The episode details an ongoing shift toward upstream platform control and infrastructure dependence in the managed IT services sector. Centralized platforms, such as Pax8’s 8OS and governance initiatives from the Channel Trade Association (GTIA), increasingly control AI, access rights, consent, and management tooling, concentrating privileged identities and access points within vendor environments rather than those of MSPs or clients.
A key case highlighting the risk is the ConnectWise Cloud Backup incident, where one credential enabled access to 173 Microsoft 365 tenants in two hours. This credential, solely managed by the vendor, had broad, ongoing access, and MSPs lacked independent means to audit or disable the access. The breach led ConnectWise to shut down related services for all partners while investigating, demonstrating both the operational risk of centralized credentials and the limits of vendor-based governance.
Supporting developments reinforce this centralization. Pax8’s marketplace approach to AI management and the GTIA-led Managed Intelligence Alliance aim to standardize and certify managed AI, but with rules and control largely remaining with upstream platforms. Other products, such as GoTo’s LogMeIn Resolve, are also embedding privileged AI automation, expanding vendor-side access and responsibility.
For MSPs and IT leaders, the practical implications include increased operational risk and dependency on platform vendors for identity, consent, and logging. Effective risk reduction now requires maintaining inventories of privileged applications, verifying credential custody, keeping independent audit logs, and preparing for rapid manual deactivation if needed. Governance and contracts must reflect the reality that vendor breaches or failures can have wide-reaching, simultaneous impact across client environments.
About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.
22:53
12:50
41:30
12:37
26:33