Executive summary
Buying protection is not the same as being protected. What decides the outcome is how the protection is configured and used every day. This report looks at that gap. It uses the live configuration records behind a large managed fleet, more than 1.6 million active endpoints, to see how protection plans are actually set up, how administrators and the providers who manage them choose to structure plans and what those choices tell us about real-world practice.
The most interesting pattern sits one level up from any single machine, in how the managed service providers running these fleets treat the customers on their books. Among more than 9,000 providers with five or more active customers, only about half apply broadly the same plan to their whole customer base; the other half configure customer by customer.
Where a provider is based matters more than how big it is: providers in the United States and Canada standardize the most, while those in Colombia, Mexico and Japan customize for the majority of their customer base.
The customer’s own business plays its part too: Health care customers receive by far the most security-forward and varied treatment, while traditional industries such as construction and agriculture mostly sit on a simple, shared template.
A protection plan in Acronis Cyber Platform can turn on many kinds of protection at once, called modules: backup, anti-malware, active protection against ransomware, endpoint detection and response, vulnerability assessment, data loss prevention, remote monitoring and management, disaster recovery and more, and customers really do use that breadth. About 65% of active endpoints run two or more protection modules together, managed from one console. This is exactly the direction the wider market is being told to take: Gartner names the move onto consolidated, converged security platforms as a defining trend for 2026.
The protection that ships switched on by default is kept switched on, too. Across hundreds of thousands of anti-malware plans in use, the behavioral engine that catches unknown threats stays on in 84.7% and exploit prevention in 70.4%.
Across a similarly large population of active protection plans, a ransomware response is set in 87.9% and self-protection is on in 84.4%. Customers accept a strong, safe starting point, which is the real-world goal behind the secure-by-default idea now promoted by national cyber agencies.
Customers also structure their plans deliberately rather than by accident. Among machines with two or more plans, 82% separate plans by purpose, such as a backup plan and a security plan applied side by side, yet 77% keep the same schedule across plans. Purpose separation, not scheduling, is the main reason administrators create multiple plans.
Creation-date gaps show that plans are often added incrementally as new modules become available, rather than designed as a set from the start, and regional differences in plan complexity, from markets that favor simple single-plan setups to those that build layered multiplan configurations, further show that policy structure reflects local practice and maturity.
Why the way you configure matters
Security budgets keep rising. Gartner forecasts that worldwide spending on information security will grow about 12.5% to roughly $240 billion in 2026, up from around $213 billion in 2025, driven by rising threats and the spread of AI. Yet spending more has not made configuration simpler. Teams juggle many tools from many vendors, and Gartner names the consolidation of security onto converged platforms as a defining trend for 2026, precisely to cut that complexity.
Alongside consolidation, national cyber agencies now expect products to be safe without the customer having to be an expert. This is the secure-by-default principle, part of CISA’s wider secure-by-design work: A product should ship ready to use with its most important protections already switched on, so a safe setup is the starting point rather than a project.
The question this report asks is simple. When a platform already brings many protections together and ships them switched on, how do customers actually configure their plans, and what do the configuration choices reveal about real-world practice? The configuration records give a direct answer.
One console, every layer of protection
Two different things can make a machine look "well covered," and this report keeps them apart throughout. A single plan can bundle several modules together, such as backup and anti-malware in one container, that is one plan with several features inside it. Separately, an administrator can apply several distinct plans to the same machine, each covering one specific area. When this report says a machine has "multiple plans," it always means the second case: multiple separate plan containers, not multiple features bundled into one.
In Acronis Cyber Platform, the unit an administrator applies to a machine is a protection plan. Inside a plan, individual protections are turned on as modules (for example, the Antivirus and Anti-malware module, the Backup module or the Endpoint Detection and Response module). These modules do not have to live in one plan: A customer may put every protection in a single plan or keep separate plans, for example, one for backup and another for anti-malware, and apply several plans to the same machine. Both are supported, and Acronis documents how multiple plans combine on one workload. What matters for protection is the set of modules a machine ends up running once every plan on it is combined.
Measured that way, across the more than 1.6 million endpoints selected for this report, 65% run two or more protection modules together. The average Windows workstation runs 5.6 modules from the single console.
