Barracuda Research Survey: Future MSP Growth Will Be Driven by AI Expertise and Cyber Resilience

Barracuda’s MSP Survey Is a Warning About AI Risk, Not a Reason to Panic

Barracuda Research surveyed 2,000 mid- to senior-level IT and security decision-makers at organizations with 100 to 2,000 employees. The result is clear. Businesses want managed service providers to do more than monitor alerts.

That does not mean every 30-person company needs an AI security department. It does mean the MSP you hire should understand how artificial intelligence changes phishing, access control, data handling, and incident recovery.

What the survey actually found

Sixty-six percent of the organizations surveyed already work with an MSP. Another 29% are considering or evaluating providers. Barracuda says the strongest growth opportunities for MSPs will come over the next 12 to 18 months.

The most useful number is 59%. That is the share of prospective MSP customers concerned about AI-related risks, including AI-generated phishing, AI-powered social engineering, shadow AI, and AI-enabled insider threats.

These concerns are practical. A criminal can use AI to write a convincing payment request. An employee can paste confidential information into an unapproved chatbot. A former contractor can retain access to an application nobody remembered to review. AI makes some attacks easier, but it also exposes old weaknesses in identity, permissions, and oversight.

AI is not the only gap

Nearly half of prospective MSP customers said important security and resilience capabilities were still at an early or partial stage. The gaps included security leadership, security culture, asset visibility, and third-party risk management.

That matters more than the buzzword. If we do not know what devices and applications a business owns, who can access them, or which vendors handle its data, an AI policy will not save it.

Traditional services still matter. Barracuda specifically says a 24/7 security operations center remains important. We agree. Someone needs to review suspicious activity and respond outside normal office hours. But monitoring alone is not a complete service. A ticket that says “potentially malicious login detected” does not tell an owner what the event means or what to do next.

What this means for a small business

The survey covered larger organizations than many local companies. Its respondents worked for businesses with 100 to 2,000 employees, so we should not pretend the percentages map perfectly to every San Diego small business.

Still, the direction is useful. A small business may not need a dedicated AI governance committee. It does need a written answer to a few basic questions.

Can employees use public AI tools with company information? Which applications are approved? Who reviews access when someone changes jobs? How quickly can we restore email, files, and line-of-business software after ransomware? Which vendors can reach sensitive systems?

Those are management questions supported by technology. They should be answered before a crisis, not during one.

What we would ask an MSP before signing

We would ask for plain answers, not a list of product names. How do you find unknown devices and accounts? How do you handle a suspected business email compromise? What happens if Microsoft 365 is unavailable? Can you explain a serious alert to a nontechnical owner? How do you help us control unsanctioned AI use without blocking useful work?

We would also ask what the monthly service includes. Does it cover after-hours response, backup testing, vulnerability reviews, security training, and incident planning? If those items cost extra, the proposal should say so clearly.

Good technology support should reduce confusion. Forty percent of existing MSP customers in the related findings said clear, plain-language explanations of risks, incidents, and next steps are important when selecting a provider. That is not a soft skill. It is part of security.

Where to spend the budget

We would not start by buying an expensive AI security platform. We would start with asset visibility, multifactor authentication, reliable backups, endpoint protection, email security, and a tested recovery plan. Then we would set rules for AI tools and review who can access business data.

After that foundation is in place, specialized AI-risk services may make sense. Before then, they can become another dashboard sitting on top of unknown equipment and weak permissions.

Ask your current provider to document your AI-use policy, backup recovery test, asset inventory, and incident response contacts within the next 30 days. If they cannot explain those items plainly, IT911Now can help you assess what is missing and decide which fixes deserve your next IT dollar.