Written by Dan Candee, CEO of Cork Cyber

A few weeks ago I moderated a panel at the Canadian Risk Summit in Toronto. Before we started, I made one rule: anybody who said “AI” was getting fired off the panel.

I was joking. Mostly.

I wanted to hear what business owners would talk about once the buzzword was off the table. It turned into the best conversation of the trip. One panelist runs a demolition company. She blows up buildings for a living, and she told the room she feels more in control setting off explosives than she does about her own company’s security right now.

Email breaches. Phishing. Software everywhere. Employees who need to feel safe coming to work every day. That’s the weight our MSP partners carry for every client they serve.

Subscribe now

The break-in point moved

Verizon has published its Data Breach Investigations Report for 19 years. This year, for the first time, exploited software vulnerabilities took the top spot as the way attackers get in: 31% of breaches, ahead of stolen credentials and phishing.

The fixes are getting slower, too. The median time to fully fix a known exploited vulnerability went from 32 days to 43.

Here’s how I think about it. Picture every client as a house. The RMM locks the front door, and MSPs do that well. So the bad guys stopped kicking in the front door to steal the family jewels. They come in through the dryer vent, the doggy door and the exhaust pipe on the roof.

That’s the software sitting on top of the operating system. The browser and its plugins. The PDF reader on the front desk PC. The remote access client nobody has touched in two years. The video game somebody installed on a company laptop. Attackers are using AI to find those gaps faster than any MSP can staff against them.

Two jobs wearing one name

We call all of this “patching,” and the word is doing too much work.

Job one is the operating system. The RMM owns it, updates arrive through one channel, and there’s a report you can put in front of a client.

Job two is everything on top. Dozens of vendors, dozens of update paths, no inventory and no report. A fleet can sit at 98% OS compliance and still be full of software attackers already know how to use.

Eleven months ago we decided Cork had to stop reporting on that second job and start doing it. In September we launched automated software vulnerability remediation. Cork finds the vulnerable software across every client, puts what’s actively being exploited first, and fixes it through the RMM the MSP already runs. No new agent. No second console. Nothing to rip out.

What partners did with it

Here’s what happened when we handed partners the keys. Since September 2:

• 50,000+ remediation runs across 200,000 devices

• Most of it on autopilot, through schedules nobody has to babysit

• 97% of those schedules fix every vulnerability Cork can fix, not just the criticals

• Partners scope it per client, to their financially protected clients, or across the whole fleet

That 97% is the number I love most. Partners skipped the one-app-at-a-time approach and pointed it at everything. Give MSPs clear controls and they will happily hand the routine work to the machine.

And the results:

• A critical vulnerability at the average MSP stays open 1.5 to 2 months. On a Cork schedule it’s a couple of hours, under 1% of the old exposure window.

• About 5,100 tech hours saved, roughly $250,000 of labor redeployed to other work. That’s at $48 an hour, so we kept it low.

• We estimate about $1.5 million in potential ransomware losses avoided, modeled on published industry loss averages.

The hours are nice. They’re the by-product. The real win is the MSP owner who sleeps at night and gets the holiday weekend back.

What I’d tell an MSP planning 2027

There’s no cliff coming. Nobody needs a dramatic reinvention next year.

Partners don’t need to be building highways for their clients right now. They need to repaint the stripes on the roads, adjust the lines, and let people know where the passing lane is. Get the basics 3% better month over month: security awareness training, guardrails around AI use, and plain-language updates to clients about what you’re doing for them.

And don’t try to monetize something you don’t fully understand. Just go be of service.

We hold ourselves to the same standard. Nobody at Cork uses an unpaid, unmonitored AI tool. The guardrails are set, and we meet regularly to talk governance and trade what we’re learning. Security is job zero. AI and automation sit on top of it.

Lock the windows

Cork started because we wanted to fix financial protection and be of service to the channel. The mission hasn’t changed: keep money in people’s bank accounts where it belongs and not in the bad guy’s pockets.

So here’s my question for the MSPs reading this: what’s the one window in your clients’ houses you already know is open?

Three of our partners asked us some version of the same question last week.

One had a shared accounting mailbox that several people log into. The client wanted security awareness training turned off for that mailbox. Every person who uses it is trained on their own account. Does that still count?

Subscribe now

Another was rolling out web filtering to their clients and wanted to know if what each client chose to block would affect their financial protection eligibility.

The third had a real incident. A user at a county government client downloaded a trojanized app. The EDR caught it and isolated the machine the same night. The client had paused MFA enrollment while they migrated licensing, and the attack had nothing to do with a login. Does a non-compliant MFA control rule out a claim anyway?

Three different MSPs. Three valid questions. None of them had an obvious answer sitting in front of them.

What a slow answer costs you

When you can’t get a coverage answer quickly, you usually do one of three things.

1. You guess

2. You avoid the topic with the client

3. Or you assume the answer is no and never file.

Guessing means you might tell a client something that isn’t true. Avoiding it means the client never understands what they’re paying for.

Assuming no is the expensive one. When somebody assumed the answer was no, our answer was to submit it anyway. We can’t evaluate a claim that never comes in, and there’s no penalty for submitting one that turns into nothing.

Coverage questions are the normal part

None of those three examples are edge cases. Real client environments can be messy: Mailboxes get shared, controls get paused mid-migration, new tools roll out halfway through the year. Every one of those changes raises a fair question about what’s covered in the event of an unexpected security incident.

A few months ago we wrote about the insurance gap hiding in your client base, and said the under-covered part of your book is the most valuable conversation you’re not having. That conversation stalls fast when you can’t answer the follow-up questions with confidence. Clients ask “what if.” If your answer is “let me find out,” the moment passes.

What we built

We just released the Coverage Assistant in Cork Vantage. To try it out, go to the Claims page and to the left of Submit a Claim there’s a new button: Ask a Coverage Question.

Pick the client, describe the situation in plain language, and you get an answer up front. It knows whether that client has active financial protection, and if they don’t, it tells you that first. You can apply financial protection right from the conversation.

If the answer doesn’t cover everything you need, click Talk to the claims team. That sends your question straight to us as a ticket, so you’re not retyping the whole situation into an email.

One thing so it isn’t a surprise later

The Coverage Assistant gives you a strong read before something happens. It isn’t a claim decision. Final determinations still come from the claims team’s review.

Use it to know where you stand and to have a clear conversation with the client. If something does happen, submit the claim. Here’s how that process works: Understanding the Cork Claims Process.

Where it fits in the client conversation

We’ve said before that financial protection works best as a standing part of what you offer, not an optional line at the bottom of the proposal. The hardest part of positioning it that way has always been the follow-up questions. What about this tool? What if we change that setting? What happens if someone wires money to a fake vendor?

Now you can answer those in the room. A client asks a pointed question during a review, you ask the Coverage Assistant, and you have an answer before you hang up. That’s the difference between a client who has financial protection and a client who understands it.

Ask before you need to

The best time to get a coverage answer is before the incident. Everything about the moment after one is worse: more stress, less time, and a client waiting on you.

Try it this week with a real question you’ve been sitting on. If the answer isn’t what you expected, or you want to talk it through, just click the button to talk to the team!

Pull up your patch compliance report. Odds are it looks good. Ninety-something percent of endpoints current on the operating system, reboots landing inside the window, exceptions documented and defensible. That number is real and you earned it.

Now ask a different question about the same machines. What version is the PDF reader on? The remote access client? The browser your client’s entire staff lives inside for eight hours a day? The database engine running under the line of business app someone installed in 2019 and nobody has touched since?

For most MSPs there is no report that answers that. There is no cycle that keeps it true, and no one whose job it is to check.

Subscribe now

Two jobs wearing one name

The industry has one word for all of this, and the word is doing too much work.

