In 2025, cybersecurity remains a critical concern for managed services providers (MSPs) and their clients. Data from the 2024 Verizon Data Breach Investigations Report highlights several alarming trends.
Business owners are often their own worst enemies. Over half of small to midsize (SMB) owners do not consider themselves targets, leading to inadequate security measures. Despite this, SMBs are the primary targets for cybercriminals, facing more attacks than enterprises year over year.
Criminals follow the path of least resistance, and SMBs often provide that path. Shockingly, 23% of SMBs have no cybersecurity measures in place, either due to a lack of providers or because their solution providers are failing them. This negligence makes both the business owners and solution providers significant cybersecurity threats.
Additionally, 27% of SMBs have unprotected GRC data, including credit card and financial information. This lack of protection is often due to solution providers and MSPs not knowing or enforcing adequate security measures or not dropping non-compliant clients. The result is a continued cycle of vulnerability.
The human factor: Lack of security meets inadequate training
The human element is a significant vulnerability in cybersecurity. With 59 million SMB employees in the US, they are 350% more likely to fall victim to social engineering attacks than enterprise employees. Nearly a quarter of these employees (15 million) receive no cybersecurity training, and many solution providers allow clients to opt for minimal training, further exacerbating the problem.
Business owners who refuse training because they do not view themselves as targets and solution providers who allow this contribute to the high rate of human error that leads to credential theft. The lack of security affecting 15 million individuals, combined with inadequate training for 33 million employees, emphasizes the urgent need for improved cybersecurity practices.
Mitigating threats with security frameworks
To address these threats, MSPs can leverage cybersecurity frameworks. These frameworks provide structured processes to enhance security measures. One popular choice is the CIS Controls, which offer a comprehensive list of best practices. CIS maps its controls to other frameworks, making it adaptable to clients using standards like HIPAA and CJIS.
Implementing a framework like CIS has several benefits:
- Risk mitigation: Following globally recognized standards and best practices reduces business risks.
- Insurance compliance: Cyber insurance providers favor frameworks like CIS, which meet their coverage requirements.
- Documentation and checklists: MSPs gain accurate documentation and checklists to ensure proper implementation, mitigating shared liability with clients.
Demonstrate value through analyses
A gap analysis is essential for identifying vulnerabilities and areas for improvement. MSPs can conduct a thorough discovery process using a cybersecurity framework to pinpoint gaps in their clients’ security measures. This analysis helps develop targeted strategies to close these gaps and enhance security.
Applying a cost-benefit analysis to cybersecurity investments is crucial for demonstrating value to clients. For example, consider a fictitious client in the manufacturing sector using Office 365 but not implementing Multi-Factor Authentication (MFA). The cost of enabling MFA is minimal, involving time to guide users through the setup process. The benefit is significant, as it secures accounts and reduces the risk of breaches.
The average cost of an MFA breach in SMBs is $217,000. Comparing the cost of implementing MFA to the potential breach cost makes it clear that enabling MFA is a prudent investment. This analysis helps clients understand the tangible benefits of cybersecurity measures.
Accountability and action
MSPs must hold themselves accountable for allowing clients to dictate cybersecurity measures. It’s your duty to inform clients about risks and recommend appropriate security measures. If you knowingly provide inadequate services and a breach occurs, your business can face legal liability. Don’t be a threat to your own business because someone wants to cut corners.
In 2025, MSPs must prioritize cybersecurity to protect their clients and themselves. Understanding the top threats, leveraging security frameworks, performing gap analyses, and applying cost-benefit analyses are essential steps in this process. By taking these measures, MSPs can mitigate risks, comply with insurance requirements, and provide robust security solutions that safeguard their clients’ businesses. Remember, it’s not just about implementing security measures; it’s about holding yourself accountable and ensuring your clients do the same.
