The cybersecurity landscape is evolving, and managed service providers are at the center of growing security risks. Ransomware attacks, stolen credentials and misconfigured security tools continue to be top concerns, putting MSPs and their clients at risk. Compounding these threats is the cybersecurity skills gap, making it increasingly difficult for businesses to find the expertise needed to combat today’s sophisticated attacks.

To break down these challenges and provide actionable insights, Andrew Mundell, senior product marketing manager at Sophos, joins CRNtv’s Sydney Neely to discuss the biggest cyber threats MSPs face and how they can improve their security posture.

Why Are MSPs Prime Targets for Cyberattacks?

Sydney: We know that MSPs are seen as one of the biggest cyber risks—not just for their clients but for themselves. In your view, what’s making MSPs such big targets for cybercriminals?

Andrew: Unfortunately, attackers love MSPs. Many people are familiar with supply chain attacks, where attackers compromise a third-party provider to access its customers. MSPs are an ideal target for these attacks because they often have high-level administrative privileges across multiple organizations.

If an attacker breaches an MSP, they don’t just gain access to one organization—they gain a master key that allows them to infiltrate multiple businesses at once. And unfortunately, we’ve seen a significant increase in these complex, targeted attacks against MSPs. Our most recent threat report showed that MSPs are now a primary focus for attackers, making it even more critical for them to strengthen their defenses.

The Growing Cybersecurity Skills Gap

Sydney: The shortage of cybersecurity expertise has been a major issue. Why is this such a big challenge for MSPs?

Andrew: We’re seeing this across the board. Over 70 percent of organizations report that they can’t find the right security staff. MSPs, in particular, like to run lean, which makes hiring, training and retaining a full-scale 24/7 security team an expensive and time-consuming challenge.

A lot of MSPs have a great mix of business and technical expertise, but cybersecurity is highly specialized. Without the right personnel in place, they can really struggle to keep up with emerging threats, and that puts both them and their customers at risk.

How Attackers Are Stealing Credentials

Sydney: Stolen credentials are a major issue. How are attackers getting their hands on this data, and why is it so effective?

Andrew: I hate to sound like a broken record, Sydney, but it all comes back to phishing. Attackers are constantly trying to socially engineer users into giving up their credentials. And with generative AI tools, the days of poorly written phishing emails are fading fast.

We’re now seeing AI-generated phishing attacks that are incredibly convincing and highly effective. Attackers also brute-force weak passwords or exploit known vulnerabilities in software to steal credentials. Many of these credentials end up for sale on the dark web, where initial access brokers make a business out of selling login information to other cybercriminals.

So, like you said in the opener, that means attackers aren’t breaking in—they’re logging in as if they belong.

How MSPs Can Strengthen Their Cyber Defenses

Sydney: MSPs face unique security risks. What are some of the biggest vulnerabilities they share with their clients?

Andrew: The number one concern is ransomware. More than 60 percent of organizations consider ransomware their biggest cyber threat, and for good reason. What’s even more alarming is that less than half of the data is successfully recovered when organizations pay the ransom. That means even those who choose to pay often struggle to fully restore their systems.

Another growing concern for MSPs is insider threats—whether accidental or intentional. Misconfigurations are a major issue, and one small mistake at the MSP level can expose every single client. We’ve also seen cases where attackers infiltrate organizations by gaining the confidence of employees, turning them into unwitting threats.

For more information on how Sophos can help MSPs strengthen their defenses, visit Sophos.com.