The BPO credential problem every financial services firm is carrying

When Medibank's customer data breach exposed 9.7 million records in October 2022, investigators traced the attack vector to compromised credentials at a third-party provider. The incident crystallised a growing concern across financial services: Business Process Outsourcing (BPO) arrangements create credential exposure that traditional security frameworks cannot adequately address.

The hidden liability in your supply chain

Financial institutions have spent the past decade hardening their internal security posture, deploying sophisticated identity and access management systems, implementing zero-trust architectures, and enforcing multi-factor authentication across their estates. Yet a critical vulnerability persists in plain sight: the credentials managed by Business Process Outsourcing partners.

BPO arrangements in financial services typically involve sensitive operations—customer service, claims processing, transaction monitoring, compliance reporting, and data analytics. These partnerships require BPO providers to maintain administrative access to core banking systems, trading platforms, customer databases, and regulatory reporting tools. Each access point represents a credential that, if compromised, can provide attackers with a direct pathway into the financial institution's most sensitive systems.

The challenge extends beyond simple access management. BPO environments often operate under different security standards, employ staff with varying levels of security awareness, and maintain credential practices that would be considered inadequate within the financial institution itself. Yet these same credentials can access systems containing customer financial data, trading information, and regulatory filings.

The scale of exposure

Recent industry analysis reveals the extent of this exposure. According to the Financial Conduct Authority's 2023 operational resilience survey, 78% of UK financial services firms rely on critical BPO arrangements, with an average of 12 third-party providers having access to systems classified as important business services.

Verizon's 2023 Data Breach Investigations Report found that 61% of breaches in financial services involved compromised credentials, with 43% of these originating from partner or supply chain access points. The average cost of a supply chain breach in financial services reached $4.8 million in 2023, according to IBM Security's Cost of a Data Breach report.

The regulatory implications are equally concerning. The European Central Bank's 2023 cyber incident reporting data shows that 34% of significant cyber incidents reported by credit institutions involved third-party or outsourcing arrangements. In the United States, the Office of the Comptroller of the Currency cited inadequate third-party risk management in 23% of enforcement actions against national banks in 2023.

Perhaps most tellingly, a study by the Ponemon Institute found that financial services organisations can identify only 57% of the credentials held by their BPO providers at any given time. This visibility gap represents a fundamental control failure in environments where regulatory frameworks demand comprehensive oversight of access to sensitive systems.

Why current security tools miss the mark

The financial services sector has invested heavily in sophisticated access management technologies, yet these solutions fail to address the fundamental issue of credential control in BPO relationships.

Identity and Access Management (IAM) systems excel at managing identities within organisational boundaries but struggle with the distributed nature of BPO credentials. These systems can provision and deprovision access, but they cannot prevent BPO staff from accessing, copying, or sharing the underlying credentials themselves.

Privileged Access Management (PAM) solutions provide session recording and approval workflows, but they still rely on the principle that users hold their own credentials. When a BPO employee receives credentials for a privileged account, PAM systems can monitor how those credentials are used but cannot prevent the credentials from being compromised at source.

Single Sign-On (SSO) reduces credential proliferation but requires extensive integration work and may not be feasible across complex BPO arrangements involving multiple systems and platforms. More fundamentally, SSO still requires users to hold authentication credentials, merely consolidating rather than eliminating the risk.

Multi-Factor Authentication (MFA) adds a layer of security but does not address credential theft. Sophisticated attackers have demonstrated numerous techniques for bypassing MFA, from SIM swapping to real-time phishing attacks that capture both passwords and authentication tokens.

Zero Trust architectures improve security posture by assuming no inherent trust, but they still must grant access based on some form of credential verification. If those underlying credentials are compromised, Zero Trust principles provide limited protection.

The common failure across these approaches is structural: they assume that users must hold credentials to access systems. This assumption creates an inherent vulnerability that no amount of monitoring, encryption, or access control can fully eliminate.

Solving credential control at source

The solution lies in fundamentally restructuring credential ownership and distribution. Rather than allowing BPO partners to create, hold, and manage credentials, financial institutions need systems where credentials are generated, distributed, and controlled entirely by the organisation—with users never gaining direct access to the credential material itself.

Under this model, when a BPO employee needs to access a financial system, they receive encrypted credential material that can only be decrypted and used within a controlled environment. The employee cannot extract, copy, or share the underlying credentials because they never possess them in a readable format. Access becomes cryptographically bound to specific devices and sessions, making credential theft practically impossible.

MyCena's patented credential control technology demonstrates this approach in practice. The system generates unique encrypted credentials for each user and session, distributing them through secure channels without ever exposing the credential material to the end user. BPO employees can access the systems they need to perform their roles, but the underlying authentication mechanism remains entirely under the financial institution's control.

