The beginning of 2025 has been wild so far, and there’s no sign of it slowing down. We’re back with more predictions for what 2025 will look like for MSPs, with an eye towards 2026 and beyond.

Whether it’s integrating cutting-edge technologies, adapting to regulatory shake-ups, or capitalizing on emerging markets, MSPs and IT leaders must stay ahead of the curve. That’s why ChannelPro turned to some of the sharpest minds in the channel and asked them to deliver an unfiltered forecast for the rest of 2025.

If you’re looking to enhance your service offerings or master shifting market dynamics, these predictions and insights will help you stay ahead in an unpredictable year.

Tarun Desikan

Desikan is executive vice president, cloud secure edge for SonicWall.

“In the Mission Impossible movie franchise, Tom Cruise and team make use of advanced techniques – latex 3D face masks, voice modulators, adaptive contact lenses and more – to impersonate people, enter restricted areas and save the world from destruction. In 2025, new AI capabilities will make what was only possible in the realm of movies available to the mainstream. And, as with all such new technologies, the bad guys will be amongst the first to take advantage. Unfortunately, the bad guys won’t be using impersonation to save the world; instead, they will launch more sophisticated spoofing and phishing techniques to launch cyberattacks against unsuspecting civilian organizations.”

Jim Elder

Elder is VP of global pathways at Blancco.

“The proliferation of AI will continue to increase demand for greater processing speeds and more scalable data operations in 2025. Hyperscalers will forge ahead with their buildout and focus on facilitating AI applications and supporting AI initiatives at large and medium enterprises. Meanwhile, the cloud migration “gold rush” will continue to cool off and balance out, leading CIOs to shift budget into their own enterprise data center operations. This will further increase spend and demand for partner services that include helping enterprises optimize their cloud environments.”

Tim Erlin

Erlin is VP of product at Wallarm.

“In 2025, Managed IT will be all about reducing the burden for customers. As security incidents continue to gain more visibility with businesses and their boards, I predict that the dividing line between MSPs and MSSPs will blur. MSPs who are looking to expand their ability to help customers are likely to expand into security.

Also, a backup is only as good as the business’ ability to recover. So, the opportunity isn’t around “SaaS backups,” but around SaaS recovery.

MSPs looking to expand their “data loss” offerings in 2025 should focus more on business continuity. The real value to customers is gained by examining the threats that might disrupt their operations, including their SaaS tools, and providing a fast, reliable path to recovery.”

Terry Hedden

Hedden is the CEO of Marketopia.

“I believe the Managed IT Industry will continue the transformation it began in 2024. Security risks are becoming more complex. MSPs will elevate the services they offer far beyond user support to become both providers of very robust security.  I also see increased regulation and industry requirements that MSPs will be required to provide. The market opportunity for businesses in general is great in 2025. That means a very bright future for MSPs that are able to demonstrate value and increase income and profit as a result.”

J.J. Kardwell

Kardwellis the CEO of Vultr.

“In 2025, agentic AI will leap from imaginary to necessary, quickly redefining enterprise automation. Self-directed AI applications will allow organizations to make real-time, data-driven decisions, particularly in sectors already making use of sovereign and private clouds. Expect early enterprise-level adopters to crop up in places where CapEx isn’t an issue, deploying high-performance GPU and CPU clusters for mission-critical applications. Simultaneously, lighter agentic AI solutions will flourish through alternative cloud providers, enabling serverless inference at the edge, slashing costs and complexity.

By outsourcing infrastructure management, businesses will be able to focus on optimizing the AI application layer, unlocking unparalleled productivity and customer engagement. To support the massive scale of AI inference required, organizations will increasingly deploy specialized models paired with vector databases and RAG at edge locations. This edge-focused architecture will deliver the ultra-low latency needed for AI agents to effectively support the volume of AI interactions needed for agentic AI at scale.”

Denny LeCompte

LeCompte is the CEO of Portnox Security.

