MSP technology security: tool architecture and blast radius.
The software your IT provider uses may have privileged access to hundreds or thousands of customer devices. As cyber attacks become faster and increasingly AI-assisted, the architecture behind your MSP matters more than ever.
A practical guide to blast radius, architectural separation and the questions leaders should ask about an MSP's own technology.
An MSP may hold some of the keys to your business. Understand how those keys are protected, and whether they are all attached to the same keyring.
When organisations choose an MSP, they assess engineering capability, certifications, service levels, cybersecurity expertise and coverage. Far fewer assess the technology architecture the provider uses to operate the service.
An MSP naturally needs privileged access. It may manage endpoints, run approved scripts, administer Microsoft 365, support backup and coordinate security operations. Those capabilities are necessary, but increase the consequence if a trusted management system is compromised.
Many MSPs use integrated service-management ecosystems such as Kaseya, HaloPSA and ConnectWise. These can join ticketing, customer records, automation, remote monitoring, endpoint administration, backup and security capabilities. Integration can improve efficiency and consistency. The question is the potential blast radius created by the architecture around it.
Blast radius
The important question is not simply, “Is this platform secure?” It is, “If it is compromised, what else can an attacker reach?”
Attackers look for leverage. A compromised MSP management platform can create potential pathways across many environments. That makes MSPs, remote management platforms, SaaS products, backup platforms, identity providers and software supply chains attractive targets.
The danger is not simply that the management platform contains customer information. It may also possess legitimate administrative pathways into the systems it manages.
Speed changes the calculation
Attackers may be ready before they arrive.
Sophisticated criminal groups can prepare infrastructure, tooling, exfiltration processes and target information before initial access. Once they do, they can move through a planned operation rather than pause to decide what to do next.
Mandiant’s 2026 M-Trends research reports that the median time from initial access to hand-off to another threat group fell from more than eight hours in 2022 to 22 seconds in 2025. This is not a claim that every intrusion follows the same pattern. It is a useful warning that the operation may be prepared before a defence is breached.
AI may make this window smaller. The NCSC says AI will almost certainly make elements of cyber intrusion more effective and efficient. It can reduce the effort behind reconnaissance, vulnerability research, social engineering, data analysis and automation.
Traditional assumption
Breach
Explore
Prepare
Execute
Increasing reality
Prepare
Breach
Execute
When attackers become faster, limiting what they can reach becomes just as important as detecting how they got in.
Why Architecture Matters More Now
The data points to third-party exposure, exploit pressure and an increasingly compressed response window.
48%
of breaches involved a third party in Verizon’s 2026 DBIR dataset, up 60% from the prior year.
Trusted software can become a route of attack precisely because it is trusted.
The recent ConnectWise Cloud Backup incident, involving the former SkyKick service, illustrates the principle. ConnectWise reported unauthorised access to application credentials associated with Cloud Backup, which customers had granted Microsoft 365 access for backup functions.
Its remediation guide asks customers to review enterprise applications, service-principal sign-ins, permissions, directory audit records and local evidence. A trusted application deserves the same scrutiny around identity, permissions, monitoring and response as a privileged employee account.
ConnectWise said existing backup archives remained encrypted and isolated, with no indication they were compromised, and that it had no indication other products were affected. This does not establish that every customer was affected, Microsoft was compromised or backup data was stolen. It shows why trusted application identities need a containment plan.
Detection still matters
Why a SOC may have a difficult job.
Endpoint and identity security tools can identify abnormal process execution, suspicious authentication, privilege change, network connections and data-exfiltration indicators. A SOC can still detect meaningful warning signs from trusted management software.
The challenge is context. MSP tools may be approved software, expected administrator behaviour and legitimate scripting engines. The question is whether a trusted management agent is doing something it should not.
Security monitoring is essential, but it cannot compensate for unlimited architectural trust. Independent telemetry, useful logs and bounded privileges give detection teams a stronger chance to distinguish approved activity from abuse.
Do Not Put Every Key on the Same Keyring
A compromise of one system should not automatically provide control of another.
Wavex selects specialist products and services for different functions rather than relying on one ecosystem for every capability. Service management should not automatically equal endpoint administration. Billing access should not automatically equal infrastructure access. Backup and security administration should use deliberately constrained controls and identities.
Integration is not wrong, and specialist tools are not automatically secure. More products can create more credentials, API keys and monitoring gaps. The principle is to choose the right tools, secure each, integrate deliberately and minimise unnecessary trust.
Useful integration can be efficient. The architectural question is how much privilege is concentrated and how far a single compromise could reach.
Segmented specialist architecture
Service management
A governed operational hub, not the master key to every client technology
Controlled integration
Endpoint management
Security monitoring
Backup
Vulnerability management
Operational functions
Independent identities, least privilege, restricted integrations, separation of duties and independent monitoring introduce practical barriers between functions.
The objective is not more tools. It is fewer unnecessary trust relationships.
Service management with boundaries
Why ServiceNow sits at the centre of Wavex APEX.
Wavex uses ServiceNow as the core service-management platform for APEX, bringing incidents, problems, changes, CMDB, vulnerabilities, workflow, reporting and governance together. It is the operational record and coordination layer, not the master key to every client technology.
Wavex has enabled ServiceNow High Security. ServiceNow says the plugin creates or updates more than 900 configurations intended to mitigate common OWASP attack classes, including stricter access control, input validation and output encoding. It is one part of a wider architecture, not a guarantee that any platform cannot fail.
ServiceNow is at the centre of our service-management architecture, but it is deliberately not the master key to every client technology.
The goal is not to find a platform that can never be compromised.
Every SaaS provider can experience a vulnerability, credential theft, configuration error, supply-chain incident or service interruption. The resilient objective is to prevent, limit, detect, contain and recover. Isolation and least privilege reduce the consequence when prevention fails.
Watertight compartments
Design for a failure that does not travel.
Good security architecture works like watertight compartments on a ship. You still try to prevent the breach, but you also design the vessel so one failure does not sink everything.
Prevent
Limit
Detect
Contain
Recover
Use in your next supplier review
Ten Questions to Ask Your MSP About Their Own Technology
These questions test whether a provider understands the privilege it holds and can explain how it is separated, monitored and recovered. They are a constructive starting point, not an attempt to catch a provider out.
Security by Architecture, Not Assumption
We assume every technology carries some risk. Good architecture is about preventing a failure in one technology becoming a failure everywhere.
ServiceNow APEX
Specialist management platforms
24x7 SOC
Vulnerability management
Endpoint security
Strong identity and segregated privileges
Controlled integrations
Incident management and continuous review
Related Wavex reading
Continue the conversation about trusted technology.
An MSP naturally requires privileged access to support your organisation. The important question is how that privilege is secured, separated and monitored.
