The Uptime report

Author: chrisomo

  • IT Services Industry Growth 2026: Revenue Up 3%, While Cloud Hosting Grew 20%

    Uptime Report Research · Industry Revenue

    IT Services Industry Growth 2026: Revenue Up 3%, While Cloud Hosting Grew 20%

    IT services industry growth slowed to a modest pace in 2026 while the businesses selling cloud capacity and software pulled away. Census Bureau survey data put revenue for computer systems design and related services, the industry that includes managed service providers, 3.2% above a year earlier in 2Q 2026. Data processing and hosting grew 20.4%.

    +3.2%IT services (NAICS 5415), 2Q 2026 vs 2Q 2025
    +20.4%Data processing and hosting (518)
    +15.0%Software publishers (5112)

    The growth race across service industries

    Year-over-year revenue change in 2Q 2026 for the service sectors in the Quarterly Services Survey and selected information and professional services industries. IT-related industries are in bold. Among the 65 four-digit industries in the survey, IT services ranks 48 by growth, below its own sector, professional, scientific, and technical services (+6.4%).

    • Data processing, hosting, and related services 518

      +20.4%

    • Software publishers 5112

      +15.0%

    • Transportation and warehousing 48-49

      +12.3%

    • Other services (except public administration) 81

      +12.2%

    • Information 51

      +10.0%

    • Legal services 5411

      +8.9%

    • Finance and insurance 52

      +7.6%

    • Health care and social assistance 62

      +7.6%

    • Utilities 22

      +6.8%

    • Arts, entertainment, and recreation 71

      +6.7%

    • Real estate and rental and leasing 53

      +6.6%

    • Professional, scientific, and technical services 54

      +6.4%

    • Management, scientific, and technical consulting services 5416

      +5.2%

    • Accounting, tax preparation, bookkeeping, and payroll services 5412

      +5.2%

    • Architectural, engineering, and related services 5413

      +4.1%

    • Computer systems design and related services 5415

      +3.2%

    • Administrative and support and waste management and remediation services 56

      +2.9%

    • Educational services 61

      +2.6%

    • Telecommunications 517

      -1.8%

    Not seasonally adjusted, employer firms, 2Q 2026 compared with 2Q 2025. 2Q 2026 estimates are preliminary.

    Quarterly revenue for IT industries

    Industry 1Q 2025 2Q 2025 3Q 2025 4Q 2025 1Q 2026 2Q 2026 Year over year
    5415 Computer systems design and related services $180.4B $189.4B $191.3B $193.4B $192.4B $195.5B +3.2%
    518 Data processing, hosting, and related services $98.4B $102.7B $107.1B $113.9B $115.5B $123.7B +20.4%
    5112 Software publishers $150.1B $155.1B $157.2B $166.2B $171.0B $178.4B +15.0%
    517 Telecommunications $164.0B $165.1B $163.1B $170.6B $164.2B $162.2B -1.8%

    Over the four quarters to 2Q 2026, NAICS 5415 firms earned about $773 billion. The hosting industry, at $460 billion, is smaller but growing about 6 times as fast. Telecommunications revenue shrank.

    Government is the growing customer

    Government 32%
    Business and households 68%

    Government customers paid NAICS 5415 firms $62.8 billion in 2Q 2026, 7.5% more than a year earlier. Revenue from all other customers, business and households combined, grew 1.3%. The Census Bureau does not publish the business figure on its own because it does not meet publication standards, so the two are shown together here.

    What this means for MSPs

    Client budgets are moving toward cloud platforms and software subscriptions faster than toward services. Providers that resell or manage that spend, through cloud cost management, licensing, and platform operations, sit on the faster-growing side of the line. Revenue for IT services firms as a whole grew 3.2% in a year, so growth for a typical provider has to come from taking share or moving up into cloud and security work rather than from a rising market.

    Frequently asked questions

    How fast is the IT services industry growing?

    Revenue for computer systems design and related services (NAICS 5415), the Census industry that includes IT consultancies, integrators, and managed service providers, was $195.5 billion in 2Q 2026, up 3.2% from 2Q 2025, according to the Census Bureau Quarterly Services Survey.

    How big is the IT services market in the US?

    About $773 billion over the four quarters to 2Q 2026 for NAICS 5415 employer firms, not seasonally adjusted. Data processing and hosting added $460 billion and software publishers $673 billion.

    Is cloud growing faster than IT services?

    Yes. Data processing, hosting, and related services revenue grew 20.4% year over year in 2Q 2026, and software publishers 15.0%, against 3.2% for computer systems design and related services.

    How much IT services revenue comes from government?

    Government customers accounted for $62.8 billion, or 32%, of NAICS 5415 revenue in 2Q 2026, and that revenue grew 7.5% from a year earlier. Revenue from all other customers combined grew 1.3%.

    Where does this data come from?

    The U.S. Census Bureau Quarterly Services Survey, which estimates revenue for employer firms in selected service industries each quarter. The 2Q 2026 figures are preliminary.

    Download the data. census-qss-service-industry-revenue-2025-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. Census Bureau, Quarterly Services Survey, release for 2Q 2026 (file qss-all-current.xlsx), tables 1c (revenue, not seasonally adjusted), 13 (revenue by class of customer), and 14 (sampling variability), downloaded October 2026.

    Calculations. Year-over-year change compares 2Q 2026 with 2Q 2025, not seasonally adjusted. Four-quarter totals sum 3Q 2025 through 2Q 2026. Non-government revenue equals total minus government revenue for NAICS 5415.

    Limitations. Survey estimates carry sampling error: the coefficient of variation for NAICS 5415 revenue in 2Q 2026 is 8.2%. Figures are nominal, not adjusted for inflation. NAICS 5415 covers custom programming, systems design, facilities management, and other computer services, not only MSPs. This release covers six quarters; longer history requires the Census API.

    Not advice. This is an analysis of public economic data, not investment advice.

    Cite as:The Uptime Report. "IT Services Industry Growth 2026: Revenue Up 3%, While Cloud Hosting Grew 20%." October 2026. https://theuptimereport.com/it-services-industry-growth-2026/

    References

    1. U.S. Census Bureau, Quarterly Services Survey. Accessed October 2026.
    2. QSS current release tables. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • IT Hourly Rates 2026: What Government Contracts Pay for Help Desk, Network, Security, and Cloud Work

    Uptime Report Research · Rate Card

    IT Hourly Rates 2026: What Government Contracts Pay for Help Desk, Network, Security, and Cloud Work

    IT hourly rates are hard to benchmark because commercial providers rarely publish them. Federal contracts are the exception. The General Services Administration publishes the ceiling hourly rate for every labor category on its Multiple Award Schedule, and we analyzed 23,033 of them across ten roles that MSPs and MSSPs staff. Help desk work has a median of $76 an hour; cloud architects, $185.

    The rate card: median hourly rate by role

    Each card shows the median rate, the middle half of rates, and the median at each experience level required by the labor category. Manager, lead, and director categories are excluded.

    Help desk and IT support

    $76/hr median

    Middle half: $60 to $98 · 3,176 rates

    • 0-2 yrs$68
    • 3-5 yrs$80
    • 6-9 yrs$99
    • 10+ yrs$115

    2.6x the BLS median wage ($29.74/hr)

    Network administrator

    $113/hr median

    Middle half: $92 to $142 · 1,438 rates

    • 0-2 yrs$97
    • 3-5 yrs$110
    • 6-9 yrs$134
    • 10+ yrs$145

    2.4x the BLS median wage ($47.66/hr)

    Systems administrator

    $115/hr median

    Middle half: $91 to $143 · 3,848 rates

    • 0-2 yrs$97
    • 3-5 yrs$113
    • 6-9 yrs$133
    • 10+ yrs$144

    2.4x the BLS median wage ($47.66/hr)

    Network engineer

    $129/hr median

    Middle half: $104 to $158 · 2,904 rates

    • 0-2 yrs$105
    • 3-5 yrs$122
    • 6-9 yrs$144
    • 10+ yrs$158

    Database administrator

    $129/hr median

    Middle half: $104 to $156 · 3,022 rates

    • 0-2 yrs$104
    • 3-5 yrs$123
    • 6-9 yrs$147
    • 10+ yrs$160

    2.6x the BLS median wage ($50.30/hr)

    Cybersecurity analyst

    $130/hr median

    Middle half: $105 to $162 · 2,277 rates

    • 0-2 yrs$101
    • 3-5 yrs$127
    • 6-9 yrs$149
    • 10+ yrs$180

    2.1x the BLS median wage ($62.11/hr)

    Security engineer

    $146/hr median

    Middle half: $119 to $180 · 3,105 rates

    • 0-2 yrs$118
    • 3-5 yrs$140
    • 6-9 yrs$162
    • 10+ yrs$180

    Penetration tester

    $152/hr median

    Middle half: $120 to $193 · 546 rates

    • 0-2 yrs$129
    • 3-5 yrs$149
    • 6-9 yrs$177
    • 10+ yrs$184

    Cloud engineer

    $161/hr median

    Middle half: $132 to $199 · 1,859 rates

    • 0-2 yrs$127
    • 3-5 yrs$153
    • 6-9 yrs$178
    • 10+ yrs$209

    Cloud architect

    $185/hr median

    Middle half: $153 to $221 · 858 rates

    • 0-2 yrs$144
    • 3-5 yrs$169
    • 6-9 yrs$195
    • 10+ yrs$214

    How rates compare with wages

    A contract rate pays for the worker plus benefits, overhead, and profit. For roles with a direct match in Bureau of Labor Statistics occupation data, the median rate runs 2.1 to 2.6 times the national median hourly wage.

