The Pivot: How MSPs can Turn a Challenge Into a Once-in-a-Decade Opportunity

Cybersecurity is quickly becoming one of the most significant
growth drivers for Managed Service Providers (MSPs). That’s the
main insight from a recent study^[1]
from Lumu: in North America, more than 80% of MSPs cite
cybersecurity as a primary growth driver of their business. Service
providers have a huge opportunity to expand their business and win
new customers by developing their cybersecurity offerings.

This hardly comes as a surprise since the demand for
cybersecurity is in full swing among SMBs and larger enterprises.
According to Gartner^[2], “by 2025, 60% of
organizations will use cybersecurity risk as a primary determinant
in conducting third-party transactions and business
engagements.”

This means that the perception around security is transforming:
from liability, it’s becoming a powerful business driver. Of
course, cybersecurity continues to evolve at a very rapid pace,
with threats emerging every day and the stakes getting higher. This
alone can fuel the perception that it is an overwhelming and
stressful field, especially since COVID-19 reshuffled the (IT)
world.

The acceleration of cloud adoption and hybrid work, scams,
phishing messages, and endpoint threats are all concerns for
companies caring for their customers. It is also undisputed that
cybersecurity is a critical component of hybrid work environments.
The pandemic has made security teams more aware of digital risks
and the importance of strategic defense, security planning, and
risk management. Not to forget the struggle to hire skilled
security specialists and the complexity of many security
products.

Yet, MSPs are uniquely positioned to thrive in this re-inventing
market.

According to the 2023 State of the MSP report^[3]:

“Cybersecurity is still a very large area for growth. While
services for ransomware and phishing/email security remain the top
focus for MSPs, others are finding further growth offering services
around expanding reporting, auditing, training, and policy building
for clients.”

In other words, MSPs have a unique opportunity to build a
security brand by better serving their customers’ needs. This is
likely to become a key business differentiator in the next
decade.

But packaging and reselling security products alone is not going
to cut it. They need to transform into trusted security
advisors.

Let’s explain what it will take for service-oriented companies
to take full advantage of this major strategic shift.

Building a competitive advantage

MSPs are first and foremost service companies, looking to help
their customers in their digital operations. Cybersecurity is an
expanding field with lots of opportunities to create valuable
services.

The shift to the cloud and digital collaborative workflows has
resulted in a significant gap in security coverage in many
industries, resulting in inefficient and outdated protective
measures.

This is even true in software-driven businesses: the rapid
adoption of DevOps practices has created numerous security grey
areas lacking in monitoring and audit capacities.

Not only that but in the past few years, there has been a shift
in the way cybercriminals operate worldwide. We are observing that
cyber threats are focusing on enterprise software through what is
called supply chain attacks^[4], and concentrate their
efforts on high-leverage entry points, such as employees with
special IT rights like developers.

But building a competitive advantage means bringing value to the
customers. In cybersecurity, it can be challenging to demonstrate
such value.

So, for MSPs, the key is to better understand what are the
challenges that security leaders are facing today, and then to
build on that:

— How can I get full visibility into what is happening in my
environment?

— How can I detect potential misconfigurations and
vulnerabilities?

— How can I prioritize among the ever-growing list of
priorities?

— How can I quickly and efficiently respond to threats in my
organization?

— What threats are unique to my organization?

Then, it’s about selecting the right set of tools. Tools are not
the definitive answers to these questions. They are what will allow
service providers to gain insight into their customer’s
environments, and create a security roadmap to mitigate risk.

Operating at scale, MSPs will have to prove that they are able
to separate the signal from the noise (not all vulnerabilities are
made equal) and that they are able to leverage that information to
solve the issues quickly and accurately.

Deploying solutions without the competence to operate them will
only make the problem worse.

Customers, no matter their size or their industry, will expect
intelligence and tailor-fit advice.

There lies a unique opportunity to re-think security as a
process, or security as a service.

Now the central question is: how to stand out?

Bring value by finding leaked credentials before hackers

Scalability, observability, response automation, and educational
value will allow service providers to bring the most to their
customers. Advancing in the field of cybersecurity by providing
exceptional value is the way to go.

GitGuardian is a code security platform specialized in detecting
leaked credentials (secrets) in source code. We provide a solution^[5]
to monitor internal source code repositories that integrates
natively with GitHub, GitLab, BitBucket, and Azure Repos.

Hardcoded secrets are a soaring problem for virtually any
software-driven company: they are copied and shared across
environments with little to no control, and they pose a major
threat to companies. We found out last year^[6]
that application security engineers are totally overwhelmed by the
sheer number of credentials found in codebases: 3.4K secrets
occurrences on average per engineer.

Building on this audit capacity to provide SOC analysts with
actionable insights would immediately be valuable for any security
team. You can start using the platform for free here^[7].

GitGuardian also offers a public monitoring capacity to
determine the global perimeter of a company on GitHub. More than
6 million secrets^[8]
were found in 2021 alone by our detection engine, doubling the
number from the previous year. Many of these credentials are
corporate secrets made publicly available by mistake.

This monitoring capacity allows for proactively identifying
threats and protecting companies from getting breached.

If you are ready to embrace the industry move towards
security-aware advisory, request a free
demo^[9] to start auditing your
customers’ perimeter on GitHub.