:30 when the techs are lined up with ROs.
It’s a Tuesday, a little after 2 a.m., and one of the parts computers starts running a program nobody opened. You’re asleep. So is your GM. If you’ve hired a security company, one of their analysts sees it, and if they’re any good, they shut that computer off from your network within minutes. I mean that as a real compliment. That’s exactly the job you hired them for, and it’s the part most people picture when they hear “MSSP.”
Now look at what they leave behind. A ticket, sent wherever the contract says to send it. A note that the computer has to be wiped or rebuilt. A recommendation to reset the counter person’s password, plus a line saying the same login was used on two more machines, one of them in the service office.
Who rebuilds the computer? Not the security company. Probably your IT provider, once somebody tells them, and somebody usually means your parts manager at 7:35 with a line of techs at the window, reading a security report out loud to a help desk that’s never seen it.
Time is money in this business. That counter feeds every bay.
We set Helion up so that handoff doesn’t exist. Our security monitoring runs around the clock out of a live-staffed, US-based security operations center, and the help desk picks up live from 6 a.m. to midnight Eastern, Monday through Saturday, with after-hours and weekend support included in the same monthly number. The analyst who cuts off the computer and the technician who rebuilds it work for the same company and read the same ticket. By the time your store opens, our people already know what happened. Nobody has to translate. Our managed detection and response page follows one alert from start to finish, and our dealership ransomware guide shows what happens when nobody catches it at all.
Seeing the attack is half the job.
Who Fixes What the SOC Finds
Security reports run long. A monthly findings list from a security provider could easily include things like these:
- A service loaner laptop that hasn’t taken a Windows update in four months
- Remote access left open on the router for a vendor who finished their install last spring
- Two accounts still active for people who left in August. One belonged to a former F&I manager.
- Old firmware on the firewall at the second rooftop, which has been on the list since March
- Microsoft 365 users who still sign in with only a password
Every item there is a job. It isn’t just a fact. Somebody has to schedule the laptop, call the vendor about the remote access, shut off the old accounts, and book the firewall work after hours so sales doesn’t lose the internet on a Saturday. If the MSSP only reports and the MSP only works the tickets that come in, the list just gets longer every month.
Think of a multipoint inspection with nobody assigned to do the work. Every red item gets written up, the customer even signs the sheet, and the car still drives off the lot with all of them.
The Cybersecurity and Infrastructure Security Agency’s guidance for MSP customers makes the same point from the government side. It tells businesses to spell out roles in the vendor agreement, down to which company applies patches, maintains hardware, or trains employees. Microsoft draws a similar line for Microsoft 365. Its shared responsibility model leaves your data, your user accounts, and the laptops and desktops that sign in with you, no matter how much of the platform Microsoft runs.
A finding nobody fixes is still an open door.
What Two Vendors Look Like to the People on the Floor
NADA’s 2025 data counts 16,990 franchised light-vehicle dealers in the U.S., and together they wrote more than 276 million repair orders last year, every one of them printed, signed, closed, and paid through a computer, a login, and a network that somebody has to keep running and keep safe. That’s the part of security dealers actually feel.
When I helped a multi-rooftop group move more than 30 stores from CDK to Tekion, the daily war rooms were mostly about permissions, bank setups, forms, and hardware. None of it was glamorous. It worked because the people in that room were working the same list, and nobody could say a problem belonged to somebody else. That’s the real work, and it’s the same with security. Here’s what a split setup tends to look like, department by department:
- The F&I manager gets locked out halfway through a deal because the security side forced a password reset at 4 p.m. on a Saturday and never told the help desk it was coming.
- In service, an advisor’s PC gets isolated, and the MSP won’t put it back without an all-clear from the MSSP. The customer at the write-up desk waits.
- Accounting gets two invoices.
- Parts just wants one number to call. Can you blame them?
Two vendors can both be good at their jobs and still leave your store in the gap between them.
When an MSP, an MSSP, or Both Makes Sense
No single answer fits every rooftop. It never does. There are three common situations, though, and each one points somewhere different.
A single store with nobody in IT needs both jobs done, plain and simple, and in my experience it’s usually the controller or the GM who ends up as the accidental IT manager, taking vendor calls between month-end close and a full Saturday sales floor. The phishing email that lands in a one-rooftop inbox is the same one that lands at a 20-store group. Buying the two jobs from one team means one phone number and one person accountable when something goes sideways.
Groups with an IT manager or a small IT team usually do best with co-managed IT. Your IT person stays in charge of the store’s technology and keeps the relationships with your DMS provider, your OEM, and your people, while an outside team covers the overnight security watch, the specialties, and the hours one or two people can’t. Nobody is getting replaced. Honestly, that’s the setup where the IT manager finally gets a weekend.
Already happy with an MSP that doesn’t do security? You can add a separate MSSP. Before you sign, though, get three things in writing: who fixes each kind of finding, how fast, and who calls whom when an alert fires at night. If the two companies won’t sit down together and agree on that before the contract is signed, you’ve learned something important about how the first real incident is going to go, and you learned it cheaply. Good.
One more note, for the controller. The FTC Safeguards Rule lets a dealership meet its testing requirement through continuous monitoring, or else through an annual penetration test plus vulnerability assessments at least every six months. Either way, a report proves the testing happened, but somebody at your store or one of your vendors still has to fix what turns up, and the rule doesn’t care which one of them it is.
Whichever way you go, one person should be able to tell you who owns every alert.
What to Ask Before You Sign With Either
We hear the same few lines from dealers every week, so let’s take them in the words people actually use.
“We already have an MSP.” Great. Anybody can fix Windows, though. Ask whether your MSP knows the dealership-specific stuff, like why the wireless in the shop won’t talk to the OEM’s diagnostic equipment, and ask whether a live person or an inbox reads their security alerts overnight.
“Our MSP says they do security.” Maybe so. Maybe they do it well. Ask who’s watching at 2 a.m., whether that person is a live analyst or an automated email, and whether they can cut off a machine without waking you up first to ask permission.
“Can’t we just buy the security software ourselves?” Sure, you can. Software raises the alarm, and somebody still has to answer it.
And whoever you’re talking to, MSP or MSSP, these are worth asking out loud:
- When an alert fires at night, does a person see it or an inbox?
- When you find a problem, who fixes it, and how fast?
- Do you know our DMS and our OEM’s network requirements?
- What’s in the monthly number, and what gets billed extra?
- How quickly does a real person pick up when my F&I office calls? (Ours averages 82 seconds.)
Then get the answers in writing. All of them.
Things Dealers Ask About MSPs and MSSPs
So is an MSSP just an MSP that does security?
Does a single-rooftop store really need an MSSP?
Which costs more, an MSP or an MSSP?
We have an IT manager. Where does an outside security team fit?
What should happen in the first hour after an overnight alert?
One Team, No Finger-Pointing
The acronym on the contract matters a lot less than the phone call at 7:30 in the morning. If the people who caught the problem overnight are the same people fixing it before your first customer pulls into the service drive, your team is set up for success. If they work for two companies that have never met, somebody at your store is about to become the go-between, and it’s almost never the person with the time or the training to do it well. Usually it’s whoever answers the phone.
We’d be glad to show you where your setup stands today. Our complimentary IT and cybersecurity assessment maps who watches what at your store, who fixes it, and where the gaps sit between your vendors, whether you end up working with us or not.
Every alert deserves an owner. One team is the simplest way to make sure it has one.