Security: as an MSP, don’t leave opportunities on the table

Published on October 16, 2026

For a long time, security was something an MSP did on the side. An extra service on top of workplace management, or simply part of the overall package. But those days are over.

A working IT environment is a given for customers. What they now expect from their MSP is active involvement in preventing and limiting cyber risks. That also has to do with NIS2: organizations covered by it must manage the risks in their supply chain. Sometimes an MSP falls under this legislation too. That’s why clear agreements are needed on responsibilities and security measures, and those agreements also need to align with the terms of the customer’s cyber insurance. Yet at Worldstream, we see that many MSPs deliver a large share of their security advice and work without making it visible or charging for it. That’s where they leave opportunities on the table.

In the past, an MSP delivered workplace management and infrastructure. At some point, security was added, as a separate service or an extra option. Now security is the starting point.

Security by design means that security has already been considered before the infrastructure is delivered. It’s not a layer you add on top afterward. It’s part of the service from the very first design. After all, thinking ahead beats fixing things after the fact.

Before I joined Worldstream, I worked at an MSP. We didn’t just handle security at the workplace level. We sat down with our customers’ executive team and CISO and helped them think through network segmentation, access management and incident response. Nobody called it a service. It was simply part of the job.

I still remember a conversation with a CISO who had to map out for his executive team where they stood on NIS2. Together we went through the measures, from logging and monitoring to vendor management. We had already put a large part of them in place. But he didn’t know that, because it wasn’t explicitly mentioned anywhere. And he had a point: the invoice listed licenses and management hours, but the advice, the design sessions and the conversations with him were missing. That’s when it hit me: if you don’t show what you do, it doesn’t exist for the customer. That’s a missed opportunity, especially since customers are setting more and more security requirements.

What I see more and more often now is MSPs turning that around. They make what they do on top visible in the contract, for example “30 hours of security consulting included,” and can offer it separately at renewal. That way it isn’t a sudden price increase, but something the customer already knows the value of. I made the same point in my blog on AI adoption: name your advisory hours and sell them.

Customers used to have one simple requirement: it just has to work. Now they expect proactivity and assume you’re the expert. You can read how customer expectations have shifted, from “it just has to work” to proactivity and an advisory role, in my earlier blog on the five MSP challenges. With security, there’s something extra. Customers no longer only ask whether everything is available, but also whether you can stop them from getting hacked. That calls for solid management of day-to-day operations, looking ahead and building roadmaps together.

That shift makes the service more valuable, but also more expensive. That isn’t always easy to explain to customers who are used to everything being included. Yet right now, they need a good MSP more than ever. All the more reason to make visible what you already do.

One area that’s often underestimated is cyber insurance. Insurers set requirements for MFA and backups. But who makes sure these measures are in place and tested? That needs to be clear in the agreements between the MSP and the customer.

This is where things regularly go wrong. I recently spoke with an MSP that helped a customer after a ransomware attack. Afterward, it turned out to be unclear who was responsible for MFA on admin accounts and for testing the backups. The SLA did mention “backup management” and “workplace security,” but not who was supposed to carry out and check these measures. That can lead to disputes. My advice: document responsibilities explicitly and check together with the customer whether the agreements match the cyber insurer’s requirements.

With the new regulations, the focus is no longer only on the MSP, but on the entire chain it operates in. At its core, that chain consists of three parties: the MSP, the infrastructure partner and the customer.

We notice this ourselves too. As an infrastructure partner, we face increasingly strict requirements for security, compliance and demonstrable management controls. Certifications, clear processes and careful employee screening are becoming more and more important. The bar is higher for everyone in the chain.

So what can you, as an MSP, expect from your infrastructure partner? Not just a certificate, but a partner that helps you think things through. Someone who is involved from the design stage: where is the data stored, how do you separate environments, how do you set up backup and recovery? And a party that’s honest about what does and doesn’t fit your customer’s requirements. At Worldstream, the security officer and your account manager help you think through those choices. That way, you build security in from the start, instead of fixing it afterward.

Security is no longer an “add-on,” but the foundation of good MSP services. That makes the opportunity many MSPs miss actually quite simple: think about security up front, make visible what you already do and choose an infrastructure partner that helps you think things through.

This article is the fourth part of a series in which Worldstream discusses current topics in the MSP market in the run-up to MSP Global.

Meet us at MSP Global on October 21 and 22, 2026, in Barcelona.