MSP Cybersecurity Statistics 2026: Attacks, Risk and Demand

MSP cybersecurity statistics for 2026 show an industry that attackers treat as a shortcut. One breached managed service provider can reach every client it manages. In CyberSmart's 2026 survey, 75% of UK and Irish MSP leaders said their business had been breached at least once in the past year. Huntress saw abuse of remote monitoring and management (RMM) tools rise 277%. The Kaseya VSA attack of July 2021 reached fewer than 1,500 downstream businesses through fewer than 60 MSP customers. And 71% of MSPs grew their security revenue. Here are the verified MSP statistics and what to test.

MSP statistics at a glance

Every figure below was checked on the publisher's own page, report or filing on 5 November 2026. Vendor research is labeled as such. Read the "What it measures" column before comparing two rows.

Primary sources for each row are linked in the sections below and listed under Sources and References.

Four kinds of evidence sit in this table, and they should not be blended:

• Government sources and incident statements (CISA, DOJ, Microsoft, Kaseya) describe specific events and are the most reliable counts.
• Representative surveys (the UK Cyber Security Breaches Survey) describe a whole population, but only the UK one.
• MSP vendor surveys and telemetry (Kaseya, ConnectWise, Sophos, CyberSmart, Huntress) are useful but reflect each vendor's customers or panel.
• Market sizes are analyst estimates.

None of these numbers adds up to a single "MSP breach rate."

What counts as an MSP

The Five Eyes joint advisory AA22-131A defines MSPs as "entities that deliver, operate, or manage ICT services and functions for their customers via a contractual arrangement". The advisory adds that MSP services "usually require both trusted network connectivity and privileged access to and from customer systems" (CISA, 11 May 2022).

The EU's NIS2 Directive uses a similar definition in Article 6(39). It treats a managed security service provider (MSSP) as an MSP that carries out or assists with cybersecurity risk management.

That privileged, persistent access is what makes MSP statistics a security topic rather than an IT services topic. MITRE ATT&CK tracks the abuse of this access as Trusted Relationship (T1199). In this technique, an attacker compromises a provider and then uses the provider's legitimate connection to reach the customer.

How big is the MSP market?

All market sizes in this section are estimates.

• Global. Omdia (formerly Canalys) estimated that IT managed services revenue delivered through channel partners would grow about 13% in 2025, to USD 595 billion worldwide. It expected about 341,000 partners to be delivering managed services by the end of that year. Its regional forecasts were around 15% growth in Asia-Pacific, 12% in EMEA and 10% in North America (Omdia executive summary, 15 January 2025).
• UK. Research for the UK Department for Science, Innovation and Technology (DSIT), published 12 November 2025, counted 12,867 active MSPs in the UK as of March 2025. They employed 343,762 people and generated an estimated GBP 51 billion in revenue and GBP 22.3 billion in gross value added. More than half (7,074) offered cloud services (GOV.UK, Research on managed service providers 2025).

Market reports sold by research resellers often quote far larger or smaller totals for "managed services." They use different definitions, such as including or excluding telecoms, vendor-delivered services or managed security. Treat any single market figure as a range, and check what it includes before comparing it with another.

How many businesses rely on an outside provider for security?

The best representative data comes from the UK government's Cyber Security Breaches Survey 2025/2026. It surveyed 2,112 UK businesses between August and December 2025 and was published on 30 April 2026:

• 48% of businesses had an external cyber security provider, a level broadly consistent with the previous four years.
• Outsourcing peaked among small (64%) and medium (70%) businesses, compared with micro (44%) and large (42%) businesses.
• The share of micro businesses with an external provider rose from 39% to 44% in a year.

(GOV.UK, Cyber Security Breaches Survey 2025/2026)

The same survey shows how rarely those businesses check the providers they rely on. Only 15% of businesses formally reviewed the cyber risks posed by their immediate suppliers, and 6% looked at their wider supply chain. The figures rise with size, to 30% of medium and 48% of large businesses reviewing immediate suppliers. In other words, about half of UK businesses hand security work to an outside provider, but most never assess that provider's own risk. For the attack and cost data on small companies themselves, see our small business cybersecurity statistics.