Your RMM patches the operating system. That is a real job and your RMM is good at it. Microsoft ships on a predictable cadence, the updates arrive through one channel, the RMM knows how to stage them, and you already have a reboot window your clients have agreed to. It is a solved problem with an owner and a report.

The software running on top of the operating system is a different job entirely. Dozens of vendors, each on their own release schedule, each with their own update mechanism, none of them coordinated with the others or with the OS cycle. Some update themselves if a user clicks the prompt. Some need an installer pulled down and run. Some have not been opened in eleven months and are sitting four major versions behind.

Same fleet. Same endpoints. A completely different problem. Calling both of them patching is how the second one stays invisible.

The exposure moved and the reporting did not

The 2026 Verizon Data Breach Investigations Report put vulnerability exploitation at the top of the initial access list for the first time in the report’s nineteen year history. It is now the way about a third of breaches start, ahead of credential abuse.

That finding got read across the industry as a patching story, and it is only partly one. The Known Exploited Vulnerabilities catalog is not a list of operating system flaws. It is full of the layer above: VPN clients, file transfer tools, document readers, web frameworks, remote access software. The things attackers reach for are frequently not the things your OS cycle touches.

This means a fleet can realistically sit at ninety-eight percent OS compliance and still be full of software an attacker already knows how to use.

The report is accurate. It is just answering a question that is no longer the whole question.

Why the second job goes unowned

It is not laziness, and not a skills gap. Three structural reasons.

1. There is no inventory. You cannot keep current what you have not enumerated, and most environments have never had a complete, cross-client software inventory that updates itself.

2. There is no single path. The OS has one update channel. The layer above it has as many channels as it has vendors, and stitching those together by hand across a book of clients is a project nobody has time to start.

3. There is no report. This is the quiet one. The OS cycle produces a number you can show a client and put in a QBR. Software currency produces nothing, so it competes for attention against everything that does. What gets measured gets done, and this has not been measured.

Effort alone does not close the gap completely

Here is the part that should change how you think about staffing this.

That same DBIR found the share of known exploited vulnerabilities getting fully remediated went down year over year, not up, and the median time to fully remediate one went up by about a third. Even the strongest programs leave most of their known exploited items open a week after they surface. That ceiling holds across organizations regardless of maturity, budget, or tooling.

Read that carefully. It is not a finding about effort. It is a finding about queue economics. The volume of new exploitable software arriving every month has outrun what any human review cycle can process, and the gap between a vulnerability becoming public and becoming useful to an attacker is now measured in days.

You cannot hire your way across that volume. Adding a technician adds throughput to a queue that is growing faster than the throughput you added, and simply does not scale. The only thing that changes the shape of the problem is removing the human step from the routine cases so your people spend their attention on the exceptions and escalations.

Where Cork fits

Cork does not patch operating systems and has no interest in trying. Your RMM owns that, it does it well, and replacing a working cycle with a second one is not an improvement.

What Cork does is the job sitting above it. We observe the software inventory across every client from the tools you already run, cross reference it against what is actually being exploited in the wild rather than what merely scores high, and then push the updates through package managers using the RMM you already have deployed.

The MSP controls the remediation schedule: scoped to one client or all of them, at any cadence. Limited by software or by severity. Running on a schedule you set, inside a window you choose.

No new agent on the endpoint. No second console. The operating system stays exactly where it is, on your cycle, under your control.

A current fleet and a stale fleet can look identical

That is the whole point of separating the two jobs. On the report you have today, they may look identical. Both show green, but one of them has an entire category of exposure that nothing in the reporting picture is watching.

Naming the second job is the first step. Once you can see the layer above the operating system, keeping it current turns out to be considerably easier than you would expect from how long it has been ignored.

Ask an MSP where the good margin and the loyal clients are, and the answer is almost always the same. Strategic advisory. The vCISO work. Sitting with a client not to fix a ticket but to tell them where they stand, what to prioritize, and what to invest in next (and tying all of this back to their business needs). It is the stickiest, most differentiated, highest-value thing an MSP can offer.

It is also the thing most MSPs cannot scale. You cannot put a seasoned security strategist in every quarterly review across a book of dozens or hundreds of SMBs. There are not enough of those people, and they are not cheap. As a result, the advisory work gets reserved for the largest accounts and quietly skipped for everyone else.

Here is the useful realization. The blocker was never the knowledge. It was time and repeatability. Thankfully, a well-bult workflow can solve this issue. Here, we’ll explore how that can be done.

Subscribe now

What is a vCISO, really?

For anyone outside the acronym, a vCISO is a Virtual Chief Information Security Officer. It is strategic security leadership: where you stand, what matters most, where to spend. It is delivered by technology providers as a fractional service rather than a full-time executive hire. The value is not in running tools. It is in judgment, turning a security picture into clear, prioritized business guidance.

The question is: How does a lean team deliver that judgment consistently, to every client, without burning out the one or two people senior enough to provide it? That is where the workflow comes in, and it has three layers.

Layer one: Live Data from connected systems

The foundation is the connection this series has already covered. Through MCP, an assistant can reach the tools you run and return current, cross-referenced answers about any client on demand. No exporting, no stitching, no week-old snapshot. The raw material for advice is on tap, in real time.

That alone is not strategy. It is the ingredient strategy is made from and helps us scale this important business function.

Layer two: Reusable Prompts

This is the layer that changes the economics, and it is the one most teams overlook. Wash, rinse, learn, repeat.

A good prompt is captured expertise. Sit down with your most experienced strategist and write out exactly how they analyze a client’s posture, how they prep a quarterly review, how they benchmark one client against its peers, how they judge whether coverage is healthy. Test it, refine it, and you have turned a senior person’s way of thinking into something repeatable. The judgment that used to live in one person’s head now runs on demand, against live data, for any client in the book.

Build the prompt once. Run it as many times as you need. That is the whole trick. Expertise stops being tied to the expert’s calendar and starts scaling like software, because the hard part (the thinking, analysis, and judgement) was done once and captured. A curated library of these, covering the analyses you run over and over, is worth more than any single clever prompt. It is your experience team members’ judgment written down and made reusable.

Layer three: Conducing the Conversation

The output of all this is not the deliverable. It is the input to a better conversation.

The vCISO value has never been the report. It is a person sitting across from a client saying:

• “Here is where you stand in comparison to your goals.”

• “Here is how it changed since last quarter.”

• “Based on what I know about you, here is what I recommend and why.”

That translation, from data into prioritized business guidance, is the part only a human does well. This is the value that clients actually pay for. The workflow does not replace it. It clears the hours of assembly that used to crowd it out, so the human walks in ready to advise instead of ready to recite.

What it looks like in practice

Take the quarterly review. The old way, a junior team member spends most of a day building a deck that is heavy on data and thin on insight, and the meeting becomes a tour of charts. Worse yet, time is spent rehashing past tickets that represent pain, issues, and time spent away from the work that your client needs to do to make money.

The new way, a tested review prompt pulls the client’s posture, trend, open gaps, recovered spend, and peer benchmarking through the live connection. The analysis is simplified into a draft in just minutes. The senior person spends their time where it counts: sharpening the recommendation, adding the context only they know, and preparing for the actual conversation.

Same person, same client, an entirely different meeting.

The boundaries that keep it real

Three honest limits:

1. A prompt is only as good as the judgment written into it. Weak expertise captured carefully just produces weak advice at scale. This is an argument for a tested, curated library, not a folder of clever one-liners.

2. The data underneath has to be trustworthy. Fast advice built on an incomplete picture is just fast wrong advice, which is why seeing the stack clearly comes first and everything else second.

3. The human owns the recommendation. The assistant drafts the analysis. The strategist decides what it means and stands behind it to the client. The client is buying your judgment, not a model’s output, and that distinction is the whole value.

