LinkedIn Live- 2025 MSP Horizons Report with Stefanie Hammond and Jeff Nulsen

Doing great, Steph, thank you. Wonderful. Maybe just give everyone a quick introduction about yourself.

Yeah, Jeff Nulsen. I've been here for about four years and, like Stephanie is trying to build sound sales and marketing plans for all of you, I'm trying to do the same thing for N-able. And frankly, Stephanie is my inspiration in a lot of cases, so thank you for that.

Great question. We built it to be a pragmatic set of insights that can be used by MSPs to build their business. The why behind this is because if we're going to show up and have some level of trust and confidence, we've got to understand the space and arm ourselves, not just our marketers but our front lines and our thought leadership, in a way that really does understand where the industry is headed. We took a look around at what was out there. There was a little bit of state of that type of thing. We didn't see a lot of future-looking things. We didn't see a three-year view from anybody. And it was always numbers and good numbers, which is great, and we include that in ours, but we wanted to supplement that with stories, real-life stories, that bring together the numbers and the data with how do you actually take that and make it actionable. So I'll actually be up on stage at Empower, little plug for Empower, April 7th in Berlin. If you haven't got your tickets, please do so. I'll have a panel up there talking about some of these insights, and I'm going to grill them, and you're going to hear some great insights and real-life stories of how they've taken that insight and brought it to life in a way that has demonstrated success.

100%. You got it.

Yep. We partner with Canalys. They've got a great panel and they understand this industry really, really well. Our goal was we need to match the industry in terms of the respondents. There are over 460 responses to this. They range across the globe, just as heavily in Europe as they are in North America, and representative sample from APAC and LATAM, and all shapes and sizes of MSPs. We do have the ability to cut it, and we'll speak a little bit to that today in terms of which segments seem to see differentiation across growth areas. But it's a really well-represented sample.

Well, first of all, it's wonderful to work in an industry that has such strong growth and has such optimism. My take on the optimism is I'll go through why I think it's happening, but I believe that it's really good that we've got these group of MSPs. Actually, less than 5% believe they'll be flatter or declining. It's incredible. There are many industry reports suggesting kind of low teens or 12 to 13% growth overall. You're all a little bit more optimistic than that, and that's not a bad thing. I think that's a good thing. It's a little bit of a warning as well, just to make sure that where you believe the growth is going to come from, you are actually building the plans and you're building teams and accountability mechanisms and all the things that you need to in order to deliver against that. So industry analysts saying 12%, you're all saying many of you at least saying you think you're going to grow greater than 20%. Challenge there is make sure that you're setting yourself up for success. When we talk to MSPs, there really are five different mechanisms for growth. Steph, you are solely responsible for one of them, which is go-to-market. I think you understand this one really well. Folks who invest in go-to-market see growth. It's not easy. You hear about that every day. And by the way, if you haven't, please log in to some of Stephanie's webinars, reach out. I'm sure she'd be happy to chat. She's got incredible insights here. But go-to-market is number one. M&A is number two. New verticals and new channels are three and four. And new services is the fifth thing. These are the things we hear most regularly. The folks who allow themselves the space to step back and think about which of those are they going to invest in, which of those are they most suited for success in, and do they have the product or the service, the route to market, the mechanisms to measure, the mechanisms to test, the space to understand willingness to fail along the way because it will happen. It's those folks who give themselves that space to step back, decide, and really go after one that are having the most success. I heard a great example on the way in this morning. I listen to a podcast, and one of the MSPs was talking about that one week between Christmas and New Year's, and they use that to really reflect on their business and where the industry is heading and to make their double-down decisions. They do it as a leadership group because you've got to drive awareness and commitment internally to find success in those things.

