BYOD has moved from a side topic to a core security concern for MSPs because it represents one of the last major unmanaged risk areas in the IT environment.

According to Omdia’s survey of 319 US-based MSPs in early 2026:

• 65% said at least one client requested help with BYOD security or data-exposure risks in the past 12 months.
• Nearly half (45%) said multiple clients have raised the issue.

This demand spans client sizes:

• 70% of MSPs serving mid-market clients (100+ employees) reported BYOD-related requests.
• 42% of MSPs focused on very small businesses (fewer than 10 employees) also heard BYOD requests.

At the same time, employee-owned devices are still largely unmonitored compared with other assets:

• 79% of MSPs monitor corporate laptops.
• Only 24% monitor employee-owned devices.
• Corporate mobile phones sit in the middle at 34%.

In other words, personal devices are actively accessing corporate email, files, and credentials, but they sit outside the managed perimeter. That combination of clear client demand, visible incidents, and a large coverage gap is why BYOD is now a priority topic for MSPs.

The incident data shows that BYOD risk is less about lost hardware and more about compromised identities.

In the Omdia survey, 55% of MSPs reported at least one BYOD-related security incident in the past 24 months where an unmanaged personal device played a material role. Among those incidents:

• 45% involved credential theft or account compromise.
• 42% involved email or messaging compromise, often phishing.
• 40% involved malware.
• 31% involved data leakage (files, screenshots, messages).
• Only 29% involved lost or stolen devices.

This pattern shows that the primary BYOD risk has shifted to the identity layer rather than the physical device. Attackers are targeting credentials and sessions on personal devices that connect to corporate systems, and then using those identities to move further into the environment.

MSPs with higher annual recurring revenue (above $10 million) reported a 61% BYOD incident rate, compared with 52% for smaller MSPs. This likely reflects better detection rather than lower risk for smaller providers, suggesting that the overall 55% incident figure may understate the true prevalence.

For MSPs, this means that BYOD governance can’t be limited to device-centric controls. It needs to address identity, credentials, and sessions alongside traditional endpoint protections.

Most MSPs see a path to offering BYOD services but have been cautious because of operational and legal concerns. In the Omdia research:

• 92% of MSPs said they can envision a model for offering BYOD services.
• The top preference (36%) is to package BYOD as an optional add-on to existing services.

The main historical barriers have been:

• Operational complexity – per-device configuration, manual enrollment, and client-by-client policy scoping don’t scale well.
• Liability – traditional device-control models can make the MSP feel responsible for personally owned hardware.
• Blast radius concerns – fear that a BYOD incident could spread into the broader client environment.

The solution landscape is starting to reimagine how BYOD is handled. MSPs in the study described what they want from next-generation BYOD governance:

• Automated, self-service enrollment for users.
• Hyper-automated onboarding and selective wipe that can scale to thousands of users.
• A shift from device-centric to identity-centric security, protecting credentials and sessions rather than taking full control of the hardware.
• Privacy-first approaches that respect personal ownership while still protecting corporate data.
• Integration that works alongside the existing security stack instead of complicating it.

For MSPs, a practical path forward is to:

1. Define a BYOD governance service as a security add-on (not a standalone one-off project).
2. Anchor the design in identity protection (credentials, access, sessions) plus lightweight device hygiene.
3. Use tools that support automated enrollment and selective wipe to keep operations lean.
4. Position the service as a way to close the “last unmanaged gap” in the client’s security posture.

Because 76% of MSPs already treat security as core to their practice, BYOD governance fits naturally into existing security offerings and can help differentiate the business in a part of the market that still values specialization.