Cybersecurity customers want more from MSPs than a 24 by 7 SOC: Barracuda

With 74 percent of Indian organisations outsourcing security to MSPs, Barracuda says customers expect providers to combine technical security services with cyber resilience, AI-risk expertise, faster incident recovery and clear communication of business risk.

Governmental cyber defense team using advanced technology to secure information, cyber operations in high tech monitoring center. Working on data protection and threat detection. Camera B.

Cybersecurity customers are looking beyond traditional managed security services as they expect managed service providers (MSPs) to help strengthen cyber resilience, address AI-related security risks and communicate cybersecurity risks to business leaders, according to new research from Barracuda Networks.

The cybersecurity company’s What MSP Customers Need Next report finds that while technical expertise and services such as a 24/7 security operations centre (SOC) remain critical, organisations are also looking for strategic guidance, resilience capabilities and support in navigating AI-related security risks.

According to the research, 74 percent of organisations in India outsource security to an MSP, compared with 66 percent globally. A further 29 percent of organisations globally are considering or evaluating MSP providers.

Barracuda Networks says these findings point to growth opportunities for MSPs over the next 12 to 18 months as customer expectations expand beyond traditional outsourced security operations.

The research finds that demand for additional external security support is not primarily being driven by organisations experiencing higher rates of cyberattacks.

Instead, prospective MSP customers are concerned about their ability to detect, investigate and respond to threats quickly and effectively.

Only 29 percent of organisations looking for MSP support say they can secure compromised accounts and restore operations within hours of an incident.

The findings indicate an opportunity for MSPs to address a broader set of requirements around incident response and recovery, rather than focusing only on threat monitoring and detection.

Cyber resilience gaps also extend beyond technical security operations.

Nearly half of prospective MSP customers report that several key resilience capabilities, including strong security leadership, an effective security culture, asset visibility and third-party risk management, are either at an early stage or only partially established.

AI is adding another layer to customer security requirements. The research finds that 59 percent of prospective MSP customers are concerned about AI-related risks, including AI-generated phishing, AI-powered social engineering, shadow AI and AI-enabled insider threats.

This creates another area where MSPs can potentially expand their security expertise as customers seek help responding to risks arising from the growing use of AI as well as its use by threat actors.

However, the research does not suggest that traditional managed security capabilities such as SOC services are losing importance. Instead, customers increasingly expect additional capabilities alongside the technical services they already receive.

Customers want MSPs to explain business risk

Another shift highlighted by the research is the importance customers place on an MSP's ability to communicate cybersecurity issues to non-technical business leaders.

Forty percent of existing MSP customers globally say clear, plain-language explanations of cybersecurity risks, incidents and next steps are an important consideration when choosing a provider.

The finding potentially expands the role of MSPs from managing security technologies and responding to incidents to helping organisations understand the wider business implications of cybersecurity risks.

“Organisations today are looking for more than outsourced security operations,” says Michelle Hodges, senior vice president, global channel and alliances at Barracuda Networks.

“As cyber threats become more sophisticated and AI reshapes both attack techniques and business operations, customers increasingly want trusted partners who can help them understand risk, strengthen resilience, recover quickly from incidents, and make informed decisions.”

Hodges says MSPs best positioned for growth will be those that combine technical expertise with the ability to protect customers’ businesses, advise leadership teams and help organisations navigate an increasingly AI-driven environment.

For MSPs, the findings point to a changing value proposition as security outsourcing grows. A 24/7 SOC and technical security capabilities remain fundamental, but customers expect their providers to also help them build resilience, recover from incidents, address emerging AI risks and explain cybersecurity issues in terms that business leaders can act on.