Key Takeaway: Competent MSP cybersecurity is not a stack of tools. It is a set of practices that the tools support. An MSP can have every product on the market and still leave clients exposed if nobody is reviewing the alerts, the backup has never been tested, and the firewall rules have not been audited since onboarding.
MSP cybersecurity is not a product category. It is an operational discipline. The ongoing practice of identifying risk, reducing exposure, and responding to incidents in a way that protects clients and demonstrates the competence they are paying for. Most MSPs sell cybersecurity. Fewer deliver it as a discipline.
The threat landscape has changed faster than most MSP security stacks have. IBM’s 2024 Cost of a Data Breach Report puts the average breach cost at $4.88 million, a ten percent increase over the prior year. AI-powered attack tools have lowered the skill floor for attackers while raising the stakes for defenders. Ransomware crews now target backup repositories in 96% of attacks, according to Veeam’s 2024 Ransomware Trends Report. The old defenses are not enough.
This hub collects everything Rewired MSP has published on cybersecurity. If you are an MSP owner building a security practice, or a business owner evaluating whether your IT provider is actually protecting you, this is where you start.
What Competent MSP Cybersecurity Actually Looks Like
Competent cybersecurity is not a stack of tools. It is a set of practices that the tools support. An MSP can have every product on the market and still leave clients exposed if the practices are not in place: if nobody is reviewing the alerts, if the backup has never been tested, if the firewall rules have not been audited since the client was onboarded.
The baseline for a competent MSP security practice in 2026 includes active monitoring with human review of alerts, not just automated responses; MFA enforced across all accounts, not just email; DNS filtering to block malicious domains before they reach the endpoint; endpoint detection and response rather than signature-based antivirus; verified backup with tested restore procedures; and a documented incident response plan that the team has actually practiced.
That is the floor. Clients who are paying for managed security and not receiving all of those elements are not getting what they paid for.
The Monitoring Trap: Why More Alerts Is Not More Security
The RMM tool is the backbone of most MSP operations. It is also one of the most misunderstood security tools in the stack. MSPs that configure their RMM to generate maximum alerts believe they are being thorough. What they are actually doing is creating alert fatigue, a condition where technicians stop paying attention to alerts because there are too many of them to meaningfully review.
Alert fatigue is not a minor inefficiency. It is a security failure. When technicians are conditioned to dismiss alerts, the one alert that matters gets dismissed along with the noise. The monitoring trap is not that MSPs monitor too little. It is that they monitor in a way that produces volume without signal.
The fix is not fewer tools. It is better configuration: tuning alerts to surface what matters, suppressing what does not, and building a review process that ensures the alerts that fire are actually reviewed by a human who can act on them.
Backup Is Not Business Continuity
Every MSP sells backup. Very few sell business continuity, and fewer still deliver it. The distinction matters enormously when something goes wrong.
Backup is the practice of copying data to a secondary location. Business continuity is the practice of ensuring that a business can keep operating, or resume operating quickly, after a disruption. Backup is a component of business continuity. It is not a substitute for it.
The gap shows up in the restore. An MSP that has never tested a restore from backup does not know whether the backup works. They know whether the backup job completed. Those are not the same thing. Ransomware crews know this. They target backup repositories specifically because they know that many MSPs have never verified that their backups can actually be restored under pressure.
The standard is simple: if you cannot demonstrate a successful restore, you do not have a backup. You have a backup job. Test the restore. Document the test. Show the client the results. That is business continuity.
Cyber Insurance: What It Requires in 2026
Cyber insurance has changed. The policies written in 2019 and 2020 are gone. The policies available in 2026 require documented security controls, and carriers are denying claims when those controls were not in place at the time of the incident.
The controls that carriers now require as a condition of coverage include MFA on all remote access and privileged accounts, endpoint detection and response, verified backup with tested restore, security awareness training with documented completion, and a written incident response plan. MSPs that cannot demonstrate these controls on behalf of their clients are not just leaving clients exposed to attacks. They are leaving clients exposed to denied insurance claims after attacks.
The MSP attestation letter, a document in which the MSP certifies the security posture of a client’s environment to the insurance carrier, is becoming a standard part of the renewal process. MSPs that cannot sign that letter honestly should not be signing it at all.
