MSSP vs MDR is the difference between two kinds of outside security service: an MSSP mostly forwards alerts to the customer, while an MDR provider investigates the alert and stops the attack itself. MSSP stands for managed security service provider. MDR stands for managed detection and response. Both are kinds of managed service, in which an outside company does work that the customer would otherwise do itself.
The MSSP is the older model. It watches the customer's alerts from its own security operations centre (SOC). When an alert looks important, it forwards the alert to the customer, usually by email or in a ticket. Many MSSPs also manage the customer's equipment, such as its firewalls. But investigating the alert and acting on it is left to the customer. If the alert arrives at night and nobody at the customer reads it until the next working day, the attacker has all that time.
MDR is the newer model. Its analysts investigate the alert themselves, using the customer's own security tools. If the attack is real, they contain it. To contain an attack means to stop it from spreading. For example, the analysts cut a laptop off from the network through the endpoint detection and response (EDR) software. Then they tell the customer what they did.
Consider a hotel group in Goa. At 11 p.m. on a Saturday, an alert fires: someone abroad is trying thousands of passwords on the hotel booking server. An MSSP emails the alert, and the IT manager reads it at 9 a.m. on Monday. An MDR provider blocks the attacker's address at the firewall within ten minutes, and then calls the IT manager.
Today the line between the two is not sharp. Many MSSPs now sell MDR as well. The real question for a customer is how far the provider may go without asking first. Some providers may only isolate a laptop. Others may also disable accounts or block addresses at the firewall. Some customers own a SIEM and want the provider only to read it.