Episode 11: How MSPs close security gaps across five attack surfaces

Adam Welcome to the deep dive. Today we’re plunging into uh really critical and honestly often misunderstood part of digital security. You know that feeling? When your laptops, your phones, your servers, uh the endpoints they feel protected, we get this sense of security from that. But, and this is the big question, what if that’s only like a graction of the real story? So the core problem we’re seeing, and you know, what our research really backs up, is that a lot of managed service providers, MSPs, and well, their clients too, they rely really heavily on just endpoint-only security tools. And they kind of mistakenly think, okay, we’re covered, this is comprehensive, but it’s just not the whole picture. And here’s where it gets uh truly eye-opening looking at the sources we dug into. While something like 70% of all breaches start at an endpoint.

Christina Yeah, they originate there.

Adam Right. But those same endpoints, they only account for maybe what, a third of the total attack surface? Exactly. Just think about that for a second. That leaves this huge, potentially, well, catastrophic security gap.

Christina It really is a classic case, isn’t it? That false sense of security. Relying only on endpoint protection, um, it’s basically like locking the front door of your house but leaving all the windows wide open.

Adam Good analogy.

Christina You might feel safe, right? But the vulnerabilities are just sitting there everywhere else, and this kind of oversight, it can lead directly to, you know, massive downtime, serious data loss, uh big regulatory risks, and yeah, ultimately losing business painfully.

Adam That analogy, yeah, it really hits home. Okay, so let’s unpack this then. Our mission for this deep dive is to figure out okay, what does endpoint-only security actually protect? What crucial stuff does it miss? And what are the you know, the high costs tied to these blind spots in managing your attack surface today? And importantly, how do we get to like complete visibility? So, this deep dive, it’s really for you if you’re managing a network, or maybe you’re just really curious about cybersecurity, or perhaps you’re even prepping for that big IT strategy meeting. All right, let’s start with maybe the clearer side. What do these endpoint-only security tools actually cover? The sources are pretty clear here. Endpoint detection and response, EDR, well, the name says it all right. They monitor and secure those individual devices, desktops, laptops, servers. They’re like the digital guards for those specific machines.

Christina Exactly right. And EDR tools, they are quite good at spotting suspicious behavior on those devices. They can isolate a compromised endpoint, help with rapid incident response. They’re great for detecting malware or you know, persistent footholds an attacker might set up, other device-level threats. But the challenge, the big, however, is that’s where the protection ends. It’s really scoped just to that device itself.

Adam And this is where the limitations become, well, a critical issue. I mean, locking down devices sounds great. But here’s the twist, isn’t it? Yeah. What if the real threats, the sneaky ones, aren’t even directly touching those traditional endpoints? It makes you wonder with these blind spots being so fundamental, cloud identity, lateral movement, are attackers just getting smarter, or have these gaps always been there, just maybe less obvious before?

Christina That’s a really good question. And honestly, it feels like a bit of both. Attackers definitely evolve, right? They go for the path of least resistance. And what we’ve gathered from the research, it really spells out what these endpoint-only tools consistently miss, like cloud environments, huge blind spot. Think about um misconfigured cloud storage or maybe exposed APIs, compromised sauce credentials.

Adam Right, good targets now.

Christina Huge targets and completely invisible to EDR tools because, well, they’re not on a traditional endpoint device. Then you’ve got network traffic and lateral movement. This is a big one. Without seeing what’s happening at the network level, it’s basically impossible to spot, let alone stop attackers moving sideways inside your network once they get that first foothold.

Adam So EDR might catch something on one laptop.

Christina Exactly. It might catch malware on one laptop, great. But it won’t tell you if that same attacker then just, you know, quietly pivoted over to a server or some other device that isn’t monitored. unknown 3:57 Oof.

Adam So the breeze just keeps going.

Christina Silently escalating, yeah. And identity and access abuse, another critical piece. Your endpoint tools, they just can’t tell if legitimate user credentials get stolen and then used to log in from, say, a weird location. Or if they’re used to access resources, they absolutely shouldn’t be touching. The device might look clean, totally fine, but the identity is compromised. EDR just has no visibility there.

Adam Okay, that’s a major gap.

Christina And we absolutely have to talk about IoT devices and uh shadow IT. EDR simply can’t monitor things like your network printers, smart TVs, security cameras, because they don’t run a normal OS where you can install an agent.

Adam Right, no agent.

Christina No agent. But these things have become super common entry points or pivot points in attacks, often completely unmonitored. And lastly, think about email attacks. Most EDRs, they only really kick in when a malicious payload, like a file, actually hits the device. This means they miss the threat way earlier in the uh the kill chain, you know, that sequence attackers follow.

Adam Yeah, the steps they take.

Christina Right. So EDR misses the phishing email itself, maybe the credential harvesting website. It lets that initial access happen because maybe no bad file ever actually touched the endpoint directly.

Adam That is quite a list of blind spots. And it’s not just theoretical, is it? I mean, our sources specifically mention some common EDR tools, Huntress, ConnectWise EDR, Caseya Rocket Cyber. And while they’re great for their main job, endpoint threats, they do have these documented limitations in the broader areas we’re talking about. But the research suggests Huntress doesn’t natively do network traffic analysis or cover the full cloud picture.

Christina Right, often needs other pieces.