    Role BLS occupation BLS median wage Median contract rate Multiple
    Help desk and IT support 15-1232 $29.74 $76.34 2.6x
    Network administrator 15-1244 $47.66 $113.37 2.4x
    Systems administrator 15-1244 $47.66 $115.25 2.4x
    Database administrator 15-1242 $50.30 $129.26 2.6x
    Cybersecurity analyst 15-1212 $62.11 $129.99 2.1x

    Does it matter where the work is done?

    Labor categories are priced for work at the contractor’s own facility or on site at the customer. For most roles the difference is small and runs in both directions.

    Role Contractor site Customer site Difference
    Help desk and IT support $80 $73 +10%
    Network administrator $120 $108 +11%
    Systems administrator $118 $113 +4%
    Network engineer $132 $125 +5%
    Database administrator $133 $126 +6%
    Cybersecurity analyst $134 $126 +7%
    Security engineer $150 $144 +4%
    Penetration tester $145 $155 -6%
    Cloud engineer $166 $158 +5%
    Cloud architect $190 $177 +8%

    What this means for MSP pricing

    These are federal ceiling prices, so they mark the upper range of what an established contractor can charge for dedicated labor. They are useful as a sanity check: at the median rate, a full-time equivalent help desk technician bills about $12,214 a month and a systems administrator about $18,440. A per-user managed services price that implies more dedicated labor per client than that is underpriced; one that implies much less needs automation or scale to deliver the promised service levels.

    Frequently asked questions

    What is the average hourly rate for IT support?

    The median GSA contract rate for help desk and IT support labor categories is $76.34 an hour across 3,176 rates, with the middle half between $60 and $98. Entry-level categories (0 to 2 years of experience) have a median of $68.

    How much does a penetration tester charge per hour?

    Penetration testing labor categories on GSA contracts have a median rate of $152.04 an hour, rising from $129 for 0 to 2 years of experience to $184 for 10 or more years.

    What do contract rates include?

    GSA schedule rates are fully burdened ceiling prices: the maximum hourly price a contractor may charge the government, covering wages, benefits, overhead, and profit. Actual task order prices can be lower.

    How do IT contract rates compare to IT salaries?

    For the roles with a direct BLS occupation match, the median contract rate is 2.1 to 2.6 times the national median hourly wage. Help desk rates are 2.6 times the wage of computer user support specialists.

    What does a dedicated help desk technician cost per month?

    At the median contract rate, 160 hours of help desk labor costs about $12,214 a month; a systems administrator about $18,440. Managed service providers usually price per user or per device instead, spreading one technician across many clients.

    Download the data. gsa-calc-it-labor-rates-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. General Services Administration, Contract-Awarded Labor Category (CALC+) ceiling rates API, retrieved 2026-10-12. We searched fifteen IT role keywords and kept 26,629 unique labor category rates, all on the Multiple Award Schedule.

    Classification. Each labor category title was assigned to one role by keyword (penetration testing first, help desk last); titles containing manager, director, supervisor, lead, chief, principal, or executive were excluded, leaving 23,033 rates. Experience bands use the minimum years of experience in the labor category. Bands with fewer than 20 rates are not shown.

    Wage comparison. BLS Occupational Employment and Wage Statistics, May 2025 national estimates: 15-1232 (help desk), 15-1244 (systems and network administrators), 15-1212 (information security analysts), 15-1242 (database administrators). Roles without a one-to-one occupation match have no multiple.

    Limitations. Ceiling rates are maximums for federal buyers; awarded prices can be lower, and commercial MSP pricing is usually per user or per device. Rates include current-year prices only.

    Not advice. This is an analysis of public contract data, not pricing advice.

    Cite as:The Uptime Report. "IT Hourly Rates 2026: What Government Contracts Pay for Help Desk, Network, Security, and Cloud Work." October 2026. https://theuptimereport.com/it-hourly-rates-2026/

    References

    1. GSA, CALC+ Pricing Tool. Accessed October 2026.
    2. GSA, CALC+ Labor Ceiling Rates API documentation. Accessed October 2026.
    3. BLS, Occupational Employment and Wage Statistics. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Patch Tuesday Statistics 2026: Microsoft Patched Three Times More Flaws, Not Three Times More Zero-Days

    Uptime Report Research · Patch Data

    Patch Tuesday Statistics 2026: Microsoft Patched Three Times More Flaws, Not Three Times More Zero-Days

    Patch Tuesday statistics are usually reported one month at a time. We pulled every monthly release from Microsoft’s Security Update Guide API since January 2021 and counted the vulnerabilities Microsoft itself assigned, leaving out the Linux and Chromium entries that the same feed now carries. The 2026 numbers break every prior year, but the count of flaws exploited before a fix did not move.

    2,859Microsoft CVEs, Jan to Sep 2026
    896same months of 2025
    19 vs 20exploited zero-days, 2026 vs 2025 (same months)

    Every Patch Tuesday since 2021

    2021 to 2025 2026 one exploited zero-day

    020040060080010002021-Jan: 81 CVEs, 1 exploited2021-Feb: 56 CVEs, 1 exploited2021-Mar: 89 CVEs, 7 exploited2021-Apr: 108 CVEs, 1 exploited2021-May: 52 CVEs, 0 exploited2021-Jun: 49 CVEs, 6 exploited2021-Jul: 119 CVEs, 4 exploited2021-Aug: 45 CVEs, 1 exploited2021-Sep: 60 CVEs, 1 exploited2021-Oct: 72 CVEs, 1 exploited2021-Nov: 56 CVEs, 2 exploited2021-Dec: 68 CVEs, 1 exploited2022-Jan: 96 CVEs, 2 exploited2022-Feb: 48 CVEs, 0 exploited2022-Mar: 70 CVEs, 0 exploited2022-Apr: 117 CVEs, 1 exploited2022-May: 75 CVEs, 2 exploited2022-Jun: 50 CVEs, 0 exploited2022-Jul: 82 CVEs, 1 exploited2022-Aug: 120 CVEs, 1 exploited2022-Sep: 65 CVEs, 3 exploited2022-Oct: 84 CVEs, 1 exploited2022-Nov: 62 CVEs, 5 exploited2022-Dec: 48 CVEs, 1 exploited2023-Jan: 98 CVEs, 1 exploited2023-Feb: 75 CVEs, 3 exploited2023-Mar: 74 CVEs, 2 exploited2023-Apr: 98 CVEs, 1 exploited2023-May: 38 CVEs, 2 exploited2023-Jun: 75 CVEs, 0 exploited2023-Jul: 130 CVEs, 5 exploited2023-Aug: 74 CVEs, 1 exploited2023-Sep: 59 CVEs, 2 exploited2023-Oct: 103 CVEs, 2 exploited2023-Nov: 58 CVEs, 3 exploited2023-Dec: 34 CVEs, 0 exploited2024-Jan: 48 CVEs, 0 exploited2024-Feb: 72 CVEs, 4 exploited2024-Mar: 61 CVEs, 0 exploited2024-Apr: 147 CVEs, 1 exploited2024-May: 60 CVEs, 2 exploited2024-Jun: 50 CVEs, 0 exploited2024-Jul: 142 CVEs, 2 exploited2024-Aug: 89 CVEs, 6 exploited2024-Sep: 82 CVEs, 5 exploited2024-Oct: 121 CVEs, 2 exploited2024-Nov: 94 CVEs, 3 exploited2024-Dec: 73 CVEs, 1 exploited2025-Jan: 162 CVEs, 3 exploited2025-Feb: 58 CVEs, 3 exploited2025-Mar: 62 CVEs, 6 exploited2025-Apr: 127 CVEs, 1 exploited2025-May: 78 CVEs, 5 exploited2025-Jun: 69 CVEs, 1 exploited2025-Jul: 135 CVEs, 1 exploited2025-Aug: 114 CVEs, 0 exploited2025-Sep: 91 CVEs, 0 exploited2025-Oct: 179 CVEs, 2 exploited2025-Nov: 71 CVEs, 1 exploited2025-Dec: 63 CVEs, 1 exploited2026-Jan: 123 CVEs, 2 exploited2026-Feb: 59 CVEs, 6 exploited2026-Mar: 95 CVEs, 0 exploited2026-Apr: 179 CVEs, 2 exploited2026-May: 153 CVEs, 3 exploited2026-Jun: 216 CVEs, 0 exploited2026-Jul: 596 CVEs, 3 exploited2026-Aug: 445 CVEs, 1 exploited2026-Sep: 993 CVEs, 2 exploited202120222023202420252026

    Microsoft-assigned CVEs per monthly release, excluding Edge (Chromium-based), Azure Linux, and other third-party entries. Red dots above each bar stack one per CVE marked “Exploited: Yes”.

    From 2021 to 2025, Microsoft fixed between 855 and 1,209 of its own CVEs a year. In 2026, the total through Sep is 2,859, up 219% on the same months of 2025, and 2,034 of those arrived in July, August, and September alone. The largest single release was 2026-Sep, with 993.

