MSPs say 46% of their customers now look to them for CISO-level leadership

"CISO-level" in the report means specific work: assessing how controls perform, managing compliance programs, and helping customers understand risk, prioritize security investment, demonstrate compliance and verify their security posture ^[11]. The 46% is the providers' own estimate of what their customers want from them, and the customers themselves were not surveyed ^[1]. Sophos writes that MSPs are "now the de facto CISO for many of their customers, and demand is only expected to increase" ^[12].

Thirty-one percent can fully automate reports at speed, and 69% cannot ^[7][15]. Fifty-five percent still need some manual effort to consolidate activities, including those already using automation ^[8]. Slightly over half, 53%, run that consolidation across multiple tools or platforms ^[6]. On breadth, 99% sell at least one compliance service and 6% sell all seven the report counted, so 94% are running a partial practice ^[3][4][16].

That manual step sits between an auditor's request and the answer. The report says compliance influences 50% of customer purchasing decisions ^[5]. It also says each additional customer, framework, assessment and reporting requirement needs more resources and more governance, and that providers who add service volume without addressing the complexity risk putting pressure on already stretched teams ^[9]. Nothing in the report describes an intrusion.

Sophos sells security tooling to MSPs, and the report's closing section is headed "The untapped opportunity: unification and scale" ^[13]. The blog post summarizing the findings gives no respondent count and no detection-coverage figures ^[14]. What the numbers support is narrow: among the providers surveyed, compliance breadth reaches all seven services in 6% of cases and reporting is fully automated in 31% ^[4][7].

The report's own diagnosis is that compliance practices remain incomplete, delivery is fragmented across different tools, and much of the reporting process still requires manual effort ^[10]. All three problems belong to the provider, and the customer is the one buying risk judgment from it.