Right of Boom 2026 Recap: 4 Key Cybersecurity Takeaways for MSPs

At Right of Boom 2026, one theme ran through every Blackpoint Cyber session: cybersecurity challenges are no longer just technical problems. They are business risks, and MSPs are increasingly expected to help customers understand, manage, and recover from them. 

From cyber insurance pressure to identity-driven attacks and sophisticated social engineering, MSPs must guide customers through complex decisions with real financial consequences. 

Here are the most important takeaways from Blackpoint Cyber’s pre-day panel and session, and what they mean for MSPs in 2026. 

1. Readiness Matters More Than Ever in Cyber Insurance 

The pre-day panel highlighted a growing gap between perceived security and insurable security. Many organizations only quantify risk after an incident occurs. 

Insurers are no longer satisfied with checklists. They want evidence that risk is actively mitigated, and that response capabilities are tested. 

“Response maturity directly impacts outcomes. When MDR is deployed effectively, downtime can drop from weeks to days: a difference that can turn a multi-million-dollar claim into a far smaller financial event.”  -Andy Runyan, Director of Strategic Alliances at Ukon 

Insurance claims trends are evolving: 

• Business Email Compromise (BEC) and ransomware claims are now nearly equal. 

• Invoice manipulation remains one of the most common MSP-related claims. 

• For every ransomware incident, roughly ten BEC cases move through insurance. 

What this means for MSPs: Prevention is critical, but readiness, documentation, and process maturity increasingly determine business impact. MSPs who guide clients beyond tool discussions toward risk-based strategies will stand out as trusted advisors. 

2. Threat Actors Are Logging In, Not Breaking In

In the breakout session led by Wil Santiago, the discussion emphasized that modern attacks are rarely about advanced exploits, they are about predictable weaknesses.  

“It’s not a tool failure. It’s a posture failure.” 

Common attack vectors include: 

• Weak identity hygiene 
• Over-privileged accounts 
• Exposed VPNs and edge devices 
• Limited visibility across endpoint, network, and cloud 

“In 2025, 96% of Blackpoint’s response activity occurred in the cloud, with identity at the center of nearly every incident. Credentials remain the fastest path to compromise.  Credentials are king. If I have credentials, I am you.”  -Wilfredo Santiago, Chief Security and Trust Officer at Blackpoint Cyber 

Examples of real-world attack paths: 

• Adversary-in-the-Middle phishing that bypasses MFA 
• Legitimate remote tools used for persistence 
• Fake CAPTCHA attacks that trick users into executing PowerShell 
• Identity compromise used to pivot from cloud environments to on-prem environments 

A clean EDR dashboard doesn’t guarantee security; it may simply mean an attacker hasn’t tested the environment yet. 

3. Adopt Verification and Assume Compromise  

Social engineering continues to evolve faster than awareness training alone can prevent. The panel emphasized a pragmatic approach: assume compromise. 

Users will click. MFA will be bypassed. AI will accelerate attack speed. Verification of logins, access changes, behavior, and intent must become an operational standard, not an optional control. 

“We are all human at the end of the day.” -Calvin Engen, Chief Technology Officer at F12.net 

Identity-first controls such as conditional access, token lifetimes, and continuous monitoring, are now foundational. MSPs who can explain how these measures reduce business risk will be positioned as indispensable advisors. 

4. The Importance of Oversight in AI and Automation 

AI was a recurring topic across sessions, with a focus on practical applications in security operations. 

“AI lies. You have to verify.” – Nett Lynch, Chief Information Security Officer at Kraft & Kennedy, Inc. 

Effective MSPs are not replacing people with AI. They use AI to reduce repetitive work, improve response quality, and scale insight without losing context. Automation is most effective when applied to documented, repeatable processes. Otherwise, it accelerates existing gaps. 

AI governance is increasingly part of vendor risk management. Organizations that claim not to use AI often present higher risk than those that do, since unapproved use is already widespread. 

What MSPs Should Prioritize in 2026 

Across all sessions, one conclusion was clear: raising the security standard is no longer optional. Key priorities include: 

• Accurate asset visibility 
• Identity-first security strategies 
• Hardening posture before incidents occur 
• Clear response plans that reduce downtime and financial impact 

Clients care less about individual tools and more about outcomes: they want continuity, accountability, and confidence that risks are understood and managed. MSPs can differentiate by acting as trusted advisors, not just technology providers. 

Right of Boom reinforced a simple truth: cybersecurity decisions impact revenue, insurance, operations, and customer trust. 

If you want to discuss the business challenges you’re seeing and how Blackpoint Cyber partners with MSPs to address them, book time with our team. 

Understanding risk before the next incident is what allows organizations to stay ahead of the boom.