Episode 38: The 5 attack surfaces your MSP misses

Adam

So, uh, you know that very universal feeling of comfort when you lock your front door at night? Like you hear the deadbolt click and your brain just sort of it just relaxes.

Christina

Oh, absolutely. You've basically outsourced your anxiety to the locking system.

Adam

Exactly. But I mean, today we are asking what happens when that system is uh only locking half the doors in your house, but it's telling you it locked them all.

Christina

Yeah. And we're doing that by looking at some rather um uncompromising public evidence today.

Adam

We really are. We're diving into the MSP Security Coverage Report 2026. This was published by enhanced.io, and it includes some incredibly candid commentary from their CEO, Christian Wright.

Christina

It's a fascinating document. Really pulls the curtain back.

Adam

Right. So if you're listening to this deep dive right now, like whether you're prepping for a vendor meeting or maybe you're trying to understand your own company's risk profile, or you just want to know how digital defense actually works, you are in the right place.

Christina

Definitely. There's a lot to learn here.

Adam

Okay, let's unpack this. So most small and mid-sized businesses, they hire a managed service provider, right? Yeah. An MSP. They pay their monthly fee, they look at a dashboard full of green check marks, and they sleep soundly.

Christina

Right, because they assume their digital perimeter is locked tight.

Adam

Exactly. But this report it looks past the dashboard to measure actual coverage. And it well, it breaks business security down into a landscape of five distinct attack surfaces.

Christina

Yeah. Five surfaces. First you have the endpoint, so that's your laptops, your standard servers, things like that. Then there's a network, the actual traffic flowing through the office.

Adam

Okay. It's two.

Christina

Then you have the cloud, which is Microsoft 365 or Google workspace. Fourth is identity. This covers passwords, access tokens, uh user permissions, and finally you've got IoT and OT.

Adam

The Internet of Things and operational technology.

Christina

Exactly. So think like smart devices, building controls, factory equipment, that sort of stuff.

Adam

I'm five surfaces. That sounds really comprehensive on paper.

Christina

It does. But um the core finding from the report presents this significant disconnect. The monitoring from MSPs has largely stayed right where the mature traditional tools already sit.

Adam

Well, the attackers.

Christina

Right. The attackers went exactly where the watching stopped.

Adam

Man, that is a revealing way to frame the problem. Attackers going where the watching stops. Let's start with the one surface where everyone feels like the most confident.

Christina

The endpoint.

Adam

Yeah, the endpoint. The surface that arguably gives businesses that initial false sense of security.

Christina

Well, endpoints are the laptops, the desktops, the traditional servers. And you know, to be fair, this is the part of the security stack that MSPs actually manage quite well.

Adam

They really do. The data backs that up, right?

Christina

It does. According to Sophos's 2024 MSP Perspectives report, 81% of MSPs offer some level of managed detection and response.

Adam

Wow. I mean 81%, that's a huge majority.

Christina

Oh, absolutely. And Caseya's 2025 benchmark report also showed that security is among the top five fastest growing revenue lines for uh 67% of MSPs. So the endpoint tools are mature, they're well documented, and they are widely deployed.

Adam

But, and this is a big but, the report highlights a massive gap here. Like the Verizon 2025 data breach investigations report, the DBIR, they found that 46% of compromised systems that carried corporate logins were either completely unmanaged devices or BYOD. Bring your own device, yeah. Right. Almost half. So if an MSP is managing the network, how on earth can almost half the compromised machines be totally unmanaged?

Christina

This is a point Christian Wright emphasizes from enhanced.io's own field observations. There is just this sheer disparity between the onboarding reality and the MSP's dashboard.

Adam

What do you mean by onboarding reality?

Christina

Well, when they onboard a new partner and evaluate a client base, the device count on the dashboard rarely matches the actual number of devices touching the network.

Adam

, why is that? I mean, if the MSP installs their software, shouldn't it map everything?

Christina

You'd think so, but we have to look at how these tools actually function. Most MSP endpoint tools are built specifically for Windows environments. They rely on software agents installed directly on the operating system.

Adam

Okay, so if it's not Windows.

Christina

Exactly. Say an engineering team drops a Linux server in the IT closet for a specific project. The standard MSP tool doesn't just casually ignore it, it literally lacks the software language compatibility to monitor it. Oh wow. Or consider a handful of MacBooks that the standard Windows-centric agents handle really poorly, or you know, a director's personal iPad that was connected to the network one afternoon to review a document and just never secured.

Adam

So a clean green dashboard just means the devices the tool successfully installed itself on are quiet.

Christina

Basically, yes.

Adam

It is exactly like spending thousands of dollars on a state-of-the-art home alarm system, but you only put sensors on the front windows. Like you leave the back door wide open, you leave the basement unlocked, but your keypad by the front door glows green, so you just assume the whole house is secure.

