Episode 34: Whole-of-Network Coverage for MSPs

Christina

Okay, let's unpack this. For the longest time, the security playbook was, well, pretty simple, right? It was all about protecting the device.

Adam

Right. You threw AV on it.

Christina

Then you upgraded to EDR, and that was kind of it. A lot of organizations felt they'd achieved a decent security posture.

Adam

But the reality is that hyper focus on the endpoint has become well, it's essentially obsolete.

Christina

The attackers just adapted faster than our defenses.

Adam

That is the crux of the issue. And our mission for you today is to really move past that endpoint-only mindset and fully understand whole of network coverage.

Christina

So what it is exactly.

Adam

What it is, why it's so rapidly becoming the non-negotiable baseline for managed service providers, and crucially, how it detects those quiet, multi-stage attacks that your device-centric tools miss completely.

Christina

And that's the paradox we all have to wrestle with, isn't it? Most modern breaches, I mean, statistically, they never involve a single piece of malware or some suspicious process that an EDR can flag.

Adam

Not at all. They start somewhere else.

Christina

They originate in cloud accounts, identity systems, maybe a firewall, SaaS apps, even a rogue IoT device somebody plugged into the wall. But when that breach happens, who gets held responsible?

Adam

It's always you, the service provider.

Christina

Exactly.

Adam

And if you look at the data, it's staggering. Nearly 80% of breaches involve some form of identity compromise. And here's the really terrifying part. Once an attacker gets that initial access, the lateral movement, them spreading across the internal network, that begins within minutes, sometimes seconds.

Christina

So if the front door is Microsoft 365 and the way they're moving around is with legitimate Windows tools, where should our security monitoring actually be focused?

Adam

It has to be everywhere. It can't just be that single device anymore.

Christina

Let's start with that fundamental shift then. Historically, that good enough stack, you know, AV, EDR, a bit of email filtering.

Adam

Okay.

Christina

It was built for a world where malware was the main enemy.

Adam

It was the file-based era. The attack lived locally, you scanned for it, you blocked it. Simple. Now we're firmly in the identity and tool-based era. The threat landscape didn't just move it, it strategically sidestepped the endpoint completely. Attackers know you have EDR. They expect it. They know it looks for files and suspicious processes. So they just change their entire strategy.

Christina

And what does that look like on the ground for an MSP?

Adam

It looks like using the organization's own tools against them. Attackers love using legitimate admin protocols, WMI, SMB, PowerShell remoting. They steal credentials, they log in, and they just use these native tools to look around the network.

Christina

And because those are approved, signed operating system processes.

Adam

They're designed not to trigger alerts. They never have to drop a single malicious file onto the disk.

Christina

So an attacker is basically walking into the building with a key, dressed in the company uniform, using the employee elevator, and the EDR tool is just standing there saying, everything looks fine here.

Adam

Precisely. And we can't forget about the perimeter exploits. We constantly see vulnerabilities in VPNs, firewalls, you know, edge appliances like 40 OS or Citrix.

Christina

Oh, all the time.

Adam

When an attacker exploits one of those, they bypass the perimeter entirely and jump straight into the internal network. No malware has to touch an endpoint for them to get that initial access.

Christina

Which brings us right back to that accountability gap. If your tooling only sees the world through the lens of a single operating system, you are blind to everything happening in the account systems across the network wire and inside the cloud.

Adam

And when that tooling is bypassed, the client doesn't blame the tool.

Christina

No, they blame the MSP they trusted.

Adam

That's why the very definition of being protected has had to change.

Christina

Now, when we talk to MSPs about moving to whole of network, I think the first reaction is often fear. They think, great, now I have to collect a million more logs and I'm just gonna drown in data.

Adam

And that's where the industry has often failed to explain the concept. It is not about collecting more logs.

Christina

It's about correlation.

Adam

It's about correlation. It's so much more than just aggregation. Whole of network coverage is really a system, and it's built on four critical pillars that turn all that chaos into clarity.

Christina

Okay, what's pillar number one?

Adam

The first is telemetry capture. And yes, you have to pull data from endpoints, but also from identity systems like Active Directory, cloud platforms like N365 and Azure, perimeter devices like firewalls and VPNs.

Christina

All the sources we just mentioned.

Adam

All of them. SaaS apps, internal network flow data. You have to open up the view. Which brings us directly to pillar number two automatic correlation. This is the revolutionary part. Traditional SIMs often need human analysts or really complex manual rules to connect separate logs.

Christina

Right.

Adam

True whole of network security automatically unifies and stitches that massive data set together for you.

