N-able Empower 2025: Who are the cyber experts, MSSPs or vendors?

During a press panel in Berlin, Germany at N-able’s annual partner conference, MSSPs and vendor execs debated who really is the cybersecurity lead

Who is the true cybersecurity expert, the vendor or the MSP? Should that extra ‘s’ be added to become a fully-fledged MSSP? Is now the easiest time ever to become an MSP? And the problem with a lack of certifications.

These were the topics debated yesterday during a partner press panel at N-able’s Empower 2025 partner event in Berlin, Germany.

Attended by channel partners and N-able executives, the table discussed some of the top concerns weighing on the minds of the MSPs in the room.

The cohort was posed with a question around MSPs who sell security products and have a service offering - are they actually MSSPs?

And with vendors pushing out security products in the market to MSPs who are taking them to their customers, how is it that MSPs are being perceived?

Are they the security experts, or is that still the vendors in the background being the security leads? And then, how does that work from a marketing position?

“I think it depends on what capabilities MSPs have in-house, what skills and expertise they have to be able to call themselves an MSSP,” said Oliver Spence, CEO of MSSP, CybaVerse.

“You can't just turn around and say, ‘Hey, we're IT people’ one day and ‘now we're security experts’ the next day, just because we changed our job titles.

“Being a security expert comes with training and experience. Lots of different aspects make up that MSSP.

“I think there's real confusion around how they should be positioning themselves with these product stacks in the market.”

However, N-able CEO John Pagliuca plainly stated that these acronyms don’t matter to those who it concerns the most - the customer.

“The customer doesn’t care what letters you call yourselves. And frankly, I don’t think you guys care what letters you call yourselves.

“What the customers are looking for is an outcome and a trusted advisor.”

Meanwhile, Stephen Richardson, CEO of Digital Origin Solutions suggested the added complexity is too much.

“We make a point to back off the ‘expert’ because I already feel the MSP is a jack of all trades anyway.

“Adding another thing to that doesn’t stand in good stead,” Richardson said.

“I think there’s always been an inherent crossover between IT security and operations security that any MSP worth their salt is going to have fundamental understanding of,” stated Paul Cashmore, co-founder of Solace Global Cyber.

“But we're the trusted partner to then put that customer in contact, for example with someone that's going to do security and audit compliance, we're there as a total point.

“The key is the customer doesn't care or understand whether we’re an MSSP or an MSP. As far as they're concerned, they work with us. They expect us to have a handle on the situation.”

Some end user organisations are savvy enough to have their own IT person in-house. But does this help or hinder the MSP, or MSSP even?

“Sometimes a little bit of knowledge can be dangerous,” said Lee Robinson, co-founder & director of Meta Eagle.

“Whereas if there’s someone who doesn’t have as much of an understanding but is willing to work with you, what I've always found helps us is someone who's capable of making decisions.

“Someone you can present the facts to. There's nothing worse than someone in that role that isn't able to either be in the position of power to take the responsibility, or perhaps isn't that good at evaluating the situation.”

Richardson added that the problem with an internal IT person is they’re too inward facing.

“They don't go and test the market. They have that skill set or sit in a room like this.”

Is now the easiest time in history to become an MSP?

With what was once advanced digital resources readily at our fingertips, the table agreed it is the easiest time ever to become an MSP.

All that’s required is a website, a stack from MSP solution vendors like N-able, Kaseya or ConnectWise, outsource some resources to a low cost time zone, hire a few sales people, and boom you’re an MSP.

Perhaps not a very good MSP, but do you need to be?

“The biggest thing that worries me around that is you don't need any sort of accreditation,” said Robinson.

“It comes down to the moment that people buy from people's credibility and reputation.

“There has to be some form of regulation.

“We’re starting to see it with the Cyber Resilience Act, but it still needs to go further.

“I think, similar to other professional services like solicitors or accountancies, where there are accreditations and third party audits, that’s where it needs to go.”

And without the right certifications in place, how do MSPs highlight to customers what good looks like?

N-able VP of partner experience David Weeks started with a company’s track record through its legacy and customers.

“But I think where you're actually going to see the certifications and the desire and the requirement for that come from is not going to be government, it’ll be on the insurance side.”

However, Spence warned of the major difficulties MSP are facing in attaining cyber insurance.

“Most MSPs can’t get cyber insurance because of the risk factor.

“The inherent problem with insurance is it's not mandatory.”