    Where the surge came from

    The third-quarter jump is spread across core products rather than one component. Product families with the most CVEs in July to September 2026, against the same quarter of 2025:

    Product family Q3 2026 Q3 2025
    Microsoft Office Excel 95 15
    Microsoft Office 72 12
    SQL Server 68 10
    Microsoft Office Word 67 8
    Microsoft Office SharePoint 64 8
    Windows Biometric Service 64 0
    Windows NTFS 61 3
    Windows DHCP Server 57 0

    Zero-days did not triple

    19 CVEs fixed in 2026 are flagged as exploited in the wild, compared with 20 in the same months of 2025. Most of the growth is in vulnerabilities found and fixed before attackers used them. For patch prioritization that is the key ratio: in 2026, roughly 1 in 150 Microsoft CVEs was exploited before its fix, against 1 in 45 a year earlier.

    • CVE-2026-20805 Desktop Window Manager 2026-Jan
    • CVE-2026-21509 Microsoft Office 2026-Jan
    • CVE-2026-21519 Desktop Window Manager 2026-Feb
    • CVE-2026-21533 Windows Remote Desktop 2026-Feb
    • CVE-2026-21513 MSHTML Framework 2026-Feb
    • CVE-2026-21510 Windows Shell 2026-Feb
    • CVE-2026-21514 Microsoft Office Word 2026-Feb
    • CVE-2026-21525 Windows Remote Access Connection Manager 2026-Feb
    • CVE-2026-32201 Microsoft Office SharePoint 2026-Apr
    • CVE-2026-32202 Windows Shell 2026-Apr
    • CVE-2026-41091 Microsoft Defender 2026-May
    • CVE-2026-42897 Microsoft Exchange Server 2026-May
    • CVE-2026-45498 Microsoft Defender 2026-May
    • CVE-2026-56155 Active Directory Federation Services (AD FS) 2026-Jul
    • CVE-2026-56164 Microsoft Office SharePoint 2026-Jul
    • CVE-2026-58644 Microsoft Office SharePoint 2026-Jul
    • CVE-2026-68820 Windows Ancillary Function Driver for WinSock 2026-Aug
    • CVE-2026-81963 Windows Update Stack 2026-Sep
    • CVE-2026-85880 Windows ALPC 2026-Sep

    Year by year

    Year CVEs Exploited Critical Remote code execution Elevation of privilege Cloud, no action
    2021 855 26 11.7% 37% 30% 0
    2022 917 17 9.4% 33% 41% 0
    2023 916 22 9.3% 36% 26% 0
    2024 1,039 26 7.0% 39% 30% 23
    2025 1,209 24 13.0% 30% 40% 68
    2026* 2,859 19 15.8% 24% 45% 174

    *2026 is January to Sep. Critical is Microsoft’s maximum severity rating for the CVE. Impact is the most frequent impact rating across affected products.

    What this means for MSPs

    A tripling of monthly patch volume strains testing and deployment windows, but the exploited share fell. Treat the exploited and publicly disclosed CVEs as same-week deployments, follow Critical remote code execution flaws in internet-facing services next, and let the remaining volume flow through normal rings. Cloud-service CVEs marked as requiring no customer action can be excluded from patch reporting to clients.

    Frequently asked questions

    How many vulnerabilities did Microsoft patch in 2026?

    From January to Sep 2026, Microsoft’s security update guide lists 2,859 CVEs assigned by Microsoft itself, compared with 896 in the same months of 2025. That already exceeds every full year in our series; the previous high was 1,209 in 2025.

    How many zero-days has Microsoft patched in 2026?

    19 of the 2026 CVEs are currently marked as exploited in the wild, compared with 20 in January to Sep 2025. The number of exploited flaws did not rise with the total.

    Which Microsoft products have the most vulnerabilities in 2026?

    In July to September 2026, the product families with the most CVEs were Microsoft Office Excel (95), Microsoft Office (72), and SQL Server (68).

    What was the biggest Patch Tuesday?

    2026-Sep, with 993 Microsoft-assigned CVEs in our data.

    What are cloud CVEs with no customer action?

    Since 2024-Jun, Microsoft has also published CVEs for vulnerabilities it fixed in its own cloud services, marked as requiring no customer action. There were 174 in 2026 through Sep. They count toward totals but need no patching by MSPs or clients.

    Download the data. microsoft-patch-tuesday-cves-2021-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. Microsoft Security Response Center, Security Update Guide CVRF API v3.0, one document per monthly release, retrieved October 2026. The 2026 October release was not yet published at retrieval.

    Filters. Kept CVEs whose assigning CNA note is Microsoft (or, in older documents with no CNA note, entries not tagged Azure Linux). Excluded security advisories (ADV), Microsoft Edge (Chromium-based) entries, and Azure Linux (Mariner) entries, which cover third-party open source packages. With these filters, monthly counts match Microsoft’s published totals for spot-checked months (for example, 48 in January 2024 and 142 in July 2024).

    Coverage. The series starts in January 2021 because several earlier monthly documents in the API (including October 2017, September 2018, and March, April, and October 2020) now contain only backfilled Azure Linux entries.

    Limitations. Exploited and severity flags reflect Microsoft’s current ratings, which can be revised after release. One CVE can affect several products; product family is the first tag listed.

    Not advice. This is an analysis of public vulnerability data, not a patching recommendation for any environment.

    Cite as:The Uptime Report. "Patch Tuesday Statistics 2026: Microsoft Patched Three Times More Flaws, Not Three Times More Zero-Days." October 2026. https://theuptimereport.com/patch-tuesday-statistics-2026/

    References

    1. Microsoft Security Response Center, Security Update Guide. Accessed October 2026.
    2. MSRC CVRF API v3.0, updates index. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Disaster Declarations by State: 25 Years of FEMA Data for Business Continuity Planning

    Uptime Report Research · Continuity Risk

    Disaster Declarations by State: 25 Years of FEMA Data for Business Continuity Planning

    Disaster declarations by state are the closest thing to an official record of where business continuity plans get tested. We analyzed every FEMA declaration in the OpenFEMA dataset through 2026-10-09, focusing on major disaster declarations and excluding the COVID-19 pandemic declarations of 2020, which covered every state at once.

    100major disaster declarations in 2024, the most in any year since records begin in 1953
    85%of US counties designated in at least one major disaster in the ten years to 2026-10-09
    648counties designated five or more times in that decade

    Major disasters by type and year, 2000 to 2026

    00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
    Severe storm 34 29 22 37 44 29 45 56 57 47 57 50 26 34 23 23 16 26 17 27 19 13 24 30 40 26 20
    Flood 2 5 4 1 2 2 1 3 3 7 19 3 15 10 9 16 13 17 25 6 9 11 21 20 11 12
    Hurricane or typhoon 3 11 10 19 13 9 1 2 17 15 2 3 6 12 15 6 12 13 6 7 21 8
    Wildfire 3 1 2 2 1 3 1 1 1 2 3 4 1 2 1 1 4 3 7 1 1 7 3 2
    Tornado 3 3 1 2 1 2 1 2 1 1 1 4 1 2 3 3 1 1 4 1
    Winter storm 2 3 5 5 1 2 1 4 5 5 12 5 2 7 5 5 3 3 1 9 3 9 4 3 9
    Earthquake 1 2 2 1 1 1 1 2 1 1 2 1 1
    Other 2 1 1 1 3 3 2 1 2 1 2 1 1 4 2 4
    All types 45 45 49 56 68 48 52 63 75 59 81 99 47 62 45 43 46 59 59 61 47 56 47 71 100 45 57

    Count of major disaster (DR) declarations by year declared and FEMA incident type, excluding biological (pandemic) declarations. One declaration is one state or tribal government for one event. 2026 runs to 2026-10-09.

    Severe storms are the steady background of the table. Hurricane declarations peaked in 2004, 2011, and 2024, the three busiest hurricane years since 2000. 2024 produced 100 major disaster declarations, narrowly above the 99 of 2011, against an average of 59 a year over the prior decade. The year after, 2025, had 45.

    Which states are declared most often?

    Major disaster declarations in the ten years to 2026-10-09, top 15 states and territories, with the most frequent incident type for each.

    # State Declarations Most frequent type
    1 CA 32
    		Severe storm
    2 TN 23
    		Severe storm
    3 AK 22
    		Severe storm
    4 KS 21
    		Severe storm
    5 MS 21
    		Severe storm
    6 OK 20
    		Severe storm
    7 KY 19
    		Severe storm
    8 SD 18
    		Severe storm
    9 MO 18
    		Severe storm
    10 NE 18
    		Severe storm
    11 MT 16
    		Flood
    12 WV 16
    		Flood
    13 FL 15
    		Hurricane or typhoon
    14 IA 15
    		Severe storm
    15 WA 15
    		Flood

    How widespread is disaster exposure?

    A declaration lists the counties eligible for assistance. Across the 50 states and DC, 2,658 of 3,143 counties (85%) were designated in at least one major disaster declaration in the ten years to 2026-10-09, and 648 were designated five or more times. For most businesses, a declared disaster in their county within a decade is the norm, not the exception.

    What this means for MSPs

    Disaster recovery testing is easy to defer when the risk feels hypothetical. This data makes it local: an MSP can check how many declarations each client’s county has had and use that history when scoping backup, offsite replication, and recovery time objectives. Clients in counties with five or more recent declarations are the strongest case for tested failover rather than backup alone.