Christina

That's a great way to put it. Conflating what we manage with what actually exists is a widespread philosophical problem in IT right now. The tool is doing exactly what it was programmed to do, which is report on its own installed agents.

Adam

But it's blind to everything else.

Christina

Right. And as the Verizon data shows, attackers aren't wasting time trying to break into the heavily fortified managed Windows laptop. They scan the environment, they find that forgotten Linux box or the unmanaged iPad that still has access to the corporate server, and they use that as their entry point.

Adam

Because they take the path of least resistance. Since attackers know the endpoints, like the front windows are mostly watched, they pivot to the unmonitored back doors. And according to this report, those back doors are the network edge and the cloud.

Christina

Yeah. And if we connect this to the bigger picture, you can really see how rapidly the threat has moved. Going back to the Verizon data, edge devices and VPNs jumped from being involved in 3% of exploitation-based initial access to 22% in just a single year.

Adam

Wait, from 3% to 22% in one year? That is a staggering leap.

Christina

It really is. It indicates a massive shift in tactics. And once they breach that edge, they don't just sit there. Cover's Q4 2025 report noted that lateral movement appeared in 65% of ransomware cases.

Adam

Okay, wait, let's pause and define lateral movement for a second for the listener. How exactly are they hopping from one machine to another once they get inside? Like they aren't just guessing passwords over and over, right?

Christina

No, no. It's much more systemic than that. Once an attacker is past the firewall, they exploit internal trust. They might compromise, say, a low-level workstation and then scan that machine's memory to harvest administrator credentials.

Adam

Like credentials that were just left behind.

Christina

Yeah, exactly. Like if an admin temporarily logged in during a routine IT fix. This is known as pass the hash or credential dumping. So once they have that administrative token, they can simply walk through the network accessing servers and sensitive databases.

Adam

Just walking right in.

Christina

Right, because the interior machines are programmed to implicitly trust that administrator account.

Adam

And the MSP doesn't see this happening at all.

Christina

Usually, no. The core issue is that MSP network coverage often stops right at the perimeter. They install a highly capable managed firewall at the edge of your network. But I mean, a firewall is essentially a bouncer at the front door of a nightclub.

Adam

It checks IDs at the entrance.

Christina

Exactly. It does not monitor what the patrons are doing once they're inside the club. Literally no one is watching the east-west traffic. The internal data moving sideways between machines that have absolutely no logical business reason to be talking to each other.

Adam

Man. And that brings us to the cloud. I think there's this assumption out there that moving infrastructure to the cloud automatically offloads the security burden to companies like Microsoft or Google.

Christina

Oh, that's a very common misconception.

Adam

But the report notes only about one-third of MSPs consistently secure their clients Microsoft 365 environments. That's according to ConnectWise data. Meanwhile, Microsoft's own 2025 digital defense report tracked an 87% rise in destructive cloud campaigns.

Christina

Yeah, the disconnect stems from how MSPs often conceptualize cloud services. When asked about cloud security, many MSPs will just point to cloud backup.

Adam

Backups.

Christina

Yeah. They faithfully back up the Sauce data, which is fantastic for disaster recovery if a file gets deleted. But I mean, a restore point from yesterday does absolutely nothing to stop an active account takeover happening right now.

Adam

Right. It is treating Microsoft 365 like a static storage locker. You throw a padlock on it, you make a copy of the key for backup, and you walk away.

Christina

Which is not what it is.

Adam

No. An enterprise cloud environment isn't a storage locker. It is a bustling corporate headquarters with hundreds of people constantly walking in and out, sharing files, changing folder permissions, and setting up workflows.

Christina

That analogy perfectly captures the dynamic nature of the cloud. Because no one is actively watching the floor of that bustling headquarters. Attackers just blend into the daily operations.

Adam

So what happens when someone actually looks?

Christina

Well, when enhanced.io turns on audit logging or internal traffic visibility for a new client, they rarely find a loud, crashing hack. What they find is quiet, persistent access, they instantly uncover large, unscheduled data transfers, or they find an Ooth consent grant that nobody remembers approving.

Adam

Okay, let's bust some jargon here. Explain what an Oath Consent grant is for the listener.

Christina

Sure. So think about when you download a new app or use a new web service, and instead of creating a brand new account, you click a button that says login with Microsoft or log in with Google.

Adam

Oh yeah, I do that all the time.

Christina

Right, everyone does. A window pops up asking if you grant this application permission to read your profile or access your email. That is an OAuth consent grant.

Adam

Okay. So how is that used in an attack?

Christina

Attackers routinely send highly convincing phishing emails with links to malicious apps. An employee clicks the link, clicks accept on the Microsoft pop-up, thinking they are just logging into, say, a secure document viewer, and boom. They have just legally handed an attacker persistent, programmatic, read and write access to their inbox.

