Cynomi report finds clients want more security advice

Cynomi has published its 2026 State of vCISO Report, which found that 95% of clients would increase security spending in exchange for more strategic guidance.

The report surveyed 400 US respondents: 200 senior leaders at managed service providers, managed security service providers and vCISO firms, and 200 client-side IT, cybersecurity, risk and compliance leaders. It is the first time Cynomi has surveyed both service providers and their clients in the same study.

The findings point to a gap between the advisory services clients want and what many providers currently offer. Almost all clients surveyed said they would be more likely to spend more on security if their provider delivered more proactive planning and strategic guidance. Yet only 28% of service providers said they offer vCISO services today.

That figure was lower among MSPs, where just 5% said they offer vCISO services. Among MSSPs, the share was 32%.

Advisory gap

The study suggests that detection and response services alone are not meeting client expectations for strategic support. No managed detection and response clients surveyed said their strategic needs were fully met. Meanwhile, 61% said they need more guidance and 39% said their provider offers detection and response only.

Nearly half of providers, 47%, said they already view MDR as commoditised. By contrast, only 6% said the same of vCISO services.

Clients also indicated a willingness to buy advisory work as a separate service. The report found that 83% would be likely to purchase strategic advisory on a standalone basis.

Retention and expansion appear closely tied to that demand. Strategic advice and risk visibility ranked as the top retention drivers for both providers and clients, while pricing and packaging ranked last.

Client priorities

The research found a gap between the issues clients prioritise and the areas some providers believe matter most. More than half of clients, 53%, said their top goal is reducing overall business risk.

Business continuity was named by 41% of clients as a priority, but only 19% of MSPs believed it was important to clients. No client surveyed identified maximising cybersecurity return on investment as their main priority.

Compliance also emerged as a prominent theme. Compliance readiness was the strategic outcome valued most by clients, cited by 58% of respondents.

MSSPs were more likely than MSPs to sell advisory as a separate paid service: 39% do so, compared with 24% of MSPs.

Delivery model

Providers surveyed said that, on average, 56% of their clients ask for strategic guidance beyond the resolution of technical issues. Even so, 70% said they mainly deliver advisory through quarterly business reviews.

Only 7% said they provide strategic guidance through a client portal or dashboard. The findings suggest a mismatch between sustained client demand for advice and the way providers package and deliver it.

The study also examined the effect of artificial intelligence on pricing and customer expectations. No provider surveyed said they had reduced prices because of AI.

Most clients did not expect lower charges. Instead, 84% said prices should stay the same while service quality or scope improves, and only 15% said AI should lead to lower prices.

When asked what they expected from AI, clients most often pointed to better reporting, cited by 60%, followed by better outcomes at 55% and more proactive recommendations at 54%.

Erin McLean, Chief Marketing Officer at Cynomi, said the results show a market that already accepts outsourced security services but wants more strategic input from providers. "Every client we surveyed already works with an outside security provider. The market doesn't need to be convinced to outsource; it's asking to be guided," McLean said.

She said the commercial opportunity now lies in standardising advisory work and delivering it more consistently. "Detection keeps clients safe, but advisory keeps them retained. The providers who standardize how they deliver strategic guidance, and deliver it continuously rather than once a quarter, will own the next decade of growth in this channel," McLean said.

McLean added that providers have already invested heavily in operational security services, but customer expectations are shifting. "MSPs and MSSPs have spent a decade building operational excellence in detection and response. That work is valuable, but clients now see it as the baseline," she said. "The data is clear that the next margin opportunity is advisory. The challenge is delivering it consistently across hundreds of clients without hiring a CISO for each one."