At present, most information security construction in domestic governments and enterprises is at a relatively early stage, lacking reasonable planning for information security, and generally lacking corresponding security management mechanisms. These problems are limited by the overall management level and informatization level, and are difficult to fundamentally change in the short term. Currently, domestic information security service providers have proposed their own security service systems, which generally include information security assessment, reinforcement, operation and maintenance, education, risk management, etc. While these advanced concepts with a Western background attract users, they also cause great confusion for users. The direct motivation of many users to purchase security services is to cope with current security incidents, satisfy the will of management, or reduce the pressure of public opinion from inside and outside. There is a large gap between service form and content and actual needs.

It must be admitted that current information security services mainly help users in technical aspects, and their impact on management is limited. The biggest problem commonly encountered by users is the lack of their own resources, which is actually the absence of "security administrators", followed by the need to explore the basic management system. From the user's perspective, the actual benefits that information security services can bring include: making up for the user's lack of manpower, making up for the user's lack of technology, making up for the user's lack of information, and making up for the user's lack of management ideas. These service contents are mainly delivered to users through the service team, especially front-line personnel. The technical skills and attitude of the service personnel will directly determine the user's benefits.