It’s a reporting day.

A client wants a security posture summary. You log into the EDR for coverage. The RMM for the endpoint list. The email security tool for mailbox status. The backup platform to confirm the last good restore point. The identity tool for MFA. Then you paste it all into one place, reconcile the parts that disagree, and format it into something you can actually send.

That’s half a morning for one client. Multiply it across a book of dozens.

The work isn’t hard. It isn’t interesting either. It’s just where a huge share of your hours go.

Subscribe now

The bottleneck came from somewhere else

Your tools aren’t slow. The data isn’t missing. The bottleneck is you, in the middle, moving between consoles, reconciling by hand, and updating copies of presentations you already created.

That’s the real ceiling on an MSP. It’s why serving more clients has always meant hiring more people, and why the smallest teams feel it worst. Every client you add multiplies the stitching. The tools scale fine. The manual assembly doesn’t.

What actually changes when tools connect

The last post we published covered MCP, the common way an assistant connects to the tools and data you already run. Here’s why that matters on a Tuesday morning:

When your tools are reachable through that layer, retrieval and reconciliation stop being your job. You ask in one prompt: Give me the posture summary for this client across all their tools, and show me where coverage is missing. The assistant goes and gets it from every connected source and hands back the assembled answer. The morning of clicking becomes a sentence, a quick review, and maybe some back and forth to prepare for showtime.

Notice what didn’t change. You still read the answer with a professional eye. You still decide what it means and what to do about it. What’s gone is the hour of mechanical work sitting between you and the point where your judgment is worth more.

What flexibility looks like

Capacity without headcount: When per-client reporting drops from hours to minutes, the same lean team covers more clients well. That’s growth that doesn’t require hiring ahead of revenue.

Answers during the call: A client asks something pointed. Instead of “let me pull that together and get back to you,” you ask it live and answer before you hang up.

Consistency (which is the quiet one): When thorough costs hours, thorough goes to your biggest accounts and everyone else gets skipped. When thorough costs a sentence, every client gets the same treatment. The small client stops slipping through.

More questions, asked more often: The right questions are answered proactively. You catch a client drifting in the wrong direction this month instead of finding out at the next incident.

Follow the thread instead of building a report

Start broad. Which of my clients are worst on email security right now? Read the answer, then narrow. Of those, which also have no working backup? Then act. Draft me a plain summary I can send each of them.

No new report to build, no new view to configure. You’re thinking out loud and the data keeps up with you. A fixed screen never did that.

It removes the administrative tax, not the expertise

This doesn’t replace knowing your craft. The assistant assembles the picture. Reading it correctly, weighing the tradeoffs, and deciding what a client actually needs is still the work, and it’s still yours.

What goes away is the retrieval tax. The unbillable, unrewarding hours spent gathering and reconciling before any thinking can start. Spending your scarcest resource, expert attention, on copy and paste was never a good trade.

One thing so it isn’t a surprise later: This only works if something has already reconciled your tools. Point an AI assistant at a dozen disconnected consoles and you get a dozen disconnected answers plus the same reconciliation problem, now with an extra step. This can result in reading the output the way you’d read a report from a junior tech. Of course, always check it before you send it.

Where Cork fits

Cork has already done the reconciliation. We connect the tools you run into one cross-referenced source of truth, and we expose an MCP connection on top of that. Your question runs against the whole picture instead of one tool at a time, using whatever assistant your team prefers.

If you’re on the client side of this, it explains something you’ve probably noticed about the best providers. They answer fast, they show up to the review with real analysis instead of a canned deck, and nothing seems to take a week. That isn’t a bigger team behind the scenes. It’s a shorter distance between a question and its answer.

The distance is the whole point

The old promise was more dashboards. More screens, more places to look. The real win turns out to be the opposite. Collapse the distance between a question and its answer until there’s almost nothing left of it.

That distance is where MSP hours go to die. Closing it is what operational flexibility actually means, and it’s available now with the tools you already own.

Ask a room of MSPs how many of their clients carry cyber insurance, and it is unlikely that you will get a clean number back. What comes through instead is a pattern. A lot of small and midsize businesses do not carry it, and most of the ones who skip it have never really understood why it matters in the first place. The exact percentage moves around. The underlying truth does not. For the majority of SMBs, cyber insurance is either absent or barely understood. That gap is sitting somewhere in your client base right now.

Most MSPs treat that gap as an awkward subject. Something adjacent to their job, a little outside their lane, a conversation easier to leave alone. That instinct is understandable, and it is also backwards. The under-covered part of your book is not a problem to work around. It is the most valuable conversation you are not having.

Subscribe now

Why the gap gets avoided

At face-value, the avoidance makes sense. Insurance feels like someone else’s product. Bringing it up feels like selling something you are not licensed to sell. The conversation itself can feel heavy, so it slips down the list behind the ticket queue and the next onboarding.

However, MSPs must step back and look at what the gap actually means. It is real financial exposure sitting on clients whose security you are already responsible for managing. If one of those uninsured clients takes a ransomware hit or a wire fraud loss, the fallout does not stay neatly in their lane. It becomes your emergency, your late nights, and often your blame, whether or not the incident was anything you could have prevented. The gap is already your problem. The only question is whether you engage with it before an incident or while evaluating the aftermath.