“There will be an even greater financial opportunity for MSPs to offer SaaS data backups in 2025. As organizations increasingly migrate to cloud-native solutions, the need for comprehensive data protection has never been higher. MSPs can capitalize on this demand by providing reliable SaaS backup services, thereby expanding their service portfolio and generating new revenue streams. By addressing a critical need, MSPs can enhance their value proposition and strengthen customer relationships.”

Dror Liwer

Liwer is the co-founder of Coro.

“In 2025, AI can either be a powerful ally or an unseen double agent. On one hand, it will help MSPs and their clients boost productivity; on the other, it introduces significant risks. In the rush to improve efficiency, security often takes a back seat, and sharing sensitive data with AI tools can result in severe consequences.

In addition, expect more AI-driven attacks as hackers further experiment with the technology and become more clever in their social engineering. For example, phishing emails are getting alarmingly good at mimicking people’s tone and even referencing past conversations. The usual security training is not cutting it anymore and MSPs will need to lean on advanced tooling like email address cross checking and behavioral tracking to plug those gaps. For SMBs, having an MSP who can stay ahead of these attacks will be a game-changer.”

Gary Pica

Pica is the president of TruMethods, a Kaseya company.

“Managed service providers (MSPs) are taking a more strategic role with their small to medium-sized business (SMB) customers as they invest more in technology and security. Lowering costs, adding value, and becoming more efficient is the top priority of every MSP. Automation and AI will play a critical role in this phase of the MSPs’ journey.

SMB decision-makers are now more educated about what a comprehensive IT and security offering looks like. For this reason, a more complete, automated solution will be more important than ever, and MSPs will need to be ready to offer it to their customers.”

If your organization takes security monitoring seriously, you’re likely drowning in dashboards, logs, and alerts from SIEMs, EDRs, SOAR platforms, and enough threat intelligence feeds to make your head spin. But amidst all the buzz about real-time monitoring, anomaly detection, and automated response, there’s often a glaring blind spot: Network Access Control (NAC).

Yes, NAC—arguably one of the least flashy but most foundational security tools—is often overlooked in security monitoring discussions. But if you’re not integrating NAC into your security monitoring strategy, you’re leaving gaps in your visibility, increasing your attack surface, and making it harder to respond to threats in real time.

So, let’s talk about where NAC fits into a well-rounded security monitoring strategy and why ignoring it is a mistake your SOC (Security Operations Center) can’t afford.

The Role of NAC in Security Monitoring

At its core, NAC enforces security policies by controlling which devices and users can connect to your network. But in doing so, it generates a wealth of valuable data that should feed into your broader security monitoring ecosystem.

Here’s what NAC brings to the table:

• Real-time visibility into device connections: Every device that attempts to access your network—whether a corporate laptop, a rogue IoT device, or an attacker’s foothold—gets logged by NAC. This visibility is essential for identifying unauthorized or suspicious devices before they become a problem.
• Policy enforcement and automated responses: NAC doesn’t just alert you to security issues; it acts on them. When a device fails compliance checks (e.g., missing security patches, outdated AV, unrecognized MAC address), NAC can quarantine or block it automatically, reducing the time attackers have to move laterally.
• Contextual data for security investigations: When correlating data from a SIEM or SOAR platform, NAC logs can provide context on whether a user’s device was compliant, where it connected from, and whether access was granted or denied. This is crucial for incident response.

Now, let’s look at how NAC should integrate into your broader security monitoring strategy.

1. Feeding NAC Data into SIEMs for Comprehensive Monitoring

Most organizations rely on a Security Information and Event Management (SIEM) solution to centralize security logs, detect anomalies, and trigger alerts. Yet, many fail to include NAC data in this process.

Why it matters:

• SIEMs thrive on correlation—NAC provides essential data on who’s connecting, from where, and whether they passed security checks.
• If a user’s account triggers a login from an unusual location in the IAM logs, NAC can confirm whether their device was present on the corporate network or using a VPN.
• NAC logs can identify when devices that were previously blocked attempt to reconnect, potentially signaling an insider threat or an attacker persistently probing for access.