How often are MSPs breached?

Self-reported breaches

CyberSmart's 2026 MSP Survey, run with OnePoll among 350 MSP and MSSP leaders in the UK and Ireland, found:

• 75% said their business had suffered at least one breach in the previous 12 months.
• 54% reported two or more breaches, and 32% reported three or more.
• Repeat breaches eased from 2025, when 69% reported two or more and 47% three or more.

(CyberSmart MSP Survey 2026)

CyberSmart notes that "a breach" ranges from a minor incursion to a business-critical compromise. Read the 75% as a measure of how often something gets through, not of how often MSPs suffer major incidents. This is a vendor survey of one region.

What MSPs see among their clients

Kaseya's 2025 Global MSP Benchmark Report surveyed 841 MSPs in November 2024. It shows attacks becoming routine across MSP client bases:

• The share of MSPs saying fewer than 10% of their clients had experienced a cyberattack in the past year fell from 62% to 52%.
• MSPs reporting that 21% to 40% of clients were attacked rose from 11% to 19%.
• MSPs reporting that more than 40% of clients were attacked rose from 6% to 8%.

(Kaseya 2025 Global MSP Benchmark Report, PDF)

Kaseya is an MSP software vendor, so this is vendor research.

What threat telemetry shows

ConnectWise, which sells RMM and security software to MSPs, publishes an annual MSP Threat Report from its Cyber Research Unit. The 2025 edition found:

• More than 84,000 alerts since January 2024 targeted known vulnerabilities in edge devices from major firewall and VPN brands, and about 60% of the vulnerabilities in its sample were disclosed in 2024.
• Drive-by compromise was part of initial access in 22% of the incidents it reviewed in 2024.
• Citing "The State of SMB Cybersecurity in 2024," about 78% of MSPs surveyed worried that a serious attack could put them out of business, and about 83% planned to invest more in cybersecurity.

The 2026 edition, released on 5 March 2026, is mostly qualitative. Its defining finding is that attackers in 2025 relied on trusted identities, VPN access and legitimate tools rather than new exploits. In multiple cases, full domain compromise followed within hours of a successful VPN login. All ConnectWise figures are vendor research.

Why attackers target MSPs: one breach, many victims

The Five Eyes agencies warned in May 2022 that they expected malicious actors, including state-sponsored groups, to "step up their targeting of MSPs". In their words, "a vulnerable MSP" can serve "as an initial access vector to multiple victim networks, with globally cascading effects". The record before and since bears that out.

Sources for the table:

• The DOJ release describes how APT10 used MSP credentials to move between providers and their clients. A US Department of Energy statement adds that the group had been compromising MSP administrative credentials since at least 2014.
• The Texas DIR update did not name a provider. It followed the attack with specific guidance for systems "remotely administered" by an MSP.
• For Kaseya, the company's own incident overview gives the counts, and CISA's Kaseya guidance documents the joint CISA and FBI response that began on 2 July 2021.
• Microsoft's Nobelium post notes that the reseller attacks exploited no software flaw at all, only stolen credentials and privileged access.
• The ConnectWise bulletin and the NVD entry for CVE-2024-1709 cover ScreenConnect.
• CISA advisory AA25-163A describes the SimpleHelp campaign as part of a broader pattern of ransomware actors targeting unpatched SimpleHelp since January 2025.

Two patterns repeat. First, the multiplier is real. Using Kaseya's own upper bounds, roughly 25 downstream businesses were affected for every directly compromised customer (1,500 divided by 60; our calculation). Second, attackers rarely need anything exotic. Stolen administrator credentials, password spraying and unpatched remote access software account for most of the cases above. Our supply chain attack statistics cover the broader category. Verizon's 2026 DBIR puts third-party involvement at 48% of breaches, and that page analyzes the cost and case data in depth.

