What are the market trends that are driving growth and changes in the managed security service provider market? MSSPAlert.com, an affiliate of Cyber for Hire, does an annual survey of MSSPs to find out about growth trends, technology providers, different types of incidents they see in their work with small and mid-sized businesses, and other information and insights. In this edition of Cyber for Hire, we’ll talk about some of those trends revealed in the survey. For instance, some of the factors driving growth in the MSSP market today include the global shortage of talent across enterprise, mid-market and small organizations. Hybrid and remote work are another factor that is contributing to demand for MSSPs. Find out more about what’s driving the growth as well as other market trends in and around the MSSP market in this episode of Cyber for Hire.

Segment Resources:

Link to subscribe to a newsletter that will alert you of when we open our MSSP 250 Survey for 2023 (second one from the bottom): https://www.msspalert.com/sign-up-for-enewsletter/

Ask Jessica C. Davis, editorial director of MSSPAlert any questions about participating in the research at: [email protected]

Show Notes: https://securityweekly.com/cfh15

ChatGPT and all of its competitors are not just text generators, they are also powerful tools that can be used for good or for evil in the realm of cybersecurity.

• What are the implications for MSSPs in the scope of their own services as well as the threat vectors for clients? 

• What are the applications of generative AI for hackers and threat actors?

• What tools are available or in development to help security service providers deal with the escalating quantity and quality of attacks? 

Segment Resources:

• https://www.darkreading.com/vulnerabilities-threats/generative-ai-changes-everything-we-know-about-cyberattacks

• https://www.theregister.com/2023/03/28/chatgpt_europol_crime_report/

• https://www.msspalert.com/cybersecurity-services-and-products/ai/microsoft-debuts-ai-chatbot-for-cybersecurity-defenders/

Show Notes: https://securityweekly.com/cfh15

It's a tough call for MSSPs to make, but sometimes when a client relationship isn't working out, it may be time to cut your losses. Perhaps the customer isn't honoring its commitments to security hygiene; or maybe you're at odds over strategy; or it could be that they are a drain on your resources. This session will examine when to know it's the right time to go separate ways -- and what's the most professional and responsible way to end your relationship.

Show Notes: https://securityweekly.com/cfh14

Now in its eighth iteration, the Center for Internet Security's Critical Security Controls (CIS Controls) framework provides organizations with 18 categories of high-priority best practices that they can follow in order to improve their cyber hygiene, while remaining in step with key regulations. In this segment, we'll look at what MSSPs and their client base need to know if they opt to follow CIS' guidelines vs. other competing frameworks. What are the biggest barriers to successful implementation? What are the biggest benefits? Which best practices are managed services providers best equipped to conduct, and where might they need some assistance?

This segment is sponsored by Liongard. Visit https://msspalert.com/liongard to learn more about them!

Show Notes: https://securityweekly.com/cfh14

To what extent should compliance with privacy and security frameworks -- whether imposed by government bodies or industry standard organizations -- be the decisive factor when MSSPs choose their tech stacks and craft their threat defense strategies? Meanwhile, are would-be MSSP customers deciding which managed services provider to hire largely based on their compliance needs, or are they more influenced by other market forces and threat trends? And for those organizations who ARE building their managed services strategies around compliance, which frameworks, laws or standards should be highest priority? This segment will offer important perspectives on these key questions.

Show Notes: https://securityweekly.com/cfh13

Security is a shared responsibility between MSSPs and their clients. Yes, the provider was hired to do a job -- be it SOC operations, threat intelligence or offensive security -- but part of the job is also to consult and communicate with the client to help them gain some degree of cyber self-sufficiency. This discussion will reveal how providers can teach their clients how to develop a secure corporate culture, how to share responsibility and accountability for security matters, and how to broaden their security awareness through partnerships with professional development organizations and information sharing groups.

Show Notes: https://securityweekly.com/cfh13

In the cybersecurity job market, it's "Advantage Worker," as the demand for talent has opened up a world of possibilities for security professionals to seek out greener pastures. Meanwhile, other infosec pros are so stressed and burned out that they're looking to quit the daily grind altogether. These factors have combined to create a cyber talent turnover crisis, which can result in organizational instability, stalled implementations, slow responses to threats, and overworked, stretched-thin employees. In this segment, we'll identify some of the best talent retention practices and policies that give you better odds of earning loyalty from your cyber workforce.

Show Notes: https://securityweekly.com/cfh12

In late 2022, the MITRE Engenuity foundation revealed the findings from its first-ever ATT&CK Evaluations for managed security service providers. The report measured various MSSPs' ability to recognize, analyze and report the TTPs of the OilRig Advanced Persistent Threat group. This session will dig into the findings to help MSSPs better understand where they can stand to improve when it comes to hunting, detecting and responding to threats posed by sophisticated cyber adversaries. Plus, MITRE will reveal how managed security providers can participate in the next round of assessments.

Show Notes: https://securityweekly.com/cfh12

Once upon a time, organizations that relied on Macs or Linux machines could rest easy knowing that they were too few in number for cybercriminals to bother targeting them. This is no longer the case. As adoption of non-Windows operating systems has increased, so has the number of incidents victimizing devices running on these OSes. In this segment, we'll identify some of the latest non-Windows cyber threats and assess whether MSSPs currently have the specialized knowledge to successfully service organizations that run on macOS, iOS, Linux and other less common OSes.

Show Notes: https://securityweekly.com/cfh11

For managed services providers looking to build their market strategy around XDR and MDR -- or a hybrid of the two solutions -- it's important to understand how this approach will shape future priorities for their tech stacks and toolsets, their clients and their vendor partners. What kinds of next-generation services can they build from an XDR/MDR foundation? How does this differ from a more traditional MSSP approach? And how can managed services providers clearly communicate and define what XDR constitutes to clients who don't fully understand the concept?

Show Notes: https://securityweekly.com/cfh11