There was a time when many of us in the IT channel, myself included, tolerated a level of client security that is simply unconscionable today. As a part-owner of a VAR, I remember the pressure to please customers and avoid difficult conversations about what they considered unnecessary expenses. The reality is, back then, the threats were different. A security breach was an inconvenience, not a business-ending event. Today, the landscape has changed dramatically. With that heightened risk comes a much greater responsibility for MSPs.
A conversation about due care, not negligence
The reckoning is coming. For MSPs that have allowed clients to operate with lax security for too long, a major incident isn’t a question of if, but when. It’s easy to think a client who refuses to enable multi-factor authentication (MFA) or pay for essential security services is on their own if they get hit. After all, you have a master services agreement (MSA) that outlines their responsibilities.
But when a cyberattack cripples a business, and millions of dollars are on the line, a court is likely to look at the situation through a different lens. They won’t focus on simple negligence; they’ll look at due care.
Imagine a lawyer standing in front of a jury. They won’t ask about an MSA. Instead, they’ll ask about a seatbelt. “Would you let a client drive a car without a seatbelt, knowing the risks?” The jury’s answer would be an obvious no. The MSP, in this analogy, is the seatbelt. We have a professional duty to not only recommend but also to enforce basic safety measures.
The problem with legacy configurations
Many of the biggest risks aren’t with new clients. They’re with long-standing clients who have resisted change for years. I’m talking about the legacy configurations with Windows Active Directory that haven’t been updated in 20 years. The eight-character domain admin password that’s been synchronized with Microsoft 365. The disabled security defaults, allowed legacy protocols, and disabled MFA.
These clients aren’t just a risk to themselves – they’re a risk to you. The path forward isn’t to simply tolerate their inaction. It’s about having those uncomfortable but critical conversations. It’s about explaining that the world has changed and the level of risk they’re currently accepting is no longer sustainable for their business or for yours.
Instead of an ultimatum, frame the conversation around partnership and shared responsibility. Your goal is to work together to mitigate risk. Explain that these security measures are no longer optional, and you need their full cooperation to keep them safe. It’s a conversation you need to have, for the sake of your client’s business and for the future of your own.