Anti-malware and active protection reach furthest across the active fleet, each on close to 52% of endpoints, with backup close behind on 45%. Data loss prevention, remote monitoring and management and disaster recovery are tracked separately below: Each is a distinct capability rather than a subtype of "security," and none of these needs a second console — each is a module that can be switched on inside the same protection plan.
Table 1. Reach of each protection module across active endpoints. Percentages are weighted across all machine types.
The best evidence for secure-by-default is not that a safe setting exists, but that customers keep it. Across hundreds of thousands of antimalware plans in use, the behavioral engine that catches unknown threats stays on in 84.7%, real-time protection in 72.0% and exploit prevention in 70.4%. Active protection tells the same story: A ransomware response is set in 87.9% of active protection plans and self-protection is on in 84.4%.
Matching protection to the machine that needs it
Acronis advises building separate protection plans for workstations and servers, and the fleet follows that advice. Protection is clearly shaped by what a machine is. The chart isolates one module, endpoint detection and response, to show the pattern most sharply.
Workstations are the security-forward tier: 72% of Windows workstations run at least one security module and 48% run EDR specifically. Servers are the backup-forward tier: 83% are backed up. Linux servers are almost pure backup, at 98%. The fleet is mostly workstations: of the 1,619,489 active endpoints, about 76% are workstations; the rest are servers. Running backup and security together on the same machine is, perhaps surprisingly, rarer on workstations (8%) than on servers (19%): workstations lean hard into security modules without always pairing them with backup, while servers that run any security module are far more likely to already have backup underneath it too.
Table 2. Share of machines running each protection module, by machine type (Windows server includes domain controllers). Workstations are security-forward; servers are backup-forward.
One plan or many? How customers build their protection
All the protections discussed above can live in a single plan, yet in practice many administrators create more than one. Across the fleet, 60% of machines carry a single plan, 18% carry two, 11% carry three and 11% carry four or more. The interesting question is why: if everything can go in one plan, what drives administrators to split it up?
Purpose separation turns out to be the main reason. Among the more than 600,000 machines that carry two or more plans, 82% have plans serving different purposes, for example, a backup plan alongside a separate security plan. The remaining 18% have multiple plans of the same type. Scheduling, by contrast, is not the driver: 77% of multiplan machines keep the same schedule across all their plans, and only 23% use different schedules. Administrators separate plans to isolate different kinds of protection from each other, not to run them at different times.
The plans also tend to arrive over time rather than as a set designed up front. The time gap between the earliest and latest plan on a machine reveals how plans accumulate: When plans are created on the same day, the administrator likely designed the set together, and when they are months or years apart, the second plan was added later, often as a new module became available or a new requirement arose.
Figure 4. Distribution of multiplan machines by the time gap between the earliest and latest separate plan on the machine. Warm colors show plans added months later, suggesting incremental adoption rather than deliberate upfront design.
Table 3. Creation-date gap between separate plans on multi-plan machines. Only about one in five multiplan machines had all their plans created on the same day; the rest added a second plan weeks, months or years later.
Inside the backup plan: What gets protected and for how long
Backup remains one of the most widely deployed protections, present on 45% of the active fleet. Looking inside the close to half a million enabled backup modules shows what administrators actually choose to protect and how carefully they manage how long it is kept.
Table 4. Backup source-type distribution. Application-level backup groups SQL Server and Exchange together, since both back up a specific application rather than the whole machine or files generally.
Retention policy shows a clear split. Over half of backup modules leave retention at the default (not explicitly set by the administrator), meaning the platform’s built-in retention applies. Among those that do set retention explicitly, the most common choices are three to six months and one to three months.
Table 5. Backup retention distribution. Over half of modules rely on the platform default; the rest spread across defined retention windows.
Scheduling is enabled on 98% of backup modules, and every one of them is managed centrally from the cloud console rather than locally on the machine. Policy-driven, centralized management is, in practice, the universal way backup is run across this fleet.
A world of different habits: Policy configuration by region
The way administrators structure their plans varies across markets. Some regions favor simpler, single-plan configurations; others build layered setups with multiple plans per machine, and this is a genuine difference in configuration practice, not simply a measure of what was purchased. The table below compares four configuration metrics across the 20 largest markets by active machine count.
