MSPs: When Did You Become the Client’s CISO?

Published 13 October 2026

A client calls because an employee clicked something alarming. You contain the problem, explain what happened and recommend a policy or process change to prevent it from happening again.

Then the client asks whether their cyber insurance will still cover the business. Since you’re already looking into it, could you please review their access controls, prepare a security report for the board and confirm that everything meets the relevant compliance requirements?

The role simply crept up on you, one perfectly reasonable question at a time.

Somewhere between resetting a password and reassuring the managing director, you quietly became the client’s Chief Information Security Officer (CISO).

There was no formal request. Nobody sat down to negotiate your new responsibilities or what they should cost. The role simply crept up on you, one perfectly reasonable question at a time.

In a Sophos-commissioned survey conducted by UK-based market research firm Vanson Bourne, 800 senior leaders at managed service providers (MSPs) across seven countries estimated that:

46% of their customers already rely on them to act as their CISO.
84% expect the demand for CISO-level services to grow during the next 12 months.

Read those two figures together and a striking picture emerges. Almost half of MSP customers already expect CISO-level help and the demand is still growing.

That presents MSPs with a substantial business opportunity. It could also leave them carrying responsibilities that their existing support agreements don’t clearly define.

How Technical Support Became Security Leadership

For the customer, the expansion makes sense. Many small and mid-sized organizations can’t justify employing a full-time CISO. Even larger businesses may struggle to recruit a CISO or need specialist help across several frameworks, platforms and threats.

From the client’s perspective, their MSP is already there, understands the environment, manages important systems and is often the first call when something goes wrong. Trust develops through hundreds of small interactions. Eventually, “Can you configure this?” becomes “What should we do?”

One asks you to carry out a task. The other asks you to guide the client’s cybersecurity risk management, establish priorities and help determine what happens next. That’s leadership work, whether anyone has formally assigned the title or not.

The client may expect CISO-level accountability without giving the MSP the authority to make CISO-level decisions.

You may begin by managing endpoint protection and backups. Before long, you’re interpreting insurance questionnaires, advising on regulatory obligations, evaluating third parties, briefing executives and creating incident response plans. By then, the relationship has fundamentally changed. The MSP is no longer just keeping systems running. It’s influencing how the client understands, reduces and reports business risk.

As the MSP’s influence grows, the relationship needs clearer boundaries. Otherwise, the client may expect CISO-level accountability without giving the MSP the authority to make CISO-level decisions.

Responsibility Without Authority Is a Bad Bargain

A CISO normally has access to senior leadership and at least some power to enforce policy. An MSP acting as an informal CISO may have neither.

You can recommend multifactor authentication, tighter permissions or a tested recovery plan. The client can delay the work, reject the expense or make an exception for an executive who finds the controls inconvenient. If an incident follows, memories may become remarkably selective about who approved what.

This is where the informal arrangement becomes risky. The boundary between advice and accountability must be visible. Who owns the risk? Who approves exceptions? Who supplies the evidence? Which recommendations are mandatory and which are merely encouraged? What happens when the client declines one?

“We’ve always sort of handled that” isn’t good enough from either party.

An MSP shouldn’t promise outcomes it lacks the authority to produce. Nor should a customer assume that buying managed technology transfers every legal, regulatory and operational responsibility to the provider. Good security depends on both sides understanding exactly what they own.

That division belongs in contracts, service descriptions, reports and meeting records. A rejected recommendation shouldn’t disappear into an old email thread. Neither should an accepted risk or an action that’s been overdue for months.

From-Tech-Support-to-Security-Leadership-1

The technical toolkit may be familiar. The responsibility is another matter.

Compliance Is Already Part of the Job

The survey also found that 99% of MSPs provide at least one cybersecurity compliance service. Yet only 33% said they were completely confident in their ability to monitor, manage and document compliance continuously across multiple customers.

Compliance isn’t a handsome binder that gets dusted off once a year.

That’s one of the survey’s most revealing findings.

An annual audit has a deadline and a defined set of requirements. Continuous compliance keeps moving as systems, users and regulations change. Compliance isn’t a handsome binder that gets dusted off once a year. It’s an ongoing record of what controls exist, whether they’re working and what still needs attention.

The job becomes harder when the evidence is scattered. Fifty-three percent of MSP respondents use multiple platforms to deliver compliance or CISO-type services. Security posture lives in one system, policies in another, tickets somewhere else and reports in a collection of documents that somebody promises to organize when things calm down.

And for an MSP, things rarely stay calm for long.

MSPs estimated that a unified platform could save 53% of the time they spend on security posture, compliance management and reporting. I wouldn’t treat that figure as a stopwatch reading, but the underlying problem will be familiar to almost any MSP. Skilled people lose hours gathering information before they can apply their judgment to it.

Tool consolidation may help, along with standardized assessments, repeatable reporting, clearly assigned actions and a defined review schedule. That leaves skilled people with more time to interpret the evidence, advise clients and decide what needs to happen next.

Price the Responsibility, Not Just the Tools

If clients already treat you as their CISO, continuing to provide strategic leadership as an unofficial favor makes little sense. The work needs a name, a defined scope and a price.

A formal service might include regular risk assessments, a documented security roadmap, compliance oversight, executive reporting, policy reviews and incident planning. Its scope should clearly state what the MSP will do, what the customer must do and how decisions will be recorded.

Pricing should reflect the responsibility and expertise involved. Charging only for licenses, devices or support hours hides the value of preventing bad decisions. Worse, it teaches the customer to regard strategic advice as free commentary attached to the “real” technical work.

I think MSPs sometimes undersell this work. After all, how do you invoice a client for a problem that was successfully avoided? Yet helping a client avoid an expensive security mistake may be far more valuable than fixing a malfunctioning device.

A structured service gives the MSP a way to demonstrate progress against an agreed plan, while the client gets clearer expectations and better evidence. If something does go wrong, both parties have a defensible record of the decisions that led up to it.

Formalizing the service also creates room for honest limits. No MSP needs to be an expert in every regulation or accept every risk. The agreement can define when legal counsel, an auditor or another specialist needs to take over. Recognizing that point is part of mature leadership.

I think MSPs sometimes undersell this work.

Make the Accidental Promotion Official

Technology companies describe themselves as “trusted advisors” so frequently that the phrase has lost much of its meaning. In this case, though, clients behave as if they mean it. They’re asking MSPs to interpret risk, guide investment and help protect the business itself.

Clients are relying on their MSP for much more than routine technical support, so the relationship needs to be defined accordingly.

The MSP can give the advice, but the client still holds the authority to act.

MSPs should review what they’re already doing for each customer and identify the work that has drifted beyond the contracted scope. Some of it may belong in a formal CISO-level offering or a broader managed security services package, with appropriate authority, documentation, staffing and pricing.

Reviewing the services you already provide may uncover opportunities beyond cybersecurity. Data migration is one example. Customers may expect an MSP to move their files without realizing that thousands of links inside those files could stop working after the move.

Through the LinkTek Partner Program, MSPs can add link protection and repair to their migration services. That can reduce link-related disruption, support larger projects, generate additional revenue and help earn referrals.

Your clients may already regard you as their CISO. If they do, it’s time to make sure your agreements, processes and fees have caught up.

By Ed Clark