While there’s a lot of information about increased cyber threats, the biggest issue may not be that organizations are being hit harder, but that they are less confident in their ability to cope in the wake of a successful attack.
Organizations considering MSPs aren't reporting more security incidents than those already using MSPs. What distinguishes those using MSPs is their confidence in responding when something goes wrong, and that gap is creating opportunities for providers that can deliver more than technical protection.
New research from Barracuda sheds light on this disparity. Among prospective MSP customers, 81% reported security incidents, compared to 86% of existing customers. Yet, only 29% of prospects say they can secure compromised accounts and restore operations within hours of an incident.
For MSPs, the implications extend beyond cybersecurity. Customers increasingly need help managing operational risk, maintaining business continuity, and navigating the challenges AI introduces to both cybersecurity and business operations. It’s a real opportunity that will require MSPs to rethink how they demonstrate their value.
The Confidence Gap Is Creating Opportunity
Barracuda Research's international survey of 2,000 IT and security leaders reveals several weaknesses among organizations considering MSP support.
Prospective customers report slower response and recovery capabilities than existing MSP customers across every measured stage:
- Detecting suspicious email activity within one day;
- Investigating suspicious activity within a day;
- Attack containment; and
- Securing compromised accounts and restoring operations within a day.
There are even nine percent of prospects that say recovery takes longer than a week or cannot be completed consistently.
To be clear, these are self-reported capabilities rather than independently measured performance, and the findings don't necessarily establish that MSPs alone accounts for the differences. Still, they highlight a significant opportunity to help organizations improve preparedness and response.
The weaknesses go beyond incident response. Between 41% and 46% of prospective customers describe fundamental resilience capabilities as early-stage or only partially established. These include a companywide security program (41%), an inventory of critical assets (42%), clear security leadership (42%), a strong security culture (43%) and an inventory of third parties with access to sensitive information (46%).
AI is adding another layer of concern. Fifty-nine percent of prospective MSP customers worry about AI-related threats. The top perceived threats for the next 12-18 months, in order, include:
- AI-generated phishing and social engineering
- Email-based ransomware and malware
- Identity and access attacks
- Compromised employee accounts
- Shadow AI and AI-enabled insider risk
The skills gaps are equally revealing. Forty-two percent identify AI-generated, highly targeted phishing as an area where they lack sufficient expertise, while 36% cite challenges securing and governing AI tools.
Despite its prevalence, though, AI hasn't displaced established security concerns. Ransomware, identity compromise, and compromised accounts remain significant threats. For MSPs, the opportunity isn't to abandon traditional security services in favor of AI, but to extend those capabilities while helping customers manage the risks introduced by AI adoption.
Here’s why MSPs have such an opportunity: Prospective customers don’t necessarily believe hiring more employees will solve their problems. Less than a quarter say additional headcount would have the greatest impact on their security posture. Instead, they place greater value on visibility, AI-assisted detection and investigation, specialist expertise, and more time for prevention.
The message is that organizations aren't simply looking for additional personnel or another collection of security tools. They need capabilities their internal teams struggle to develop or maintain.
That certainly helps explain the demand for outside support. But, demand for assistance doesn't mean customers will choose providers based on technical capabilities alone.
Technical excellence remains fundamental, with 95% of existing MSP customers identifying it as important. At the same time, 80% value relevant expertise and business understanding, while 78% value communication, trust, and relationship quality. Forty percent say an MSP's ability to explain risks, incidents, and next steps in plain language influenced their provider selection, suggesting that cybersecurity expertise becomes more valuable when accompanied by an understanding of how technology risks affect business operations.
Turning Technical Expertise into Business Value
Round-the-clock monitoring and incident response remain important, but MSPs can differentiate themselves through resilience, strategic guidance, and business understanding.
One opportunity is to make cyber resilience a more clearly defined service. Organizations need help preparing for disruption, prioritizing recovery, and minimizing operational impact. Resilience assessments, incident response planning, recovery testing, and ongoing business continuity reviews can become structured, recurring engagements rather than occasional projects.
They also create opportunities to demonstrate measurable value. MSPs can report detection, investigation, containment and restoration times, identify where response processes are improving, and show customers how those improvements reduce operational risk.
The same applies to basic security capabilities. Asset inventories, third-party visibility, security policies and defined leadership responsibilities may not be exciting services to sell, but there seems to be considerable demand for help establishing and maintaining them.
AI presents another opportunity, although one that requires more than deploying AI-powered security tools. Shadow AI discovery, governance policies, sensitive-data controls, and assessments of AI-enabled workflows can become extensions of existing security and compliance services. In other words, it’s not just about selling AI, but selling AI safety and trust, and integrating these capabilities into a coherent offering.
Barracuda’s research also highlights the importance of translating technical risks into business terms. A third of prospective MSP customers identify this as a skills gap, while existing customers place considerable value on clear communication and business understanding.
It makes sense. Explaining how an identity compromise could interrupt operations, how downtime might affect revenue, or why an AI deployment introduces new business risks changes the conversation. Cybersecurity becomes less about threats blocked and more about protecting the organization's ability to operate.
As Michelle Hodges, Barracuda's Senior Vice President, Global Channel and Alliances, puts it, the MSPs best positioned for growth "will be those that combine technical excellence with the ability to protect their customers' businesses, advise their leadership teams, and help organizations navigate an increasingly AI-driven landscape."
For MSPs, this shift creates real commercial opportunities. Providers that understand customers' business priorities can identify unmet needs, broaden their services, and develop stronger relationships with decision-makers. Advisory services, resilience assessments, and ongoing risk reviews offer recurring revenue opportunities beyond traditional monitoring and management.
But, moving from technical provider to strategic advisor requires more than changing the sales pitch. MSPs need people who can communicate with business executives, repeatable advisory processes, and ways to demonstrate meaningful outcomes. They must also determine which capabilities to develop internally, where partnerships make sense, and how to price new services profitably.
Vertical specialization shouldn’t be overlooked. Healthcare organizations, manufacturers, retailers, and professional services firms may face similar threats, but the operational consequences can differ significantly. Providers that understand those nuances will be better positioned to sign new clients in those sectors.
Of course, not every MSP will be prepared to make this transition immediately, nor will every customer need the same level of strategic support. Thus, there is also an opportunity in identifying meaningful gaps and building services that address them in a measurable, sustainable way.
Ultimately, the opportunity for MSPs isn't simply to offer more security services. It's to make cybersecurity more meaningful to the business. Barracuda's research suggests customers are increasingly receptive to this kind of partnership. For MSPs, the question is whether they can develop the capabilities to deliver it. Those that do will find that managing more technology isn’t their biggest growth area. Instead, it’s becoming more valuable to the businesses they serve.
Edited by
Erik Linask