    Frequently asked questions

    How many disaster declarations does FEMA make each year?

    Excluding pandemic-related declarations, FEMA issued an average of 59 major disaster declarations a year from 2016 to 2025. 2024 had the most on record, 100. 2026 has 57 through 2026-10-09.

    Which state has the most federal disaster declarations?

    Over the ten years to 2026-10-09, CA had the most major disaster declarations (32), followed by TN (23) and AK (22).

    How many counties have had a major disaster declaration?

    2,658 of the 3,143 counties and county equivalents in the 50 states and DC (85%) were designated in at least one non-pandemic major disaster declaration in the ten years to 2026-10-09. 648 were designated five or more times.

    What is the most common type of disaster declaration?

    Severe storms. Since 2000, they account for 871 of 1585 major disaster declarations, followed by floods and hurricanes.

    What is the difference between DR, EM, and FM declarations?

    A major disaster declaration (DR) opens the widest range of federal assistance. Emergency declarations (EM) provide narrower, short-term support, and fire management assistance declarations (FM) help fund firefighting. This report counts DR declarations.

    Download the data. fema-major-disaster-declarations-by-state.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. FEMA, OpenFEMA Disaster Declarations Summaries (v2), all 70,566 records retrieved October 2026 (5,281 unique declarations). County list: U.S. Census Bureau 2020 national county file.

    Filters. Major disaster declarations (type DR) only, excluding incident type Biological. County coverage counts county FIPS codes in the 50 states and DC that appear in the designated areas of those declarations; statewide or tribal designations without a county code are not counted as county coverage.

    Limitations. Declarations reflect federal decisions to provide assistance, not every damaging event. Thresholds for a declaration vary by state population and damage. Connecticut’s 2022 switch from counties to planning regions may affect a few recent county matches.

    Not advice. This is an analysis of public disaster records, not a risk assessment of any location.

    Cite as:The Uptime Report. "Disaster Declarations by State: 25 Years of FEMA Data for Business Continuity Planning." October 2026. https://theuptimereport.com/disaster-declarations-by-state/

    References

    1. FEMA, OpenFEMA Disaster Declarations Summaries v2. Accessed October 2026.
    2. FEMA, How a disaster gets declared. Accessed October 2026.
    3. U.S. Census Bureau, ANSI and FIPS codes. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • VoIP Statistics 2026: How VoIP Replaced the Business Phone Line, in FCC Data

    Uptime Report Research · Telecom Data

    VoIP Statistics 2026: How VoIP Replaced the Business Phone Line, in FCC Data

    VoIP statistics from vendors tend to measure market size in dollars. The Federal Communications Commission measures something more concrete: every voice connection in service, reported by carriers and VoIP providers on FCC Form 477. Those filings show the business phone line changing technology almost completely in seventeen years.

    83.6%of US business and government wireline voice connections were interconnected VoIP in June 2025, up from 3.2% in Dec 2008. Traditional switched access lines fell to 8.6 million.

    The business line crossover

    Interconnected VoIP Switched access lines · business and government grade, millions

    0M10M20M30M40M50M60MVoIP passes 50%: Dec 2018200820102012201420162018202020222024

    Business VoIP connections grew from 2.1 million to 44.0 million while business switched access lines fell from 62.8 million to 8.6 million. VoIP passed half of business wireline connections in Dec 2018. The total number of business wireline connections also shrank, from 64.9 million to 52.6 million, so VoIP did not only replace lines but absorbed a smaller market.

    Hosted VoIP drives the growth

    Since 2014, the FCC has separated over-the-top VoIP, which runs over broadband the customer buys from someone else. That is the delivery model of most hosted and cloud phone systems. Business over-the-top subscriptions grew from 2.1 million in June 2014 to 26.4 million in June 2025, and now make up 60% of business VoIP.

    Consumers are leaving wireline altogether

    Households tell a different story. Consumer VoIP subscriptions peaked at 40.3 million in Dec 2016 and have fallen to 19.4 million. VoIP’s share of consumer wireline connections (75.2%) is lower than in business because the whole consumer wireline category is shrinking as mobile replaces it. Mobile voice subscriptions reached 395 million in June 2025. Interconnected VoIP in total peaked at 68.0 million in June 2022.

    Period Business VoIP Business switched VoIP share Consumer VoIP Consumer switched Mobile
    Dec 2008 2.1M 62.8M 3.2% 19.6M 78.1M 261M
    Dec 2010 4.7M 57.9M 7.6% 27.0M 59.9M 285M
    Dec 2012 7.7M 51.5M 13.1% 34.7M 44.5M 305M
    Dec 2014 16.1M 40.8M 28.3% 38.3M 32.0M 323M
    Dec 2016 22.9M 34.0M 40.2% 40.3M 24.2M 338M
    Dec 2018 28.2M 25.9M 52.1% 38.6M 17.6M 348M
    Dec 2020 33.5M 20.6M 61.9% 33.8M 13.8M 353M
    Dec 2022 38.7M 14.1M 73.3% 27.5M 10.3M 373M
    Dec 2024 43.0M 9.4M 82.1% 20.8M 7.0M 391M
    June 2025 44.0M 8.6M 83.6% 19.4M 6.4M 395M

    Business VoIP share by state, June 2025

    VoIP’s share of business and government wireline voice connections in each state. 50 jurisdictions have both figures published; Alaska is excluded because the FCC withheld one of the counts.

    • Rhode Island

      91.9%

    • Michigan

      89.9%

    • Kansas

      89.6%

    • Texas

      89.3%

    • Florida

      89.2%

    • Tennessee

      89.0%

    • Missouri

      88.9%

    • Illinois

      88.3%

    • Utah

      88.3%

    • Arizona

      87.5%

    • Oklahoma

      87.5%

    • Georgia

      87.0%

    • Oregon

      86.4%

    • North Carolina

      86.4%

    • Alabama

      85.6%

    • Colorado

      85.5%

    • Minnesota

      85.2%

    • Wisconsin

      85.0%

    • Indiana

      84.8%

    • Massachusetts

      84.8%

    • Arkansas

      84.3%

    • California

      83.9%

    • Mississippi

      83.6%

    • Washington

      83.6%

    • Nevada

      82.8%

    • Delaware

      82.5%

    • Connecticut

      82.4%

    • Ohio

      82.3%

    • Louisiana

      82.0%

    • Virginia

      82.0%

    • Idaho

      80.8%

    • New Jersey

      80.4%

    • Kentucky

      79.8%

    • Pennsylvania

      79.5%

    • Nebraska

      78.7%

    • New Hampshire

      78.1%

    • South Carolina

      77.7%

    • Maryland

      77.5%

    • New York

      77.2%

    • Iowa

      73.9%

    • Montana

      72.7%

    • District of Columbia

      72.4%

    • Vermont

      72.3%

    • New Mexico

      70.2%

    • South Dakota

      68.1%

    • Maine

      66.7%

    • North Dakota

      66.7%

    • Wyoming

      66.7%

    • Hawaii

      63.8%

    • West Virginia

      61.1%

    What this means for MSPs

    The remaining 8.6 million business switched lines are the migration pool. By count, the most remain in California (1.00M), New York (0.79M), Texas (0.45M). For most clients the question is no longer whether to move to VoIP but which hosted platform, and how it is secured and supported.

    Frequently asked questions

    What percentage of businesses use VoIP?

    FCC data count connections, not businesses. In June 2025, interconnected VoIP accounted for 83.6% of the 52.6 million business and government wireline voice connections in the United States; traditional switched access lines made up the rest.

    How many VoIP lines are there in the US?

    63.4 million interconnected VoIP subscriptions in June 2025, of which 44.0 million were business and government grade. The total peaked at 68.0 million in June 2022.

    Are landlines going away?

    Switched access lines fell from 141.0 million in Dec 2008 to 15.0 million in June 2025. Consumer VoIP is also shrinking, from a peak of 40.3 million in Dec 2016 to 19.4 million, as households rely on mobile phones. Mobile voice subscriptions reached 395 million.

    What is over-the-top VoIP?

    VoIP delivered over a broadband connection the customer buys separately, the model used by most hosted and cloud phone systems. Business over-the-top VoIP subscriptions grew from 2.1 million in June 2014 to 26.4 million in June 2025.

    Which states use the most business VoIP?

    In June 2025, VoIP’s share of business wireline voice connections was highest in Rhode Island (91.9%), Michigan (89.9%), and Kansas (89.6%), and lowest in West Virginia (61.1%).

    Download the data. fcc-voice-subscriptions-2008-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. Federal Communications Commission, Voice Telephone Services reports and historical data file (VTS_Historical_Data_Thru_J25), based on FCC Form 477 filings, downloaded October 2026. Figures are in thousands of connections, as of June 30 and December 31 of each year.

    Calculations. VoIP share of business connections equals business and government grade interconnected VoIP subscriptions divided by the sum of those subscriptions and business and government grade switched access lines. The same method is used for consumer connections and for each state.

    Limitations. The FCC counts connections and subscriptions, not businesses or users. Over-the-top VoIP is reported separately only from 2014. Some state figures are withheld to protect provider confidentiality. The latest FCC data are for June 2025.

    Not advice. This is an analysis of public telecom data, not purchasing advice.