RMM and remote access: the most abused MSP tools

Remote monitoring and management software is how MSPs do their job, and that is why attackers want it:

• Huntress (vendor telemetry). The Huntress 2026 Cyber Threat Report, drawn from telemetry across more than 4 million endpoints and 230,000 organizations, found RMM abuse rose 277% year over year and accounted for 24% of all incidents it observed. Use of traditional hacking tools fell 53% over the same period.
• CISA, NSA and MS-ISAC. Their joint advisory AA23-025A (January 2023) documented criminals using portable versions of legitimate RMM software. A portable copy runs with ordinary user rights and needs no installation, so it can slip past controls that only audit installed software.
• The ScreenConnect and SimpleHelp cases above show the other side: flaws in the RMM platforms themselves. Each turns a single unpatched server into access to every endpoint it manages.

For MSPs, the lesson is that the RMM console, the PSA system and the remote access gateway are the highest-value assets they own. Once an attacker controls those systems, moving from one client environment to the next looks like ordinary administration. Our guide to lateral movement explains how attackers pivot after that first foothold and how to detect it.

MSPs and the supply chain

MSPs sit in the middle of their clients' supply chains, and they have suppliers of their own. CyberSmart's 2026 survey found:

• Two in five MSPs, or their customers, had a cyber incident caused by or originating from a supplier or third-party vendor in the past 12 months.
• Of those incidents, 39% affected only the customer, 16% only the MSP and 39% both, so 55% involved the MSP in some way.
• Only 45% of the leaders surveyed said their MSP monitors third-party risk continuously; the rest rely on periodic reviews.

For clients, the practical question is how to manage that dependency: contracts, access reviews and evidence of testing. Our guide to third-party risk management covers the program side. The third-party data breach statistics page tracks vendor-caused breach data across all supplier types.

Regulation now names MSPs

For most of their history, MSPs were not regulated as a category. That changed in Europe first.

• EU NIS2. NIS2 lists "managed service providers" and "managed security service providers" in Annex I, among sectors of high criticality. As a result, medium-sized and large MSPs operating in the EU fall within its cybersecurity risk management and incident reporting obligations.
• UK Cyber Security and Resilience Bill. The bill was introduced to Parliament on 12 November 2025. It brings "relevant managed service providers" (medium and large MSPs) into the UK's Network and Information Systems Regulations, with the Information Commission as regulator (GOV.UK factsheet). DSIT's research estimates that around 1,214 UK MSPs could be in scope, depending on the definitions used. That is about 9% of the 12,867 active UK MSPs (our calculation).

MSPs' own view of their exposure is very different. In CyberSmart's 2026 survey, 76% of respondents said their MSP falls into scope of the bill, and 45% of those said they were already fully prepared. The gap between about 9% of all UK MSPs and 76% of respondents probably reflects a panel weighted toward larger providers and uncertainty about the final definitions. It is also a warning: many MSPs that assume they are in scope have not yet seen the final criteria.

In the US, there is no MSP-specific statute, but federal guidance is explicit. AA22-131A recommends that MSPs and their customers:

• disable unused accounts
• enforce MFA on MSP accounts that access customer environments
• keep their most important logs for at least six months
• spell out security roles and responsibilities in contracts

What MSP clients now demand, including testing

The demand side is where MSP statistics turn into a business decision.

All rows are vendor surveys:

• Kaseya 2026 State of the MSP: 1,061 MSPs worldwide, surveyed in November 2025.
• Sophos 2026 MSP Perspectives: sample size not stated in the public summary.
• Sophos MSP Perspectives 2024: 350 MSPs in the US, UK, Germany and Australia, surveyed by Vanson Bourne in March 2024.

