MSPs need to drive outcome-based relationships in cybersecurity, says Rapid7 CSO. – ARNnet

In the face of increasing cyber threats, managed service providers (MSPs) and technology service providers (TSP) are encouraged to drive transparent and honest relationships with their customers.
Having a reliable team that includes third-party providers can help mitigate the stress and burnout faced by CISOs, explained Rapid7 CSO Brian Castanga.
Prior to joining Rapid7, Castanga worked as a CISO at a number of US-based enterprise organisations in senior cybersecurity executive roles. He speaks from experience in the working relationship between third party suppliers and CISOs.
“There’s a lot of challenge and we’re trying to defend all the time,” he told ARN in an interview. “There’s a lot that’s coming at us, so having partners through services or software that we can trust — it’s not like a tagline — we really have to.”
Without the right support the stress and mental health challenges leads to high turnover in the CISO role.
“I have a friend who got that call — it’s usually a matter of not if, but when — he got the call and he was on a hike with his family,” Castanga explained. “It was a Sunday and he just started crying because he knew that the next three months of his life was going to be dealing with this incident.
“Having that strong team — people you can rely on – [is] why you keep hearing me say ‘trust in partnership’. [It’s] because that’s in the back of our minds at all times.”
“I really need people that I can trust and depend upon and know that when I have that bad day, they will be there to help me.”
The other part of that is having the solution that is being offered to CISOs fits in “at the right place, at the right cost and for the right need”, Castanga noted.
“With all of our budgets being squeezed, whether you’re a CISO or not, the mix of best of breed and platform is super important,” he said.
For Castanga not having the right type of support in his previous role become successful fast means having technology that works.
“I need to have those aha moments in a POV [proof of value],” he explained. “Then I need the service and support to make sure that it does work.
“If we’re talking about weeks and months versus hours and days for me to become successful, then it’s not a win.”
In Castanga’s past experience working with MSPs – the majority were of service providers he worked with in the US are either going to be pure software, software plus service.
This includes those integrated with a vendor, or a value-added reseller that is providing services.
The way that Castanga thinks about working with partners is like art than a science.
“You have to have the right skills in the right place, with the right levels of experience,” he explained. “That absolutely now includes third-party providers and other service providers that are going to help build that collective team.”
While cybersecurity was a lot “simpler 15 years ago”, with threats less frequent and less impactful.
“The whole journey has been as the threats have advanced, both in the types of threats like ransomware,” Castanga said. “[Talking] about ransomware in 2011, 2012…I mean, can you imagine if 10, 50, 100 companies were getting ransomware?
“Add on data breaches and other types of operational or availability issues or defacements, you add all the nation states.
“Those threats and the impact of those threats have gotten much more difficult, and as a result, the technology stacks that we need have gotten more complex.”
“In the past five years, I’d say there’s more of a shift back to platformisation. There’s also more of a shift to a lot of soft problems.
“[It’s] been a journey and it’s not getting easier with AI yet.”
 Castanga’s insights helps to reinforce the challenges Rapid7 customers are dealing with.
“We need to understand the challenges that exist at [that] levels, and sometimes [it’s] different to the conversations that we have with the technical team,” noted channel director Asia Pacific Japan (APJ) David Quist.
That means making sure “partners are as conscious” as Rapid7 sellers, he said. As well as being prepared as they can be for the types of conversations they need to have.
“Our partners’ technical teams are at the heart of how customers experience Rapid7 in the market,” Quist said. “These are highly skilled practitioners who customers trust to guide critical security decisions, often in complex and high-stakes environments.”
That’s why the vendor has revised its channel program and relooked at how it rewards partners – which gives clearer deal structures, stronger incentives for partner-led opportunities, and economics that support long-term growth.
The recently released 2026 partner program introduces partner tier differentiation, simplified deal motions, and enhanced program economics.
Rapid 7’s PACT framework supports partners delivering managed detection and response. As well as other recurring security services where consistency and margin clarity are critical.
Other key updates to the program include platinum partner tier, updated deal motions, improved program economics and a Tech Champion program.
With the introduction of initiatives like the Tech Champion framework, we’re doubling down on recognising that expertise,” explained Quist. “[This] gives partner engineers earlier visibility, deeper engagement and a stronger voice in how we go to market together.
“These changes are very much shaped by partner input, ensuring we’re aligned to how they build profitable security practices while responding to increasingly complex customer needs.”
Quist said the changes to the partner program wasn’t just about “hitting partners with a lot of information about solutions.”
“It’s really about how we connect better and get better acceptance of those solutions,” he said. “We need to continue to invest [in] how we help our partners win the trust of their existing customers, to continue to earn the right to maintain those relationships.
“We’re not looking to be ‘showing up and throwing up’… because that gets you a pretty quick journey to the exit.”
According to Quist that’s Rapid7’s responsibility as part of the wider cybersecurity community.
“We work collaboratively,” explained Quist. “Brian’s [Castanga] isn’t going to be able to help and solve all these problems by himself.
“He’s going to make informed decisions based on the problems that he’s got and the relationships that he trusts.
“I suppose what we’re trying to reinforce with the Rapid7 community is that…we need to be able to empathise with the situations that CISOs face.
“I think CISOs have more and more expectations. Partners will [need to] approach [them] in a way that he can rely on. Also one that’s real, very much aligned to the outcomes that he’s trying to get.”

source
This is a newsfeed from leading technology publications. No additional editorial review has been performed before posting.