Table 6. Protection plan configuration across the 20 largest markets by active machine count.
Three terms recur in this table, and they describe three different things. "Multiplan" counts separate plan containers on one machine (see the definition above: several distinct plans, not one plan with several features). "All-purpose" is a subset of multiplan machines, specifically those whose separate plans serve different purposes, for example, one plan for backup and a different plan for security. "Mixed-plan" is the opposite pattern: A single plan that bundles two or more of backup, security, RMM or disaster recovery together in one container, rather than splitting them across separate plans.
Several patterns stand out. Canada, Mexico and Colombia average more than two plans per machine, with multiplan rates above half. These markets build layered configurations where backup and security are separated into distinct plans applied side by side. Japan, Israel and France sit at the other end, averaging closer to one and a half plans per machine, with lower multi-plan rates — administrators there simply run fewer plans overall. What differs between them is what those few plans contain, covered next.
Singapore (52.0%), Mexico (47.2%) and France (44.8%) stand out for the highest rates of mixed plans: A single plan that bundles two or more different protection functions — backup, security, RMM or disaster recovery — together rather than keeping them in separate plans. France is the more surprising case: It also has one of the lowest average plans per machine (1.52), so French administrators are not layering many plans; they are consolidating broadly into a smaller number of richly bundled ones, the opposite strategy from Canada or Mexico. Turkey, Japan and Israel keep the rate of mixed plans lowest, all around one in five, preferring to separate different functions into their own plans rather than combine them.
One provider, many customers: How MSPs decide what to deploy
Everything so far looks at policy from the endpoint up. Turn the lens around and ask how the managed service providers who run much of this fleet actually decide what to deploy, and a different pattern appears. Each provider’s customers are classified by their dominant plan purpose: backup, security, RMM, disaster recovery or a mixed plan bundling two or more of those together. A provider where at least 80% of customers share the same pattern is counted as applying a uniform plan; the rest customize to varying degrees. More than 9,000 providers with five or more active customers were identified this way, through the same tenant hierarchy used in Acronis’ customer-profile research.
Roughly half standardize and half customize, and size has almost nothing to do with which camp a provider falls into: Whether it manages five customers or 500, it is about equally likely to run close to one plan across the board or to configure each customer differently. Backup is the dominant template everywhere, more so for smaller providers (74% backup-led among providers with five to nine customers) than larger providers (67%), which lean relatively more on security-led templates instead (21% versus 11%).
RMM-led is a genuine but small category, 3% to 5% of providers depending on size: a provider whose dominant offering to most customers is device management and monitoring rather than backup or security. Disaster recovery is never a provider's dominant offering in this data; where it appears, it is always bundled alongside something else.
Table 7. MSP plan uniformity by tier. Uniform: at least 80% of a provider’s customers share the same purpose pattern.
Where a provider is based says far more about its approach than its size does. The table below shows the 20 countries with the most providers and the share meeting the uniformity threshold: at least 80% of a provider's c’stomers share the same plan-purpose pattern. The United States (65%), Canada (64%), the Netherlands (62%) and Germany (61%) are the only countries where the share exceeds 60%, followed by the United Kingdom (59%) and Australia (57%). The lowest shares are in Colombia (24%), Mexico (25%), Japan (31%) and Brazil (34%). In these four countries, only about one-third of providers meet the threshold, indicating greater variation in plan purposes across their customer bases.
Table 8. MSP policy approach by partner country, top 20 by MSP count. Average dominance: the average share of a provider’s customers on its most common plan pattern (higher = more standardized).
Health care, construction and everyone in between: Protection by industry
The customer’s own business shapes what a provider deploys just as much as geography does. Where industry is known from the customer’s contact record, the plan purpose breakdown varies substantially: Health care and education stand out as the most security-forward and varied industries, while traditional industries mostly receive simpler, backup-focused setups.
Health care and education customers are the least likely to receive a plain backup-only plan, only around 32% and 34%, respectively, compared with roughly half or more everywhere else. Both instead overwhelmingly receive mixed plans — a single plan bundling two or more protection functions together — at 59% for health care and 50% for education, far above every other industry, most of which sit in the 25%–35% range for mixed plans. This is a genuinely different pattern from the rest of the fleet: Health care and education providers are not just adding a separate security-only plan alongside backup; they are consolidating backup, security and often device management into single comprehensive plans per customer.