Yeah, really good question. The very straightforward and somewhat obvious answer here is cybersecurity. Of course, there are many flavors of that. But just to give you an idea of what the data suggests, 90% of partners believe that over the next three years, a significant portion of their growth will come from cybersecurity. What's really interesting about that 90% is it splits down the middle. Half of the 90% already have a meaningful portion of their growth coming from cybersecurity. The other half don't. They have a small portion, if any at all, but they're expecting it to grow. What that tells me is that if you're not planning now to position yourself well, you are going to find yourself on the wrong end of that equation with some of your competitors swooping in with cyber, and you finding it even more difficult in the future to catch up because labor has become more scarce, because compliance has become more challenging and more complex, because overall technology and sprawl has become more complex, and bad actors have become more sophisticated. The longer you wait, the harder it is to get into this game. My very strong recommendation is that you lean in now. One way to think about it, because there are so many ways to cut this, is lean in on verticalization. Think about which parts of the market, which industries, could be geographies, but think about industries that you want to serve, and that will be a path to solving multiple challenges for you. I believe growth is chief among them, but we also hear that you are challenged with upskilling your staff, you're challenged with securing infrastructure, you're challenged with customer budgets. If you verticalize and let's say by example you choose financial services as a vertical to go after, you're going to get really good at growth because you've built a product and a service offering that caters to an audience, and you're going to get really good at selling that because you've sold it many times over and each time you're speaking the language and you've built something that is going to meet the need in a really crisp way. You're going to get better at upskilling talent because you focus the team on a specific need that has to do in this case with financial services. They have a specific environment, you'll understand it, and you'll build your skills that way. You'll also be better positioned to secure that environment, which is challenge number three that we hear about, because you again understand it and you're specialized. Lastly, a customer budget challenge. Financial services again, that's one example, but what I hear from MSPs is we don't build a good, better, best packaging when it comes to financial services. We only build a best because compliance and regulations require it, and they cannot go with a good, they cannot go with a better, it must be best. So huge opportunity, really, whether you're small or large, to lean in both on choosing the right tech when you're building your security stack. It's got to be best of breed. You cannot compromise. And building the service around it, whether you're going to do that yourself, which you could, that's expensive and hard and takes time, or if you outsource it through MDR, which is becoming more and more affordable and more and more popular. Doesn't matter if you're small or large, you've got to be leaning in.

It's interesting. We do see the larger MSPs using whether it's MDR or their own instance of a SOC more frequently than the smaller ones. What's interesting though is they both are doing it to a pretty large extent. Almost half of whether you're large or small are planning to lean in on MDR or building a SOC themselves. But the larger ones are about twice as likely to be doing that. I think the warning here for the smaller ones is unless you're specializing in some form or fashion, unless your strategy is allowing you to differentiate and build a moat so that you can not only win business but keep business, there is going to be a real risk when it comes to security if all these other folks are building specialty. Of course, as a smaller shop, it's going to seem harder. Those large shops have more resources, they've probably got a little bit more patience and the ability within their financial model to accept an investment. That is a little bit harder, but you are more nimble and you can specialize and verticalize to a greater extent, so you've got your advantages as well. Both the large and small are leaning in here, but large seem to be doing it at a much faster rate. If you're small, I would be looking at that as a risk and thinking about how do you get ahead of that.

Yes, a great way to say it.

I agree that is a shocking finding, that folks are still thinking about that. I just had a conversation this week on it. To me, it is a minimum aspect of the minimum viable cybersecurity offering that you need to go to market with if you're truly going to claim yourself as somebody who can not only protect but defend and ultimately respond when it comes to cybersecurity, or for that matter, natural disaster or just human mistake. Having not only backup as a requirement but making sure you have the right one is hugely important. The reality is if something goes awry, if there is the worst case and somebody gets into the system, a bad actor, or if there is a natural disaster and the backup's not there, the customer is either not going to remember that you said hey, they turned it down. They're not going to remember that they turned it down, even if you really were forceful and said I really recommend this. That memory is probably going to escape them at that moment. Most MSPs probably recognize this, you'll be on the hook, rightly or wrongly, for that. My strong recommendation would be, and I know this isn't easy, I understand the situation can be difficult, but that is a requirement. We hear most MSPs are certainly including that as a requirement. And again, it's not just that you've got it, you've got to have the right backup solution in place because if you don't, I heard a story, I won't name names, but a large competitor, well-known and fairly respected provider of backup, was being used at a 500-person company. There was a phishing attack, that bad actor got in, they moved laterally, they progressively escalated permissions, they ultimately were able to access the backup. They were aware of a vulnerability in that case that they exploited, it hadn't been patched, hadn't been managed, and as a result they were able to encrypt and destroy all the backups that were on the network and the immutable copies and anything off network. That company for over a month was not able to operate, which for a 500-person company is devastating. So if you're worried that you might not be able to manage backups effectively, then you've got to look at something like Cove where it's cloud-first and it's managed and you no longer have to worry about doing the patches yourself because it's done for you. I'd be really thoughtful in your selection, not only around backup but frankly best of breed has got to be burned into your thought when it comes to building that stack. Good enough is not good enough. I say that all the time.

Absolutely.

