For years, businesses have measured the value of their IT providers by relatively straightforward standards: how quickly they resolve technical issues, how reliably systems operate, and how efficiently employees receive support.
But as cyber threats become more sophisticated and business operations increasingly depend on digital systems, those expectations are changing.
Businesses no longer want managed IT providers who simply keep technology running. They want strategic partners who can help them understand risks, prevent disruptions, and make better technology decisions.
New international research published in November 2026 confirms this shift. For small and medium-sized businesses across New Zealand, it raises an important question:
Is your current IT provider helping you prepare for what could go wrong, or simply responding when something already has?
New Research Reveals What Businesses Expect From Managed IT Providers
On 4 November 2026, Barracuda Networks released its latest research report, What MSP Customers Need Next, examining the evolving expectations businesses have of managed service providers (MSPs).
Based on an international survey of 2,000 IT and security decision-makers, the findings reveal growing demand for cybersecurity expertise, incident recovery capabilities, and strategic guidance.
Among the key findings:
- 66% of surveyed organisations already outsource cybersecurity services to an MSP.
- 29% are considering or evaluating managed security providers.
- 59% of prospective MSP customers are concerned about AI-related cybersecurity threats.
- Only 29% of prospective customers report being able to secure compromised accounts and restore operations within hours.
- 40% of existing MSP customers identified the ability to explain cybersecurity risks in plain language as a factor in choosing their provider.
Source: Barracuda Networks — What MSP Customers Need Next
Although the research surveyed organisations with 100–2,000 employees across several international markets, rather than specifically measuring New Zealand SMEs, its findings highlight challenges that growing Kiwi businesses should consider.
The message is significant: cybersecurity is no longer just an IT department responsibility. It is a business management priority.
Why Traditional IT Support Is No Longer Enough
Traditional IT support focuses primarily on keeping technology operational.
When an employee cannot access their email, the IT provider restores access. When a device fails, someone repairs or replaces it. When a network experiences an outage, technicians investigate the problem.
These services remain essential.
However, reliable day-to-day support does not necessarily mean a business has an effective cybersecurity strategy.
Consider an Auckland accounting firm using Microsoft 365 to manage financial documents, communicate with clients, and collaborate internally.
Its systems might function perfectly during normal business hours. Employees may experience few technical issues, and support tickets may be resolved promptly.
But what happens if an attacker compromises a senior employee’s Microsoft 365 account?
Can the business identify suspicious access quickly? Can it prevent unauthorised access to confidential documents? Does it know which systems and accounts need to be secured first?
Most importantly, can it continue operating while the incident is investigated?
The difference between reactive IT support and strategic managed IT services is preparation.
A proactive IT partner helps identify vulnerabilities, implement appropriate safeguards, and establish recovery procedures before a security incident disrupts operations.
Cybersecurity Leadership Is Becoming a Core MSP Responsibility
Barracuda’s findings are reinforced by Sophos’ 2026 MSP Perspectives Report, which examines the growing strategic responsibilities of managed service providers.
According to Sophos:
- MSPs estimate that 46% of their customers look to them for CISO-level cybersecurity leadership.
- 84% of MSPs expect demand for CISO services to increase over the following 12 months.
Source: Sophos — The Evolution of the MSP Cybersecurity Value Proposition
A Chief Information Security Officer (CISO) traditionally oversees an organisation’s cybersecurity strategy, governance, and risk management.
For many growing New Zealand businesses, employing a dedicated senior cybersecurity executive may not be commercially practical.
This is where an experienced managed IT services provider can contribute strategic value.
Rather than focusing exclusively on technical troubleshooting, an MSP can help business leaders:
- Identify and prioritise cybersecurity risks.
- Evaluate the effectiveness of existing security controls.
- Establish policies for protecting business information.
- Improve incident response and disaster recovery planning.
- Review technology investments against business objectives.
- Understand security risks without unnecessary technical complexity.
This does not mean every business requires an enterprise-level cybersecurity programme.
