21 September Blog

Your IT Provider Says You're Secure. But Is That Even the Right Question?

I regularly ask business owners and senior executives about cybersecurity. A response I still hear surprisingly often is:
“We’re comfortable. Our IT provider looks after that.”
Or:
“Our MSP has cybersecurity covered.”
There was a time when my immediate response would have been:
“But who independently checked?”
I still believe independent assurance matters enormously, but increasingly, I think we need to challenge the premise of the question itself. Because if we are asking whether the IT provider, MSP or MSSP has made the organisation secure, are we still treating cyber as an IT problem? And if we are, perhaps that is the bigger risk.
Cyber Has Left the IT Department
Cybersecurity has changed, so has the use of AI. Both now reach into almost every part of an organisation.

• Finance uses AI.
• Marketing uses AI.
• HR holds sensitive employee information.
• Operations depend on interconnected systems and suppliers.
• Employees work remotely, access cloud applications and make security decisions every day.
• Executives make decisions about risk, investment and priorities.
• The Board determines risk appetite and oversees organisational resilience.

When an incident occurs, it isn't simply the IT department that responds, it may involve the CEO, Board, legal advisers, communications teams, HR, finance, insurers, regulators, customers and external providers. So why do we continue asking:
“Is IT keeping us secure?”
Perhaps the better question is:
“Is the organisation governing cyber and AI risk effectively?”
That is a very different conversation.
Your MSP May Be Doing an Excellent Job! This is not an argument against MSPs or MSSPs. Quite the opposite, a strong technology partner can be enormously valuable. They may manage your infrastructure, monitor threats, maintain security tools, manage identities, protect endpoints, maintain backups and help respond to incidents. They may know your technology environment better than almost anyone.
But there is an important distinction:
Knowing your technology environment is not the same as governing your organisation.
And nor should we expect it to be. Your MSP cannot determine your organisation's risk appetite; it cannot decide what level of business disruption your Board is prepared to tolerate. It cannot create your organisational culture, nor can it ensure that every executive understands their responsibilities during a crisis. It cannot determine how comfortable employees feel reporting mistakes or near misses, nor can it decide where your organisation draws the line on acceptable AI use or own the Board's accountability for organisational resilience. Those responsibilities belong inside the organisation.
So Perhaps We've Been Asking Our Providers the Wrong Question
Imagine asking your MSP: “Are we secure?” What exactly are we asking them to assess?

• Your endpoints?
• Firewalls?
• Identity controls?
• Backups?
• Cloud environment?
• Email security?
• Vulnerabilities?
• Monitoring?

Those things matter enormously, but consider a different set of questions:

• Does our Board understand our cyber and AI risk exposure?
• Have we clearly defined our risk appetite?
• Do our people understand their role in protecting the organisation?
• Can an employee report a mistake without fearing that they will be blamed?
• Do we know which AI tools are being used across the business?
• Do we understand the cyber dependencies within our supply chain?
• Does everyone know who has decision-making authority during a serious incident?
• Could the executive team operate effectively if critical systems were unavailable?
• Has the Board actually exercised a cyber crisis?
• Are lessons from incidents and near misses changing the way we operate?
• And can we demonstrate that our resilience is improving?

Suddenly, “Our MSP says we're secure” doesn't answer very much.
The Problem Isn't the MSP. It's the Governance Model.
This distinction matters. If an organisation has effectively handed responsibility for cybersecurity to its technology provider, I don't think we should automatically blame the provider. We should examine the governance model.
Somewhere along the way, many organisations appear to have confused outsourcing cybersecurity services with outsourcing responsibility for cyber risk. They aren't the same thing. You can outsource technology, monitoring, specialist security capability, penetration testing and incident response expertise. But there are things you cannot meaningfully outsource.

• Leadership.
• Accountability.
• Risk appetite.
• Culture.
• Governance.

Ultimately, the organisation still owns the risk.
This Is Why Cyber and AI Belong in the Boardroom
Over the course of developing the Cyberplanz Boardroom Guide to Cyber & AI Governance, one theme has become increasingly clear to me:
Cyber resilience is an organisational capability, not an IT product.
The same is rapidly becoming true of AI governance. Technology remains critically important, but technology is only part of the picture. I believe Boards need to consider resilience through five interconnected areas.
LEAD

• Does the Board provide appropriate governance, leadership and accountability?
• Is risk appetite understood?
• Are cyber and AI risks being discussed as business risks rather than technical issues?

