Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

If you've glanced at a vulnerability tracker lately, the numbers look alarming. The Forum of Incident Response and Security Teams (FIRST) now projects roughly 66,000 CVEs will be published in 2026; up from a February forecast of 59,427 and closing in on 70,000 by some counts. That would follow a record 2025, which finished at roughly 48,000 disclosed CVEs, itself a sharp climb from about 40,000 the year before. It's tempting to read that curve as a sign that software is getting worse. It isn't.

Guest post by Neil Holme, Founder and CEO of Impact Business Technology, a WatchGuard partner. The cloud environments MSPs manage change every week. Clients adopt new SaaS applications, AI tools, and collaboration services, making it difficult to track what is in use, how it is configured, and which access permissions remain active. Exposure grows without a clear warning sign until an incident occurs. The cloud is also the fastest-growing attack surface an MSP manages.

The European Commission has published its first official guidance to help businesses implement the Cyber Resilience Act (CRA)—the EU regulation establishing cybersecurity requirements for products with digital elements. The timeline is critical: reporting obligations for actively exploited vulnerabilities and severe incidents take effect on September 11, 2026, while the core CRA requirements will become mandatory from December 11, 2027.

The NIST’s changes in how the National Vulnerability Database (NVD) operates have fundamentally shifted how organizations interpret the vulnerabilities published in this go-to registry. In the past, the NVD provided vulnerability enrichment data, such as CVSS scores, affected products, CWE classifications, and reference links.

The MSP landscape is evolving. Customers increasingly expect more than technology management, they want trusted partners who can help them understand, reduce, and manage cybersecurity risk. WatchGuard's upcoming “Provider to Advisor: The MSP Shift Toward Risk Leadership” webinar explores exactly this opportunity.

For years, managed service providers (MSPs) have secured customer cloud environments through periodic reviews of each tenant. That approach worked when a customer ran two or three cloud applications. As organizations adopt more SaaS applications, the number of environments, identities, and configurations to monitor also increases. The challenge is already visible.

For years, the sophistication of a cyberattack was closely connected to the sophistication of the attacker behind it. Advanced campaigns required experienced threat actors with the knowledge, resources, and time needed to research targets, understand environments, create convincing interactions, adapt when something failed, and coordinate complex operations. Artificial Intelligence is beginning to change that relationship.

Artificial intelligence is no longer a future consideration for MSPs because it is already reshaping how leading providers run their businesses, protect their clients, and create new revenue streams. Separating real business value from hype requires a clear-eyed, practitioner-driven perspective. Join Marc Laliberte and a panel of MSP and security operations leaders for a candid discussion on how AI is being deployed today.

WatchGuard Technologies, a global leader in unified cybersecurity, has been recognized as a 2026 CRN Annual Report Card (ARC) Award winner in the Security: Network Security—SMB category by CRN, a brand of The Channel Company. The recognition is based on direct feedback from solution providers across North America, who evaluated technology vendors on product innovation, support, partnership, and managed and cloud services. WatchGuard achieved an overall score of 92.8, ranking first in the category.

The recent Grandoreiro campaign detected by the WatchGuard Threat Lab team is a clear example of how today’s threats combine different techniques to make detection more difficult and operate more discreetly. In this case, the attack begins with a phishing email designed to persuade the user to click a link. From there, the victim is taken through several redirects and eventually downloads a compressed file from well-known services such as Dropbox or MediaFire.