This architectural shift transforms BPO credential management from a risk management exercise into a technical control. Rather than hoping that BPO partners will maintain adequate security practices, financial institutions can ensure that compromise of BPO environments cannot lead to credential theft.

The compliance imperative

For financial services firms, the implications are clear. Regulatory frameworks increasingly require demonstrable control over third-party access to sensitive systems. The EU's DORA regulation, which takes effect in January 2025, explicitly requires financial entities to maintain "full oversight and accountability" for ICT services provided by third parties.

The time for treating BPO credential management as a contractual rather than technical problem has passed. Financial institutions that continue to rely on traditional access management approaches for BPO relationships are carrying a structural vulnerability that regulatory scrutiny and threat actor sophistication will inevitably expose.

The path forward requires recognising that identity and access are separate concepts—and that true security emerges from controlling access without distributing the credentials that enable it.

SolarWinds: How One Vendor Credential Reached 18,000 Organisations Including the US Government

On 13 December 2020, cybersecurity firm FireEye disclosed that nation-state attackers had infiltrated SolarWinds' Orion network management software, creating what would become the most significant supply chain cyberattack in history. The breach exposed a fundamental vulnerability in how organisations manage vendor access: a single compromised credential cascade through 18,000 customers, including nine US federal agencies and Fortune 500 companies.

The attack began with attackers inserting malicious code into SolarWinds' software updates between March and June 2020. When customers installed routine updates, they unknowingly granted attackers persistent access to their networks. This breach demonstrated how vendor credential management failures can transform trusted business relationships into national security threats.

The Critical Gap in Government Vendor Access Control

Defence and public sector organisations face a unique challenge in vendor credential management. Unlike private companies that can limit third-party access, government agencies require extensive contractor and vendor integration for everything from IT infrastructure to classified research programmes. Each vendor relationship creates potential attack vectors through shared credentials, privileged access, and interconnected systems.

The SolarWinds incident exposed how traditional credential management approaches fail at scale. Government agencies typically manage vendor access through manual processes, shared accounts, or basic identity management systems that assume credentials remain secure once issued. This assumption proved catastrophic when attackers gained access to SolarWinds' internal systems and leveraged existing vendor credentials to move laterally across customer networks.

The attack succeeded because it exploited the trust relationship between vendors and customers. SolarWinds' legitimate credentials provided attackers with authorised access to customer systems, bypassing traditional perimeter security controls. For government agencies handling classified information or critical infrastructure, this represented a complete failure of access control architecture.

The Scale of Compromise: By the Numbers

The SolarWinds breach affected approximately 18,000 organisations that downloaded compromised software updates, according to SolarWinds' own SEC filings. However, the attackers demonstrated strategic targeting, with Microsoft estimating that fewer than 1,000 organisations were actually compromised through follow-on activities.

Among confirmed victims, nine US federal agencies were breached, including the Departments of State, Treasury, Homeland Security, Energy, and Commerce. The attackers maintained persistent access for up to nine months before detection, with some intrusions continuing for months after the initial disclosure.

Financial impact data reveals the true cost of credential compromise. SolarWinds reported spending over $18 million on incident response in 2021 alone, while facing multiple federal investigations and lawsuits. The company's market capitalisation fell by approximately $3.3 billion in the weeks following disclosure, according to financial filings.

The UK's National Cyber Security Centre identified that British government departments were among those affected, though the full extent remains classified. Similar impacts were reported across NATO allies, demonstrating how vendor credential compromise can cascade across international government networks.

Why Traditional Security Tools Failed

The SolarWinds attack succeeded despite extensive deployment of modern security tools across victim organisations. Identity and Access Management (IAM) systems failed because they authenticated legitimate SolarWinds credentials — the attackers were using valid access tokens obtained through the supply chain compromise.

Privileged Access Management (PAM) solutions, designed to control high-value accounts, proved ineffective because the attackers leveraged standard vendor access rather than obviously privileged credentials. The malicious code operated within normal software update processes, avoiding PAM monitoring focused on administrative activities.

Single Sign-On (SSO) and Multi-Factor Authentication (MFA) provided no protection because attackers bypassed these controls entirely. Once inside victim networks through legitimate SolarWinds access, attackers could move laterally without triggering authentication challenges designed for external access.

Zero Trust architectures, increasingly adopted across government agencies, failed to prevent the breach because they still relied on validating credentials rather than controlling their creation and distribution. The fundamental assumption — that credentials can be trusted once verified — remained intact and exploitable.

These tools address authentication and monitoring but do not solve the core problem: organisations cannot control credentials they allow others to create and hold. Vendor credentials, by definition, exist outside organisational control boundaries, creating persistent blind spots in security architecture.

Structural Solution: Organisational Credential Control

The SolarWinds breach demonstrates that effective security requires organisations to maintain complete control over all credentials accessing their systems, including vendor access. This means shifting from credential verification to credential generation and distribution.

