Cybersecurity spending is increasing, yet many organizations still experience breaches, operational disruption, and ongoing security challenges.

As businesses expand their digital environments and adopt new technologies such as AI, many are also finding that their larger security budgets are not translating into stronger protection.

For managed security service providers (MSSPs) and channel partners, this is an important opportunity. Many customers are looking for support that goes beyond simply deploying additional security products. They want a partner who can help them manage cyber risk more effectively, while also helping them operate in a complex security environment.

This shift in customer priorities is even more visible as organizations are managing increasingly fragmented IT environments. Hybrid working, cloud adoption, remote endpoints, and connected applications have all expanded attack surfaces considerably over the past few years. In addition, many businesses have accumulated multiple security tools across different parts of the organization, often from different vendors and with varying levels of integration.

Too many tools

Although each tool may exist to address a specific security requirement, the overall result is difficult to manage. Security and IT teams may need to monitor numerous dashboards, respond to large volumes of alerts, and manually correlate information between systems. In some environments, this will create visibility gaps and operational inefficiencies, making it harder to respond quickly to threats.

For MSSPs, this is likely to be a key focus for customers. Many organizations are reassessing whether adding more standalone tools is the most effective way to improve resilience. And there is growing interest in approaches that simplify management, improve visibility, and support measurable risk reduction.

This is particularly relevant for mid-market organizations that may not have large in-house security teams. Many smaller IT departments are being asked to manage increasingly sophisticated environments, while also responding to complex threats, regulatory requirements, and user demands. A channel partner that can reduce this operational pressure while also improving security outcomes will be able to demonstrate and deliver greater long-term value to customers.

Unsurprisingly, AI is also influencing this. Businesses are adopting AI-enabled technologies across their operations, while cybersecurity vendors are increasingly integrating AI into security tools and platforms. Cybercriminals are also using automation and AI-supported techniques to increase the scale and sophistication of phishing campaigns, social engineering, and vulnerability exploitation.

Keeping safe and secure, but without spending more

Organizations are faced with growing pressure to improve detection and response capabilities without significantly increasing operational overhead.

For MSSPs, this creates the opportunity to help customers manage security more practically and sustainably. Rather than focusing solely on deploying additional technologies, many are positioning themselves around outcomes such as improved visibility, faster response times, and simplified security operations.

Integrated security platforms are becoming increasingly relevant in this context. Platforms that bring together endpoint protection, identity security, network monitoring, and threat detection capabilities help organizations reduce fragmentation and improve operational efficiency. By consolidating visibility and automating some routine tasks, businesses may be able to reduce alert fatigue and simplify day-to-day security management.

Automation is also playing a growing role in helping organizations manage their rising security demands. Many MSSPs are using automation to support threat detection, incident response, patch management, and policy enforcement. For customers with limited internal resources, this helps to improve consistency and reduce the burden on internal IT teams.

Technology alone is not the solution

But technology on its own is unlikely to solve every security challenge. Many organizations still require support with prioritisation, governance, and practical risk management. This is where MSSPs can differentiate themselves from those providers who are focused primarily on product deployment.

Customers are increasingly evaluating cybersecurity investments based on operational effectiveness rather than simply the number of tools deployed. In some cases, this may involve consolidating overlapping products, improving configuration management, or streamlining response processes rather than introducing additional technologies.

This approach also aligns with the growing industry focus on cyber resilience. Many organizations recognize that security strategies should include detection, response, and recovery capabilities, alongside prevention. MSSPs that can help customers improve resilience and reduce operational disruption will strengthen their role as long-term strategic partners.

The channel also has an important role to play in helping organizations adopt AI-enabled security capabilities responsibly. While AI may help improve efficiency and threat analysis, it can also introduce additional management challenges if implemented without proper oversight or integration. This means customers will value partners that can help them adopt new technologies in a manageable and commercially practical way.

Organizations need to balance growing cyber risks with operational and financial pressures. As a result of this, there is likely to be increasing demand for MSSPs and channel partners that can simplify cybersecurity management while supporting stronger resilience outcomes.

This is an opportunity for the channel to move conversations away from tool proliferation and towards measurable risk reduction. The conversation with customers needs to be about helping them manage complexity, improve operational visibility, and align security more closely with business priorities.

Many small and medium-sized businesses (SMBs) might struggle to afford third-party relationships - like those with channel partners - or have a specific need or capacity for models that see someone closely manage their technology for them.

Instead, they might want to do it themselves, creating a DIY-style initiative that builds a system with parts from many different platforms, tools, or cloud services.

Could such an approach be dangerous? Essentially, bringing with it risks to security, among other issues for internal operations such as compliance, delivery, and productivity. Or, is it entirely possible? And, if it can be achieved, how would this be done?

Eleanor Watson is a member of the IEEE, the world’s largest technical professional organization dedicated to advancing technology for the benefit of humanity. As an AI ethics engineer, she works principally as a machine intelligence researcher.

Watson is in agreement that for SMBs with limited budgets, the use of channel partners “might not be feasible”. She believes the DIY approach is sound and can work for SMBs but only “when treated as a disciplined strategy, rather than cost-cutting”.

“As a first step, businesses should map business-essential functions (finance, HR, sales, compliance) and assign clear ownership for each system’s uptime and data security,” she explains.

“Invest in architecture first: build a clean, modular stack using open standards (SSO, OAuth2, API-first systems), and document relentlessly. Begin with a manageable scope – self-hosted basics or low-code automation – while maintaining flexibility to integrate external providers later.”

That’s not to say there won’t be any challenges with such an implementation, as Watson is happy to concede. “Achieving interoperability without fragility is the primary challenge,” she warns. “Vendor APIs evolve; dependencies break. Without dedicated integration expertise, SMBs must maintain test environments and version control for configurations.”

Cybersecurity resilience is “equally demanding”, she adds, stating: “A single ransomware incident or supply-chain compromise can cripple an unsegmented network. Apply zero-trust principles – robust identity management, privilege separation, encrypted backups – as foundational defaults, not afterthoughts.”

Risks vs rewards

The most common types of IT channel partners are the likes of value-added resellers (VARs), systems integrators (SIs), managed service providers (MSPs), managed security service providers (MSSPs), and consultants. Vendors they use often include AWS, Google, IBM, and Microsoft, and a channel partner usually provides online training and certification to an SMB.

Ian Anderson, senior director of partner sales at Park Place Technologies, understands the “temptation” of DIY but concurs with Watson, believing the risks must be clearly identified and understood first if SMBs push ahead with this approach.

He cites how a good partner might “understand the business, environment, and resources in a way a DIY approach never can,” but does admit: “The reality is most channel partners have gaps in their service range. They can’t be experts in everything. This is why the smartest SMBs look for partners who are, in turn, supported by specialist service providers to fill those gaps – whether professional or managed services.”

However, for those who still wish to go it alone, Watson has more advice to follow. “Meaningful savings come from open-source platforms, consumption-priced cloud services, and internal automation replacing external consultancy,” she explains. “AI copilots for documentation, compliance drafting, or troubleshooting can substantially reduce administrative overheads.”

Watson also points to the issue of believing you are making savings when actually you might cost yourself more in the long run, adding: “The real economic advantage is agility: direct system control enables rapid iteration without vendor lock-in. However, cheap setups requiring costly rescue operations are common – beware of these false economies.”

Smart work vs hard work

The risk of a DIY approach is greater for mid-sized organizations compared to those smaller businesses, according to Matt Fox, chief operating officer at technology consultancy TXP.

“If mid-sized organizations are to avoid a piecemeal approach to IT modernization, they require a joined-up approach to technology and people,” he says.

“Mid-sized organizations can work smarter, not harder, by working with an external IT provider that has the skills and resources required to fully address their IT needs.”

Fox adds: “However, channel providers need to go beyond simply augmenting team numbers or selling products to provide a transformational service. A successful relationship with a channel partner will involve at least some element of knowledge transfer as experts share their expertise with their partner’s team.

“This ‘teacher-learner’ relationship brings value beyond a simple transaction to working with the channel, and it ought to be the gold standard when working with partners for IT implementation.”

In the real world, there are no clear rules on when to DIY, when to begin with a channel partner, or when to move from doing it yourself to getting third-party help and guidance.

But Siyar Isik, CEO of Eskritor, an AI-powered writing assistant tool, believes DIY is possible when the right guardrails are in place. “Not every small business has to lean on channel partners for IT,” he admits.

“Some can manage on their own, but only if they stay realistic about what is possible.”

Isik’s first advice would be “to start simple” with tools like Google Workspace or Microsoft 365, which have been built with small teams in mind.

“They come with great support communities and plenty of clear documentation. That takes a lot of pressure off the team,” he says.

While it is possible to reduce overheads by cutting costs and avoiding long contracts, there are clear areas where it would be dangerous to compromise, according to Isik.

“Data protection, backups, patching, and continuity planning need to be airtight,” he insists.

“Skipping those is like skipping insurance. A DIY approach can work, but only if a business goes in with clear eyes about its limits and refuses to cut corners on the areas that matter most.”

Weighing up the time outlay

Watson is also concerned about other pitfalls. “Most DIY IT failures stem from underestimating complexity debt,” she explains.

“Integration across accounting, customer relationship management (CRM), and inventory systems can spiral without professional oversight. Security hardening, patch management, and compliance consume more time than expected. Staff turnover erases undocumented expertise, orphaning systems.”

And although the use of Agentic AI tools in an SMB setting might offer simplified management, these can also “amplify errors when unsupervised”, Watson warns.

“Autonomous misconfiguration – AI making confident but destructive changes without full context – is an emerging risk,” she highlights. “Governance remains essential regardless of tooling intelligence.”

There are also real benefits, however, according to Watson. These include full control over architecture, data, and priorities, plus faster iteration and innovation cycles. Deep understanding of your digital infrastructure and reduced dependency on opaque vendor ecosystems are two more.

“Properly managed, DIY IT builds organisational technological literacy – a durable competitive asset,” she adds.

At BI Worldwide, a partner with 300+ Fortune 500 clients, there is clearly an appetite for help from customers who do not wish to go down the DIY path or can’t do so. Deborah Watson, its client and solutions strategy director, suggests asking what a good partner might “bring to the table” before choosing one.

She explains: “This means asking the right questions: is your partner part of a programme that rewards them for investing in training, support, and customer success? If not, you may not be getting the full benefit of what a channel relationship can offer.

