Barracuda Research: AI Security and Cyber Resilience Will Drive MSP Growth

Barracuda’s MSP report points to a practical shift in IT buying

Barracuda Networks’ new report says 59% of prospective managed service customers are concerned about risks tied to artificial intelligence. That number matters more than the headline about MSP growth.

The report, titled What MSP Customers Need Next, surveyed 2,000 IT and security leaders internationally. It found that 66% of organizations already work with an MSP, while another 29% are considering or evaluating one.

That does not mean every small business suddenly needs a new provider. It does mean business owners are asking better questions about what an MSP should do after the contract is signed.

AI phishing is the immediate concern

Among organizations considering an MSP, 40% identified AI-generated phishing and social engineering as concerns for the next 12 to 18 months. Another 29% pointed to shadow AI and AI-enabled insider risk.

We are not surprised. Generative AI has made it easier to produce convincing messages that sound like a vendor, a manager, or a customer. A bad email no longer needs obvious spelling mistakes. It may use the right name, the right logo, and details copied from public information about your company.

For a 30-person business, this does not call for a science-fiction security program. It calls for basics done consistently. Email filtering needs to be configured properly. Multifactor authentication should protect every important account. Staff need a simple way to report suspicious messages. Payment and account-change requests should require a second form of verification.

We would also ask where employees are using AI tools. Someone pasting customer records, contracts, or internal financial information into an unapproved service creates a problem that antivirus software will not solve.

Cyber resilience is more than having backups

Barracuda’s findings also point to cyber resilience as a growth area for MSPs. That phrase can sound inflated, but the underlying issue is plain. A business needs to keep operating after an account compromise, ransomware event, or major cloud outage.

Backups are part of that plan. They are not the whole plan.

We want to know whether backups are isolated from normal administrator accounts, whether they are monitored, and whether files can actually be restored. We also want a written answer to a basic question: who does what during an incident?

A small company may not need a full emergency operations center. It does need current contact information for its IT provider, its cyber insurance carrier, its bank, and its leadership team. It needs a decision about who can shut down a compromised account. It needs a tested recovery process, not a comforting dashboard that says “backup successful.”

Business owners want plain English, not a security lecture

Forty percent of existing MSP customers said plain-language explanations of risks, incidents, and next steps are important when selecting a provider. That should not be a surprising finding. It should be the minimum standard.

When an alert appears, the owner needs to know whether it affects payroll, customer data, operations, or nothing at all. “Critical vulnerability detected” is not a useful business update by itself. A useful update explains what happened, what was contained, what remains exposed, and what decision is needed.

We also think providers should be willing to say when a risk is low. Not every alert deserves an emergency meeting. Good guidance helps a company spend its limited IT budget where a failure would hurt most.

What we would do for a small business

We would not recommend buying an AI security product simply because Barracuda’s report mentions AI. First, we would review Microsoft 365 or Google Workspace settings, administrator accounts, multifactor authentication, email protection, and backup recovery. Then we would ask employees which AI tools they use and what information they put into them.

After that, we would run a short phishing exercise and review the results with management. The goal is not to embarrass anyone. It is to find out whether a suspicious request reaches the right person before money or information leaves the company.

Finally, we would provide a one-page incident plan written for the owner, not for an engineer. It should include the first calls to make, the accounts to isolate, and the facts to preserve.

The report’s survey details beyond the 2,000 participants are not clear, so we would not treat its percentages as a budget forecast. We would treat them as a useful warning about customer expectations. If your MSP cannot explain an AI-related risk in plain English or show how your business would recover after an attack, ask for that conversation this month. IT911Now can help with the review.