The MSP Risk Is Not Where You Think It Is

Using the ConnectWise Cloud Backup shutdown as a case study, Charles Weaver examines a recurring issue for MSPs: they may be held accountable for risks in systems they do not directly control. He considers what this means for MSPs, vendors, and customers as security requirements and oversight continue to increase. The discussion focuses on how MSPs should respond when a supplier’s access is misused, why customers expect answers from the MSP, and how responsibility should be addressed when operational control is shared. The episode is relevant to MSPs that manage backup, EDR, password management, and other integrated services. It presents a framework for assessing vendor-related risk through questions such as: Where does risk begin when a supplier is compromised? Who is responsible when the MSP does not control the underlying system? When does operational efficiency create concentration risk? What information and support should vendors provide to MSP partners? How should contracts, liability, and evidence be managed across the service chain? Charles also outlines five tests MSPs can use to evaluate their technology stack: the control test, concentration test, substitutability test, contract test, and failure test. These tests help determine whether vendor relationships support resilience and clarify how an MSP would respond to a service failure. The episode also considers supplier access, industry consolidation, and the operational impact of relying on a limited number of platforms. It is intended for MSP owners, security leaders, and others responsible for managing customer risk and vendor relationships.