“SMBs should ask whether their chosen partner is part of such a programme – it can be a strong indicator of the quality and reliability of the support they’ll receive. Understanding whether their partner is supported in this way can help assess the long-term viability of a DIY approach versus a channel-supported model.”

Planning for growth

For Colin Crow, managing director at digital transformation specialist Nexer Enterprise Applications, the big risk with DIY is “you only know what you know”.

“You might be fortunate enough to have a small team of tech talent in-house, but that doesn’t necessarily mean they are experts in the specifics of the new system you’re implementing or on how to manage the change across the organization,” he says.

“With a partner, you can get the best of both worlds: control over your vision, with expertise on tap to keep you on track.”

However, Zayed Ahmed – who started as a call center agent before founding outsourcing company ASL BPO – believes the go-it-alone route has plenty of positives. They believe it’s just about understanding where the pitfalls are on your journey that might then mean you need greater levels of outsourced help.

“I see very few who succeed with a pure DIY approach,” he says. “They often start there, setting up basic tools like email platforms, cloud storage, or password managers. It feels manageable at the beginning and helps keep costs down.

“But as soon as compliance or security comes into the picture, things change quickly. Most internal teams cannot keep up with constant updates in regulations or the latest cyber threats. Missed patches, poor backup routines, or weak access controls can cost far more than what was saved upfront."

That is why Ahmed suggests SMBs heed this piece of advice: “The question should not be ‘DIY or partner?’ but ‘what mix works best for your stage of growth?’”

Managed security service providers (MSSPs) are a vital part of the cybersecurity ecosystem, often serving as the first, and sometimes the only, line of defense across multiple clients. Their role is also growing in importance, largely due to the persistent global skills shortage. However, new benchmarking data reveals blind spots that could limit their strategic value.

Hack The Box’s Global Cyber Skills Benchmark 2025 analyzed nearly 800 teams and more than 4,500 participants worldwide. While MSSP teams performed strongly in OSINT (64.5%) and forensics (62.8%), they lagged in preventive and offensive disciplines such as secure coding (18.7%), web security (21.1%), and adversary emulation.

The results, which were mapped to the MITRE ATT&CK framework, show a clear imbalance. Although MSSPs are great at detection and response, they are falling short in prevention and protection. Detection is obviously an essential skill, but it’s reactive only. As adversaries exploit AI automation, supply-chain vulnerabilities, and custom exploits, MSSPs risk the need to be more than reactive responders; they need to become active defenders of an organization’s resilience.

Scale vs depth

The MSSP operating model generally includes standardised tooling, multitenant platforms, and is built for speed and efficiency, but it lacks depth. The problem is that detection scales easily, while prevention needs context-specific expertise and secure engineering fluency. When it comes to prevention tools, they alone can’t compensate for missing skills. And that’s why capability, not tooling, is now the main differentiator for an MSSP.

Continuous Threat Exposure Management (CTEM), a concept introduced by Gartner, is a useful framework for proving resilience. CTEM reframes the narrative from “How fast can we detect?” to “How much risk did we actually remove?” It scopes attack surfaces, simulates threats, validates controls, and measures improvement.

For MSSPs, embedding CTEM helps to turn technical skills into business value. It will provide proof that cybersecurity investments are actually reducing risk exposure and by how much.

Skills as a differentiator

To close the gap between detection and prevention, MSSPs should start with data-driven workforce benchmarking. This will help ensure money spent on professional skills development delivers genuine operational impact.

Generic training won’t help. MSSPs need role-based learning paths aligned to core functions, such as SOC analyst, threat hunter, red team operator, and secure developer. Short, verifiable micro-credentials are also important to support continuous improvement.

The focus isn’t just about training. It is about implementing carefully planned upskilling and having the ability to prove capability to clients and boards alike.

MSSPs should also consider building industry-aligned capability pods, where there are specialised teams focused on vertical threat landscapes. A finance pod might prioritize blockchain and application security; energy and manufacturing pods could focus on ICS and OT defence; retail pods might tackle supply chain and web application threats.

These pods deepen contextual understanding of threats and help to strengthen protection. To avoid siloing skills, pod governance should include a process to ensure structured knowledge transfer and continuous feedback loops.

Offensive emulation and AI risk

Offensive emulation is one of the weakest areas for many MSSPs, with the benchmarking figures showing Pwn/exploitation solve rates averaging just 9.8%. Regular red teaming exercises and adversary emulation training will help improve and validate defences under real-world conditions and feed directly into CTEM metrics, turning simulations into proactive indicators of resilience.

MSSPs are early adopters of AI-assisted tooling, with solve rates in the benchmarking averaging 38.3%, which is above the global mean. But AI without a secure engineering discipline is a double-edged sword because it has the potential to accelerate vulnerabilities faster than they can be fixed.

To mitigate this, MSSPs must reinforce secure-by-design skills and integrate AI governance checklists into development and automation pipelines.

Speaking the boardroom language

Traditional SOC metrics like MTTD (Mean Time to Detect) or MTTR (Mean Time to Respond) do not accurately reflect investment value. Executives want to see measures of exposure reduction, such as fewer exploitable weaknesses, faster patching, and tangible improvements in secure coding proficiency.

By combining skills benchmarking with CTEM, MSSPs get the ability to communicate actual progress. For example: “Secure coding proficiency up 20%, with a 25% reduction in client-side web vulnerabilities.” That’s the kind of language that needs to be used in the boardroom to translate technical performance upskilling into trust in the MSSP’s business.

The tech industry, particularly the channel, is filled with big personalities making even bigger moves and announcements that drive things forward. While the tenure of tech CEOs, on average, ranges wildly between less than four years and up to 15 years (depending on which research you consider), the point at which one leader leaves and another is brought in can be quite a make-or-break moment for the company in question. 

So when Fred Voccola, then co-founder and CEO of Kaseya, announced back in January that he would be stepping down from the top spot – and moving into a vice chairman role – it sent waves of chatter, confusion, and curiosity throughout the market. 

For many, Fred is Kaseya. Since his appointment was announced back in July 2015, Voccola has spent a decade front and center. He’s evangelized about the importance of supporting and empowering MSPs and IT personnel through simple-to-use, cost-effective technology that can be game-changing for small and medium businesses (SMBs). 

During the last decade, Voccola has been at the helm through many acquisitions, personnel changes, technology innovation, and problems ranging from issuettes to slightly bigger challenges. One thing that has remained consistent during that time is his belief that trust and transparency are key. 

“I think we've done it the right way, in an honorable way. We're not a scumbag company. Do we mess up? Oh yeah, but we try to own it,” he told me recently during an interview. 

“We didn't sell our souls. We didn't become a political or social engine. We always stayed focused on our partners, our employees, and on building a sustainable, great company. I think that we've completely accomplished the first phase of our mission – we have changed the unit economics for MSPs.”

Being an MSP can be an unforgiving, unprofitable, unrewarding experience. Once the bills are paid, there’s little left for anything else, let alone innovation. Kaseya, during Fred’s tenure, set out to change that. Today, he says, MSPs that are “powered by Kaseya” can expect to generate a 35-45% profit margin. 

Given that success and the fact that the role of a CEO is all-encompassing, it seems the right time to exit stage left and leave on a high note. 

“A lot of people say they work an 80-hour week. But this company has been my life for the last 11 years. I was talking to my dad last year a little bit [and said] there's a lot of things that I want to do in life, and you can't do them when you wake up at six in the morning for your first phone call meeting, and you go to bed at 11 at night, and you know, half of your Sunday is spent doing that all day,” he said. 

“You just can't do it. So when we released Kaseya 365 that was a monster moment. And the following day and days [post launch], the adoption of it was a monster moment. So I spoke to my fellow board members to say I think it's time that we start to find the next CEO. 

“There are lots of things I want to do in life. It’s not that I don't love this job. I mean, this,  I LOVE it. It's just there are those other things in life...“

While there will soon be a change at the helm – although industry insiders are divided as to how quickly that may happen in reality, given the ongoing will they/won’t they whispers of an IPO – Kaseya stakeholders can expect all of the good stuff to continue. 

“We're not changing direction,” Voccola asserted. “One of the cool things about Kaseya is, as a security and IT company, we are mission-driven.. That North Star will not change. 

“I assure the industry, the employees, everyone, they will be 10 times better than I am. Everything that I screw up with, they won't make those mistakes. They will be much better, a much better, more charming, handsome, intelligent person. But that North Star mission will not change.” 

Voccola has also consistently exuded passion for what he does and pride in what the company as a whole, not just himself, has achieved. 

Speaking about just the last financial year, under his leadership, it was a record breaker. Indeed, 2024 was the best financial year in Kaseya’s history, with the firm growing over 17% organically. 

The organization has around 5,000 employees, and more than 7,500 companies have already adopted Kaseya 365 since its launch. Voccola takes the responsibility of supporting both sides of the ecosystem very seriously. He refers to employees as ‘Kaseyans” and reports that there have been up to 50 Kaseyan marriages during his time. 

“I've always taken a lot of pride in how people who have worked in my companies have gone on to do great things. At Kaseya right now, I can tell you there are 20 to 25 tier one CEOs,” he said. 

“Miami, Florida, 10 years ago, was not a technology town. Kaseya has made Miami a permanent tech destination that rivals [other locations]. The talent levels at Kaseya are among the best in the world, and what that means is, for every partner who reads this, you have really smart, capable people working tirelessly to make your profitability better. We have an amazing, amazing bunch of people.”

When it comes to continuing to service MSP needs, he has his eye firmly on the horizon and the next big thing… 

That next big thing for Kaseya will almost certainly involve AI and automation. Heck, this week plays host to the firm’s Connect event in Las Vegas, so we’re probably mere hours away from the big reveal. 

But to move forward, it’s also important to look back, and Voccola has worked hard to reassure people that while he is changing gears, the next era will also be positive. 

Going back to the early days, he remembers fondly when things clicked. When he and his peers “saw the magic” and how they could really change the unit economics for MSPs. 

“My father used to say, ‘If you want to create something great, find a huge market. Find a problem that the market has, solve it, and then make it easy for people to use your solution, whatever that solution may be.’

It’s clear from the outside looking in, Kaseya has done just that. And while his time as CEO may be done, Kaseya will long be in his life. 

“Once the new CEO comes on board, I'll be vice chairman. I'm the largest individual shareholder of this company, so I have a huge interest in the company. I love it. It's my baby. It will always be my baby,” he said. 

