Remote access is indispensable to the managed services model. It also concentrates risk. A tool that allows an engineer to support hundreds of endpoints can offer an attacker the same reach if it is vulnerable, misconfigured or used without adequate oversight.
The latest Barracuda SOC Threat Radar provides three useful examples. During a month of investigations, Barracuda Managed XDR researchers observed scanning for vulnerable GlobalProtect deployments, credential stuffing against remote-access services exposed by permissive firewall rules, and the malicious use of ScreenConnect to maintain endpoint access.
These are individual incidents rather than a measure of how frequently each threat affects the wider market. Nevertheless, together they expose an important operational reality: attackers do not always need novel malware or an ingenious exploit. Often, they can find opportunity in the same products, ports and credentials that businesses use every day.
Internet exposure turns weaknesses into urgent risks
In the first case, Barracuda detected two waves of inbound scanning directed at publicly accessible GlobalProtect services. The activity followed the disclosure of CVE-2026-0257, an authentication-bypass vulnerability that, under specific configuration conditions, can allow an attacker to establish a VPN session as a legitimate user. Palo Alto Networks rates it 7.8 (high) on the CVSS scale and confirmed exploitation in the wild since May, reason enough to treat any unpatched, exposed GlobalProtect instance as an active risk rather than a theoretical one.
The affected configuration is not universal. Palo Alto Networks’ advisory explains that exploitation depends on a GlobalProtect portal or gateway being configured alongside authentication override cookies and related certificate settings. This distinction matters: MSPs should determine actual customer exposure instead of assuming that every installation is vulnerable – or that a product patch alone completes the job.
Barracuda’s researchers found the scanning during a proactive threat hunt, blocked the attempts and reported no successful exploitation. That outcome demonstrates the value of connecting vulnerability intelligence with live operational monitoring. An MSP needs to know not only that a vulnerability exists, but which customers run the affected service, whether the vulnerable configuration is present and whether anyone is already probing it.
The second case shows why configuration management deserves equal attention. Barracuda investigated credential stuffing against a Fortinet VPN and found overly broad firewall rules exposing SSL VPN, Remote Desktop Protocol and Telnet services. Multiple unrelated scanning clusters targeted the environment.
For MSPs, this is the practical danger of configuration drift. A temporary rule may outlive the project that required it; a legacy protocol may remain enabled because no one owns its removal; or a customer-side change may silently alter the exposure that the provider believes it is managing.
CISA’s internet exposure reduction guidance similarly warns that misconfigured systems, default credentials and outdated software are often discoverable online. MSPs should therefore examine customer environments from the outside as well as from the management console. An internal inventory describes what should exist; external attack-surface monitoring reveals what the internet can actually see.
Trusted tools need zero-trust treatment
Barracuda’s third investigation involved several unauthorized ScreenConnect clients configured for unattended access. The software communicated with suspicious domains over non-standard ports and appeared in the Windows System32 directory alongside command scripts – behavior inconsistent with a normal deployment.
The lesson is not that MSPs should distrust a particular vendor. It is that legitimacy is not evidence of authorization. Attackers favor remote administration software precisely because it is capable, familiar and less likely than bespoke malware to trigger suspicion.
This risk has been recognized beyond Barracuda. A joint CISA guide to securing remote-access software notes that cybercriminals increasingly co-opt legitimate tools. CISA’s Remote Monitoring and Management Cyber Defense Plan also warns that compromising an MSP’s systems can potentially give attackers access to many downstream customer networks.
MSPs should consequently establish an approved-tool policy covering product, version, deployment path, management server, permitted ports, named owner and business purpose. Detection should look for deviations from that baseline: duplicate agents, installations in unusual directories, connections to unrecognized infrastructure, unexpected unattended-access settings and persistence mechanisms such as new services, scheduled tasks or startup entries.
A practical checklist for MSP owners
Security leaders can turn the research into a manageable operating routine:
- Maintain a current inventory of every customer’s internet-facing assets, VPN gateways and remote administration tools.
- Compare internal records with regular external exposure scans to identify unknown or unintentionally published services.
- Create an urgent review process for newly disclosed vulnerabilities that maps each advisory to affected customers and configurations.
- Require multifactor authentication – preferably phishing-resistant methods – for VPN, RMM and privileged access.
- Eliminate Telnet and unnecessary direct exposure of RDP or administrative interfaces; restrict essential access by network, identity and role.
- Review firewall rules on a defined schedule and require expiry dates and accountable owners for temporary exceptions.
- Allow only approved remote-access tools and alert on duplicate agents, unusual paths, unfamiliar domains or non-standard ports.
- Centralize logs from firewalls, VPNs, identity platforms, endpoints and remote-management systems, with alerts for scanning, repeated failures and anomalous sessions.
- Pre-authorize containment actions so the provider can isolate a compromised endpoint quickly without losing time to contractual uncertainty.
- Report measurable controls to customers, including MFA coverage, overdue patches, exposed services, firewall exceptions, and unauthorized tool findings.
Price the checklist as a tiered service
The checklist above does not have to be part of an all-inclusive support agreement. Structured as a tiered offering, it becomes a sellable service rather than an unbilled obligation.
A three-tier model fits naturally. The entry tier delivers visibility: an inventory of internet-facing assets and remote-access tools, plus regular external exposure scans. The next tier adds enforcement: MFA requirements, an approved-tool policy and a defined firewall-review cadence. The highest tier adds continuous monitoring and response: centralized logging, pre-authorized containment and quarterly reporting to the customer.
Major remediation, such as replacing an unsupported VPN appliance or rebuilding a customer’s firewall rule set, should remain a separately scoped project rather than something the recurring fee is expected to absorb.
Barracuda’s research ultimately points to a service-design issue. MSPs already possess many of the necessary controls, but those controls produce value only when applied continuously and consistently across the customer base.
The strongest proposition, therefore, is not simply “we deploy security tools.” It’s “we know what is exposed, what is authorized, what has changed and how quickly we can act”. For MSP owners, turning that promise into a repeatable operating standard can reduce risk while providing customers with visible evidence of good security stewardship.
