Sophos report: MSPs acting as de facto CISOs for nearly half of customers

The Sophos 2026 MSP Perspectives Report indicates that Managed Service Providers (MSPs) are increasingly serving as de facto Chief Information Security Officers (CISOs) for their clients. On average, 46% of customers look to their MSPs for CISO-level leadership, a demand that 84% of providers expect to rise over the next year.

Regulatory requirements are a primary driver of cybersecurity spending, influencing approximately half of customer investments. However, MSPs face operational hurdles in meeting these needs. Only one-third of providers express full confidence in their ability to continuously monitor and document compliance across multiple clients.

Currently, many MSPs struggle with fragmented tools and manual reporting processes. The report suggests that adopting a unified platform for security posture and compliance management could significantly improve efficiency, with providers estimating they could save up to 53% of their time by consolidating these activities.