TL;DR: MSPs are expanding service portfolios and leaning harder on cloud marketplaces, while 98% say they need to improve internal security posture and 9 in 10 want better AI knowledge and application, according to Barracuda research. Growth now depends on whether providers can govern their own access, tooling, and service expansion without weakening trust.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Barracuda's report: MSPs are adding services and relying more on cloud marketplaces, but most say their internal security posture and AI capability still need improvement.
Why it matters: MSPs often sit inside their customers' identity and access paths, so weak internal governance can quickly become a third-party risk multiplier across accounts, tooling, and delegated access.
By the numbers:
- 97% of MSPs surveyed expect to increase their service portfolio with around six new services on average in 2024.
- 92% of respondents identified cloud marketplaces as a crucial tool for strengthening their go-to-market strategy.
- 98% of MSPs believe they need to improve their internal security posture.
- 9 in 10 of the MSPs surveyed say they need either significant or notable improvements in knowledge and in the application of AI products/services.
Context
Managed service providers are operating as outsourced trust anchors for many customer environments, which makes their own governance posture a direct extension of their clients' security boundary. When providers add services quickly, the pressure shifts from simple delivery to disciplined control over access, tooling, and operational consistency.
Cloud marketplaces, AI services, and broader managed offerings all increase the number of systems and identities a provider must govern. MSP security and trust becomes a practical issue when a provider's growth strategy outpaces its ability to control delegated access and internal assurance.
Key questions
Q: How should MSPs govern service expansion safely?
A: MSPs should tie every new service to a defined access model, operational owner, and revocation process before it is sold or deployed. Service expansion becomes risky when delivery outruns governance, because new tools and integrations create more privileged paths into both the provider and customer environments.
Q: Can cloud marketplaces increase third-party risk for MSPs?
A: Yes. Cloud marketplaces can increase third-party risk for MSPs because they expand the chain of software, APIs and delegated access behind a customer deployment. The main controls are vendor due diligence, least-privilege IAM for service accounts, scoped API tokens, contract review, and clear provisioning and revocation of marketplace subscriptions, entitlements and support access.
Q: How does AI adoption affect managed service governance?
A: AI adoption changes managed service governance by adding model risk, data handling controls, human accountability for agent actions and tighter review of automated decisions. Providers need policies for approved models, prompt and output logging, access limits on training and inference data, incident escalation, and human approval for high-impact changes or autonomous actions.
Q: What should providers measure to prove their security posture?
A: Providers should measure control coverage, access scope, asset inventory completeness, patch and configuration compliance, logging coverage, privileged access review results, and incident response readiness. A security posture claim is strongest when these measures show how identities, secrets, endpoints and cloud workloads are governed, monitored and recovered, rather than when it relies on broad policy statements.
Technical breakdown
Why MSP expansion increases control surface
As MSPs broaden their portfolios, they add more administrative pathways, more customer-specific configurations, and more third-party integrations. That creates a larger control surface, not just a larger revenue base. Security posture has to cover provider tenants, delegated access, internal staff permissions, and service delivery workflows at the same time. The main issue is not scale alone, but the mismatch between faster service growth and slower governance maturity. See the Cybersecurity for MSPs and MSSPs Guide.
Practical implication: Map every new managed service to the identities, permissions, and tooling it introduces before it goes live.
Why cloud marketplaces change the go-to-market model
Cloud marketplaces reduce friction in procurement and deployment, but they also blur where provider responsibility ends and customer governance begins. If a service is provisioned through marketplace channels, the provider still has to manage permissions, billing links, tenant boundaries, and the operational controls behind the service. Marketplace-led growth is therefore also a governance problem, especially when multiple environments and customer tenants are involved. See the NIS2 Implementing Regulation 2024/2690 Guide.
Practical implication: Treat marketplace distribution as an access and lifecycle problem, not only a sales channel decision.
AI service adoption creates governance debt
AI tools inside MSP operations introduce a different kind of risk because teams need both technical competence and policy discipline. If staff cannot judge how AI products handle data, permissions, or automation, the provider inherits opaque operational risk. This is not only a model-risk issue. It also affects how service desks, SOC functions, and customer administrators use AI-enabled workflows and whether those uses stay inside policy.
Practical implication: Set clear approval, usage, and data-handling rules before AI products enter managed service workflows.
NHI Mgmt Group analysis
MSP growth is now a governance problem, not only a revenue story. The survey points to rapid service expansion at the same time that providers admit their internal security posture needs work. That combination matters because MSPs often hold privileged access into customer environments, so weaknesses inside the provider can cascade outward. The practitioner conclusion is straightforward: service growth must be matched with access governance and operational assurance.
