Fully 90 percent of MSPs have suffered a successful cyberattack in the last 18 months, and MSPs are leapfrogging end-customers as the primary target for malware, ransomware, phishing and hacker attacks, according to a Coleman Parkes Research report commissioned by N-able.
The report, State of the Market: The New Threat Landscape, reflects the responses of 500 participants—sourced from the U.S. and Europe by an independent research team—N-able noted.
MSPs Targeted By Cyberattacks: Research Findings
Among the key takeaways:
- 82% of MSPs have also seen attacks on their customers rise, though not quite at the same rate, with an average of 14 attacks prevented per month.
- While most MSPs offer two-factor authentication (2FA) to their customers, only 40% of MSPs have implemented it in-house. That's a particularly surprising stat, in MSSP Alert's opinion, since MSP software tools increasingly require 2FA as a default setting.
- DDoS and ransomware are among the main attacks MSPs are detecting, but the top attack remains phishing.
- Over half of MSPs say that financial loss and business disruption resulted after a cyberattack.
- Roughly 70 percent of SMEs plan to increase their security budgets.
- The research also connected the dots between automation, backup and N-able's data protection software services for MSPs.
In a prepared statement about the research, N-able Chief Security Officer Dave MacKinnon said:
“MSPs have worked tirelessly throughout the pandemic to ensure that the businesses they support can stay online and connected as circumstances changed. But the cybercriminals they're protecting against are working equally as hard to make use of these shifts against their targets. MSPs need to understand how the threat landscape continues to evolve and make the changes needed to protect both their customers and themselves, and make the most of the enormous opportunity that enhancing security provides.”
Repeated CISA, FBI Cyberattack Warnings to MSPs
The N-able research echos multiple FBI and CISA (Cybersecurity and Infrastructure Security Agency) warnings in recent years -- many of which have described how hackers are targeting MSPs.
The fallout of MSP-oriented cyberattacks can be massive. Indeed, a cyberattack on a single MSP or MSSP could wreak some $80 billion in economic losses across hundreds of small businesses, according to a 2021 report issued by Foundation for Defense of Democracies’ (FDD’s) Center on Cyber and Technology Innovation (CCTI) and Intangic.
Despite the findings above, MSSP Alert believes the MSP market has made considerable progress on the security front over the past two years or so.
MSP Cybersecurity: Anecdotal Signs of Progress
Indeed, most of the major MSP software providers now have CISOs and associated cybersecurity teams in place.
MSPs, in turn, have increasingly embraced cyber resilience -- the blending of data protection and security services -- to lock down their own businesses and to mitigate risk for end customers, MSSP Alert believes.
Moreover, MSPs have moved beyond basic anti-virus to introduce EDR (endpoint detection and response) as well as MDR (managed detection and response (MDR) services. Many of the MDR capabilities involve MSP partnerships with MSSPs and cybersecurity software companies that also offer incident response capabilities.
Of course, shiny security tools can't solve all security issues. To further strengthen their people and processes, many MSPs have embraced cybersecurity awareness training -- both internally and externally to end-customers.