Adam

Wow. Without ever technically giving away their password.

Christina

Exactly. Or, you know, enhance.io will find rogue mailbox forwarding rules that have been quietly sending sensitive company emails like financial invoices to an external server for weeks.

Adam

Okay, wait, I have to push back on this. Because the report explicitly notes that third-party involvement in breaches doubled from 15% to 30% in a year. And much of that is through SOS platforms and vendor connections.

Christina

Right.

Adam

If businesses are trusting these third-party vendors and MSPs to secure their cloud and they're essentially just getting a backup drive instead of active monitoring, aren't they paying for a false sense of security?

Christina

Well, they are paying for data retention under the mistaken belief that data retention equals active threat monitoring. If an attacker logs in with a valid password or uses a valid OAuth token, the cloud provider's automated systems do not see a hack.

Adam

Because it just looks normal.

Christina

Exactly. They see an authorized user performing an authorized action. Without a human analyst or a specialized system actively reading those audit logs to ask, hey, why is our CFO logging in from a country we don't operate in at 3 a.m. and immediately setting up an inbox forwarding rule? Again, the platform assumes everything is perfectly fine.

Adam

Which naturally leads us right to the fourth surface. Because how are these attackers bypassing the perimeter and logging into the cloud so easily? I mean, they aren't writing complex code to break firewalls. They are literally just logging in because they are sealing identities.

Christina

Identity is arguably the highest risk attack surface today. The Verizon DBIR states that credential abuse is present in 22% of all breaches. The financial impact is just immense. Business email compromise losses hit $6.3 billion in 2024.

Adam

6.3 billion?

Christina

Yes. And Microsoft notes that 97% of identity attacks are fundamentally password attacks.

Adam

So the threat to identity is massive.

Christina

Yeah.

Adam

But how well are MSPs actually watching the surface?

Christina

Well, the finding in the document regarding identity is quite stark. There is absolutely no neutral public data on multi-factor authentication or MFA monitoring rates for MSP managed clients.

Adam

Right. Zero public data.

Christina

Zero. And we see a similar absence when we look at the fifth surface, IoT and OT.

Adam

The Internet of Things and operational technology. So we are talking about devices that barely even have interfaces, right? Like building management systems, security cameras, smart thermostats.

Christina

Yes. Clarity actually released a report in 2025 finding that 75% of organizations with building management systems had known exploits. And more concerning, 51% of them had ransomware-linked vulnerabilities directly exposed to the internet. Yikes. Right. Yet when enhanced.io looked for independent figures on how many MSPs actively monitor IoT or OT devices for their clients, the number was zero. The public record just goes completely quiet.

Adam

See, okay, here's where it gets really interesting. Because I want to push back on that logic fairly hard. Just because survey companies haven't published a neat little chart on IoT monitoring or MFA monitoring, it doesn't mean MSPs are completely ignoring the problem.

Christina

Okay, I hear you.

Adam

Like couldn't they just be handling this internally? Maybe it is just baked into their standard daily operations and they don't see a need to report it to a third-party research firm. Assuming a lack of data means a lack of action, that kind of feels like a leap.

Christina

It is a reasonable skepticism, sure, but in the cybersecurity vendor space, silence is a glaring indicator of behavior. The report makes a really core point here. We measure what we monetize and what we manage.

Adam

Okay, that makes sense.

Christina

If MSPs were widely deploying active IoT monitoring, software vendors would be loudly marketing tools for it. They'd be boasting about their market share and surveying their success. Historically, when the security industry stops counting a surface or never starts counting it, it means that Surface has not entered normal scalable practice.

Adam

Okay, but surely an MSP sees these devices on the network. They know the thermostat is there, right?

Christina

Seeing a device's MAC address on a network scan is fundamentally different from actively monitoring its behavior for security threats. And you know, going back to identity, the identity gap isn't about MSTs failing to turn on MFA.

Adam

They do turn it on.

Christina

Most of them do turn it on. The gap is the lack of monitoring after the MFA prompt is passed. Who is watching for session hijacking, who is looking for an administrator account being misused to create new hidden accounts.

Adam

Go, buddy. And for IoT.

Christina

For IoT, it's a structural blindness. Devices like smart door controllers or warehouse floor sensors do not run standard operating systems like Windows or Mac OS. You cannot install a traditional security agent on a smart thermostat.

Adam

Oh, because it doesn't speak the same language.

Christina

Exactly. Therefore, they are entirely invisible to the standard endpoint console that the MSP analyst relies on every single day. If you can't put an agent on them and your primary tool requires agents, you aren't monitoring them.

