Managed Security Services: The journey into the future of IT security
We spoke to Marc Frank, department head at Steep GmbH, a company with over 800 employees and an impressive range of IT services through to defense solutions. His experience shows how IT service providers can successfully implement managed security services – even if you start from scratch.
The beginning: From license sales to services with added value
Marc Frank describes the starting point at Steep as follows: “When I started in 2021, the IT department was still geared towards classic license sales. Customers received software and hardware, but there was a lack of long-term support.” A crucial step was to develop standardized service contracts from recurring activities. For example, the first managed service contract for firewall updates was introduced, which was very well received by customers.
His tip for IT service providers who want to start: “Look at your systems. What services do you provide frequently? Which could be mapped on a recurring basis? Start small, for example with a manageable service such as updates or vulnerability scans.”
Challenge: Get everyone on board
A key success factor was convincing the stakeholders – from management to sales to technicians. Marc explains: “Sales is convinced with efficiency: standardized offers save time and nerves. The technicians, in turn, appreciate clearly defined processes and know exactly what to do – and what not to do.”
Structured communication is the key here. Technicians were involved at an early stage to make the service portfolio realistic. This enabled everyone involved to get behind the new models.
Stumbling blocks and lessons learned
“The biggest mistake is to set the complexity too high,” warns Marc Frank. In the initial phase, it is essential to draw clear boundaries about what a service includes – and what it does not. “We have learned to define exactly what is included in our service contracts. This protects against false expectations and misunderstandings.”
Another tip: Start with customers you know well. “We only offer managed services if we have thoroughly analyzed the customer’s IT beforehand. An unclear starting situation otherwise leads to problems.”
Looking ahead: What does the future hold?
For Steep, the introduction of a traffic light system for security reports is on the agenda for the coming year. “Reports and transparency create trust. Customers want to see what has been done for them. With a traffic light system, we give them a simple overview of the state of their IT security.”
Another topic is preparing for regulatory requirements such as the NIS-2 directive. Marc emphasizes: “We help our customers not only to be technically secure, but also to provide the documentation and processes necessary for audits.”