Among clients using a managed detection and response (MDR) provider, none said the service fully meets their strategic advisory needs. That finding comes from Cynomi’s 2026 State of vCISO Report, which surveyed 200 U.S. service providers and 200 end clients. The Chess Masters series profiles providers whose managed service comes with the advisory built in. FIT Technologies, one of Ohio’s largest managed service providers, is one of them.
Becky Cross is Vice President of Client Partnerships at FIT. Asked how FIT’s managed security and advisory services fit together, she answered: “From our perspective, the two can’t really be separated, and at least certainly not in a modern managed security services standpoint.”
Two Layers, One Relationship
Cross describes managed security as the operational layer and advisory as what makes it mean something. “The advisory services add the layer that turn those alerts and notifications into actionable business outcomes.” The job of the advisory layer is translation. “The advisory layer helps us translate to the client what they mean, not just to outline here’s what’s going wrong in your environment and certainly not to just quickly say and here’s what you need to buy, but rather to inform a conversation and connect it back to the business.”
At FIT the two layers are run by separate teams. “We have a team whose only job is strategic advising. So they’re not going to be out playing triage when there’s an incident or communicating when there’s an outage.” A fractional vCIO is in every default agreement, and clients with heavier compliance needs add a fractional vCISO from a separate team.
The report shows clients value advisory enough to pay for it: 83% would be somewhat to very likely to purchase strategic cybersecurity advisory as a standalone service; 10% very likely.
The Roadmap Starts With the Client’s Worries
FIT’s first move with a client is agreeing on terms. “The very first thing that we have to do, and it takes discipline, is making sure we’re aligned on what advisory means. If we’re not operating on a standard definition, we’re going to miss no matter how great we are at it.”
The second is not assuming. “We make assumptions because we’re a bunch of tech nerds and we jump ahead six steps because we’ve already seen it play out with 10 other companies in the last month.” Cross has a name for the failure mode. “We call it happy ears, where you hear them say like a buzzword and then you jump in with a solution. That’s such an order taker mindset. Instead, our team is trained to ask thoughtful questions.”
The output is a roadmap with a specific definition. “The roadmap isn’t a list of things we want to sell to hit quota. An IT roadmap is a list of prioritized outcomes that match to their worries.”
Compliance as a Journey
Compliance used to show up as a reaction to an insurance attestation or a board audit. Now, among the architecture, engineering and construction firms FIT serves, it shows up as ambition: opportunities in broader government contract work, which bring CMMC requirements. FIT’s response is to slow the conversation down. “We slow them down and say, to start, what framework are you operating with today? And the answer to that is almost always with a certain tool.”
With current clients making that move, FIT sets one expectation. “Compliance is a journey, not a destination. It’s a little road to Hana, if you will. And so we slow it down by really starting with where are we today? And that’s really where Cynomi has come in for us and been a huge leverage point.”
Clients in the report rank better risk visibility (47%) and more strategic security advice (41%) as their top reasons to renew or expand with a provider, ahead of compliance support (38%). Cross’s framing matches. “When you play checkers, you have that transactional relationship, that order taker. You want CMMC, here’s the thing you need to buy. When you’re providing advisory to strategic advisory services or chess, you’re really asking thoughtful questions, slowing it down to build a plan that makes sense and is attainable.”
Security as the Non-Negotiable Baseline
FIT does not sell security a la carte. “If you’re unwilling to create that firm baseline of cybersecurity investment, then it’s not probably a good alignment between our organizations. And that’s a choice we get to make.” Every client is standardized on Microsoft E5 or A5, and the bar keeps rising. “About seven years ago, we added the cybersecurity requirement. And now we’ve leveled it up once more to say if you’re coming to us with any kind of expectation around a framework or a compliance or regulatory need, it’s also non-negotiable.”
This quarter FIT is launching FIT Secure 360, which bundles security operations, email and access security, assessment, a fractional CISO with a compliance platform, and privilege management. “FIT Secure 360 is a managed approach with one solution, six distinct layers. But what connects each of those layers together is the glue of advisory services.” One of those layers, in Cross’s words, is “compliance via Cynomi and vCISO services,” built on Cynomi’s compliance management.
Why They Stay, and How Often They Hear From FIT
“Our current average client age is 12 years, and that’s including significant growth over the last several years. So, what that tells me is the people that are coming are staying.”
Cross traces the cadence of advisory from an account manager to quarterly business reviews to something faster. “Now what we’re seeing is a continuously in motion, evolving, mature IT roadmap plan where the engagements have to occur more frequently than quarterly to keep up with the pace of change. And especially when you insert the compliance layer.” The report shows where most of the market still is: 70% of service providers name the quarterly business review as their primary method for delivering strategic advisory; 7% name a client portal or dashboard.
The payoff is in the spend. 95% of clients say they would be more likely to increase their overall cybersecurity spending if their provider offered more proactive planning and strategic guidance. “The MSPs who don’t bring that advisory layer to the table are going to fall behind very quickly.”
The One Move: Train for Curiosity
Asked what advice she would give another provider, Cross pointed at training. “The rocket fuel for us has been thoughtfully investing in the way that we design our advisory role via training.” The goal is a habit of mind. “If you’re able to have that genuine curiosity when you’re interacting with the business owners who are paying you money, probably a lot of money every month, you’re really going to feel that transformation organically because now it’s a collaborative blueprint as opposed to a transactional, here’s what you need, trust me.”
See how Cynomi helps providers run advisory across every client, watch the full interview with Becky Cross above, and download the 2026 State of vCISO Report.
Table of contents