Where Cork Cyber fits

The two hardest layers are the ones Cork already provides. The unified, cross-referenced data, and the MCP connection that makes it askable. On top of that sits a growing library of ready-made prompts built for Cork’s data, so partners can draw on proven analyses rather than writing every one from scratch. The workflow is not something you have to invent alone. Much of it is already assembled, waiting to be pointed at your book.

Tying it all together

Seeing the stack, knowing what is actually exploited, closing the protection gap, understanding how coverage holds: these all create real, tangible business value. Security is no longer a line item, and your MSP is positioned as a business partner that happens to provide IT and Security services. This workflow is how the parts become a practice you can run every week, at every account, with the team you already have.

The vCISO you assumed you could not afford to hire turns out not to be a hire at all. It is a workflow backed by a strategic IT security expert. Your data connected, your expertise captured, your judgment freed up for the conversation that earns the relationship. The provider who shows up with strategy instead of just support is the one clients keep, where renewal conversations are non-events, and any necessary price increases are backed by continuous value creation.

That provider is no longer defined by headcount. It is defined by whether you have connected what you know to what you can see.

For most MSPs, financial protection lives at the bottom of the proposal. It is the optional line item, the thing offered to the one or two clients who happened to ask, the box you mention if there is time. It gets treated as an add-on, and that treatment is exactly what caps its value.

Positioned differently, the same offering is something else entirely. It is a recurring revenue stream and one of the strongest retention tools available to you. Nothing about the product changes. Everything about the outcome does. The difference is entirely in how you frame it.

What is financial protection?
Financial protection is a financial layer that wraps around your MSPs cybersecurity tools (different from cybersecurity insurance). While we aim to prevent security incidents from occurring in the first place, there are many forces outside of the MSPs control that may still result in a cyber attack. Financial protection considers and supports the immediate financial implications of reacting to and resolving a cybersecurity incident.

Subscribe now

The add-on trap

An add-on is, by definition, marginal. You sell it one client at a time, usually reactively, priced as an extra on top of what they already pay. If a MSP presents it as an option, there is no real control around ensuring financial protection sits at the intersection of a technical and business conversation. Instead, it sits in the same mental category as a nice-to-have, and it performs like one. A few clients take it. Most do not think about it until it’s too late. It never becomes a real line of the business or wedge to further demonstrate value.

The trap is self-fulfilling. Treat protection as an afterthought and it stays an afterthought. The ceiling on its value is not the product. It is the framing.

Value before price

The move that flips it is simple to state and takes discipline to run. Lead with value, not with price.

Instead of presenting financial protection as a new charge the client can opt into, present it as something you are adding to their account on their behalf. It’s important to have a layer of financial resilience wrapped around any client, because keeping them operational is your job. Framed that way, it is closer to a gift than a line item, and the conversation changes from cost to care.

That reframe does real work. It gives you a reason to talk to every client, not just the ones who asked. It is genuinely good for them, so it is an easy thing to stand behind. Further, it positions you as the provider thinking about their business continuity: not just closing tickets that represent technical issues. Value delivered first is what earns the right to a pricing conversation later. Value first, price second… in that order, every time.

The differentiation that separates

Step back and look at the market honestly. Most MSPs sell roughly the same stack. The same EDR, the same backup, the same email security, from the same short list of vendors. On tools alone, you are difficult to tell apart from the provider down the road.

Financial resilience is one of the few things that actually sets you apart. It gives a prospect a concrete reason to choose you and gives an existing client a concrete reason to stay. In a category where differentiation is genuinely hard to come by, this is a real one, and it is sitting right there in the offering you have been treating as optional. The best part? The business conversation builds from here.

The revenue mechanics

Run across the whole book rather than client by client, this becomes two things at once.

The first is a new recurring revenue line, which is the obvious part. The second matters more. You have moved from being the vendor who manages their tools to being part of how their business stays standing when something goes wrong. That kind of relationship does not churn on a price comparison, which means the protection does not just earn its own revenue. It defends every other dollar that client represents, because you mean more to their business.

The guardrails that keep it honest

This model only works if you represent it accurately: Financial protection covers defined incident types, not everything. The benefits are conditional, not guaranteed payouts. When the conversation touches cyber insurance, you are facilitating and connecting clients to qualified brokers, never advising on what policy to buy.

Give yourself a reason to reach everyone

One practical note on rolling this out to your client base. You do not want to introduce this one client at a time, whenever it happens to come up, because it never comes up without your guidance.

It helps to have a natural trigger that gives you a reason to reach the entire book inside a defined window. Cyber insurance renewal season is a good example. It is a moment when the topic is already relevant, which turns “we should mention protection sometime” into “this is the conversation we are having with every client this quarter.” If you already have a disciplined process around client business reviews, it can also be worked in as an agenda item.

Where Cork fits

Cork Protect is the vehicle that makes this real, as it is the actual financial protection you wrap around a client’s business. The Cyber Insurance Analyzer helps you position it against a need the client can see rather than an abstract risk. Then, the posture visibility underneath it all is what makes the value tangible, because “here is exactly what is protecting you, and here is the financial resilience behind it” is a far stronger conversation than a generic reassurance.

The ceiling was always the framing

Financial protection was never destined to be a line item at the bottom of a proposal. Treat it as a core part of what you deliver, positioned as value before price, and it stops being an add-on nobody thinks about.

Instead, it becomes a growth engine, a differentiator, and the thing that makes clients stay long-term. The product was always capable of that, and the right framing helps demonstrate clear, tangible value while separating security-first MSPs from the pack.

It’s a reporting day.

A client wants a security posture summary. You log into the EDR for coverage. The RMM for the endpoint list. The email security tool for mailbox status. The backup platform to confirm the last good restore point. The identity tool for MFA. Then you paste it all into one place, reconcile the parts that disagree, and format it into something you can actually send.

That’s half a morning for one client. Multiply it across a book of dozens.

The work isn’t hard. It isn’t interesting either. It’s just where a huge share of your hours go.

Subscribe now

The bottleneck came from somewhere else

Your tools aren’t slow. The data isn’t missing. The bottleneck is you, in the middle, moving between consoles, reconciling by hand, and updating copies of presentations you already created.

That’s the real ceiling on an MSP. It’s why serving more clients has always meant hiring more people, and why the smallest teams feel it worst. Every client you add multiplies the stitching. The tools scale fine. The manual assembly doesn’t.

What actually changes when tools connect

The last post we published covered MCP, the common way an assistant connects to the tools and data you already run. Here’s why that matters on a Tuesday morning:

When your tools are reachable through that layer, retrieval and reconciliation stop being your job. You ask in one prompt: Give me the posture summary for this client across all their tools, and show me where coverage is missing. The assistant goes and gets it from every connected source and hands back the assembled answer. The morning of clicking becomes a sentence, a quick review, and maybe some back and forth to prepare for showtime.

Notice what didn’t change. You still read the answer with a professional eye. You still decide what it means and what to do about it. What’s gone is the hour of mechanical work sitting between you and the point where your judgment is worth more.

What flexibility looks like

Capacity without headcount: When per-client reporting drops from hours to minutes, the same lean team covers more clients well. That’s growth that doesn’t require hiring ahead of revenue.

Answers during the call: A client asks something pointed. Instead of “let me pull that together and get back to you,” you ask it live and answer before you hang up.

Consistency (which is the quiet one): When thorough costs hours, thorough goes to your biggest accounts and everyone else gets skipped. When thorough costs a sentence, every client gets the same treatment. The small client stops slipping through.

More questions, asked more often: The right questions are answered proactively. You catch a client drifting in the wrong direction this month instead of finding out at the next incident.

Follow the thread instead of building a report

Start broad. Which of my clients are worst on email security right now? Read the answer, then narrow. Of those, which also have no working backup? Then act. Draft me a plain summary I can send each of them.

No new report to build, no new view to configure. You’re thinking out loud and the data keeps up with you. A fixed screen never did that.

