Most MSPs worry about missing an alert. Maybe the SOC will overlook something critical. Or perhaps a firewall will be misconfigured.

Any one of these could let an attacker into the network. And when that happens, guess what? You’re the one holding the bag.

But here’s the real problem: missing an alert or a misconfiguration isn’t the start of the issue. It’s the final mistake in a chain of failures. The real trouble begins with mistake number one and number two.

So, what are the first two mistakes?

Mistake #1: No Defense in Depth

If an attacker can get into your network, exfiltrate sensitive data, or move laterally with ease, you don’t have defense in depth. And that’s your first major failure.

Here’s the hard truth: we’ve audited over 38,000 environments in the last five years. Want to know the #1 thing MSPs miss? Defense in depth.

It’s not just about layering your defenses; it’s about doing it right:

  • Least privilege: Every user should only have the access they need to do their job. No more, no less.
  • Tested incident response plans: If you haven’t tested your plan, it’s not a plan—it’s a liability.

And let’s be clear: incident response, business continuity planning, and documentation are non-negotiable components of a serious security strategy.

Mistake #2: No Evidence

Let’s say you’ve nailed defense in depth. Your controls are solid, and your strategies are tight. What could still go wrong?

One thing: evidence.

Most MSPs focus on building a security program—based on standard sources, of course. They implement the controls, train the users, and test the solutions. But they miss the most critical piece: documenting everything.

Here’s what I mean by evidence:

  • Proof of decisions made by stakeholders in the network.
  • Evidence that users are trained and security solutions are tested.
  • Documentation of how everything is supposed to work—and proof that it actually does.

Why Does Evidence Matter?

Because after the hackers come the lawyers.

When a breach happens, it’s not just about fighting the hackers. You’ll be fighting the people lining up to get their “compensation” for the breach. 1 in 5 ransomware events ends in a lawsuit.

You’ve seen the ads: “Did you get a breach notification letter? We can help you sue!” This isn’t theoretical—it’s reality.

If you can’t prove you made the right decisions, trained your users, and tested your solutions, you’ll be on the hook. Evidence isn’t just for compliance or cyber insurance; it’s your shield in court.

The Two Things You Need Before a Breach Happens

If you want to stay in the game, you need two things set up now:

1. Defense in Depth

Layered security, least privilege, and a tested incident response plan.

2. Evidence You’re Doing the Right Things

Document everything. Prove your users are trained, your systems are tested, and your processes work.

Hackers will hack. But when they come for your network, will you be another victim—or will you be ready to fight back? The choice is yours.