MSP cyber security report warns of tougher regulations ahead
Government or insurance providers will likely take a stand against vulnerable MSPs in 2021


The MSP industry could face tougher regulation over the coming year as attacks on vulnerable third-party providers continue to rise, ConnectWise’s Perch Security predicts.
The forecast comes as part of the second annual Perch MSP Threat Report, which dives into the major trends from 2020 and makes predictions for the year ahead.
At the top of that list of predictions is the belief that either government or insurance providers – or potentially both – will move to start regulating the MSP industry to protect against rising cyber attacks.
A sustained period of attacks on vulnerable third-party providers - a tactic known as 'island hopping' or 'buffalo jump attacks' - that target an MSP and many of its customers at once, has already seen many insurance carriers choose to close out policies with breached MSPs.
“Some are even not renewing policies for MSPs across the board,” Perch explains. “Buffalo Jumps and their subsequent damages have caused insurance carriers to realise they may have bitten off more than they can chew with regards to MSP’s cyber policies.”
Over the last year, the report found that just 25% of MSPs that suffered a security breach said it was related to ransomware. However, almost 73% reported that at least one client had experienced a security incident, with nearly 60% of these MSP client incidents involving ransomware.
Looking forward, Perch predicts cyber insurance carriers will continue to demand “better cyber security maturity” from MSPs looking for coverage, while US state governments are also beginning to cast an eye at the MSP.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
RELATED RESOURCE
The global state of the MSP report
Trends, growth drivers, and challenges in the world of MSPs
“Whether driven by government or insurance carriers, we predict that new regulations or compliance minimums are on the way,” the report continued. “MSPs still have a voice in this discussion. That voice needs to be used quickly before others outside our industry dictate the future for us.”
Perch also predicts that attackers will continue to focus on cloud-based attacks that exploit poor cloud visibility and understanding, resulting in data-hostage scenarios where criminals demand a ransom to not leak the data. Cyber extortion will also vastly increase the costs of a breach and the time it takes to recover from one, it added.
In terms of security budget, more than 82% of MSPs increased their spending last year, while 75% of survey respondents have indicated that their budget for 2021 will increase by an average of 12.1%.
Perch’s 2020 iteration of the report accurately forecast the beginning of data exfiltration as an attachment to ransomware, ransomware moving to the cloud, ransom demands continuing to settle in the six figures for MSPs, as well as the increasing threat of island hopping.
“Unfortunately for MSPs, all of the predictions we made in our inaugural 2020 report came true,” commented Wes Spencer, CISO at Perch Security. “But the good news is that after taking some serious blows, MSPs have woken up to the existential threat they face from cyber criminals and are finally fighting back.”
Dan is a freelance writer and regular contributor to ChannelPro, covering the latest news stories across the IT, technology, and channel landscapes. Topics regularly cover cloud technologies, cyber security, software and operating system guides, and the latest mergers and acquisitions.
A journalism graduate from Leeds Beckett University, he combines a passion for the written word with a keen interest in the latest technology and its influence in an increasingly connected world.
He started writing for ChannelPro back in 2016, focusing on a mixture of news and technology guides, before becoming a regular contributor to ITPro. Elsewhere, he has previously written news and features across a range of other topics, including sport, music, and general news.
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs