vCISO view: who owns your MSP's admin access?

By Yonatan Hoorizadeh, CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: July 27, 2026

Most companies cannot name the person who approves privileged changes made by their outside IT provider. That gap, not a missing tool, is what turns one compromised remote management server into dozens of breached clients. Third parties now appear in 48% of breaches, according to the 2026 Verizon Data Breach Investigations Report. Ownership belongs in the contract.

What happened in the Bomgar RMM attacks?

Attackers spent April 2026 breaking into companies through the remote support software their IT providers use. Researchers at the Huntress Security Operations Center reported a sharp increase in attacks against Bomgar Remote Support instances, exploiting CVE-2026-1731, an unauthenticated remote code execution flaw affecting BeyondTrust Remote Support and older versions of the vendor's Privileged Remote Access product. Huntress counted five incidents in two weeks.

The numbers from one of those incidents explain why this matters more than a typical vulnerability writeup. According to Dark Reading's coverage of the Huntress research, an April 15 intrusion at a managed service provider (MSP) ended with 78 businesses isolated and four downstream customers exploited. An April 3 attack compromised a dental software company and reached three of its downstream companies.

Huntress tactical response analyst Josh Allman described compromising the server that runs the remote monitoring and management (RMM) appliance as “like getting the key to the city,” telling Dark Reading that upstream access hands an attacker every downstream client at once.

The technical pattern was consistent. Attackers targeted high-privilege Bomgar accounts inside MSP environments, pushed remote access tools such as AnyDesk and Atera directly onto domain controllers, added their own accounts to local and domain administrator groups, and in several cases deployed LockBit ransomware. Huntress noted that CVE-2026-1731 was first disclosed in February 2026, which means the April victims were compromised through a flaw that had been public for roughly two months.

Why do third parties now show up in nearly half of all breaches?

Vendor access is legitimate access, and legitimate access is hard to see. The 2026 Verizon Data Breach Investigations Report found that breaches involving a third party now account for 48% of all breaches, a 60% jump in a single year. The trend line is steep: third parties appeared in 30% of breaches in the prior year's report and 15% the year before that.

Smaller companies carry more of this exposure, not less. The 2026 DBIR reported that third parties were involved in 55% of breaches at small and mid-sized businesses, and that 96% of ransomware victims whose organizational size was known were SMBs. A 40-person medical practice and a 12-attorney firm are not edge cases in this data. They are the center of it.

The remediation side is worse than the exposure side. The same Verizon report found that only 23% of third-party organizations fully remediated missing or improperly secured multi-factor authentication on cloud accounts. Verizon also found that exploitation of software vulnerabilities became the top initial access method at 31%, passing stolen credentials for the first time. Put those two findings next to the Bomgar timeline and the shape of the problem is clear: your provider's unpatched system becomes your incident, and nobody in your company is watching their patch cycle.

Who actually owns the privileged access your IT provider holds?

In most mid-market companies, nobody owns it, and both sides believe the other one does. The client assumes the provider watches the firewall. The provider's scope of work says manage, and monitoring was a separate line item nobody purchased. Both readings survive a plain reading of the contract, which is exactly the problem. During an incident, the difference between manage and monitor becomes a legal argument while the environment stays open.

The specific failures repeat across almost every third-party access review I run. A rule gets opened for a vendor project and never closed, because closing it was never assigned to a named person. A provider technician leaves that firm and their credential still authenticates months later. Admin accounts are shared across the provider's client base rather than issued per technician. No one on the client side can produce a list of which provider accounts hold administrative rights in their own tenant.

None of those are technology failures. They are ownership failures, and they show up in the paperwork long before they show up in a SIEM. NIST Cybersecurity Framework 2.0 made this explicit when it added supply chain risk management under the Govern function, where the first expected outcome is that roles and responsibilities for suppliers are established, communicated, and coordinated on both sides of the relationship.

