MSP cybersecurity: Clients aren’t shown who holds standing access

The episode highlights a persistent governance gap in how MSPs extend trust and standing access to third-party vendors within client environments. Key mechanisms such as Microsoft’s partner consent process and delegated credentials mean clients rarely have visibility or control over which vendors or tools their MSPs connect to their systems. Incidents involving N-able, ConnectWise, and MSP Process demonstrate how these invisible dependencies increase client exposure without their explicit approval.

Recent breaches illustrate the risk: ConnectWise Cloud Backup affected over 2,300 MSP partners, with Huntress noting suspicious activity in nearly 1,000 accounts and 300 confirmed intrusions. Similarly, MSP Process lost app secrets and tokens enabling attackers to access client tenants without user logon or multifactor authentication, according to incident responders. These weaknesses allow unauthorized, persistent access and often leave both vendors and clients unable to fully audit data exposure after an incident.

Supporting evidence further underscores the governance issue: Only 42% of North American providers enable multifactor authentication for most client systems, per GTIA. While some vendors, like Microsoft with its default subprocessor notifications, provide clarity about new data access, most MSP-integrated tools lack equivalent transparency. Efforts to move toward user-controlled authorization models remain limited and largely untested across the industry.

For MSPs and IT leaders, these dynamics underscore the need to clearly document all vendors with standing access, secure explicit client approval, and establish notification procedures for changes. Building and maintaining such inventories from client tenants, not memory, will become increasingly important for accountability, contract clarity, and meeting customer and insurer expectations.

00:00 The Door the MSP Installed
03:59 Consent the Client Never Gave
06:38 Who Gets to See the Keys
10:47 Why Do We Care?

Supported by:
ScalePad https://scalepad.com/dave/
Guardz https://www.guardz.com/
Oveka https://oveka.io/mspradio

💼 All Our Sponsors

ABC Solutions — https://go.businessof.tech/p/abc-solutions-yt
CometBackup — https://go.businessof.tech/p/cometbackup-yt
FireTail — https://go.businessof.tech/p/firetail-yt
Guardz — https://go.businessof.tech/p/guardz-yt
HaloPSA — https://go.businessof.tech/p/halopsa-yt
LogMeIn — https://go.businessof.tech/p/logmein-yt
Mailprotector — https://go.businessof.tech/p/mailprotector-yt
OpenText — https://go.businessof.tech/p/opentext-yt
Oveka — https://go.businessof.tech/p/oveka-yt
Pax8 — https://go.businessof.tech/p/pax8-yt
Rythmz — https://go.businessof.tech/p/rythmz-yt
ScalePad — https://go.businessof.tech/p/scalepad-yt
TimeZest — https://go.businessof.tech/p/timezest-yt

Supporting the IT services community through insights, analysis, and transparency.

⸻

🚀 Join The Small Biz Thoughts Community

The membership for independent MSP owners: vendor intelligence, member-only briefings, a private peer forum, and direct access to Dave.

👉 https://smallbizthoughts.org/join/

⸻

🎧 Subscribe to the Business of Tech

Want the show on your favorite podcast app or prefer the written versions of each story?
📲 https://www.businessof.tech/subscribe

⸻

📰 Story Links & Sources

Looking for the links from today’s stories?
Every episode script — with full source links — is posted at:
🌐 https://www.businessof.tech

⸻

🎙 Want to Be a Guest?

Pitch your story or appear on Business of Tech: Daily 10-Minute IT Services Insights:
💬 https://www.podmatch.com/hostdetailpreview/businessoftech

⸻

🔗 Follow Business of Tech

LinkedIn: https://www.linkedin.com/company/28908079
YouTube: https://youtube.com/mspradio
Bluesky: https://bsky.app/profile/businessof.tech
Instagram: https://www.instagram.com/mspradio
TikTok: https://www.tiktok.com/@businessoftech
Facebook: https://www.facebook.com/mspradionews