It means cybersecurity decisions should be appropriate to the organisation’s size, industry, operational requirements, and exposure to risk.
Five Cybersecurity Capabilities New Zealand SMEs Should Expect From Their MSP
1. Proactive Threat Detection and Response
Cybersecurity should not depend entirely on employees recognising suspicious activity or reporting technical problems.
Modern managed cybersecurity services can combine endpoint protection, identity monitoring, threat detection, and security operations expertise to identify potential attacks.
A Security Operations Centre (SOC) provides monitoring and response capabilities that can help organisations investigate and contain threats.
However, monitoring alone is not enough.
Businesses should understand who investigates security alerts, how incidents are escalated, and what actions are taken when a genuine threat is identified.
2. Microsoft 365 and Identity Security
Microsoft 365 is central to daily operations for many New Zealand businesses.
It supports email, document management, communication, and collaboration. It also creates a valuable target for attackers seeking access to business accounts and sensitive information.
Effective Microsoft 365 security should include:
- Multifactor authentication and appropriate access controls.
- Microsoft Entra ID security configuration.
- Protection against phishing and business email compromise.
- Regular reviews of user permissions.
- Secure configuration of SharePoint, OneDrive, and Teams.
- Monitoring for suspicious account activity.
The objective is not simply to make Microsoft 365 available.
It is to help ensure that the people accessing business information are authorised to do so.
3. Business Continuity and Incident Recovery
One of the most concerning findings in Barracuda’s November report relates to recovery readiness.
Only 29% of organisations considering an MSP said they could secure compromised accounts and restore operations within hours of an incident.
For a New Zealand SME, prolonged disruption can affect revenue, productivity, customer confidence, and contractual commitments.
A construction company may lose access to project documentation. An accounting practice may be unable to retrieve essential client records. A professional services firm may experience interruptions to communication and billing.
A strategic managed IT provider should help establish recovery priorities, backup arrangements, and tested procedures for restoring essential operations.
The real measure of cybersecurity is not whether an organisation can guarantee that an incident will never happen. It is how effectively it can reduce risk, respond, and recover.
4. AI Security and Responsible Technology Adoption
Artificial intelligence is introducing new opportunities for productivity, automation, and business efficiency.
It is also creating additional cybersecurity considerations.
Barracuda found that 59% of prospective MSP customers were concerned about AI-related threats, including AI-generated phishing, social engineering, and unauthorised use of AI tools.
For New Zealand businesses, managing AI-related risk requires more than purchasing another security product.
Organisations should consider which AI tools employees are permitted to use, what information can be shared with those tools, and how access to confidential business data is controlled.
An effective IT partner can help businesses explore AI adoption while establishing appropriate safeguards.
The goal should be practical innovation without unnecessary exposure.
5. Strategic IT Planning and Clear Business Reporting
Business leaders should not need advanced technical knowledge to understand whether their organisation is adequately protected.
One of the most valuable findings from Barracuda’s research is the importance customers place on clear communication.
Cybersecurity reporting should help management answer practical questions:
- What are our most significant technology risks?
- Which issues require immediate attention?
- Are our security controls improving?
- What investments should we prioritise?
- How prepared are we for a serious disruption?
Regular IT reviews and strategic guidance can help businesses make informed decisions rather than relying solely on technical reports or reacting to emergencies.
Why This Matters for New Zealand Professional Services, Finance, and Construction Businesses
Different industries face different operational risks.
For professional services firms, confidential client information, email security, document access, and business continuity are particularly important.
For finance and insurance businesses, protecting sensitive information, controlling access, maintaining reliable systems, and meeting applicable regulatory obligations require careful attention.
For construction and engineering companies, secure access to project files, mobile devices, remote employees, subcontractors, and cloud collaboration platforms can be essential to maintaining operations.
Although their requirements differ, these businesses share a common challenge: technology has become too important to manage without a clear plan for security and resilience.
