Episode 10: How MSPs protect clients against supply chain attacks

Adam Okay, let’s dive into this. We’ve got a stack of sources here, all centered on, well, a really critical area of cybersecurity right now in 2025. Supply chain attacks.

Christina That’s right. And looking at the material, our uh our goal here is to really unpack these sources, understand what these attacks actually are, why they’ve become, you know, so effective and frankly dangerous, and crucially, what the sources are telling us about how to defend against them now.

Adam And the big thing, the thread running through all of this material, it seems to be that these attacks work so well because they exploit the very thing our digital world runs on. Trust.

Christina Exactly.

Adam They take something seemingly normal, like a software update, maybe a service provider you trust, a tool you use daily, and they weaponize it, turn it into the weigh-in for some really damaging breaches.

Christina Yeah, it’s not just theory anymore, is it? This is where a huge amount of the uh the action is, unfortunately. And I think to really get our heads around it, we should start with how the sources define these attacks.

Adam Okay, yeah, let’s break that down. According to these sources, what is a supply chain attack?

Christina So fundamentally, it’s when the bad actors don’t just, you know, bang on the front door of their main target. Right. Instead, they find and compromise someone else first. Maybe a third-party supplier, a service provider, could be a software vendor, someone the main target relies on.

Adam Ah, okay. So rather than a direct assault, they’re slipping in through a like a side entrance that the target organization just assumes is safe because they trust who uses it.

Christina Precisely. They come in through a trusted channel. And the sources give some really good examples. You know, it could be malware hidden inside a perfectly legitimate software update from a vendor.

Adam Right, something you’d install without a second thought. Or maybe compromising, say, an IT provider’s own tools, like those RMM remote monitoring and management platforms.

Christina Exactly that. Because then they potentially get access to all the clients that provider serves. It’s a massive force multiplier for them.

Adam Wow.

Christina Or another example, injecting bad code into an open source library that tons of developers then use in their own software.

Adam So it gets baked right in.

Christina Yeah. Or even something as simple, relatively speaking, as stealing the login details for a third-party contractor who already has legitimate access to the target’s network.

Adam Okay. That makes the how much clearer. So once they’re inside via that trusted third party, what kind of access do the sources say they typically get?

Christina Well, the key point the sources make is that the attackers often inherit the same level of access and permissions that the compromised trusted party already had. Which, you know, makes it way easier for them to move around inside the target’s network without setting off immediate alarms. They look like legitimate traffic.

Adam Which must make them incredibly hard to spot with traditional security tools that are mainly looking for untrusted connections coming in from the outside.

Christina Absolutely. They just blend right in.

Adam Okay. So we get the what. But the sources really hammer home that by early 2025, something big has changed. Why now? Why have these attacks gone from maybe a niche concern to what the sources are calling a mainstream tactic?

Christina Yeah, the sources are pretty specific on this. They point to a really sharp increase over the past couple of years. The data for early 2025 is well, it’s quite stark.

Adam Like that stat you pulled out, over 60% of ransomware attacks now starting from a third-party compromise. That’s that’s huge.

Christina It’s a massive number, isn’t it? And it really shows this isn’t some edge case anymore. It’s a primary attack vector. The sources also keep highlighting software dependencies, um open source libraries, still massive targets. Right. Attackers are actively trying to get malicious code into these components before they even get widely distributed.

Adam So the vulnerability is built in almost from the get-go before it even reaches the end user.

Christina Exactly. And another thing explicitly called out in the material is that MSPs and MSSPs, the managed service providers and security providers, they are absolutely trime targets themselves.

Adam Why them specifically?

Christina Because they’re seen as these central hubs, compromise one MSP, and you might get keys to the kingdom for hundreds, maybe thousands of their clients downstream.

Adam Attack the provider to cascade down to everyone they serve.

Christina Yeah.

Adam That’s uh disturbingly efficient from the attacker’s view.

Christina It is. And the sources also mention the growing sophistication. Attacks are becoming more automated, sneakier, more scalable. They link this partly to AI helping develop malware. Oh, great. And things like deep fakes making phishing emails or impersonations for credential theft incredibly convincing now.

Adam AI making the attacks better. Just what we needed.

Christina Yeah. And there’s a line in one of the sources that really sticks. It says, your clients are only as secure as their most vulnerable supplier.

Adam Oof. That cuts right to the heart of it, doesn’t it? Yeah. It’s not just about your own four walls anymore. So digging into that danger aspect, why are these attacks seen as so dangerous compared to, say, a direct brute force attack? Yeah. The sources seem to list a few key reasons.

Christina They do. And number one, as we’ve sort of touched on, is exploiting that trust. Businesses have to trust their vendors, their tools, their providers to function.

Adam Right. It’s foundational.

Christina So when an attacker compromises that trusted relationship, they often just waltz past security measures that are designed to stop outsiders, the untrusted.

Adam The defenses are basically waving them through because they recognize the uniform, so to speak.

Christina Pretty much, yeah. Another big danger the sources point out is just how hard they are to detect. Attackers can apparently sit dormant inside a network for well, weeks or even months sometimes.

Adam Doing what? Just watching.

Christina Mapping the network, maybe quietly stealing data, figuring out the best way to cause maximum damage before they trigger the main event, like ransomware. The sources say many breaches aren’t found until long after the initial infiltration.

Adam So it’s a slow burn before the explosion.