Cloud marketplaces create a trust chain that has to be managed, not assumed. Marketplaces can accelerate distribution, but they also increase the number of identities, entitlements, and tenant relationships a provider must keep under control. The governance challenge is not whether to use marketplaces, but how to keep delegated access, billing integration, and service ownership aligned across customers. The practitioner conclusion is to treat marketplace participation as part of the provider's identity and access model.
AI readiness has become a provider competency test. When 9 in 10 MSPs say they need better knowledge and application of AI products and services, the issue is not curiosity, it is operational capability. AI adoption inside managed services can amplify misuse, poor data handling, and opaque automation unless the provider sets rules early. The practitioner conclusion is to govern AI use as part of service delivery, not as an informal productivity layer.
Provider trust depends on the weakest internal control that customers never see. A managed service business can look commercially mature while still carrying immature identity hygiene, inconsistent segmentation, or weak oversight of third-party tooling. That is why internal security posture becomes a commercial differentiator even when it is not visible in the buying process. The practitioner conclusion is to measure provider assurance with the same discipline used for customer-facing controls.
What this signals
Provider assurance now sits inside the sales motion. MSP buyers increasingly evaluate whether the provider can govern its own access, tenant boundaries, and service delivery before they trust it with additional workloads. The market signal is that internal security posture is becoming part of commercial credibility, not a separate compliance exercise.
Managed service growth will keep exposing governance debt. As portfolios expand, the weakest point is often the internal operating model rather than the customer solution. The providers that separate service launch speed from access governance will be better positioned to scale without accumulating hidden trust risk.
For practitioners
- Inventory every managed service against its access model Document which identities, consoles, tenants, and privileged workflows each new service introduces, then review them before launch.
- Separate marketplace distribution from control ownership Define who owns provisioning, revocation, tenant administration, and incident response for marketplace-delivered services.
- Set policy for AI use inside service operations Publish approved use cases, data handling rules, and escalation criteria for AI tools used by engineers, analysts, and support teams.
- Measure internal security posture as a board metric Track provider-side access hygiene, privileged account review, and service onboarding control as part of growth reporting.
Key takeaways
- MSP growth is being constrained by internal governance as much as by demand for new services.
- Cloud marketplaces and AI tools expand the operational surface that providers must control.
- The practical test is whether a provider can scale services without weakening access, tenancy, and lifecycle oversight.
Related NHI Mgmt Group resources: Cybersecurity for MSPs and MSSPs Guide · NIS2 Implementing Regulation 2024/2690 Guide · Co-Managed SOC and SOC-as-a-Service Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | MSP growth increases the number of provider accounts and delegated access paths that need governance. |
| Recommendation — Apply CIS-5 to govern provider accounts, revoke stale access, and standardise lifecycle oversight for managed services. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The report centers on whether MSPs can control permissions as they add services and market channels. |
| GV.RM-01 — Risk Management Strategy | MSP leaders are balancing growth plans against internal security posture and third-party trust risk. | |
| Recommendation — Use PR.AA-05 to review entitlements across provider tenants, customer environments, and service tooling. Embed provider security posture into enterprise risk strategy and reassess it as service scope expands. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Managed services depend on controlling provider and delegated identities across cloud tenants and marketplaces. |
| Recommendation — Apply IAM controls to govern tenant access, delegated administration, and lifecycle ownership for provider identities. | ||
Key terms
- Security posture: Security posture is the current state of an organisation’s defensive controls, governance, and operating discipline. In identity programmes, posture includes MFA, logging, access reviews, privileged access management, rotation, and offboarding. Insurers and auditors use it as a practical proxy for how likely the organisation is to suffer and contain loss.
- Managed Service Provider: A managed service provider is a third party that administers systems, users, or infrastructure on behalf of customers. In identity terms, it often becomes a concentrated trust broker because one provider account can reach many client environments, making governance, logging, and offboarding especially high impact.
- Google Cloud Marketplace: Google Cloud Marketplace is a procurement and deployment channel for cloud software purchased through a Google Cloud account. For security buyers, it can simplify contracting, billing, and commit consumption while keeping procurement aligned with existing cloud commercial relationships and internal approval processes.
- Delegated administration: Delegated administration allows local operators to make approved configuration changes without waiting on a central platform team. It improves speed, but it only remains safe when permissions are narrow, changes are logged, and validation prevents policy drift.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. Explore the course if your programme needs a common language for governing service accounts, secrets, and delegated access.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org