Sophos survey says MSPs act as CISO for almost half their customers
In the security vendor’s own survey, MSPs say compliance shapes half of their customers’ security purchasing decisions. It arrives weeks before Sophos launches a service designed to bill for that work
- 31% of MSPs can produce consolidated security posture reports through a fully automated process
- 33% of MSPs say regulation heavily or decisively influences their customers’ security buying
- 36% of MSPs manage compliance or CISO-type work from a single tool or platform
- Sophos says it protects more than 625,000 organizations
Customers who rely on their MSP for security leadership should write that role into the contract: who owns risk decisions, what gets reported and how often. MSPs doing this work informally should log the hours it takes before pricing it or committing to any single platform. Check whether a current compliance report can be produced for each customer without manual assembly, and fix that gap before selling a virtual CISO service.
“MSPs are already stepping into this role for nearly half of their customers, creating a significant opportunity to deepen relationships and develop new, higher-value services.”Scott Barlow, vice-president and chief evangelist, Sophos
Sophos published its MSP Perspectives 2026 report on 15 September. MSPs in the survey estimate that, on average, 46% of their customers rely on them to act as chief information security officer, and 84% expect demand for that kind of service to grow over the next 12 months.
The research was commissioned by Sophos and carried out by Vanson Bourne in April 2026. It covers 800 senior and board-level MSP staff in the US, UK, Germany, France, Singapore, Australia and Brazil. The release gives no UK breakout, and the headline number is MSPs’ own estimate of customer behavior rather than customer data.
Compliance is the thread running through the findings. Nearly all respondents (99%) offer at least one compliance service and 58% run full compliance programs, but only 6% offer the full range Sophos tested. MSPs say compliance influences half of their customers’ security purchasing on average. Only 33% are completely confident they can monitor and document compliance continuously across customers, and 53% juggle several tools to do it.
The report doubles as a launch pad. Sophos CISO Advantage, available from October 2026 through its Sophos Fusion platform, is pitched at turning that informal CISO role into a billable service. The survey also found MSPs expect a single platform for posture and compliance reporting would save them 53% of their time on those tasks.
Sources
- Sophos, “MSPs Have Quietly Become Acting CISO for Nearly Half of Their Customers, Sophos Research Finds”, press release via GlobeNewswire, 15 September 2026. https://www.globenewswire.com/news-release/2026/09/15/3362118/0/en/msps-have-quietly-become-acting-ciso-for-nearly-half-of-their-customers-sophos-research-finds.html
- Channel Insider, “Sophos Report: 46% of MSPs Act as Customer CISOs”, 16 September 2026. https://channelinsider.com/security/managed-services/sophos-msp-report-ciso-compliance-services/
