The call every MSP dreads

It usually starts with a phone call.

A client’s email has been hijacked. Or a payment went to the wrong bank account. Or the office files are suddenly locked and there’s a ransom note on the screen.

Then comes the question: “Why didn’t you stop this?”

It doesn’t matter that security was never in your contract. It doesn’t matter that you recommended an upgrade last year and the client said no. In the client’s mind, you look after their IT. So when something goes wrong, it’s on you.

Most MSPs have had some version of this call. Over the next few years, many more will. Here’s why, and what you can do about it.

AI has changed the game for attackers

Attacking a small business used to take time and skill. AI has made it cheap, fast and easy to repeat. Over the next 2–5 years, expect four things to become normal.

Phishing that knows your client’s business. The old scam emails were easy to spot: bad grammar, odd requests, strange senders. AI-written emails can mention a real supplier, a real project and a real deadline. They read like they came from someone inside the company.

Voices and messages that sound exactly right. A short voice clip from a video or a voicemail is enough to clone someone’s voice. Picture the accounts team getting a call from the “owner” asking for an urgent payment. Most staff would do it.

Scanning that never stops. Automated tools search the internet day and night for exposed routers, open ports and unpatched devices. They don’t care how big the business is. They only care whether the door is open.

Attacks that adapt. When one approach fails, AI-driven tools try another, and another. Defences that rely on someone noticing something odd fall behind quickly.

The common thread is scale. Attackers no longer have to choose between big targets and small ones. They can go after everyone at once.

Now look at your own clients

Think about the small businesses you support. You’ll probably recognise a few of these:

• The router the ISP installed five years ago, still on its default settings
• Laptops and phones nobody has checked since the day they were set up
• Staff who connect personal devices to the office Wi-Fi
• A guest network that isn’t really separate from the main one
• No one watching what’s happening on the network, so problems surface only when something breaks
• An owner who says, “We’re too small to be a target”

This isn’t carelessness. It’s how most small offices grow. The network gets set up once, it works, and nobody touches it again.

That was fine when attacks were manual and aimed at big companies. It isn’t fine anymore.

Why small businesses don’t act

If you’ve raised security with a small client, you’ve heard the answers.

“We don’t have the budget.”

“It’s too complicated for us.”

“Nothing has happened so far.”

After 20+ years in cybersecurity, I don’t think small businesses ignore security because they don’t care. They ignore it because of what they’ve been offered.

Most security products were designed for companies with an IT department. They come with long setup, complex dashboards and pricing built for large budgets. A 15-person office looks at that and decides it isn’t for them.

So they do nothing. Not because the risk is low, but because the options don’t fit.

Why the problem lands on you

Here’s the uncomfortable part for MSPs. Your client may not pay for security, but they still expect it.

To a small business owner, “IT” and “security” are the same thing. You set up their laptops, their email and their network. So in their eyes, you’re responsible for keeping the bad guys out.

When an incident happens, three things usually follow:

1. You spend days cleaning up, often without being paid for most of it
2. The client’s trust in you takes a hit, even if you warned them
3. The relationship becomes harder to keep, and sometimes it ends

You carry the risk either way. The only question is whether you get paid for managing it.

The opportunity: security as a service you already own

The same situation that creates the risk also creates an opportunity.

Your clients already trust you. They don’t want another vendor, another dashboard or a security person they can’t afford. They want someone they know to take care of it, at a monthly cost they can plan for.

That someone can be you.

Instead of treating security as a one-off project or an awkward upsell, treat the network itself as a managed service. Every client network becomes secure, monitored and looked after, and you bill for it every month.

This changes the business in a few ways:

• Recurring revenue instead of waiting for the next break-fix call
• Fewer emergencies, because problems are blocked or spotted early
• Stronger client relationships, because you’re preventing trouble, not just cleaning it up
• A clear answer when a client asks, “Are we protected?”

The key is that it has to be simple. If it takes a security specialist to deploy or run, it won’t scale across dozens of small clients. It needs to be something your existing team can roll out site by site, without enterprise complexity.

Where to start

You don’t need a big security practice to begin. A few simple steps go a long way.

1. Pick your most exposed clients. Start with the ones who handle money or sensitive data, such as accounting firms, clinics and small finance offices.
   
2. Show them, don’t tell them. A quick check makes the risk real. For example, run the free DNS security test at mydnstest.com from the client’s office. It needs no install and no email address.
   • mydnstest.com
     
3. Talk about the business, not the technology. Owners don’t care about ports and protocols. They care about missed payments, locked files and lost clients.
   
4. Offer a simple monthly plan. One clear price for a secure, managed network is far easier to say yes to than a list of products.
   
5. Report back regularly. A short monthly note on what was blocked and what was checked reminds the client what they’re paying for.

Start with one or two clients. Once the process works, roll it out to the rest.

Protected, not just warned

AI is widening the gap between what attackers can do and what small businesses can defend against. That gap won’t close on its own.

Small businesses shouldn’t need a security team or enterprise-level complexity to stay safe. They need someone they already trust to make it simple. For most of them, that’s their MSP.

That’s the gap we’re building Cybird to help MSPs close.

Small businesses deserve to be protected, not just warned. MSPs are the ones who can make that happen.

If you’re an MSP, what’s the biggest thing stopping your clients from investing in security today? I’d like to hear what you’re seeing.