A conversation about co-managed versus fully managed security that starts with a shared inbox — “forward the alerts,” “we all see the mailbox,” “someone will pick it up after hours” — usually fails at the first unowned action, not at the first ticket. A shared inbox is a distribution list. It is not an operating model.
This page is the first Security advisor operating-model brief. It is not an MSSP provider shortlist, not a detection-depth comparison, and not a ranked list of tools. It is the set of questions that keep a mailbox from being treated as co-managed or fully managed security.
Why a shared inbox is not the model
An inbox proves someone can be copied. It does not prove who monitors, who may isolate a host, who accepts residual risk, or what happens at 02:00. Two mailboxes can look identical and still leave privileged access unowned and detection with no one who can act. A Supplier Matrix or Hub catalog view has the same limit. It is a screen. It can show that Security-shaped offerings exist among Security and Cloud — hundreds of named suppliers across fourteen categories. It cannot name your after-hours authority or the information that must stay out of an uncontrolled first form. Treat the catalog as an outbound screen, not as the operating model. The Data Partner is the advisor on that frame, not the monitored service.
Decision grid
Fill the same columns before anyone treats a mailbox as co-managed or fully managed security.
| Signal | Shared inbox | Co-managed | Fully managed |
|---|---|---|---|
| After-hours | Whoever is awake | Named internal + provider | Named provider, written hours |
| Authority | Forward the ticket | Internal still acts | Written: isolate / disable / notify |
| What they operate | Nothing defined | Split, written | Defined work they run |
| What you still own | Everything | Identity, change, residual risk | Residual risk + prerequisites |
| Evidence a reviewer accepts | Email thread | Split runbook | Case + ticket |
| Comparison format | Tool names | Two owners, unclear | Same columns, same work |
The live MSSP provider shortlist is the companion when the next job is which providers belong on a list — not how the work is operated. The MSSP versus MDR page is the companion when the decision is detection and response depth. The managed cybersecurity provider evaluation is the companion that holds the scorecard once the model is written. The cloud security responsibility matrix is the companion when the split is buyer-owned cloud controls, not the managed operating model.
First-meeting scorecard
| Check | Written? | Owner |
|---|---|---|
| Work to be operated — monitor, act, report | ||
| After-hours owner and hours | ||
| Authority written before 02:00 | ||
| What stays internal | ||
| Evidence a later reviewer would receive |
If those answers are a shared inbox and a promised tooling week, you do not have co-managed or fully managed security. You have a mailbox.
What this page is not
This is not a provider ranking, not an MSSP brochure, and not a claim that The Data Partner already operates anyone’s detection after an inbox review. It is not a clone of the live MSSP provider shortlist. Skip incentive talk, skip shared inboxes as a substitute for written authority, and skip any suggestion that a catalog row replaces a shared brief. Write the rows. Then request comparable replies. If you want a second set of eyes on the brief, start with a conversation.