Nearly Half of SMBs Now Lean on Their IT Provider as Acting CISO

Most small businesses will never hire a full-time CISO, the executive who owns cyber risk. New industry research says many already get that leadership from their managed service provider (MSP) — whether the relationship is labeled that way or not.

What’s new

A 2026 survey of 800 MSPs (including 200 in the U.S.), published by a large endpoint-protection vendor, finds that providers estimate 46% of their customers currently rely on them to act as CISO. 84% of MSPs expect demand for that guidance to grow over the next 12 months. Nearly every provider already does some compliance work, and more than half say they manage customers’ full compliance programs — yet few deliver a complete, end-to-end approach, and many stitch reporting together across several tools by hand.

The headline for owners is simple: cyber-risk leadership is shifting from “someone we’ll hire later” to “the partner who already runs our technology.”

Why San Antonio SMBs should care

If your IT provider is already answering “are we compliant?”, “what should we buy next?”, and “what do we tell the board or insurer?”, they are doing CISO work. That is good when the relationship is intentional. It is risky when it is accidental — no written risk priorities, no clear compliance scope, and no single place that shows where you stand over time.

South Texas medical, finance, and professional firms feel this first: HIPAA/WISP expectations, cyber insurance questionnaires, and vendor reviews all assume someone owns the answers.

Practical next steps (this month)

1. Name the owner — even if that owner is your IT provider. Put it in writing: who decides risk acceptances, who owns MFA and backups, who answers insurer and auditor questions.
2. Ask for a one-page snapshot — top risks, what’s patched, what’s still open. If the answer takes three portals and a weekend of screenshots, the operating model is the problem.
3. Tie compliance to purchases — when a new firewall, network device, or SaaS tool is proposed, ask which requirement or risk it closes.
4. Keep identity basics non-negotiable — MFA, least privilege, tested backups, and segmented guest networks still stop more real incidents than a fancy title.
5. Decide what “CISO services” means for you — advisory only, full compliance program management, or day-to-day operations. Scope drives cost and accountability.

Nice2GeekYou supports on-site work across Texas (fiber, Cat6, racks) and remote managed IT clients nationwide with the same foundation: clear ownership, measurable IT hygiene, and compliance that fits how the business actually runs. Request a quote.

Sources: Industry news coverage of the survey (Sept. 16, 2026) · Survey publisher’s press release