Kaseya Survey Finds Human Error is Cybersecurity's Biggest Unsolved Problem

Kaseya's 2026 report, based on 1,132 MSPs and IT professionals in more than 60 countries, finds 68% view human error as their top cybersecurity threat concern over the next 12 months, while 77% report being under-resourced. Only 20% say cybersecurity budgets are growing in line with risk, and 65% of MSPs say their clients are underinvested. High-performing MSPs report greater adoption of advanced security tools and more frequent incident-response testing; the release introduces a resilience assessment and playbook.

Analysis

The commercial signal is a widening gap between perceived cyber risk and customers’ ability to fund or operate controls—not proof of an imminent industry-wide spending acceleration. Because this is a vendor-sponsored survey of MSPs and IT professionals, treat it as directional demand discovery, not independent evidence of budgets or purchasing intent. In the near term, awareness may lift sales conversations but does not establish conversion, contract size, or timing.

The more durable opportunity is in reducing operational burden: managed detection/response, identity controls, backup and recovery testing, and compliance services that can be packaged for resource-constrained SMBs. This could favor scaled MSPs and platforms able to bundle services; it may pressure smaller providers that cannot support more complex security stacks. Security vendors—including Microsoft, CrowdStrike and Palo Alto Networks—could benefit if customers consolidate around integrated platforms, but the survey does not identify winners or demonstrate that buyers will increase spend rather than defer upgrades. Cyber insurers may also tighten evidence requirements, indirectly increasing demand for documentation and testing.

Contrarian point: the report’s strongest implication may be implementation friction, not product scarcity. More tools can add cost and complexity without fixing training, documentation, or incident-response gaps. Over the next 1–3 months, there is no clear catalyst beyond vendor marketing and budget discussions; over 6–18 months, actual incident losses, insurance renewals, and compliance deadlines could force spending. The thesis weakens if security-vendor results show slowing customer additions or weaker expansion, or if MSPs report that compliance interest fails to convert into paid services.

Key Decisions for Investors

• No event-driven trade from this report alone. Treat it as a watch item for security vendors and MSP-focused businesses, not a standalone buy signal.
• Prefer a relative-value screen of integrated security platforms versus smaller, point-product vendors only if upcoming results show stronger renewals, expansion, or cross-selling; verify reported customer metrics and security revenue before positioning.
• Monitor MSP earnings and commentary for paid compliance-service uptake, managed-security attach rates, and service margins. If demand rises without conversion or margins deteriorate, avoid assuming the survey translates into earnings growth.
• Track cyber-insurance renewal requirements and customer incident-response or backup-testing spend over the next 6–18 months. A rise in mandated controls would support the demand thesis; flat budgets and continued deferrals would falsify it.