Episode 26: Cybersecurity Trends MSPs Must Lead in 2026

Christina

All right, welcome back to the deep dive. So if you're a decision maker, maybe a security provider, and you're trying to look past, you know, just the next quarter and really understand what the next two years are going to demand of your security architecture. Well, you've come to the right place. We have a stack of sources here, and they don't just uh suggest change. They really mandate a fundamental shift.

Adam

They really do. It's not just about a technical upgrade cycle anymore. It's it's more like an architectural reckoning. I mean, the old models, the ones centered on firewalls and endpoint protection, they're failing. And the statistics are uh brutally clear about the cost of that failure.

Christina

Okay, so give us the hard numbers. What's the data that makes this shift completely non-negotiable?

Adam

Look at dwell time. It's well, it's staggering. Research shows organizations are taking, on average, 204 days just to identify that a breach has even happened, and then on top of that, another 73 days. That's nearly three months, just to contain it.

Christina

Wow. So you're talking about a seven to nine month window where an attacker just has free run of the environment.

Adam

Exactly. And if your defense strategy doesn't drastically cut that response time, you are, I mean, you're just accepting a massive amount of risk.

Christina

And while that risk window is wide open, the attackers they're not always using some sophisticated zero-day exploit. They're using the keys we already gave them. I saw some Microsoft data. It shows over 80% of attacks today start with something terrifyingly simple: compromise credentials. The perimeter isn't just degraded. I mean, for all intents and purposes, it's dead.

Adam

Precisely. So our deep dive today is going to focus on detailing these uh seven crucial trends that are forcing everyone's hand. The initial thesis, the thing we can pull from all these sources is this the economics of defense failure measured in those 277 days of exposure. It demands that we replace these disconnected tools and manual processes with a unified, automated, and crucially an identity-centric model.

Christina

Okay, let's unpack that. Let's start with a new reality. Identity is the new attack surface. We're not just talking about leaked password lists from some old breach anymore, are we? How are sophisticated attackers leveraging today?

Adam

The game has completely changed. Attackers are now bypassing multi-factor authentication MFA, which, you know, was supposed to be the definitive control.

Christina

The silver bullet.

Adam

The silver bullet, exactly. They do it with things like session hijacking or the one we're seeing more and more, the MFA fatigue exploit. The thing is, they don't need to write a single line of malware if they can just steal a valid session token or trick a user into approving a login.

Christina

You mentioned MFA fatigue. For anyone listening who might not have seen that firsthand, how does that actually work? How does it look to a user?

Adam

It's actually a master stroke of social engineering. So the attacker gets the username and password right, then they just try to log in over and over in a really short period of time, and this floods the victim's phone with push notifications asking for approval. The victim, who is probably frustrated or annoyed, eventually just approves one to make their phone stop buzzing. And that's it. That one approval grants the attacker access with a valid session token. The control is completely bypassed.

Christina

So if the attack surface has shifted almost entirely to credentials, and that's being driven by cloud adoption, remote work, saw sprawl, our traditional network monitoring tools are basically useless here.

Adam

Oh, absolutely. The traditional tools are looking for unauthorized code. They should be looking for unauthorized behavior from authorized keys. And that's exactly why identity threat detection and response, or ITDR, is moving so quickly from, you know, an emerging category to a mandatory one.

Christina

So explain ITDR's core function for us. What is it actually doing?

Adam

Okay, so think of ITDR not as a guard at the front door, but as a system that watches the behavior of every single key that's already inside the vault. It's designed to spot those really specific high-risk identity behaviors that a firewall or an endpoint solution would completely miss. We're talking about detecting impossible logins.

Christina

Like someone logging in from New York and then 30 minutes later from Frankfurt.

Adam

Exactly that. Or immediately flagging when a user tries to escalate their privileges without authorization. Or, and this is the most critical part, spotting lateral identity movement. That's when an attacker is bouncing between accounts inside the network. ITDR is what closes that huge identity gap.

Christina

That need for continuous behavioral monitoring. It just means we're generating exponentially more data. Which brings us right to the next huge challenge for security teams. That, you know, age-old problem of tool sprawl. We have separate systems for endpoints, for cloud logs, firewalls, vulnerability scanners, and every single one is screaming warnings.

