MSP Cybersecurity: Critical No Longer Means Rare

[00:00:02] It's Patch Tuesday. The criticals alone would fill your team's month. A few are already being exploited, and nothing in your policy says which come first. So the Q decides. This is the Business of Tech. I'm Dave Sobel.

[00:00:18] The amount of software that needs fixing has changed, and it changed fast. Start with Microsoft. Its October Patch Tuesday fixed a record 1,411 flaws by bleeping computers count. PCWorld note that's more than Microsoft fixed in any previous full year.

[00:00:38] 70 were rated critical, and 57 of those allow remote code execution. One zero-day was already being exploited in attacks, and two more were public before a fix existed. That total is conservative. Fleeping Computer counts only what Microsoft releases on Patch Tuesday itself, which leaves out another 348 flaws fixed earlier in the month.

[00:01:01] Fleeping Computer ties the record to Microsoft's continued use of AI to find and fix vulnerabilities in its own products. Microsoft isn't the only one shipping more. Epic AI, a research group that tracks AI's progress, counts vulnerability disclosures from 21 major software organizations, among them Microsoft, Google, Apple, Cisco, Red Hat, and the Linux kernel.

[00:01:24] In July, those organizations published about 2,500 flaws rated high or critical. That's roughly five times the biggest month on record before April, when Anthropix announced Claude Mythos Preview, a model it said could find and exploit vulnerabilities on its own. June had already set a record at about 1,550. July beat it by about 60%.

[00:01:51] And those are only the flaws that have been disclosed. Anthropix says its Project Glasswing, which uses its models to find bugs in critical software, has turned up more than 10,000 serious vulnerabilities by itself. Epic is careful about cause. It says some of the increase is almost certainly AI making flaws easier to find, and some may simply be that more people are looking. Either way, the count reaching the people who apply the fixes has moved.

[00:02:21] More serious flaws are being published than at any point in Epic's records, and the curve hadn't flattened as of its latest count. That's how much is arriving. The harder question is how little of it tells you what to fix first. If you're listening to this and haven't hit follow yet, on Apple Podcasts, search Business of Tech. It takes five seconds, and you'll get the next episode automatically.

[00:02:48] The MSPs who win the next three years won't be the ones with the most AI tools. They'll be the ones who turn AI into a business. Pax8 calls it Managed Intelligence, built on the marketplace over 47,000 partners already run on. Join them. Pax8.com That's P-A-X, the number 8, dot com. This episode is supported by ScalePad.

[00:03:16] Here's the uncomfortable part of running a good MSP. The client decides whether to keep you based on what they can see, and most of what you do well is invisible by design. Nothing broke. Nobody noticed. ScalePad's Lifecycle Manager is built for that gap, bringing the full picture for each client together, so you can show how your work connects to their business goals.

[00:03:42] The work may be technical, but the value should be obvious to the person paying for it. ScalePad.com A severity score was never a measure of risk. It describes how bad a flaw could be if someone used it. It's a storm's category, not a forecast of where it makes landfall.

[00:04:06] The score attached to every published vulnerability rates how the flaw is reached and what it comprises. It says nothing about whether anyone is exploiting it. C-cracky, C-R-A-C-I, a company that sells vulnerability tracking, rebuilds the CVE's program's own records every day, and it makes the point plainly. The score is not a measure of how much any particular organization is at risk.

[00:04:32] For years, that gap was easy to live with because serious flaws were rare enough to treat everyone as urgent. Discovery changed that, and severity came along with it. By that same count, the CVE program published about 131 records a day in 2025. In 2026, it's 280. Records, rated high or critical, went from 54 a day to 143.

[00:04:59] That's about six serious flaws an hour around the clock. AI made flaws cheaper to find. It didn't make each one more likely to be used. Exploitation is rising, but on a different curve. CISA's known exploited vulnerabilities catalog is the government's list of flaws with reliable evidence of attacks in the wild. The Uptime Reports analysis of that catalog counts 249 additions through October 2.

[00:05:27] That's already more than all of 2025 and 32% ahead of the same point last year. It's the busiest year since the catalog launched. It's also about a third more exploitation against more than twice the disclosures. And some of what lands on that list is years old. Sort the CVE by severity and it grows with discovery. The risk grows with exploitation. Those curves have split.

[00:05:56] CISA has already built its own rules around that split. Binding Operational Directive 26-04, issued in June, replaced the agency's earlier patching directives and cited AI's effect on the volume of vulnerabilities. It sorts federal remediation by four questions. Is the system exposed to the internet? Is the flaw on the exploited list? Can exploitation be automated at scale? Does it hand an attacker control of the system?