Voccola added: “There are a couple of highlights. One of them is that we built the company the right way. It’s [like that] rank Sinatra song ‘My way.” My dad loved that song. When I think about what we've done at Kaseya, [we’ve done that]. And by the way, this is just the beginning of Kaseya. This is just the beginning…” 

Nozomi Networks has announced that energy management and automation specialist Schneider Electric has joined its MSSP Elite Partner Program.

The move will see Schneider embed Nozomi’s range of security solutions into its platform to deliver enhanced managed security services (MSS) to key global sectors, including energy and chemicals, water, consumer packaged goods, power and grid, data centers, and critical infrastructure.

Nozomi said the integration will create a full-scale, industrial-focused security management service capable of safeguarding complex operational environments.

Schneider customers will be able to leverage capabilities such as OT and IoT visibility and vulnerability management, network monitoring, threat detection, and risk management, as well as access bundled offerings that incorporate Nozomi Networks’ Vantage, Guardian, Threat Intelligence, and Arc solutions.

Jay Abdallah, president of Schneider Electric’s cyber security solutions segment, said the collaboration will help customers minimize their cyber risk and maximize resilience, while complying with regulatory requirements.

“With the power of AI-driven analytics and timely response, our fully managed, end-to-end security solution helps organizations ensure the resilience of their most critical systems,” he explained.

“As part of a broad range of solutions to help organizations run more efficiently, this certified cybersecurity offering gives customers the ability to focus on their core operations, while we support them with industry leading and continuously evolving cybersecurity defenses.”

Deployable both on site and in the cloud, Nozomi Networks’ range of solutions span IT, OT, and IoT and leverage AI to automate tasks such as inventorying, visualizing, and monitoring of industrial control networks.

The firm said these solutions currently support 115 million devices across a range of sectors, from energy and manufacturing, to smart cities and critical infrastructure.

Launched in 2023, Schneider Electric’s MSS offering has since evolved into a multi-layered cyber security solution, complete with end-to-end security controls management, vulnerability management, advanced threat detection, as well as around-the-clock support.

The firm’s addition to the Nozomi Networks MSSP Elite Partner Program builds on a long-standing strategic alliance that has seen the pair collaborate to support customers since 2017. Last year, Schneider also participated in Nozomi’s $100 million Series E funding round.

“Schneider Electric continues to advance the future of sustainable energy management and automation,” commented Chet Namboodri, Nozomi’s SVP of global business development,. “They share Nozomi Networks’ passion for ensuring energy resources are always available, reliable and safe.

“With an established eight-year track record of collaboration, we firmly believe this partnership accelerates our joint mission to help protect energy management and automation processes around the world.”

MORE FROM ITPRO

• Schneider Electric names Hanne Sjøberg as new VP channels for Europe
• Schneider Electric confirms breach after hacker claims to have 40GB of stolen data
• Emerson and Nozomi Networks announce expanded partnership

The managed security services provider (MSSP) market is burgeoning as organizations look to outsource their cybersecurity, and this is due to a number of factors.The economic downturn has hit security budgets hard and many have had to make cutbacks as a result, with an ISC2 report revealing that 47% have laid off staff, slashed budgets, and/or frozen recruitment drives and promotions.

Threats continue to escalate, making cyber insurance a must, and premiums frequently require that certain conditions are met, driving organizations to seek external assistance in the form of managed detection and response (MDR). These challenges are all compounded by an unprecedented skills shortage, with a workforce gap of approximately 4 million worldwide and growing at a rate of 13% per year, according to the same ISC2 report, forcing organizations to plug holes in their teams with external resources.

Some of these same issues are also making it very difficult for MSSPs to exploit this demand for outsourcing, however, and are even putting them at risk. The MSP Perspectives 2024 survey found the top three challenges experienced by channel providers were keeping pace with innovation in cybersecurity, securing analysts due to the skills shortages, and keeping up with emerging threats. 

In addition, many have a bloated security stack and are struggling to meet demand due to unwieldy systems that make provisioning and management complex. Costs are also rocketing across the board from licensing through to salaries but the MSSP can’t pass those costs onto their customer base. Absorbing them then curtails their ability to invest and expand.

Not surprisingly, MSSPs are therefore under tremendous pressure to provide round-the-clock support with diminishing human resources. The survey notes that around a third of MSPs offering MDR have an inhouse SOC manned by between 15 – 30 analysts, depending on the size of the customer base, which means there’s the risk of the MSSP becoming short-staffed, jeopardizing operations. It’s becoming increasingly apparent that they will need to make some substantial changes over the course of the next few years if they are to navigate their way through these tough times and emerge intact. So, what should these providers be doing? 

Supply and demand

To start with, it’s worth considering how demand for managed services is likely to manifest itself during that time frame. In addition to the drivers above, we can also add regulation to the mix, with a raft of new legislation set to come into force such as NIS2 across the EU (which will also likely be adopted in some form or fashion in the UK) from October and DORA in the financial sector in January. 

Both will compel organizations to be more proactive in how they assess and address risk and introduce much greater accountability, which means many will seek assistance in meeting those requirements. MSSPs that have positioned themselves to be able to offer that level of support in the form of MDR or have systems specifically attuned to those compliance demands will then be best placed to capitalize on this demand.

Yet, with analysts in short supply, scaling operations could prove challenging, forcing the MSSP to either miss out or compromise on the quality of delivery. The key here is making the business model more efficient so that it becomes easier to service multiple tenants. 

So, the MSSP should continue to look at how they can consolidate their cybersecurity stack and reduce the number of vendors they deal with. But they also need to think more creatively about how they provision those services. Having a cyber defense platform in place that can perform numerous functions can significantly reduce complexity in this regard, one example being a security and incident event management (SIEM) platform with additional complementary add-ons such as automation, case management and behavior analytics.

A single pane of glass

To make provisioning easier, those services then need to be overlaid with an MSSP-specific interface. This allows customers to be onboarded and managed collectively while still enabling the analyst to drill down into and customize an individual organization’s requirements or carry out an investigation. Using a single interface also makes it possible to enact changes or respond to threats more efficiently by rolling out new rulesets to the entire customer base at the same time. 

Instead of focusing on provisioning the distributed SIEM, the MSSP is then free to monitor incidents, analyze log data and add valuable insights. As a result, valuable human resources are being used as productively as possible and time is not being wasted on so-called ‘swivel chair’ operations which sees the analyst log in and out of systems. It’s important to look at the architecture of any such offering, however, to ensure partitioning is in place that keeps each customer’s data secure, particularly given that the MSP Perspectives 2024 survey notes that stolen access data and credentials are the number one risk keeping MSSPs awake at night.

It may also be worth going back to the market to look at alternative licensing models. Data throughput pricing models will see costs rise over time as the customer grows and data consumption increases, so being able to keep those costs nailed down can enable the MSSP to shield its customer from any price increases. For this reason, predictable pricing models based on nodes rather than data are gaining in popularity. 

Those MSSPs that address these issues today by streamlining their operations will be well placed to exploit demand and also to adapt to changing market conditions as these materialize. Essentially there are three secrets to success. Provided they can manage their own costs and protect their customers from any shock increases, rationalize the stack, and achieve economies of scale, there’s no reason why MSSPs can’t turn the current challenges they’re experiencing into tomorrow’s opportunities. 

Cyber security vendor Logpoint has cut the ribbon on a brace of new partner programs for managed security service providers (MSSPs) and channel partners.

The company said its new initiatives aim to foster successful collaborations and add increased value to both its partner ecosystem and mutual customers during the year ahead.

Logpoint provides a range of threat detection and investigation response (TDIR) and compliance solutions that work to help customers defend against cyber attacks and meet regulatory demands via a simple licensing model.

The Logpoint platform combines SIEM, UEBA, SOAR, and SAP security technologies to provide threat detection, minimization of false positives, autonomous risk prioritization, and incident response.

Now, with its two new programs, the firm has introduced a range of complimentary features to provide tailored support and improved assistance to both MSSPs and channel partners.

Logpoint shakes up its MSSP program

Logpoint said its dedicated MSSP program will help speed up MSSPs’ time to success with customers through several distinct features, including a predictable pricing model based on nodes as opposed to data volumes.

Businesses joining the initiative will receive a dedicated starter pack that includes Logpoint Director – a platform designed to help MSSPs operate and manage large and multi-tenant deployments – as well as training resources, onboarding assistance, and enablement opportunities.

The program also features two flexible commercial models. The first is based around subscription assignments for customers, with subscriptions for each end customer manageable through Logpoint Director.

The second places a focus on consumption and features quarterly reporting and specific pricing structures that are tailored to consumption levels for flexibility and scalability.

In an announcement, Antti Vilhunen, Logpoint’s regional director for Northern Europe, said the changing threat landscape is piling more pressure on organizations in the mid-market as threats become increasingly more sophisticated.

“We’re seeing an increased move in that segment towards MSSPs, offering extensive cyber security skills and advanced threat intelligence technologies to help improve the security posture and manage risk,” he explained."

“Our new MSSP program empowers them to capture opportunities and thrive in today’s cyber security landscape, delivering the tools, resources, and support they need.”

Channel partner program

Logpoint has also unveiled its new program for channel partners, which includes a simplified tier model for increased clarity on margin benefits. Partners can achieve either silver or gold status for training and sales engineering enablement, with the tiers offering total partner discounts of 20% and 30%, respectively.

The cyber security vendor said it has also streamlined the deal registration process for a consistent experience across regions, while access to its new Extended Success Plan will enable channel partners to offer end customers improved service level agreements (SLAs).

“In addition to our MSSP Program, we’re delighted to introduce an improved Channel Partner program, offering generous margins in a simple and clear structure, reinforcing our commitment to Channel Partners,” Vilhunen said.

“We have partners across many different regions. We understand that each region has its distinct challenges and opportunities, which the new Channel Partner Program reflects.”

Cyber security solutions provider Check Point has unveiled a host of enhancements to its MSSP Partner Program, designed to help tackle the cyber security workforce shortage and rise in digital threats. 

The initiative has been revamped to offer a more robust and flexible service model, the firm said, featuring simplified onboarding, predictable revenue streams, new solutions, as well as a comprehensive security ecosystem. 

In an announcement, Check Point said the updated program is a direct response to evolving needs in the global managed security services market, which is currently experiencing “unprecedented growth.”

“MSSPs have a big opportunity to capitalize on the demand for their services, but they face their own challenges in a rapidly changing world,” said Shahar Divon, Check Point’s head of global SMB sales. 

“At the operational level, these teams spend too much time handling hundreds of alerts daily, tying up resources that could be better spent on more urgent requests.