How to integrate NAC with your SIEM:

• Send NAC logs and alerts to your SIEM in real time.
• Correlate NAC data with firewall logs, endpoint detection and response (EDR) tools, and authentication data.
• Use NAC policies as an early indicator of device compliance issues before they escalate into security incidents.

2. Using NAC as a First Line of Defense in Zero Trust Architectures

Zero Trust isn’t just a buzzword—it’s a necessary shift in security strategy. NAC plays a crucial role by ensuring that only authorized, compliant devices gain access to the network in the first place.

How NAC fits into a Zero Trust strategy:

• Continuous verification: NAC doesn’t just check compliance at login; it continuously enforces security policies. If a device falls out of compliance (e.g., a user disables their endpoint protection), NAC can revoke access immediately.
• Least-privilege access: Combining NAC with microsegmentation ensures that even if an attacker compromises a device, lateral movement is restricted.
• Dynamic risk-based access: Integrating NAC with identity providers (e.g., Entra ID, Okta) and security monitoring tools enables adaptive access controls based on risk signals.

By ensuring that every device accessing your network is continuously assessed, NAC strengthens the foundation of Zero Trust security monitoring.

3. Automating Incident Response with NAC and SOAR

Security teams are overwhelmed with alerts, making automation a must. NAC, when integrated with a Security Orchestration, Automation, and Response (SOAR) platform, can act as an automated containment mechanism for threats detected elsewhere.

Example use cases:

• If an EDR detects malware on a device, SOAR can trigger a NAC policy to isolate that endpoint from the network.
• If an unusual login attempt is flagged by an IAM system, SOAR can use NAC to block the user’s device until security reviews the case.
• If a SIEM detects multiple failed login attempts from an unknown device, NAC can automatically deny access and flag the security team for investigation.

With SOAR integration, NAC isn’t just enforcing access controls—it’s actively participating in threat containment.

4. Strengthening Security for IoT and Unmanaged Devices

IoT security remains a nightmare for enterprises. These devices often lack traditional endpoint security controls, making NAC one of the few tools capable of providing visibility and enforcement for them.

What NAC can do for IoT security:

• Fingerprint and classify devices to detect unauthorized or rogue IoT devices.
• Segment IoT devices to prevent them from accessing sensitive corporate resources.
• Trigger alerts and block anomalous behavior—for instance, if a smart thermostat suddenly starts trying to communicate with external servers in Russia.

By integrating NAC data into security monitoring platforms, you can detect and mitigate IoT threats in real time.

Final Thoughts: NAC as a Security Monitoring Force Multiplier

If you’re only using NAC as a compliance checkbox, you’re missing out. In the right hands—and integrated with SIEM, SOAR, Zero Trust, and IoT security frameworks—NAC becomes a force multiplier for security monitoring.

Instead of viewing NAC as a standalone gatekeeper, think of it as a real-time security enforcer that feeds critical data into your broader threat detection and response strategy.

A well-integrated NAC strategy doesn’t just keep attackers out—it actively helps your security team detect, investigate, and respond to threats faster and more effectively. And in today’s landscape, where speed is everything, that’s not something you can afford to ignore.

The December 2013 Target hack remains one of the most infamous data breaches in cybersecurity history.  The hackers stole 40 million credit card numbers, got the PII (Personal Identifiable Information) of 70 million people, cost Target upwards of $200 million, and ruined Christmas for probably every single person working in Target’s IT department.  The breach not only tarnished Target’s reputation but also impacted several other sectors, highlighting the ripple effects of large-scale cyberattacks. Financial institutions faced increased costs for reissuing millions of compromised cards, while consumers dealt with heightened anxiety over identity theft and fraud. The breach also served as a wake-up call for retailers and businesses worldwide, prompting many to reevaluate their cybersecurity practices and adopt more robust systems to safeguard sensitive data. Ultimately, it underscored the critical importance of proactive cybersecurity measures in an increasingly interconnected world.