Christina Exactly. And then of course there’s the sheer scale of the potential impact. A single compromise supplier, particularly if it’s a widely used software or a major service provider, it can cause this massive domino effect. Hit one, and you affect hundreds or thousands of their customers downstream. The sources mentioned some past big incidents involving MSPs as clear examples of this kind of cascading failure.

Adam One crack spreads through the whole supply chain network.

Christina Which brings up the last danger point the sources highlight. It muddies the waters on who’s actually to blame.

Adam How so?

Christina Well, if a company gets breached because their software vendor was compromised, who’s ultimately responsible? The company. The vendor. Maybe the vendor’s cloud provider if their security was weak. Yeah.

Adam Tricky.

Christina This confusion, this ambiguity can wreck reputations, destroy business relationships, and lead to some serious legal and financial mess. Especially the sources note for providers who maybe didn’t have robust layered security in place themselves.

Adam Okay, so turning to those providers then, the MSPs and MSSPs, this sounds like it’s more than just another threat for them. The sources seem to suggest it actually changes their fundamental role.

Christina Yeah, the position right in the middle of this. The sources call them the connective tissue between all the tech vendors and the end clients.

Adam Connective tissue.

Christina Which basically puts a dual responsibility on them.

Adam Dual responsibility. Okay, first part must be protecting themselves, protecting their own shop.

Christina Absolutely critical. The sources are very clear. MSPs have to lock down their own infrastructure because attackers love using the provider’s own tools and access to launch attacks downwards onto their clients. If the MSP is vulnerable, their clients are too.

Adam Makes sense. And the second part of that responsibility.

Christina It’s about helping their clients secure their entire digital ecosystem. That means looking beyond just the client’s immediate network. It’s about helping them manage the risks coming from their vendors, their SaaS apps, their whole complex web of third-party relationships.

Adam Wow. So for providers, cybersecurity is shifting from just being a technical service offering to more of a like a strategic business partnership focused on the resilience of the client’s entire operational environment, including all those trust connections.

Christina That’s definitely the shift the sources describe. It elevates the whole game. And interestingly, they also point out there’s a real opportunity here for providers who step up.

Adam Not opportunity amidst all this risk.

Christina Yeah. The thinking in the sources seems to be that by proactively offering these uh supply chain aware security services, providers can actually deepen their client relationships, become indispensable partners. It creates chances for higher value services, recurring revenue, a way to stand out from competitors just offering basic stuff, and you know, opportunities to upsell things like advanced monitoring, specifically looking for these kinds of threats.

Adam Okay. So what does that kind of advanced supply chain savvy defense actually look like in practice? The sources are pretty clear that you know basic antivirus just doesn’t cut it anymore in 2025.

Christina No, definitely not. The material really pushes for a comprehensive, proactive approach, one that looks across all the layers of that digital supply chain, not just the client’s own network.

Adam So what are the key pieces? What strategies do the sources recommend?

Christina Okay, they list several core things. First, really strong vulnerability management. And critically, this needs to cover not just internal systems, but third-party assets too.

Adam Meaning you need to know about weaknesses, not just in your own stuff, but in the software and services you rely on from others.

Christina Exactly. Know your entire attack surface. Second, they stress having threat detection and response capabilities that are specifically tuned to spot the uh the subtle signs of a supply chain compromise in real time.

Adam So looking for those attacks coming through trusted channels, not just the obvious frontal assaults. Right.

Christina Third, zero trust architecture comes up a lot. The whole idea of never trust, always verify. Right. Assume no user or device is safe just because it’s inside the network, enforce strict checks and limit access. That makes it much harder for an attacker to move around if they do get in via one compromise point.

Adam Verify everything, trust nothing automatically. Makes sense. What else?

Christina Fourth, the sources really emphasize doing proper vendor risk assessments and getting visibility into software dependencies, like really understanding what’s inside the software you and your clients are using, including all the open source bits.

Adam So don’t just take a vendor’s word for it. Actually assess their security and know the ingredients in their products.

Christina Yeah, know your supply chain. And finally, they mention automation, automated alerting, reporting, compliance support, because trying to manage all this complexity manually is just well, it’s not really feasible.

Adam And the sources do seem to acknowledge that building all this capability in-house is tough, maybe too costly for many. They suggest partnering, particularly for MSPs, might be the way to go to bring in specialized tools and expertise.

Christina That’s definitely a path highlighted in the material, yeah. Partnering to make the delivering these advanced necessary defenses actually achievable and scalable for providers.

Adam Okay. Wow. We’ve definitely covered a lot unpacking these sources. If you had to boil it down, what’s the single biggest takeaway message from this deep dive?

Christina I think the core message, loud and clear from these sources, is that supply chain attacks aren’t just a trend. They are, as the sources put it, the new front line of cyber conflict in 2025.

Adam Yeah, the stakes feel incredibly high, affecting everyone because we’re all so interconnected.

Christina Yeah.

Adam But like the material also hinted, for those who really tackle this proactively, there’s maybe an opportunity there too to build more resilient systems.

Christina Absolutely. And for you listening, whether you’re deep in IT management or you run a business relying on vendors, or honestly, even just living your life online, understanding the specific way attacks happen now is just crucial for managing your own risk.

Adam Definitely. So maybe a final thought to leave everyone with, building on all this. Given how much we have to rely on these external, supposedly trusted parties and knowing the risks we’ve just discussed, what’s the most practical, effective way for you or for your organization to actually verify that trust continuously, not just assume it’s okay?

Christina That’s the million dollar question, isn’t it?

Adam Right. How do we balance needing to be connected with managing the danger that connection inevitably brings? Something definitely worth thinking about as you look at your own digital world.