    Cite as:The Uptime Report. "VoIP Statistics 2026: How VoIP Replaced the Business Phone Line, in FCC Data." October 2026. https://theuptimereport.com/voip-statistics-2026/

    References

    1. FCC, Voice Telephone Services Report and data. Accessed October 2026.
    2. FCC, Form 477 resources. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Data Breach Statistics 2026: What 980 Breaches in Have I Been Pwned Reveal About Stolen Data

    13.2Bbreached accounts in
    980 verified breaches
    Uptime Report Research · Breach Anatomy

    Data Breach Statistics 2026: What 980 Breaches in Have I Been Pwned Reveal About Stolen Data

    Data breach statistics usually count incidents. This report looks inside them. Have I Been Pwned, the breach notification service run by security researcher Troy Hunt, publishes the data classes exposed in every breach it loads. We analyzed all 980 verified breaches in its public catalog as of 2026-09-30. The clearest finding: breaches are carrying fewer passwords and more personal contact data.

    What is inside a typical breach?

    HIBP records 160 distinct data classes. The median breach exposes 5 of them. Share of all 980 breaches that include each class:

    • Email addresses99%
    • Passwords66%
    • Names54%
    • Usernames48%
    • IP addresses38%
    • Phone numbers36%
    • Physical addresses29%
    • Dates of birth28%
    • Genders19%
    • Geographic locations15%
    • Purchases9%
    • Website activity8%
    • Social media profiles5%
    • Job titles5%

    Passwords out, phone numbers in

    0%25%50%75%100%’14’15’16’17’18’19’20’21’22’23’24’25’26Phones 62%Passwords 19%

    Share of breaches added to HIBP in each year that include the data class. 2026 is January to 09/2026.

    In breaches added from 2016 to 2019, 86% included passwords. In 2026 additions, 19% do, the lowest share in the catalog. Phone numbers overtook passwords in 2026 additions and reached 62% in 2026. Among 2026 additions, the most common classes after email addresses are names (77%), phone numbers, and physical addresses (57%): the profile of stolen customer records rather than login databases.

    How long until breached data surfaces?

    Median days from the breach date to the date HIBP added it, by year added. 32% of all breaches were added within 30 days; 34% took more than a year.

    62014
    432015
    2492016
    4522017
    742018
    1812019
    1242020
    1702021
    2742022
    4292023
    382024
    1262025
    222026

    The 2026 median of 22 days is among the shortest in the series, compared with 429 days for breaches added in 2023, a year when many older breaches were loaded. Lag here is not the breached company’s disclosure time; it measures how long the stolen data took to reach a public notification service.

    The largest breaches on record

    Breach Accounts Breach date Added to HIBP Data classes
    Synthient Credential Stuffing Threat Data 1,957M 2025-04-11 2025-11-06 2
    Verifications.io 763M 2019-02-25 2019-03-09 10
    Data Enrichment Exposure From PDL Customer 622M 2019-10-16 2019-11-22 7
    Facebook 509M 2019-08-01 2021-04-04 8
    Combolists Posted to Telegram 361M 2024-05-28 2024-06-03 3
    MySpace 359M 2008-07-01 2016-05-31 3
    ALIEN TXTBASE Stealer Logs 284M 2025-02-15 2025-02-25 2
    Not SOCRadar 282M 2024-08-03 2024-08-09 1

    What this means for MSPs and MSSPs

    Fewer breaches with passwords does not mean less risk for clients. Exposed phone numbers, names, and employers feed SMS phishing, voice phishing, and help desk social engineering, where an attacker calls in posing as an employee. Password resets and credential monitoring remain necessary, but identity verification at the service desk deserves equal attention. The HIBP domain search lets a provider check client domains against every breach in this dataset.

    Frequently asked questions

    How many data breaches are in Have I Been Pwned?

    980 verified breaches covering 13.2 billion breached accounts as of 2026-09-30, after excluding fabricated breaches and spam lists. One person can appear in many breaches, so accounts are not unique people.

    What data is most often exposed in a breach?

    Email addresses (99% of breaches), passwords (66%), names (54%), usernames (48%), and IP addresses (38%).

    Are fewer breaches exposing passwords?

    Among breaches added to Have I Been Pwned, yes. 86% of breaches added from 2016 to 2019 included passwords, against 19% of those added in 2026. Phone numbers moved the other way, reaching 62% in 2026.

    How long does it take for a breach to become public?

    For breaches loaded into Have I Been Pwned, the median time from the breach date to the date it was added is 126 days. For breaches added in 2026, the median was 22 days. This measures when the data reached HIBP, not when the breached company disclosed it.

    What is the largest breach in Have I Been Pwned?

    Synthient Credential Stuffing Threat Data, with 1.96 billion accounts, added on 2025-11-06.

    Download the data. hibp-breach-catalog-analysis.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. Have I Been Pwned public breach catalog (API v3 breaches endpoint), retrieved October 2026. Data licensed under CC BY 4.0; attribution: Have I Been Pwned (haveibeenpwned.com).

    Filters. Included breaches marked verified; excluded those flagged as fabricated or spam lists. Sensitive, retired, malware, and stealer log entries that are verified are included.

    Calculations. Data class shares are the percentage of breaches whose DataClasses list includes the class. Lag is AddedDate minus BreachDate in days. Years are grouped by date added, because grouping by breach date would undercount long lags for recent breaches that have not surfaced yet.

    Limitations. HIBP holds breaches that were obtained and verified by one person’s service, not a census of all breaches. Breach dates are often approximate. Account counts include duplicates across breaches.

    Not advice. This is an analysis of a public catalog, not a security assessment.

    Cite as:The Uptime Report. "Data Breach Statistics 2026: What 980 Breaches in Have I Been Pwned Reveal About Stolen Data." October 2026. https://theuptimereport.com/data-breach-statistics-2026/

    References

    1. Have I Been Pwned, Pwned websites. Accessed October 2026.
    2. Have I Been Pwned, Domain search. Accessed October 2026.
    3. Have I Been Pwned API v3 documentation and license. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Highest Paying Cities for IT Jobs in 2026: Metro Pay for Security, Sysadmin, Network, and Help Desk Roles

    Uptime Report Research · Metro Leaderboard

    Highest Paying Cities for IT Jobs in 2026: Metro Pay for Security, Sysadmin, Network, and Help Desk Roles

    The highest paying cities for IT jobs are not the same for every role. Using the Bureau of Labor Statistics May 2025 metropolitan wage estimates, we ranked every metro area with at least 500 workers in four occupations central to MSP and MSSP staffing. Each card also shows a pay multiple: the role’s median divided by the median for all jobs in the same metro.

    The short version

    San Jose-Sunnyvale-Santa Clara, CA, San Francisco-Oakland-Fremont, CA, Washington-Arlington-Alexandria, DC-VA-MD-WV, Boston-Cambridge-Newton, MA-NH, Seattle-Tacoma-Bellevue, WA, New York-Newark-Jersey City, NY-NJ, Baltimore-Columbia-Towson, MD appear in the top 10 for at least three of the four roles. A California metro ranks first on raw pay for all four roles, while the large federal markets around Washington, DC and Baltimore rank high for security, systems, and network roles. The local pay multiple tells a different story from raw pay: a role can rank in the middle nationally and still pay well above the local typical wage.

    Information security analysts: highest paying metros

    54 metro areas have at least 500 information security analysts with a published median. The typical metro median among them is $126,300. The top-paying metro pays 2.1 times the lowest-paying one.

    1San Jose-Sunnyvale-Santa Clara, CA$176,1202,280 jobs · 2.1x local median
    2San Francisco-Oakland-Fremont, CA$162,3103,730 jobs · 2.2x local median
    3Seattle-Tacoma-Bellevue, WA$161,7804,700 jobs · 2.2x local median
    4Boulder, CO$154,990520 jobs · 2.2x local median
    5Washington-Arlington-Alexandria, DC-VA-MD-WV$148,95016,560 jobs · 2.1x local median
    6Raleigh-Cary, NC$143,6402,510 jobs · 2.8x local median
    7New York-Newark-Jersey City, NY-NJ$140,47011,330 jobs · 2.3x local median
    8Baltimore-Columbia-Towson, MD$138,1704,600 jobs · 2.3x local median

    Lowest paying of the 54

    50Milwaukee-Waukesha, WI$101,550690 jobs · 2.0x local median
    51Indianapolis-Carmel-Greenwood, IN$98,060980 jobs · 2.0x local median
    52Omaha, NE-IA$95,700700 jobs · 1.9x local median
    53Oklahoma City, OK$82,490950 jobs · 1.7x local median

    Biggest local premium: in Orlando-Kissimmee-Sanford, FL, the information security analysts median of $129,440 is 2.8 times the median for all occupations there. Largest market: Washington-Arlington-Alexandria, DC-VA-MD-WV, 16,560 jobs at a $148,950 median.

    Network and computer systems administrators: highest paying metros

    96 metro areas have at least 500 network and computer systems administrators with a published median. The typical metro median among them is $96,975. The top-paying metro pays 2.4 times the lowest-paying one.

