MSPs say nearly half their customers rely on them for CISO services
MSPs estimate that 46% of their customers, on average, look to them to act as CISOs, according to Sophos. Most of those providers do that job without the full set of compliance services, and many spread the work across several tools.
Most providers expect this work to grow. For many of those customers, the MSP is the closest thing they have to a security leader.
Most compliance offerings are partial
Nearly every provider does some compliance work. Providers also estimate that compliance requirements influence about half of their customers’ security purchases. Sophos measured seven services, from identifying which regulations apply to managing a customer’s whole compliance program, and most providers deliver four to six of them.
More than half of all providers say they manage customers’ full compliance programs, yet about one in ten of those also delivers the other six services. Sophos says some of that oversight may amount to coordinating work that customers or outside specialists perform.
The providers still feel good about the work. Ninety-five percent say they are confident they can track compliance across many customers, though a third call themselves completely confident.
Reports still take hand work
Nearly nine in ten providers use software for this work, but more of them juggle several tools than rely on one. Sophos says many of those tools cannot feed a central reporting platform, which leaves staff to combine data by hand.
Staff feel that most when they build security posture reports, the summaries that tell a customer where its security stands and what to fix. About a third of providers produce those reports through a fully automated process. A larger group, 55%, has automated part of the job and still does some of it manually.
Providers think one unified platform would help. On average, they estimated it would cut the time they spend on posture, compliance management and reporting by about half. Providers already running full compliance programs expected more savings than those with no plans to offer that service. Those figures are guesses about a hypothetical system. Sophos, which paid for the survey, sells a service aimed at this work, CISO Advantage, delivered through its Sophos Fusion system.
“MSPs have an opportunity to become indispensable strategic partners to their customers, but scaling that role requires a more unified operating model,” said Scott Barlow, VP and chief evangelist at Sophos. “Bringing security posture, compliance management and reporting together can help MSPs spend less time manually consolidating information and more time helping customers reduce risk, strengthen resilience and make informed cybersecurity decisions.”
Download: eBook: Identity-First Threat Intelligence