It removes the administrative tax, not the expertise

This doesn’t replace knowing your craft. The assistant assembles the picture. Reading it correctly, weighing the tradeoffs, and deciding what a client actually needs is still the work, and it’s still yours.

What goes away is the retrieval tax. The unbillable, unrewarding hours spent gathering and reconciling before any thinking can start. Spending your scarcest resource, expert attention, on copy and paste was never a good trade.

One thing so it isn’t a surprise later: This only works if something has already reconciled your tools. Point an AI assistant at a dozen disconnected consoles and you get a dozen disconnected answers plus the same reconciliation problem, now with an extra step. This can result in reading the output the way you’d read a report from a junior tech. Of course, always check it before you send it.

Where Cork fits

Cork has already done the reconciliation. We connect the tools you run into one cross-referenced source of truth, and we expose an MCP connection on top of that. Your question runs against the whole picture instead of one tool at a time, using whatever assistant your team prefers.

If you’re on the client side of this, it explains something you’ve probably noticed about the best providers. They answer fast, they show up to the review with real analysis instead of a canned deck, and nothing seems to take a week. That isn’t a bigger team behind the scenes. It’s a shorter distance between a question and its answer.

The distance is the whole point

The old promise was more dashboards. More screens, more places to look. The real win turns out to be the opposite. Collapse the distance between a question and its answer until there’s almost nothing left of it.

That distance is where MSP hours go to die. Closing it is what operational flexibility actually means, and it’s available now with the tools you already own.

Ask a room of MSPs how many of their clients carry cyber insurance, and it is unlikely that you will get a clean number back. What comes through instead is a pattern. A lot of small and midsize businesses do not carry it, and most of the ones who skip it have never really understood why it matters in the first place. The exact percentage moves around. The underlying truth does not. For the majority of SMBs, cyber insurance is either absent or barely understood. That gap is sitting somewhere in your client base right now.

Most MSPs treat that gap as an awkward subject. Something adjacent to their job, a little outside their lane, a conversation easier to leave alone. That instinct is understandable, and it is also backwards. The under-covered part of your book is not a problem to work around. It is the most valuable conversation you are not having.

Subscribe now

Why the gap gets avoided

At face-value, the avoidance makes sense. Insurance feels like someone else’s product. Bringing it up feels like selling something you are not licensed to sell. The conversation itself can feel heavy, so it slips down the list behind the ticket queue and the next onboarding.

However, MSPs must step back and look at what the gap actually means. It is real financial exposure sitting on clients whose security you are already responsible for managing. If one of those uninsured clients takes a ransomware hit or a wire fraud loss, the fallout does not stay neatly in their lane. It becomes your emergency, your late nights, and often your blame, whether or not the incident was anything you could have prevented. The gap is already your problem. The only question is whether you engage with it before an incident or while evaluating the aftermath.

It is the same instinct you already trust

Here is the reframe that makes it easy.

You already sell clients tools they do not fully use on day one. You recommend the backup, the EDR, the security training, all because you know the client needs the protection even when they have not asked for it. Closing the insurance and financial protection gap is the same instinct, pointed at the same goal. Protect the client, and strengthen the relationship in the process.

The easiest version of this conversation is not the client who is already covered. It is the one who is not. They are at risk whether they know it or not. You are the person they already trust with this category. You do not have to manufacture a need. You just have to point out the one is already there.

The line you do not cross

This only works if you are clear about what you are and are not doing, so say it plainly to yourself and to the client. You are not becoming an insurance broker. MSPs are not permitted to sell insurance or advise clients on what policy to buy, and you should not try.

What you can do is different and entirely within bounds. You can start the conversation. You can show a client where they actually stand on security posture, which is where any honest insurance discussion should begin. Then, you can connect them to a broker who specializes in this, so the actual insurance decision is made by someone qualified to make it. You are the facilitator who opens the door, never the advisor who walks them through it. Held to that line, the conversation is a service, not a sales pitch.

What makes the gap closeable

Two things turn this from a nice idea into something a client can act on.

1. Visibility into posture: An insurance conversation that starts with “here is what your security actually looks like right now” is a real conversation. One that starts with a generic warning is not. Being able to show a client their posture, clearly and specifically, is what gives the discussion weight and gives a broker something concrete to work from.

2. Financial protection as a wrapper around the whole thing: This is where Cork Protect fits. It provides financial coverage toward specific covered incidents, things like ransomware, wire transfer fraud, and SMS phishing scams, including coverage toward a client’s cyber insurance deductible if a covered incident occurs. It is worth being precise here, because overpromising helps no one. The coverage applies to defined incident types, and the deductible benefit only pays off for a client who actually carries a policy. Named accurately, it is a genuine layer of financial resilience you can place on a client’s account regardless of where they land on insurance itself.

Everyone comes out ahead

Play it forward and both kinds of client benefit. The uninsured client goes from fully exposed to carrying real financial protection, and gains a clear-eyed view of whether a policy makes sense for them. The already-insured client gets a sharper picture of their posture and, often, a better-structured relationship with their coverage. Either way, you did not attempt to sell insurance. In both cases, you delivered something valuable, which is exactly the kind of thing that earns the right to a pricing conversation later. Value first. Price second.

If you are on the client side reading this, the takeaway is calmer than the usual cyber insurance noise. Most businesses like yours either skip this entirely or carry it without fully understanding it, so you are not alone either way. The point is not to panic-buy a policy. It is to know where you actually stand, and to have protection in place either way.

The most valuable conversation in your book

The under-covered part of your client base is not a gap to tiptoe around. It is a room full of people who trust you, carry a real exposure, and have not been given a clear, low-pressure way to think about it. Being the one who opens that door, honestly and within your lane, is some of the highest-value work available to you right now.

The gap was never the obstacle. It was the opening.

“Patch everything” is not a strategy. It is a wish. Every environment has more vulnerabilities than any team can close in a week, which means the real question is never whether you have vulnerabilities. It is which ones actually matter, and where to point your limited time first.

The reassuring news is that risk is not random. It has a shape. A lot of what creates that shape is set by something as mundane as what industry your client is in, and what ordinary software everyone in that industry happens to run.

Subscribe now

Every industry has a signature

Look across a large number of managed environments and a pattern emerges that is hard to unsee. Each industry tends to have a characteristic piece of software that shows up, again and again, as the most common carrier of active vulnerabilities. It is rarely exotic or particularly interesting. It is almost always something boring and everywhere.

In the environments Cork sees across its partner base, the patterns break down along a few clear lines.

Remote access and VPN clients dominate several sectors. Cisco Secure Client turns up as the most common vulnerable software in construction, in finance and insurance, and in retail, among others. SonicWall NetExtender leads in health care and in real estate. These are the tools everyone connects through to get work done, which is exactly why they are both everywhere and attractive to threat actors.

PDF readers own another large slice. Adobe Acrobat Reader and Foxit PDF Reader are the top vulnerable software in education, public administration, arts and entertainment, information, and transportation. Every desktop has one. Almost nobody thinks of it as security-critical. It opens files from outside the organization all day long.

Database servers show up in the industries built on data. Microsoft SQL Server is the most common vulnerable software in manufacturing and in professional, scientific, and technical services, sitting quietly behind the line-of-business applications those firms depend on.

Why the “boring” software is the risky software

There is a reason the pattern lands on ordinary tools rather than flashier ones.

First, they are everywhere. A vulnerability in software installed on one machine is a footnote. The same vulnerability in software installed on every machine is a campaign waiting to happen.

Second, they handle untrusted input or face the internet. A VPN client is a front door by design. A PDF reader opens documents from strangers all day. A database server is the thing worth stealing. These are not incidental targets. They are the point.

Third, they patch on their own schedule, not the operating system’s. Everyone has a process for OS updates. Far fewer have a reliable process for keeping the PDF reader, the VPN client, and the database engine current across a whole client base. That gap between “we patch” and “we patch everything” is where the exposure lives.