“That is where our MSSP Partner Program can deliver real value, not only for those that have security as a practice, but also MSPs that are looking for ways to protect their customers.”

A “revolutionized” program

Check Point said its changes are not merely incremental adjustments, but significant additions that “revolutionize” the program. MSSPs of various sizes can now take advantage of simplified onboarding, as well as predictable revenue streams.

The new consumption-based pricing model introduces fixed, pay-as-you-go, and tiered options that have been designed to make Check Point’s services more accessible and convenient through local distribution channels. 

Partners can also leverage the latest managed security services across all vectors, the firm added, including SASE, email security, SD-WAN, and mobile security. 

These security management features are accessible via the Infinity Portal, which leverages Check Point’s ThreatCloud AI solution to integrate all elements of security management for convenient management. 

Additionally, the program serves up free training for managing PAYG licenses via the portal, distributor support, an agile user management tool for handling user access and customer requirements, as well as a security ecosystem that includes services across all attack vectors, Check Point said. 

“We have now streamlined the business model and simplified the onboarding process, making it easier for partners of any size to access our innovative products and scale their operations as needed,” Divon added. “We believe the simplicity and agility is what sets our program apart in the market.”

Managed Security Service Providers (MSSP) are at the forefront of emerging market trends, meaning they need to identify and adopt the latest technology to best protect their customers and keep step with competitors. 

The demand for dark web intelligence has skyrocketed over the past few years, as organizations grow ever more aware that cyber attacks originate in marketplaces, forums, and sites they cannot see. It is therefore not surprising that most MSSPs have already started to address customer demands for dark web threat insights.

But despite many MSSPs already undertaking dark web monitoring, our latest research identified that 35% of MSSPs believe that dark web monitoring is too complex, while nearly one-third (29%) believe it isn’t relevant to their service offering, and 18*+% are yet to be convinced they will be able to sell it.

With 34% of MSSPs not seeing value in dark web monitoring tools, some providers are potentially missing out on providing essential insights into an online criminal underworld where cyber criminals discuss and plan future attacks. 

MSSPs, therefore, have an opportunity to harness the power of dark web intelligence to protect their customers from cyber threats.

Dark web intelligence and the “cyber kill chain”

When we talk about cyber security, most of a security team’s resources and tools are focused on the late stages of “cyber kill chain” (the sequence of actions a cybercriminal has to take to execute their attacks). 

For instance, email security tools sit at the ‘delivery’ phase of a cyber attack, whilst endpoint, network, and antivirus security solutions focus on identifying the subsequent activity as the attacker makes their way across an organization’s infrastructure. 

As cyber criminals continue to evolve their capabilities and skill sets to be able to bypass existing security solutions, preventing an attack is not always as simple as not clicking a phishing link. To give the best chance of disrupting a cyber criminal’s operation in clients systems, MSSPs need to “shift left” and act as early in the cyber kill chain as they can on behalf of their customers. 

Dark web intelligence allows MSSPs to investigate the ‘reconnaissance’ stage, right at the beginning of the “kill chain” when threat actors are planning their cyber attacks on dark web hacking forums, and buying the exploits and tools they need on malicious marketplaces. 

By starting this early, MSSPs can make a dent in an attack plan and advise their clients on how to take preventative action that stops their network from being breached in the first place. 

MSSPs’ position in the market requires them to be early adopters, able to identify the latest tools and technologies to protect their customers. It is no surprise then, that 56% of MSSPs already undertake dark web intelligence, recognising the benefit. 

Companies of all sizes are increasingly conscious of dark web threats and the opportunity dark web intelligence holds for helping them identify the early warning signs of attack. 

This has created an opportunity for MSSPs to use dark web intelligence as a basis to deliver the analysis, expertise, services, and solutions that help their customers act on the dark web risk they have heard so much about.

Meeting customer demand

According to our research, customer interest in the dark web has been increasing, with 65% of MSSPs stating that their customers have asked for threat intelligence from the dark web. 

Why is that? Well, there are three main reasons for this demand. Firstly, as visibility in cyber security is key, customers want to identify vulnerabilities affecting their organization. Secondly, they want to know if they or their competitors are currently being targeted on the dark web. 

Thirdly, they want to own and act upon intelligence on threat groups including ransomware gangs that are active in the threat environment.

So, as the topic of dark web monitoring grows in prominence, those MSSPs that have started to build out their capabilities, data sources, and understanding will be able to benefit as more customers look for guidance on the dark web, giving them an advantage in the competitive market of managed security services.

Unlocking benefits for MSSPs

Aside from striking benefits for customers, MSSPs can also take advantage of dark web intelligence from a commercial perspective. When asked about the benefits of using dark web intelligence, 37% of MSSPs reported that it helps them identify customer details on the dark web, closely followed by giving them new products and services to sell to customers and making their current services more efficient.

By “shifting left” in the cyber kill chain, MSSPs are enabled to move from reacting to threats to proactively preventing them from happening in the first place. This makes good business sense as it means MSSPs can document and demonstrate value based on attributes exposed and/or being discussed on the dark web. 

It also means that MSSPs don’t have to wait for their clients to be breached before they can prove their worth – they can often find threats that could impact the organization, from day one.

According to research, the most common use for threat intelligence is to inform pentests and security audits (35%) followed by informing incident response (34%). The MSSPs which use dark web intelligence in one-off engagements are missing a trick in integrating dark web intelligence into their value proposition and hence recurring revenues, where they could be capitalizing month-on-month. 

A huge opportunity lies in MSSPs wrapping dark web monitoring into their Managed Security and SOC services to provide customers with an ongoing view of their dark web risk over time and alert them as soon as a serious situation emerges.  

The turbulent nature of criminal activity means that the dark web shifts and changes at an even faster rate than the clear web. Marketplaces, forums, and criminal groups appear out of nowhere, rise to prominence, jostle with other criminals and law enforcement, and disappear just as quickly as they came. 

Dark web threat prevention is, therefore, not something that can be done on a six monthly or yearly basis. If organizations want to truly understand their threat risk on the dark web, they need their MSSPs to continuously monitor and deliver meaningful insights for effective cyber security protection and healthy cyber posture.

Cyber security solutions provider Cyware is looking to grow its partnership with its channel and managed security (MSSP/MDR) partners through its new global partner program, CywareOne.

The fresh initiative will enable partners to provide customers with Cyware’s advanced threat intelligence automation, security advisory sharing, low-code vendor-agnostic SOAR, as well as cyber fusion technologies.

In an announcement, the firm revealed it has already partnered with several globally renowned cyber security providers to deliver security solutions, including GuidePoint Security, Ernst & Young, Optiv, Morado, and SHI.

"CywareOne represents a significant step forward in our commitment to developing strong partnerships with businesses that share our vision for a safer digital world," said Matt Courchesne, Cyware’s head of channel for North America. 

"Our new program will deliver the resources and support our partners need to succeed in the rapidly evolving cyber security landscape."

Cyware specializes in unifying threat intelligence, automation, threat response, and vulnerability management with a range of data insights. The company’s Cyber Fusion solution integrates SOAR and TIP technology to enable collaboration across siloed security teams. 

The platform is deployed by enterprises, government agencies, and MSSPs while providing threat intelligence-sharing platforms for the majority of information-sharing and analysis centers (ISACs) around the world.

With its new partner program, Cyware is now also offering various benefits to its partners, including comprehensive training programs, dedicated support, co-marketing opportunities, and competitive discounts.

CywareOne has been designed to streamline engagement and opportunity management while facilitating a high level of trust and transparency. 

Ultimately, the aim is to equip partners with the skills and resources to effectively tackle clients’ cyber security issues.

The company said the program will create a thriving community of partners that are “united by their commitment to excellence”.

"We designed CywareOne with a clear goal in mind: to facilitate our partners' success," said Amit Patel, SVP of sales at Cyware. 

"We are committed to working collaboratively with our partners to deliver unrivaled cyber security solutions, providing them with the tools they need to excel and differentiate themselves in the market."

Cyber security provider Dragos has announced the launch of its new Dragos Global Partner Program, which will enable partners to act as industrial controls systems (ICS) and operational technology (OT) experts and advisors.

Dragos specializes in cyber security for ICS and OT environments, providing visibility into ICS/OT assets, vulnerabilities, threats, and response actions. 

The firm’s solutions protect organizations across industries such as energy, manufacturing, building automation systems, water, government, food, and more. 

Partners will have access to the Dragos platform for visibility into customer assets, Dragos Professional Services, as well as threat intelligence via the Dragos WorldView offering. Dragos OT Watch also enables managed ICS/OT threat hunts and notification triage, while Neighborhood Keeper provides collective defense.

Positioned as the only channel program that spans OT, services, and threat intelligence, the initiative provides training to help partners position themselves as specialist advisors able to offer their customers assessment services, resell the Dragos security platform, as well as manage deployment.

In an announcement, Dragos said partners will be able to offer the full range of ICS/OT cyber security technology and services to increase revenue opportunities and deliver positive results for customers.

“Market demand for OT cyber security is accelerating as evolving threats, geopolitical dynamics, and regulations shine a spotlight on the need to protect industrial infrastructure,” said Christophe Culine, VP of global sales and CRO at Dragos. 

“With the new Dragos Global Partner Program, we will transfer our knowledge and experience as the industry’s ICS/OT cyber security leader to our channel partners, enabling them to fully manage their customers’ deployments with the industry’s most comprehensive and complete ICS/OT security solution.”

Partners can access the program’s training via a self-service portal that pulls together automated deal registration, marketing materials, and access to self-paced ICS cyber security skills training through Dragos Academy training modules.

There are also market development funds (MDF), including proposal-based MDFs for demand and lead generation, as well as cumulative volume discounts and deal registration with increased margin for identifying opportunities.

Sean Tufts, practice director of ICS and IoT security at Dragos partner Optiv, said the partner program enables both businesses to achieve joint commercial success.

“The comprehensive, unparalleled training we get from Dragos and the highly differentiated product offerings allow us to triage and investigate potential incidents for our customers, enabling quicker response and visibility into the breadth and depth of attacks as well as affected devices,” he said. 

“All this allows us to give our customers the confidence that their operational technology and industrial infrastructure are secure, resilient, and compliant.”

Dark web intelligence continues to be a hot topic among MSSPs, with the latest research revealing a rapid increase in demand from customers in the US and UK.

According to the data, around two thirds (65%) of MSSPs said their customers had requested intelligence from the dark web and, among those, 74% said their customers' interest was increasing.