    1San Jose-Sunnyvale-Santa Clara, CA$133,3602,460 jobs · 1.6x local median
    2San Francisco-Oakland-Fremont, CA$129,6803,910 jobs · 1.7x local median
    3Washington-Arlington-Alexandria, DC-VA-MD-WV$125,4309,920 jobs · 1.8x local median
    4Baltimore-Columbia-Towson, MD$122,9504,620 jobs · 2.1x local median
    5New York-Newark-Jersey City, NY-NJ$119,39017,690 jobs · 1.9x local median
    6Boston-Cambridge-Newton, MA-NH$116,7706,760 jobs · 1.8x local median
    7Olympia-Lacey-Tumwater, WA$112,530800 jobs · 1.8x local median
    8Durham-Chapel Hill, NC$110,6401,270 jobs · 1.8x local median

    Lowest paying of the 96

    92Sioux Falls, SD-MN$77,140710 jobs · 1.6x local median
    93Tallahassee, FL$74,020880 jobs · 1.6x local median
    94Gainesville, FL$73,230650 jobs · 1.6x local median
    95San Juan-Bayamon-Caguas, PR$55,040770 jobs · 1.9x local median

    Biggest local premium: in Las Vegas-Henderson-North Las Vegas, NV, the network and computer systems administrators median of $103,440 is 2.2 times the median for all occupations there. Largest market: New York-Newark-Jersey City, NY-NJ, 17,690 jobs at a $119,390 median.

    Computer network support specialists: highest paying metros

    54 metro areas have at least 500 computer network support specialists with a published median. The typical metro median among them is $76,560. The top-paying metro pays 3.1 times the lowest-paying one.

    1San Jose-Sunnyvale-Santa Clara, CA$124,1301,080 jobs · 1.5x local median
    2Seattle-Tacoma-Bellevue, WA$104,6102,320 jobs · 1.4x local median
    3Baltimore-Columbia-Towson, MD$102,9804,910 jobs · 1.7x local median
    4San Francisco-Oakland-Fremont, CA$101,6002,370 jobs · 1.4x local median
    5Washington-Arlington-Alexandria, DC-VA-MD-WV$92,4005,100 jobs · 1.3x local median
    6Boston-Cambridge-Newton, MA-NH$88,9501,700 jobs · 1.3x local median
    7Tulsa, OK$88,540580 jobs · 1.9x local median
    8New York-Newark-Jersey City, NY-NJ$86,9306,330 jobs · 1.4x local median

    Lowest paying of the 54

    50Virginia Beach-Chesapeake-Norfolk, VA-NC$61,840940 jobs · 1.3x local median
    51Little Rock-North Little Rock-Conway, AR$61,510560 jobs · 1.3x local median
    52Los Angeles-Long Beach-Anaheim, CA$57,2205,390 jobs · 1.0x local median
    53San Juan-Bayamon-Caguas, PR$39,570580 jobs · 1.3x local median

    Biggest local premium: in Tulsa, OK, the computer network support specialists median of $88,540 is 1.9 times the median for all occupations there. Largest market: New York-Newark-Jersey City, NY-NJ, 6,330 jobs at a $86,930 median.

    Computer user support specialists (help desk): highest paying metros

    156 metro areas have at least 500 computer user support specialists with a published median. The typical metro median among them is $59,390. The top-paying metro pays 2.9 times the lowest-paying one.

    1Sacramento-Roseville-Folsom, CA$106,04013,820 jobs · 1.8x local median
    2San Jose-Sunnyvale-Santa Clara, CA$93,5905,790 jobs · 1.1x local median
    3Carson City, NV$93,560560 jobs · 1.7x local median
    4San Francisco-Oakland-Fremont, CA$89,44010,770 jobs · 1.2x local median
    5Santa Maria-Santa Barbara, CA$80,520960 jobs · 1.6x local median
    6Seattle-Tacoma-Bellevue, WA$78,33015,030 jobs · 1.1x local median
    7Bridgeport-Stamford-Danbury, CT$78,0702,460 jobs · 1.3x local median
    8Washington-Arlington-Alexandria, DC-VA-MD-WV$77,86018,510 jobs · 1.1x local median

    Lowest paying of the 156

    152Sioux Falls, SD-MN$48,260600 jobs · 1.0x local median
    153Fayetteville-Springdale-Rogers, AR$47,4001,070 jobs · 1.0x local median
    154Gainesville, FL$47,130710 jobs · 1.0x local median
    155San Juan-Bayamon-Caguas, PR$36,7204,690 jobs · 1.2x local median

    Biggest local premium: in Sacramento-Roseville-Folsom, CA, the computer user support specialists median of $106,040 is 1.8 times the median for all occupations there. Largest market: New York-Newark-Jersey City, NY-NJ, 36,580 jobs at a $75,690 median.

    What this means for MSPs hiring across metros

    Remote and hybrid work lets an MSP hire outside its home market, and these rankings show why that matters. Depending on the role, the top-paying metro pays between 2.1 and 3.1 times the lowest-paying one, so a provider that pays a single national rate will overpay in some markets and fail to compete in others. Pricing a help desk seat or a security analyst into a managed services contract works best from the local median, not the national one.

    Frequently asked questions

    What city pays the most for IT jobs?

    For information security analysts, San Jose-Sunnyvale-Santa Clara, CA has the highest median annual wage among large markets at $176,120, according to BLS May 2025 metro data. San Jose-Sunnyvale-Santa Clara, CA, San Francisco-Oakland-Fremont, CA, Washington-Arlington-Alexandria, DC-VA-MD-WV rank in the top 10 for at least three of the four IT roles we analyzed.

    Where do help desk jobs pay the most?

    Sacramento-Roseville-Folsom, CA at a $106,040 median for computer user support specialists, followed by San Jose-Sunnyvale-Santa Clara, CA ($93,590).

    What is the highest paying city for system administrators?

    San Jose-Sunnyvale-Santa Clara, CA, with a median of $133,360 for network and computer systems administrators.

    Which metro has the most cybersecurity analyst jobs?

    Washington-Arlington-Alexandria, DC-VA-MD-WV, with 16,560 information security analysts and a $148,950 median.

    What does the pay multiple mean?

    It is the occupation’s median annual wage in a metro divided by the median annual wage for all occupations in that metro, both from the same BLS release. A multiple of 2.0x means the IT role pays twice what the typical local worker earns, which is a rough proxy for how far the salary goes locally.

    Download the data. it-wages-by-metro-may-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics (OEWS), May 2025 metropolitan and nonmetropolitan area estimates (file MSA_M2025_dl), downloaded October 2026. Occupations: 15-1212, 15-1244, 15-1231, and 15-1232, plus all occupations (00-0000) for the pay multiple.

    Filters. Metropolitan statistical areas only. A metro is ranked for an occupation when BLS publishes both an employment estimate of at least 500 and an annual median wage. Suppressed estimates are excluded. Rank is by annual median wage.

    Calculations. Pay multiple equals the occupation’s annual median wage divided by the all-occupation annual median wage for the same metro.

    Limitations. OEWS covers wage and salary workers and excludes the self-employed. Estimates have sampling error, especially in smaller metros. Wages are not adjusted for cost of living; the pay multiple is a local comparison, not a cost of living index.

    Not advice. This is published wage data, not compensation or career advice.

    Cite as:The Uptime Report. "Highest Paying Cities for IT Jobs in 2026: Metro Pay for Security, Sysadmin, Network, and Help Desk Roles." October 2026. https://theuptimereport.com/highest-paying-cities-for-it-jobs-2026/

    References

    1. BLS, OEWS data tables and downloads. Accessed October 2026.
    2. BLS, OEWS technical notes. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • MSP Industry Statistics 2026: Jobs, Wages, and Firm Counts in Managed IT Services

    Uptime Report Research · Industry Census

    MSP Industry Statistics 2026: Jobs, Wages, and Firm Counts in Managed IT Services

    MSP industry statistics usually come from vendor surveys. This report uses the Bureau of Labor Statistics Quarterly Census of Employment and Wages, which counts every employer covered by unemployment insurance. In NAICS 541513, the industry code closest to managed IT services, the number of firms is rising, the number of jobs is falling, and pay is climbing.

    +10.6%Establishments, Q1 2023 to Q1 2026 (6,304 to 6,972)
    -5.1%Employment, same period (79,383 to 75,313)
    +14.3%Average weekly wage ($2,892 to $3,306)

    Smaller firms, fewer people, higher pay

    The three numbers above combine into one pattern. The average NAICS 541513 establishment employed 12.6 people in Q1 2023 and 10.8 in Q1 2026. Over the most recent year alone, employment fell 1.4%. Rising wages alongside falling headcount fits a shift toward fewer, more senior staff per firm, though QCEW cannot show job titles, so that reading is an inference.

    Employment index across computer services

    Computer facilities management (MSP core) 541513Computer systems design 541512Other computer related services 541519

    95100105110Q1 2023Q1 2024Q1 2025Q1 202694.994.9112.2

    Index of quarterly private employment, Q1 2023 = 100. Quarterly employment is the average of the three monthly figures.

    The decline is not unique to managed services. Computer systems design (541512), by far the largest of the three, lost a similar share of jobs. Other computer related services (541519) grew, and the three codes combined changed -3.4% between Q1 2023 and Q1 2026.