PROTECT

• Are appropriate cybersecurity, AI governance, policy and third-party controls in place?
• This is where your IT providers, MSPs, MSSPs and security technologies play a crucial role, but notice something important.

Protect is one part of the governance picture. It isn't the entire picture.
ENGAGE

• Does the organisation have a culture that supports resilience?
• Are employees engaged?
• Do they understand why security matters?
• Can they challenge unsafe behaviour?
• Do they report mistakes and near misses?
• Are cyber champions, communication and staff wellbeing part of the conversation?

RESPOND

• When something goes wrong, can the organisation actually respond?

Not just IT, The organisation.

• Does leadership know what to do?
• Are responsibilities clear?
• Have business continuity and crisis management arrangements been tested?
• Can difficult decisions be made quickly with incomplete information?

IMPROVE

• Finally, how does the Board know things are getting better?
• What is being measured?
• What are audits revealing?
• What lessons have been learned?
• What changed after the last incident, exercise or near miss?
• And is innovation creating new risks faster than governance can understand them?

Taken together, these questions create a very different view of cybersecurity. And That Changes the Purpose of Independent Assurance. This also changes what we should mean when we talk about an independent cyber review.
The objective shouldn't simply be: “Let's check whether our MSP is doing its job.” That is too narrow, the MSP should certainly be part of the picture, but independent assurance should examine the organisation.

• Does leadership understand the risks?
• Does the organisation's technology environment support its business requirements?
• Are provider responsibilities clearly defined?
• Are controls aligned with the organisation's risk appetite?
• Is AI being governed?
• Are people engaged?
• Is the culture helping or hindering resilience?
• Can the organisation respond to a serious incident?
• And is the Board receiving meaningful evidence rather than technical reassurance?

That isn't an audit of the MSP. It is an assessment of organisational resilience.
There Is Still a Role for Independent Challenge
Independence nevertheless remains important. Your MSP may genuinely believe you are well protected. Your internal IT team may genuinely believe your controls are appropriate. Your executives may genuinely believe employees know what to do. And the Board may genuinely believe the organisation could manage a major incident. Everyone can be acting professionally and in good faith, and everyone can still be wrong.

• Assumptions develop.
• Blind spots emerge.
• Responsibilities become blurred.
• Policies drift away from actual behaviour.
• Technology changes.
• New suppliers are introduced.
• Employees adopt AI tools.
• People leave.
• Businesses restructure.
• Risk appetite changes.
• What was appropriate two years ago may no longer reflect the organisation that exists today.

That is where independent challenge becomes valuable, not because somebody necessarily needs to be caught doing something wrong. But because occasionally an organisation needs somebody outside the existing structure to ask:
“How do you know?”
 
A Different Boardroom Conversation
So perhaps the next time someone around the Board table says: “Our IT provider tells us we're secure,” the response shouldn't immediately be: “Has anyone independently checked them?”
Perhaps it should be: “What exactly do we mean by secure?” Then:

• “Secure against what?”
• “Within whose risk appetite?”
• “Who owns that risk?”
• “How do our people and culture contribute to our resilience?”
• “What happens when something gets through?”
• “How are we governing AI alongside cyber?”
• And finally: “What independent evidence do we have that our organisation can answer those questions?”

That is the conversation I believe Boards increasingly need to have.
Trust Your MSP. Govern Your Organisation.
Your MSP can be an excellent partner, your MSSP can provide outstanding security capability. Your internal IT team can be highly competent. None of those things removes the need for governance and none of them transfers accountability away from leadership.
Perhaps, therefore, the future conversation about cybersecurity shouldn't begin with: “Is our IT provider keeping us secure?”, it should begin with: “Are we building an organisation capable of understanding, governing, responding to and learning from cyber and AI risk?” Then ask: “What evidence proves it?” Because ultimately, cybersecurity isn't something your IT provider does to your organisation.
Resilience is something your organisation builds together.