Detect and triage
Keep the SIEM, EDR, identity, network, vulnerability, and exposure tools that already detect problems. VitalSec adds the customer information analysts need to decide what deserves action.
MSSP / SOC operations
Turn managed detection into security improvement the customer can see.
VitalSec carries managed security past the alert. Analysts can see the problem, decide what needs to happen, make or assign approved fixes, check whether they worked, and keep the evidence. Customers get a recurring security review that shows what changed, what was fixed, what remains open, and whether risk moved.
EVERY DAY · SOC OPERATIONS
Find the issue. Act. Check the result.
Detection and investigation stay in the tools your analysts already use. VitalSec adds the work that follows: response within the customer's permissions, remediation, a fresh check, and proof.
EVERY REVIEW · CUSTOMER SECURITY REVIEW
Show what changed and how you know.
Walk the customer through what is true now, what changed, what was fixed and verified, what remains open, how current the evidence is, and whether risk improved.
Daily SOC work
The alert is the beginning of the work, not the end.
VitalSec does not replace detection engineering or investigation. It gives the MSSP a consistent way to carry an important finding through response, remediation, verification, and evidence the customer can use.
The same six steps run through that work: Observe → Decide → Act → Validate → Prove → Measure.
Respond inside customer permissions
Recommend a fix, send it to the right team, or make the change only when that customer has approved it. One customer's permissions never carry over to another.
Verify the change
Read the environment again after containment or remediation. Confirm whether the control, exposure, or endpoint actually moved to the required state.
Show the result
Keep the original evidence, action, follow-up check, unresolved exceptions, and risk movement together so the customer can see what improved and what still needs attention.
Customer security review
Make the quarterly review about security state, not service activity.
An MSSP should be able to show the customer what materially changed since the last review, what the team fixed, whether those fixes held, and what still needs a decision. VitalSec keeps that evidence current between reviews.
A useful review should answer six questions
01
Current security state
What is healthy, degraded, failed, missing, or too stale to support a conclusion.
02
Material change
What improved or deteriorated since the last customer review and why it matters.
03
Work completed
Which fixes or response actions ran and whether the follow-up check showed they worked.
04
Open work
Important exposures, failed controls, exceptions, and evidence gaps that still require attention.
05
Risk direction
Risk Compression Engine direction and the supported 0–100 Risk Compression Index when the evidence is sufficient.
06
Evidence ready to reuse
Evidence Continuity evidence that can support executive reporting, audit, renewal, underwriting questions, or claims when needed.
Automation and customer authority
Automate responses within each customer’s permissions.
The MSSP can reuse response steps across customers. What it cannot reuse is customer permission. Each environment keeps its own allowed actions, approval rules, evidence, and results.
Core rule: automation stops when the customer's approved scope stops. A follow-up check still has to confirm the result.
Works with the SOC stack
Keep the tools that detect. Connect the work that follows.
VitalSec reads the systems that know each fact, makes or assigns only the changes that customer has approved, checks the environment again, and keeps the evidence with that customer.
See integrationsDetection
SIEM, data lake, EDR, XDR
Identity
IdP, MFA, PAM, MDM
Network
Firewall, SASE, segmentation
Exposure
Vulnerability, ASM, cloud
Response
SOAR, EDR, Rusty
Recovery
Backup and recovery systems
Workflow
Ticketing and PSA
Evidence
Evidence Continuity, CAAT, VUMA
Why this changes the service
A managed security service should be able to prove improvement.
Fewer dead-end escalations
Give analysts a path from finding to approved action to verification instead of ending the service at notification.
More useful customer reviews
Lead the quarterly security review with current state, material change, verified work, open risk, and proof instead of ticket counts and alert totals.
More automation without losing control
Reuse response steps across customers while keeping permissions, evidence, policies, and results separate for every managed environment.
Evidence the customer can use elsewhere
Keep the same verified history available for leadership, audit, cyber insurance renewal, underwriting questions, and claims support.
Research & white papers
Related research
Selected PatientLock papers on the issues covered here.
White paper
MSSP: From Detection to Verified Remediation
How an MSSP can move from detection into approved remediation, check the environment again, and show the customer what changed without exceeding the customer's permissions.
Central argument
MSSPs can extend beyond detection when customer-authorized remediation, a follow-up check, and evidence stay connected to the original finding without taking control away from the customer.
Written for: MSSP executives, SOC leaders, security engineering teams, and enterprise security customers.
White paper
Measuring MSSP Outcomes Beyond Alert Volume
An outcome-oriented MSSP measurement model using verified remediation, recurrence, exposure windows, evidence gaps, and control-state improvement instead of alert volume alone.
Central argument
Alert counts, cases closed, and analyst utilization describe SOC activity. Customers also need measures showing whether material exposure decreased, remediation held, and evidence quality improved.
Written for: MSSP leaders, SOC managers, customer executives, CISOs, and service-governance teams.
White paper
Continuous Control Validation for MSSP Customers
How MSSPs can combine passive observation with bounded active testing, PASS/FAIL/INCONCLUSIVE outcomes, remediation, and retesting without turning production into an uncontrolled test environment.
Central argument
Continuous validation allows MSSPs to test whether important customer safeguards still behave as expected between incidents, audits, and periodic penetration tests when safe authorized test paths exist.
Written for: MSSP security leaders, validation teams, customer CISOs, and security engineering teams.
White paper
MSSP Evidence Reporting for Customer Governance
How to build MSSP reporting from a durable customer evidence record with material-change summaries, owned exceptions, evidence quality, verified outcomes, and role-specific sharing.
Central argument
Customer governance needs more than a monthly activity deck. MSSP reporting is stronger when executive summaries remain traceable to customer-specific evidence, unresolved exceptions, and verified outcomes.
Written for: MSSP account leaders, customer CISOs, boards, risk committees, and governance teams.