Episode #954 of the MSPi PrimeCast
Cybersecurity continues to evolve, but Ryan Grant of ESET believes some of the biggest opportunities for MSPs begin with getting the fundamentals right.
During his conversation with Joey Pinz, Grant pointed to a concerning reality: many SMBs still lack security measures the industry has discussed for years. For MSPs, that creates an important role—not simply deploying security products, but helping customers build, manage, and maintain a more complete approach to protection.
Here are eight cybersecurity fundamentals from Grant’s conversation that MSPs can put into practice.
1. Build Around an Established Security Framework
Grant repeatedly encouraged MSPs to adopt an established framework such as NIST or CIS. Rather than addressing security one product or threat at a time, a framework provides structure for determining what protections should be in place.
He also sees an opportunity for MSPs to educate customers about that framework and use it to guide their overall cybersecurity approach.
MSP Action: Select an established security framework and use it as a consistent foundation for assessing and discussing each client’s security environment.
2. Move Beyond Basic Endpoint Protection
Grant referenced ESET survey findings indicating that many SMB respondents had antivirus or some form of endpoint protection while other security measures were far less prevalent.
His message to MSPs was clear: basic endpoint protection alone does not constitute comprehensive security.
MSP Action: Review client environments for gaps beyond endpoint protection and determine where additional protections are needed to create more complete coverage.
3. Extend Existing Cybersecurity Practices to AI
Grant specifically advised MSPs not to build an entirely separate AI practice. Instead, he said they should extend their existing cybersecurity practices into the AI tools their customers are adopting.
That includes applying existing security disciplines to new AI-related risks rather than treating AI as an isolated category.
MSP Action: Incorporate AI tools into existing cybersecurity assessments, policies, and client conversations instead of managing them outside the established security program.
4. Strengthen Data Governance and Access Controls
As businesses use more AI tools, Grant sees data governance and access control becoming increasingly important.
He discussed the risk of unauthorized AI use—or “shadow AI”—and the need to control which tools can access company information and how that information is managed.
MSP Action: Work with clients to identify AI usage, review access controls, and determine whether existing data-governance policies adequately cover those tools.
5. Keep Educating the Humans
Technology alone cannot eliminate cybersecurity risk. Grant identified human error as a continuing problem and pointed to increasingly sophisticated AI-enabled phishing attacks.
That makes employee education an ongoing part of cybersecurity rather than a one-time exercise.
MSP Action: Make cybersecurity education a recurring part of the client security program, with particular attention to phishing, data handling, and emerging AI-related risks.
6. Make Sure Security Is Managed and Monitored
Grant pushed back against what he described as a “check the box and let it run” approach to cybersecurity.
Deploying EDR, obtaining cyber insurance, or installing another security tool does not mean the job is finished. Security needs ongoing management and monitoring. He also discussed the importance of having support available when threats occur outside normal working hours.
MSP Action: Review whether every critical security control is actively monitored and determine who is responsible for responding when an issue occurs—including after hours.
7. Talk About Risk With Facts, Not Fear
When discussing cybersecurity with clients, Grant recommended using facts to explain risk while also recognizing the customer’s financial realities.
MSPs can help clients understand the potential operational and financial consequences of a breach without relying on scare tactics. Grant also pointed to cyber insurance as another part of that broader risk conversation.
MSP Action: Frame cybersecurity recommendations around measurable business exposure, operational consequences, financial impact, and the protections a client can realistically implement.
8. Ask Vendors What Happens When Something Goes Wrong
Grant believes the industry spends too much time talking about features, pricing, speeds, and feeds.
One question he wishes MSPs would ask more often is essentially: What do you do when this situation occurs?
For Grant, MSPs should understand how a security platform and its supporting team will respond in a real-world scenario before relying on it to protect customers.
MSP Action: During vendor evaluations, introduce realistic security scenarios and ask vendors to demonstrate how their technology and teams would detect, contain, communicate, and respond.
What This Means for MSPs
One of the strongest themes from Grant’s conversation is that cybersecurity progress does not always require chasing the newest technology.
For many organizations, there is still substantial work to be done around the fundamentals: frameworks, comprehensive protection, governance, employee education, monitoring, risk management, and knowing exactly what security partners will do when an incident occurs.
Grant also expressed optimism about the MSP channel precisely because SMBs cannot be expected to manage all of this themselves. They are focused on running their businesses. MSPs bring the knowledge and ongoing support that can help close those security gaps.
For MSPs, getting the fundamentals right remains an important part of helping customers keep pace with a security environment that continues to change.
Catch the full conversation on MSPi PrimeCast Episode #954 and connect with Ryan at https://www.linkedin.com/in/ryangrant/