Not all vulnerabilities are equal: the KEV signal

This is where a single idea does more prioritization work than any scanner. Known Exploited Vulnerabilities.

The KEV catalog, maintained by the US Cybersecurity and Infrastructure Security Agency and VulnCheck , is a list of vulnerabilities confirmed to be under active exploitation in the real world. Not theoretical. Not “could be dangerous.” Being used, right now, by actual attackers.

That distinction changes how you triage. A vulnerability with a scary score that nobody is exploiting can wait. However, a vulnerability on the KEV list is a door someone is actively trying to walk through. When one of those lands in the everyday software your industry runs on, that is not a maintenance item. That is the thing to prioritize fixing today.

When you put the two ideas together, you get a genuinely short, genuinely useful list.

• Which of my clients run the software my industry is most exposed on?

• Which of those carry an actively exploited vulnerability that is still unpatched?

Answer those questions, and you have found the handful of things most likely to cause a real incident. This prioritization gets you ahead of everyone still trying to patch everything at once.

Turning the pattern into action

The obstacle has never been the concept. It has been the legwork. Answering that question the manual way means inventorying software across every client, cross-referencing it against exploited-vulnerability lists, and figuring out what is actually patched. For a small team across a large book, that is not realistic to do often, so it does not get done.

This is where surfacing vulnerabilities across the connected stack earns its keep. Cork finds the software vulnerabilities living across the tools you already run, ties them to specific endpoints and clients, and lets you act on them, including pushing patches through your RMM and package managers rather than touching each machine by hand. The prioritization stops being a research project and becomes a working list.

If you are on the client side of this, the takeaway is a question worth asking your provider. What are the common exposures for a business like mine, and are we carrying any that are actively being exploited right now? A provider who can answer that clearly is one who is triaging by real-world risk, not by whatever the scanner happened to sort to the top.

Risk has a shape, so use it

The point of all this is not to fear a specific product. Cisco, SonicWall, Adobe, Foxit, and Microsoft build software the entire economy runs on, and being common is not the same as being bad. It is that risk concentrates, predictably, in the tools an industry cannot operate without.

That predictability is a gift. It means you do not have to defend everything equally. You can look at what your industry actually runs, find the pieces carrying vulnerabilities the world is actively exploiting, and start prioritizing there.

Patch by priority, not by panic. The list is more reasonable to manage than it feels.

Think about how you get an answer out of your stack today. Let’s say a client asks a fair question: are all of our machines actually protected? To answer it honestly, you log into the EDR and pull a list. Log into the RMM and pull another. Export both. Line them up in a spreadsheet. Find the machines that appear in one and not the other. An hour later you have an answer that includes information from just two of your security tools, and it is already slightly out of date.

The data was never the problem. It was all right there. The problem was the work of getting an answer out of it. That is the specific thing that is changing, and the name for what is changing it is MCP.

Subscribe now

What MCP actually is (and what it isn’t)

What it is: MCP stands for Model Context Protocol. Strip away the acronym and it is a simple idea. It is a common way for an AI assistant to connect to the tools and data you already use.

The useful analogy is USB-C. Before a universal connector existed, every device needed its own special cable, and nothing quite fit together. MCP is that universal connector, but for AI platforms. It gives an assistant a standard way to plug into a system, ask it for information, and get a structured answer back. Once a tool speaks MCP, any assistant that speaks MCP can work with it.

That last point matters more than it sounds. MCP is not tied to one AI company or one product. It is an open standard, which means you are not locking yourself into a single vendor’s assistant to get the benefit. You can use the tool you prefer today and a different one next year, and the connection to your data still works.

What it isn’t: MCP is not a new dashboard to learn. There is no console to master. The interface is a plain-language question. It is not a replacement for your tools. MCP is the layer that lets you ask about them, not a substitute for them.

Also, it is not your data being handed off somewhere to train a model. A connection through MCP is you pointing your own assistant at your own systems to answer your own questions. You stay in control of what it can see and what it can do.

Why this matters for an MSP specifically

Every MSP lives the same reality. You do not have a data shortage. You have a data-scattered-across-a-dozen-tools problem. The friction is never finding whether the answer exists. It is assembling it from pieces that live in different places and do not talk to each other.

That is exactly the friction MCP removes. Instead of logging into each tool and stitching the pieces together by hand, you ask a question once, and an assistant connected through MCP pulls what it needs from the connected sources and hands you the answer. The hour of exporting and reconciling becomes a sentence.

Picture the questions you would actually ask:

• Which clients have an endpoint missing EDR right now?

• Which mailboxes got added this month but never made it into the email security policy?

• Which of my clients are trending in the wrong direction on their security posture?

These are the questions you already want answered and rarely have time to chase down. MCP is what makes them a quick ask instead of an afternoon.

Where Cork fits

Here is why this pairs naturally with the way Cork already works.

The value of asking a question across your stack depends entirely on something behind the scenes having already unified that stack. If your tools are still a dozen separate islands, an assistant has a dozen separate places to go and no way to reconcile them, and that’s only if it’s possible to connect into them directly. Cork has already done that reconciliation. It connects to the tools you run and cross-references them into one source of truth.

So, when you connect your AI platform of choice to Cork through its MCP connection, you are not querying one tool at a time. You are asking questions against the whole cross-referenced picture, the same unified view that surfaces your coverage gaps and your wasted spend. Since Cork’s connection is built to be assistant-agnostic, you bring whatever AI tool your team already prefers.

Regarding the questions you may usually ask, here’s how Cork answers them:

Which clients have an endpoint missing EDR right now?
Cork is already matching every device your RMM sees against every device your EDR sees, so the answer is the list of machines that appear in one and not the other, with how long each has been that way.

Which mailboxes got added this month but never made it into the email security policy?
Cork tracks every inbox in the tenant against what the email security tool is actually covering, and stamps each gap with the date it opened, so scoping it to this month is part of the same question.

Which of my clients are trending in the wrong direction on their security posture?
Cork scores every client daily and keeps the history, so the answer is which scores moved down and which specific gap moved them.

The one honest caveat

An answer is only as good as the data underneath it. This is the through-line of everything in this series. If your visibility is incomplete, a fast answer just gets you to a wrong conclusion faster. Getting the stack seen clearly comes first. Once it is, the ability to question it in plain language is what turns that visibility into something you use every day rather than a report you glance at once a quarter.

It is also worth saying that the assistant gives you the answer, not the decision. It can tell you which endpoints are exposed. Deciding what to do about them is still your job, and should be what you bring to the table.

The shift worth noticing

For years, the promise was better dashboards: More screens, more charts, more places to look. The shift underneath MCP is different. It moves you from hunting for answers to simply asking for them, reducing the need for tabbing between dashboards and learning what pages to export.

If you are not an MSP but you rely on one, this is quietly good news for you too. It means the provider protecting your business can answer real questions about your environment in minutes instead of days, which is the difference between security you are told about and security you can actually see. This also gives them more times to consider how technology can impact your business needs.

This post is the on-ramp to discussing the real value an MCP connection can bring. In a later piece we will get concrete about what it looks like to go from ten open dashboards to a single question, and how that reshapes the daily work. For now, take a look at the Prompt Distillery we created to get our partners started.

Your security data can answer questions now. You just have to ask.

Somewhere in your client base right now, a tool is checking in, reporting for duty, and doing nothing useful. Nobody is using it. Nobody remembers turning it on. And every month, it bills.

This is not an edge case. It is one of the most common and least discussed line items in a managed services business. The tools you stop needing rarely announce it. They just keep running, and keep charging.

Subscribe now

How the waste gets in

Two situations create almost all of it, and both are routine.

The first is offboarding. A client leaves, or a set of users gets cut, and the accounts get closed on the front end. But the seat in the EDR, the mailbox in the email security tool, the endpoint in the backup platform, those do not always get cleaned up in the same motion. The client is gone. The license is not. It keeps checking in, and it keeps appearing on the bill, sometimes for months.

