Managed service providers are increasingly acting as the de facto Chief Information Security Officer for nearly half of their customers, according to Sophos‘s 2026 MSP Perspectives Report, with demand for the role expected to keep rising.

The global cybersecurity firm’s survey of 800 MSPs across the United States, United Kingdom, Germany, France, Singapore, Australia and Brazil found that MSPs estimate 46 per cent of their customers currently rely on them for CISO-level guidance, while 84 per cent expect demand for that role to grow over the next 12 months.

Compliance is driving the shift

Compliance obligations, rather than technology alone, are increasingly shaping how customers make cybersecurity investment decisions, the report found. On average, compliance influences 50 per cent of customer cybersecurity purchasing decisions, with a third of MSPs saying it heavily or decisively drives those decisions. Yet only 33 per cent of MSPs said they feel completely confident in their ability to continuously monitor, manage and document compliance across multiple customers at once.

“Organisations require more than technology management to stay secure. They need trusted cybersecurity leaders who can help them understand their risk, navigate compliance requirements and translate security investments into meaningful business outcomes. MSPs are already stepping into this role for nearly half of their customers, creating a significant opportunity to deepen relationships and develop new, higher-value services,” said Scott Barlow, Vice President and Chief Evangelist at Sophos.

Fragmented tools are slowing things down

Nearly all MSPs surveyed, 99 per cent, offer at least one compliance service, and 58 per cent offer full compliance programme management — but just 6 per cent deliver the full range of compliance services the research evaluated. More than half, 53 per cent, rely on multiple tools or platforms to manage cybersecurity compliance and CISO-type activities, which the report says makes delivery harder to scale consistently.

MSPs estimate they could save 53 per cent of their time with a single, unified platform for security posture and compliance management, with 81 per cent believing it would cut their current workload by more than 30 per cent. Sophos plans to address this with Sophos CISO Advantage, a service launching in October 2026 that uses agentic AI to support board-ready reporting and compliance workflows for MSPs.