Every client in this year’s survey already works with an outside security provider. None of them needs convincing to outsource. What they are asking for is guidance, and most are not getting enough of it from the provider they already pay.
That is the finding at the center of the 2026 State of vCISO Report, Cynomi’s fourth annual study of the vCISO market. For the first time it surveys both sides of the relationship: 200 senior leaders at MSPs, MSSPs and vCISO firms, and 200 IT, cybersecurity, risk and compliance leaders at organizations that buy managed security. Side by side, the two sets of answers show what providers think they deliver, what clients say they need, and how far apart the two are.
The short version: detection and response have become the baseline. Clients see them as table stakes. Advisory is where the next margin is, and most providers deliver it mainly through a quarterly review. The gap between those two facts is a growth opportunity hiding inside existing client bases.
Here are five branches of that argument, with the figure that carries each. The detail behind every figure, including the breakdowns by provider type and the full client-side findings, is in the report.
1. Detection Is Commoditized. Advisory Isn’t.
Managed detection and response is the product most providers built their security practice on, and clients now treat it as a given. Nearly half of providers (47%) already consider MDR commoditized. The clients agree, in their own way: among those using an MDR provider, 0% say their strategic needs are fully met. 61% say they need more guidance, and 39% say their provider does detection and response only.
Detection still keeps clients safe. The verdict is on what sits on top of it. A provider whose relationship with a client runs entirely through alerts and tickets has no answer when the client asks what they are getting for the money, beyond the absence of a breach.
2. Clients Will Pay for Advisory, and Stay for It
The report’s headline figure is also its simplest. 95% of clients would be more likely to increase their overall security spend if their provider delivered more proactive planning and strategic guidance. 83% would be likely to buy strategic advisory as a standalone service.
The retention data points the same way. Strategic advice and risk visibility are the top two retention drivers for providers and clients alike. Pricing and packaging rank last. Price is not what keeps clients. Seeing where their security stands, and being told what to do next, is.
For a provider, that reframes the renewal conversation around one question: can the client see a roadmap and watch it move?
3. MSPs and MSSPs Are Two Different Businesses
The label “service provider” hides a split the report makes visible. Only 28% of providers offer vCISO services today. Among MSPs it is 5%. Among MSSPs it is 32%. On packaging, the same pattern: 39% of MSSPs sell advisory as a separate paid service, compared with 24% of MSPs.
MSSPs are moving faster, and compliance is their way in. MSPs are the furthest behind: 5% offer vCISO services, and 24% sell advisory as a separate paid service. That is the opportunity, and it is widest for the providers who have not started.
4. Demand Is Continuous. Delivery Is Quarterly.
Providers say 56% of their clients, on average, ask for strategic guidance beyond fixing technical issues. Yet 70% still deliver advisory mainly through quarterly business reviews, and only 7% through a client portal or dashboard.
A client who hears strategic advice from their provider four times a year is guessing about the other 48 weeks. The quarterly review itself is fine; what matters is what it leaves behind. A review that ends with a posture score, a roadmap and a dated list of what closed since last time gives the client something to look at between meetings. One that ends with ticket counts does not.
5. AI Raises the Value Bar, Not the Discount
The expectation that AI would push managed security prices down has not arrived. Not one provider surveyed has cut prices because of AI. 84% of clients say prices should hold while service quality or scope improves, and only 15% expect AI to lower prices.
What clients expect instead is more: better reporting (60%), better outcomes (55%) and more proactive recommendations (54%). The dividend from AI in managed security goes to the provider who uses it to deliver advisory at a standard and a frequency a human team alone could not reach. Across every client, not only the top accounts.
What the Gap Asks of Providers
“MSPs and MSSPs have spent a decade building operational excellence in detection and response. That work is valuable, but clients now see it as the baseline,” said Erin McLean, Chief Marketing Officer at Cynomi. “The data is clear that the next margin opportunity is advisory. The challenge is delivering it consistently across hundreds of clients without hiring a CISO for each one.”
Three moves follow from the data.
Standardize how guidance is delivered. Advisory that depends on one senior person does not scale past that person’s calendar. A repeatable method, from assessment to roadmap to re-assessment, lets the whole team deliver to one standard.
Deliver it continuously. Clients want guidance between reviews, not only at them. A posture the client can see at any time changes the renewal conversation before it starts.
Price it. 83% of clients would be likely to buy strategic advisory as a standalone service. The providers who sell it as a standalone service with its own price are the ones who turn the gap into recurring revenue.
Cynomi exists to bridge that gap. As the agentic Security Growth Platform for service providers, powered by CISO Intelligence, Cynomi helps MSPs, MSSPs and consultancies standardize and scale security and compliance service delivery, so teams of every experience level can deliver consistent, strategic advisory across every client.
The full report, including detailed breakdowns by provider type and the complete client-side findings, is available now. Download the 2026 State of vCISO Report.
Methodology: Cynomi commissioned Global Surveyz, an independent research firm, to survey 400 respondents in the U.S. in August 2026: 200 senior leaders at MSP, MSSP and vCISO firms with 20 or more employees, and 200 IT, cybersecurity, risk or compliance leaders at client organizations from 50 to more than 1,000 employees.
Table of contents
