Here is the honest situation. Here is the honest situation. Managed service providers are attacked as providers, not as companies. The attacker is not after your invoices, your payroll or your own file server. They are after the one thing you own that nobody else does, which is authenticated, privileged, automated reach into hundreds of other organisations at once. Everything below follows from that, and almost none of it is addressed by the security programme a company of your size would otherwise run. The first failure is that the delivery plane is not treated as a distinct estate at all. The monitoring and management servers, the automation runners, the credential vault, the technician jump hosts and the identity system behind them are administered as ordinary corporate IT, because that is who built them and that is where the budget sits. So the single asset class that reaches every customer runs the same baseline as the office print server, and often the same accounts. The second failure is identity. A technician logs into email in the morning and into a customer's domain controller at lunchtime with the same credential, and the second factor is a code or a push prompt, both of which fall to techniques used against providers routinely. Shared break-glass accounts sit in a team vault, which means every action they take resolves to nobody, which destroys attribution at exactly the moment attribution is the whole question. And when the customer asks who did this and on whose instruction, the honest answer is that their log shows a tool acting, not a person, and the authorising ticket lives in a system they cannot see. The third failure is that segmentation is asserted rather than enumerated. Ask whether credentials are shared across customers and you get an honest no, because the person answering is describing intent. Enumerate it and you find a backup service account deployed with the same identity for years, a monitoring credential baked into a build image, a local administrator password set from one template on every device you ever installed. None of these was a decision. They accumulated. The network has the same shape: a management segment reachable from everywhere, or a hub whose spokes can route to each other because nobody wrote the deny rule. The fourth failure is that segmentation work runs in the wrong direction. Providers concentrate on keeping one customer out of another, which matters, while the direction that produces the estate-wide event is inbound: a foothold in one customer network that reaches the management plane and inherits its reach into everyone else. Agents call home, technicians tunnel back from a customer jump host for convenience, collectors sit inside customer networks holding provider credentials. Each is legitimate, each solved a real problem, and none of them shows up in a review that only asks whether customers are separated from one another. The fifth failure is the tooling's own pre-authentication surface. Remote monitoring and management is remote code execution as a product, and its consoles and agent endpoints are frequently published to the whole internet because that is the default installation. The defence offered is that authentication is strong, which misses the point entirely, because the flaws that matter in this product class are reached before the login. Those flaws are weaponised in days and the platform waits in a thirty day patch queue, not because anyone thinks that is right but because an update that breaks the tool takes the whole service desk offline and nobody has rehearsed the fast path. Meanwhile the agents on customer endpoints are versions behind, and the endpoints that stopped checking in months ago cannot even be listed, because the console reports what it manages and is silent about what it lost. Those are the worst case: reachable, unmanaged, unpatched, still holding valid enrolment credentials. The sixth failure is blast radius. In most providers one identity can both write a script and push it to every managed endpoint, and the target is chosen from a dynamic group whose membership nobody has resolved. It does not matter whether that identity belongs to an attacker or to a competent engineer at the end of a long shift, because the mechanism and the consequence are the same. Caps exist in runbooks rather than in the platform, which means they do not exist on the shift where somebody is in a hurry. The seventh failure is detection. Watching for unusual logins does not work when the intruder arrives holding valid credentials and behaves like an administrator. What would work is alerting on the handful of actions that precede every mass event, a new or modified artefact, a first execution, an unusually broad target set, an out-of-hours mass push, and almost nobody does, because the platform's alerting is oriented to endpoint health rather than to administrative behaviour inside itself. Providers also decline the one structural advantage they have: they can see every customer at once, so the same indicator landing in two unrelated organisations inside a week is a strong signal, and it gets closed twice as two unrelated events because detection is built per customer with no view across tenants. The eighth failure is that standing access makes a stolen credential worth the whole customer base rather than one environment, and it persists because nobody has made the request path fast enough for a technician working an outage. The ninth failure is the response. The decision to sever the management plane has to be made in minutes on partial information, it stops the attacker and it stops service delivery for every customer simultaneously, and taken live by whoever is available it is dominated every time by the certain immediate cost of the outage over the uncertain larger cost of the spread. Then the recovery plan turns out to begin by using the platform that has just been disconnected. And the notification obligations arrive all at once, with different clocks and different recipients, at the moment the team is least able to draft anything. Where teams fall short is predictable: a delivery plane nobody has inventoried, technician accounts that reach everything all the time, sharing proven by assertion, the inbound direction unexamined, a console on the open internet, a patch window measured in weeks for a product exploited in days, one person able to reach every endpoint in one action, no alert on the actions that always come first, no view across tenants, and a severance decision left to the night it is needed.
This Kit removes the guesswork. It is multi-tenant provider infrastructure security written as adopt-ready controls you personalize in a weekend, with the evidence a customer's security team, an insurer, an auditor or your own board actually examines.
