In this article 5 sections
If you want to know where MSP money is in 2026, Kaseya’s new numbers answer it cleanly. Security is the second largest revenue source for MSPs and the fastest growing. Proving it is the constraint.
In Kaseya’s 2026 State of the MSP report, which surveyed 1,061 MSPs in November 2025, security ranks as a top revenue source for 52% of MSPs, second only to endpoint and network management. 71% of MSPs reported year-on-year growth in security revenue, the highest of any service category. Backup followed at 50%.
Why is security still the safest place to grow?
Because the demand is structural. Kaseya found 61% of MSPs say most or all of their clients turn to them for cybersecurity advice, and 44% reported at least one client suffering a cyberattack in 2025. Clients buy it because their provider is the person they call when something goes wrong, and something is going wrong often.
Proving value is getting harder
The same report shows the share of MSPs struggling to demonstrate value to clients nearly doubled, from 10% to 19%. Security is the worst category to be vague about, because the client cannot see any of it until it fails. You can run flawless patching, enforced MFA and tested backups all year and still lose the account to a cheaper provider, simply because the client never saw the work and the competitor told a better story.
Self-reported numbers don’t settle it either. At Labyrinth, a vendor’s policy setting left real patching at 47%, while the MSP’s own reporting showed 95%. Assurix’s live monitoring flagged it and worked with the vendor to fix it.
There is a revenue line hiding in this. Kaseya’s data shows regulatory compliance is offered by 42% of MSPs but lands in the top revenue sources for only 8%. Most MSPs deliver it as unbilled admin that clients never see.
How do you turn invisible security work into defensible revenue?
Make the work visible and independently verified. Three moves:
- Report security outcomes to the client monthly in their language, not raw tool output. Risk reduced, incidents prevented, backups proven.
- Get an independent party to verify your controls are met now, so the client is not relying on your word during a renewal conversation.
- Price the assurance as its own line, not as something bundled and forgotten inside the managed services fee.
This is the gap the Assurix Trustmark is built for. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Live-measured controls are checked every six hours and the rest on a set cycle. The result sits on a Trust Portal a client or insurer can open. Leave a failure unfixed for 30 days and the Trustmark is suspended publicly.
The read for the next 12 months
Security revenue is growing faster than anything else MSPs sell. The MSPs that win that budget are the ones who can prove the security. If a client is weighing you against a competitor, the playbook on handling that conversation is worth reading next.
One caveat on the numbers. Kaseya’s sample is global and North America heavy, so treat the figures as directional rather than a precise UK cut. The direction holds: security sells, proof decides who gets paid for it.
A concrete example of invisible work losing a deal
An MSP runs enforced MFA, weekly tested backups and same-day patching for a 50-seat client for three years with zero incidents. Renewal comes up. A competitor quotes 15% less and says all the same words. The client cannot see any difference between the two, because the incumbent never showed the work, so they switch to save money. The security was excellent. The proof was absent. The account still left.
Now run it the other way. The incumbent has sent a monthly outcomes report all year and holds an independently assessed status. The competitor’s lower quote now reads as a risk, because the client can see exactly what they would be giving up. Same work, opposite outcome, and the only variable that changed is proof.