This demand is being driven by customers looking to identify vulnerabilities affecting their organisation (39%), to find out whether they are currently being targeted on the dark web (38%), and to gather intelligence on threat groups such as ransomware gangs (38%).

With interest on the rise, a majority of MSSPs have moved to address this customer demand, with more than half (56%) of those surveyed now undertaking dark web monitoring.

The findings are from dark web security firm Searchlight Cyber, which surveyed more than 500 MSSPs across the US and UK to detail if and how they leverage dark web intelligence.

Ben Jones, CEO and co-founder of the company, praised MSSPs for capitalising on the “rapidly increasing demand” from customers.

“We see a huge opportunity for MSSPs that are able to integrate dark web intelligence into their services,” he said. “As this topic grows in prominence, those that have started to build out their capabilities, data sources, and understanding will be able to benefit as more customers look for guidance on the dark web, giving them an advantage in the competitive market of managed security services.”

In terms of its benefits, 37% of surveyed MSSPs said dark web intelligence helps them identify customer details on the dark web, while 35% said it gives them new products and services to sell to customers. 33% revealed that it makes their current services more efficient.

However, 35% said the main barrier to its adoption was the perceived complexity, while 29% believe it isn’t relevant to their service offering. 18% did not believe they can sell it.

The findings reinforce data unearthed from Datto’s Global State of the MSP Report in October 2022, which found that dark web monitoring was top of the list of MSP’s next biggest investments, being planned by 30% of respondents.

Commenting on this latest survey, Matt Hull, global head of threat intelligence at NCC Group, highlighted the importance of understanding how attackers target their victims.

“As threat actors increasingly publicise and claim responsibility for ransomware attacks, leak breach data, and target executives on hidden sites and forums, there is an increased requirement from organisations to understand how they may be exposed and what they can do to mitigate risk,” he said.

“Effective and safe research across the dark web requires a degree of skill that is not often present within your average organisation and as such, they are turning to us for help in understanding the threats emanating from the dark web.”

Cloudflare has announced the development of the Cloudflare Zero Trust SIM, which has been designed to secure every packet of data that leaves a mobile device.

The first of its kind, the SIM will allow organisations to connect employee devices quickly and securely to Cloudflare’s Global Network, directly integrate devices with the firm’s Zero Trust platform, as well as protect their network and employees.

Cloudflare is also launching Zero Trust for Mobile Operators, a new wireless carrier program that will let carriers offer their subscribers comprehensive mobile security tools by tapping into its Zero Trust platform.

In an announcement, Cloudflare co-founder and CEO Matthew Prince said securing mobile devices at scale is currently one of the biggest issues for CISOs.

“Effectively securing mobile devices is hard, and we have been working on this problem since we launched our WARP mobile app in 2019, now we plan on going even further,” he said. “With Cloudflare Zero Trust SIM we will offer the only complete solution to secure all of a device’s traffic, helping our customers plug this hole in their Zero Trust security posture.”

Cloudflare says its Zero Trust SIM will integrate seamlessly with its entire Zero Trust stack, which will allow security policies to be enforced for all traffic leaving the device. That’s on top of its embedded SIM (eSIM) first approach, which allows SIMs to be automatically deployed to both iOS and Android and then locked to a specific device – ultimately mitigating the risk of SIM-swapping attacks.

Businesses will also be able to deploy the company’s Zero Trust SIM at scale in just minutes, as well as leverage integration with its WARP mobile agent.

Additionally, Cloudflare says it is developing new tools based on the new SIM, which will extend its connectivity and Zero Trust security perks to the Internet of Things.

“By combining Cloudflare’s award-winning security tools with the largest mobile networks in the world, businesses can be confident that their devices and data are secure without worrying about performance being impacted,” Cloudflare said.

Google Cloud has announced a new Chronicle MSSP Program to help Managed Security Service Providers drive customer satisfaction and deliver advanced security capabilities.

Announcing the move in a blog post, Google said the initiative will offer MSSPs the ability to provide “scalable, differentiated, and effective” detection and response capabilities via its cloud-native Chronicle SIEM offering.

“In a highly competitive environment where customers have little to differentiate between various MSSP providers, we are helping to turbocharge our MSSP partners with specialised services offerings, enabling branded portals and advanced threat detection, investigation, and response capabilities,” explained Sharat Ganesh, Head of Product Marketing at Google Chronicle.

With the Chronicle MSSP Program, partners will receive more go-to-market tools and support, as well greater controls over margins thanks to its modern licensing model.

Partners can add their solutions to Chronicle to help make it “unique in the market” and easier to sell, Google says, thanks to branded reporting, unique solutions, as well as advanced threat intelligence.

As the tech giant looks to stand out in a field that now includes programs from competitors AWS and Microsoft, it also highlighted Chronicle’s key technical differentiators.

These include API-driven multi-tenancy to streamline and automate customer management workflows, as well as its ability to “ingest data from any cloud” – even voluminous datasets such as EDR, NDR, and Cloud. Chronicle’s context-aware detections also help to prioritise threats and quickly respond to alerts.

“Simply put, Google Chronicle will help reduce the MTTR (mean time to respond) for our partners by helping to minimise the need to wait for contextual understanding before making a decision and taking an investigatory action, which can lead to greater customer and cost benefits,” Ganesh added.

Robert Herjavec, CEO of Herjavec Group and Fishtech Group, said the company was looking forward to helping its customers through the new MSSP program.

"We are proud to partner with Google Cloud Security to solve functional challenges that exist in security for our customers,” he commented. “As a major partner and a distributor/MSSP, we are excited to leverage this new program, helping our customers and delivering security outcomes"

While we all hope for a good year ahead, we can be sure that it’s not going to get any easier or safer for businesses and organisations as cyber threats continue to grow in sophistication and complexity. And as the going gets tougher and the shortage of cyber security skills gets more acute, more companies, particularly SMEs, are turning to their trusted IT solution providers for outsourced support to defend against cyber attacks. Ransomware is what keeps most CISOs awake at night but there is a whole host of old and new attack vectors to lose sleep over.

The Global Managed Security Services market size is projected to grow from USD 22.8 billion in 2021 to USD 43.7 billion by 2026, according to a report published by MarketsandMarkets. But if you’re a traditional cyber security reseller that wants to embrace the as-a-service opportunity, or if you’re an IT managed service provider (MSP) looking to add the extra S for security, what does it take and what are the things to avoid?

Prevent, detect, respond

First and foremost, it’s no good offering half the solution. Businesses are looking for a “one-stop-shop” and with a threat landscape that gets scarier by the day, you need a layered approach to managed services that include prevention, detection and response. And it’s not enough to be reactive, relying on signature-based anti-malware solutions, for example. Zero-day protection should not be negotiable. It’s key to certifying all running processes and preventing any program or even lines of code from executing without having been previously certified.

A complete managed security offering must also include protection for both networks and endpoints along with other services such as Multi-Factor Authentication (MFA) and DNS protection. MFA has traditionally been too costly to implement for SMEs but the cloud has changed that, making it possible to streamline delivery and simplify operations. Users can be added or removed and passwords changed with just a few clicks and without the need for time-consuming and costly site visits. A cloud-based management system can centralise a ton of previously arduous configuration, deployment, and management tasks through a single pane of glass, and help maintain a strong network performance and security posture at scale. And the more offerings you can adopt from a single source, while ensuring that customers get the services they need, the easier it is to keep your total vendor and hassle count down.

20/20 vision

As IT infrastructures grow in size and complexity, granular visibility into activity across them is crucial, to recognise patterns, threats, and security gaps, and to respond before damage occurs. Some SMEs don’t even know what resources are being consumed by whom, where they reside, and how they interact.

The problem is that many network platforms deliver large volumes of data, but with little clarity and ranking. If you’re managing multiple companies with multiple sites, it becomes essential to have a clear insight that provides actionable data to quickly and effectively identify, prioritise, investigate, resolve, and report multiple issues. From a remote network admin standpoint, actionable data is about tracking the top users, destinations, applications, domains, and includes things like the top blocked botnet sites, intrusion preventions, advanced malware attack attempts, and blocked malicious destinations.

With this level of granularity, you can see what’s going on in your customers’ networks and endpoints in real-time, from anywhere. Making sense of all this and actioning the appropriate response requires the MSP to have skilled security professionals. However, advances around AI and machine learning algorithms are increasing threat detection automation, classification of running processes, and prioritisation of alerts.

Flexible pricing and billing

For traditional resellers, the idea of recurring revenues is one of the great attractions as well as one of the biggest barriers to becoming an MSSP. Consumption-based billing is a major shift from customer billing models but should be a win-win for MSSPs and their customers. The best way to avoid complexity is for vendors to offer flexible pricing models, which could include fixed-term contracts paid upfront or monthly, pay-as-you-go setups, or pre-pay points, all with the ability to scale up and down instantly to meet changing requirements.

Another aspect to think about is the human touch. Humans are still the weakest link with most breaches starting with a simple click on a malicious link or document. This means that education remains a critical component of an effectively managed security programme. Without an understanding of how attacks happen and a commitment to behaviours and processes that reduce their likelihood, businesses are left exposed.

Managing IT security can feel like a mountain to climb – that just keeps getting higher. And now, as employees slowly head back to the office, cloud deployment using automation can eliminate many of the on-site headaches involved in setting up and managing customer sites. Having been through the era of Unified Threat Management (UTM) solutions, we’re seeing the emergence of a new Unified Security Platform, that lives in the cloud and gives centralised access to end-to-end security services from the network to the endpoint. It’s these new USPs that will enable and empower a new generation of MSSPs.

Jonathan Whitley is vice president for Northern Europe at WatchGuard Technologies

McAfee has launched MVISION Private Access to safeguard private applications deployed across hybrid IT environments.

“As private applications increasingly move to the cloud, organizations are rapidly adopting Zero Trust Network Access due to its security and flexibility advantages compared to VPN,” explained Christopher Rodriguez, research director at IDC Network Security.

“However, organizations need to recognize that private applications are just as likely to pose a data theft risk as SaaS apps, and that this risk needs to be mitigated.”

Upending the zero trust network access (ZTNA) arena, McAfee’s MVISION Private Access offers “granular zero trust" access to private applications hosted in private, public, or hybrid cloud environments.

By leveraging McAfee’s Endpoint Security for threat detection and remediation, the platform performs continuous risk assessment by monitoring device posture. Furthermore, MVISION Private Access is integrated with MVISION Unified Cloud Edge (UCE), enabling unified visibility and control across clouds, private applications, web, and endpoints.

