“SMB cybersecurity spending is projected to reach $109 billion in 2026, with small and medium businesses accounting for roughly 60% of global cybersecurity spend,” according to Analysys Mason — a scale of demand that, the source argues, shifted what service providers must buy and build to run security practices.
SMB scale and the MSP as the security function
The core shift is simple and structural: most SMBs that pay for security do not have an internal CISO, so the managed service provider is the de facto security function. That reality, combined with a growing share of global cybersecurity spend flowing through service providers, means the tools an MSP needs are no longer the consultant-oriented “vCISO” toolset or the one-customer focus of enterprise compliance platforms. The work has expanded from point-in-time advisory engagements to continuous program delivery across a portfolio of clients.
Three structural gaps: GRC platforms, vCISO tools, and enterprise-first platforms
The source lays out three gaps that created a distinct market tier. First, enterprise GRC and compliance automation platforms are architected for a single customer with internal security teams; recent repositioning in that tier toward agentic AI and trust automation makes them more end-customer centric, not partner-delivery centric. Second, standalone vCISO tools were built for one senior consultant — assessment templates, advisory frameworks, and reporting decks — and lack the compliance depth and automation needed to run continuous programs across dozens or hundreds of SMB clients. Third, enterprise-first compliance platforms sell direct to customers and treat MSPs as referral channels, shifting economics away from the service provider running the program. Together, these structural choices left a commercial and technical white space for a new platform tier.
Five capabilities that define a Security Growth Platform
- CISO Intelligence built in: decision-making logic of an experienced security leader integrated into AI infrastructure and guided workflows so any trained team member can deliver senior-level advisory outcomes.
- Unified security, risk, and compliance across 40+ frameworks: one assessment maps controls across frameworks including NIST CSF 2.0, CIS Controls, ISO 27001, SOC 2, HIPAA, CMMC, GDPR, NIS2, and DORA, making compliance an outcome of the security program.
- Complete security lifecycle management: context-aware onboarding, risk-based prioritization, automated remediation roadmaps, task-driven execution, policy automation, business impact analysis, business continuity planning, third-party risk management, and executive dashboards in a single system.
- Portfolio-level revenue intelligence: a multi-tenant view across the partner’s client base that maps security gaps to the partner’s service catalog and quantifies recurring-revenue expansion opportunities.
- Built for MSP and MSSP scale: multi-tenant architecture, white-label outputs, “no channel conflict,” and designs that support portfolios from 15 to more than 500 clients under a 100% partner-only commercial model.
What this means for MSPs, MSSPs, and SMB buyers
MSPs: The gap is operational and commercial. Providers that built vCISO practices around single engagements still need portfolio visibility, service-catalog mapping, executive-ready reporting, and pricing/commercialization infrastructure to turn delivery into recurring revenue. Research cited from CompTIA and Service Leadership shows partners often buy tools faster than they package and sell services; the Security Growth Platform tier is explicitly engineered to close that commercialization gap.
MSSPs: Scale and multi-tenant management are central. Platforms in this tier prioritize architecture for dozens to hundreds of clients, white-label outputs, and “no channel conflict,” meaning the commercial model is partner-only rather than competing with end-customer sales.
SMB buyers: Because most SMBs lack an internal CISO, the MSP is the security function. Enterprise-first compliance platforms that sell direct can treat MSPs as referral channels and shift economics away from the service provider. The Security Growth Platform model reframes compliance as an outcome of continuous program delivery rather than the primary sales entry point.
Market tiering, benchmarks, and outcomes
The market now sorts into four tiers: an enterprise tier (direct-sales compliance for mid-market and growth-stage firms), an MSP-native Cyber GRC tier (compliance tracking), an advisory/assessment tier (vCISO-like, lower scope), and the Security Growth Platform tier whose center of gravity is continuous program delivery and commercialization at portfolio scale. Cynomi is named in the source as an example of the latter tier and of the choices that define it.
The source reports practitioner outcomes from partners running programs through Cynomi-aligned platforms: an average 70% reduction in assessment and reporting workload, a 30% margin improvement on security services, 60% security revenue growth, and 90% shorter discovery time. Those metrics are presented as practice-level outcomes rather than pilot results.
For buyers who began by asking “which vCISO platform should we use?” the question has shifted: “how do we deliver, scale, and grow a security practice across our entire client base?” The Security Growth Platform tier, the source argues, is the software category built to answer that question.
https://thehackernews.com/2026/06/the-security-growth-platform-why-msps.html