An effective managed IT strategy should reflect the organisation’s actual operating environment rather than applying identical solutions to every customer.
How CORIT Tech Helps Businesses Move Beyond Reactive IT Support
At CORIT Tech, we believe managed IT services should deliver more than technical assistance.
Our approach combines secure IT operations, proactive cybersecurity, Microsoft 365 management, and practical technology guidance to help New Zealand businesses operate with greater confidence.
Rather than treating cybersecurity as an isolated product, we integrate security into the way IT environments are configured, monitored, managed, and improved.
Our capabilities include:
24/7 Security Monitoring and Response
Continuous security monitoring supported by our Security Operations Centre helps businesses identify, investigate, and respond to potential threats.
Microsoft 365 Security and Identity Protection
We help strengthen Microsoft 365 environments through security hardening, identity management, access controls, and ongoing configuration reviews.
Managed Endpoint and Email Security
Layered security measures help protect business devices, communication platforms, and sensitive information against common cyber threats.
Proactive Managed IT Services
Our managed IT approach focuses on reducing avoidable disruptions, maintaining reliable systems, and improving the security and performance of business technology.
Strategic Technology Guidance
We help business leaders understand their technology environment, identify improvement opportunities, and make decisions aligned with their operational priorities.
Our objective is straightforward: to help organisations reduce technology risk while building reliable, secure systems that support business growth.
Five Questions to Ask Your Current Managed IT Provider
If your business already works with an MSP, consider asking these five questions during your next technology review:
- How do you identify and prioritise cybersecurity risks before they cause disruption?
- Who monitors our systems outside normal business hours, and what happens when a serious threat is detected?
- When did we last test our backup and recovery procedures?
- How are you helping us manage Microsoft 365 security and emerging AI-related risks?
- Can you provide a clear, business-focused explanation of our current security posture and recommended improvements?
The answers can help determine whether your current arrangement provides primarily reactive technical support or contributes to broader business resilience.
The Future of Managed IT Services Is Strategic
The latest industry research points towards an important evolution in managed IT services.
Businesses still need reliable technical support, responsive service, and systems that work.
But they increasingly expect more.
They want a partner who understands how technology affects their operations, communicates risks clearly, helps them recover from disruptions, and provides guidance as new challenges emerge.
For New Zealand SMEs, this represents an opportunity to reconsider what effective IT support should deliver.
The question is no longer simply whether your IT systems are working today. It is whether your business is prepared for the technology risks of tomorrow.
Ready to Find Out Whether Your IT Is Protecting Your Business?
Your business deserves more than an IT provider who responds when something breaks.
At CORIT Tech, we help New Zealand businesses take a proactive approach to managed IT, cybersecurity, and technology planning.
Whether you’re concerned about Microsoft 365 security, business continuity, or the effectiveness of your existing IT arrangements, our team can help you identify practical next steps.
Book a Strategy Session with CORIT Tech
Discover how secure, proactive managed IT services can support your business, reduce unnecessary risk, and give your team greater confidence in the technology they depend on.
Contact CORIT Tech to discuss your IT and cybersecurity requirements.
Sources and Further Reading
- Barracuda Networks. (4 November 2026). New Study Finds Organizations Value MSPs That Can Help Them Navigate AI-related Security Challenges, Strengthen Resilience, and Communicate Business Risk in Clear Language. https://www.barracuda.com/company/news/2026/msp-growth-ai-expertise-cyber-resilience
- Barracuda Research. (2026). What MSP Customers Need Next. https://www.barracuda.com/reports/msp-customer-cybersecurity-needs-2026
- Sophos. (2026). The Evolution of the MSP Cybersecurity Value Proposition. https://www.sophos.com/en-gb/blog/the-evolution-of-the-msp-cybersecurity-value-proposition
- Help Net Security. (9 November 2026). Companies Seeking an MSP Doubt Their Ability to Spot Cyberattacks. https://www.helpnetsecurity.com/2026/11/09/barracuda-msp-cybersecurity-services-expectations-report/