Adam Yeah. And ConnectWise EDR is noted for limited network visibility, leaves most cloud stuff unmonitored without add-ons. Casilla Rocket Cyber, similar story, lacking that full spectrum view, continuous vulnerability management. Now, to be fair, these vendors might offer more through integrations or other modules. But the core EDR modules themselves, they are by definition endpoint focused. That’s the key takeaway. Okay, so we’ve identified these sort of open windows in the security house. But what actually happens when someone cloms through one? This is just theory, right? Our sources really highlight the tangible risks, the stuff that really damages client trust ruins reputations. So what does this mean for your business or for your clients?

Christina It means vulnerabilities turning into really costly incidents. Think about misbreach detection. A lot of attack methods now, they don’t even need malicious files or traditional endpoints. An attacker could get into, say, a Microsoft 365 account just using credentials stuff, guessing passwords, reusing them. And an EDR solution wouldn’t see a thing. Data could be leaking out for weeks, totally unnoticed. Or uh uncheck lateral movement. EDR might do its job, isolate malware on one machine, good, but it can’t detect that the attacker already pivoted maybe to a shared file server or a critical business app. You think the threats contain, but meanwhile the attacker is doing deeper, often way more significant, damage somewhere else.

Adam Somewhere you’re not looking.

Christina Exactly. And we’ve even seen in the research ransomware starting from an unmonitored IoT device. Imagine a compromised smart device on a client network, like uh a smart thermostat or a security camera.

Adam Right. Something seemingly harmless.

Christina Yeah. It could launch a ransomware attack. And if you only have EDR, that breach flies completely under the radar because, well, the device doesn’t run an OS or an agent EDR supports. It just goes undetected until it’s way too late. That’s a terrifying thought, right? That smart coffee maker could take down the whole business.

Adam Wow. Yeah. Okay.

Christina And then there are the compliance violations, audit failures. Without that complete visibility across cloud, identity, the network proving you’re compliant with rules like HIPAA, GDPR, CMMC, it becomes basically impossible.

Adam One blind spot sinks you.

Christina One blind spot, one unmonitored area can lead straight to failed audits, big fines, and yeah, lost contracts, critical contracts. And finally, maybe the most insidious, is client distrust and churn. Clients today. They’re smarter about security than ever. They expect you to be thorough. So when they ask, how do I know we’re protected beyond just the laptop? You need a really good, confident answer that covers everything.

Adam Yeah, you need the proof.

Christina Exactly. Without that transparent reporting across the whole infrastructure, you’re gonna struggle. Struggle to prove your value, build that vital trust, or even just justify your security costs.

Adam All of this really points to that significant high cost of having incomplete visibility across client environments. It’s not just about one incident, it’s like the systemic risk that can genuinely cripple a business.

Christina Precisely. Undetected threats, they almost always lead to extensive downtime, business disruption, and then very costly incident response. And if attackers manage to pull data out, exfiltrate it from cloud apps, shared drives, SAS platforms, then you and your client could be looking at lawsuits, potentially crippling fines, and those mandatory breach disclosures.

Adam Which nobody wants.

Christina Nobody. Plus, think about the inefficiency trying to manually piece together alerts from all these different siloed security tools. It’s incredibly hard. Teams miss crucial threats. Containment gets delayed significantly. And this lack of a cohesive, continuous view across networks, users, systems, it directly leads to failed audits and yeah, lost business opportunities.

Adam So let’s connect this right back to you, the listener. Your clients today, they expect you to cover all the bases. If you can’t confidently show how their cloud accounts, their networks, their identities are secured, well, you’re basically leaving, what was it, 70% of the attack surface potentially unprotected?

Christina Around that, yeah. A huge portion.

Adam And when that’s the case, confidence, trust, and ultimately your business, it’s all definitely a stake.

Christina And this is exactly why something like OpenXDR has become so, so essential in today’s threat landscape. Attackers aren’t just hitting endpoints anymore. They’re actively exploiting cloud setups, abusing identity systems, moving laterally through networks you might not even be watching closely. So to counter that, MSPs really have to achieve complete total visibility across their client environments.

Adam So OpenXDR isn’t just another tool in the box then.

Christina No, not at all. It’s more like upgrading from, say, a patchwork of separate security cameras to one single intelligent control center, one that sees the entire breach unfolding, maybe even helps predict the next move, and crucially helps stop it before it paralyzes everything. Okay. It augments that traditional attack surface management with what we call whole of network capabilities. It basically consolidates those siloed functions, EDR, SIEM. Right. And AR, security orchestration, automation, and response. It pulls them into one unified view, a single pane of glass, and it uses things like AI-powered analytics, correlation, automation. It moves you from just reacting to single alerts to actually understanding the whole story almost instantly. It really boils down to that core principle that you just can’t protect what you can’t see.

Adam So wrapping this up, we’ve really explored why just relying on endpoint security, while definitely important, is also a critical vulnerability. It leaves huge parts of your digital infrastructure exposed and can lead to really significant hidden costs and risks. This deep dive, I think, really highlighted how critical these blind spots are.

Christina Absolutely. It’s just crucial now to shift that focus, move towards whole of network visibility using solutions like OpenXDR. In a world where threats change so fast, real protection has to extend way beyond just individual devices. It needs to secure the entire organization truly end-to-end.

Adam And this brings us to an important question for you, our listener. Where might your own digital security strategy have blind spots? What does comprehensive protection actually look like for your unique environment, considering the specific threats you face? We really encourage you to think about that entire attack surface. Thank you for diving deep with us today. Keep that curiosity going.