The second is tool migration. You move a client from one platform to another. The new tool goes in, everyone confirms it is working, and the project is declared done. What often does not happen is the last step: fully decommissioning the old tool on every machine. A handful of endpoints keep running the platform you thought you left behind. Two tools now cover the same job. You pay for both.

Neither of these is negligence. They are the natural residue of a busy operation where the urgent work is standing things up, not tearing them down.

Why you cannot see it from inside any one tool

The reason this spend stays hidden is the same reason coverage gaps stay hidden. Each tool only sees itself.

The old platform left running after a migration is, from its own point of view, perfectly healthy. It is installed, it is checking in, its dashboard is green. It has no idea it was supposed to be retired. It will report itself as active indefinitely, because nothing inside it knows the decision to replace it was ever made.

The only way to catch it is to look across tools at once. To line up what is still checking in against what should still be there, and flag the difference. That comparison is exactly what no single console can perform, which is why the waste survives quarter after quarter in stacks that otherwise look well run.

This is recoverable money, not a sunk cost

Here is the part that changes how you think about it. This is not spend you have to accept. It is money sitting inside a stack you already own, waiting to be found.

Cross-reference your connected tools against a time window, say 60 or 90 days, and ask a direct question. What is still checking in that has no business doing so? The seats that outlived an offboarding. The platform that survived a migration. Draw a line at, for example, day 91, and anything still reporting past it that should have been retired becomes a candidate to cut.

For a lot of MSPs the first pass alone recovers enough to pay for the effort several times over. This is not a one-time cleanup. Run the same comparison on a rhythm and the waste never gets the chance to accumulate again.

The client-facing upside

Recovered margin is the obvious win. The less obvious one is what this does for client trust.

Most QBRs are a mix of reassurance and upsell. A savings finding is neither. It is you walking into the room and handing the client money back, with a clear reason attached. You were paying for this, it was doing nothing, we turned it off. There is no spin to see through. It is the kind of moment that makes a client believe you are watching their spend as closely as their security, which is exactly the relationship that survives a budget review.

There is a security angle too. Every orphaned tool and stale license is one more thing in the environment that nobody is managing. Clearing them out does not just cut cost. It shrinks the surface area of things that can quietly break, get exploited, or muddy the picture when you are trying to see the stack clearly.

How Cork surfaces it

This is one of the places the cross-referencing approach pays off in plain dollars. Since Cork connects to the tools you already run and compares them against one another, it can surface savings opportunities directly. The licenses still checking in that map to no active need. The leftovers from offboarding and migration. The seats you are paying for and not using.

The output is not another report to interpret. It is a list of specific things you can act on, tied to specific clients, with the wasted spend attached. Some partners leveraging this today think of it less as a savings feature and more as a decommissioning tool, because that is what it does. It tells you what to turn off.

The audit worth running this quarter

You can start without any new tooling at all. Pick your three largest clients. For each, list every security tool you believe is active, then check it against what is actually checking in today. Look specifically for anything tied to a user who left or a platform you migrated away from.

Whatever you find is money you were spending for nothing, and now get back. Do it once and it is a nice recovery. Build it into how you run, and it becomes a permanent line of margin you were leaving on the table.

You cannot recover spend you cannot see. The good news is that seeing it is the hard part, and it is very findable.

Most monitoring answers one question. Is the tool installed, yes or no? Green check, you’re covered. Red X, go reinstall. It is clean, it is binary, and it is where a surprising amount of risk hides.

Since installed and working are not the same question. A tool can be deployed on every endpoint you expect, show up as present in your RMM, and still be quietly failing to do the one job you are paying it to do.

Subscribe now

A story most MSPs will recognize

Here is a pattern that plays out more often than anyone likes to admit.

A client was certain their EDR was deployed everywhere. Their RMM confirmed it. The agent showed installed across every endpoint, so as far as the team was concerned, those machines were protected. Case closed.

Then they started getting flagged that the tool was not checking in on a set of those same assets. The pushback was immediate: It is installed, I can see it right there. The reply was the part that stuck. We are not telling you it is not installed. We are telling you it is not checking in. Then, an audible pause fills the room. Those are two different things.

The tool was there. It just was not working. We can’t expect everything to work the way it is the day it was installed, that’s just not how technology works. Once they dug in and fixed it, a wave of tickets that had been quietly piling up closed out. The experience changed how they ran monitoring from that day forward. The question was no longer “is it installed.” It was “is it connected and actually reporting.”

Installed, configured, working: three different questions

It helps to separate what a green checkmark actually promises from what you assume it promises.

Installed means the software is present on the machine. That is all it means. It does not mean the agent is checking in. It does not mean it is configured correctly. It does not mean it is sending data anywhere that anyone is watching. And it does not mean it is catching what it is supposed to catch.

Each of those is a separate condition, and a tool can pass the first and fail the rest. An EDR agent that stopped checking in after an OS update. A backup that runs on schedule but has been silently failing for six weeks. An email security policy applied to the domain but never extended to a batch of new mailboxes. In every case the dashboard says present. Reality says exposed.

Why the binary view feels safe

RMM and single-tool dashboards are built to answer the binary question, and they answer it well. Installed or not installed. That simplicity is exactly why it feels reassuring, and exactly why it is incomplete.

A yes-or-no view cannot tell you about degradation. It cannot tell you the agent went dark three days ago, because from its point of view the agent is still technically there. It cannot tell you that two tools disagree about the same machine. The binary view is comfortable precisely because it never surfaces the uncomfortable middle, the place where a tool is installed, looks fine, and has stopped doing its job.

That comfort has a name worth being honest about. It is the assumption that deployed equals protected. Most of the time it holds. The trouble is that the times it does not are invisible until something forces them into view.

What it costs when installed is not working

A tool that is installed but not working is in some ways worse than a tool you know is missing, because a known gap gets fixed and an invisible one just sits there waiting to be exploited.

The risk is obvious once you say it out loud: the endpoint everyone believed was covered is the one with no live protection. If an incident lands there, it lands on the machine that was at risk while appearing in compliance. If that client carries financial protection where that control is required for coverage, an unresolved gap on the exact asset that was compromised is precisely the kind of thing that can put a claim in jeopardy… at the worst possible moment.

Every one of those silent failures is generating friction in an MSPs operations:

• Tickets that do not quite add up.

• Alerts that never fire, because the thing that should fire them is offline.

• Teams spend real hours chasing the symptoms of a tool that simply stopped reporting, without ever suspecting the tool itself.

These points represents a quieter cost that is rarely considered.

Monitor connection, not just presence

The shift is not complicated, but it changes everything downstream. Stop monitoring whether tools are installed. Start monitoring whether they are connected and reporting.

That means treating “checking in” as the real signal, not “present.” It means cross-referencing your tools against each other, so when your RMM says a machine exists but your EDR has not heard from it in days, that disagreement surfaces on its own instead of waiting for an incident to reveal it. The gaps that matter almost always live in the space between two tools, and no single tool can see that space.

This is the layer Cork Vantage sits on. Rather than asking each tool whether it is installed, Cork watches whether the tools you already run are actually checking in, and flags the assets where they are not. Not “the agent is missing,” but “the agent is there and has gone quiet.” That is the alert that closes tickets before they become incidents, and it is the difference between a stack you assume is working versus proving that everything is in place as expected.

The question to ask this week

Pick one tool you consider fully deployed across your client base. Now ask a harder question about it. Not “is it installed everywhere,” but “is it checking in and reporting everywhere, today?”

If the answer is a confident yes, backed by something more than a green checkmark, you are in good shape. If the honest answer is “it should be,” that gap is worth finding now, on your terms, rather than during an incident on someone else’s.

Installed is a starting point. Working is the whole game.