Traditional industries — construction, manufacturing and agriculture — sit at the other end: Backup-only plans dominate and mixed plans are less common, suggesting these customers mostly receive a simpler, less bundled template from their provider.
Recommendations: Getting more from the policies you already run
These steps are for the people who run the fleet: managed service providers and the in-house teams who administer their own tenants. Each follows directly from what the data above shows.
Standardize plans by machine role
Keep a small set of reusable protection plans for office workstations, remote workstations, file servers and domain controllers, following Acronis’ advice to use separate plans for workstations and servers. This keeps configuration consistent and easy to audit as you grow, in line with NIST guidance on secure configuration management.
Review multiplan machines for simplification
Where machines carry three or more plans that accumulated over time, check whether the plans can be consolidated. Purpose separation is reasonable when it serves a clear operational need, but plans added incrementally may overlap or carry redundant modules. Fewer plans mean fewer conflict-resolution decisions and simpler audits.
Set retention explicitly on backup plans
Over half of backup modules rely on the platform default for retention. While the default is safe, explicitly choosing a retention period that matches recovery requirements shows that the configuration was deliberate and can be justified to auditors.
Keep the strong defaults and record any exception
The behavioral engine, exploit prevention and ransomware response are on by default for good reason. Where you must switch one off for a specific machine, note why so the exception does not quietly spread across a shared plan.
Apply lessons from regional variation
Markets with simpler plan structures (fewer plans per machine, lower multiplan rates) may find it easier to audit and maintain their configurations. Markets with complex layered setups should periodically review whether the layering still serves a purpose. Either approach can work, but it should be a deliberate choice rather than the result of incremental accumulation.
Review MSP templates against customer industry
Health care and education customers receive comprehensive, bundled plans in this data, and that pattern is consistent with their regulatory requirements. MSPs serving mixed-industry portfolios should check whether their less-regulated, backup-only customers would benefit from a similarly bundled plan as their own risk profile grows, rather than adding protections through separate, uncoordinated plans later.
Conclusions
The clearest lesson in this report is that protection is decided less by what an organization buys and more by how it is configured and applied. Security budgets are large and still growing, and the market is being pushed toward simpler, consolidated platforms that bring many protections together and ship them ready to use. The configuration records behind a very large managed fleet show what happens when that vision meets daily practice, and the picture is one of deliberate, structured use.
When administrators need more than one plan on a machine, they split by purpose rather than by schedule. A backup plan and a security plan applied side by side are the dominant pattern, and the plans are typically added over time as new modules become available. This incremental adoption is a sign of a platform that grows with its users rather than requiring everything to be configured at once.
Where plan complexity has accumulated beyond what is needed, the opportunity is simplification: Consolidating overlapping plans and ensuring that every plan serves a clear, auditable purpose.
The view from the service provider side reinforces these patterns. About half of all MSPs apply a near-uniform plan template to their entire customer base, while the other half differentiate. Neither approach is inherently better: A uniform template is efficient and auditable; customization lets the MSP match protection to each customer’s industry and risk profile.
The geographic split, with English-speaking markets favoring standardization and Latin American and Southern European markets favoring customization, suggests that local market norms and regulatory environments shape the MSP’s delivery model as much as the technology does.
Industry is not neutral. Health care and education customers receive markedly different protection from customers in construction or agriculture: not just more security modules but comprehensive, bundled plans that combine backup, security and often device management into one container, at roughly double the rate of every other industry. This is the right outcome: Regulated industries with sensitive data should carry stronger, more consolidated protection, and the data shows that MSPs already deliver it. The question for MSPs serving mixed portfolios is whether their backup-only customers in lower-regulation industries would benefit from a similarly bundled approach as threat landscapes evolve.
The tools are in hand, and the habits are mostly right. What remains is to review and simplify where complexity has grown beyond its purpose, set retention and configuration choices explicitly rather than relying on defaults, keep standardizing plans by machine role and ensure that MSP templates reflect the risk profile of each customer’s industry. The platform already delivers the consolidation the industry is working toward; the next step is ensuring that every plan on every machine is as deliberately structured as the best ones already are.