Kaseya cybersecurity report: Human error remains top MSP security risk   

Most cybersecurity strategies depend on everything going right. There’s no room for error, no hesitation on decisions and an incident response plan at the ready. But at the end of the day, that isn’t reality. True cyber resilience requires a deeper look. 

According to the 2026 Kaseya Cybersecurity Report, after surveying over 1,100 MSPs and IT professionals across 63 countries, the answer starts with human error. 

Employees don’t spot every phishing email, budgets can’t keep pace with cyberthreats and the right expertise is not always on hand when an attack hits. However, human error cannot be eliminated, so security must be built to withstand it.  

The report, released earlier this month, points to four places where security programs assume everything will go right and how MSPs can build around it. 

Human error is the biggest risk 

Attackers don’t need to beat every control; they just need one person to click a link. About 68% of respondents named human error, including social engineering and distraction, as the threat they are most concerned about.  

Among organizations that had an incident in the past three years, four of the top five contributing factors were people related. Poor user practices or gullibility led at 41%, followed by a lack of end-user training at 40%. While human error contributed to the issue, people also affect recovery. Among organizations that recovered within two hours, a well-trained internal IT or security team was the top factor, cited by 35%. 

“People aren’t perfect, and everyone knows it. Yet much of cybersecurity still depends on people making the right decision every time,” said David Baggett, SVP and GM, Security Suite, at Kaseya. “The path to true cyber resilience isn’t about eliminating mistakes. It’s about building an organization that can withstand them.” 

For MSPs, that means layering protections such as email security, MFA, least-privilege access and tested recovery, so one mistake doesn’t become a major incident. 

Security investment waits for an incident 

About 65% of MSPs say their clients are underinvested in security. IT departments see a similar pattern with only 20% saying their cybersecurity budget is growing in line with risk. Up to 77% describe themselves as under-resourced. 

Increased spending tends to follow cyber attacks. One in five MSPs say client investments only came after a recent incident or near miss. Similarly, the same amount say investments increased due to compliance or cyber insurance requirements.  

Only 11% of MSP respondents say clients invest based on clear evidence of business impact and 9% on demonstrated risk reduction. The report suggests tying security gaps to downtime, recovery costs, lost revenue and compliance exposure, making the risk and cost visible early on. 

Being audit-ready doesn’t mean staying compliant 

About 65% of respondents say they could pass a compliance audit today with no preparation. However, 49% say they have incomplete documentation or policies that could cause problems during one, and 34% point to security controls that aren’t fully implemented.  

An audit is a point-in-time test, but compliance is an everyday task. It has no finish line, so every day should look like audit day. That’s not easy. MSPs name budget constraints (47%) and keeping up with regulations (42%) as their top compliance challenges.  

Kaseya’s new MSP resilience assessment compared high-performing MSPs, those that met both revenue and growth goals over the past two quarters, with low performers. High performers tend to treat compliance, cyber insurance and AI adoption as competitive advantages, and they are more likely to test their clients’ incident response plans regularly. 

The takeaway is to build compliance into daily operations. Assign clear owners, maintain evidence as work happens and help ensure controls are in use.  

Stretched teams and scarce skills slow security 

Routine work competes with security work. End-user requests are the most common interruption (38%), and MFA creates the most operational friction (36%). To stay secure, about 30% of respondents most often trade off IT budget and 28% trade off end-user experience. 

Hiring alone isn’t closing the gap. Security automation and AI specialists are the hardest skills to find or retain (32%). AI is filling some of it: 44% use it for threat detection and monitoring and 29% for alert reduction or triage. Data privacy (25%) and false positives (21%) are the top concerns, which is why human oversight still matters. 

The report suggests using AI for repetitive, high-volume work while building the skills to oversee it. Simplifying and automating repeat requests frees up time, and making controls like MFA easier to use helps make secure behavior the easier path. 

Human error can’t be eliminated, but it doesn’t have to turn into a crisis. The report closes with a five-part Cyber Resilience Playbook for building security that withstands mistakes, tight budgets and skills shortages.  

Read the full Kaseya cybersecurity report: Building security that survives human error.