At Cork Cyber, we proactively monitor over a million devices to safeguard against threats. As part of this effort, we analyze software inventories across these devices that come from RMMs and other tools to identify vulnerabilities and potential risks. Discover how your industry’s sanitation practices compare to others and uncover potential, concerning issues within your own environment that you might be overlooking.

Subscribe now

Which industries are managing these vulnerabilities the best?

When we look at the different vulnerabilities among sectors, one industry stands out for its effective sanitization of software vulnerabilities compared to the rest: educational services. Out of a sample of 7,000 devices, only 15.2% devices found to have a vulnerability (routine to critical). This sector’s success is driven by a conversion towards cloud-centric OS environments (such as ChromeOS) and centralized management tools. Chromebooks alone were found to reduce support labor by 92% in comparison to standard desktops and laptops. In comparison to the healthcare and social assistance sector, the difference is alarming. In a much larger sample size of 38,793 devices we found more than a third (34.4%) of devices contained some sort of vulnerability. A device in a healthcare setting is more than twice as likely to be vulnerable as one in a classroom, despite much more at stake. For context, across all sectors we found on average 29.3% of devices are considered vulnerable.

So, what exactly are triggering these alarms?

When we look beyond the standard browser-based threats that affect every user, the most critical risks are seen in the operational tools industries rely on daily: VPNs, PDF Readers, and database management systems. While browser vulnerabilities are frequent, they are often low in severity due to auto-updates. Many times a user has multiple browsers installed in which they keep their browser of choice updated, while the other browsers remain out of date due to never opening them. The real “silent killers” are the infrastructure tools that facilitate remote work and storage; software that is often trusted, installed, and then forgotten.

In the healthcare sector, our most concerning finding is the massive prevalence of vulnerable SonicWall NetExtender clients (1,358 devices). Just this year there has been a surge in attacks where threat actors have exploited defects such as CVE-2024-40766 and CVE-2024-53704 to bypass multi-factor authentication entirely. By targeting these unpatched clients, attackers can hijack active SSL VPN sessions to infiltrate into networks with the same permissions as a doctor or administrator. A breach here doesn’t stop a sale or cause downtime, it puts patient care and safety at risk. If an unpatched NetExtender client lets ransomware in, it could lock up patient histories, delay surgeries and more, making the management of these vulnerabilities an absolute necessity. In 2025 it was found that 72% of U.S. healthcare organizations that faced a cyberattack had a disruption to patient care.

The financial and construction sectors face a different but equally dangerous VPN hurdle, with a heavy reliance on Cisco Secure Client (formerly AnyConnect). These industries often rely on Cisco because of it being a trusted industry standard for enterprise security, however, its large prevalence also makes it a prime target. When hundreds of devices are left unpatched, it makes a backdoor into the network much easier. A compromised VPN could allow attackers to steal proprietary blueprints and bid data in the construction industry. In finance the stakes are even higher with the ability to steal clients’ financial records. In 2025 the “Velvet Ant” group targeted many sectors, including financial, to steal sensitive records and intellectual property by exploiting Cisco vulnerabilities and others. By utilizing these specific VPN flaws, they were estimated to have stolen over $244 million by late 2025.

However not all threats come via remote access tools. The professional, scientific, and technical services sector as well as the manufacturing sector’s danger lies deep within the backend. For Microsoft SQL Server 2019 alone, we found 2,768 vulnerable devices in the former and 1,028 vulnerable devices in the latter. Leaving these vulnerabilities unattended can allow hackers to not only steal sensitive client records, they can also deploy ransomware to encrypt the database files. The compromised business is then threatened to either pay a ransom fee or have their files leaked on the internet and files remain encrypted. It’s very easy for this to lead to the end of many small businesses. Half of all small businesses only have enough cash to stay open on average for 27 days with no income. Meanwhile, the average length of recovery for a ransomware attack in 2025 was up to 27 days.

Lastly, out of date PDF readers were the third biggest point of entry among various sectors. While these tools are viewed as harmless utilities, a single unpatched reader can turn a routine document review into a full network compromise. We found 161 devices in the educational services sector with a Foxit PDF Reader vulnerability as well as 341 devices utilizing Adobe Acrobat Reader in the public administration sector with a vulnerability. Threat actors have been seen exploiting these flaws and embedding malicious code into what seems to be innocent PDF assignments or administrative forms. When a teacher or administrator opens the file, the exploit triggers silently in the background executing code that can deploy spyware like Recmos RAT (remote access trojan) to harvest credentials. Not only does this compromise personal administrative records, but it also affects student records alike. RAT’s such as Recmos allow webcams and microphones to be remotely activated which can also threaten the safety of minors.

Do you truly know what lives on your network?

The vulnerabilities we’ve discussed so far on SQL servers, corporate VPNs, and PDF readers are all business-critical tools. It comes as no surprise they are installed; they are essential for operations. But the question every business leader and MSP must ask is: are you aware of everything else?

Some businesses allow individuals to bring their own device (BYOD), but if devices aren’t properly monitored and sanitized, the corporate networks drastically become at risk. It takes only one compromised device running unauthorized or vulnerable software to bridge the gap between a secure environment and the public internet. While analyzing vulnerabilities and software inventories we’ve found many employees treating company assets like personal laptops, introducing significant risk.

One of the most frequent unauthorized categories we observed was the presence of personal VPNs. We found about 4,000 instances of ExpressVPN, NordVPN, Surkshark, and Private Internet Access installed on corporate workstations. While employees may have legitimate reasons to have these installed, it creates a “blind spot” where data can be exfiltrated (or malware introduced) without the security team ever seeing it happen.

Even more concerning was the presence of torrent clients (such as Deluge uTorrent) and other peer-to-peer file sharing software. This isn’t just a potential legal issue regarding copyrighted material, it’s a direct pipeline for identity theft. According to a 2024 report by Flare, nearly 41% of all stolen credentials sold on the Dark Web originated from devices infected via pirated software and P2P games.

However not every unauthorized app we found was “malicious”, more so reminders that everyone is human. Across all industries we found thousands of installs of Spotify and other personal media software. We also checked for the presence of applications associated with gaming such as Steam, Epic Games, and Discord. While gaming software is more expected in education environments, its prevalence in the information sector (also seen in other business orientated sectors) exposes a critical gap in endpoint management.

MSPs must take it upon themselves to better enforce strict software policies on corporate assets. Whether operating under a BYOD policy or simply failing to lock down corporate hardware, the lack of proper monitoring and sanitization puts networks at drastic risks. They need to both block unauthorized executables and question why recreational software is being run on devices intended for secure business operations.

What can you do to be aware of these issues?

Awareness is the first line of defense; you cannot patch what you do not know exists. The NIST Cybersecurity Framework (CSF) 2.0 is a great reference to ensure you are checking all boxes. In short you need to: maintain a complete software inventory, implement continuous vulnerability monitoring, and adopt an enterprise patch strategy.

Continuous monitoring can feel like a massive undertaking, largely because standard RMMs fall short. Most tools focus strictly on Windows updates and popular apps like Chrome, leaving you to manually track patches for everything else. To bridge this gap, Cork developed its own software vulnerabilities tool to help provide suggestions and comprehensive visibility that traditional RMMs miss.

Rather than focusing solely on popular applications, Cork evaluates your entire software inventory. It maps your software against official vulnerabilities from the National Vulnerability Database (NVD) by NIST and cross-references them with emerging threats actively being exploited and identified on the dark web. Instead of just flagging the problem that others miss, Cork also gives clear remediation steps for each CVE that is detected and the easiest way to solve the vulnerability.

Visit corkinc.com to learn more, or schedule a live demo with the team to see your hidden vulnerabilities today.

Ask an MSP how many security tools they run across their client base, and watch the pause before the answer. Most can name the big ones without thinking. EDR, RMM, email security, backup, identity. Then the list gets fuzzy. There’s the platform they migrated off last year that might still be checking in somewhere. The tool one client insisted on. The point solution that came with an acquisition. The trial that quietly converted to a paid plan.

