The capability gap
39% of MSPs cite keeping up with cybersecurity as their biggest day-to-day challenge[2], even as 81% of organisations rate it a high priority[1]. The gap matters: when breaches hit, the cost averages US$4.44 million globally and takes 241 days to identify and contain[3].
33% of organisations do not have the budget to adequately staff their security teams[5]. The MSP is supposed to fill that gap, but if the MSP itself is struggling, the gap just gets relocated, not closed.
What MSPs commonly oversell
- EDR/XDR coverage, labelled as deployed, but exclusions and offline endpoints not disclosed
- Patching SLAs, quoted in days, but critical-asset segmentation not in scope
- Identity hygiene, privileged access reviews quoted quarterly, executed annually if at all
- Backup verification, tested for restoration on production-similar systems, not just file-existence checks
- Incident response, quoted but never tabletop-tested against a realistic scenario
- "Enterprise-grade security", used freely, despite only 61% of MSPs maintaining ISO 27001 or SOC 2
What independent validation looks like
Independent validation is not a penetration test (which tests controls that you assume exist). It is the verification that controls exist in the first place, function as described, and are being maintained as the contract requires. From direct operational experience inside MSPs, the gap between contracted and delivered security is rarely small[4].