One Breached MSP, 500 Victims: How to Vet Your Managed Service Provider Before It’s Too Late
Your managed service provider may be one of your most important business partners. It may also be one of the most privileged entities inside your environment.
An MSP often has access to your endpoints, servers, cloud platforms, backups, identity systems, and remote administration tools. If that provider is compromised, attackers may not need to breach your business directly. They can use the provider’s trusted access as a shortcut.
That is the core of MSP supply-chain risk.
A single breached MSP can create downstream exposure for hundreds of organizations. The 2021 Kaseya ransomware incident demonstrated how attackers can abuse remote management infrastructure to affect multiple customers at once. The Cybersecurity and Infrastructure Security Agency (CISA) and international cybersecurity authorities continue to warn that threat actors target MSPs because one successful intrusion can cascade across an entire customer base.
“Too small to be hacked” is no longer a security strategy. Neither is choosing an MSP based only on price, convenience, or a polished sales presentation.
You need to know how your provider protects its own environment: and how it prevents one compromised credential, tool, or employee from becoming your organization’s next major incident.
WHY MSPs ARE HIGH-VALUE TARGETS
MSPs and MSSPs are attractive targets because they operate at scale.
Instead of attacking 500 businesses individually, a threat actor may target one provider that has:
- Administrative access to multiple customer environments
- Remote monitoring and management (RMM) tools
- Backup and disaster recovery platforms
- Cloud and identity administration privileges
- Network diagrams, credentials, and security configurations
- Trusted communication channels with customer employees
RMM platforms are particularly sensitive. They allow providers to deploy software, run scripts, make configuration changes, troubleshoot systems, and access endpoints remotely. Those capabilities are essential for IT operations: but they can become powerful weapons when an RMM console or administrator account is compromised.
The same risk applies to software supply chains and third-party integrations. A vulnerable vendor, subcontractor, help desk account, or remote access tool can become the entry point attackers use to reach your business.
CISA’s guidance for MSPs and customers recommends MFA, strong monitoring and logging, network segmentation, least privilege, timely patching, tested backups, and clearly defined contractual responsibilities. Those are not “nice-to-have” controls. They are the baseline for a provider that handles privileged access.
THE FIRST QUESTION: HOW DOES THE MSP SECURE ITS OWN ENVIRONMENT?
Before asking how an MSP will protect your network, ask how it protects itself.
A provider that cannot explain its own security controls should not be trusted with access to your business systems.
Ask for clear answers to these questions:
- Do you enforce MFA on every account that can access customer environments?
- Is phishing-resistant MFA used for privileged accounts?
- Are RMM, PSA, backup, cloud, and administrative email accounts protected with MFA?
- How do you separate your internal systems from customer environments?
- Do you use unique administrative credentials for each customer?
- How often do you review privileged access?
- How quickly are inactive employee and contractor accounts disabled?
- Do you monitor administrator activity and investigate unusual behavior?
The strongest providers will answer directly and explain how those controls are enforced: not simply say, “We take security seriously.”
They should also be able to describe their own vulnerability management program, patching procedures, incident response plan, and backup strategy.
If the provider treats its internal security as confidential but cannot provide meaningful assurance, treat that as a risk signal.
MFA ON RMM TOOLS IS NON-NEGOTIABLE
MFA must protect every system that can provide access to your environment.
That includes:
- RMM and remote access platforms
- Backup and disaster recovery tools
- Cloud administration consoles
- Identity providers
- PSA and ticketing platforms
- Privileged email accounts
- Security and endpoint management tools
Do not accept “MFA is available” as an answer. Ask whether it is mandatory, which accounts are covered, and what authentication methods are permitted.
SMS-based MFA is better than no MFA, but hardware security keys, passkeys, certificates, or properly configured authenticator applications offer stronger protection against phishing and account takeover.
Also ask whether the provider uses:
- Role-based access controls
- Just-in-time or time-limited administrative privileges
- Separate accounts for daily work and administration
- Device trust or conditional access
- Session logging and command auditing
- Quarterly access reviews
A provider should not give every technician unrestricted access to every customer. Least privilege limits the blast radius when an account is stolen or misused.
CONTINUOUS VULNERABILITY MANAGEMENT: NOT A PDF ONCE A QUARTER
A provider’s vulnerability management practice reveals how seriously it handles exposure.
Ask:
- How do you discover assets across your own environment?
- How do you identify vulnerabilities in RMM and remote access systems?
- Do you prioritize known exploited vulnerabilities?
- How quickly do you patch critical findings and zero-days?
- Do you scan internet-facing systems, cloud environments, Active Directory, and internal networks?
- Do you validate that remediation was completed?
- Can you provide risk reports and remediation metrics?
Traditional scanning often produces a long list of CVEs without explaining what matters most. A mature program combines discovery, continuous scanning, exploitability intelligence, asset criticality, remediation coordination, and validation.
