Episode 13: What full-spectrum security looks like for MSPs

Adam Welcome to the deep dive. For uh managed service providers and managed security service providers, there’s a tough reality check happening in cybersecurity right now. It seems the old way, just relying on endpoint protection. Well, it’s just not cutting it anymore. Not at all. We keep seeing this number uh that up to 70% of the attack surface. It’s just dark, unmonitored by those tools.

Christina Yeah, the data is pretty stark on this. It really highlights that endpoint-only strategies leave this massive, I mean 70% gap. Wow. And it’s unsettling because we’re not talking about super sophisticated, you know, zero-day stuff here. Right. These are the everyday threats we face. Things like compromised identities, uh cloud misconfigurations, attackers moving sideways, stuff that endpoint tools just aren’t designed to see.

Adam So it’s like trying to guard a whole city with CCTV, but only on like a few buildings.

Christina That’s a great analogy, actually. You see what’s happening in those buildings, but you miss the bigger picture, the movement between them, the coordinated stuff.

Adam Okay, so that’s the harsh truth. Given this huge blind spot, how do we really uh get our heads around the risk, the impact of that 70%?

Christina Right.

Adam And maybe more importantly, what are the sort of forward-thinking ways people are tackling this? That’s what we want to dive into today, right? Get the full picture.

Christina Exactly. And let’s be clear up front. EDR, endpoint detection and response, it’s still incredibly important. Sure. These tools are fantastic at what they do, spotting malware, ransomware, file-based nasties right there on the device. They’re absolutely a critical layer, no question.

Adam Okay, good point. It’s not about throwing EDR out. But if it wasn’t designed for that whole ecosystem, what are the specific areas it’s missing? Where are these modern attacks really living?

Christina Well, the attack surface has just uh exploded. It’s way beyond the endpoint now.

Adam How so?

Christina Think about cloud apps and platforms, right? Everyone’s using them. Then there’s user identities, authentication systems, huge targets, email gateways, network infrastructure itself, and you know, all those remote users, maybe using unmanaged devices. Exactly. EDR is great for watching the device, but it just doesn’t have visibility into that whole digital sprawl. It wasn’t built for that.

Adam And this isn’t just theory, is it? I mean, we’ve all heard stories, seen cases where companies had, you know, solid endpoint protection.

Christina Absolutely.

Adam But they still got preached because the attacks started somewhere else or moved in ways the endpoint couldn’t track.

Christina Precisely. And that leads to the obvious question. What kind of attacks are actually slipping through? What are we seeing in the wild?

Adam Yeah. Like what specifically?

Christina Well, uh think about credential-based attacks. MFA fatigue is a big one now, just hammering users with prompts until they give in.

Adam Ugh, yeah. Annoying and dangerous.

Christina Right. Or classic phishing, stolen passwords. These often go straight after cloud services, you know, Microsoft 365, Google Workspace.

Adam And no malware lands on the endpoint initially.

Christina Often not, not until maybe it’s way too late. Sometimes not at all, if the goal is just data exfiltration from the cloud service itself.

Adam Okay, that makes sense. What else? You mentioned lateral movement earlier.

Christina Yes, that’s a huge one. An attacker gets one foothold, maybe compromises one machine. But they don’t just sit there, they start moving sideways, exploring the network, maybe using Active Directory vulnerabilities, open network ports.

Adam And the EDR on other machines might not see anything suspicious.

Christina Exactly. Yeah. Because the activity isn’t necessarily, you know, running a malicious file on those machines. It’s network traffic, it’s credential abuse. It’s like a ghost in the machine moving silently. Wow.

Adam I remember a case just like that. EDR was all green lights, but the attacker had been mapping their network for weeks. Scary stuff.

Christina It really is. And then there’s email compromise. A user clicks a bad link in their, say, cloud email inbox, leads to account takeover. Again, no malware might hit the endpoint itself. EDR is blind to that initial compromise vector.

Adam And the unmanaged devices you mentioned, BYOD.

Christina Yeah, those are tricky. They might bypass your monitored corporate network entirely, but still access sensitive cloud data or an insider threat can use them. Without visibility across identity, network, email, and cloud, you’re often finding out about threats way too late.

Adam Or not at all.

Christina Or not at all. Exactly.

Adam So that 70% number. Yeah. It starts to feel very real. How does the math actually break down? Where do the sources say these non-endpoint threats are coming from?

Christina So the data we’ve looked at suggests roughly only about 30% of threat activity really starts and finishes purely on the endpoint.