MVISION Private Access’s other interesting features include remote browser isolation (RBI), granular controls for unmanaged devices, endpoint security and posture assessment, direct-to-app access, and more.

Lastly, MVISION Private Access includes built-in identity and access management (IAM) and multi-factor authentication (MFA) solutions, enabling strong authentication and context-based access control.

“ZTNA is built for cloud-first deployments, simplifying technology stacks, reducing cost and complexity, and improving productivity. However, existing ZTNA solutions lack the data-centric security controls associated with cloud and web security needed to secure today’s increasing remote connections,” said Shishir Singh, chief product officer at McAfee Enterprise.

Singh added, “MVISION Private Access unlocks secure, seamless and ultra-fast access to private applications for remote workforces and eliminates the additional hardware costs, time-consuming setup process and complicated architecture associated with traditional VPNs.”

Blok has officially launched to become the UK’s first managed cyber security service provider dedicated to small businesses and the self-employed.

The Leeds-based firm aims to tackle cyber criminals targeting sole traders, start-ups, and businesses with 49 employees or less.

As much as 38% of micro and small businesses reported at least one breach or attack in the last twelve months, with 27% hit at least once a week, according to the Government’s Cyber Security Breaches Survey 2021.

Where a breach has resulted in a loss of data or assets, the average cost of these attacks for micro and small businesses is £8,170, the research found.

To help tackle this, Blok is offering a range of cyber security subscription packages which are managed by a support team available 365 days a year. These include comprehensive endpoint protection, detection and response, as well as cloud security, malware defence, identity protection, network and perimeter security, plus technical support and training.

“We have launched Blok as we found that, although there is lots of advice, there was no organisation dedicated to providing managed security services specifically for small businesses and the self-employed,” explained Neil Peacock, co-founder of Blok.

“Drawing on our experience, knowledge and utilising industry-leading technologies, Blok is taking on the cyber criminals and making it easier and affordable for our clients to help protect their business and reputation.”

Based in Leeds, Blok has been founded by Peacock alongside business start-up expert Helen Phelan. A Certified Information Systems Security Professional (CISSP), Peacock brings more than 20 years’ experience in the information and cyber security industry, as well as experience in auditing and providing solutions to protect small and medium businesses.

Phelan joins a pool of just eight percent of cyber security professionals in the UK who are women, and ten percent of females across the world that hold management positions in the industry.

Drawing on her vast experience of successfully launching and establishing businesses, she will be responsible for operations at Blok, the firm said, including finances, business development plans, recruitment and marketing activity.

“There is a real lack of female representation in the cyber security industry,” Phelan commented. “I am excited to launch Blok and join a growing number of women breaking the cyber security glass ceiling.

“Having a more diverse team means we are better placed to engage with our clients and provide the service they need.”

The IT industry has long had a problem with buzzwords, with marketing teams latching onto the latest trends and using them to push their products as ‘the next big thing’. It’s even more pronounced in cyber security, where buzzwords can be backed up with a dose of fear, uncertainty, and doubt over new threats.

As a result, it can be difficult for buyers to parse the genuinely valuable solutions from those that simply have the latest buzzwords thrown into their sales pitches. This makes it more challenging for partners to decide which solutions to bring into their portfolio and can also make it more difficult for them to cut through the noise and sell successfully.

Zero Trust is one such trend, providing increased assurance that only trusted identities are able to access critical networks, systems and data. It’s become particularly beneficial as organisations must now deal with a largely remote workforce that falls outside the scope of normal processes.

However, there are a few barriers to implementing this model that may have some organisations holding back. Nevertheless, there's a real opportunity for channel firms in adding Zero Trust to their portfolio. While Zero Trust is time and resource-intensive, the value that it adds can make taking the plunge more worthwhile. Based on our experience with our growing channel community, here are four real-world outcomes partners can achieve if they invest in Zero Trust.

Establishing strategic value

Partners should be striving to create strong, long-term strategic relationships with their clients rather than simply selling products on a transactional basis. Establishing a role as a trusted adviser can vastly improve customer retention and the lifetime value of a customer.

Zero Trust is ideally suited for forging or strengthening this relationship. Partners have an opportunity to play a major role in the delivery of the Zero Trust model, which will impact the wider security strategy, providing further opportunity to establish their credibility as a trusted adviser and deliver more value.

Increasing the share of income

Zero Trust is not a specific, singular product, but a framework incorporating technology across five main areas: people, data, devices, networks, and workloads. All of these areas are supported by a process of continual improvement that delivers visibility and automation.

This means that helping to deliver a Zero Trust model creates a huge opportunity to influence and support the wider security strategy of the organisation. Partners with the right services and solutions can significantly increase their share of wallet by providing all the products and services the customer needs to continue on their Zero Trust journey.

Establishing 'ZTaaS'

Zero Trust is not a “one and done” type of solution that can be delivered and signed off but is a project of continual improvement. Because it spans multiple pillars of technology, channel partners can establish an MSP agreement that delivers service engagements across their portfolio.

A Zero Trust as a service (ZTaaS) package will both provide the partner with multiple, repeatable streams of revenue, and ensure that the customer has access to best of breed, marketing leading solutions.

Safeguarding gross product margins

Achieving and maintaining high gross product margins is always a challenge when rivals are offering competing bids offering like-for-like comparison or undercutting on price.

The powerful differentiator created by becoming an established, strategic adviser ensures that channel partners are shielded against competing bids that are sold on price alone. The more involved a partner is in the Zero Trust project, the more strategic and financial sense it will make for the customer to expand the existing relationship rather than explore competing bids.

Seizing the opportunity

Zero Trust has a huge potential global market, with the majority of security teams planning to adopt the model in future, and many already implementing a framework. Business needs have, of course, changed drastically in recent months due to COVID-19, and the model’s ability to manage user authentication has become more important for dealing with remote workforces.

Organisations need strategic partners that can genuinely deliver the technology, services and expertise needed to implement a successful Zero Trust model, rather than those that are simply throwing the latest buzzwords into their sales pitches. Partners equipped to meet these needs have a powerful opportunity to create and maintain highly valued and long-lasting strategic relationships.

Scott Walker is senior director for channel and alliances for EMEA at Illumio

Cyber security provider Secureworks has lifted the lid on its new security analytics platform Secureworks Taegis XDR, as well as the addition of a new global MSSP initiative to its Global Partner Programme.

With extended threat detection and response (XDR), the new Taegis XDR offering aims to protect users from threats that exploit gaps in point solutions and vulnerabilities in the supply chain, the firm says.

A cloud-native SaaS solution, it bundles together Secureworks’ security operations expertise with its threat intelligence capabilities to detect and respond to attacks across cloud, endpoint and network environments.

The platform also helps infoSec teams bridge their cyber security skills gaps while reducing costs where security blind spots previously existed, Secureworks added.

“When we first began developing Taegis, our original vision on where the market would go aligns squarely with what is now considered an XDR solution,” explained Steve Fulton, chief product officer at Secureworks. “We built a cloud-native security analytics platform and detection & response application—now officially Taegis XDR—from the ground up, with that vision in mind.

“XDR wasn’t an afterthought for us, or a label we decided to put on a point-product. It was the fundamental design-principle and architecture from where we started.”

The provider has also launched a new MSSP track within its Secureworks Global Partner Programme, aimed at both MSPs and MSSPs.

Leveraging the firm’s 20-plus years’ experience as an MSSP itself, the programme enables partners to deliver services on the Taegis platform to create additional revenue streams and service offerings to protect customer growth, as well as tackle difficult threats together.

The initiative offers access to the Secureworks Taegis security platform, which includes financial incentives, a defined enablement path, an assigned partner access manager, as well as dedicated partner support.

It also provides security operations centre (SOC) development for MSSPs, as well as training and enablement for delivering Taegis XDR, Tageis VDR and premium onboarding services. Additionally, there are financial incentives for partners - such as deal registration discounts and access to marketing development funds.

Secureworks said it is currently working with four geographically dispersed partners in the programme’s initial phase - including Globe Business, the enterprise arm of Globe Telecom.

“Globe and Secureworks believe cybersecurity should be supported by a community, as the battle can’t be won by one team alone,” commented Peter Maquera, senior vice president at Globe Business. “Secureworks has enabled us to not only bridge businesses to cybersecurity experts and cyber threat intelligence, but also provide predictive, continuous, and responsive protection.”

The role of the Managed Service Provider (MSP) is constantly evolving, as businesses seek support from their partners to navigate new challenges. As digital risks continue to increase, cybersecurity is one key area where there is rising demand from businesses for specialist support services from external providers.

It’s an area which offers significant scope for MSPs to support those businesses – and particularly resource-strapped SMBs – that are less likely to have the technology or skills in-house to block or defend against cyber attacks. The services of an outsourced provider are critical to protecting their business from the fallout of a security incident. Early breach detection is vital and more advanced threat intelligence and breach detection services are enabling MSPs to play a crucial role in identifying and mitigating threats wherever they emerge.

Making the transition to Managed Security Service Provider (MSSP) can add value to your offering and provides scope for growing revenue and strengthening client relationships, at a time when the threats businesses face are increasing in both scale and sophistication.

Outsourcing security

Research suggests the volume of incoming cyber attacks businesses faced in the first quarter of the year was roughly 30% higher than during the same period for 2019. The situation has clearly been exacerbated by COVID-19, creating more challenges for firms seeking to stay secure. Criminals are exploiting the crisis with deceptive emails and phishing sites, preying on the security vulnerabilities that make the remote workforce an easier target.

Innovation continues to make cyber attacks easier and at volume. As a result, criminals are turning their attention to smaller businesses, hoping they might represent ripe opportunities. It isn’t difficult to see why the cyber risks facing SMBs are considerable, with the latest platforms and dedicated, in-house security specialists, often beyond the budgets of the smallest companies.

Outsourcing security to a managed service provider offers clear advantages for businesses that simply cannot deal with all the threats they face on their own. Our own research with IT and security decision makers shows that more than half of businesses are now using either totally or partially outsourced services to manage their cyber security needs, and value the expertise of external providers on security decisions. In fact, advice from security resellers, consultants or partners is the preferred way for IT and security professionals to find out about new cybersecurity technology.

The value of early warnings

There is significant scope for MSPs to add value to their offering and help SMBs plug their security gaps with affordable service-based solutions that provide protection against digital risks. The latest services to identify and mitigate threats wherever they emerge, including the dark web, play a vital role in helping businesses to reduce the threat landscape. Monitoring the internet for early warning signs of an attack provides clients with the best chance of taking action to prevent loss of data or business downtime. Threat intelligence can now monitor a variety of sources; scraping data from open sources such as social media or forums on the dark web that can shed light on threats in advance. They can also reveal discussions about the company, including negative chatter that may point to a security risk.