Well, that they're a massive opportunity. It's funny because three years ago I remember an MSP came to me and said, 'I am no longer leading with IT, I'm leading with cybersecurity, and I'm winning the IT business because of that.' At that time I wasn't hearing a ton of people saying that. Today, I think just as many people are saying that as those that are leading with IT. More and more over time, that's going to continue to flip, and it's going to be leading with cyber. What comes next are compliance. What comes after that is selling AI as a service. You can imagine what even goes beyond that. But when it comes to compliance, there are different levels of maturity that we're seeing in the market. There's some who are talking about, 'Look, I've built an offering. That offering is a take-it-or-leave-it offering. I'm going to call it my compliance offering because it meets the compliance regulations of NIST or CIS or whatever, but it requires that you are doing the things you would expect.' There's patch, there's endpoint detection, there's an MDR component, there's a backup, there's a disaster recovery, there's a surface that overlays it all. Unless you're willing as a customer to sign up with me along those lines, I'm not willing to accept you as a customer because there's risk. Obviously, every time I accept a customer who's not willing to take cybersecurity seriously, that's risk for my business, not just for yours. So that's one end of the spectrum. The other end is full service compliance as a service offerings where they're mapping their technology and their protocols to very specific regulations or compliance. That's when they're getting into HIPAA or they're getting into PCI or something more specific, and they're committing to not only getting that company to a point where they are meeting those standards and maybe certified, but that they're staying that way because obviously technology and a lot of those regulations change over time. So they're including reporting, they're including board meetings, they're including things like pen testing to make sure that they're on top of all this in those offerings.

It's a really good point. The thought leadership opportunity is large. If you are specializing, verticalization, focusing on a specific element of compliance, the challenge that I think most MSPs have is there is so much complexity in each of these elements of compliance. They offer up both an opportunity and a challenge to understand it. But if you decide to specialize there, then you've got, to your point, this amazing piece of content that you could put into the community and leverage to build leads and relationships and demonstrate your specialty, demonstrate really how you differentiate. It's funny because we think about that, that's our 'hey, what kind of content are we going to build?' And frankly, there are MSPs out there who are building really good content when it comes to compliance. We know because we're looking for who's doing this really well, and most often it's an MSP or somebody who's very close to being an MSP. So it's happening, but that doesn't mean that it's happening at scale yet, and there's certainly a huge opportunity for you to do that.

Yeah, so your example is a great one. There are some vanguard MSPs out there who are pushing the needle on how to offer this as a service. It's part of their offering, and they're selling how to use Copilot. The really advanced ones are helping folks build AI into products or services. But it's a small portion, it's less than 10% that are doing that right now. Most of them are doing it within their day-to-day operations, using AI, generative AI to help them understand data trends or to generate content or to deliver better customer service. That's kind of the lowest maturity, where folks are focused. The next level of maturity is folks that are taking AI and trying to make their service better with it. They're trying to make their service, usually one of two things, more efficient or more thorough. More thorough security, more thorough elements of onboarding, or whatever the use case might be. They're either doing that, probably most frequently, through vendors that have built AI into their own tools, some of the stuff that we've done and our competitors have done to build AI into for both of those purposes, or, and this is less frequent as well, they'll build their own instances of AI to drive that same type of outcome. So it's really these three types of maturity or lifecycle of maturity: pointing it at operations, pointing at your service delivery, or the furthest along would be actually creating a new service and selling that in to help your customer use AI more effectively within their business.

Yeah, that's a big one. I don't think many of the small business community and some portion of the mid-market really are grasping that. So to your point around content and thought leadership, AI is really ripe for that, just like compliance is.

It's two things. On the one hand, increase in complexity that we're all aware of when it comes to every element of technology, whether that has to do with sprawl or cloud or cyber and all the different ways that we need to protect against the threat factors. So that's point one, that is a market force. The other market force is labor is scarce, particularly around cybersecurity, but broadly within IT in general. What that means then is for these midsize companies who've got a CIO or CTO or somebody along those lines, they're looking at their teams and their teams are made up of individuals usually counted on one hand who are focused on some of these things. Sometimes it's a single individual. They've got a risk with that because of all the things I just mentioned. It's hard to keep up with complexity. It's also that person's probably going to be in high demand and they don't have any redundancy. If that person were to leave, all of a sudden the thing that they were doing, whatever that thing was, is at risk. So we're seeing more and more of those folks reach out to MSPs who have five or 10 or 15 or 20 or 50 of these folks on staff and create redundancy. In many cases, it's more cost-effective for those folks, and in many cases it's also more effective because these MSPs have specialized, they have verticalized, they have positioned themselves to be experts, and they're further along than the CTO has sitting within her or his staff. So this is a huge opportunity. I was listening to a customer talk about this just the other day. They built their whole business around it, and they are really smart because it's driven great growth for them. But everything follows the positioning. First of all, the offering, how they've built their product and service, but the way they talk about that, the way they show up and do thought leadership, it all follows that strategy of we're leading with a co-managed approach in terms of our go-to-market.

Another growth driver, I think you mentioned in the beginning, mergers and acquisition, M&A. Another interesting finding from the report, especially how it differed from last year. Really no one was looking at M&A last year. I think 44% of survey respondents were actively looking at M&A as a growth strategy. 90% now in this year are looking at M&A for their MSP. Why such a big jump?

