Topic starter
11/11/2026 5:57 pm
TL;DR: MSPs are expanding service portfolios and leaning harder on cloud marketplaces, while 98% say they need to improve internal security posture and 9 in 10 want better AI knowledge and application, according to Barracuda research. Growth now depends on whether providers can govern their own access, tooling, and service expansion without weakening trust.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “The Evolving Landscape of the MSP Business”.
By the numbers:
- 97% of MSPs surveyed expect to increase their service portfolio with around six new services on average in 2024.
- 98% of MSPs believe they need to improve their internal security posture.
- 9 in 10 of the MSPs surveyed say they need either significant or notable improvements in knowledge and in the application of AI products/services.
Key questions
Q: Can cloud marketplaces increase third-party risk for MSPs?
A: Yes. Cloud marketplaces can increase third-party risk for MSPs because they expand the chain of software, APIs and delegated access behind a customer deployment. The main controls are vendor due diligence, least-privilege IAM for service accounts, scoped API tokens, contract review, and clear provisioning and revocation of marketplace subscriptions, entitlements and support access.
Q: How does AI adoption affect managed service governance?
A: AI adoption changes managed service governance by adding model risk, data handling controls, human accountability for agent actions and tighter review of automated decisions.
Q: How should MSPs govern service expansion safely?
A: MSPs should tie every new service to a defined access model, operational owner, and revocation process before it is sold or deployed.
Practitioner guidance
- Inventory every managed service against its access model Document which identities, consoles, tenants, and privileged workflows each new service introduces, then review them before launch.
- Separate marketplace distribution from control ownership Define who owns provisioning, revocation, tenant administration, and incident response for marketplace-delivered services.
- Set policy for AI use inside service operations Publish approved use cases, data handling rules, and escalation criteria for AI tools used by engineers, analysts, and support teams.
Bottom line: MSP growth is being constrained by internal governance as much as by demand for new services.
Glossary terms: Security posture, Managed Service Provider, Google Cloud Marketplace, Delegated administration
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
MSP growth is now a governance problem, not only a revenue story. The survey points to rapid service expansion at the same time that providers admit their internal security posture needs work. That combination matters because MSPs often hold privileged access into customer environments, so weaknesses inside the provider can cascade outward. The practitioner conclusion is straightforward: service growth must be matched with access governance and operational assurance.
A question worth separating out:
Q: What should providers measure to prove their security posture?
A: Providers should measure control coverage, access scope, asset inventory completeness, patch and configuration compliance, logging coverage, privileged access review results, and incident response readiness. A security posture claim is strongest when these measures show how identities, secrets, endpoints and cloud workloads are governed, monitored and recovered, rather than when it relies on broad policy statements.
👉 Read our full editorial: MSP growth hinges on stronger security posture and AI skills