Why Managed Service Providers must take greater responsibility for cyber security

AI-powered cyber attacks are here. But are businesses focusing on the wrong solution?

The National Cyber Security Centre’s latest warning around AI-powered cyber attacks highlights an important challenge for businesses. The headline is rightly going to grab attention. AI is changing the cyber threat landscape and, as the technology develops, the methods used by cyber criminals are likely to become increasingly sophisticated.

However, there’s another takeaway that businesses need to be aware of.

We can talk about AI-powered attacks all day long, but a huge concern is the number of businesses that could already be exposed because the technology protecting them isn’t configured properly in the first place.

The Managed Service Provider (MSP) industry as a whole needs to be honest about that.

Why buying a firewall doesn’t make you secure

Over the years, businesses have invested huge amounts of money in firewalls, endpoint protection, Microsoft 365, backup and other security services. That’s clearly a good thing.

But buying a security product doesn’t necessarily mean you’re secure.

You can have a great firewall, but if it’s badly configured, how much protection is it actually providing?

You can have Microsoft 365, but if you’re not making proper use of the security controls available to you, are you really getting the protection you think you’re paying for?

And you can have endpoint security installed across your estate, but who’s checking that it’s configured correctly, monitored properly and doing what you expect it to do?

That’s where MSPs have a massive responsibility.

Why effective MSPs challenge their customers

Part of being a good technology partner is being prepared to have conversations that customers don’t necessarily want to have.

Nobody wants their IT bill to go up. But equally, if we know a customer’s current firewall, configuration, Microsoft licensing or security setup isn’t where it needs to be, we have a responsibility to tell them.

That doesn’t mean simply selling more products. In fact, this is where our industry sometimes gets the message wrong.

The conversation shouldn’t be: “We’ve got another security product we’d like to sell you.” It should be: “This is the risk we can see in your business. This is why we think it matters. Here’s what we recommend doing about it.”

Whether the solution is a configuration change, replacing outdated equipment, introducing another security control or moving a customer onto something like Microsoft 365 Business Premium, it needs to start with understanding the risk.

Why M365 Business Premium doesn’t automatically make you secure

We still come across businesses using Microsoft 365 primarily as email, Teams and Office applications. But the conversation has moved on.

For the right SME, Business Premium isn’t simply about getting another Microsoft licence. The real opportunity is using the security capabilities available within the platform to improve how identities, devices, endpoints and email are protected.

The truth is, Business Premium is only as effective as the way it’s configured and managed.

The technology still needs configuring properly. Policies need implementing. Devices need managing. Security controls need reviewing.

And somebody needs to take responsibility for making sure all of that continues to work as the customer’s business and the threats around them change.

Why AI threats highlight the importance of the basics

This is where the AI threat conversation becomes really interesting.

Businesses shouldn’t only be worrying about some incredibly sophisticated AI-generated threat coming over the horizon. They should be asking a much simpler question: if an attacker came looking for weaknesses in our business today, what would they find?

An unnecessary open port? An old firewall rule nobody wants to remove because nobody remembers why it was created? A device that isn’t properly managed? A security policy nobody has reviewed recently? A Microsoft tenant where better security controls are available but haven’t actually been switched on or configured?

These things aren’t as attention-grabbing as the dangers of AI-powered cyber threats. But they’re exactly the sort of things we need to get right.

Where MSPs prove their worth

The role of an MSP is changing. Keeping the lights on isn’t enough anymore. Responding quickly to tickets isn’t enough. Installing some security software and moving on isn’t enough.

Our customers trust us with their businesses. That means we should be constantly looking at their environment and asking: “If this was our business, would we be comfortable with this level of risk?” If the answer is no, we need to say so.

Sometimes customers won’t take our advice. That’s their decision, and there will always be a balance between cost, practicality and risk. But our job is to make sure they’re making that decision with their eyes open.

The final word

The AI cyber threat is absolutely real, and businesses should take the NCSC’s warning seriously.

But the answer doesn’t begin with rushing out to buy the latest AI-powered security product. It starts with getting the basics right.

Configure the technology properly. Review it regularly. Replace things when they’re no longer good enough. Use the security capabilities you’re already paying for. And, where the existing technology genuinely doesn’t provide enough protection, have an honest conversation about investing in something better.

For MSPs, that might occasionally mean having a difficult conversation with a customer.

We would much rather have that conversation today than see a customer suffer a cyber attack because known risks weren’t addressed.