It is the same instinct you already trust

Here is the reframe that makes it easy.

You already sell clients tools they do not fully use on day one. You recommend the backup, the EDR, the security training, all because you know the client needs the protection even when they have not asked for it. Closing the insurance and financial protection gap is the same instinct, pointed at the same goal. Protect the client, and strengthen the relationship in the process.

The easiest version of this conversation is not the client who is already covered. It is the one who is not. They are at risk whether they know it or not. You are the person they already trust with this category. You do not have to manufacture a need. You just have to point out the one is already there.

The line you do not cross

This only works if you are clear about what you are and are not doing, so say it plainly to yourself and to the client. You are not becoming an insurance broker. MSPs are not permitted to sell insurance or advise clients on what policy to buy, and you should not try.

What you can do is different and entirely within bounds. You can start the conversation. You can show a client where they actually stand on security posture, which is where any honest insurance discussion should begin. Then, you can connect them to a broker who specializes in this, so the actual insurance decision is made by someone qualified to make it. You are the facilitator who opens the door, never the advisor who walks them through it. Held to that line, the conversation is a service, not a sales pitch.

What makes the gap closeable

Two things turn this from a nice idea into something a client can act on.

1. Visibility into posture: An insurance conversation that starts with “here is what your security actually looks like right now” is a real conversation. One that starts with a generic warning is not. Being able to show a client their posture, clearly and specifically, is what gives the discussion weight and gives a broker something concrete to work from.

2. Financial protection as a wrapper around the whole thing: This is where Cork Protect fits. It provides financial coverage toward specific covered incidents, things like ransomware, wire transfer fraud, and SMS phishing scams, including coverage toward a client’s cyber insurance deductible if a covered incident occurs. It is worth being precise here, because overpromising helps no one. The coverage applies to defined incident types, and the deductible benefit only pays off for a client who actually carries a policy. Named accurately, it is a genuine layer of financial resilience you can place on a client’s account regardless of where they land on insurance itself.

Everyone comes out ahead

Play it forward and both kinds of client benefit. The uninsured client goes from fully exposed to carrying real financial protection, and gains a clear-eyed view of whether a policy makes sense for them. The already-insured client gets a sharper picture of their posture and, often, a better-structured relationship with their coverage. Either way, you did not attempt to sell insurance. In both cases, you delivered something valuable, which is exactly the kind of thing that earns the right to a pricing conversation later. Value first. Price second.

If you are on the client side reading this, the takeaway is calmer than the usual cyber insurance noise. Most businesses like yours either skip this entirely or carry it without fully understanding it, so you are not alone either way. The point is not to panic-buy a policy. It is to know where you actually stand, and to have protection in place either way.

The most valuable conversation in your book

The under-covered part of your client base is not a gap to tiptoe around. It is a room full of people who trust you, carry a real exposure, and have not been given a clear, low-pressure way to think about it. Being the one who opens that door, honestly and within your lane, is some of the highest-value work available to you right now.

The gap was never the obstacle. It was the opening.

“Patch everything” is not a strategy. It is a wish. Every environment has more vulnerabilities than any team can close in a week, which means the real question is never whether you have vulnerabilities. It is which ones actually matter, and where to point your limited time first.

The reassuring news is that risk is not random. It has a shape. A lot of what creates that shape is set by something as mundane as what industry your client is in, and what ordinary software everyone in that industry happens to run.

Subscribe now

Every industry has a signature

Look across a large number of managed environments and a pattern emerges that is hard to unsee. Each industry tends to have a characteristic piece of software that shows up, again and again, as the most common carrier of active vulnerabilities. It is rarely exotic or particularly interesting. It is almost always something boring and everywhere.

In the environments Cork sees across its partner base, the patterns break down along a few clear lines.

Remote access and VPN clients dominate several sectors. Cisco Secure Client turns up as the most common vulnerable software in construction, in finance and insurance, and in retail, among others. SonicWall NetExtender leads in health care and in real estate. These are the tools everyone connects through to get work done, which is exactly why they are both everywhere and attractive to threat actors.

PDF readers own another large slice. Adobe Acrobat Reader and Foxit PDF Reader are the top vulnerable software in education, public administration, arts and entertainment, information, and transportation. Every desktop has one. Almost nobody thinks of it as security-critical. It opens files from outside the organization all day long.

Database servers show up in the industries built on data. Microsoft SQL Server is the most common vulnerable software in manufacturing and in professional, scientific, and technical services, sitting quietly behind the line-of-business applications those firms depend on.

Why the “boring” software is the risky software

There is a reason the pattern lands on ordinary tools rather than flashier ones.

First, they are everywhere. A vulnerability in software installed on one machine is a footnote. The same vulnerability in software installed on every machine is a campaign waiting to happen.

Second, they handle untrusted input or face the internet. A VPN client is a front door by design. A PDF reader opens documents from strangers all day. A database server is the thing worth stealing. These are not incidental targets. They are the point.

Third, they patch on their own schedule, not the operating system’s. Everyone has a process for OS updates. Far fewer have a reliable process for keeping the PDF reader, the VPN client, and the database engine current across a whole client base. That gap between “we patch” and “we patch everything” is where the exposure lives.

Not all vulnerabilities are equal: the KEV signal

This is where a single idea does more prioritization work than any scanner. Known Exploited Vulnerabilities.

