As an MSP, you spend a lot of time helping clients improve their cybersecurity as you assess their systems and identify vulnerabilities.
But how much attention do you give your own security? If a client asked for evidence of the measures you have in place, how easily could you provide it?
MSPs have access to some of their clients' most sensitive systems and information, so it's understandable that businesses want reassurance about the security of the providers they work with.
Being able to demonstrate your own security standards could become increasingly important, especially as more organisations start paying closer attention to the risks associated with their suppliers. We explore this further in this article
Why MSPs need to look at their own security
MSPs are an attractive target for cybercriminals because of the level of access they have to their clients' systems.
Administrative credentials, remote management tools and access to cloud environments are all essential to providing managed IT services. Unfortunately, they can also give attackers a route into multiple businesses if an MSP's own systems are compromised.
The 2021 Kaseya VSA attack is a well-known example: attackers exploited vulnerabilities in remote management software used by MSPs, with an estimated 800 to 1,500 downstream businesses affected worldwide.
In 2022, the National Cyber Security Centre (NCSC) published guidance specifically aimed at protecting MSPs and their customers.
The NCSC is now telling small businesses what to ask for. Its guidance on choosing an MSP, published in November 2025, points clients to certifications such as Cyber Essentials Plus, ISO 27001 or SOC 2 and also tells them to check that a provider uses two-step verification on its own accounts and has a tested incident response plan.
Those are the questions your clients may start putting to you.
The risks have been recognised for years, but there's still an important question for MSPs to consider. Are you taking the same precautions with your own business that you recommend to your clients?
Clients want reassurance about supplier security
Businesses are becoming more aware of the security risks associated with third-party suppliers, including the IT providers they rely on.
The government's Cyber Security Breaches Survey 2025/26 found that just 15% of UK businesses formally review the cybersecurity risks posed by their immediate suppliers. Only 6% assess the risks associated with their wider supply chain.
There's clearly still a lot of room for improvement, and MSPs should be prepared for clients to ask more detailed questions about their security arrangements.
A new domain, an expired certificate or an overlooked configuration change could all affect how secure your business appears from the outside.
Supply Guard's SupplierLens scoring can help. It assesses publicly visible security information to give you a clearer picture of your business's external security posture, including areas that may need attention.
Combined with ongoing monitoring through Supply Guard, it gives you a way to keep track of changes between formal assessments.
Don't overlook your email security
According to the Cyber Security Breaches Survey 2025/26, phishing remains the most common type of cyber-attack, affecting 38% of UK businesses. Among businesses that experienced a breach or attack, 69% identified phishing as the most disruptive type.
It goes without saying that for MSPs, the potential consequences of an email security weakness are very concerning.
Clients receive emails from their IT provider and are likely to trust communications that appear to come from them, making impersonation a serious risk.
Email authentication measures such as SPF, DKIM and DMARC help protect against domain spoofing, but they need to be configured correctly.
These records are publicly accessible, which means gaps in your email configuration can also be identified by someone assessing your business from the outside.
Checking your own domain is a sensible place to start, especially if email security is something you already advise clients on.
Start by assessing your own business
Before introducing supplier security scoring to your clients, it's a good idea to see what the process reveals about your own organisation.
You can start by requesting a SupplierLens score for your business. It gives you an overview of your publicly visible security posture and highlights areas where improvements may be needed.
Review the findings, address any issues you identify and keep track of the changes you make. You can then use that information when discussing your security arrangements with existing clients or prospects.
For example, if a potential client asks you to complete a supplier security questionnaire, having a recent external security assessment alongside your existing certifications and documentation could make the process easier.
It also gives you an opportunity to explain how you monitor your own security and what you're doing to address any weaknesses.
There's a commercial opportunity here, too. If you're already helping clients manage their cyber security, supplier risk monitoring could be a useful addition to your services.
With Supply Guard, you can assess the security posture of your clients' suppliers, monitor for changes and identify issues that may need further investigation or remediation.
Having gone through the assessment process yourself, you'll be in a better position to explain the findings and show clients how the service could work for their business.
How would your business score?
Clients rely on MSPs to help keep their businesses secure, so it's reasonable for them to expect their IT provider to take its own security just as seriously.
You should identify areas for improvement, monitor changes and have more informed conversations with clients about the measures you have in place.
If you're considering offering supplier security assessments as a service, your own business is a good place to begin.
Learn more about Supply guard and book a demo here.