AI-Powered Attacks: What Changed and What It Means
The threat landscape shifted in 2023 and has not shifted back. AI tools lowered the skill floor for attackers in three specific ways: they made phishing emails grammatically correct and contextually convincing, they automated the reconnaissance phase of attacks, and they enabled the creation of malware variants that evade signature-based detection.
The implication for MSPs is not that the tools need to change, though some do. It is that the human layer of security needs to be stronger. Phishing emails that look legitimate require users who are trained to be skeptical, not just users who have completed an annual awareness module. Attacks that evade signature detection require behavioral monitoring, not just antivirus. The security stack that was adequate in 2021 is not adequate in 2026.
The Burnout-Security Connection
There is a security risk that almost nobody in the MSP industry talks about: exhausted technicians make security mistakes. They miss alerts. They skip steps in the incident response checklist. They approve access requests without verifying them. They take shortcuts in the patch cycle because they are behind on everything else.
Burnout is not a human resources problem. It is an operational risk. MSPs that run their teams at maximum capacity with no margin for error are not just risking turnover. They are risking the security of every client those technicians support.
What Business Owners Should Ask Their MSP
If you are a business owner evaluating whether your IT provider is actually protecting you, these are the questions that matter. Not “do you have antivirus?” Every MSP has antivirus. The questions that reveal operational maturity are harder.
When did you last test a restore from our backup? What is our incident response plan, and can I see it? How do you handle alerts from our environment, who reviews them, and how often? What would our cyber insurance carrier need to see to confirm our coverage? If a ransomware attack started right now, what would happen in the first hour?
An MSP that cannot answer those questions clearly and specifically is not delivering competent security. They are delivering the appearance of security, which is a different and more dangerous thing.
Frequently Asked Questions
What is the difference between antivirus and EDR?
Antivirus uses signatures, known patterns of malicious code, to detect threats. It cannot detect threats it has not seen before. Endpoint detection and response monitors behavior and flags anomalies that may indicate an attack even if the specific malware is new. In 2026, antivirus alone is not sufficient for business-grade security.
How often should backups be tested?
At minimum, quarterly for a full restore test and monthly for a partial restore verification. The specific frequency should be documented in the client’s service agreement and the results should be reported to the client. A backup that has never been tested is not a backup. It is an assumption.
What does cyber insurance actually cover?
Modern cyber insurance policies cover incident response costs, legal fees, regulatory fines, notification costs, and business interruption losses, subject to the security controls being in place at the time of the incident. The key question is not what the policy covers in theory, but what the carrier will require you to prove when you file a claim.
Is MFA enough to prevent a breach?
MFA significantly reduces the risk of credential-based attacks, which account for a large percentage of breaches. It is not sufficient on its own. MFA can be bypassed through SIM swapping, MFA fatigue attacks, and social engineering. It is a necessary control, not a complete defense.
About Brent Lacy: Brent Lacy is a technology advisor and the voice behind Rewired MSP. He helps MSPs operate with greater maturity and helps business owners make IT choices that make them more secure and more efficient. He is the author of Rewired MSP: Mastery, Scalability & Performance, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security.
Everything Rewired MSP Has Published on Cybersecurity
- Backup Is Not Business Continuity: What Every Business Owner Must Know
- The Restore Nobody Tested: Why Backup Restore Testing Is the Only Thing That Saves You
- The Monitoring Trap: Why Your MSP’s RMM Tool Is Making You Less Secure
- Antivirus Alone Is Not Stopping the Threats Coming for Your Business
- MFA and Digital Identity: What Your IT Provider Should Be Doing
- Is Your IT Provider Actually Watching Your Firewall?
- The Denied Claim: What Business Owners Are Learning Too Late About Cyber Insurance
- The Attestation Letter Your MSP Should Be Willing to Sign
- The Attackers Got Cheaper: What AI-Powered Attacks Mean for Every Business Owner
- The Overnight Update That Broke Your Business: Vendor Software Update Risk After CrowdStrike
- Is Your IT Provider Putting You at Risk? 11 Warning Signs
- The Burnout-Security Connection: Why Exhausted Technicians Put Clients at Risk
- Shadow AI: What Unapproved Tools Cost Your Business