The KEV catalog, maintained by the US Cybersecurity and Infrastructure Security Agency and VulnCheck , is a list of vulnerabilities confirmed to be under active exploitation in the real world. Not theoretical. Not “could be dangerous.” Being used, right now, by actual attackers.

That distinction changes how you triage. A vulnerability with a scary score that nobody is exploiting can wait. However, a vulnerability on the KEV list is a door someone is actively trying to walk through. When one of those lands in the everyday software your industry runs on, that is not a maintenance item. That is the thing to prioritize fixing today.

When you put the two ideas together, you get a genuinely short, genuinely useful list.

• Which of my clients run the software my industry is most exposed on?

• Which of those carry an actively exploited vulnerability that is still unpatched?

Answer those questions, and you have found the handful of things most likely to cause a real incident. This prioritization gets you ahead of everyone still trying to patch everything at once.

Turning the pattern into action

The obstacle has never been the concept. It has been the legwork. Answering that question the manual way means inventorying software across every client, cross-referencing it against exploited-vulnerability lists, and figuring out what is actually patched. For a small team across a large book, that is not realistic to do often, so it does not get done.

This is where surfacing vulnerabilities across the connected stack earns its keep. Cork finds the software vulnerabilities living across the tools you already run, ties them to specific endpoints and clients, and lets you act on them, including pushing patches through your RMM and package managers rather than touching each machine by hand. The prioritization stops being a research project and becomes a working list.

If you are on the client side of this, the takeaway is a question worth asking your provider. What are the common exposures for a business like mine, and are we carrying any that are actively being exploited right now? A provider who can answer that clearly is one who is triaging by real-world risk, not by whatever the scanner happened to sort to the top.

Risk has a shape, so use it

The point of all this is not to fear a specific product. Cisco, SonicWall, Adobe, Foxit, and Microsoft build software the entire economy runs on, and being common is not the same as being bad. It is that risk concentrates, predictably, in the tools an industry cannot operate without.

That predictability is a gift. It means you do not have to defend everything equally. You can look at what your industry actually runs, find the pieces carrying vulnerabilities the world is actively exploiting, and start prioritizing there.

Patch by priority, not by panic. The list is more reasonable to manage than it feels.

Think about how you get an answer out of your stack today. Let’s say a client asks a fair question: are all of our machines actually protected? To answer it honestly, you log into the EDR and pull a list. Log into the RMM and pull another. Export both. Line them up in a spreadsheet. Find the machines that appear in one and not the other. An hour later you have an answer that includes information from just two of your security tools, and it is already slightly out of date.

The data was never the problem. It was all right there. The problem was the work of getting an answer out of it. That is the specific thing that is changing, and the name for what is changing it is MCP.

Subscribe now

What MCP actually is (and what it isn’t)

What it is: MCP stands for Model Context Protocol. Strip away the acronym and it is a simple idea. It is a common way for an AI assistant to connect to the tools and data you already use.

The useful analogy is USB-C. Before a universal connector existed, every device needed its own special cable, and nothing quite fit together. MCP is that universal connector, but for AI platforms. It gives an assistant a standard way to plug into a system, ask it for information, and get a structured answer back. Once a tool speaks MCP, any assistant that speaks MCP can work with it.

That last point matters more than it sounds. MCP is not tied to one AI company or one product. It is an open standard, which means you are not locking yourself into a single vendor’s assistant to get the benefit. You can use the tool you prefer today and a different one next year, and the connection to your data still works.

What it isn’t: MCP is not a new dashboard to learn. There is no console to master. The interface is a plain-language question. It is not a replacement for your tools. MCP is the layer that lets you ask about them, not a substitute for them.

Also, it is not your data being handed off somewhere to train a model. A connection through MCP is you pointing your own assistant at your own systems to answer your own questions. You stay in control of what it can see and what it can do.

Why this matters for an MSP specifically

Every MSP lives the same reality. You do not have a data shortage. You have a data-scattered-across-a-dozen-tools problem. The friction is never finding whether the answer exists. It is assembling it from pieces that live in different places and do not talk to each other.

That is exactly the friction MCP removes. Instead of logging into each tool and stitching the pieces together by hand, you ask a question once, and an assistant connected through MCP pulls what it needs from the connected sources and hands you the answer. The hour of exporting and reconciling becomes a sentence.

Picture the questions you would actually ask:

• Which clients have an endpoint missing EDR right now?

• Which mailboxes got added this month but never made it into the email security policy?

• Which of my clients are trending in the wrong direction on their security posture?

These are the questions you already want answered and rarely have time to chase down. MCP is what makes them a quick ask instead of an afternoon.

Where Cork fits

Here is why this pairs naturally with the way Cork already works.

The value of asking a question across your stack depends entirely on something behind the scenes having already unified that stack. If your tools are still a dozen separate islands, an assistant has a dozen separate places to go and no way to reconcile them, and that’s only if it’s possible to connect into them directly. Cork has already done that reconciliation. It connects to the tools you run and cross-references them into one source of truth.

So, when you connect your AI platform of choice to Cork through its MCP connection, you are not querying one tool at a time. You are asking questions against the whole cross-referenced picture, the same unified view that surfaces your coverage gaps and your wasted spend. Since Cork’s connection is built to be assistant-agnostic, you bring whatever AI tool your team already prefers.

