Supply Chain Attacks: How MSPs Can Protect Themselves and Clients

The SolarWinds attack in 2020 was a wake-up call, but the Kaseya VSA attack in 2021 made it personal for every MSP. When attackers compromise a tool that MSPs use to manage thousands of client endpoints, the blast radius is enormous. As an MSP, you occupy a unique position in the supply chain: you're simultaneously a customer of upstream vendors and a critical supplier to your clients. This dual role means you face supply chain risk from both directions.

Hardening Your Upstream Supply Chain

Every tool in your stack is a potential attack vector. Evaluate each vendor's security posture with the same rigor you'd apply to a client assessment. Demand SOC 2 Type II reports, ask about their secure development practices, and understand their incident response capabilities. Segment your management infrastructure so that a compromise of one tool doesn't grant access to everything. Your RMM should not have the same network access as your backup solution. Use dedicated service accounts with minimal privileges for each tool, and monitor those accounts for anomalous behavior. Consider running critical management tools from hardened jump servers rather than from technician workstations.

Protecting Downstream Clients

Your clients trust you with administrative access to their environments, which makes your MSP a high-value target. Implement strict MFA on every management console and internal system — not just client-facing tools. Enforce conditional access policies that restrict management tool access to known locations and devices. Maintain detailed logs of all administrative actions across client environments, and regularly audit those logs for anomalies. Most importantly, have a plan for the worst case. If your RMM platform is compromised tomorrow, can you quickly isolate all client agents? Can you communicate with clients through an out-of-band channel? These aren't hypothetical scenarios — they're events that have already happened to real MSPs.