Inside the room: How channel leaders are rethinking defence against business email compromise
Earlier this month, a select group of senior MSP and channel leaders gathered at The Ivy City Garden, Liverpool Street, for a private, invite-only CRN roundtable dinner, hosted in partnership with Huntress
Held under Chatham House rules, the discussion brought together decision-makers from across the UK channel to candidly examine one of the most financially damaging and persistently underestimated threats facing customers today: business email compromise (BEC).
This was not a presentation-led session. Instead, it was an off-the-record, peer-level conversation focused on what is actually working, where MSPs are still exposed, and why identity has become the front line of defence, hosted by CRN deputy editor Kelsey Rees.
Channel cybersecurity conversations are changing with end users
“We’re having harder conversations with our customers than we’ve ever had on their business’ cybersecurity strategy,” one partner MD told the group.
“It’s clear customers are struggling to have what I’d call the right mindset approach to security – it’s no longer enough for them to tell their staff that having two-factor authentication is everything. Maybe five years ago that was progress, it’s not now with bad actors adapting to AI tools.”
One of the actionable pieces of advice from a MSP group MD is to bring more decision-makers to the table within customers, and not shy away from the message that traditional IT conversations around cybersecurity need to adapt.
“My advice is that we have to include other leads in our customers like the CFO to get them to understand email security is a finance decision. It absolutely is. One of the ways is to talk about the cost of insurance or escalating business survival costs from a breach.”
UK PLC and cybersecurity
The team from Huntress agreed the conversation with customers is evolving.
Rather than the business being at risk of random payments from potential breaches, getting the right technology and human training best practices in place will help future-proof businesses.
Particularly with the likelihood of breaches being a matter of when not if.
It’s a critical risk that the UK government also recognises.
UK businesses face a record-high, "perfect storm" of cybersecurity threats in 2026, driven by AI-powered phishing, sophisticated ransomware, and supply chain vulnerabilities.
At the start of this year, the new Cyber Action Plan was launched backed by more than £210m of central investment.
However, CRN reporting has found that many in the channel believe this investment is not enough to protect data and critical services from escalating cyber threats.
This puts even more pressure on MSPs and VARs to be a key defence.
The answer to this requires nuance.
The group agreed that the channel needs to anchor customer messaging in defence of depth: the idea that no single tool stops modern attacks, so layered security - backed by humans - is essential.
BEC and the multiple layers of cybersecurity
This was a common theme for partner leaders around the table: bad actors have adapted faster than end user customer behaviours.
And that human‑led detection matters more than automated alerts.
“Look at our SMB market customers – the maturity level varies wildly.” Another VAR MD added.
“Our role as MSPs is to increase the maturity level wherever we can, even if it’s from a position of zero, or from a position of them already having several layers of security in place – we have to make it clear, standing still is just not fit for purpose to prevent business email compromise and breaches.”
“Training is key, that’s the foundation – but then you have to validate the training you gave them a year ago. Are they doing regular training? Have they done simulations to test - are the human behaviours effective when they’re opening their email six months on from the training?”
Several partners mentioned the human pressure to comply with spoofing attacks what can appear to be from senior leadership.
“We have had to take the approach even within our own business as a MSP – let alone with our customers – that we have a “we will never do this” conversation with staff. We’re trying to give them the confidence to question certain demands they may see come through via email.”
The biggest challenge everyone around the table said they face is that the majority of customer engagement in the cybersecurity channel is about prevention. How do you put a price on prevention in the minds of some customers? It’s not the same as promising the customer you’re keeping the lights on directly.
“The analogy I sometimes use is you don’t know how much you’re going to cost the NHS until you’re actually ill. Likewise, until you’re hacked you can’t really anticipate how great the cost will be to your business. And actually, as an MSP we’re finding that customers consistently underplay the likely consequences of breaches,” added another MSP director.
As the discussion made clear, stopping business email compromise can no longer rely on any single control or point solution.
From user training and email filtering through to identity monitoring and response, MSPs and VARs around the table repeatedly returned to the need for multiple, reinforcing layers of defence, backed by human insight when something slips through.
Huntress’ role in this model is to sit across those layers, providing visibility into how identities behave once inside the environment and responding when traditional safeguards fail. It’s an approach increasingly resonating with partners under pressure to deliver not just prevention, but confidence that suspicious activity will be detected and acted on, day or night.
If you’d like to explore Huntress’ position in more detail, and hear directly from their security experts on how MSPs can tackle identity‑led threats like BEC in practice, you can watch their in-depth CRN webinar.