Dive Brief
-
Nearly every North American IT services provider sells cybersecurity, but fewer than half deploy key security controls across a majority of their customers, according to the Global Technology Industry Association’s Q3 2026 Cybersecurity Tracker, which surveyed 309 providers. GTIA found that 93% of firms offer cybersecurity as a core or complementary service. Yet only 42% deploy multifactor authentication (MFA) across all critical systems for more than half their customers.
-
The figures fall to 37% for managed detection and response and 35% for immutable, air-gapped backups. Even DNS filtering, the most widely deployed control measured, reaches a majority of customers at just 46% of providers. The findings suggest that MSPs are taking on more responsibility for customers’ security than their capabilities and practices can support.
-
The research also suggests the commercial consequences are already playing out. GTIA found that 87% of providers gained customers because they offered cybersecurity services, while 21% lost customers following a cybersecurity incident in the past year.
Dive Insight
The gap matters because customers increasingly judge MSPs on their security capabilities. GTIA VP of Research and Market Intelligence Carolyn April said customers are becoming more knowledgeable about cybersecurity and more demanding of their providers.
“They go to their providers asking more about cybersecurity, and they are looking for somebody who is good at it,” she told Channel Dive at GTIA ChannelCon EMEA in London on November 10.
Changing MSPs can be expensive and disruptive, but April said a serious cybersecurity incident can make customers more willing to switch.
“Somebody pays the price for that, and it typically will be the provider,” she said. April also pointed to a similar disconnect between widespread AI adoption and the maturity of providers’ internal practices.
While AI use is nearly universal among channel partners, GTIA’s 2026 State of the Channel research found only 20% have formalized it with policies and governance, and just 25% have the governance and commercial strategy to qualify as ‘AI driven.’
“You cannot do AI and have an AI practice and do it well unless you also have a concurrent cybersecurity practice that is just as sophisticated and just as up to speed as what you’re doing with AI,” April said.
The concern is that MSPs may rush to sell new services without first establishing the processes and expertise required to support them.
“Many go ahead and start selling AI solutions, and in year two or three, realize they’ve gotten ahead of their skis because we really didn’t have our own house in order,” she said.
April argued that providers need to move beyond basic adoption and establish stronger internal practices before taking more sophisticated offerings to customers.
“Until you do those steps internally, you are not in a good position to be taking these things to market for your customers,” she said.