Regarding the questions you may usually ask, here’s how Cork answers them:

Which clients have an endpoint missing EDR right now?
Cork is already matching every device your RMM sees against every device your EDR sees, so the answer is the list of machines that appear in one and not the other, with how long each has been that way.

Which mailboxes got added this month but never made it into the email security policy?
Cork tracks every inbox in the tenant against what the email security tool is actually covering, and stamps each gap with the date it opened, so scoping it to this month is part of the same question.

Which of my clients are trending in the wrong direction on their security posture?
Cork scores every client daily and keeps the history, so the answer is which scores moved down and which specific gap moved them.

The one honest caveat

An answer is only as good as the data underneath it. This is the through-line of everything in this series. If your visibility is incomplete, a fast answer just gets you to a wrong conclusion faster. Getting the stack seen clearly comes first. Once it is, the ability to question it in plain language is what turns that visibility into something you use every day rather than a report you glance at once a quarter.

It is also worth saying that the assistant gives you the answer, not the decision. It can tell you which endpoints are exposed. Deciding what to do about them is still your job, and should be what you bring to the table.

The shift worth noticing

For years, the promise was better dashboards: More screens, more charts, more places to look. The shift underneath MCP is different. It moves you from hunting for answers to simply asking for them, reducing the need for tabbing between dashboards and learning what pages to export.

If you are not an MSP but you rely on one, this is quietly good news for you too. It means the provider protecting your business can answer real questions about your environment in minutes instead of days, which is the difference between security you are told about and security you can actually see. This also gives them more times to consider how technology can impact your business needs.

This post is the on-ramp to discussing the real value an MCP connection can bring. In a later piece we will get concrete about what it looks like to go from ten open dashboards to a single question, and how that reshapes the daily work. For now, take a look at the Prompt Distillery we created to get our partners started.

Your security data can answer questions now. You just have to ask.

Somewhere in your client base right now, a tool is checking in, reporting for duty, and doing nothing useful. Nobody is using it. Nobody remembers turning it on. And every month, it bills.

This is not an edge case. It is one of the most common and least discussed line items in a managed services business. The tools you stop needing rarely announce it. They just keep running, and keep charging.

Subscribe now

How the waste gets in

Two situations create almost all of it, and both are routine.

The first is offboarding. A client leaves, or a set of users gets cut, and the accounts get closed on the front end. But the seat in the EDR, the mailbox in the email security tool, the endpoint in the backup platform, those do not always get cleaned up in the same motion. The client is gone. The license is not. It keeps checking in, and it keeps appearing on the bill, sometimes for months.

The second is tool migration. You move a client from one platform to another. The new tool goes in, everyone confirms it is working, and the project is declared done. What often does not happen is the last step: fully decommissioning the old tool on every machine. A handful of endpoints keep running the platform you thought you left behind. Two tools now cover the same job. You pay for both.

Neither of these is negligence. They are the natural residue of a busy operation where the urgent work is standing things up, not tearing them down.

Why you cannot see it from inside any one tool

The reason this spend stays hidden is the same reason coverage gaps stay hidden. Each tool only sees itself.

The old platform left running after a migration is, from its own point of view, perfectly healthy. It is installed, it is checking in, its dashboard is green. It has no idea it was supposed to be retired. It will report itself as active indefinitely, because nothing inside it knows the decision to replace it was ever made.

The only way to catch it is to look across tools at once. To line up what is still checking in against what should still be there, and flag the difference. That comparison is exactly what no single console can perform, which is why the waste survives quarter after quarter in stacks that otherwise look well run.

This is recoverable money, not a sunk cost

Here is the part that changes how you think about it. This is not spend you have to accept. It is money sitting inside a stack you already own, waiting to be found.

Cross-reference your connected tools against a time window, say 60 or 90 days, and ask a direct question. What is still checking in that has no business doing so? The seats that outlived an offboarding. The platform that survived a migration. Draw a line at, for example, day 91, and anything still reporting past it that should have been retired becomes a candidate to cut.

For a lot of MSPs the first pass alone recovers enough to pay for the effort several times over. This is not a one-time cleanup. Run the same comparison on a rhythm and the waste never gets the chance to accumulate again.

The client-facing upside

Recovered margin is the obvious win. The less obvious one is what this does for client trust.

Most QBRs are a mix of reassurance and upsell. A savings finding is neither. It is you walking into the room and handing the client money back, with a clear reason attached. You were paying for this, it was doing nothing, we turned it off. There is no spin to see through. It is the kind of moment that makes a client believe you are watching their spend as closely as their security, which is exactly the relationship that survives a budget review.

There is a security angle too. Every orphaned tool and stale license is one more thing in the environment that nobody is managing. Clearing them out does not just cut cost. It shrinks the surface area of things that can quietly break, get exploited, or muddy the picture when you are trying to see the stack clearly.

How Cork surfaces it

This is one of the places the cross-referencing approach pays off in plain dollars. Since Cork connects to the tools you already run and compares them against one another, it can surface savings opportunities directly. The licenses still checking in that map to no active need. The leftovers from offboarding and migration. The seats you are paying for and not using.

