MSP cybersecurity: Clients aren’t shown who holds standing access

SPEAKER_1 (0:00)

The holidays have a way of bringing out old habits. Saying yes to every invitation because you feel guilty saying no, or getting pulled into the same family arguments year after year. But what if this year, you gave yourself permission to do things differently? Maybe you skip an event you don't have the energy for, or take a breath instead of reacting to that comment that always gets under your skin.

Those small moments can change how you feel and how you show up for the people you love. That's what growing feels like. Grow Therapy makes finding care easier. Find a licensed therapist who fits your needs, book your first session in minutes, and start in as little as two days. Prepare for holiday glimmers instead of holiday stress. Visit growtherapy.com/book now. That's growtherapy.com/book now. Availability and coverage vary by state and insurance plan.

Dave Sobel (0:55)

Your clients agreed to trust you. They never agreed to the vendors you extended that trust to, and most have never seen the list. The next breach notice may be the first time they do. This is the Business of Tech. I'm Dave Sobel. The breaches MSPs prepare their clients for usually start with a person logging in. The incidents landing on MSPs start with the MSPs own tools. A quick disclosure before we start, I own shares in Enable, which is part of the story. Start with an update on Enable. On this show, I reported that Enable took its hosted Encentral platform offline after a researcher published more than 30 alleged vulnerabilities. Enable has now released a hotfix, Encentral 2026.4hf2.

It says all hosted servers across every region have been upgraded and are back online. Customers running Encentral on their own servers were told to apply the hotfix before restoring Internet access. Enable hasn't flagged the flaws as exploited, but threat intelligence firm Diffused says attackers have started scanning for vulnerable systems. The Shadow Server Foundation counted 1,338 Encentral servers exposed to the Internet and later just over 148 The disclosure itself is in dispute. The researcher Sean Bales said he went public because earlier reports about another Enable product went unpatched. Enable says that claim is inaccurate. Now a follow up on ConnectWise. On October 20th, I told you about one ConnectWise Cloud Backup credential that signed in to 173 Microsoft 365 tenants in a little over two hours. The fuller picture is larger. Channel Insider reports the outage disrupted more than 2,300 MSP partners. Huntress found suspicious sign-ins across nearly 1,000 accounts, and more than 300 were successful intrusions. The secrets attackers planted in other trusted tools were set to expire in 2028 That's access built to outlast the cleanup. And ConnectWise says it can't tell individual MSPs whether their client's tenants were accessed or changed.

Set that against what the industry measures. GTIA's quarterly cybersecurity tracker surveyed 309 North American providers. 93% offer cybersecurity. Only 42% have multi-factor authentication on all critical systems for more than half their customers. Here what that adds up to. The industry is still counting how many clients have MFA. The incidents keep arriving through the MSP's own tools, not through a client's login. In plain terms, the door that keeps opening is one the MSP installed. So why doesn't the client ever see it?

If you're listening to this and haven't hit follow yet, on Apple Podcast search Business of Tech. Takes 5 seconds and you'll get the next episode automatically.

This episode is supported by ScalePad. Clients decide whether to continue and grow with you based on the value they can see. ScalePad CS is the customer success platform built for MSPs. It gives you one shared view of every client's health, priorities, sentiment, risks, and opportunities. It covers the whole customer success workflow, real-time hardware, software and AI insights, assessments, roadmaps, budgets, and client-ready QBRs. It's one platform instead of spreadsheets and disconnected tools. So you can catch risks earlier, deliver more consistently, and grow the relationship. The work may be technical. The business value should be obvious. scalepad.com/mspradio.

Underneath all of this is one dynamic. Microsoft built the partner model so an MSP can act on a client's behalf, and that includes saying yes on the client's behalf. Every tool the MSP connects inherits that yes. Start with how the consent works. Microsoft's own partner documentation explains that under granular delegated admin privileges, either the customer or an admin with an on behalf of relationship to the customer consents to let partner managed applications use the customer's tenant. In practice, that admin is usually the MSP. The credential that comes out of that consent replaces a person. Microsoft's guidance says the stored Refrex token is used by the application or script instead of user credentials when it authenticates. No one signs in, so there's nothing for MFA to check. Now look at what happens when a vendor in the middle is breached. MSP Process makes identity and user management tools for more than a thousand MSPs, connected to the major PSA platforms. Its apps typically hold permissions in client tenants to read and write user accounts and their authentication methods. The company told customers that anyone holding one of its app secrets could use those permissions without a user sign-in or MFA. Reportedly stolen? App ideas and secrets, administrator refresh tokens, and the lists of which client tenants each MSP has delegated access to. That's the keys and the map. A Huntress staffer responding to the breach reported successful malicious token grants in 47 tenants. Chief executive Patrick Leonard said containment on its platform does not, on its own, confirm that partner tenants are clean. And the cleanup advice for MSP Process users tell you where the consent came from. Revoke sessions for the admin who originally connected the tool. That admin works for the MSP.