    Industry Jobs Q1 2023 Jobs Q1 2026 Change Weekly wage Q1 2026 Wage change Establishments
    541513 Computer facilities management (MSP core) 79,383 75,313 -5.1% $3,306 +14.3% 6,972
    541512 Computer systems design 1,136,131 1,078,408 -5.1% $3,194 +18.4% 179,455
    541519 Other computer related services 128,900 144,575 +12.2% $3,184 +20.4% 36,371

    State league table: managed IT jobs, Q1 2023 to Q1 2026

    States with at least 1,000 NAICS 541513 jobs in Q1 2023, ranked by employment change. Across all 51 jurisdictions with disclosed data in both periods, 26 added jobs and 25 lost them.

    # State Q1 2023 Q1 2026 Change Weekly wage
    1 North Carolina 1,262 1,699
    		+34.6% $1,983
    2 Illinois 1,429 1,515
    		+6.0% $2,729
    3 Oregon 1,284 1,351
    		+5.2% $2,531
    4 Arizona 1,791 1,874
    		+4.6% $2,551
    5 Missouri 1,763 1,803
    		+2.3% $2,149
    6 Georgia 6,030 6,100
    		+1.2% $3,531
    7 Texas 4,706 4,722
    		+0.3% $2,771
    8 Florida 8,294 8,308
    		+0.2% $3,023
    9 Ohio 2,104 2,042
    		-2.9% $2,560
    10 Massachusetts 1,115 1,080
    		-3.1% $3,549
    11 California 11,813 11,113
    		-5.9% $6,410
    12 Virginia 5,364 4,972
    		-7.3% $2,122
    13 Pennsylvania 1,910 1,705
    		-10.7% $2,317
    14 Kentucky 1,215 1,078
    		-11.3% $1,674
    15 New Jersey 4,609 3,899
    		-15.4% $4,156
    16 Hawaii 1,059 889
    		-16.1% $2,196
    17 Indiana 1,345 1,119
    		-16.8% $1,900
    18 Michigan 4,420 3,538
    		-20.0% $3,429
    19 Washington 1,310 1,009
    		-23.0% $2,747
    20 Nebraska 1,488 1,062
    		-28.6% $2,727
    21 New York 2,046 1,418
    		-30.7% $3,759
    22 Arkansas 1,220 760
    		-37.7% $2,023

    Private ownership only. Smaller states are in the download; their percentages swing widely on small counts.

    What this means for MSP owners

    A growing count of establishments with shrinking average headcount means more, smaller competitors. QCEW does not say why headcount fell; automation, offshore delivery, and consolidation into larger firms classified elsewhere are all possible explanations. For hiring, the wage data matters most: the average weekly wage in this industry rose 14.3% in three years, so a contract priced on 2023 labor costs now carries a materially higher wage bill per employee.

    Frequently asked questions

    How many people work in the MSP industry?

    BLS counts 75,313 private-sector jobs in NAICS 541513, computer facilities management services, in Q1 2026 (average of monthly employment). This is the industry code closest to managed IT services. Many MSPs are classified under 541512 or 541519 instead, so this is a floor, not a total.

    Is the MSP industry growing?

    In firm count, yes: establishments in NAICS 541513 rose from 6,304 to 6,972 between Q1 2023 and Q1 2026 (+10.6%). Employment fell 5.1% over the same period, so the average establishment shrank from 12.6 to 10.8 employees.

    How much do MSP employees earn?

    The average weekly wage in NAICS 541513 was $3,306 in Q1 2026, up 14.3% from $2,892 in Q1 2023. Across all four quarters of 2025 the average weekly wage was $2,868, about $149,136 a year; the first quarter runs above the annual average ($3,328 in Q1 2025), a seasonal pattern that is why this report compares first quarters only.

    Which states have the most MSP jobs?

    In Q1 2026: California (11,113), Florida (8,308), and Georgia (6,100) in NAICS 541513.

    What is NAICS 541513?

    Computer Facilities Management Services: establishments that provide on-site management and operation of clients’ computer systems or data processing facilities, as defined by the U.S. Census Bureau NAICS manual.

    Download the data. msp-industry-qcew-541513-by-state.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. Bureau of Labor Statistics, Quarterly Census of Employment and Wages (QCEW), industry data files for NAICS 541512, 541513, and 541519, Q1 2023 to Q1 2026, downloaded October 2026. National figures use private ownership (own code 5) at the national industry level; state figures use the state industry level.

    Calculations. Quarterly employment is the mean of the three monthly employment levels. Wage comparisons are first quarter to first quarter because first-quarter wages run above other quarters. Average establishment size is employment divided by establishments. The 2025 annual wage is the mean of four quarterly average weekly wages times 52.

    Limitations. QCEW classifies each establishment by its primary activity, so MSPs filed under 541512 or 541519 are not counted in 541513. Q1 2026 data are preliminary and subject to revision. An establishment is a single location, not a company.

    Not advice. This is published labor data, not business or compensation advice.

    Cite as:The Uptime Report. "MSP Industry Statistics 2026: Jobs, Wages, and Firm Counts in Managed IT Services." October 2026. https://theuptimereport.com/msp-industry-statistics-2026/

    References

    1. BLS, Quarterly Census of Employment and Wages. Accessed October 2026.
    2. BLS QCEW open data access. Accessed October 2026.
    3. U.S. Census Bureau, NAICS 541513 definition. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Federal IT Spending 2026: Where IT Services Contract Dollars Went, and Why the Headline Number Misleads

    Uptime Report Research · Spending Ledger

    Federal IT Spending 2026: Where IT Services Contract Dollars Went, and Why the Headline Number Misleads

    Federal IT spending 2026 looks like a decline if you add up the raw numbers: IT services contract obligations of $57.4B, down 4% from FY2025. That reading is wrong. Defense Department obligations for the final quarter of the fiscal year have not yet posted to USAspending.gov. Measured like for like, spending grew, and civilian agencies set a record.

    Raw FY2026 vs FY2025-4.4%

    All agencies, full fiscal year as published in October 2026. Includes the missing Defense quarter.

    Like for like, Oct to Jun+8.5%

    All agencies, first three quarters of FY2026 vs the same quarters of FY2025, before the reporting lag applies.

    Eight years of IT services contract obligations

    Civilian agencies Department of Defense Defense FY2026, incomplete

    $0B$20B$40B$60B$43.6BFY19$49.5BFY20$52.2BFY21$56.6BFY22$59.3BFY23$61.9BFY24$60.0BFY25$57.4BFY26

    Contract obligations (award types A to D) under NAICS 541512, 541513, and 541519, by federal fiscal year (October to September). FY2026 as of early October 2026.

    Obligations grew from $43.6B in FY2019 to $60.0B in FY2025, a 38% increase in nominal dollars. The FY2024 total of $61.9B remains the high point in this series.

    How big is the Defense reporting gap?

    Defense obligations for July to September 2026 total $0.2B in the data, against $7.8B for the same quarter of 2025. Civilian agencies show no such gap: their July to September 2026 obligations are present at normal levels. Comparing the first three quarters only, Defense obligations rose 9.2% and civilian obligations rose 8.1%.

    The civilian full-year figure can be compared directly. Civilian agencies obligated $43.9B for IT services in FY2026, up 9.6% from $40.0B, the highest in the series.

    Top agencies, FY2026

    Agency FY25 FY26 Change
    Defense $20.0B $13.5B lag
    Veterans Affairs $6.5B $8.1B +25%
    General Services Administration $6.0B $7.1B +18%
    Homeland Security $5.2B $6.1B +18%
    Health and Human Services $5.4B $5.4B +1%
    State $2.5B $2.4B -5%
    Treasury $2.9B $2.0B -30%
    Justice $2.1B $2.0B -1%
    Commerce $1.4B $1.6B +13%
    Transportation below top 10 $1.3B

    Top contractors, FY2025

    # Recipient FY25 FY26
    1 Accenture Federal Services LLC $2.8B $3.2B
    2 General Dynamics Information Technology, Inc. $2.4B $2.4B
    3 Leidos, Inc. $2.2B $1.4B
    4 Booz Allen Hamilton Inc $1.9B $1.8B
    5 Science Applications International Corporation $1.7B $1.4B
    6 CACI, Federal $1.6B $1.6B
    7 Deloitte Consulting LLP $1.4B $1.5B
    8 FCN, Inc. $1.0B $0.9B
    9 Oracle Health Government Services, Inc. $1.0B $2.1B
    10 CGI Federal Inc. $1.0B $1.2B

    The seven largest recipients took $14.0B in FY2025, 23% of all obligations under these codes. FY2026 recipient figures are incomplete for the same reason as the Defense total.

    Which kind of IT services is growing?

    NAICS Category FY2019 FY2025 Change
    541512 Computer systems design services $24.0B $31.7B +32%
    541519 Other computer related services $16.9B $24.9B +47%
    541513 Computer facilities management services $2.7B $3.4B +29%

    NAICS 541513, computer facilities management, is the code closest to outsourced infrastructure management, the work most managed service providers do. It is also the smallest of the three in federal contracting.

    What this means for MSPs selling to government

    Federal IT services demand did not shrink in FY2026, and civilian agencies spent more than in any prior year. The top seven contractors hold 23% of obligations under these codes, which leaves roughly 77% spread across all other prime recipients. Subcontract dollars flowing down from the large primes are not counted here. Watch the Defense figures as the delayed quarter posts; the like-for-like trend suggests the final FY2026 total will be close to or above FY2025.

    Frequently asked questions

    How much does the federal government spend on IT services?

