Here’s a little thought I had while prepping for a talk I’m giving this week:
Most MSPs think they’re secure because they bought a bunch of tools.
They bought the firewall. The antivirus. The backup system with more redundancy than a government form. And they think: “We’re good. Locked down. Fort Knox status.”
Let me say this with all the love in the world:
You’re not good. You’re dangerously naïve.
Buying tools doesn’t mean you’ve secured anything. It just means you’ve bought something. Let’s break it down.
Installed ≠ Configured ≠ Secured
You installed the tool. Cool. But did you configure it correctly? Did you tie it to a cybersecurity standard? Does it meet the cyber insurance requirements your clients signed off on? If the answer is “maybe” or “what requirements?” then I have some bad news: You’re not securing your clients. You’re playing dress-up.
The Most Dangerous Moment in Cybersecurity
Let’s talk about the real threat. It’s not when data is stored in the cloud. That part is usually fine. It’s not even when it’s in transit—assuming the stars align and your TLS certificates aren’t expired.
The most dangerous moment in cybersecurity is when the user is looking at the data.
Because that’s when it’s completely exposed.
Naked. Vulnerable. Begging to be exfiltrated.
Every standard—PCI DSS, NIST, even the cyber insurance providers—is screaming about this one thing: Secure. Your. People.
Yet most MSPs are doing the opposite. They’re ignoring the soft underbelly of the attack surface: human behavior.
Your Users Are the Doorway
Policies aren’t optional. They’re your only shot at sanity.
- Acceptable Use Policy
- Password Policy
- Funds Transfer Policy
- Training Policy
Without them? You’re walking clients into a courtroom with no pants on.
And here’s the kicker: if you’re not getting signatures on these, you’re not serious about security. Worse, you’ve got no evidence to prove your clients were ever educated, trained, or warned.
Signatures = Security Evidence
Two things happen when you require users to sign your security policies:
- They take it seriously. (Because now they know you take it seriously.)
- You have evidence. Evidence that will save your hide when the breach happens and lawyers start asking questions like: “Did you warn them?”
Here’s Your Action Item
Stop hiding behind your firewall and start securing your users.
- Build your policies.
- Train your users.
- Get their signatures.
Security isn’t a product you buy. It’s a culture you create.
Get started now. Because one day soon, someone’s going to click the wrong thing. And when that happens, you’ll wish you had more than a receipt for antivirus to defend yourself.
