Sophos survey says MSPs act as CISO for almost half their customers
In the security vendor’s own survey, MSPs say compliance shapes half of their customers’ security purchasing decisions. It arrives weeks before Sophos launches a service designed to bill for that work
- 31% of MSPs can produce consolidated security posture reports through a fully automated process
- 33% of MSPs say regulation heavily or decisively influences their customers’ security buying
- 36% of MSPs manage compliance or CISO-type work from a single tool or platform
- Sophos says it protects more than 625,000 organizations
UK MSPs doing unpaid governance work for customers have evidence here to price it, and the Cyber Security and Resilience Bill is likely to raise demand for documented compliance. The catch is capacity: virtual CISO work needs senior people and repeatable evidence, and few MSPs have both at scale. Treat the time-saving claims as Sophos selling a platform, and compare them with the time costs you already track before committing a practice to a single vendor.
“MSPs are already stepping into this role for nearly half of their customers, creating a significant opportunity to deepen relationships and develop new, higher-value services.”Scott Barlow, vice-president and chief evangelist, Sophos
Sophos published its MSP Perspectives 2026 report on 15 September. MSPs in the survey estimate that, on average, 46% of their customers rely on them to act as chief information security officer, and 84% expect demand for that kind of service to grow over the next 12 months.
The research was commissioned by Sophos and carried out by Vanson Bourne in April 2026. It covers 800 senior and board-level MSP staff in the US, UK, Germany, France, Singapore, Australia and Brazil. The release gives no UK breakout, and the headline number is MSPs’ own estimate of customer behavior rather than customer data.
Compliance is the thread running through the findings. Nearly all respondents (99%) offer at least one compliance service and 58% run full compliance programs, but only 6% offer the full range Sophos tested. MSPs say compliance influences half of their customers’ security purchasing on average. Only 33% are completely confident they can monitor and document compliance continuously across customers, and 53% juggle several tools to do it.
The report doubles as a launch pad. Sophos CISO Advantage, available from October 2026 through its Sophos Fusion platform, is pitched at turning that informal CISO role into a billable service. The survey also found MSPs expect a single platform for posture and compliance reporting would save them 53% of their time on those tasks.