Adam

So let's review these five surfaces. Endpoints are mostly watched, but only the known compatible ones. The network interior is blind because we only watch the front door. The cloud is treated like a backup drive instead of a bustling active environment. Identity monitoring after login is an unmeasured black hole. And IoT devices are completely invisible because they can't run the software. We've uncovered massive blind spots across four out of the five surfaces. The obvious question is: why haven't MSPs fixed this?

Christina

It ultimately comes down to a really harsh operational reality. There is a massive lack of human resources combined with a flawed, siloed approach to using security tools. The ISC2 2025 Cybersecurity Workforce Study found that 59% of security teams report critical or significant skills gaps.

Adam

Wow.

Christina

And that is up from 44% just the year prior.

Adam

59%. So more than half of all security teams are critically short-staffed.

Christina

Yeah. You have a threat landscape that is expanding exponentially across five complex surfaces, and a workforce that is shrinking relative to the demand. No single MSP can simply hire its way out of this problem.

Adam

There just aren't enough people.

Christina

Right. You cannot throw enough human analysts at five different disconnected security consoles. Because of this, the structural fix actively happening in the market right now is consolidation.

Adam

Consolidation, meaning what exactly?

Christina

Meaning fewer tools watched together, usually by leveraging shared third-party security operations centers. So instead of an MSP buying a separate tool for the endpoint, a separate tool for the cloud, and a separate tool for the network, they integrate them into a single pane of glass.

Adam

Okay, let me challenge that solution for a second. If these security teams are already critically short-staffed and they are already overwhelmed by the alerts just coming from the endpoint surface, won't trying to actively watch five services at once just create five times the noise?

Christina

That's a great question.

Adam

Like, aren't you just going to burn out the few analysts you do have by giving them more things to monitor?

Christina

That is the exact trap most teams fall into. And it is why they historically avoided turning on those other surfaces. But what's fascinating here is Christian Wright's argument on the power of correlation. Watching five surfaces separately is what produces the overwhelming noise and the blind spots.

Adam

Wait, how does correlation reduce the noise?

Christina

Because attacks do not happen in silos. An attack is a sequential chain of events. Let's trace one. Okay. A stolen credential, which is an identity event, turns up in a breech dump. A few days later, that credential works on a Microsoft 365 account because the employee reused their password. Yeah. That becomes a cloud event. Right, right. From there, the attacker establishes the session, accesses the VPN, and moves to an internal server. That is a network event, lateral movement. Finally, they try to deploy ransomware on that server. That is an endpoint event.

Adam

Ah, lazy.

Christina

If you do not correlate the data across all five surfaces simultaneously, you only see disjointed, confusing alerts, a weird login here, a blip of internal network traffic there. It looks like random noise, and an overwhelmed analyst will likely just dismiss it.

Adam

But if you can make the docs.

Christina

Yes. If you watch all five together and correlate the data, you don't get five times the alerts. You get one clear chronological story of an attack in progress. Correlation is the only way to filter the noise down to the few alerts that truly matter, giving the analyst time to stop the attack before the final encryption stage.

Adam

It is the difference between hearing five different instruments playing random notes in separate soundproof rooms versus hearing them play together in the same room as a symphony. One is just chaotic noise, the other is a clear intentional signal.

Christina

Exactly. A stretched, short-staffed MSP team trying to jump between five different dashboards simply has no hours left in the day to find that signal. They need the symphony.

Adam

This has been an incredibly eye-opening dive into how digital defense actually operates in the real world. If you are listening, the takeaway here is a fundamental strategic shift in how you evaluate risk. Like whether you are reviewing your own tech stack or evaluating a vendor, the core question fundamentally shifts from what security tools do we have to where does our visibility actually end.

Christina

Absolutely. Because a clean dashboard with green check marks does not mean you are secure. It just means the specific things your software can talk to happen to be quiet.

Adam

Yeah. Discovery truly is the entirety of the first step. You cannot secure what you cannot see, and you cannot see what your tools are fundamentally incapable of measuring. So true. You have to look past the endpoint illusion and demand correlation across the network interior, the cloud, identity access, and unmanaged devices. But before we wrap up, I want to leave you with a final lingering question to mull over on your own. Like a thought that builds strictly on the facts we have laid out from this report.

Christina

Oh. Where are we going with this?

Adam

Well, the report explicitly notes that third-party involvement in breaches doubled from 15% to 30%. At the same time, it points out that the structural fix for the massive 59% skill shortage is consolidation. The industry is moving toward shared third-party security operations to watch all these services together because individual teams just can't keep up. So consider this. As the entire industry's solution to these blind spots is to consolidate their defense into a few centralized shared security operations centers, do those third party watchers themselves become the ultimate high value single point of failure for attackers?

Christina

Wow.

Adam

Yeah. As we all rely on these consolidated providers to watch all five services for thousands of businesses at once, who is watching the watchers?