Three conclusions follow:

• Security pays, but it is crowded. Security revenue is growing at most MSPs, yet 71% of MSPs in the same Kaseya survey called acquiring new customers their biggest challenge, and AI and automation (48%) overtook security (42%) as the top client need. MSPs need a differentiated security offer, not another resold tool.
• Clients want evidence, not just tools. Sophos found that compliance influences 50% of customer purchasing decisions. Cyber insurance applications and compliance frameworks increasingly ask for proof that controls work. A penetration test report is one of the few artifacts that provides that proof.
• Skills are the constraint. Kaseya found that the share of MSPs struggling to hire skilled technicians rose from 9% to 16% in a year, and Sophos 2024 found 66% of MSPs deliver MDR through a third-party vendor. Most MSPs fill specialist gaps through partners, and manual penetration testing is a specialist skill.

No public dataset measures MSP demand for manual penetration testing directly. Kaseya groups "automated pentesting" with antivirus and email security, so its 72% overstates how many MSPs offer human-led testing. Treat the testing figures above as indicators of direction, not of market share.

Where MSP risk concentrates and what testing validates

The statistics point to a short list of systems where an MSP compromise starts or spreads. The table maps each one to the evidence above and to what a penetration test should validate. It is DeepStrike method guidance, not data from the cited studies.

The table is deliberately about access rather than malware. In almost every case above, the attacker used the same paths the MSP uses to do its work. That is why testing should cover the MSP's own environment as well as each client's. An internal penetration test shows how far an attacker can move once inside.

What the numbers mean: a 90-day MSP testing baseline

You cannot defend trusted access that you have never tested. This sequence lets an MSP, or a client reviewing its MSP, establish a baseline in about a quarter. It is DeepStrike method guidance, not a requirement from any standard.

1. Inventory privileged access (weeks 1–2). List every RMM, PSA, remote access and backup console, every admin account and every delegated permission into client tenants. Output: an access register with owners, plus a list of accounts to disable.
2. Close the advisory basics (weeks 2–4). Enforce MFA on all MSP accounts that touch client environments, keep important logs for at least six months, and patch RMM and remote access servers, in line with AA22-131A. Output: a dated gap list.
3. Test the external edge (weeks 4–6). Run an external penetration test of the MSP's internet-facing services, especially VPNs, remote access gateways and RMM web consoles. Output: validated findings, not a scanner export.
4. Test from a compromised technician's seat (weeks 6–8). Run an internal or assumed-breach test that starts from one technician account. Measure how far it reaches into client environments. Output: the real blast radius of one stolen login.
5. Test client-facing applications (weeks 8–10). Test portals, ticketing integrations and APIs that hold client data. Output: application findings with severity.
6. Retest and report (weeks 10–12). Retest fixed findings and turn the results into client-facing evidence for compliance and insurance questions. Output: a testing summary MSPs can share with clients.
7. Set the cadence. Repeat external and application testing at least annually and after major platform changes. Consider continuous testing for client-facing apps that change often.

For smaller clients, the same logic applies at lower scale. Our guide to penetration testing for startups and small businesses explains how to scope a first test on a limited budget.

How we compiled these MSP statistics

Selection. We included a statistic only if we could read it on the original publisher's page, report or filing and record its date, sample and method. We prioritized:

• government advisories and filings (CISA, NSA, FBI, NCSC-UK and partners, US DOJ, Texas DIR, NVD)
• official statistics (UK DSIT and the Cyber Security Breaches Survey)
• companies' own statements about their incidents (Kaseya, Microsoft, ConnectWise)

We then used MSP vendor surveys and telemetry with published scope (Kaseya, ConnectWise, Sophos, CyberSmart, Huntress) and labeled each as vendor research. Market sizes are labeled as estimates.

Exclusions. We excluded figures that appear only on vendor blogs or market-report resellers without a traceable study. We also excluded paywalled analyst forecasts we could not read (including Omdia's 2026 MSP report) and figures quoted second-hand from LinkedIn posts.

