Security Is the MSP Revenue Engine | Assurix

Security ranks as a top revenue source for 52% of MSPs and 71% reported year-over-year growth. The constraint is not selling it. The constraint is proving it.

If you want to know where MSP money is in 2026, Kaseya's new numbers answer it cleanly. Security is the second largest revenue source for MSPs and the fastest growing. The constraint is not selling it. The constraint is proving it.

In Kaseya's 2026 State of the MSP report, which surveyed 1,061 MSPs in November 2025, security ranks as a top revenue source for 52% of MSPs, second only to endpoint and network management. 71% of MSPs reported year-over-year growth in security revenue, the highest of any service category. Backup followed at 50%.

Why is security still the safest place to grow?

Because the demand is structural, not a trend. Kaseya found 61% of MSPs say most or all of their clients turn to them for cybersecurity advice, and 44% reported at least one client suffering a cyberattack in 2025. Clients are not buying security because it is fashionable. They are buying it because their provider is the person they call when something goes wrong, and something is going wrong often.

So what is actually holding MSPs back?

Not the offer. The proof. The same report shows the share of MSPs struggling to demonstrate value to clients nearly doubled, from 10% to 19%. Security is the worst category to be vague about, because the client cannot see any of it until it fails. You can run flawless patching, enforced MFA and tested backups all year and still lose the account to a cheaper provider, simply because the client never saw the work and the competitor told a better story.

There is a revenue line hiding in this. Kaseya's data shows regulatory compliance is offered by 42% of MSPs but lands in the top revenue sources for only 8%. That gap is not because compliance is worthless. It is because most MSPs deliver it as invisible admin instead of as evidenced, billable assurance.

How do you turn invisible security work into defensible revenue?

Make the work visible and independently verified. Three moves:

• Report security outcomes to the client monthly in their language, not raw tool output. Risk reduced, incidents prevented, backups proven.
• Get an independent party to verify your controls are met now, so the client is not relying on your word during a renewal conversation.
• Price the assurance as its own line, not as something bundled and forgotten inside the managed services fee.

The read for the next 12 months

Security revenue is growing faster than anything else MSPs sell, and the buyers are more sceptical than they have ever been. Those two facts together mean the MSPs that win the security budget are the ones who can prove the security, not just deliver it. If a client is going to ask you, or worse ask a competitor, what your security actually looks like, the playbook on handling that conversation is worth reading next.

One caveat on the numbers. Kaseya's sample is global and North America heavy, so treat the figures as directional rather than a precise UK cut. The direction holds: security sells, proof decides who gets paid for it.

A concrete example of invisible work losing a deal

An MSP runs enforced MFA, weekly tested backups and same-day patching for a 50-seat client for three years with zero incidents. Renewal comes up. A competitor quotes 15% less and says all the same words. The client cannot see any difference between the two, because the incumbent never showed the work, so they switch to save money. The security was excellent. The proof was absent. The account still left.

Now run it the other way. The incumbent has sent a monthly outcomes report all year and holds an independent verified status. The competitor's lower quote now reads as a risk, because the client can see exactly what they would be giving up. Same work, opposite outcome, and the only variable that changed is proof.

The money is in security. The win is in proof. Make the work visible, get it independently verified, and price it like it matters. That is what Assurix is for.