Key findings
66%
of organizations outsource security to an MSP — a further 29% are considering/evaluating providers
40%
of customers choose MSPs who can explain risks and incidents in plain language
59%
of MSP prospects worry about AI-related threats
29%
of MSP prospects can secure compromised accounts and restore operations within hours of an incident
Executive summary
Organizations work with managed service providers (MSPs) because cybersecurity has become too business-critical, complex, and fast-moving to manage alone with limited resources. 53% of MSP customers say they are expected to support new and expanding digital operations without additional resources, and 41% cite resource limitations as a contributing factor in successful email security threats and attacks.
Barracuda Research’s international survey found that two-thirds (66%) of organizations already outsource security services to an MSP, and a further 29% are considering or evaluating providers.
The survey explored what drives organizations to engage an external service provider and the factors that influence the choice of partner.
The results show that organizations looking to outsource security to an MSP are not experiencing materially more security incidents than MSP customers or organizations that prefer not to use external providers. Their concern is whether they can see, understand, and respond to attacks quickly enough. They report lower confidence in their tools, slower response and recovery times, significant skills gaps, and less mature security and resilience capabilities.
Existing MSP customers say they chose providers who could deliver round-the-clock technical protection, but also help the business to understand risk, recover from incidents, adopt AI securely, and communicate clearly with non-technical leaders.
For MSPs, this means that future business growth lies in offering higher-value cybersecurity partnerships. Both prospective and existing MSP customers value always-on detection and response, sector-specific expertise, identity and email protection, cyber resilience, AI security capabilities, compliance support, and executive-level reporting.
Who this report is for
This report is written for MSPs and IT and security leaders to help them understand the evolving security needs of organizations and the opportunities for MSP business growth.
Methodology
Barracuda surveyed 2,000 mid- to senior-level IT and security decision-makers in organizations with between 100 and 2,000 employees from a broad range of industries in the U.S., UK, France, DACH (Germany, Austria, Switzerland), Benelux (Belgium, the Netherlands, Luxembourg), the Nordics (Denmark, Finland, Norway, Sweden), Australia, India, and Japan. The survey was undertaken for Barracuda by independent research agency, Arlington Research.
- What’s keeping the next wave of MSP customers awake at night?
- Security incidents are not the main driver
- Weaker security capabilities
- How confident are you that your current email security tools can detect the following in real-time?
- Supplementing skills not headcount
- Cyber resilience gaps remain
- Detection, investigation, and recovery are slower
- Security resilience remains less developed
What’s keeping the next wave of MSP customers awake at night?
Security incidents are not the main driver
One in three (29%) organizations surveyed are looking to outsource security services to an MSP. This rises to 36% among organizations with 100 to 500 employees.
These organizations are not experiencing more security incidents than existing MSP customers (81% compared with 86%). Instead, the key difference is confidence. Prospective customers feel less able to detect threats, investigate incidents, and recover quickly when attacks occur.
Weaker security capabilities
Across every threat category listed, MSP prospects report lower confidence in their ability to detect attacks than respondents overall — and MSP customers in particular. The largest confidence gaps relate to spoofing and impersonation attacks, account takeover, identity compromise, insider threats, and emerging techniques such as QR code phishing.
This is significant because many modern cyberattacks rely on compromised identities, trusted accounts, and social engineering rather than traditional malware techniques.
Looking ahead, the leading concerns cited by organizations considering or evaluating MSPs are balanced between established cyberthreats and emerging AI-related risks.
The top concerns for MSP prospects over the next 12 to 18 months include:
- AI-generated phishing and social engineering: 40%
- Ransomware or malware initiated through email: 32%
- Identity and access attacks, including multifactor authentication (MFA) compromise: 31%
- Attacks from compromised employee accounts: 30%
- Shadow AI and AI-enabled insider risk: 29%
- Security measures failing to keep pace: 29%
Supplementing skills not headcount
Prospective MSP customers are not primarily looking to solve cyber risk by adding more staff.
Only 23% believe more head count would have the greatest impact on improving security. Instead, respondents place emphasis on visibility, AI-assisted detection and investigation, access to specialist expertise, more time for prevention activities, and stronger oversight of automation.
