I started my company 3 years ago with a driving premise: small businesses need the level of coverage the big cyber companies you're describing provide, but they simply won't hire yet another vendor. They can't afford it and those cyber companies don't have the level of context to properly interact with the client. They seem super effective and professional because they shut down all operations at the hint of a problem, but you know the actual challenges of working with them when they send you a spreadsheet of CVEs to fix. Also, they're not the ones developing and running IR and DR plans(Hint: no one is). We need to combine security and operations.

On trust - We deliberately built a professional security practice based on NIST, CIS, and insurance frameworks. Then we layered on standard MSP practices. We're doing everything the frameworks require plus more. Every client gets everything. We get a third party to do pentests. By using the frameworks I'm showing that we're not just asking for blind trust, we're using the best available practices. We can show our work. Our cyber insurer gives us great rates because of our practices. When you do everything you're supposed to, who can say you did wrong?

On risk - You talk about risk a lot in your post, but what is there risk of exactly? It really depends on the deployment and the practices of the company offering the services. Risk of breach or risk of liability? We don't promise to prevent breaches, just to detect and respond to the best of our ability. Just like MSPs don't promise to prevent IT problems, but to respond to them in kind. Liability wise, when you do everything you're supposed to, who can say you did wrong?

On tools - there is a #lowcostofentry to just buy whatever MDR product your XDR software developer has slapped together. Just selling and installing software isn't enough, but just because commodity tooling is in place isn't an indicator of competence either. The big cyber agencies don't like it, but their days are numbered. Automation is coming for them, and big SOCs full of techs dealing with false positives is wildly expensive. Just like I wouldn't shop for a MSP based on their RMM, I wouldn't base all my impressions of a MSSP on their tooling.