MSPs AS CISOs
Acting up Research has found that MSPs are increasingly becoming acting CISO for nearly half of their customers, as AI-driven risk accelerates demand for high-level guidance that they don’t have in-house, which is putting pressures on MSPs.
Cyberthreats have continued to grow in number and complexity in recent years, driven in part by the development of AI. This means that for businesses, managing their information security is an increasingly crucial part of their operations – but that is often beyond the capabilities of their in-house team, which means they are increasingly turning to their managed service providers (MSPs) for help in this. Sophos’ 2026 MSP Perspectives Report revealed that MSPs, traditionally responsible for deploying, managing and supporting IT and cybersecurity technologies, are increasingly being called upon to provide cybersecurity leadership, governance and risk guidance. On average, MSPs estimate that 46% of their customers currently rely on them to act as their chief information security officer (CISO). Sophos’ research suggests this role will continue to expand, with 84% of MSPs expecting demand for CISO services to increase over the next 12 months as organisations seek trusted advisors to help navigate cybersecurity risk, compliance obligations and increasingly complex
security environments. “Organisations require more than technology management to stay secure. They need trusted cybersecurity leaders who can help them understand their risk, navigate compliance requirements and translate security investments into meaningful business outcomes,” says Scott Barlow, vice president and chief evangelist at Sophos. “MSPs are already stepping into this role for nearly half of their customers, creating a significant opportunity to deepen relationships and develop new, higher- value services. The challenge now is delivering that leadership consistently and efficiently across a growing customer base.” The opportunity to create efficiencies is also vast, with MSPs estimating they would save 53% of their time if they could use a single, unified platform for customer security posture and compliance management and reporting. Additionally, 81% believe it would reduce the time they currently spend on these activities by more than 30%. Jamie Akhtar, CEO and co-founder of CyberSmart, notes that the Sophos research supports what the company found in its own 2026 MSP research: in response to increased expectations to support customers with compliance, MSP investment in compliance and regulations has risen from 64% to 72%. “Organisations now expect a trusted adviser who can help them understand risk, meet compliance requirements and make informed decisions about where to invest limited security budgets,” he says.
“
MSPs are already stepping into this role for nearly half of their customers,
creating a significant opportunity to deepen relationships and develop new, higher-
value services. The challenge now is delivering that leadership consistently and efficiently across a growing customer base.
”
REPORT MSP PERSPECTIVES 2026 Insights from 800 MSPs into the challenges and opportunities shaping the future of cybersecurity services.
SEPTEMBER 2026
20
Powered by FlippingBook