    Contract obligations under the three computer services NAICS codes (541512, 541513, 541519) totaled $60.0B in fiscal year 2025, according to USAspending.gov. The peak year was FY2024 at $61.9B.

    Did federal IT spending fall in 2026?

    Not on a like-for-like basis. The raw FY2026 total of $57.4B is 4% below FY2025, but Department of Defense obligations for July to September 2026 show only $0.2B in the data versus $7.8B a year earlier, a reporting lag. Comparing October to June in both years, obligations rose 8.5%.

    Which agency spends the most on IT services contracts?

    The Department of Defense, with $20.0B in FY2025, followed by Veterans Affairs ($6.5B), GSA ($6.0B), and HHS ($5.4B).

    Who are the largest federal IT services contractors?

    In FY2025, by obligations under these NAICS codes: Accenture Federal Services LLC ($2.8B), General Dynamics Information Technology, Inc. ($2.4B), and Leidos, Inc. ($2.2B).

    Why is Defense contract data delayed?

    The data itself shows it: Defense obligations for the last quarter of FY2026 are nearly absent from USAspending as of early October 2026, while civilian agencies’ September obligations are present. Any FY2026 comparison that includes Defense should be redone once the delayed records post.

    Download the data. federal-it-services-obligations-fy2019-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. USAspending.gov award search API (spending by category and by time period), queried in October 2026. Filters: contract award types A, B, C, and D; NAICS codes 541512, 541513, and 541519; federal fiscal years 2019 to 2026. Amounts are obligations in nominal dollars, not adjusted for inflation.

    Calculations. Defense is the Department of Defense as awarding top-tier agency; civilian is every other agency. The like-for-like comparison sums fiscal quarters 1 to 3 (October to June) in each year. The reporting gap is measured from the data: the difference between full-year and first-three-quarter Defense obligations.

    Limitations. USAspending figures are revised as agencies submit and correct records; FY2026 is preliminary. NAICS codes are assigned by contracting officers and do not capture IT services bought under other codes. Obligations can include de-obligations (negative amounts).

    Not advice. This is an analysis of public spending data, not investment or business advice.

    Cite as:The Uptime Report. "Federal IT Spending 2026: Where IT Services Contract Dollars Went, and Why the Headline Number Misleads." October 2026. https://theuptimereport.com/federal-it-spending-2026/

    References

    1. USAspending.gov, Advanced Search. Accessed October 2026.
    2. USAspending API endpoints. Accessed October 2026.
    3. U.S. Census Bureau, NAICS 5415 Computer Systems Design and Related Services. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Ransomware Initial Access Vectors: What 25 CISA #StopRansomware Advisories Show

    Uptime Report Research · Technique Matrix

    Ransomware Initial Access Vectors: What 25 CISA #StopRansomware Advisories Show

    Ransomware initial access vectors are documented in an unusual public record: the #StopRansomware joint advisories that CISA, the FBI, and partner agencies publish on individual ransomware groups. We read all 25 of them and coded the MITRE ATT&CK techniques each one lists under Initial Access. Exploits against internet-facing systems lead, and phishing is close behind.

    Advisories reviewed25
    With initial access techniques22
    Public-facing app exploit73%
    Phishing59%
    Two or more entry routes77%

    How do ransomware groups get in?

    Across the 22 advisories that publish an initial access technique list, five techniques account for nearly every entry. Shares are the percentage of those 22 advisories that list each technique; one advisory can list several.

    Exploit public-facing application T1190

    16 of 22

    Phishing T1566

    13 of 22

    External remote services T1133

    12 of 22

    Valid accounts T1078

    10 of 22

    Drive-by compromise T1189

    2 of 22

    Most groups have more than one door. 17 of 22 advisories (77%) list two or more of these techniques. A defense that closes only one route, such as email filtering for phishing, leaves the others open.

    The matrix: every advisory, every technique

    Each row is one #StopRansomware advisory, newest first. A filled dot means CISA lists the technique under Initial Access for that group. Advisory IDs link to the original on cisa.gov.

    Advisory T1190Exploit public-facing application73% T1566Phishing59% T1133External remote services55% T1078Valid accounts45% T1189Drive-by compromise9%
    AA26-222AGunra Ransomware2026-08-10
    AA25-203AInterlock2025-07-22
    AA25-071AMedusa Ransomware2025-03-12
    AA25-050AGhost (Cring) Ransomware2025-02-19
    AA24-242ARansomHub Ransomware2024-08-29
    AA24-131ABlack Basta2024-05-10
    AA24-109AAkira Ransomware2024-04-18
    AA24-060APhobos Ransomware2024-02-29
    AA23-353AALPHV Blackcat2023-12-19 No initial access table published
    AA23-352APlay Ransomware2023-12-18
    AA23-325ALockBit 3.0 (Citrix Bleed)2023-11-21 No initial access table published
    AA23-319ARhysida Ransomware2023-11-15
    AA23-284AAvosLocker2023-10-11
    AA23-263ASnatch Ransomware2023-09-20
    AA23-158ACL0P (MOVEit, CVE-2023-34362)2023-06-07
    AA23-136ABianLian Ransomware Group2023-05-16
    AA23-075ALockBit 3.02023-03-16
    AA23-061ABlacksuit (Royal) Ransomware2023-03-02
    AA23-040ADPRK-funded ransomware (Maui, H0lyGh0st)2023-02-09 No initial access table published
    AA22-335ACuba Ransomware2022-12-01
    AA22-321AHive Ransomware2022-11-17
    AA22-294ADaixin Team2022-10-21
    AA22-249AVice Society2022-09-06
    AA22-223AZeppelin Ransomware2022-08-11
    AA22-181AMedusaLocker2022-06-30

    Percentages in the header use the 22 advisories with an initial access technique list as the base. 3 advisories do not publish one.

    Edge devices are the common thread

    In 20 of 22 advisories (91%), initial access included either an exploit of a public-facing application (T1190) or abuse of an external remote service such as a VPN or RDP gateway (T1133). Since January 2025, 3 of the 4 new advisories with an initial access list name T1190. Several advisories are built around a single product flaw: CL0P’s MOVEit campaign (CVE-2023-34362) and LockBit 3.0 affiliates exploiting Citrix Bleed (CVE-2023-4966).

    Valid accounts (T1078) appear in 10 advisories. Of those, 7 also list external remote services, the pattern of a stolen or purchased login used on an exposed VPN or remote desktop gateway.

    What this means for MSPs and MSSPs

    For a managed provider, the matrix is a patching and exposure priority list. Internet-facing appliances, file transfer servers, and remote access gateways belong at the top of the vulnerability queue, ahead of internal endpoints. Phishing still appears in 59% of advisories, so email security and user reporting remain necessary, but they cover less than two thirds of the entry routes documented here.

    Frequently asked questions

    What is the most common ransomware initial access vector?

    Exploitation of public-facing applications (MITRE ATT&CK T1190). It appears in the initial access section of 16 of the 22 CISA #StopRansomware advisories that list initial access techniques (73%).

    How often is phishing the way ransomware gets in?

    Phishing (T1566) is listed in 13 of 22 advisories (59%). It is the second most common technique, but most advisories list more than one entry route.

    Do ransomware groups use stolen credentials?

    Valid accounts (T1078) appear in 10 of 22 advisories (45%), and external remote services such as VPN and RDP (T1133) in 12 (55%). The two often work together: a stolen or bought login is used on an exposed remote access service.

    How many #StopRansomware advisories has CISA published?

    We counted 25 unique #StopRansomware advisories from 2022-06-30 (MedusaLocker) to 2026-08-10 (Gunra Ransomware), as listed on cisa.gov in October 2026.

    What should an MSP patch first to reduce ransomware risk?

    The data points at internet-facing systems. In 20 of 22 advisories (91%), initial access included either a public-facing application exploit or an external remote service. That makes VPNs, firewalls, file transfer tools, and remote access gateways the first place to look, alongside MFA on every remote login.

    Download the data. cisa-stopransomware-initial-access.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. All advisories published under CISA’s #StopRansomware program, collected from cisa.gov in October 2026. One duplicate URL for the Vice Society advisory was removed, leaving 25 unique advisories from 2022-06-30 to 2026-08-10.

    Coding. For each advisory we extracted the MITRE ATT&CK technique IDs listed in its Initial Access tactic table. We recorded techniques exactly as CISA lists them. T1021, T1059 also appear in Initial Access tables but are outside the five shown. Three advisories (AA23-040A, AA23-325A, AA23-353A) do not include an Initial Access technique table and are excluded from percentages.

    Limitations. Advisories describe what investigators observed for a group at the time of writing, not a statistical sample of all ransomware incidents. Some advisories were updated after release; we used the current version. A technique’s absence means CISA did not list it, not that the group never uses it.

    Not advice. This is a summary of public government advisories, not a security assessment of any environment.

    Cite as:The Uptime Report. "Ransomware Initial Access Vectors: What 25 CISA #StopRansomware Advisories Show." October 2026. https://theuptimereport.com/ransomware-initial-access-vectors/

    References

    1. CISA, #StopRansomware official alerts and statements. Accessed October 2026.
    2. MITRE ATT&CK, Initial Access (TA0001). Accessed October 2026.
    3. CISA, AA26-222A: #StopRansomware: Gunra Ransomware. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending