Security demands from MSPs are widening

MSP customers now expect more than a security alarm

Barracuda’s survey of 2,000 IT and security decision-makers found that 66% already outsource security to a managed service provider, while another 29% are considering or evaluating one. The respondents worked at organizations with 100 to 2,000 employees.

That is a large market, but the more useful finding is what those companies want from an MSP. They are not asking only for someone to watch alerts overnight. They want help assessing risk, deciding what to fix, preparing for recovery, and explaining security issues to the people who run the business.

Security monitoring is necessary, not sufficient

Most businesses still need the basics. We need to know when an account is compromised, when a device starts behaving badly, and when a suspicious email reaches an employee. A provider that cannot deliver dependable detection and response has no business selling managed security.

That is the starting point. It is not the whole service.

The survey found demand for cyber-resilience strategy, identity and email security, compliance support, executive reporting, and 24/7 detection and response. Customers also wanted remediation recommendations rather than a stream of warnings that someone inside the company must interpret.

We agree with that direction. An alert is not a business decision. The useful question is whether the alert means we should disable an account, rebuild a laptop, contact a customer, involve legal counsel, or simply document a low-risk event.

AI risk is showing up in ordinary offices

Fifty-nine percent of prospective MSP customers said they were concerned about AI-related risks. Those concerns include AI-generated phishing, AI-assisted social engineering, unauthorized AI use, and insider risk tied to so-called shadow AI.

The headline can sound larger than the problem for a 30-person company. We do not think every small business needs a separate AI security department. Most do not.

They do need clear rules. Which AI tools may employees use with company data? Who approves a new service? What happens when an employee pastes a customer contract or financial report into a public chatbot? Are Microsoft 365 audit logs, identity controls, and email protections configured well enough to spot the fallout?

Those are ordinary IT questions with a newer source of risk. We would start there instead of buying an expensive product because it includes “AI” in the name.

Plain English is part of the service

Forty percent of existing MSP customers said clear, plain-language explanations of risks, incidents, and next steps mattered when choosing a provider. That should not be surprising. A business owner cannot make a good decision from a report filled with severity scores and security abbreviations.

We would expect an MSP to explain an incident in terms such as these: what happened, which accounts or systems were affected, what has been contained, what remains exposed, and what the business should do next.

That communication also needs a regular schedule. A monthly report should show unresolved risks, aging equipment, backup test results, account weaknesses, and the decisions that need management approval. If the provider only contacts you after an alarm fires, you are paying for reaction instead of preparation.

What we would check before signing

Staffing shortages are increasing the pressure on smaller organizations to use outside help. That does not mean every MSP is ready to provide strategic guidance. Some are still mainly resellers with a ticket queue and a monitoring dashboard.

Before choosing or expanding an MSP, we would ask:

• Who responds to a compromised account at 2 a.m., and what can that person do without waiting for approval?
• How often will the provider review identity, email, backup, and endpoint risks with management?
• How does the provider handle AI tool approvals, data exposure, and employee misuse?
• Will incident reports explain business impact in plain language?
• Can the provider show how it tests recovery, not just how it creates backups?

We would also ask for a sample executive report and a written incident-response process. Those documents reveal more than a polished sales presentation.

Spend first on decisions that reduce exposure

This survey does not mean a small business needs every security service available. A 30-person company may get more value from fixing weak Microsoft 365 authentication, protecting administrator accounts, testing backups, and training staff against phishing than from adding another dashboard.

The broader message is sound. An MSP should help decide what matters before an incident, act during the incident, and explain the result afterward. If your provider only reports alerts, ask what happens next. IT911Now can help review that gap and turn it into a practical security plan.