[00:06:26] Deadlines run from three days to 60. The fastest ones go to exploited flaws on exposed systems, and agencies can defer action on the lower risk ones. CISA encourages every organization to take the same approach. In plain terms, severity now measures how much was found. Exploitation and exposure measure what's dangerous. That split doesn't stay inside federal agencies. For an MSP, the split lands in the patch policy.

[00:06:56] If your policy still promises to fix every critical within a set number of days, it was written for a world where critical meant rare. The number of things it now calls urgent is set by how fast flaws are found. How many you can actually fix is set by the hours your team has. Look first at a company that has the hours to spend. Bank of America CEO Brian Moynihan said the bank brought in about a thousand outside contractors

[00:07:25] in the second quarter to fix weaknesses that AI models had found, Anthropics Mythos among them. They work alongside roughly 3,000 of the bank's own people already assigned to the job. The flaws were in code the bank runs, both on its own and its vendors. Moynihan put the quarter's remediation costs at, quote, a couple hundred billion dollars plus. That figure also covers separate anti-money laundering fixes.

[00:07:51] He expects the cost to fall as the backlog clears. In plain terms, one of the largest banks in the country answered the volume with labor. AI scaled the finding. Nobody has scaled the fixing the same way. Now look at the labor MSPs have. Nerdio, which sells management tools for Microsoft environments, surveyed 153 MSP decision makers for its 2026 State of the MSP Business report.

[00:08:18] 60% say management complexity is growing faster than their ability to scale. 29% grew their customer base without adding engineers in proportion. And 29% lost technicians to workload-related burnout in the 12 months before the survey. Put those together. The bank added a third more people to the work to keep up. MSPs aren't adding people at that rate, and many are losing the ones they have.

[00:08:46] So a severity rule doesn't fail loudly. The queue just grows longer than the team, and something waits anyway. The only question is whether anyone chose what. So here's the choice. Rewrite your patch priority around exploitation and exposure. Flaws on Sys' exploited list on systems facing the internet that would hand an attacker control, move first and move fast.

[00:09:13] Except that some unexploited criticals will wait and decide which ones. Or keep the severity rule and let a queue bigger than your team decide what waits without anyone deciding. And that decision isn't yours alone to make. This episode is supported by Halo. If you run a managed service provider, your PSA sits at the center of everything. Tickets, billing, contracts, workflows, and reporting.

[00:09:41] Halo PSA was built as a modern PSA platform designed for how service providers operate today. With flexible workflows, strong integrations, and support for automation across the service desk. Many MSPs first encounter Halo when they start asking a simple question. What would a PSA built today actually look like? If that's something you're thinking about in your own business, Halo PSA is worth a look. Learn more at usehalo.com

[00:10:12] In events, Ninja One has a free on-demand webinar on making your security hygiene work visible to clients. What to measure and how to show it at a QBR. Link is in the show notes. Why do we care? Because every MSP tells its clients it patches. And none of them can honestly say it patches everything anymore. So tell yours before a breach does. Here's what we fix within days.

[00:10:40] Exploited flaws on anything facing the internet. Here's what rides the normal schedule and why. That conversation is also the separator. A client who helped draw the line doesn't blame you for where it fell and won't believe the competitor who says there isn't one. So what to consider? Resort the queue every time the exploited list changes, not once a month.

[00:11:05] CISA updates its known exploited vulnerabilities catalog several times a week and publishes it as a free feed. Match each addition against what your clients actually run and pull those fixes ahead of the monthly cycle. Microsoft's new risk cohorts can help group the rest. Microsoft itself says the groupings don't, on their own, show which flaws are most dangerous.

[00:11:31] Know what each client exposes to the internet before you need to. Exposure is the first question in CISA's directive, and you can't answer it without a current inventory of what faces the internet at each client. If it takes your team more than a day to say which clients run the product named in that morning's KEV entry, close that gap first. Write down what waits and show it.

[00:11:58] For each client, keep the fast lane and the deferral list side by side, and review both whenever the exploited list changes. Bring that page to the business review. It turns WePatch into a decision the client has seen and agreed to.

[00:12:14] If this trend continues, if disclosures keep outrunning exploitation through 2027, WePatch everything will stop being a promise MSPs make and become one clients insurers and auditors ask them to prove. And only the MSPs with an exploitation first policy will be able to do so. This is the business of tech. What would you fix in your business with the right playbook?

[00:12:42] Small Biz Thoughts members get a library of templates and operational resources, recorded member calls, and classes through IT Service Provider University. Operational education built specifically for independent MSPs. Start at smallbizthoughts.org Interested in advertising? Head to mspradio.com slash engage.

[00:13:07] The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode. Proud member of the MSP Radio Network. And that is the video into useful video editor of the series. Offer creator and introduce a new page of the web, the image of the web. The best такое app is connected to all of the various features to all of the web. Thank you.