Join WatchGuard CISO Corey Nachreiner and Director of Security Operations Marc Laliberte as they unpack key findings from the WatchGuard Threat Lab’s H1 2026 Internet Security Report. During the lead half of the year, nearly every measure of attack volume fell while nearly every measure of attack variety rose.

They’ll explain why 95.72% of the malware blocked on endpoints last quarter appeared on exactly one machine, how malware-as-a-service builders and large language models made per-victim payloads cheaper than a mass campaign, and why the exploits reaching networks are ancient; the median vulnerability under attack being first disclosed in 2014. Along the way, they will also cover the generic web shell detection that became the most widespread network attack on Earth, and how ransomware extortion groups grew.

In this webinar, you’ll learn:

• Why the falling attack volume in H1 2026 did not mean falling risk
• How attackers build a unique payload per victim, and what still catches them
• Why decade-old flaws and plain SQL injection still do most of the damage
• How stolen credentials and Windows living-off-the-land (LotL) binaries get attackers around your controls
• Defensive priorities you should act on first

Your clients rely on a growing security stack to protect their business. Endpoint protection, firewalls, identity security, cloud controls, and detection tools all play an important role in reducing risk. But those investments generate a constant stream of alerts, events, and telemetry that need to be monitored, investigated, and acted on.

That's where the challenge begins.

For MSPs, managing security across multiple customers often means juggling alerts from disconnected products, switching between consoles, and identifying the threats that matter, all while creating operational overhead and increasing the stress of missing critical signals. 

Join WatchGuard as we explore how MSPs can move beyond siloed security monitoring and extend managed detection and response across the technologies their clients already use. Learn how a unified approach to managed security can help uncover threats faster, improve operational efficiency, and build a more scalable, profitable security services practice.

You'll learn:

• Why security tools alone don't guarantee visibility across customer environments
• The operational risks of disconnected security tools and alert streams
• How endpoint-only MDR can leave gaps across network, identity, and cloud security
• The value of connecting telemetry across multiple security layers
• Practical ways to scale managed security services without increasing operational overhead

Network Detection and Response (NDR) has traditionally come with a heavy price tag, including complex deployments, expensive infrastructure, constant tuning, and skilled analysts to manage the workload. That model was built for enterprise SOCs, not MSPs protecting dozens or hundreds of customers.

In this webinar, Stephen Helm explores how WatchGuard Total NDR changes the equation. Learn how MSPs can uncover threats traditional security controls may miss, centralize detection and response across customers, reduce alert noise through behavioral analytics and automation, and deliver advanced network security without building a dedicated SOC.

We’ll cover:

• Why NDR is a critical service offering for MSPs
• The pitfalls of NDR designed for an enterprise SOC
• Use cases & go to market trends

As customers expand their networks, embrace cloud applications, and demand a better user experience, many MSPs find themselves troubleshooting performance issues that are not easily explained by bandwidth or connectivity alone. Hidden constraints within a customer's network security infrastructure can create bottlenecks, introduce operational challenges, and make growth more difficult to support. 

Join us as we explore five warning signs that cybersecurity may be limiting performance and learn how modern approaches can help MSPs deliver a better experience, reduce complexity, and position customers for long-term success.

Key Takeaways:

• Recognize when faster connectivity isn’t improving performance
• Understand how encrypted traffic increases inspection demands
• Spot when performance is driving security compromises
• Identify legacy infrastructure limiting network upgrades
• Assess whether security capacity can support growth

A cloud incident does not always start with a sophisticated attack. Sometimes it starts with a small configuration mistake, such as guest invitations left unrestricted, or a mail forwarding rule still enabled after a migration. 

For MSPs, that risk can multiply quickly. Standardized policies, repeatable configurations, and shared operational processes make it possible to manage many customers. However, they can also allow the same security weakness to propagate across multiple environments. 

In this webinar, we will explore how:

• Small cloud security gaps can combine, spread, and ultimately contribute to larger incidents. 
• Continuous security assessments can help MSPs identify where protection is weakening, prioritize issues based on the severity CloudDR assigns to each, and demonstrate measurable security improvement across their customer base. 
• WatchGuard CloudDR, Rai Auditor, Security Strength, and Insights Hub can help MSPs move beyond periodic posture reviews.