What the Hack Happened

The breach began when attackers targeted a third-party vendor that had legitimate access to Target’s network. The vendor, Fazio Mechanical Services, was a Pennsylvania-based HVAC (heating, ventilation, and air conditioning) company that provided maintenance services to Target.

Attackers sent a phishing email to Fazio employees, and one unfortunate soul fell for it. That’s a point that deserves some emphasis – it only takes one person, one click, in one unguarded moment, to give the bad actors a way in.  

The laptop was protected with the free version of Malwarebytes – an excellent tool that scans for and eliminates malware when initiated by the user.  The version you pay for – that actually gets appropriately licensed for corporate use – has a real-time scanner that probably would have caught the issue, because the malware installed, called Citadel, was pretty well-known.

Network Infiltration

Using the stolen credentials from Fazio Mechanical Services, the attackers got access to a Target-hosted web service dedicated to outside vendors.  They uploaded a file that allowed them to install a web shell to execute commands on the hosting server.  Some call this a vulnerability, but there are lots of legitimate reasons a web application would let you upload files – invoices, for example – and while it should ideally block executables, it’s easy enough to disguise them. 

 They used a Pass-the-Hash attack to get domain admin credentials, and then the network was their playground.  They went looking for database servers, and they found them – to the tune of 70 million records of PII (Personally Identifiable Information.)

But here’s a fun fact – know what those databases did not contain?  Credit card numbers!  Because Target’s data was PCI-DSS compliant, there was no financial info stored on their database servers.  

Deployment of Malware & Exfiltration of Data

Having been foiled in their scheme by Target’s PCI-DSS compliance, the hackers moved on to plan B (or what might have been plan A all along, we don’t really know) – infiltrate the PoS (Point-of-Sale) servers and capture credit card data in real-time.  They did this using malware called Kaptoxa, which would scrape the machine’s memory and store anything that looked like a credit card number in a file. Then, the malware would periodically transfer that file to another server, which would transfer it back to the hackers via FTP.  

If you’ve been following along so far, one thing that may have stuck out to you was how the attackers were able to wander through the network, accessing pretty much whatever they pleased.  This is why standard security procedures – like role-based access control and network segmentation, are so important.  

Note: There’s a very thorough deep-dive about the hack here, including all of the tools, protocols, and technology used if you want to geek out.

Target’s Security Posture Before the Breach

You might think that Target had pretty poor security before the breach, but that was surprisingly (and alarmingly) not true.  They had a security team of over 300 employees and had just invested in the well-known security tool FireEye.  This tool actually did send out alerts about the malware, which the security team forwarded on to the operations team….but no one did anything about them.  Not only that, FireEye has a setting that can automatically remove Malware….and they turned it off. The thought was they wanted a human to make decisions about what to remove vs. automated software.  

Lessons Learned

So what are the lessons we can take away from Target?  Let’s review:

Lesson 1: Security can be expensive – but not nearly as expensive as a breach.

Lesson 2: Assume every device outside your organization is compromised, because eventually one will be.

Lesson 3: Regulatory compliance might be difficult, but it is often worth it.

Lesson 3: Pay attention to the security basics.  Role-based access control, least-privileged access and network segmentation are not new concepts, but they are invaluable to minimize damage.  

Lesson 4: Your security tools are essential; invest in them and tailor them to work for you.  Automation is there to make your life easier.  

We’re going on 12 years since this hack happened, and it still serves as a powerful reminder of the critical importance of cybersecurity in today’s digital age.  The Target breach underscored how even a single weak link in a company’s supply chain can have catastrophic consequences, impacting not only the business but also millions of customers. It also paved the way for stricter industry regulations and greater emphasis on safeguarding sensitive data. As cyber threats continue to evolve, the lessons from this breach remain especially relevant.