76% of MSPs that sell cybersecurity hold no security certification at all.

Limitations

• We measure what a company lists publicly, not what it holds. A firm with SOC 2 and no mention of it on its site counts as uncertified here.
• Services are on file for 32,365 of the 39,351 firms in scope, so the 17,936 figure is a floor on how many sell security, not a census.
• Certifications are checked on 20,139 firms; an unchecked firm counts as showing none.
• That limitation is part of the finding: buyers also only see what you list.

What to do with this

• Put every certification, company and individual, on a single page and link it from the security service page.
• Name the issuing body and the year. An unattributed badge image reads as decoration.
• If a certification is in progress, say so with a date rather than leaving the section blank.

More findings