The attack surfaces growing fastest are the ones no one measures

The attack surfaces growing fastest are the ones no one measures

The attack surfaces growing fastest are the ones no one measures

Back

PRESS RELEASE · FOR IMMEDIATE RELEASE

The MSP Security Coverage Report 2026 from enhanced.io maps managed service provider security coverage across five attack surfaces and finds the highest-risk surfaces are thinly covered or not measured at all. 

EDINBURGH, June 2026. Most small and mid-sized businesses hand their cybersecurity to a managed service provider and assume the job is covered. A new report from SOC-as-a-Service provider enhanced.io tests that assumption against the public evidence and finds it holds for only one of the five surfaces where attacks happen. 

The MSP Security Coverage Report 2026 examines endpoint, network, cloud, identity, and IoT and OT coverage across the MSP industry, drawing on published research from Verizon, Microsoft, IBM, ISC2, Sophos, ConnectWise and others, published between January 2024 and June 2026. It asks two questions of each surface. Are MSPs watching it for their clients, and is anyone measuring whether they do? 

Key findings include: 

  • Endpoint is the most watched surface, with 81% of MSPs offering some level of managed detection and response (Sophos MSP Perspectives 2024). It is the only surface where coverage is mature and well documented. 

  • Cloud is the clearest measured gap. Only about one-third of MSPs consistently secure their clients’ Microsoft 365 (ConnectWise, March 2025), while destructive cloud campaigns rose 87% year over year (Microsoft Digital Defense Report 2025). 

  • Identity carries the biggest threat and the thinnest coverage data. Credential abuse appears in 22% of all breaches (Verizon 2025 Data Breach Investigations Report), yet no neutral source publishes an identity monitoring rate for MSP-managed businesses. 

  • The network interior is under-watched. Edge devices and VPNs jumped from 3% to 22% of exploitation-based initial access in a single year (Verizon 2025 DBIR), while most MSP network coverage stops at the firewall. 

  • IoT and OT is the surface no one measures. No public source reports how many MSPs monitor these devices for clients. The report treats the missing number as a finding in its own right. 

  • A staffing shortage sits under all of it, with 59% of security professionals reporting critical or significant skills gaps, up from 44% a year earlier (ISC2 2025 Cybersecurity Workforce Study). 

Kristian Wright, founder and CEO of enhanced.io, said: “Endpoint is the part the industry does well. The other four surfaces are where attacks are growing fastest, and for two of them nobody has measured whether anyone is watching at all. The missing number is the finding. If the industry has not checked whether MSPs monitor a surface, the honest reading is that most do not.” 

The report is a synthesis of public evidence rather than a survey. Every figure carries its named source, date and sample size, and no statistic is estimated or inferred. Where no coverage data exists, the report says so and treats the absence as part of the picture. 

The full report is available at https://enhanced.io/the-msp-security-coverage-report-2026-edition-1 and on request from the press contact below. 

Press contact:

Kristian Wright, founder and CEO. 

kristian.wright@enhanced.io 

About enhanced.io.

enhanced.io is a channel-only SOC-as-a-Service provider. It works exclusively through managed service provider partners and never sells direct to end clients. Every partner gets a named Fractional Security Director and correlated detection across five attack surfaces: endpoint, network, cloud, identity, and IoT and OT. Founded in 2019 and headquartered in Edinburgh, enhanced.io was ranked 88th in the MSSP Alert Top 250 in 2025.

Logos and brand assets are at https://enhanced.io/brand-guidelines.