Fixing a ransomware attack is not enough to keep your IT provider's clients

An IT company can fix a ransomware attack and still lose the customer. Kaseya, a software maker for IT providers, says 12% of managed service providers (MSPs) lost clients after security incidents, based on its 2026 Cybersecurity Outlook report. An MSP is a company that runs technology for other businesses. Ransomware, account takeover and business email compromise were among the main reasons.

What goes wrong after the restore

The article describes a recovery that works on a technical level but still leaves the client unhappy. Updates go quiet for two days. Costs climb without explanation. The invoice shows 31 hours of emergency labor that the client does not recognize. Those doubts can carry into the next contract renewal.

Time matters too. According to industry reports, only 16% of affected organizations fully recovered within a day. Some 55% recovered within a week. Every extra day of disruption costs a business that depends on its systems to serve customers and earn money.

Why it happens

Kaseya points to disconnected tools. Backup, monitoring, ticketing and billing often sit in separate systems. During an attack, staff spend hours piecing together what happened instead of restoring systems.

• An alert, a ticket and a restore job can live in three tools with nothing linking them.
• Emergency and after-hours work often goes untracked, then gets rebuilt from memory days later.
• Without one ticket trail, some clients get a call every few hours while others hear nothing.

What the report found

Kaseya's 2026 report found two factors that supported faster recovery. One was well-trained internal IT or security teams, at 35%. The other was integrated security and IT management tools, at 18%.

Kaseya's answer is its own product, Kaseya Trifecta. It combines remote monitoring (RMM), ticketing and billing (PSA) and backup and disaster recovery (BCDR) in one platform. This is a vendor article, so the product claims come from the seller. The material does not include independent testing of Trifecta.

What it means for you

If a business hires an IT provider, the lesson is to settle the awkward questions before an attack. The article says providers who set expectations early, communicate on a schedule and explain costs before they become surprises are more likely to keep client trust.

• How often will you hear from the provider during an incident?
• Who will be your contact, and will everyone give the same answer?
• How will emergency hours be tracked and billed?