Why Security Work is Now Free for MSPs: Automation and Commoditization — Business of Tech: Daily MSP News & IT Services Analysis

The dominant structural shift in the cybersecurity market is the relocation of value from security work to financial consequence management, driven by insurers moving directly into the managed services space. A cyber insurer's analysis of 100,000 policyholders revealed that those under constant security monitoring file 70% fewer claims. This data allows carriers to identify effective controls, leading them to offer bundled security services directly to clients and MSPs, as exemplified by Coalition's offerings for managed service providers.

This shift is underscored by the commoditization of specialized security tasks. Capital One released Vulnhunter as open-source, an AI tool that finds exploitable software flaws, a function previously requiring dedicated specialists. Similarly, Deloitte is industrializing vulnerability remediation using AI, and Blackpoint Cyber deploys autonomous agents for rapid threat detection and containment. These developments signify that the "doing" of security is becoming automated and cost-effective, while the ultimate financial responsibility remains with those who bear the risk.

Supporting this core shift, breaches are increasingly originating through third-party vendors, impacting numerous downstream organizations without direct attacker interaction. A software provider serving over 2,000 US hospitals experienced a breach that exposed data for thousands of its clients. This highlights how vendor security failures create cascading impacts, reinforcing the insurer's position as the party ultimately on the hook for losses and incentivizing them to directly manage or provide the preventative security.

For MSPs and IT service providers, this dynamic presents a clear operational imperative. The "insurability floor"—the baseline security controls required by carriers—is rising and being set by insurers, not vendors or clients. MSPs must integrate these evolving carrier requirements into their standard operating procedures to ensure their clients remain insurable. Failure to do so risks making clients ineligible for coverage, creating liability for the MSP, and potentially leading to being bypassed by insurers who are bundling services directly. The value for MSPs now lies in operationalizing this rising floor consistently for all clients, rather than merely providing a static security stack.

00:00 They're Selling the Protection Now

03:24 Why "Secure" Stopped Being Yours

05:57 The Floor Keeps Rising

08:44 Why Do We Care?

Supported by:

Guardz
ScalePad

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

💼 All Our Sponsors

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · HaloPSA · LogMeIn · Mailprotector · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.