Almost every MSSP disappointment is a scope mismatch, not a capability failure: buyers think they bought detection and response and they bought alert forwarding. The evaluation framework, from containment authority and monitored scope to SLAs with real remedies, the first ninety days, the shared-responsibility gaps that breach people, and exit terms.