MSSP or MSP: what AI tells a 100-person Australian company

Ask any of the five generative AI engines Australian buyers use whether a 100-person company needs a managed security services provider or a managed services provider, and you get five different answers. We put that exact question through the engines over the last fortnight. Here is what they return, where they agree, where they diverge, and what you should actually be deciding.

Updated 10 October 2026: the live /scan now uses four engines; see Terms for current configuration.

Why this question is now a GEO problem, not just a procurement one

For the past two decades, a company this size decided MSSP or MSP by asking a short list of people: a trusted CISO, a vendor they met at a conference, a Google search for “best MSSP Sydney” and a review of the top five results. The decision was slow, biased toward brand recall and sales contact, and anchored on whoever ran the best SEO.

That process is quietly shifting. Buyers who have grown up with search are now asking ChatGPT, Perplexity, Gemini, Claude and Google’s AI Overviews the same category-defining questions they used to put into Google. The answer is a short written recommendation with two or three named firms, not a list of ten blue links to evaluate. The scroll stops at whoever the engine named.

That changes the game for providers. If your firm is not surfaced in an AI engine’s answer, you are not on the shortlist. The buyer does not click past the summary to a page you have optimised for. They copy the names the engine gave them, open the websites of those three or four, and start a conversation with the ones that look credible.

For a 100-person Australian company deciding between an MSSP and an MSP, the question is not just about procurement. It is about which engines they are using, which firms those engines surface, and whether the engines even draw the distinction between the two models the way the industry does.

What each AI engine actually recommends

We ran the prompt “MSSP vs MSP for a 100-person Australian company” through five engines, each with its live web-grounded answer mode: ChatGPT (via SerpApi’s ChatGPT search endpoint), Perplexity (Sonar Pro), Google Gemini 2.5 Pro grounded with Google Search, Anthropic Claude with web search, and Google AI Overviews. Every answer was scored the same way: who the engine recommended by name, who it mentioned without recommending, and who it ignored entirely.

The findings differ sharply.

ChatGPT leans into brand names it has seen in enterprise contexts. It confidently recommends two or three large Australian firms that have published cybersecurity content for a decade. The answer reads like a procurement shortlist from 2018, with a slight preference for firms with a published Essential Eight capability statement.

Perplexity does the opposite. Its answer is heavy on the methodology question itself. It explains what an MSSP is, how it differs from an MSP, when a 100-person company might need one, and only then names a handful of firms, pulling heavily from directory listings and local press rather than company sites. The firms it names are different from ChatGPT’s, with less brand gravity and more directory presence.

Gemini gives the most Google-flavoured answer. It leans on recent news stories, listicles from Australian cybersecurity publications and vendor-sponsored content that happens to rank. Its named firms often include two of ChatGPT’s picks plus one that shows up only because it placed on a 2026 industry roundup.

Claude gives the shortest answer. It is cautious about naming firms it cannot verify, so the response is more about helping the buyer frame the decision than about naming vendors. When Claude does name a provider, it tends to pick ones with transparent service descriptions on their own site, not ones with the most press coverage.

Google AI Overviews is the hardest to read. The answer compresses several listicle sources into a short paragraph, usually naming the one or two firms that appear in the most independent directories at once. It drops anyone whose web presence depends on paid content.

Five engines, five materially different shortlists.

Where the engines agree, and where they diverge

Across a fortnight of running the same prompt, three things held true in every engine’s answer.

First, every engine framed the MSSP as a specialist operating a 24-7 security operations centre with Essential Eight expertise, usually with ISO 27001 or IRAP-adjacent language. The MSP is framed as a generalist handling patching, backups, Microsoft 365 licensing and some endpoint security.

Second, every engine suggested that a 100-person company is the awkward middle. Too large to be well served by a basic MSP, too small to afford a top-tier MSSP’s retainer, which the engines routinely peg at AUD 5,000 to AUD 15,000 per month without naming a source.

Third, every engine recommended one of two paths: a hybrid where an MSP handles general IT and an MSSP handles detection and response, or a mid-tier MSSP with a lighter commercial model. No engine suggested doing it in house.

The divergence is in who gets named.

The named firms across the five engines overlap by less than a third. Some firms appear in four of five answers. Others appear in only one. A couple appear in none of the five, despite being the most-cited security providers in Australian industry press over the last two years. The engines are not drawing from the same source material.

That is the gap this blog exists to make visible. If you are a 100-person Australian company, the shortlist you are given by AI depends entirely on which engine your decision-maker opens. That is a structural problem, not a vendor-selection problem.

What a 100-person Australian company should actually be deciding

Ignoring which engine your decision-maker uses for a moment, the real choice between MSSP and MSP is about four questions, not five vendors.

1. What are you obligated to defend against, and under what framework? If your workloads include Commonwealth data under IRAP, or you handle regulated financial, health or legal records, you need the Essential Eight maturity, SOC monitoring and incident response of a proper MSSP, usually paired with a Trusted Insider Threat capability. An MSP will not get you there.

2. Who owns detection and response? A 100-person company usually cannot staff a 24-7 security team. An MSP will patch and back up but will not watch your logs at 2am Sunday morning. If detection and response is your gap, you need an MSSP for that function specifically, even if you keep an MSP for the general IT work.

3. What is your spend tolerance, and over what period? A top-tier MSSP retainer puts you in the AUD 10,000 to AUD 20,000 a month range for serious coverage of a 100-person environment. A mid-tier MSSP or a hybrid MSP + MDR provider can halve that. The question is whether you are buying coverage, or buying a partner who will own problems.

4. How technical is your decision-maker? If your CIO or head of IT reads detection logs for breakfast, they can run a tight MSP relationship and buy MDR separately. If your decision-maker is a general CFO or COO without security depth, they need a provider who takes responsibility for outcomes, not one who delivers alerts for them to triage. The second one is an MSSP.

Answer those four and the MSSP-or-MSP question answers itself. The engines will not do this for you. They will give you three names and move on. The decision underneath is yours.

How to use what AI tells you

If you are the one deciding, treat the AI engines as a market map, not an answer. Ask the same question to all five, note the overlap, and look at who sits in only one shortlist and who sits in four. Overlap is signal that a firm has invested in showing up where buyers actually look. Appearance in one engine only might mean the firm has gamed a single source. Absence from all five is the one to question hardest, especially if you have heard the firm’s name through a trusted industry contact.

If you are a provider trying to be surfaced, the problem is not SEO in the 2015 sense. The engines are not indexing meta descriptions. They are extracting named entities from pages and sources they trust, then recommending the firms whose entity presence is strong enough to be remembered. If your capability statements, directory listings and Essential Eight claims are not where the engines are looking, you are invisible in the shortlist, no matter how good your service actually is.

The Australian Cyber AI Visibility Index is live at radar.payloadfoundry.com/leaderboard. It measures how five named Australian cybersecurity firms appear across four generative AI engines (Claude, ChatGPT, Gemini, Perplexity) on ten real buyer prompts, with the methodology published in full. Google AI Overviews is excluded from the Index itself because its answer quality has become inconsistent. The first scheduled monthly refresh fires on 3 November 2026, with every refresh thereafter published on the third of each month. If you want to see which firms the engines are naming and why, that is the asset to watch.

If you are a 100-person Australian company making this call now, Hello@payloadfoundry.com. We can show you where you or your preferred shortlist sit in the data and what to prioritise before the November refresh.