Here is how a vCISO triages the first 72 hours when a provider-side compromise is announced. Step one is establishing whether provider credentials can authenticate into your environment right now, and disabling every account you cannot attribute to a named technician. Step two is pulling 90 days of authentication logs and RMM telemetry for those accounts. Step three is hunting for remote access software you never purchased, especially on domain controllers, since AnyDesk and Atera showed up as persistence tools in the Huntress cases. Step four is reading your contract's notification clause to see what evidence the provider owes you and by when. Most companies discover during step four that the clause does not exist.

What should your business do?

Start with the contract, not the network. Four of the five items below cost nothing but attention, and they close the gap that turned 78 businesses into collateral damage in a single April afternoon.

• Pull your master services agreement and statement of work and find the responsibility matrix. If there is no matrix, that absence is your finding.

• Search those documents for the word monitor. Confirm whether it appears next to firewall rules, endpoint detection alerts, backup verification, and identity logs, or only next to the things you already assumed.

• Ask your provider for a written list of every account they hold with administrative rights in your environment, mapped to named technicians. Then require multi-factor authentication on all of them and eliminate shared logins.

• Add an offboarding clause: provider access is revoked within 24 hours of a technician leaving their firm or the contract ending, with written confirmation to you.

• Ask which remote support product your provider runs, what version, and how fast they patch. CVE-2026-1731 was public in February 2026 and still producing victims in April.

• Confirm with your broker that your cyber policy responds to an incident that starts inside your provider, and check what notification timeline the policy requires from you.

A formal third-party risk assessment turns those answers into a ranked list rather than a pile of email threads, and it gives you something to hand an auditor, an insurer, or a client who asks how you manage vendor access.

How vCISO services close the ownership gap

A vCISO (virtual Chief Information Security Officer) works on your side of the table, which is the structural difference that matters here. Your MSP is a capable technical partner and also an interested party in any question about the scope of their own responsibility. Someone has to read that contract as the buyer, define who approves a privileged change, and hold the provider to an evidence standard. That is the job.

For most companies under 250 employees, this does not require a full-time executive hire. Purple Shield Security delivers this as vCISO services and fractional CISO services: contract and scope review, a written responsibility matrix both parties sign, quarterly access recertification with the provider, and a governance cadence that survives staff turnover on either side. Vendor-neutral by design, since we do not resell the tools your provider sells you.

Frequently asked questions

Does hiring an MSP transfer my cybersecurity liability?

No. Regulators pursue the organization that holds the data, not the vendor that touched it. A HIPAA-covered entity remains accountable for protected health information even when an outside IT firm administers the systems, which is why a business associate agreement is required rather than optional. Contracts can shift cost through indemnification and insurance, but they do not move the regulatory obligation off your organization.

How do I tell whether my MSP monitors my firewall or only manages it?

Read the statement of work and look for who reviews alerts, on what schedule, and what happens when an alert fires at 2am on a Saturday. Managing usually means configuring the device and responding to your tickets. Monitoring means someone is watching telemetry outside your business hours and is contractually obligated to act. If the document does not name a response time, assume nobody is watching.

What is CVE-2026-1731 and does it affect my company?

CVE-2026-1731 is an unauthenticated remote code execution flaw in BeyondTrust Remote Support (formerly Bomgar) and older versions of Privileged Remote Access, disclosed in February 2026 and exploited through at least April 2026 according to Huntress. It affects you indirectly if your IT provider or a software vendor uses that product to reach your systems. The question to ask your provider is what remote support platform they run and when they patched it.

Do I still need a vCISO if my MSP already has a security team?

It depends on who you want writing the requirements. An MSP security team executes controls; it does not typically set your risk appetite, own regulatory decisions, or evaluate its own contract performance. A workable rule: if you are in a regulated sector, carry cyber insurance with security warranties, or answer client security questionnaires, you need someone accountable for security decisions who does not also invoice you for the tools. That role is what fractional CISO services provide.

Purple Shield Security helps small, mid-market, and regulated businesses answer one question with evidence: who owns each security control, us or the vendor. If your MSP relationship has never been reviewed with that question in mind, a second set of eyes on the contract and the access list is a short engagement with a long shelf life. Start at purpleshieldsecurity.com/vciso.