Briefing
Many managed service providers begin by deploying their agent and taking the help desk. Existing problems carry over silently.
A better start is an assessment: a network scan and a test of exposed services, credentials, segmentation and unsupported devices. Critical findings are fixed first, and management begins from a documented baseline.
Attackers also target the tools providers use, such as backup consoles and remote support software, which is one reason recent KEV entries include remote access products. A provider that tests your environment, and its own tooling, is better placed to notice trouble.
What to do
- Ask for an onboarding assessment in the proposal.
- Require remediation of critical findings before the management start date.
- Ask for a vendor-neutral hardware spec list.
- Ask for a list of the provider's tools that can reach your systems and how access to them is secured.
- Confirm where your offline backup lives.
How to verify
- When was the network last tested, and can you see the findings?
- Does the provider earn commission or margin on recommended products?
- Which management tools can reach your systems, and are they protected with MFA?
- When was a restore from offline backup last tested, and how long did it take?
Sources
- CISA, Known Exploited Vulnerabilities catalog
- CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, Oct 16, 2026
- CISA, #StopRansomware Guide
Want help putting this in place? Contact Computer Plus.