Christina

So it's not just dumping all the files into a filing cabinet, it's having a librarian who's already organized them and is highlighting the suspicious connections between them.

Adam

That's a great analogy. Imagine you have four notes written by four different people in four different languages. They seem unrelated, correlation translates them, puts them in order, and reveals they're all chapters in the same crime story.

Christina

And without automating that, you just can't scale.

Adam

You can't. So pillar three is detection. The system has to be able to identify attack chains that span multiple disparate systems. A single event might look fine. A user logging into the cloud is normal.

Christina

Perfectly normal.

Adam

But that login, followed seconds later by a change in mailbox rules, followed minutes later by an unusual internal server access, that tells a malicious story.

Christina

And the final pillar, number four, must be alerting.

Adam

Exactly. And it ties directly into efficiency.

Christina

Yeah.

Adam

The goal isn't just to see everything, it's to get high fidelity, context-rich alerts that your team can actually action.

Christina

Not a thousand separate log dumps.

Adam

No. One alert that says, user acts as compromise. Here's the full narrative of the attack from initial access to data staging.

Christina

That's the mental shift then. Endpoint-only security treats every device as an isolated island.

Adam

Whereas whole network coverage recognizes that the modern attack is a flowing narrative that crosses borders constantly.

Christina

Okay, let's look at the real-world consequences of this. We're going to walk through five specific blind spots. These are the insidious attacks that prove why EDR alone just cannot protect you today.

Adam

And these are all drawn directly from common incidents we see with small and medium businesses.

Christina

Let's start with number one. MFA bypass leading to cloud account takeover.

Adam

This is this is at the top of the list for current client risk. The attacker uses MFA fatigue.

Christina

The push notification spam?

Adam

Right. Spamming the user with requests until they accidentally click approve or they use token theft to compromise, say, a Microsoft 365 admin account.

Christina

And from the endpoints perspective, this is completely invisible. The whole thing happens between the attacker's server and Microsoft's cloud.

Adam

EDR sees nothing. And once they're in, the consequences escalate so fast. We see things like mailbox forwarding rules being created to silently siphon off emails, SharePoint files being staged for exfiltration.

Christina

Or worse.

Adam

Or worse, the attacker changes the existing MFA methods or creates a whole new admin user to make sure they can get back in later.

Christina

And without monitoring the identity and cloud telemetry, you have no evidence of what happened. You are completely blind until the client calls you and says their files are gone. Which brings us to number two lateral movement, using legitimate Windows tools. We touched on this, but let's dive a little deeper. The attacker has stolen some basic credentials. Now what?

Adam

Now they use native tools like WMI or PowerShell to just explore the internal network. They're not installing malware, they're just mapping out where the crown jewels are, where's the critical data, where's the domain controller.

Christina

And this is so stealthy by design. If you're only relying on EDR, this traffic looks exactly like a system administrator doing maintenance. It's an approved process.

Adam

But the whole network view connects the dots. It sees impossible travel user logs into a laptop in San Francisco, then five minutes later, that same account uses WMI to run a command on a server in New York. That's not possible.

Christina

Or it sees an employee, you know, Jane from accounting, suddenly accessing the production server database using WMI, a server she has never touched in her three years with the company.

Adam

That's the anomaly detection that saves you. And why this matters is so crucial. If you only detect the ransomware when it detonates, the moment the encryption starts, you've already lost. It's too late. It's way too late. Lateral movement is the phase where they disable the backups and get the keys to the kingdom. You have to detect the reconnaissance, not just the final payload.

Christina

Okay, blind spot number three is something physical: rogue devices and shadow networks.

Adam

Think about that old unmanaged NAS device sitting in a corner, or the security camera system running on ancient firmware, or a Wi-Fi access point, a contractor installed that's not on your inventory list.

Christina

Somebody just plugs it in.

Adam

They plug it in and it instantly becomes a massive vulnerability. And the endpoints, again, see absolutely nothing. It's not happening on their device.

Christina

But the network layer sees the truth.

Adam

It sees everything. It sees new MA addresses popping up, it sees internal scanning attempts coming from that new device, or maybe brute force attempts targeting servers coming from an IP address that shouldn't even be there. These unmanaged devices are one of the easiest ways for an attacker to get a physical foothold inside your perimeter.

Christina

Let's talk about that perimeter. Blind spot number four focuses on the front door, VPN or firewall exploits. We see this in the headlines all the time.

Adam

All the time. When these vulnerabilities are exploited, the attacker gets direct shell access to the firewall or the VPN appliance itself. The endpoint is totally oblivious until the attacker starts moving from there.

