MSPs & MSSPs

Inventory remote monitoring and management systems, professional services automation, deployment tools, support portals, credential stores, and their integrations. Determine which identities can execute commands, distribute software, or change policy across clients. Restrict those permissions and monitor the activity that uses them.

Librarian can help organize management dependencies, and Argus can inform exposed-secret investigations. Keep administration separate from ordinary browsing and email. A compromised support account should not automatically provide unrestricted access to every customer, even when centralized tooling makes that access convenient.

• Use individual privileged accounts and strong authentication.
• Review deployment scripts, API tokens, and third-party management integrations.

Test isolation across access permissions, logs, tickets, reports, backups, and automation jobs. Tenant separation is not only a dashboard feature: engineers must avoid copying secrets or customer evidence into the wrong workspace. Define how emergency access is requested, approved, recorded, and removed.

Use Relay with least-privilege integrations and clearly documented customer authorization. Sleight or Verification & Response activities must be explicitly scoped to the customer environment involved. Do not infer that a service agreement authorizes every type of testing, data collection, or automated remediation.

• Separate credentials and recovery access between customers.
• Review technician access when assignments and customer contracts change.

Document which actions the provider may take, which require customer approval, and how emergency decisions are escalated. Prepare for a compromise of the provider's own tooling, including the possibility that normal communications and ticketing cannot be trusted. Maintain verified customer contacts independently.

Dewey can support coordination and Growler can assist with evidence handling, but human authorities retain consequential decisions. Judge can help organize posture evidence without guaranteeing contractual compliance or insurance outcomes. Confirm deployment-specific multi-tenant, white-label, or OEM arrangements rather than treating them as universal capabilities.

• Exercise revocation of shared management access.
• Test restoration and customer notification workflows without mixing tenant information.