Key skills gaps cited by MSP prospects include:
AI-generated and highly targeted phishing: 42%
Identity-based attacks such as BEC, OAuth abuse, and MFA bypass: 36%
Securing and governing AI tools: 36%
Incident-response speed and decision-making: 32%
Translating technical risk into business impact: 32%
Cyber resilience gaps remain
Detection, investigation, and recovery are slower
Compared with the overall sample, MSP prospects are less likely to complete critical activities within one day compared to existing MSP customers:
- Detect suspicious email activity: 64% vs 71% using an MSP
- Investigate suspicious activity: 61% vs 68%
- Contain or respond to an attack: 62% vs 70%
- Secure compromised accounts and restore operations: 58% vs 66%
The weakest area is restoring operations after compromise. Only 29% of prospective MSP customers can secure accounts and restore operations within hours, and 9% take longer than a week or cannot do it consistently.
Security resilience remains less developed
MSP prospects rate their security resilience lower across every measure listed, with just under half admitting that capability is at an early stage or only partially established. MSP customers are significantly less likely to report low resilience.
What influences partner choice according to existing MSP customers
According to the MSP customers surveyed, when it comes to what they look for in an MSP, technical security capability remains a prerequisite, but the data also revealed several key criteria that are often overlooked.
Unsurprisingly, customers continue to prioritize security expertise. Almost all (95%) of the organizations say technical excellence is important, and the vast majority (84%) seek strong threat detection, protection, and response capabilities.
Many MSP customers are resource-constrained: 53% say they are expected to support new and expanding digital operations without additional resources, and 41% cite resource limitations as a contributing factor in successful email security threats and attacks.
More revealing is what customers value beyond technical capability.
Communication matters almost as much as technical expertise.
Among organizations already working with MSPs, 40% cite clear, plain-language explanations of risks, incidents, and next steps as a key selection factor. Overall, 78% value communication, trust, and relationship quality.
Increasingly, organizations want MSPs that can translate technical risk into business impact and help non-technical leaders make informed decisions.
They want partners who can explain what is happening, what it means, and what needs to happen next. This is especially important because cybersecurity decisions increasingly involve business leaders, not just IT teams.
Which of the following business factors matter the most when choosing an MSP to deliver or support your cybersecurity?
| Business factor | Organizations that outsource security to an MSP |
|---|---|
|
Clear, plain-language explanations of risks, incidents, and next steps
|
40%
|
|
Proven experience with companies in the same industry sector
|
39%
|
|
Strong understanding of our everyday business pressures
|
37%
|
|
People we can work with and build a relationship with
|
33%
|
|
Able to win the confidence of business leaders not just our tech teams
|
33%
|
|
Clear pricing and good value for money
|
33%
|
|
Proven experience with companies of a similar size
|
33%
|
|
Relevant expertise and business understanding*
|
80%
|
|
Communication, trust, and relationship quality**
|
78%
|
*Proven experience with companies of a similar size; Proven experience with companies in the same industry sector; Strong understanding of our everyday business pressures
**Clear, plain-language explanations of risks, incidents, and next steps; Able to win the confidence of business leaders not just our tech teams; People we can work with and build a relationship with
These results suggest organizations want MSPs who can act as translators between technical security teams and business decision-makers. Customers are also looking for providers with a genuine understanding of their industry, business environment, and operational pressures.
The MSP opportunity: The trusted cybersecurity partner
Taken together, the findings suggest an evolution in customer expectations. Historically, MSPs differentiated themselves through technology platforms, monitoring capabilities, and service delivery excellence. Those capabilities remain essential, but they are no longer enough on their own to drive differentiation and growth.
According to the survey, customers look to their MSP for:
- 24/7 detection and response
- Expertise in identity, email, and cloud security
- Guidance on AI adoption and governance
- Cyber resilience and recovery planning
- Executive-level reporting
- Clear communication and business context
- Strategic advice beyond day-to-day operations
Next steps
The MSP market is evolving from technology outsourcing to strategic cyber partnership. Organizations increasingly want providers that combine technical excellence with business understanding, cyber resilience expertise, and the ability to communicate risk clearly.
The MSPs best positioned for growth will be those that can protect the business, advise the leadership team, and help organizations navigate an increasingly AI-driven threat landscape. As AI adoption accelerates, opportunities are also emerging for MSPs to help customers securely govern AI use, maintain control of sensitive information, and reduce the risks associated with AI-enabled workflows.
