Many orgs must deal with a MSSP at some point. They can be used for one-off pentests or up-to and including a managed front-to-back security service with a ‘virtual CISO’. It doesn’t matter if you’re the junior analyst having to work side-by-side with them to accomplish your tasks or if you signed the contract and are responsible for paying them, there are things you should be sure they provide to you. I’ve worked with multiple MSSPs from small to very large and I’ve been an MSSP consultant. I will present some ideas on how to contract with one, some of the tricks they may use when working with you and how to ensure they are giving you what you’re paying for overall. If all else fails, I’ll also detail some of the pain of the rip & replace method of switching MSSPs.