Adam

And that's what leads to what our sources call tool chaos and alert fatigue. It's a real problem. Analysts spend more time just switching between consoles and validating alerts than they do actually investigating. Threats get hidden in the gaps between these tools. I mean, this is the single biggest operational time sink for security teams globally.

Christina

So how do we stop the sprawl? I mean, without forcing every company to rip out all their existing investments.

Adam

The answer is consolidation through something called OpenXDR, or extended detection and response. And that open part is really vital here. It's not just another vendor trying to sell you their endpoint solution. It's meant to be a unified control center, one that's designed to ingest data from all your existing tools, whether that's your Microsoft 365 logs, your Okta identity solution, or whatever endpoint platform you already have.

Christina

But hold on. Doesn't integrating a bunch of complex legacy tools into a new platform sound like a total nightmare for IT teams? Is this just vendor lock-in with a new name?

Adam

That's a fair challenge. And look, the effectiveness of OpenXDR, it relies entirely on its ability to integrate deeply, not just superficially. The core value isn't just, you know, unified visibility.

Christina

Right, it's not just another pretty dashboard.

Adam

No, exactly. It's the advanced threat correlation. It's about connecting the dots. For example, it might see a suspicious login from Okta, then a cloud configuration change in your AWS logs, and then finally an attempted data exfiltration from an endpoint. Your separate tools would just see three separate low priority alerts. Open XDR instantly correlates them into a single high priority attack chain. It just cuts investigation time from hours, sometimes days, down to minutes.

Christina

So it's the operational simplification you need to handle the sheer volume of data and that operational speed. It's now being dictated by this uh automation arms race. Let's talk about artificial intelligence, because it's really shaping both sides of the coin here: attack and defense.

Adam

AI is the new multiplier for cybercrime. Absolutely. On the attacker side, we're seeing some incredible sophistication, hyper-personalized phishing emails that are context aware, deep fake voice models being used for executive fraud, and dynamic malware that constantly shifts its own signature to evade detection.

Christina

And what's really worrying is that this is all being packaged up and sold as a service.

Adam

Exactly. The sources are very clear on the emergence of these autonomous cybercrime services. We're seeing subscription-based offerings on the dark web cybercrime as a service, where threat actors can essentially rent a fully automated attack infrastructure. The barrier to entry for highly effective crime is, well, it's dropping like a rock.

Christina

So if the bad guys have autonomous crime, we have to have autonomous defense.

Adam

Which brings us to defensive agenciai inside platforms like OpenXDR.

Christina

You have to meet automation with automation. There's no other way. And agenic AI is critical because it introduces the concept of autonomous action. It's more than just machine learning filtering alerts. It acts like an always-on digital analyst that helps your security operations scale without needing to hire a massive new team.

Adam

So, practically speaking, what functions is this agentic AI performing that a human analyst used to have to do? It automates what we call tier one analysis, which is, frankly, the drudgery. It auto-triages alerts in real time, instantly discarding the noise and focusing the human analyst's attention only on the most critical validated events. It then enriches those investigations, pulling in contextual evidence from across the endpoint, network, and cloud. And most importantly, it can run immediate, defined playbooks across all those different tools. It can isolate a host or revoke a credential almost instantly. This is what closes that detection to response gap that defined the old failing model.

Christina

Okay, moving beyond our internal operations for a second, the external risk landscape is also widening in a big way. And this trend has major implications for anyone running a managed security service. We have to talk about the supply chain vulnerability.

Adam

The supply chain is a massive liability. And the sources show these attacks are accelerating and they're hitting the MST channel the hardest. Managed service providers or MSPs, they're prime targets because they hold the keys to hundreds of client environments at the same time.

Christina

And how do attackers actually exploit that connection?

Adam

Well, they target the tools that MSPs use for legitimate access. So your remote monitoring and management or RMM tools, your professional services, automation, PSA tools, or even shared VPNs and identity platforms. If you compromise the vendor, you get privileged, trusted access to dozens, sometimes hundreds of downstream organizations. It's just a very efficient attack for the criminal.

Christina

And we've seen the damage this can cause.

Adam

The scale is it's sobering, really.