It's really intriguing. 90% of MSPs are thinking about making an acquisition, not just being acquired, but actually making an acquisition over the next few years. What's changed? Certainly the debt environment, the lending environment has changed a little bit more favorable. I think that's part of it. I think a lot of it has to do with there's an increasing understanding of what drives growth, and it's those things we talked about: verticalization, specialization, focus on geography. It's a build versus buy decision that MSPs are having really strategic and important conversations around which of those two routes do we want to take, or maybe a partner route is a third one you can take. They're having to consider it because it is such a hard thing in many cases to build. They're having to consider the option to grow and buy. On the other hand, what they're hearing from anybody who is focused on this, a lot of the PE companies or some of the aggregators, what they favor when they look at these MSPs is people who are verticalized, people who are specialized, and they're getting higher M&A multiples. So they're looking at it as, 'Hey, I'm either going to be eaten.' We heard people talk about this. One person said, 'If there's a six-person shop out there, they're my target, just like I know I'm somebody's target who's bigger than me. Everybody is somebody else's target.' I think folks are recognizing that they've seen their exit strategy. Whether their long-term goal is a lifestyle business that they can hand down to a kid, or they want to have a big exit and retire, or they're in it for 20 years, it kind of doesn't matter. They've got to have a path towards differentiation. M&A is a meaningful way to get there, not the only way, but it is a meaningful way. So a lot of people are considering it. Probably what's going to happen is that's going to drive multiples up over the coming years if that plays out, and there is the interest that seems to be percolating here. The folks who move quicker will benefit.

Absolutely.

Well, I think first, the tech stack that you choose, making sure that you're focused on best of breed. Your customers are going to rely on you to make those choices, and the outcomes will follow. If they don't, you'll suffer the results of that just like they may as well. So making sure the stack that you choose is best of breed, I would very much lean in on that. I would lean in then on how you differentiate the overlaying services that you bring to the table. That's where things like verticalization and specialization can play out. Even if you don't have a marketing department and a service delivery department, you're a five-person shop and you are everything, imagine yourself as the marketer. You really need to be able to go tell a story that is differentiated so that you don't allow yourself to become commoditized. If you feel like the value prop, service, and product is not meeting the aspirations that you as a marketer or the left side of your brain as a marketer is thinking about, then you've got to challenge the other side of your brain, or you've got to challenge the person who's creating the services in a collaborative, productive way to think about ways to evolve so that you can differentiate. Obviously, you want to be authentic. You don't want your marketer going off there telling a story that you can't back up. They can be a step ahead, they can tell a story that's coming, but of course if it never comes, then you'll lose your credibility. So it's a balance, but it really is up to you to make sure that you don't become commoditized, and that has to do with how you build your offering and how you tell your story.

I think that's a great example, a great way to think about it.

Yeah, I think some of this, going back to a similar theme here, the more you can set a strategy around what's their focus, the better you can identify a channel. I don't think you can think about a channel before you know your focus. But I'll give you an example. If your focus is around cybersecurity and if it's specific to a vertical within that, you can start to find some other folks that might offer new routes to market for yourself. That might be an incident response company. If you can find a local company who's just focused on the IR, usually what happens when there's an IR, that person's looking for an alternative coming out of it. If you're that great alternative, then the IR company can be a really good partner for you. Of course, you probably can reciprocate with them, hopefully not too regularly, but once in a while. So that's one example. But I think you could look at cybersecurity brokers, insurance brokers that are local. If you are verticalized and you're focused on healthcare or financial services, there's a lot of different memberships that have to do with that, and there's kind of good culture and community around that. You can join those groups and you can bring your thought leadership to them. Show up once a quarter and show off a little bit your knowledge and help them get educated and solve a problem for them over time. That's a raptor market. You'll learn a business out of that.

It's a great point. You do need to have those conversations. If those conversations don't ultimately go the way that you need to, then you've got to look at the type of customer you're targeting. You might need to rethink the type of customer that your ideal customer profile may not be the one that you're actually servicing, or maybe it's a portion of who you're servicing. But understanding which of those are most profitable and offer the most growth is a huge mechanism in determining your strategy and ultimately executing against that.

Yep, check it out. It's on our website. If you navigate to the resources center, you will find a link to it. We hope that you find true inspiration, pragmatic examples of what works. We'll be on social media and through some other channels. We'll be talking about this in many different forums. So if you forget, I'm sure we'll remind you. But would very much encourage you to spend some time in that, and of course if you do have any feedback, we would love to hear that.

Absolutely, appreciate it.

Same here. Thank you all. Bye.