Security and compliance for MSPs: why your approach is running aground

Security and compliance for MSPs is the subject nobody can avoid any more, and at the same time the subject most MSP owners secretly hope the client will not go into too deeply. Because as soon as you ask the question seriously, you end up at choices that hurt: which expertise do you really have in house, what do you outsource, and when is a client actually safe?

At MSPs under 30 people you nearly always see the same pattern. The engineers are good generalists, every one of them. They know something about Endpoint Manager, something about Defender, something about Azure, something about Sentinel. They roll out configurations, they do their tickets, they keep it running. And then security is added on top. Usually through a tool that synchronises neatly, reports neatly, and gives a neat green tick.

The problem is not that the tool does not work. The problem is that there is nobody behind it who knows exactly what every setting does and what its impact is. Tenant hardening, configuration drift, forensic response after an incident, those are not things you do on the side alongside Exchange migrations and rolling out new laptops. And most end clients have no idea. They hear: “our MSP has bought this and that product”, and assume it is fine. While in practice the same generalist knowledge is now simply being rolled out at greater scale. Wrong faster, is what actually happens.

What really works in security and compliance for MSPs

What works in practice is an honest split between what you do yourself and what you deliberately place with a specialist. Not because you are too small, but because attracting real experts at SOC and MDR level is almost impossible for an MSP of 20 people. Those people want to work among their equals, and that pool is small. Anyone who denies that and tries to build their own operation pays three times: for people you cannot hold on to, for tooling you do not fully use, and for clients who get hit anyway.

The second thing that works is a principle you make hard internally: security is not a premium. No workplace at 30 euros that becomes “safe” for 45. No MFA as an upsell. No conditional access in the gold package. If you go down that road, you sell insecurity as the default, and that is a position you do not want to defend when it goes wrong. The MSPs that push this through and are transparent about it lose a few price-sensitive clients in the short term and win the conversations with directors who understand what is at stake.

The four failure points I keep seeing at MSPs

If you open up the average security setup at a mid-sized client, you see four recurring gaps. They rarely appear in the proposition, but they do decide whether a client survives an incident. And the odd thing is: these are not exotic problems. They are the basics everyone knows, but which in daily operations get pushed systematically to next week, next sprint, next quarter.

1. Generalist knowledge behind specialist tooling

An MDR platform or an XDR tool is no substitute for someone who knows what an alert means. Anyone who buys the tool without the knowledge pushes configurations into the environment faster than they can understand them. When it goes wrong, and at any scale it does at some point, you stand in front of the client with a dashboard full of green ticks and no story. What you need is someone who looks at a log at three in the morning and immediately sees whether it is noise or something to escalate. You do not build that knowledge with a certification and a quickstart training.

2. No forensic capacity for the moment after the hack

Most MSPs can detect and block perfectly well. But as soon as something really breaks through, that is where it starts. How do you deal with a ransomware group? How do you reconstruct how far they got? Which data was exfiltrated? That is an intervention team with forensic training, and almost no MSP has that in house. Acknowledge it, and arrange a fixed partner before you need one. Not afterwards, in a panic, on a Saturday evening, while your client has the press on the line and you still have to explain who manages which tape backup.

3. Policy that exists on paper and nowhere else

An information security policy, a media policy, an incident register, at many clients it sits neatly in a folder. But policy is a paper tiger if nothing happens with it. What does work is a PDCA rhythm in which every quarter you look back at what was written down, what was executed, and where it deviated. Awareness training you run once a year does little. People come back from holiday, click through their inbox, want to get through it quickly. That is where your risk sits, not in your firewall. What you see at clients who take it seriously: short, repeating prompts. A phishing simulation every month. A ten-minute team conversation after an incident at a company in the same sector. A dashboard where the board sees how many staff have finished the latest module. Small things, but things that change behaviour. Policy that lives, instead of policy that exists.

4. AI not set up as a threat or as a tool

AI changes the game on both sides. Attackers find and test vulnerabilities at scale. If your tenant hardening is not in order, it is not a question of whether, but when. At the same time, with AI you can read out the full threat exposure of a tenant within minutes, mapped onto CIS or the relevant national baseline. Anyone who does not deploy AI on the defending side simply loses on speed to whoever does. And internally your client staff are already using AI, whether you know it or not. Having no policy on that is the gamble you do not want to take.

What this means for your proposition

The MSPs that win on this over the coming years are not the ones claiming to do everything themselves. They are the MSPs that dare to say where their limit sits, that buy in specialist knowledge where it is needed, and that sell security as a base layer instead of as an upgrade. For some that is a painful shift in proposition and pricing. For the end client it is the only story still taken seriously at board level. And honestly: it makes your conversations easier too. You no longer have to defend why MFA costs extra, or why a backup test is not a line on a quote. You position yourself as the party with the basics in order, and build on top of that the conversations about risk, continuity and growth that clients really want to have.

The shift that is hardest: internal

The hardest part of this move is not the technology and not the choice of partner. It is internal. Engineers used to solving everything themselves for years have to accept that there are things they do not do. Account managers used to selling security as a margin product have to learn to position it as hygiene and find the margin somewhere else. And you, as owner or director, have to be able to tell a client: we do not do this ourselves, and we are transparent about that. That takes nerve. But it is the same move accountants made twenty years ago with specialist tax knowledge, and that law firms are making now with niche practices. Anyone who stays a generalist in a specialist market loses.

The conversation your competitor does not dare to have is exactly the conversation that sets you apart. Not with scaremongering, but with an honest assessment of what you can do yourself, what you outsource, and where your client is really vulnerable. Anyone who dares to have that conversation with the CISO, the IT manager and the director wins the clients who understand that continuity is not a premium. The rest keep fighting on workplace price, until it really goes wrong one day.