Cyber Insurance Rules Are Finally Killing Break-Fix

Break-fix is losing ground not because clients suddenly prefer managed services, but because the legal and insurance ground underneath it has shifted. A growing number of states now offer liability protection only to businesses running a documented security program, and cyber insurers are tying coverage to the same controls. Reactive, ticket-by-ticket IT work no longer qualifies for either.

The safe harbor laws nobody told you about

For two decades, the business case for moving a client off break-fix was mostly about margin and predictability for the MSP. That case still holds, but a newer one has shown up that has nothing to do with your pitch deck: state law. A cluster of states have passed what are known as cybersecurity safe harbor statutes, which give a business legal protection after a breach if it can show it was running a qualifying, documented security program at the time.

These laws do not care whether the work was done in-house or by a contracted provider. They care whether the controls existed, were maintained, and can be proven. A client whose IT support shows up only when something breaks has no ongoing program to point to. A client on continuous, documented management does.

This is a different kind of pressure than the one that drove the last decade of managed-services adoption. Ten years ago, the pitch for leaving break-fix behind was almost entirely about predictable cash flow for the provider and fewer surprise invoices for the client. Legislatures and insurers were not part of that conversation. Now they are, and they are not asking whether a client's IT works well. They are asking whether it can be documented, which is a question break-fix support was never designed to answer.

How many states actually reward documented security?

Six states, Connecticut, Iowa, Ohio, Oregon, Tennessee, and Utah, have enacted legislation that shields businesses from certain legal liabilities when data breaches occur, with Ohio's version accepting alignment with the National Institute of Standards and Technology's cybersecurity guidelines as sufficient grounds for the defense. That detail matters because it ties the legal protection to a recognizable, auditable framework rather than a vague promise of "good security."

That is not a regional curiosity. It is a signal of where state legislatures are heading, and the next state to join the list already has a date on the calendar.

What Oklahoma's new law means for every MSP client

Starting January 1, 2026, Oklahoma's Senate Bill 626 gives businesses that use "reasonable safeguards" an affirmative defense against civil penalties following a data breach, while entities without those safeguards face penalties capped at $75,000 plus actual damages. "Reasonable safeguards" under the statute means ongoing risk assessment, layered technical and physical controls, employee training, and an incident response plan, not a one-time setup.

Read that list again. It describes a managed, monitored relationship, not an on-call one. A client running break-fix IT cannot credibly claim an ongoing risk assessment program, because nobody is assessing anything until the phone rings.

Why do insurers care how a client's IT gets delivered?

Insurers reached the same conclusion from the underwriting side. Before issuing a policy, carriers now evaluate specific baseline controls, including multifactor authentication, endpoint detection and response, tested and immutable backups, a documented incident response plan, employee security awareness training, and privileged access management. None of those controls are static. All of them require someone watching continuously, which a break-fix arrangement structurally cannot provide between tickets.

The cost gap reflects that reality. Basic cyber insurance for small to midsize MSPs and their clients runs between $1,000 and $10,000 a year, while comprehensive coverage can exceed $50,000 annually. Where a client lands in that range depends on several underwriting factors together, among them business size, revenue, claims history, and industry risk, with verifiable security controls now sitting alongside the rest rather than being an afterthought.

Privileged access management is worth calling out specifically, because it is the control most break-fix arrangements skip entirely. A technician who logs into a client's environment only to resolve a ticket has no reason to build out role-based access, rotate credentials on a schedule, or log who touched what and when. An underwriter evaluating that same client sees an environment with no access discipline, which is treated the same as having none of the other controls in place.

What is actually driving the claims insurers pay out on?

The claims data explains why insurers got strict. Business email compromise and funds transfer fraud accounted for 58 percent of all claims in Coalition's 2026 Cyber Claims Report, making it the single largest claim category the report tracked. Separately, 86 percent of businesses hit by ransomware refused to pay the demand, according to the same report. Both figures point the same direction: the loss events carriers are pricing for are the ones caught by continuous monitoring and layered email controls, not by a technician who arrives after something has already failed.

An MSP still selling pure time-and-materials support is, in effect, asking a client to self-insure against the exact failure modes the market has decided are the most expensive.

What does moving off break-fix actually require operationally?

Consider a hypothetical MSP with 40 clients, roughly a third of whom are still on pay-per-incident contracts. Moving those clients to a documented, continuously monitored program means deploying endpoint monitoring, standing up a repeatable onboarding and configuration process for each one, and keeping an auditable record of what was checked and when. None of that is exotic work, but doing it by hand across dozens of clients is where most owners stall out and default back to reactive support.

That is the gap a dedicated platform is built to close. A tool like Catalyst handles the onboarding and provisioning work of standing up documented, continuous monitoring across a client base without adding headcount for every new account, which is the part of this transition that actually determines whether it happens on schedule or gets pushed to next quarter again.

The productization opportunity this creates

For an MSP owner, the regulatory and insurance pressure described above is not a threat, it is a sales argument that writes itself. Clients are going to need to document a security program regardless of who delivers it. An MSP that can package that documentation, the monitoring behind it, and the insurance-readiness story into a defined offering captures the recurring revenue that comes with it. One that waits for clients to ask will watch a reseller or a direct insurer referral take the account instead.

The packaging question is where most owners hesitate, because building continuous monitoring, access controls, and audit-ready reporting from scratch is a multi-quarter engineering project, not a weekend configuration change. That build-versus-buy decision does not have to be answered from a blank page. A full lineup of white-labeled MSP tools already covers most of the pieces an owner would otherwise have to staff and maintain independently, which shortens the path from "we should offer this" to actually billing for it.

Before committing budget to build that offering internally, it is worth running the numbers on what to build versus what to license white-labeled through the stack builder, since the gap between the two paths is usually wider than owners expect once onboarding and monitoring overhead are counted honestly.

Where this leaves the break-fix MSP

None of this means break-fix work disappears overnight, and plenty of MSPs will keep offering it for a subset of small or low-risk accounts. What changes is the ceiling on that model. A client who needs insurance, operates in a state with a safe harbor statute, or simply wants the liability protection those laws describe cannot get there through reactive support alone, no matter how fast the response time is.

The owners who treat this as a compliance footnote will spend the next two years losing those accounts to competitors who treat it as the product it already is. The ones who move first get to define what "insurance-ready IT" means to their client base before a reseller or a direct carrier program does it for them. See the full stack to compare what is already built against what you would otherwise have to staff and maintain yourself.