Christina

Oh, the examples are clear evidence of this. The 2021 Caseya supply chain attack, that was a domino effect that hit over 1,500 businesses. The 2023 MOVEit breach impacted over 2,500 organizations worldwide. And even the identity vendors themselves are immune. The Okta breach in 2023 leveraged access to vendor logs to target their own downstream clients. So the required defense strategy here has to be relentless. Continuous vendor risk monitoring and an absolute enforcement of zero trust access policies. Now let's pivot to probably the most pervasive threat in the world today: ransomware. It's not just about file encryption anymore, is it criminals are shifting tactics in a pretty fundamental way? They're moving to extortion-only campaigns.

Adam

This is a critical development. I mean, criminal organizations realize that traditional file encryption is noisy, it's obvious, it creates immediate damage, and it often results in an immediate recovery from backups. So the shift is towards silently stealing huge amounts of critical data and then demanding a silence payment, an extortion payment to prevent it from being leaked.

Christina

The implication there is enormous because the standard defense for decades just restore from your backups, that's no longer a complete answer. It changes the entire game.

Adam

Precisely. Palo Alter Networks noted a 49% increase in leak site activity, even in cases where no file encryption was used at all. Backups, they solve data availability. They do nothing to prevent intellectual property theft or regulatory fines, or the massive reputational damage from extortion. This just mandates a dramatic shift in our defensive focus. We have to move beyond just endpoint malware detection. We have to focus on detecting exfiltration behaviors and lateral identity movement before the data actually leaves the network. DLP and behavioral monitoring are non-negotiable now.

Christina

So this high-stakes, rapidly evolving technical landscape is now reshaping the business side of cybersecurity. We need to talk about why security is no longer just a cost center. It's becoming a pretty critical revenue engine for providers.

Adam

And this raises a really important question about market maturity. Gartner is forecasting that global cyberspend will hit $300 billion by 2026. It's one of the fastest growing sectors out there, but clients are getting smarter. They don't buy alerts, they buy measurable contractual outcomes.

Christina

Which means we have to retire that failed MDR light model, right? Where a provider just sends a ticket back to the client and says, hey, there's an alert, you handle the cleanup.

Adam

That passive model is a liability now. True managed response means delivering a complete outcome 24/7. That has to include fast containment, automated host isolation, remediation guidance, root cause analysis, and guaranteed threat eradication. That commitment to real actionable containment, that's how you keep contracts and demonstrate value.

Christina

And this commitment is being mandated by an outside force now, too. The cyber insurance market, it's acting as a powerful sales catalyst.

Adam

Absolutely. The cyber insurance providers have evolved. They're not just passive risk payers anymore. They are active risk underwriters. They're routinely rejecting applicants who don't meet a baseline of continuous sophisticated monitoring. Providers like Coalition and Hiscox, they're essentially using their policies to enforce best practices.

Christina

So what are they specifically requiring evidence of? What do security providers have to deliver?

Adam

Well, the policies increasingly demand continuous proof of several controls. Zero trust adoption across the organization, EDR or XDR monitoring deployed everywhere, mandatory multi-factor authentication for all access, privileged access controls, and critically, a proven 24-hour response capability. The MSPs that can integrate this and deliver automated compliance map reporting, showing their clients exactly how risk has been measurably reduced, they gain a massive competitive edge.

Christina

So the winning model, the most profitable one, it isn't selling a single tool, it's selling a tiered cybersecurity package that incorporates all these elements together: ITDR, OpenXDR, 2047 incident response, and continuous compliance reports. It really transforms security from this vague, necessary expense into a quantifiable, risk-reducing investment.

Adam

So to summarize for the listener trying to navigate this transition, the providers who are going to thrive in the 2026 landscape are the ones who embrace agentic AI. They'll consolidate visibility through platforms that correlate threats across identity and the endpoint. They'll automate response workflows to eliminate dwell time. And crucially, they're going to sell and deliver outcomes, not just tools, with continuous compliance reporting as their proof point. At the end of the day, complexity demands consolidation and speed demands automation.

Christina

It's a lot to process, but the necessity of this change is just it's undeniable. What does this all mean for the long term view of enterprise architecture? If identity first security truly and completely replaces the concept of perimeter security, what happens to the idea of the safe internal network? And how fundamentally does that concept redefine the physical and logical border of a modern organization? That's the question freedom all over as you build your strategy for the future.