The Event
It is 2 a.m. and a client’s systems go down, or worse, get encrypted. The number they call is the one they already have saved: their MSP.
The MSP answers. That is the job, and it gets done. Systems get isolated, backups get checked, something gets restored. Then the question changes shape. Did anything leave the network before it was contained? Does this need to be reported to a regulator, an insurer, or a customer? Is there a version of events that will hold up if a lawyer or an examiner asks about it in six months?
That question sits outside what most managed IT contracts were built to answer. It is not a failure of the MSP. Monitoring, patching, and uptime are one discipline. Containing an active threat and building a record of what happened is a different one. Very few shops do both well, and most were never asked to.
What It Costs
The gap does not show up on a dashboard. It shows up the first time a client needs an answer the monitoring stack was never built to produce, and by then the client is already living through the worst week of their year.
Clients are telling providers this directly, not just feeling it quietly. In WatchGuard’s 2026 survey of the managed cybersecurity market, 47 percent of organizations said they would pay more for 24/7 monitoring paired with rapid incident response. The demand for the response half of that sentence already exists. Whether it is being met is a separate question, and clients are finding out the answer at the worst possible moment to find out.
The same research found that more than half of organizations expect to change cybersecurity providers within the next three years. A live incident with no clean answer is exactly the kind of moment that decision gets made in, and it rarely gets made out loud first.
What to Do This Week
- Know, in writing, what your current stack actually covers if a client calls you mid-incident. Not what the sales deck says. What the SOC would actually do at 2 a.m.
- Find the exact point where “we’re monitoring it” ends and “this needs forensic response” begins. Most shops have never drawn that line on paper.
- Have a name and a number for that second call already saved, so nobody is looking it up while a client is still on the phone.
When to Call Someone
- Any live incident where data may have left the network, ransomware is active, or an insider is involved.
- Anything the client will need documented later for an insurance claim, a legal question, or a regulator.
- The moment the conversation stops being “get us back online” and becomes “tell me exactly what happened.”
Line for the Email
“If something breaks, you already call us first. We built a plan for the calls that go past ‘fix it’ and into ‘what actually happened.’”
References
WatchGuard, From IT Support to Cybersecurity Powerhouse: The New Mandate for MSP Growth (2026). https://www.watchguard.com/wgrd-resource-center/msp-survey-2026