That pause is the whole problem. If you can’t say with confidence what is deployed on every endpoint today, you can’t protect it, you can’t prove it, and you are almost certainly paying for pieces of it you no longer use.

Nobody built this stack on purpose

No MSP sat down and designed a sprawling toolset. It grew by accretion.

Every new threat in the last five years added a tool. Every acquisition added a tool. Every uncomfortable QBR where a client asked a question you couldn’t answer added a tool. Here is the part that does the damage: almost nothing ever gets removed. Tools go in. They rarely come out.

The result looks reassuring from the outside. A long list of capabilities. A console for everything. A vendor for every category. On paper, it reads as comprehensive.

Underneath, it is a different picture. The same growth that made the stack look complete is what makes it impossible to see clearly. You are not running one system. You are running a dozen systems that don’t talk to each other, each with its own console, its own definition of “covered,” and its own idea of what a healthy client looks like.

One pane of glass per product

The industry sold MSPs on the single pane of glass for years. What most teams actually got was one pane of glass per product.

Each tool shows you its own slice of reality and nothing else. Your EDR tells you about the endpoints it knows about. Your RMM tells you what it has an agent on. Your email security reports on the mailboxes it protects. None of them tell you where they disagree. And the disagreements are exactly where the risk lives.

Consider a simple question. Is every endpoint you bill for actually protected by every tool it should have? To answer that honestly, you would need to line up your RMM inventory against your EDR coverage against your backup reporting against your identity platform, and find the places where one tool sees a device the others don’t. No single console can do that, because no single console can see outside itself. So the question usually goes unanswered, and “installed” gets treated as “working” until something proves otherwise.

The two costs of not seeing

A stack you can’t see clearly bills you twice.

The first cost is risk. Coverage gaps hide in the seams between tools. A device that fell out of the RMM but still shows in the EDR. A new employee whose mailbox never got added to the email security tool. A client environment from a migration that was never fully cut over. Each gap is small. Each is invisible unless something cross-references the tools against each other. And each is the kind of gap that turns into an incident, or into a denied claim at the exact moment a client needed their protection to hold.

The second cost is money, and it is more immediate than most teams realize. Orphaned agents keep checking in. Licenses for clients you offboarded months ago keep billing. The platform you migrated away from is still running on a handful of machines nobody flagged. This is spend leaving the business every month for tools delivering zero value. And you cannot recover spend you cannot see.

For a lot of MSPs, closing that second gap alone pays for the effort of getting visibility in the first place. It is found money sitting inside the stack you already own.

If you rely on an MSP, this is your question too

If you are not an MSP but you depend on one, this matters to you directly. You are trusting a provider to keep your business secure, and the honest test of that trust is not the length of their tool list. It is whether they can show you, clearly, what is protecting you right now and where the gaps are.

The best providers welcome that question. They can pull up a single view of your environment, point to what is covered, name what is not, and tell you what they are doing about it. A provider who can only answer one tool at a time, or who needs a week to assemble the picture by hand, is telling you something important about how well they can see their own operation, and by extension yours.

Visibility is the foundation, not a feature

Here is the reframe that changes how you run a security practice. Visibility is not one more capability to bolt onto the stack. It is the layer underneath everything else, the thing that makes the rest of the stack trustworthy.

You can’t remediate a gap you don’t know exists. You can’t prove protection to a client from a dozen disconnected reports. You can’t recover wasted spend you can’t find. You can’t have the confident business conversation, the kind that actually truly impacts a clients business, when you are not sure what is running.

This is the whole idea behind how Cork approaches the problem. Rather than adding another tool with another console, Cork connects to the tools you already run and cross-references them against one another, agentless and API-based. The point is not more data. It is one source of truth across the stack, so the coverage gaps surface on their own, the wasted licenses become visible, and “what is actually deployed” stops being a question you have to guess at. From there, financial protection has something solid to sit on, because you can proactively prove the posture behind it.

That is the shift from a stack you hope is working to a stack you can prove is working with confidence.

Start with one honest question

You don’t need a project plan to begin. You need one honest question, asked across your whole client base at once. What is actually deployed and checking in right now, and where do my tools disagree?

If you can answer that today, you are ahead of most of the market. If you can’t, that gap is not a failing. It is the most valuable place you could point your attention this quarter. Everything else in a security practice, the protection, the proof, the profitability, gets easier the moment you can see clearly.

The tools you can’t see are not neutral. They are the ones costing you, in risk and in dollars. Seeing them is where the work starts.

They can tell you what they bought. The firewall. The antivirus. The email filter. What they can’t tell you is whether any of it is working, whether the gaps from last year are closed, or whether the number that matters most, their actual risk, is moving in the right direction.

That is the problem with how most organizations think about security. They treat it as a project. Something you do once, check off, and forget. But security was never a destination you arrive at. It is a posture you hold, and posture drifts the moment you stop paying attention.

The mindset shift

Three ideas sit underneath everything else.

Security is an ongoing process, not a set-and-forget purchase. Your attack surface grows every time you add a device, hire an employee, or turn on a new cloud app. What was enough last year can be dangerously thin today.

Security has to be woven into how you operate, not bolted on afterward. Every hire, every purchase, every onboarding step either strengthens your posture or quietly weakens it.

And most important: you cannot improve what you cannot measure. Without a way to score where you stand, “getting more secure” is a feeling, not a fact.

So how do you measure something as sprawling as security posture? You break it into dimensions you can actually see.

The four dimensions of security posture

A complete picture of your security health comes from four questions. Each one is a lens. Together they are a system.

1. Are your controls actually working? Not licensed. Not purchased. Working. This is where the first gap almost always shows up. A firewall nobody monitors is not protection. EDR that never got deployed to that one forgotten laptop is not coverage. The details matter here, and they compound: multi-factor authentication alone blocks over 99 percent of automated credential attacks, and more than 90 percent of attacks still start in the inbox.

2. Are policies being followed? The human layer is where most breaches actually happen. Verizon’s Data Breach Investigations Report puts it at 82 percent of breaches involving a human or policy element. Training completions, access reviews, policy acknowledgments. This is unglamorous work, and it is also the difference between a defensible organization and an exposed one.

3. Are known weaknesses getting fixed? Attackers do not need a zero-day when you have left the front door open for a month. Roughly 60 percent of breaches exploit vulnerabilities that are already more than 30 days old. Measuring posture here means knowing your patch windows and holding to them. Critical issues in a day or two. High within a week. Nothing important left to drift.

4. What does your history tell you? Past incidents and claims are not just scars. They are a signal. A pattern of incidents points directly at gaps in the first three dimensions, and it shapes something with real dollars attached: your insurability, your premiums, and the terms carriers are willing to offer you at all.

Why all four, together

Here is the part people miss. No single dimension tells the truth on its own.

A company can have a beautiful security stack and terrible patching habits. Another can pass every compliance check and still have no MFA on a critical account. Strength in one area does not cover weakness in another. You need all four in view at once.

And when you measure them consistently over time, you get the thing that actually matters. Not a snapshot. A trajectory. You stop asking “are we secure,” a question with no honest answer, and start asking “are we getting safer,” a question you can prove.

From four questions to one number

This is the thinking behind the Cork Cyber Score. We take these dimensions and turn them into a single, trackable baseline, the way a credit score turns your financial health into one number you can actually work with and improve over time.

The idea is simple: pick your dimensions, measure them honestly, and watch the direction of travel. The organizations that treat security as something measurable, rather than something they hope is handled, are the ones that sleep better at night.

Security is a journey. The least you can do is know where you stand on the map.

This is the first in a series where we break down how modern organizations measure, track, and improve their cyber posture. Follow along, and visit Cork’s website to learn more!