The MSP Risk Is Not Where You Think It Is

Charles Weaver uses the ConnectWise Cloud Backup incident as a springboard to examine a larger issue facing the MSP profession: the gap between who controls risk and who gets blamed for it. The episode is less about assigning fault to any one company and more about asking where accountability really sits when supplier access, consolidation, and customer trust all collide. We discuss why MSPs are being forced to absorb the fallout from upstream vendor incidents, what questions vendors should answer before MSPs reassure customers, and how concentration in the MSP stack can turn “efficiency” into hidden systemic risk. 

Key topics 

• In this episode: the ConnectWise Cloud Backup incident and why it matters beyond the immediate breach response 
• Charles argues that the real issue is not just MSP security, but risk accumulated above the MSP layer and pushed downward during incidents 
• He asks where the risk actually begins when a supplier, not the MSP, controls the compromised access 
• The episode explores why MSPs are still expected to lead customer communication even when the issue was outside their control 
• Charles questions whether customers should get better risk allocation by buying through an MSP than they would buying directly from a vendor 
• He challenges the long-standing push toward tool consolidation, asking whether fewer vendors actually means less risk or just more concentrated ownership 
• The episode raises the issue of who is shaping the MSP profession without being an MSP, including vendors, cloud providers, distributors, insurers, and investors 
• Charles emphasizes that trust, privilege, and blast radius must be treated as operational realities, not abstract compliance concepts 
• He argues that upstream liability caps often leave MSPs as the shock absorbers for failures they did not create 
• The closing section offers five practical tests MSPs should use to evaluate vendor-driven risk in their own stack 

Timestamps 

00:00 - ConnectWise Cloud Backup as a case study in supplier risk 
03:39 - Why this incident is bigger than one vendor breach 
05:06 - Where did the risk actually begin 
07:00 - Why MSPs become the customer-facing responder 
08:17 - What vendors should owe partners after an incident 
10:55 - Who actually owns risk in the MSP service chain 
13:57 - Why customer contracts can distort risk allocation 
15:44 - Efficiency becoming concentration in the MSP stack 
18:24 - Does fewer vendors really mean less risk 
20:35 - Who is reshaping the MSP profession without being an MSP 
24:42 - Trust, privilege, and blast radius in vendor access 
28:16 - Why the MSP becomes the shock absorber 
29:35 - Contract questions MSPs should ask now 
32:09 - Five practical tests for MSP vendor risk 

Action items 

• Map every supplier in your stack and document what each one can access, change, interrupt, or observe 
• Identify shared ownership, identity, and infrastructure across supposedly separate products 
• Test how quickly a critical function could be replaced if a vendor failed tomorrow 
• Compare customer promises against supplier promises around notice, evidence, recovery, and liability 
• Practice delivering services during a major supplier outage so you know what happens when a control plane disappears