Australian MSPs have an opportunity to build new managed security services around Microsoft technology their customers already own, as growing cyber threats, regulatory pressure and demand for 24x7 protection increase expectations on the channel.
“You can no longer just say, ‘I have cybersecurity’. You need to be able to prove it,” Chorus Cyber channel solutions lead for Australia, Darren Bennett, told techpartner.news.
Bennett said MSPs were being pushed beyond traditional technology delivery as customers grappled with AI, data security and governance alongside an increasingly complex regulatory environment.
The pressure comes as cyber security emerges as one of the channel’s strongest growth opportunities. The State of Channel Security 2026 report by techpartner.news found security was the leading source of expected revenue or profit growth among MSPs, nominated by two-thirds of respondents, while the Australian Cyber Security Centre responded to 1,253 cyber security incidents in 2024–25, up 11 per cent.
Customers were also demanding more from their providers, Bennett said, making capabilities such as continuous monitoring, incident response and reporting increasingly important.
Regulation raises the stakes for the supply chain
That pressure is becoming particularly significant for MSPs and smaller technology providers working with government, critical infrastructure and other regulated organisations.
Bennett pointed to Horizon 2 of Australia's 2023–2030 Cyber Security Strategy, which is extending the government's focus beyond the cyber resilience of large organisations themselves and further into the supply chains on which they depend.
Under Horizon 2, the government plans to strengthen cyber requirements in Commonwealth procurement and use procurement and regulatory levers to encourage greater cyber maturity among SMEs. The strategy also places increased emphasis on supply-chain resilience, logging and monitoring across government and critical infrastructure.
For MSPs, Bennett said the shift has important implications: cyber capability increasingly needs to be demonstrated, rather than simply asserted.
“For smaller providers that depend on government or regulated customers, the commercial consequences could be significant,” he said.
Bennett warned that changing requirements could effectively shut a provider out of opportunities if it was unable to demonstrate the required cyber capability.
While he described the potential impact more starkly as having your “nose cut off overnight”, the underlying message for MSPs was clear: cyber maturity is increasingly becoming not only a security issue, but a condition of doing business in some supply chains.
Turning the security lights on
For Microsoft partners, Bennett argued the answer may not be another security platform.
Chorus Cyber provides managed detection and response and extended detection and response capabilities natively on Microsoft, delivered to Australian partners through Dicker Data.
Bennett said this allowed MSPs to operationalise security capabilities customers were already paying for rather than deploying an additional proprietary security platform, while helping customers maximise existing licensing investments and maintain data sovereignty by keeping their data within their existing Microsoft environment.
“Without adding third-party tooling, turn the lights on and we start monitoring it,” he said.
The approach brings together analysts, automation and threat intelligence around the customer's existing Microsoft security environment, while allowing MSPs to build a managed service around that investment to meet customer demand.
From detection to containment
The need for round-the-clock protection is also being driven by a threat environment in which attackers can deliberately exploit the hours when customers and providers are least likely to be watching.
Bennett said 68 per cent of breaches detected and responded to by Chorus Cyber's SOC last year began with phishing and identity compromise, while AI was increasing the speed at which attackers could operate.
He said partners had reported attacks deliberately beginning overnight, highlighting the importance of 24x7 detection and response.
But Bennett argued detection alone wasn’t enough.
Rather than simply isolating a compromised identity or device, he said effective containment required understanding how the attack began, identifying the security gap and addressing its root cause.
“Not just isolating a user or a device, but actually getting to the root cause of the problem and fixing that problem,” Bennett said. “I believe very passionately that's what a SOC should be doing.”
Making existing security work harder
For MSPs, Bennett said the immediate questions are more fundamental: who’s monitoring their customers’ environments around the clock, and if something does happen, are they able to respond?
For Microsoft partners, that also means looking at the security technology customers have already invested in before assuming another platform is the answer.
The opportunity, Bennett argued, is to identify where the gaps sit across the existing customer base and determine whether they can become repeatable managed services.
“What is that gap? What does it look like? How can you then productise and monetise that opportunity?” Bennett said.
“In reality, it probably exists across most customers.”
For MSPs already under pressure to deliver more security, then, the opportunity may not be about adding more technology. It may be about turning on, monitoring and managing what their customers already have.
.jpg&h=142&w=230&c=1&s=1)
.jpg&h=142&w=230&c=1&s=1)
.jpeg&h=142&w=230&c=1&s=1)
.jpg&h=142&w=230&c=1&s=1)