Cenova Cyber’s Vulnerability Management as a Service follows this full-lifecycle approach. It includes asset discovery, internal and external scanning, risk-based prioritization, guided remediation, validation scans, and compliance-ready reporting.
The question is not whether your provider can find vulnerabilities. The question is whether it can help ensure the vulnerabilities that matter most are actually fixed.
DO THEY MONITOR 24/7: including THEIR OWN ADMINISTRATIVE SYSTEMS?
An MSP that monitors your network but not its own RMM and administrative infrastructure has a serious blind spot.
Ask whether the provider operates or partners with a 24/7 security operations center (SOC). Then ask what the SOC actually monitors:
- RMM and remote access activity
- Privileged account behavior
- Unusual login attempts
- Endpoint and server telemetry
- Cloud and identity events
- Backup configuration changes
- Suspicious software deployment
- Lateral movement indicators
“24/7 monitoring” should mean more than alerts being collected overnight. Ask who reviews alerts, how incidents are escalated, what the response-time commitments are, and whether the team can isolate systems without waiting for business hours.
Cenova Cyber’s Managed Detection and Response service combines 24/7/365 monitoring, proactive threat hunting, behavioral analytics, and rapid containment. When a confirmed threat appears, the goal is action: not simply forwarding an alert to your internal team.
ASK HOW THIRD-PARTY ACCESS IS CONTROLLED
Your MSP may not be the only organization with access to your systems.
It may use subcontractors, cloud providers, software vendors, backup companies, or specialized consultants. Each additional party expands the supply chain.
Ask your provider:
- Which subcontractors can access our systems or data?
- What work do those parties perform?
- Are they subject to the same MFA and least-privilege requirements?
- How are their accounts reviewed and disabled?
- Do you assess critical vendors before onboarding them?
- Are third-party activities logged and available for review?
- Will you notify us if a critical supplier is breached?
Your contract should identify who owns security responsibilities across the relationship. It should also specify how quickly the MSP must notify you about suspected or confirmed incidents affecting its infrastructure, personnel, tools, or other customers.
INCIDENT RESPONSE SHOULD BE TESTED BEFORE THE CRISIS
Every provider has an incident response plan: at least on paper.
Your job is to determine whether the plan works.
Ask:
- What happens if your RMM platform is compromised?
- How quickly will you notify us?
- Can you disable your remote access to our environment immediately?
- How will we communicate if email is unavailable?
- Who leads the investigation?
- Will you preserve logs and support forensic analysis?
- How will you coordinate with our cyber insurer, legal counsel, and law enforcement?
- When was the last tabletop exercise?
A strong plan includes documented roles, alternate communication channels, isolation procedures, evidence preservation, recovery priorities, and customer-specific escalation contacts.
The plan should cover not only an attack against your company, but also an attack against the MSP itself.
CYBER INSURANCE AND SOC 2: USE THEM AS EVIDENCE, NOT SHORTCUTS
Ask whether the MSP carries cyber insurance and what the policy covers.
Important questions include:
- Does the policy include third-party liability?
- Does it cover incidents caused by compromised MSP tools or credentials?
- Are customer notification and forensic costs included?
- What exclusions or security-control requirements apply?
- Are subcontractors covered?
Also ask whether the provider maintains a SOC 2 report, ISO 27001 certification, or comparable independent assurance.
A SOC 2 report can provide useful evidence: but scope matters. Review what systems, services, locations, and time periods are included. A report covering a narrow internal process may not address the RMM platform or services that manage your environment.
Compliance language is not a substitute for operational transparency.
A PRACTICAL MSP VETTING CHECKLIST
Before signing: or renewing: an MSP agreement, confirm that the provider can demonstrate:
- MFA on every privileged and customer-access account
- Strong controls around RMM and remote access tools
- Unique credentials and tenant separation
- Continuous vulnerability management and defined patch SLAs
- 24/7 monitoring with human-led response
- Centralized logging and meaningful customer visibility
- Tested incident response and recovery procedures
- Documented third-party and subcontractor oversight
- Cyber insurance appropriate to the provider’s risk
- Current SOC 2, ISO 27001, or comparable assurance
- Clear notification requirements in the contract
- Defined ownership for hardening, monitoring, response, and recovery
Review the provider annually: and whenever there is a major change in ownership, tooling, personnel, subcontractors, or service scope.
CHOOSE A SECURITY-FIRST PARTNER
Your MSP should reduce operational burden without creating hidden concentration risk.
At Cenova Cyber, we approach managed security as a continuous responsibility: not a monthly report. Our services combine 24/7 SOC and MDR, continuous VMaaS, security monitoring, and vCISO leadership to help organizations identify exposure, prioritize risk, respond to threats, and build a more resilient security program.
You do not need more promises. You need clear accountability, measurable controls, and a provider that secures its own house before asking to protect yours.
Contact Cenova Cyber today to schedule a security assessment. We will help you evaluate your current provider, identify supply-chain exposure, and build a defense that supports business continuity: not just compliance.
Learn more about Cenova Cyber or schedule a security consultation.