Such systems can also be used to discover when data has already been leaked or breached. This could include company data that was stolen in a previous breach that went undiscovered, or data that was stolen from a third party such as a supplier or partner. Data leaked or lost due to human error can also be found, if it ends up in the wrong place.

Understanding the threats to businesses data that exist outside the network gives vital intel which can be used to defend against attackers on a direct, tactical level. It also provides powerful insights for long-term strategic decision making. With the right intelligence, businesses can better invest in their defences to reduce risk in the future.

New threat intelligence and breach detection services are democratising security by making it affordable and accessible to businesses of all sizes. As with the ongoing impact of coronavirus on security challenges, there’s likely to be increased demand from SMBs for this outsourced expertise to keep their businesses secure, as the level of cyber threat continues to rise. MSPs able to meet this demand will be well-placed to both better support their existing customers, and expand their customer base, providing services to help them survive the risks of the current crisis, and beyond.

Jeremy Hendy is CEO of Skurio

The frequency and complexity of cyber attacks continue to escalate, creating a challenging environment for organizations of all sizes. In 2025, cybersecurity is dominated by advanced threats, including AI-powered phishing, adaptive malware, and relentless ransomware campaigns. Cybercriminals are leveraging artificial intelligence to automate and personalize attacks, making them harder to detect and more effective at bypassing traditional security measures. For example, AI-driven phishing can now tailor messages to mimic trusted contacts and adapt to avoid detection, while AI-powered malware evolves in real time to evade defenses.

Recent data underscores the severity of this trend: ransomware attacks are surging, with a notable 84% increase in ransomware incidents over the previous year, and ransomware now accounts for 35% of all cyberattacks in 2025. The global average cost of a data breach reached an all-time high of $4.88 million in 2024, a 10% increase from the prior year. This intensification of threats is further amplified by the rapid adoption of AI by both cybercriminals and state-sponsored actors, who use it to automate reconnaissance, exploit vulnerabilities, and conduct large-scale social engineering attacks.

For many businesses, especially small and mid-sized organizations, effectively managing security in-house is an increasingly daunting challenge. This difficulty is compounded by a persistent cybersecurity skills gap, with an estimated 4.8 million person shortage in the industry.

The struggle to keep pace with evolving threats and a lack of specialized talent has made the services of a Managed Security Service Provider (MSSP) more critical than ever. The global market for managed security services is projected to reach nearly $76 billion by 2030, reflecting a growing reliance on outsourced expertise to build cyber resilience. An MSSP offers the specialized knowledge and continuous monitoring necessary to protect vital infrastructure, allowing internal teams to focus on core business objectives.

What is an MSSP?

MSSPs are specialized third-party providers that deliver outsourced cybersecurity services. They handle the security operations for an organization, either in part or in full, and can do so from a remote location or by placing experts on-site.

An MSSP may offer a broad suite of security capabilities or specialize in core focus areas like cloud security or compliance. The majority, however, will manage a business's security infrastructure and monitor systems for threats from their own Security Operations Centers (SOCs). To do this, they implement and manage a sophisticated technology stack that goes far beyond basic antivirus software. Common tools include Security Information and Event Management (SIEM) platforms, Managed Detection and Response (MDR) services, VPN management, and advanced firewall management.

Ongoing responsibilities also include system upgrades, patch management, and configuration changes, ensuring a client's security posture continuously adapts to new threats and business demands.

Services an MSSP can provide

MSSPs offer a comprehensive suite of services designed to protect organizations before, during, and after a cyber attack. Proactively, their primary goal is to harden the IT infrastructure and enforce robust security policies to minimize the attack surface. This includes vulnerability assessments, penetration testing, and ensuring systems are configured securely.

Should an attack occur, an MSSP's role shifts to rapid detection and response. Using advanced security monitoring tools, they can identify threats in real time and take immediate action to neutralize them, preventing or limiting damage to the organization's systems.

Because MSSPs serve numerous clients, they accumulate a vast amount of experience dealing with a wide variety of attacks. This broad visibility allows them to understand emerging threat patterns and containment strategies. They leverage this collective knowledge to continuously refine and strengthen your security posture.

Typical services provided by an MSSP include:

• Security infrastructure management: Implementing and managing firewalls, intrusion detection and prevention systems (IDPS), and other security hardware and software.
• 24/7 monitoring and threat detection: Continuously monitoring networks, systems, and applications for suspicious activity from a Security Operations Center (SOC).
• Vulnerability management: Regularly scanning for and remediating vulnerabilities in your systems through patching and configuration updates.
• Incident response and remediation: Developing and executing a plan to contain threats, eradicate them from the network, and recover affected systems.
• Security information and event management (SIEM): Aggregating and analyzing log data from various sources to detect patterns indicative of a cyber attack.
• Compliance management: Assisting organizations in meeting regulatory requirements such as GDPR, HIPAA, or PCI DSS.

For a small to medium-sized business (SMB), a good MSSP functions as a seamless extension of the firm's own IT employees, providing specialized expertise that would be difficult and expensive to build in-house.

Why use an MSSP?

For organizations seeking to alleviate the stress and complexity of building and maintaining robust security infrastructure, partnering with an MSSP is often the optimal choice. An MSSP not only relieves internal IT teams of the bulk of routine security tasks, such as daily threat monitoring and incident response, but also assumes responsibility for maintaining uptime, managing upgrades, and ensuring swift remediation in the event of a breach.

While some organizations may develop and execute their own security strategies, from deploying necessary software and training staff to allocating adequate resources, this approach can prove overwhelming, particularly for smaller IT teams. In such cases, outsourcing to an MSSP becomes a compelling solution.

SMBs frequently lack the specialized expertise required to manage a comprehensive security infrastructure independently. Even with strong commitment and resource allocation, the demands of security maintenance can quickly exceed the capacity of limited teams. This strain can result in critical IT functions, like system patching, hardware management, and digital transformation initiatives, receiving insufficient attention. The rise of remote work only compounds these challenges by introducing additional layers of complexity.

The evolving cybersecurity landscape further complicates matters. Smaller teams may struggle to respond effectively to the full spectrum of threats, especially as cyberattacks become more sophisticated. While in-house staff can handle some known risks, an MSSP provides specialized expertise and round-the-clock monitoring, offering a crucial layer of protection and peace of mind. Leading MSSPs bring a depth of knowledge that is difficult to cultivate internally, with dedicated teams that continuously monitor emerging threats, assess IT environments, and provide actionable recommendations. They also deliver support services, keeping all business units informed and engaged.

Partnering with an MSSP also addresses the persistent challenge of talent acquisition. Many CISOs report increasing difficulty in recruiting and retaining skilled security professionals, a problem that is especially acute for smaller firms or those located outside major urban centers. MSSPs offer immediate access to a pool of experienced security specialists, eliminating recruitment headaches and ensuring continuous protection.

MSSPs provide a comprehensive suite of security services delivered remotely, and their pricing models are typically designed to accommodate financial constraints. Most providers charge a predictable, flat monthly fee, enabling businesses to budget effectively and avoid unexpected expenses.

As technology evolves, MSSPs ensure that security measures scale and adapt alongside your business. Through regular assessments and audits, they deliver strategic insights and recommendations, allowing organizations to focus on core business objectives without compromising security.

MSSPs can operate either on-site or remotely, but in either scenario, they integrate seamlessly with existing IT teams. This collaboration frees internal staff to concentrate on innovation and other strategic projects, rather than being consumed by security incidents. Ultimately, MSSPs help enhance customer experiences by improving response times and boosting satisfaction.

By partnering with an MSSP, organizations can overcome resource limitations, access specialized expertise, and achieve scalable, cost-effective security, all while enabling their internal teams to focus on driving business growth.

MSP vs MSSP

A managed service provider (MSP) offers a broad range of IT management services, such as network support, application management, system administration, and email management, typically delivered to multiple clients on a recurring, pay-as-you-go basis. While MSPs are essential for maintaining smooth business operations and IT efficiency, their security offerings are generally limited to baseline protections like routine monitoring and patch management.

In contrast, an MSSP specializes exclusively in cybersecurity, delivering advanced, round-the-clock services such as threat detection, incident response, and compliance monitoring from a dedicated security operations center (SOC). MSSPs are well-positioned to serve as strategic security partners for organizations seeking robust protection as cyber threats grow in both frequency and sophistication.

As the threat landscape evolves, MSPs that do not expand their security capabilities risk losing business to those that do, or to MSSPs that offer more comprehensive protection. While it is possible for an MSP to transition into an MSSP by enhancing its security offerings, such as adding antivirus, patch management, and web protection, delivering true, enterprise-grade cybersecurity requires specialized expertise, tools, and continuous monitoring that are the hallmark of an MSSP.

Many MSPs now partner with MSSPs to provide their clients with the best of both worlds: efficient IT management and advanced security. This dual approach ensures organizations can maintain operational efficiency while safeguarding their critical assets from ever-evolving threats.

In a business world increasingly dominated by IT, the demand for managed services providers (MSPs) is showing no signs of slowing down. While many companies, large and small, seek the skills and support that MSPs offer, however, the role that MSPs need to play today is significantly changing.

The days of MSPs simply managing office devices and hardware are long gone. Innovations in enterprise computing and the rise of remote working are transforming business IT. While they are delivering major benefits for businesses, they are also creating new security risks and vulnerabilities.

For every business, security has risen to the top of the agenda, with data being the most important asset. Understandably, ambitious MSPs might be tempted to step up to the plate and offer security services on top of their existing services to maximise the new opportunity. After all, MSPs have been delivering some level of security for years.

The challenge that MSPs face, though, is that a bog-standard antivirus and firewall will not cut it. Businesses need insight on the latest malware threats and cybercriminals' malicious motives. They also need to be able to guarantee protection from a whole host of bad activity.

Does this mean MSPs should transition into managed security services providers (MSSPs)? Maybe, but doing so will mean delivering brand new services and hiring individuals with security experience - a significant cost for MSPs, both in time and money. For an average-sized MSP making this kind of investment simply isn't feasible.

Luckily, however, there is a viable alternative. MSPs don't need to become MSSPs themselves - but by partnering with them, MSSPs can instigate changes and help MSPs successfully deliver the security services their clients crave. This can be the perfect antidote to MSPs' problems, but only if approached the right way.

