The 2026 State of MSP Threat Report
The 2026 State of MSP Threat Report analyzes key threats across ITDR, email, endpoint, cloud, and AI-powered attack vectors observed by the Guardz research team.
Get the full breakdown
Trusted by Leading Partners
Key findings at a glance
Identities are the most attacked vector in 2026 but a closer look at email, cloud providers, ransomware and more,
reveal some interesting trends that every MSP should know.
190% Ransomware behavioral detections surged
~23% Session hijacking incidents increased
#1 RMM abuse was the leading threat campaign
28% rely on informal
processes
Reveal full data in the report
Reveal full data in the report
Ransomware behavioral
detections surged
detections surged
0
%
Session hijacking
incidents increased
incidents increased
~
0
%
RMM abuse was the
leading threat campaign
leading threat campaign
#
0
SMBs have
compromised users
compromised users
0
%
Users with compromised
passwords
passwords
~
0
%
Confirmed BEC incidents
analyzed this year
analyzed this year
$
0
M
Threat Risk Assessment Matrix
The table below provides an overview of the top five campaign threats and business impact by severity level and evasion capabilities.
Conclusion
Attackers are logging in, not breaking in. With 89% of SMBs having at least one compromised user at any given moment, identity is the primary attack surface, and one compromised MSP environment can mean dozens of breached clients. Lock down identity, eliminate legacy protocols, audit OAuth grants, and monitor RMM deployments. In this environment, every trusted tool is a potential attack vector.
Experience The Power
Of Unified
Detection & Response
- 14-Day Free Trial
- No Credit Card Required
