With cybersecurity talent in short supply and threats evolving fast, managed detection and response is emerging as a strategic necessity for MSPs
27 Oct 2025
•
,
5 min. read
Managed service providers (MSPs) should be in a good place right now. As businesses continue to grow their digital operations, they increasingly need expert partners to help deploy and manage critical IT products and services. Nowhere is this need more pronounced than in cybersecurity. According to Canalys, revenue from managed security services is predicted to grow 15% annually this year.
Yet there are challenges. MSPs are also struggling with skills shortages, threat actor innovation and macroeconomic pressures. This is where managed detection and response (MDR) can make a big impact – helping to create new revenue streams and build customer loyalty without overwhelming the service provider operationally.
MSP challenges: from threats to skills
According to one report, 97% of MSPs expected to increase their service portfolio in 2024, with a heavy focus on security. Yet they face several challenges in doing so. These include:
- Skills shortages: Over a third (35%) of MSPs cite this as their top business challenge. The battle for talent is fierce, with the world short of an estimated 4.7 million cybersecurity professionals. This includes over 392,000 in Europe, and nearly 543,000 in North America. Specialized skills like threat hunting are arguably in even greater demand. Competing on salaries with deep-pocketed rivals and large enterprises eats into margins.
- Budgets and macroeconomic pressure: The world is undergoing an intense period of geopolitical tension and economic uncertainty, causing many business leaders to pause investment plans. If that means IT spending is reined in, it can also be bad news for MSPs. The challenge becomes more acute as the battle for customers heats up.
- Evolving threats: Network defenders are being pulled in every direction by more agile, well-resourced adversaries. The attackers have the advantage of surprise, and can find all the tooling and know-how they need on the cybercrime underground to launch relatively sophisticated attacks. By one estimate there was a 179% increase in ransomware breaches in the first half of 2025 since the start of the year, and 3,104 data breaches recorded in the period, linked to 9.5 billion records. ESET’s detections of ransomware rose by almost a third in the first six months of 2025 versus the six months prior. Keeping such threats at bay is increasingly challenging for MSPs and their customers.
- MSPs as targets: MSPs are an attractive target for attack in their own right, given the access they provide to downstream customer networks. Consider the Kaseya ransomware campaign of 2021, or more recent cyberespionage attacks by Iranian threat group MuddyWater.
- Alert fatigue and overload: As the number of security tools run by client organizations increases, so too does the volume of alerts received by the security operations center (SOC). Even experienced security operations (SecOps) teams can quickly become overwhelmed by alerts if they’re unable to prioritize.
- Operational pressure: MSPs that offer managed cybersecurity services alongside other offerings may find themselves struggling to deliver. They must not only deal with a mounting volume of threat alerts, but also do so alongside daily monitoring of multiple client systems, routine maintenance, and more.
Why is MDR a good fit for MSPs?
This is why many MSPs are turning to MDR services delivered by a trusted partner. Traditionally, MDR offers:
- Continuous monitoring of the customer environment by an expert SOC team
- Detection of threats using techniques such as behavioral analysis, to sift through the noise and prioritize what matters
- Threat hunting to detect more sophisticated attacks capable of bypassing automated threat detection
- Incident response, leveraging automated tools like SOAR, generative AI (GenAI) and playbooks to rapidly contain and remediate threats
While managed security services recorded 15% annual revenue growth in 2024, the figure for MDR was predicted to be 50%, according to Canalys. That alone should make it a serious contender for those MSPs looking to increase their service portfolio. With the right cybersecurity partner on board, MDR can also help service providers by offering:
- 24/7 monitoring and detection: A compelling offering for end customers, to help rapidly spot, contain and remediate any threats before they can cause the company serious damage. If the MSP itself uses the same services to protect its own attack surface, it could also help mitigate the financial, reputational and compliance risk of serious internal security breach.
- Outsourced security services: The MDR provider’s expert SOC team does most of the heavy lifting, overcoming skills shortages and leaving the MSP to focus on high-value tasks.
- Stronger client relationships: MDR doesn’t just offer a new revenue stream for MSPs. It can also help to strengthen customer trust by positioning the provider as an extension of the client’s in-house security team.
- Reduced alert overload: With the right MDR provider intelligently prioritizing alerts, MSPs will have fewer false positives to deal with, ensuring they spend more time servicing their clients.
- Cyber insurance benefits: MDR is increasingly required by insurance providers as a pre-requisite for coverage, or at least lower premiums. This could make it a selling point for MSP customers and MSPs themselves.
Key considerations for an MDR partner
If your MSP business is considering expanding its services to offer MDR, be sure to look out for a partner that can provide:
- Excellence in threat intelligence: Accurate insight into the threat landscape enables you to see more and respond quicker.
- 24/7/365 operations: Threat actors never sleep, and neither can your MDR.
- Advanced threat hunting: Choose a provider with expert analysts skilled in detecting advanced, hidden threats.
- Proven capabilities: Look for high detection rates and low false positives from a name you can trust, with a reputation to match.
- Customer support: High-quality, localized customer service is important to ensure you can provide the best possible MDR experience to your clients.
- Human + machine: The best offerings combine AI and automation with an expert human team to monitor the output of machines and conduct threat hunting.
- GenAI assistance: GenAI can further close skills gaps and accelerate incident response.
According to IDC, just 27% of companies handle detection and response in-house. This represents a major opportunity for MSPs keen to deliver value-added services and build their business. It might be time for yours to take a look.