The output is not another report to interpret. It is a list of specific things you can act on, tied to specific clients, with the wasted spend attached. Some partners leveraging this today think of it less as a savings feature and more as a decommissioning tool, because that is what it does. It tells you what to turn off.

The audit worth running this quarter

You can start without any new tooling at all. Pick your three largest clients. For each, list every security tool you believe is active, then check it against what is actually checking in today. Look specifically for anything tied to a user who left or a platform you migrated away from.

Whatever you find is money you were spending for nothing, and now get back. Do it once and it is a nice recovery. Build it into how you run, and it becomes a permanent line of margin you were leaving on the table.

You cannot recover spend you cannot see. The good news is that seeing it is the hard part, and it is very findable.

Most monitoring answers one question. Is the tool installed, yes or no? Green check, you’re covered. Red X, go reinstall. It is clean, it is binary, and it is where a surprising amount of risk hides.

Since installed and working are not the same question. A tool can be deployed on every endpoint you expect, show up as present in your RMM, and still be quietly failing to do the one job you are paying it to do.

Subscribe now

A story most MSPs will recognize

Here is a pattern that plays out more often than anyone likes to admit.

A client was certain their EDR was deployed everywhere. Their RMM confirmed it. The agent showed installed across every endpoint, so as far as the team was concerned, those machines were protected. Case closed.

Then they started getting flagged that the tool was not checking in on a set of those same assets. The pushback was immediate: It is installed, I can see it right there. The reply was the part that stuck. We are not telling you it is not installed. We are telling you it is not checking in. Then, an audible pause fills the room. Those are two different things.

The tool was there. It just was not working. We can’t expect everything to work the way it is the day it was installed, that’s just not how technology works. Once they dug in and fixed it, a wave of tickets that had been quietly piling up closed out. The experience changed how they ran monitoring from that day forward. The question was no longer “is it installed.” It was “is it connected and actually reporting.”

Installed, configured, working: three different questions

It helps to separate what a green checkmark actually promises from what you assume it promises.

Installed means the software is present on the machine. That is all it means. It does not mean the agent is checking in. It does not mean it is configured correctly. It does not mean it is sending data anywhere that anyone is watching. And it does not mean it is catching what it is supposed to catch.

Each of those is a separate condition, and a tool can pass the first and fail the rest. An EDR agent that stopped checking in after an OS update. A backup that runs on schedule but has been silently failing for six weeks. An email security policy applied to the domain but never extended to a batch of new mailboxes. In every case the dashboard says present. Reality says exposed.

Why the binary view feels safe

RMM and single-tool dashboards are built to answer the binary question, and they answer it well. Installed or not installed. That simplicity is exactly why it feels reassuring, and exactly why it is incomplete.

A yes-or-no view cannot tell you about degradation. It cannot tell you the agent went dark three days ago, because from its point of view the agent is still technically there. It cannot tell you that two tools disagree about the same machine. The binary view is comfortable precisely because it never surfaces the uncomfortable middle, the place where a tool is installed, looks fine, and has stopped doing its job.

That comfort has a name worth being honest about. It is the assumption that deployed equals protected. Most of the time it holds. The trouble is that the times it does not are invisible until something forces them into view.

What it costs when installed is not working

A tool that is installed but not working is in some ways worse than a tool you know is missing, because a known gap gets fixed and an invisible one just sits there waiting to be exploited.

The risk is obvious once you say it out loud: the endpoint everyone believed was covered is the one with no live protection. If an incident lands there, it lands on the machine that was at risk while appearing in compliance. If that client carries financial protection where that control is required for coverage, an unresolved gap on the exact asset that was compromised is precisely the kind of thing that can put a claim in jeopardy… at the worst possible moment.

Every one of those silent failures is generating friction in an MSPs operations:

• Tickets that do not quite add up.

• Alerts that never fire, because the thing that should fire them is offline.

• Teams spend real hours chasing the symptoms of a tool that simply stopped reporting, without ever suspecting the tool itself.

These points represents a quieter cost that is rarely considered.

Monitor connection, not just presence

The shift is not complicated, but it changes everything downstream. Stop monitoring whether tools are installed. Start monitoring whether they are connected and reporting.

That means treating “checking in” as the real signal, not “present.” It means cross-referencing your tools against each other, so when your RMM says a machine exists but your EDR has not heard from it in days, that disagreement surfaces on its own instead of waiting for an incident to reveal it. The gaps that matter almost always live in the space between two tools, and no single tool can see that space.

This is the layer Cork Vantage sits on. Rather than asking each tool whether it is installed, Cork watches whether the tools you already run are actually checking in, and flags the assets where they are not. Not “the agent is missing,” but “the agent is there and has gone quiet.” That is the alert that closes tickets before they become incidents, and it is the difference between a stack you assume is working versus proving that everything is in place as expected.

The question to ask this week

Pick one tool you consider fully deployed across your client base. Now ask a harder question about it. Not “is it installed everywhere,” but “is it checking in and reporting everywhere, today?”

If the answer is a confident yes, backed by something more than a green checkmark, you are in good shape. If the honest answer is “it should be,” that gap is worth finding now, on your terms, rather than during an incident on someone else’s.

Installed is a starting point. Working is the whole game.

