security en compliance MSP
Security and compliance: does the MSP need a new approach?
Security and compliance call for an approach in which tenant hardening, specialist SOC partners and the duty of care come together. MSPs that want to do everything themselves run aground on scarce experts, price pressure below 200 seats and NIS2 responsibility along the chain.
MSP Late Night · 6 August 2026
Why does the old MSP approach to security no longer work?
The average MSP team has 10 to 15 people and cannot cover the depth of Defender, Sentinel, Entra ID and forensic investigation with generalists. Below 200 seats, building a full SOC of your own is not profitable. The way out sits in tenant hardening as the basis, collaboration with MDR and intervention partners, and the honest conversation that not every MSP has to do everything itself.
Tenant hardening or separate tools?
Security starts with a correctly configured Microsoft tenant, not with extra tooling. A forgotten tick box in Defender or Entra ID can be the difference between a small incident and a data leak.
Your own SOC or outsourcing?
24/7 monitoring, MDR and forensic investigation ask for hyperfocus and are rarely profitable below 200 seats. Working with specialist partners is more realistic than building your own SOC.
Is NIS2 a burden or a mandate?
NIS2 anchors the duty of care and board liability, along the chain as well. For MSPs it is the mandate to finally enforce security policy, incident registration and dry runs with clients.
You get the MSP you deserve.
Frequently asked questions
When is an own SOC profitable for an MSP?
An own SOC requires 24/7 staffing, certified analysts and forensic capacity. For MSPs below 200 seats per client or with fewer than a few dozen security specialists, that is nearly never profitable. A common model is outsourcing MDR to a specialist partner, with a split between ongoing detection and pay-per-use intervention in an incident, while the MSP stays responsible for tenant hardening and baseline management.
What does the duty of care under NIS2 mean for an MSP?
Under NIS2, MSPs fall under the directive themselves, and through the chain smaller clients are indirectly affected as well. The duty of care means an MSP has to be able to demonstrate which measures were taken, register and report incidents, and that directors are personally answerable. Policy on paper is not enough: dry runs, a PDCA cycle and demonstrable execution are part of compliance.
Is security awareness training still worthwhile?
Awareness training never brings the risk to zero, but identity remains the most important attack vector through phishing and business email compromise. A defensible approach combines technology (hardening, MFA, conditional access, configuration drift management) with recurring training and phishing simulations. The emphasis belongs on technology, with awareness as an additional layer for new staff and behavioural patterns.
Why is a Microsoft tenant not secure by default?
Microsoft delivers software at enormous scale with an opt-in philosophy: capabilities are ready in licences such as E5, but many controls have to be configured explicitly. Switching everything on by default would break existing environments. That is why tenant hardening is an active task for the MSP, in which baseline, least privilege, conditional access and Defender configuration are deliberately set up per client.
How does AI relate to security at MSP clients?
AI lowers the threshold for attackers to find vulnerabilities at scale and at the same time raises the risk of shadow AI, where staff put company data into external models. For MSPs that means data governance and labelling have to come before implementations of Copilot or comparable tools. Without hardening and data structure, AI adoption becomes an accelerator of existing risks.