Striking up strong partnerships

Understandably, MSPs may have reservations about entering into partnerships with MSSPs. Competition in securing and retaining clients is difficult enough without having to share the spoils. It should be considered, however, that partnerships with MSSPs can help MSPs cover the gaps and weaknesses in their security portfolios and create new streams of revenue. Through partnerships, MSPs can strengthen and sell more of their own services while alleviating the pressures of trying to "do" security alone.

When embarking on partnerships, it's important that MSPs move away from the idea that MSSPs are competitors. While the two operate in the same space and serve the same kind of client base, they are fundamentally different beasts. MSPs often act as the chief information officer (CIO) for a company, responsible for managing devices, raising help desk requests, as well as managing, deploying, configuring, and patching devices. Essentially, an MSP is there to manage, or even be, the IT department.

An MSSP, on the other hand, is solely focused on security - working to keep the bad guys out and ensuring security programmes are in place. Ultimately, the MSSP doesn't want to take on the role of an MSP, and everything this entails. Therefore, MSPs shouldn't take the cynical view of partnerships as akin to 'sleeping with the enemy'. They should instead see these as opportunities to work with partners that exist outside of the battleground where MSPs so fiercely compete.

Another important step is selecting the right MSSP to partner with. There are many out there, and going through the process of selecting a prospective partner with can be difficult and time-consuming. A great place to start is for MSPs to think honestly about which security-related services they currently can't deliver. Is it the inability to monitor networks on a 24/7 basis? A lack of an endpoint management solution? Gaps in specialist crisis management knowledge? Once MSPs have an idea of what they want from an MSSP, finding the right one to partner with will be much easier. With a strategic approach and the correct attitude, MSPs can set things off on the right foot and forge the very strongest of MSSP partnerships.

Differentiating in an overcrowded playing field

It's evident that partnering with MSSPs can help MSPs deliver the security services clients need without having to break the bank. While this alone is enough justification for MSPs to consider entering MSSP partnerships, it's also worth noting that these partnerships can deliver great benefits to the overall business of both parties involved.

Establishing a competitive differentiator is particularly difficult for MSPs and MSSPs alike. Companies across the industry are quick to mirror each other's services and products in a bid to one-up each other. By embarking on partnerships, MSPs and MSSPs not only serve their own clients better, but they can differentiate their businesses by effectively delivering both sets of services.

MSPs and MSSPs have traditionally operated separately, but vast changes in business IT means the line dividing the two is blurring. This doesn't mean MSPs and MSSPs need to completely overhaul their businesses to the point where they're replicate each other. MSPs and MSSPs will always have specialist knowledge in the areas they have years of experience in, and this is why it makes so much sense for the two forces to come together and combine their expertise. Doing so will help both develop into the businesses their clients increasingly need.

Tim Brown is vice president for security with SolarWinds MSP

Given that the 1995 Data Protection Directive was written well before the advent of cloud and managed IT services, the protections are now unable to cope with the pace of technological change. However, unlike its predecessor, GDPR will soon fill in those gaps, encompassing not only those collecting the data but any third parties that also access, process and store that data.

With organisations increasingly turning to external service providers for help with their security needs, in the run-up to GDPR MSSPs must ensure that the services they offer meet the regulations. Failing to do so could place them in the firing line.

MSSPs' role as a processor

In GDPR terminology, MSSPs are classified as "processors," in that they hold and use personal data on behalf of their customers, the "controllers". Under GDPR, MSSPs will have to provide various assurances to their customers that they meet the legislation's new requirements, particularly around the technologies and processes in place to protect sensitive data.

Yet this is easier said than done. With the absence of a recognised accreditation, it will be up to individual MSSPs to make sure that their existing processes and tools can keep them compliant.

Are your security management tools up to the job?

The GDPR states that both processors and controllers are required to implement "technical and organisational measures" to mitigate the risk to individuals incurred when handling personal data (Articles 25 and 32). These measures should include those that protect against the purposeful or accidental access, transmission, destruction, loss, alteration, or disclosure of personal data leading to physical or reputational damage of any EU citizen (Article 32).

Organisations opting for a managed service model for security are pushing some of the regulatory burden onto their MSSP. Since monitoring of access to customer data will become a function of GDPR compliance, MSSPs will have responsibility for ensuring they can effectively track user activities, such as access to sensitive data.

However, existing technical tools used by MSSPs fall short in two ways. Firstly, they do not provide the context to determine if a hacker is accessing confidential data. Secondly, if a breach does occur, they often miss the full picture, enabling a hacker to stay in the network and potentially cause further damage.

Post-breach reporting is another area of concern for MSSPs. The new Data Protection Officer (DPO) role created under GDPR will be obliged to report breach incidents to local authorities within 72 hours (Article 33), and to affected persons as soon as possible. To provide accurate information to both the authorities and customers, these DPOs must ascertain the full scope and impact of the breach, and so MSSPs must make sure that their existing technical measures can provide timely and complete post-breach forensic information.

Rethinking security

MSSPs typically use traditional SIEM (Security Information & Event Management) technologies as the main vehicle to manage data security in their Security Operations Centres. SIEM technology was fit for purpose a decade ago when data was relatively small, attacks were single incidents and the infrastructure was fairly simple. For example, there was less remote working, very few companies had BYOD policies, and emerging cloud applications were hardly used by larger organisations.

Today the style of attack has changed considerably; instead of perimeter probing, compromised insiders and zero-day internal attacks are now the norm. These styles of attack are hard for traditional SIEM technologies to detect with their correlation-based approach to detection. Advances in analytics and data science are the future for this market.

The need to be able to clearly show how a breach started, and identify everything an attacker touched during the incident, poses a big issue for MSSPs utilising a traditional SIEM. Visibility is poor, meaning cloud applications are effectively a blind spot, and there are many rules that create lots of noise, making it difficult to automate response and reduce risk exposure.

MSSPs are starting to understand that they need to rethink security management in light of GDPR. Greater visibility will enable them to identify threats to customers much quicker and with higher accuracy, and will provide a better understanding of how a breach started and the path it took, without hours or days of manual work. With this higher degree of visibility and understanding, automated controls can be applied to remediate an attack before it grows out of control.

Ultimately, the MSSP will be able to demonstrate to current and future customers that they have the correct controls in place to limit data getting into the wrong hands. Not only that, they'll avoid some nasty fines in the process.

Brett Candon is EMEA channel director at Exabeam

In the face of WannaCry, NotPetya and numerous other high-profile data breaches, European businesses are seriously re-evaluating how they manage their cybersecurity. They are looking for solutions that succeed in safeguarding critical data, but also serve all their other business and IT needs. There are still barriers to overcome and buyers will need to to be convinced if they are to part with cash for that initial managed security services provider (MSSP) adoption.

Rising cybercrime, digital disruption and increased compliance demands are threatening the stability of businesses across Europe. Dealing with cybercrime alone is a challenge, but as businesses look for a competitive edge through digitisation, and with the General Data Protection Regulation (GDPR) just over the horizon, many are looking for outside help.

Increasingly, that help comes in the form of an MSSP. For some areas of an organisation, particularly in the UK where outsourcing has long been practiced, it might come as a surprise that MSSPs are still seen as a relatively new concept and one that's still treated with suspicion by security chiefs. The issues are trust and control -- handing over the security keys of a business is not something to be taken lightly.

However, there has been a clear growth in MSSP adoption across Europe as the triple pressures of cybercrime, skills shortages and compliance begin to take their toll on under-pressure IT departments and boardrooms fret about the business impact of data breaches. So outside help is being sought, but that doesn't mean that any MSSP is going to get an easy ride.

Recent Reliance acsn research highlighted that 66% of European businesses are already using an MSSP, with a further 24% planning to invest. The remaining 10% are in the process of evaluating the prospect. This demonstrates that across the board industry sectors are putting aside their reservations about using an outsourced security service. That said, the results within the sectors show that there's still some reluctance to accept the idea of fully outsourced security.

We can see that the idea of outsource is catching on, but there is still some way to go before end users completely trust an MSSP to manage security. As a result, 53% are at an early stage of planning, with only 12% at an advanced stage.

The results show the trends they are most concerned about also tend to be the drivers of change and innovation across European businesses, and confirm the feeling that the better things get in terms of digital transformation, the worse they get for security. Mobile (74%), cloud (67%) and IoT (58%) were the most frequently mentioned concerns in our report, while other major IT trends such as digital transformation (50%) and shadow IT (34%) were also frequently mentioned. These results give a reflection of what end users are thinking about and dealing with right now.

Client organisations have a mixed view of the benefits that an MSSP can provide, and different parts of the organisation have different expectations. The board looks initially to save money, whereas security teams look for help and technology that they cannot deliver in-house. An MSSP is not for life, or even for a whole organisation. Businesses are taking a pick-and-mix approach, and even taking some functions back in-house. In an age of pay-as-you go cloud and SaaS, MSSPs need to be flexible in terms of outlook and delivery, and agile enough in the face of frequent policy changes and new threats.

Michael Clifford is the managing director at Reliance acsn

Gartner research has revealed that although security spending is set to top $113 billion by 2020, it's at the detriment of MSSPs, which are likely to see a hit to their business.

The reason for this is CISOs and security managers will turn to management platforms and services that are tailored to their market sector to bring into their business rather than seeking support from a provider.

"CISOs are keen to communicate the return on investment of their security strategy in terms of the business value associated with quick damage limitation, in addition to threat prevention and blocking," said Lawrence Pingree, research director at Gartner.

"The key enabler for CISOs in this endeavor is to get visibility across their security infrastructure to make better decisions during security incidents. This visibility will enable them to have a more strategic and risk-based conversation with their board of directors, CFO and CEO about the direction of their security program."

This trend will also go hand-in-hand with businesses changing their security strategy from prevention-only to detection and response. This has allowed new sub-sectors to emerge, including deception, endpoint detection and response (EDR), software-defined segmentation, cloud access security brokers (CASBs), and user and entity behavior analytics (UEBA).

Although these aspects of security are contributing to the growth of the overall security market, they are causing to the data security, enterprise protection platform (EPP) network security and security information and event management (SIEM) sectors to contract.

"The shift to detection and response approaches spans people, process and technology elements and will drive a majority of security market growth over the next five years," said Sid Deshpande, principal research analyst at Gartner.

"While this does not mean that prevention is unimportant or that chief information security officers (CISOs) are giving up on preventing security incidents, it sends a clear message that prevention is futile unless it is tied into a detection and response capability."