At Cork Cyber, we proactively monitor over a million devices to safeguard against threats. As part of this effort, we analyze software inventories across these devices that come from RMMs and other tools to identify vulnerabilities and potential risks. Discover how your industry’s sanitation practices compare to others and uncover potential, concerning issues within your own environment that you might be overlooking.

Subscribe now

Which industries are managing these vulnerabilities the best?

When we look at the different vulnerabilities among sectors, one industry stands out for its effective sanitization of software vulnerabilities compared to the rest: educational services. Out of a sample of 7,000 devices, only 15.2% devices found to have a vulnerability (routine to critical). This sector’s success is driven by a conversion towards cloud-centric OS environments (such as ChromeOS) and centralized management tools. Chromebooks alone were found to reduce support labor by 92% in comparison to standard desktops and laptops. In comparison to the healthcare and social assistance sector, the difference is alarming. In a much larger sample size of 38,793 devices we found more than a third (34.4%) of devices contained some sort of vulnerability. A device in a healthcare setting is more than twice as likely to be vulnerable as one in a classroom, despite much more at stake. For context, across all sectors we found on average 29.3% of devices are considered vulnerable.

So, what exactly are triggering these alarms?

When we look beyond the standard browser-based threats that affect every user, the most critical risks are seen in the operational tools industries rely on daily: VPNs, PDF Readers, and database management systems. While browser vulnerabilities are frequent, they are often low in severity due to auto-updates. Many times a user has multiple browsers installed in which they keep their browser of choice updated, while the other browsers remain out of date due to never opening them. The real “silent killers” are the infrastructure tools that facilitate remote work and storage; software that is often trusted, installed, and then forgotten.

In the healthcare sector, our most concerning finding is the massive prevalence of vulnerable SonicWall NetExtender clients (1,358 devices). Just this year there has been a surge in attacks where threat actors have exploited defects such as CVE-2024-40766 and CVE-2024-53704 to bypass multi-factor authentication entirely. By targeting these unpatched clients, attackers can hijack active SSL VPN sessions to infiltrate into networks with the same permissions as a doctor or administrator. A breach here doesn’t stop a sale or cause downtime, it puts patient care and safety at risk. If an unpatched NetExtender client lets ransomware in, it could lock up patient histories, delay surgeries and more, making the management of these vulnerabilities an absolute necessity. In 2025 it was found that 72% of U.S. healthcare organizations that faced a cyberattack had a disruption to patient care.

The financial and construction sectors face a different but equally dangerous VPN hurdle, with a heavy reliance on Cisco Secure Client (formerly AnyConnect). These industries often rely on Cisco because of it being a trusted industry standard for enterprise security, however, its large prevalence also makes it a prime target. When hundreds of devices are left unpatched, it makes a backdoor into the network much easier. A compromised VPN could allow attackers to steal proprietary blueprints and bid data in the construction industry. In finance the stakes are even higher with the ability to steal clients’ financial records. In 2025 the “Velvet Ant” group targeted many sectors, including financial, to steal sensitive records and intellectual property by exploiting Cisco vulnerabilities and others. By utilizing these specific VPN flaws, they were estimated to have stolen over $244 million by late 2025.

However not all threats come via remote access tools. The professional, scientific, and technical services sector as well as the manufacturing sector’s danger lies deep within the backend. For Microsoft SQL Server 2019 alone, we found 2,768 vulnerable devices in the former and 1,028 vulnerable devices in the latter. Leaving these vulnerabilities unattended can allow hackers to not only steal sensitive client records, they can also deploy ransomware to encrypt the database files. The compromised business is then threatened to either pay a ransom fee or have their files leaked on the internet and files remain encrypted. It’s very easy for this to lead to the end of many small businesses. Half of all small businesses only have enough cash to stay open on average for 27 days with no income. Meanwhile, the average length of recovery for a ransomware attack in 2025 was up to 27 days.

Lastly, out of date PDF readers were the third biggest point of entry among various sectors. While these tools are viewed as harmless utilities, a single unpatched reader can turn a routine document review into a full network compromise. We found 161 devices in the educational services sector with a Foxit PDF Reader vulnerability as well as 341 devices utilizing Adobe Acrobat Reader in the public administration sector with a vulnerability. Threat actors have been seen exploiting these flaws and embedding malicious code into what seems to be innocent PDF assignments or administrative forms. When a teacher or administrator opens the file, the exploit triggers silently in the background executing code that can deploy spyware like Recmos RAT (remote access trojan) to harvest credentials. Not only does this compromise personal administrative records, but it also affects student records alike. RAT’s such as Recmos allow webcams and microphones to be remotely activated which can also threaten the safety of minors.

Do you truly know what lives on your network?

The vulnerabilities we’ve discussed so far on SQL servers, corporate VPNs, and PDF readers are all business-critical tools. It comes as no surprise they are installed; they are essential for operations. But the question every business leader and MSP must ask is: are you aware of everything else?

Some businesses allow individuals to bring their own device (BYOD), but if devices aren’t properly monitored and sanitized, the corporate networks drastically become at risk. It takes only one compromised device running unauthorized or vulnerable software to bridge the gap between a secure environment and the public internet. While analyzing vulnerabilities and software inventories we’ve found many employees treating company assets like personal laptops, introducing significant risk.

