Today, Cybersmart, a provider of cyber risk management for small businesses, revealed its third annual CyberSmart MSP Survey. This 2026 report zeroes in on the security stance of Managed Service Providers (MSPs) and their clients, reflecting the growing significance of third-party risk in today’s volatile cybersecurity landscape.
The survey's findings reveal that 43% of MSPs and their customers have experienced cyber incidents attributed to suppliers or third-party vendors in the past year. Conducted by OnePoll, the research surveyed 350 MSP leaders across the UK and Ireland, representing a broad spectrum of industries.
Cybersmart, a provider of cyber risk management services for small businesses, has published its third annual CyberSmart MSP Survey. The 2026 report focuses on the security position of Managed Service Providers (MSPs) and their clients, with attention to third-party risk in the current cybersecurity environment.
The survey reports that 43% of MSPs and their customers have experienced cyber incidents linked to suppliers or third-party vendors in the past year. The research was conducted by OnePoll and surveyed 350 MSP leaders across the UK and Ireland, covering a range of industries.
Supply chain breaches are reported as a recurring issue rather than isolated events. MSPs often have broad access to client systems, which can make them a target for attackers seeking access to multiple organisations through one entry point. The survey found that 55% of MSPs have been involved in supply chain incidents, either directly or indirectly. At the same time, 55% of MSPs do not carry out continuous monitoring of supply chain risk, with 37% assessing risk quarterly and 11% annually.
Key challenges identified by MSPs in managing supply chain risk include:
- Managing and enforcing security requirements in contracts (39%)
- Third-party risk assessment and monitoring (37%)
- The cost of securing and supervising the supply chain (36%)
The Cyber Security and Resilience Bill (CSRB) introduced in November 2025 places MSPs under formal cyber security regulation. The legislation requires stricter security measures and more detailed incident reporting, with a focus on managing systemic supply chain risk and the role of MSPs in wider cyber resilience.
Among survey respondents, 96% said they feel at least somewhat prepared for the CSRB, and 45% said they are fully prepared. Respondents also indicated that software alone is not sufficient to address readiness requirements, and highlighted the importance of skills, clearer customer expectations, and defined responsibilities for liability.
The CSRB is also associated with increased liability for MSPs, which 42% of MSP leaders identified as a concern. They cited issues related to unclear accountability and a need for clearer guidance on how risk and responsibility are shared.
Overall, 77% of respondents said they believe the CSRB adequately addresses the protection needs of organisations within supply chains. When asked about additional measures, responses included requests for clearer guidance, protections around shared liability, tailored frameworks for MSPs, and security certifications for client-facing services.