Report years. Report titles carry the publication year, not the year of the events. Kaseya's 2026 report surveyed MSPs in November 2025. The CSBS 2025/2026 ran fieldwork from August to December 2025. Huntress and ConnectWise 2026 describe activity in 2025.

Calculations. Two derived figures appear on this page:

• About 25 downstream businesses per directly compromised Kaseya customer: Kaseya's upper bounds, 1,500 divided by 60.
• About 9% of UK MSPs potentially in scope of the UK bill: 1,214 divided by 12,867.

All other numbers are quoted as published.

Limits. No source gives a representative global MSP breach rate, and none is claimed here. Vendor surveys reflect each vendor's panel or customers. UK government data covers the UK only. Incident counts reflect what each source knew when it published.

Frequently asked questions

How often are MSPs breached?

In CyberSmart's 2026 survey of 350 UK and Irish MSP leaders, 75% said their business was breached at least once in the past 12 months, and 54% were breached two or more times. These are self-reported breaches of any severity, so they include minor incidents. No representative global MSP breach rate exists.

Why do hackers target MSPs?

MSPs hold trusted, privileged access to many client networks at once. The Five Eyes advisory AA22-131A warns that one vulnerable MSP can be an initial access vector to multiple victim networks. In the Kaseya VSA attack of July 2021, fewer than 60 MSP customers were directly compromised, but fewer than 1,500 downstream businesses were affected.

What happened in the Kaseya ransomware attack?

On 2 July 2021, REvil affiliates exploited zero-day vulnerabilities in Kaseya's on-premises VSA remote management product. They used it to push ransomware to endpoints managed by Kaseya's MSP customers. Kaseya reported fewer than 60 directly compromised customers and fewer than 1,500 affected downstream businesses. CISA and the FBI coordinated the US response, and Kaseya released a patch on 11 July 2021.

How big is the MSP market?

Omdia (Canalys) estimated that channel IT managed services revenue would reach about USD 595 billion worldwide in 2025, up about 13%, delivered by about 341,000 partners. In the UK, government research counted 12,867 active MSPs generating an estimated GBP 51 billion in revenue as of March 2025. Both are estimates.

What percentage of businesses use an MSP for security?

In the UK, 48% of businesses had an external cyber security provider in the Cyber Security Breaches Survey 2025/2026. That includes 64% of small and 70% of medium businesses. Comparable representative US data is not published.

Are MSPs regulated?

Increasingly, yes. The EU's NIS2 Directive lists managed service providers and managed security service providers as a sector of high criticality. The UK's Cyber Security and Resilience Bill, introduced in November 2025, would bring medium and large MSPs under the NIS Regulations. The US has no MSP-specific statute, but CISA and partner agencies publish detailed guidance.

Do MSPs offer penetration testing?

Many offer some form of security testing, but few have in-house penetration testers. Kaseya's 2026 survey found 72% of MSPs offer security services, a category that includes automated pentesting alongside antivirus and email security. The skills shortage pushes most MSPs to partner for specialist services. White label and resale partnerships let an MSP deliver human-led penetration testing under its own brand.

Next steps

The numbers agree on three things. MSPs are a preferred target because one breach reaches many clients. The paths attackers use are the same RMM, remote access and admin accounts MSPs rely on every day. And clients increasingly expect their MSP to prove security, not just provide tools.

For MSPs, MSSPs and VARs that want to offer that proof without building a testing team, DeepStrike's MSP partnership program offers three models:

• Affiliate: referral commissions.
• Reseller: co-branded materials and full technical support.
• White label penetration testing: you deliver under your own brand while our testers handle the technical execution.