One of the most frequent unauthorized categories we observed was the presence of personal VPNs. We found about 4,000 instances of ExpressVPN, NordVPN, Surkshark, and Private Internet Access installed on corporate workstations. While employees may have legitimate reasons to have these installed, it creates a “blind spot” where data can be exfiltrated (or malware introduced) without the security team ever seeing it happen.

Even more concerning was the presence of torrent clients (such as Deluge uTorrent) and other peer-to-peer file sharing software. This isn’t just a potential legal issue regarding copyrighted material, it’s a direct pipeline for identity theft. According to a 2024 report by Flare, nearly 41% of all stolen credentials sold on the Dark Web originated from devices infected via pirated software and P2P games.

However not every unauthorized app we found was “malicious”, more so reminders that everyone is human. Across all industries we found thousands of installs of Spotify and other personal media software. We also checked for the presence of applications associated with gaming such as Steam, Epic Games, and Discord. While gaming software is more expected in education environments, its prevalence in the information sector (also seen in other business orientated sectors) exposes a critical gap in endpoint management.

MSPs must take it upon themselves to better enforce strict software policies on corporate assets. Whether operating under a BYOD policy or simply failing to lock down corporate hardware, the lack of proper monitoring and sanitization puts networks at drastic risks. They need to both block unauthorized executables and question why recreational software is being run on devices intended for secure business operations.

What can you do to be aware of these issues?

Awareness is the first line of defense; you cannot patch what you do not know exists. The NIST Cybersecurity Framework (CSF) 2.0 is a great reference to ensure you are checking all boxes. In short you need to: maintain a complete software inventory, implement continuous vulnerability monitoring, and adopt an enterprise patch strategy.

Continuous monitoring can feel like a massive undertaking, largely because standard RMMs fall short. Most tools focus strictly on Windows updates and popular apps like Chrome, leaving you to manually track patches for everything else. To bridge this gap, Cork developed its own software vulnerabilities tool to help provide suggestions and comprehensive visibility that traditional RMMs miss.

Rather than focusing solely on popular applications, Cork evaluates your entire software inventory. It maps your software against official vulnerabilities from the National Vulnerability Database (NVD) by NIST and cross-references them with emerging threats actively being exploited and identified on the dark web. Instead of just flagging the problem that others miss, Cork also gives clear remediation steps for each CVE that is detected and the easiest way to solve the vulnerability.

Visit corkinc.com to learn more, or schedule a live demo with the team to see your hidden vulnerabilities today.

Ask an MSP how many security tools they run across their client base, and watch the pause before the answer. Most can name the big ones without thinking. EDR, RMM, email security, backup, identity. Then the list gets fuzzy. There’s the platform they migrated off last year that might still be checking in somewhere. The tool one client insisted on. The point solution that came with an acquisition. The trial that quietly converted to a paid plan.

That pause is the whole problem. If you can’t say with confidence what is deployed on every endpoint today, you can’t protect it, you can’t prove it, and you are almost certainly paying for pieces of it you no longer use.

Nobody built this stack on purpose

No MSP sat down and designed a sprawling toolset. It grew by accretion.

Every new threat in the last five years added a tool. Every acquisition added a tool. Every uncomfortable QBR where a client asked a question you couldn’t answer added a tool. Here is the part that does the damage: almost nothing ever gets removed. Tools go in. They rarely come out.

The result looks reassuring from the outside. A long list of capabilities. A console for everything. A vendor for every category. On paper, it reads as comprehensive.

Underneath, it is a different picture. The same growth that made the stack look complete is what makes it impossible to see clearly. You are not running one system. You are running a dozen systems that don’t talk to each other, each with its own console, its own definition of “covered,” and its own idea of what a healthy client looks like.

One pane of glass per product

The industry sold MSPs on the single pane of glass for years. What most teams actually got was one pane of glass per product.

Each tool shows you its own slice of reality and nothing else. Your EDR tells you about the endpoints it knows about. Your RMM tells you what it has an agent on. Your email security reports on the mailboxes it protects. None of them tell you where they disagree. And the disagreements are exactly where the risk lives.

Consider a simple question. Is every endpoint you bill for actually protected by every tool it should have? To answer that honestly, you would need to line up your RMM inventory against your EDR coverage against your backup reporting against your identity platform, and find the places where one tool sees a device the others don’t. No single console can do that, because no single console can see outside itself. So the question usually goes unanswered, and “installed” gets treated as “working” until something proves otherwise.

The two costs of not seeing

A stack you can’t see clearly bills you twice.

The first cost is risk. Coverage gaps hide in the seams between tools. A device that fell out of the RMM but still shows in the EDR. A new employee whose mailbox never got added to the email security tool. A client environment from a migration that was never fully cut over. Each gap is small. Each is invisible unless something cross-references the tools against each other. And each is the kind of gap that turns into an incident, or into a denied claim at the exact moment a client needed their protection to hold.

The second cost is money, and it is more immediate than most teams realize. Orphaned agents keep checking in. Licenses for clients you offboarded months ago keep billing. The platform you migrated away from is still running on a handful of machines nobody flagged. This is spend leaving the business every month for tools delivering zero value. And you cannot recover spend you cannot see.

For a lot of MSPs, closing that second gap alone pays for the effort of getting visibility in the first place. It is found money sitting inside the stack you already own.