Christina

But the whole network view spots it immediately.

Adam

It spots the unusual VPN session, a sudden connection from an unexpected country. Or maybe the system sees a configuration change being made to the firewall itself, which is a critical piece of network telemetry.

Christina

And clients assume that since you manage their infrastructure, you should have known the second that attacker got past the gate. Without that telemetry, you can't prove you were watching.

Adam

Which leads us to our final blind spot, number five. Quiet insider abuse. This isn't always a malicious outsider, is it?

Christina

No, sometimes it's the disgruntled employee who's about to leave.

Adam

Right. They copy sensitive client data to their personal cloud storage. Or departing staff member sets up a hidden forwarding rule on their email to keep getting company comms.

Christina

The challenge here is intent. An endpoint tool can't look at someone copying files and call it malicious.

Adam

It can't. But whole of network coverage connects the dots of behavior. Why did this user log in at 2 a.m.? Why did they immediately access the confidential customer directory? And why, in the next step, did their account suddenly sync 50 gigabytes of data to an unapproved cloud storage service?

Christina

It's the whole story.

Adam

Only by correlating directory access, time of day, and cloud logs can you build that narrative of abuse and stop it before the data actually leaves.

Christina

So if the solution is to collect data from everywhere, endpoints, cloud, identity, the network, I have to ask, doesn't this just shift the burden of analysis onto the MSP? How can they possibly scale this?

Adam

Yeah, that is the essential question. And the goal isn't just more data, it's operational efficiency. It's fewer, better alerts. When that correlation works properly, it actually reduces the workload.

Christina

How so?

Adam

Instead of getting 10 separate low-level alerts from the firewall, the cloud, three different servers, you get one single ticket that says active lateral movement detected, attacker utilizing WMI to reach DC.

Christina

This is where that multi-stage detection really shines. EDR can't connect this chain. An MFA bypass in the cloud leads to a mailbox rule change, allows access to SharePoint, results in exfiltration to an external IP.

Adam

To EDR, those are four separate harmless activities in four different silos.

Christina

But the integrated platform sees that sequence.

Adam

It sees the sequence and instantly flags it as a confirmed multi-stage attack. It transforms that disconnected noise into an undeniable attack narrative.

Christina

And beyond just the security efficiency, this model gives you a huge advantage when it comes to liability, right? Demonstrating duty of care.

Adam

Oh, it's vital. If a breach does occur, the ability to provide audit-ready evidence is priceless. The reporting shows exactly what was monitored, including identity, cloud, and lateral movement, what was detected, and what actions were taken.

Christina

That documentation protects the MSP.

Adam

It proves you implemented the modern security baselines needed to cover the gaps that attackers are actually using today.

Christina

We have to talk about the build versus buy dilemma here. A highly motivated MSP could try to piece all this together themselves.

Adam

They could.

Christina

But the cost is just tremendous, and it's not just financial.

Adam

Not at all. We're talking seven or more new tools, easily over a hundred hours of just initial integration, and then the ongoing burden of managing false positives, maintaining all those custom rules, and needing specialized expensive security analysts on call 24/7.

Christina

That's for the vast majority of MSPs focused on small and medium businesses, building an in-house security operations center for this is impossible financially, operationally. It's just not feasible.

Adam

They need the outcome, that hole of network visibility, but they can't afford the maintenance and the overhead.

Christina

And that's the gap these integrated platforms are designed to fill.

Adam

Exactly. They deliver that enterprise grade visibility and correlation without forcing the MSP to take on the prohibitive burden of building a custom security stack from the ground up.

Christina

So if we connect all this back to the bigger picture, the conclusion here seems pretty unavoidable. Whole of network coverage isn't some future tech or an expensive option for large enterprises anymore.

Adam

No, it's the only realistic way to protect modern clients and demonstrate that you're addressing the attack surface as it actually exists today.

Christina

Modern attacks don't live on a device.

Adam

They live in the gaps. They live in the space between identity, the cloud, the network, and device activity. You have to monitor the entire connected story.

Christina

So what does this all mean for you? I think the core lesson here is that protection has fundamentally moved beyond that single device. Your security baseline has to encompass the entire digital life of the user and the network.

Adam

That is where you win the security battle today.

Christina

And this raises a really important final question for you to think about. If attackers are primarily relying on legitimate administration tools and compromised credentials, activities that look completely normal in isolation, how much of your organization's current security budget is still being spent defending against malware and files? Activities that are no longer the primary attack vectors?

Adam

Something for you to mull over or explore on your own.