Partners get dedicated partner support, training and a platform with client reporting. If you want to add human-led penetration testing to your service catalog, apply to become a DeepStrike partner.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• CISA, NSA, FBI, NCSC-UK, ACSC, CCCS and NCSC-NZ, AA22-131A "Protecting Against Cyber Threats to Managed Service Providers and their Customers" (11 May 2022): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a
• CISA, "Kaseya Ransomware Attack: Guidance for Affected MSPs and their Customers" (12 July 2021): https://www.cisa.gov/news-events/news/kaseya-ransomware-attack-guidance-affected-msps-and-their-customers
• Kaseya, "Incident Overview & Technical Details" (July 2021): https://helpdesk.kaseya.com/hc/en-gb/articles/4403584098961-Incident-Overview-Technical-Details
• US Attorney's Office SDNY, APT10 indictment release (20 December 2018): https://www.justice.gov/usao-sdny/page/file/1122721/dl
• US Department of Energy, statement on Chinese hacking of global managed service providers (20 December 2018): https://www.energy.gov/articles/department-energy-statement-chinese-hacking-global-managed-service-providers
• Microsoft, "New activity from Russian actor Nobelium" (24 October 2021): https://blogs.microsoft.com/on-the-issues/2021/10/24/new-activity-from-russian-actor-nobelium/
• Texas Department of Information Resources, "Update on Texas Local Government Ransomware Attack" (5 September 2019): https://dir.texas.gov/news/update-texas-local-government-ransomware-attack
• ConnectWise, ScreenConnect 23.9.8 security bulletin (19 February 2024): https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
• NIST NVD, CVE-2024-1709: https://nvd.nist.gov/vuln/detail/CVE-2024-1709
• CISA, AA25-163A, SimpleHelp RMM (12 June 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a
• CISA, NSA and MS-ISAC, AA23-025A, malicious use of RMM software (January 2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a
• MITRE ATT&CK, Trusted Relationship (T1199): https://attack.mitre.org/techniques/T1199/
• European Union, Directive (EU) 2022/2555 (NIS2): https://eur-lex.europa.eu/eli/dir/2022/2555/oj
• UK DSIT, Research on managed service providers 2025 (12 November 2025): https://www.gov.uk/government/publications/research-on-managed-service-providers-2025
• UK Government, Cyber Security and Resilience Bill factsheet, relevant managed service providers: https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/relevant-managed-service-providers
• UK DSIT and Home Office, Cyber Security Breaches Survey 2025/2026 (30 April 2026): https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
• Verizon, 2026 Data Breach Investigations Report, executive summary: https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
• Omdia (Canalys), MSP trends and predictions 2025, executive summary (15 January 2025): https://omdia.tech.informa.com/blogs/2025/jan/msp-trends-and-predictions-2025---executive-summary
• Kaseya, 2026 State of the MSP Report (14 April 2026): https://www.kaseya.com/assets/downloads/resources/Kaseya_2026-State-of-the-MSP_report_2026.pdf
• Kaseya, 2025 Global MSP Benchmark Report: https://www.kaseya.com/assets/downloads/resources/Kaseya-2025-global-msp-benchmark-report.pdf
• ConnectWise, 2025 MSP Threat Report (25 February 2025): https://www.connectwise.com/globalassets/media/asset-docs/ebook/2025-msp-threat-report.pdf
• ConnectWise, 2026 MSP Threat Report release (5 March 2026): https://www.connectwise.com/company/press/releases/connectwise-2026-msp-threat-report
• Huntress, 2026 Cyber Threat Report release (17 February 2026): https://www.huntress.com/press-release/huntress-cyber-threat-report-exposes-the-playbook-for-organized-cybercrime
• Sophos, MSP Perspectives 2026 (15 September 2026): https://www.sophos.com/en-us/blog/the-evolution-of-the-msp-cybersecurity-value-proposition
• Sophos, MSP Perspectives 2024 release (29 May 2024): https://www.sophos.com/en-us/press/press-releases/2024/05/cybersecurity-skills-shortage-ranked-biggest-risk-msps-and-their
• CyberSmart, MSP Survey 2026: https://cybersmart.co.uk/msp-cybersecurity-report-2026/