If you rely on an MSP, this is your question too

If you are not an MSP but you depend on one, this matters to you directly. You are trusting a provider to keep your business secure, and the honest test of that trust is not the length of their tool list. It is whether they can show you, clearly, what is protecting you right now and where the gaps are.

The best providers welcome that question. They can pull up a single view of your environment, point to what is covered, name what is not, and tell you what they are doing about it. A provider who can only answer one tool at a time, or who needs a week to assemble the picture by hand, is telling you something important about how well they can see their own operation, and by extension yours.

Visibility is the foundation, not a feature

Here is the reframe that changes how you run a security practice. Visibility is not one more capability to bolt onto the stack. It is the layer underneath everything else, the thing that makes the rest of the stack trustworthy.

You can’t remediate a gap you don’t know exists. You can’t prove protection to a client from a dozen disconnected reports. You can’t recover wasted spend you can’t find. You can’t have the confident business conversation, the kind that actually truly impacts a clients business, when you are not sure what is running.

This is the whole idea behind how Cork approaches the problem. Rather than adding another tool with another console, Cork connects to the tools you already run and cross-references them against one another, agentless and API-based. The point is not more data. It is one source of truth across the stack, so the coverage gaps surface on their own, the wasted licenses become visible, and “what is actually deployed” stops being a question you have to guess at. From there, financial protection has something solid to sit on, because you can proactively prove the posture behind it.

That is the shift from a stack you hope is working to a stack you can prove is working with confidence.

Start with one honest question

You don’t need a project plan to begin. You need one honest question, asked across your whole client base at once. What is actually deployed and checking in right now, and where do my tools disagree?

If you can answer that today, you are ahead of most of the market. If you can’t, that gap is not a failing. It is the most valuable place you could point your attention this quarter. Everything else in a security practice, the protection, the proof, the profitability, gets easier the moment you can see clearly.

The tools you can’t see are not neutral. They are the ones costing you, in risk and in dollars. Seeing them is where the work starts.

They can tell you what they bought. The firewall. The antivirus. The email filter. What they can’t tell you is whether any of it is working, whether the gaps from last year are closed, or whether the number that matters most, their actual risk, is moving in the right direction.

That is the problem with how most organizations think about security. They treat it as a project. Something you do once, check off, and forget. But security was never a destination you arrive at. It is a posture you hold, and posture drifts the moment you stop paying attention.

The mindset shift

Three ideas sit underneath everything else.

Security is an ongoing process, not a set-and-forget purchase. Your attack surface grows every time you add a device, hire an employee, or turn on a new cloud app. What was enough last year can be dangerously thin today.

Security has to be woven into how you operate, not bolted on afterward. Every hire, every purchase, every onboarding step either strengthens your posture or quietly weakens it.

And most important: you cannot improve what you cannot measure. Without a way to score where you stand, “getting more secure” is a feeling, not a fact.

So how do you measure something as sprawling as security posture? You break it into dimensions you can actually see.

The four dimensions of security posture

A complete picture of your security health comes from four questions. Each one is a lens. Together they are a system.

1. Are your controls actually working? Not licensed. Not purchased. Working. This is where the first gap almost always shows up. A firewall nobody monitors is not protection. EDR that never got deployed to that one forgotten laptop is not coverage. The details matter here, and they compound: multi-factor authentication alone blocks over 99 percent of automated credential attacks, and more than 90 percent of attacks still start in the inbox.

2. Are policies being followed? The human layer is where most breaches actually happen. Verizon’s Data Breach Investigations Report puts it at 82 percent of breaches involving a human or policy element. Training completions, access reviews, policy acknowledgments. This is unglamorous work, and it is also the difference between a defensible organization and an exposed one.

3. Are known weaknesses getting fixed? Attackers do not need a zero-day when you have left the front door open for a month. Roughly 60 percent of breaches exploit vulnerabilities that are already more than 30 days old. Measuring posture here means knowing your patch windows and holding to them. Critical issues in a day or two. High within a week. Nothing important left to drift.

4. What does your history tell you? Past incidents and claims are not just scars. They are a signal. A pattern of incidents points directly at gaps in the first three dimensions, and it shapes something with real dollars attached: your insurability, your premiums, and the terms carriers are willing to offer you at all.

Why all four, together

Here is the part people miss. No single dimension tells the truth on its own.

A company can have a beautiful security stack and terrible patching habits. Another can pass every compliance check and still have no MFA on a critical account. Strength in one area does not cover weakness in another. You need all four in view at once.

And when you measure them consistently over time, you get the thing that actually matters. Not a snapshot. A trajectory. You stop asking “are we secure,” a question with no honest answer, and start asking “are we getting safer,” a question you can prove.

From four questions to one number

This is the thinking behind the Cork Cyber Score. We take these dimensions and turn them into a single, trackable baseline, the way a credit score turns your financial health into one number you can actually work with and improve over time.

The idea is simple: pick your dimensions, measure them honestly, and watch the direction of travel. The organizations that treat security as something measurable, rather than something they hope is handled, are the ones that sleep better at night.

Security is a journey. The least you can do is know where you stand on the map.

This is the first in a series where we break down how modern organizations measure, track, and improve their cyber posture. Follow along, and visit Cork’s website to learn more!