What you get, the moment you buy
Grounded in how managed service delivery is actually run and actually attacked, from the provider's side of the boundary. Editable Word and Excel files. This is a practitioner method and it is honest about the trade between isolation and the speed your service desk is measured on.
What one control looks like
This is the opening control, where the delivery plane either becomes an estate you can defend or stays the office network that happens to reach every customer. All 18 are built to this depth.
Why this is not another template pack
- The evidence is the point. A network diagram and a good intention are not evidence. This tells you what a customer's security team, an insurer, an auditor or your own board examines and where teams fall short, for every control.
- The hard specifics built in. A named tier-zero inventory of every system that can reach a customer environment with an owner and an authentication path per system, quarterly reconciliation against the identity provider and the tooling's own device list, privileged technician identities separated from everyday accounts with phishing-resistant authentication and weaker methods withdrawn rather than kept as fallback, shared privileged accounts enumerated and closed, every action bound to a named person and a ticket in a store the technician cannot alter and exportable per customer, sharing proven by enumeration across credentials, keys, certificates, service accounts and enrolment tokens, per-device local administrator rotation with the failure rate reported, inter-customer routing tested from inside one environment towards another, shared backup, patching, monitoring and file transfer components assessed individually, a register of every inbound channel from a customer network into provider infrastructure terminated at a broker and tested from a controlled position, the design walked against the real technician workflow with workarounds recorded as findings and deployed rules compared quarterly against the approved design, internet-facing management interfaces inventoried including legacy components, restricted by source or identity-aware access and scanned monthly from outside, a patch standard in hours for pre-authentication flaws with a twice-yearly rehearsed emergency path and a measured rollback, weekly agent version inventory reconciled against the asset register, a minimum supported version enforced by upgrade or revocation, enrolment tokens vaulted with scope and expiry and revoked at decommissioning, author and approver separated by mechanism for estate-wide execution with a version-controlled repository as the only source, a numeric cap on endpoints and customer environments with the resolved target list shown before execution and staged waves above it, alerts on new artefacts, first executions, broad target sets, out-of-hours mass pushes and logging changes delivered outside the platform and proven quarterly by an injected test, centralised delivery plane telemetry with a per-customer lawful collection statement enforced by configuration, cross-tenant correlation on shared indicators and unexplained technician breadth triaged against the ticket system first, just-in-time time-boxed access with standing entitlements enumerated and reviewed, written severance criteria held outside the platform with tested and timed steps and named consequences, an out-of-band remediation path with credentials and documentation beyond the reach of a delivery plane compromise, and a contract-mapped notification process rehearsed against an unauthorised-job scenario are written into the controls, not left generic.
- Built on real practice, not one person's opinion, grounded in how multi-tenant service delivery actually holds together and where that discipline usually breaks down under ticket pressure.
- It compounds. This work shares its shape with identity and access management, change control, incident response and customer assurance, so it feeds your wider operating model and answers most of the security questionnaire you get asked anyway.
Who buys this
Security architects, infrastructure and platform leads, service delivery and operations managers, and the technical directors accountable for a managed service provider's own environment, who have to say who can reach which customer, whether a single credential works in more than one of them, what one job could touch, how quickly the management console gets patched, how an intruder using your own tooling would be noticed, who can decide to sever the management plane at three in the morning, and how remediation happens if the platform itself cannot be trusted. Whether you are hardening a delivery plane that grew organically or formalising practice that is already careful and completely unevidenced, you save weeks and walk in with your identity, segmentation, tooling, blast radius, detection and response controls structured.
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Does it cover the whole practice? Yes. The management plane as a tier-zero asset, segmentation between customer environments, the pre-authentication surface of remote monitoring and management tooling, blast radius control over estate-wide execution, cross-boundary detection and correlation, and incident response for provider compromise and mass remediation each have their own controls with their own evidence.
Is this about managing my third-party vendors? No, and that is the most important thing to be clear about. This is written from the provider's side of the boundary: your own multi-tenant infrastructure, your technicians, your tooling, your blast radius. Vendor questionnaires, attestations, contract liability and how a customer governs its provider are a different subject with a different Kit.
Is it tied to one management platform or one cloud? No. The controls are principle-level, the identity separation, the enumeration discipline, the inbound direction, the exposure and patching rules, the execution limits, the detection correlations and the response criteria, so they apply whatever you run your delivery plane on and whatever you manage endpoints with.
Does it tell me what thresholds to use? No, and it should not. Every cap, window, patch deadline, review cadence and access duration in the Kit is a number your organization sets and records. What the Kit gives you is the method, the evidence and the discipline that makes your own numbers defensible.
What if it is not for me? A 30-day money-back guarantee.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com