From Security Tools to a Defensible Security Program

MSPs are trusted with far more than technology.

You help maintain the systems your clients use to communicate, serve customers, access data, and keep their businesses operating. As that responsibility grows, so does the expectation that security controls, ownership, and customer decisions are clearly documented.

When an incident occurs, the questions rarely stop at, “How did the attacker get in?”

Clients, insurers, regulators, and legal counsel may also ask:

• Which controls were expected to be in place?

• Who was responsible for managing them?

• What recommendations did the MSP make?

• Which risks did the customer accept or decline to address?

• Was the environment being monitored?

• Can those activities and decisions be demonstrated with evidence?

The technology stack matters. The ability to show how it was governed matters just as much.

The MSP Model Creates Both Leverage and Responsibility

MSPs create value by managing technology efficiently across many customers. Shared tools, processes, and expertise make it possible to deliver services at scale.

That same operating model can also increase the impact of a security failure.

The 2021 Kaseya incident showed how an attack involving software used by MSPs could cascade through the supply chain and affect downstream businesses. It reinforced why MSP environments, privileged access, and shared management platforms remain attractive targets.

The lesson is not that MSPs are automatically responsible whenever a customer experiences an incident. It is that providers may be asked to defend what they promised, recommended, implemented, monitored, and documented.

When Security Responsibility Becomes a Legal Question

Recent disputes involving technology and managed-service providers illustrate how quickly operational questions can become contractual, insurance, regulatory, or legal matters.

The $1.9 million Netgain class-action settlement followed a ransomware attack that exposed information held for healthcare customers. The settlement was reached without an admission of wrongdoing, but it demonstrated the potential consequences when an incident affects downstream organizations and their data.

In 2025, Clorox sued Cognizant for approximately $380 million, alleging that service-desk personnel failed to follow required identity-verification procedures before an attack.

In 2026, the Delaware Supreme Court allowed insurers to proceed with aggregated breach-of-contract claims against Blackbaud on behalf of affected customers.

These matters involve different facts and remain at different stages. They do not establish automatic MSP liability. They do demonstrate that technology providers may be required to explain how responsibilities were defined and whether agreed-upon practices were followed.

A Program Before the Incident

Several states have enacted cybersecurity safe-harbor laws that may provide an affirmative defense or limit certain damages when an organization maintains a written cybersecurity program aligned with a recognized framework.

Safe harbor is not blanket immunity. Its availability varies by state, circumstance, type of claim, and the conduct involved.

The broader principle, however, is important: a documented and consistently managed security program is more defensible than an informal collection of tools and assumptions.

A spreadsheet may capture a point in time. A mature program maintains an ongoing record of:

• Controls that are in scope

• Responsibilities assigned to the MSP and the customer

• Findings and recommended remediation

• Customer decisions and accepted risks

• Exceptions and compensating controls

• Evidence that controls are reviewed over time

This is the difference between believing reasonable practices are in place and being able to demonstrate how those practices are governed.

Evidence-Based Accountability as a Differentiator

Documented accountability is not only about preparing for litigation. It can also help an MSP deliver a better managed service.

Clear control ownership and evidence can support:

• More productive QBRs

• Stronger cyber insurance readiness

• Better alignment between technical work and business risk

• More consistent service delivery across customers

• Clearer conversations about recommendations and responsibility

• A stronger case for recurring security and compliance services

This creates an opportunity for MSPs to move beyond selling security tools and establish an ongoing governance program around the work they already perform.

Where Cytracom Fits

Telivy and Tentacle help connect risk identification with structured remediation and accountability.

Telivy provides broad visibility into vulnerabilities, assets, cloud environments, exposed data, external risks, and other conditions that may affect a client’s security posture.

Tentacle helps MSPs translate those findings into a repeatable governance model by mapping controls, assigning responsibilities, managing evidence, documenting exceptions, and tracking progress across more than 30 frameworks.

Together, they help TeamLogic IT partners move from:

• Findings to prioritized action

• Recommendations to documented customer decisions

• Individual projects to continuous managed programs

• Informal confidence to evidence-based accountability

The question is no longer only, “Do we have the right security tools?” It is also, “Can we show how security is being managed across every client we protect?”

That is the difference between a security stack and a security program.