Sophos, a global leader in innovative security solutions designed to defeat cyberattacks, has released its inaugural “MSP Perspectives 2024” survey report. The report reveals that the most significant day-to-day challenge facing Managed Service Providers (MSPs) is keeping up with the latest cybersecurity solutions and technologies, as cited by 39% of the MSPs surveyed. Additionally, MSPs highlighted the difficulty in hiring new cybersecurity analysts to manage customer growth and address evolving cyberthreats.
The survey also indicates that MSPs view the shortage of in-house cybersecurity skills as the single biggest cybersecurity risk to both their own businesses and their clients’ organizations. Furthermore, MSPs identified stolen access data and credentials, as well as unpatched vulnerabilities, as major security risks for their customers.
Supporting these findings, the latest State of Ransomware 2024 report found that nearly a third (29%) of ransomware attacks began with compromised credentials, underscoring the prevalence of this entry vector.
“The speed of innovation across the cybersecurity battleground means it’s harder than ever for MSPs to keep up with threats and the cyber controls designed to stop them.
“When you couple this with a global skills shortage, which has made it infinitely more difficult for many MSPs to attract and retain cybersecurity analyst resources, its unsurprising that MSPs feel unable to keep pace with the changing threat landscape,” said Scott Barlow vice president of MSP at Sophos.
“This is all compounded by the need for 24×7 coverage as indicated in our 2023 Active Adversary report for Tech Leaders, which finds that 91% of ransomware attacks now happen out of business hours.”
In response to the complex threat landscape, there is a growing demand for managed detection and response (MDR) services to provide continuous coverage. Currently, 81% of Managed Service Providers (MSPs) offer an MDR service, and nearly all (97%) of those that do not plan to add it to their portfolio in the coming years.
Reflecting the shortage of in-house cybersecurity skills, 66% of MSPs use a third-party vendor to deliver MDR services, while an additional 15% provide these services jointly through their own Security Operations Center (SOC) and a third-party vendor. A critical capability for a third-party MDR provider is the ability to offer a 24/7 incident response service.
MSPs are also streamlining their cybersecurity partnerships, with over half (53%) working with just one or two cybersecurity vendors, and 83% using between one and five vendors. MSPs estimate that they could reduce their day-to-day management time by 48% if they could manage all their cybersecurity tools from a single platform, highlighting the effort and overhead of running multiple platforms.
Other interesting findings from the report include:
- 99% of MSPs report an increase in demand for cyber insurance-related support, with the most common requests being for implementing an MDR service to improve insurability (47%) or assistance in completing insurance applications (45%).
- Flexibility from MDR providers is crucial, with 71% of MSPs stating it is “essential or very important” that the vendor can use telemetry from their existing security tools for threat detection and response.
- MSPs in the U.S. lead in MDR service provision, with almost all (94%) offering MDR, compared to 70% in Germany, 62% in the U.K., and 58% in Australia.
“While MSPs have a significant task in protecting their customers against fast-moving adversaries, there’s a tremendous opportunity to grow their business and profitability if they can find the right security setup,” said Barlow.
“The data shows that MSPs are strengthening their proposition and reducing overheads by consolidating the platforms they use and partnering with third-party MDR vendors to expand their service offerings.
“As they look to build their security offering of the future, they should prioritize vendors that can offer a complete portfolio of industry-best, fully managed security services and solutions,” Barlow continued.
Data for the MSP Perspectives 2024 report comes from a vendor-agnostic survey of 350 MSPs across the U.S. (200), U.K. (50), Germany (50), and Australia (50). The survey was commissioned by Sophos and conducted by research house Vanson Bourne in March 2024.
