Nearly all MSPs sell cybersecurity, but protection is still patchy - Channel Dive
Nearly all managed service providers in North America sell cybersecurity services, yet fewer than half deploy critical security controls across most of their customers, according to GTIA's Q3 2026 Cybersecurity Tracker.
The Global Technology Industry Association's Q3 2026 Cybersecurity Tracker surveyed 309 providers and found that 93% offer cybersecurity as a core or complementary service. However, only 42% deploy multifactor authentication across all critical systems for more than half their customers. The figures are even lower for other critical security measures.
Critical Security Gaps
Just 37% of providers implement managed detection and response across most customers, while only 35% offer immutable, air-gapped backups. Even DNS filtering, the most widely deployed control measured, reaches a majority of customers at just 46% of providers. These findings suggest MSPs are taking on more security responsibility than their capabilities can support.
They go to their providers asking more about cybersecurity, and they are looking for somebody who is good at it.
Commercial Consequences
The research shows commercial impacts are already occurring. While 87% of providers gained customers by offering cybersecurity services, 21% lost customers following a security incident in the past year. Customers are becoming more knowledgeable about cybersecurity and more demanding of their providers.
Many go ahead and start selling AI solutions, and in year two or three, realize they've gotten ahead of their skis because we really didn't have our own house in order.
A similar disconnect exists between widespread AI adoption and the maturity of providers' internal practices. While AI use is nearly universal among channel partners, only 20% have formalized it with policies and governance, and just 25% qualify as 'AI driven.'
Related