Adam Just 30%.

Christina Just 30 percent. The other 70 percent is happening elsewhere. For instance, uh around 22 percent seems linked to identity and access misuse, think stolen credentials, privilege escalation.

Adam 22 percent.

Christina Another 20 percent is tied to abusing cloud services, misconfigurations, insecure APIs, that sort of thing. Makes sense. Then you’ve got about 18 percent coming via email phishing, business email compromise.

Adam Still a huge vector.

Christina Always. And around 10 percent from network-level exploits, targeting routers, firewalls, open ports.

Adam So add that up. Yeah. That’s the 70 percent. Right. It really puts it in perspective. The vast majority of where a threat could come from is just outside that endpoint view.

Christina Precisely. It underscores the limitations. Okay.

Adam That paints a pretty stark picture. If endpoint only isn’t the answer anymore, what is? What’s the solution people are moving towards?

Christina Well, the big shift, the really transformative thing, is moving away from these siloed reactive security tools. Right.

Adam Bolting on-point solutions.

Christina Exactly. And moving towards a proactive, network-wide threat correlation. It’s about bringing all the signals together.

Adam What signals are we talking about?

Christina , Signals from your endpoints, yes. But also from email security, cloud platforms, identity systems, network sensors, pulling all that data into one place. Okay. And then crucially stitching it together, correlating it into a single kind of unified detection and response framework.

Adam Stitching signals together. Is that where this term open XDR comes in? Extended detection and response.

Christina That’s exactly it. OpenXDR is the approach.

Adam And what are the like immediate wins for organizations that adopt this? What benefits are they actually seeing on the ground?

Christina Oh, the benefits are pretty significant. First off, you catch threats much earlier, often before they can do real damage or spread widely.

Adam Because you see the initial stages, not just the endpoint impact.

Christina Precisely. You also see a big reduction in false positives. Alert fatigue is a killer for security teams.

Adam Tell me about it.

Christina By correlating events across different domains, network, cloud, identity, endpoint XDR, can figure out what’s really a threat versus just, you know, noise. It understands the context.

Adam That makes sense. Less noise, more signal.

Christina Exactly. And for service providers, MSPs, MSSPs, this also unlocks the ability to offer more valuable, higher margin services. Like what? Things like comprehensive compliance reporting, because you have that wider visibility, or co-managed security offerings where you provide that correlated view. It lets you see the whole picture of the environment.

Adam Instead of just that, as you called it, noisy corner that EDR shows you.

Christina Right. EDR is vital for that corner. But XDR aims to show you the whole room, the whole building, the whole city, going back to your analogy.

Adam Got it. That paints a much clearer picture, yeah. Yeah. So why now? What’s pushing organizations to make this upgrade, to move towards unified security right now?

Christina There are a few key drivers, I think. One is definitely the market itself. And clients are getting smarter. They’re asking tougher questions about security posture.

Adam They’re demanding more than just endpoint checks.

Christina Absolutely. And regulators are stepping up expectations too. Compliance isn’t just a checkbox anymore. It requires demonstrable, robust security across the board.

Adam And the cost of getting it wrong.

Christina Exactly. The cost of breaches, both financial and reputational, just keeps climbing. It makes investing in comprehensive security less of a cost center and more of a well essential risk management strategy. It’s becoming non-negotiable.

Adam Right. So for providers, it sounds like sticking with just endpoint tools is becoming well risky. It puts them and their clients at a disadvantage.

Christina It really does.

Adam The path forward seems to be embracing this unified correlated detection approach. That’s how you lead in the next phase of cybersecurity services, right?

Christina , I believe so. It’s a strategic shift. It acknowledges that threats are complex, they’re multi-layered, and you need a defense that reflects that reality. It’s about providing a much more complete, resilient defense for everyone.

Adam Okay, so let’s recap the core idea here. Endpoint protection. Absolutely essential. Still a critical piece. Foundational. But it’s only one piece of a much bigger, much more complex puzzle these days. The clear direction, the way forward is this unified, correlated visibility across the entire digital environment.

Christina Yeah, when you really think about the implications about what might be lurking in those blind spots, it’s quite eye-opening.

Adam It definitely is. So we’ll leave you, the listener, with maybe a provocative thought to chew on. Given how connected everything is, how multi-layered threats are now, what unexpected blind spots might be hiding in your own digital world? And how could you start looking beyond the obvious, beyond just the endpoint, to get that truly full picture of your security?