51% of cyberattacks in the MSP sector lead to unplanned expenses to fix security gaps

Netwrix has released additional findings for the managed service providers (MSP) sector from its annual 2024 Hybrid Security Trends Report based on a global survey of 1,309 IT and security professionals.

It reveals that 76% of MSPs spotted a cyberattack on their infrastructure within the last 12 months, similar to the results among organisations overall (79%). Among those that were attacked, every second MSP (51%) had to deal with unplanned expenses to fix the security gaps. Moreover, 31% experienced a loss of competitive edge, and 27% faced compliance fines compared to 20% and 17% across other verticals.

For the MSP sector, each second security incident in the cloud (49%) was associated with user account compromise, while 46% of attacks on premises were ransomware or other malware attacks. In contrast, these types of attacks were less common among other industries.

"Our team has had significant success in handling user account compromises and ransomware attacks using Netwrix 1Secure,” says Rory Cooksey, Director of Growth at WheelHouse IT. “Its robust monitoring and alerting capabilities allow us to detect and respond to threats swiftly, ensuring minimal disruption to our clients' operations. The comprehensive visibility and control provided by 1Secure empower us to confidently address and mitigate these security challenges, maintaining the highest level of protection for our clients."

“MSPs largely rely on software-as-a-service (SaaS), platform-as-a-service (PaaS), and infrastructure-as-a-service (IaaS) solutions. These are usually accessible to both MSPs and their clients, significantly limiting the implementation of network-based restrictions like IP address filters. As a result, attackers target such cloud-based solutions because they might be easier to infiltrate, and one successful breach gives keys to many kingdoms”, says Dirk Schrader, VP of Security Research at Netwrix

“The service provider is a promising target for ransomware gangs. On one hand, MSPs can hardly afford downtime and would be more eager to have the operations back up and running, which increases the chances for ransom payout. On the other hand, breaching a service provider can be just a step toward the real target in a supply chain attack. MSPs should adequately assess the risks and rely on threat intelligence to make their security decisions,” says Ilia Sotnikov, Security Strategist at Netwrix.