Under a controlled credential model, organisations generate all access credentials centrally, distribute them in encrypted form, and maintain continuous revocation capability. Vendors and contractors never possess plaintext credentials, eliminating the possibility of credential theft or misuse. Access becomes truly unphishable because users cannot disclose credentials they do not hold.

This approach transforms vendor relationships from trust-based to verification-based. Rather than trusting vendors to secure their own credentials, organisations maintain cryptographic control over access rights. When vendors require system access, they request specific permissions that are granted through encrypted credential distribution, not permanent credential sharing.

MyCena's patented technology implements this model by ensuring users never see or control their own credentials. The system generates cryptographically secure credentials, distributes them in encrypted form, and enables instant revocation across all access points. For government agencies, this means vendor access can be controlled with the same rigour applied to classified information handling.

Implications for Defence and Public Sector Leaders

The SolarWinds breach created lasting regulatory and operational changes across government agencies. The US Executive Order on Cybersecurity (EO 14028) now mandates specific controls for software supply chains and vendor access management. Similar requirements are emerging across allied nations, creating compliance obligations that traditional security tools cannot address.

Government leaders must recognise that vendor credential compromise represents a systemic risk requiring architectural solutions, not incremental security improvements. The shift toward controlled credential distribution will become a requirement, not an option, as regulatory frameworks evolve.

Organisations should immediately audit vendor access arrangements and identify credentials existing outside their direct control. Each uncontrolled credential represents a potential SolarWinds-style compromise vector that could provide attackers with authorised access to critical systems.

The lesson from SolarWinds is clear: in an interconnected threat environment, credential control cannot be delegated to third parties, regardless of trust relationships or contractual obligations. Security architecture must assume credential compromise and design accordingly.

SOC 2, ISO 27001, and NIS2: what MSPs must evidence on credential governance

The £36 million fine imposed on British Airways following its 2018 data breach sent shockwaves through every sector that handles client data. For Managed Service Providers (MSPs), the message was unambiguous: credential compromise affecting customer environments now carries existential financial risk. Yet three years after NIS2 came into force, most MSPs remain fundamentally exposed to the same attack vector that felled BA—compromised credentials that auditors cannot trace, control, or revoke.

The MSP credential complexity crisis

MSPs face a unique credential governance challenge that traditional enterprises do not. Where a corporation manages credentials for its own employees accessing its own systems, MSPs must govern credentials across multiple client environments, each with distinct security requirements and regulatory obligations.

Consider a mid-sized MSP managing 200 client environments. Each technician requires administrative access to client systems, backup platforms, monitoring tools, and cloud infrastructure. Multiply this across shift patterns, contractor access, and emergency response scenarios, and the credential count rapidly exceeds 50,000 active credentials. When SOC 2 Type II auditors examine this environment, they require evidence of credential creation, distribution, usage monitoring, and revocation for every single access point.

The regulatory burden intensifies under NIS2, which explicitly requires "appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems." For MSPs, this translates to demonstrable control over every credential that could impact client systems. ISO 27001 certification, increasingly demanded by enterprise clients, requires similar evidence under control A.9.2.1 (User Registration and De-registration) and A.9.2.6 (Access Rights Review).

The data tells a stark story

Recent research from the Ponemon Institute reveals that 61% of data breaches in managed services environments involve compromised credentials. More concerning for MSPs: the average time to identify a credential-based breach is 287 days, during which attackers maintain persistent access to client environments.

Verizon's 2024 Data Breach Investigations Report found that 68% of breaches involving managed service providers used stolen credentials as the primary attack vector. The financial impact extends beyond direct losses—MSPs report an average 23% client churn rate following a credential-related security incident, according to CompTIA's 2024 MSP Trust and Security Study.

Regulatory penalties compound these losses. Under NIS2, fines can reach €10 million or 2% of global annual turnover. For MSPs operating on typical 15-20% margins, a single significant breach can eliminate years of profit growth.

The compliance burden generates hidden costs too. MSPs report spending an average of 40 hours per quarter preparing credential governance evidence for SOC 2 audits, according to Service Leadership research. ISO 27001 certified MSPs spend 60% more time on credential documentation than their non-certified counterparts.

Why current tools fall short of regulatory requirements

Identity and Access Management (IAM) platforms promise credential control but typically delegate password creation to users. When auditors examine IAM logs, they see access events but cannot verify who actually created or knows the credential. SOC 2's CC6.1 control requires evidence that logical access is "restricted to authorised users"—difficult to prove when users generate their own passwords.

Privileged Access Management (PAM) solutions create another layer of complexity. While PAM tools can vault and rotate passwords, they still rely on users creating initial credentials. Under ISO 27001's A.9.4.3 control (Privileged Access Rights Management), organisations must demonstrate that privileged credentials are "allocated and used on a restricted and controlled basis." User-generated passwords cannot meet this standard.

Single Sign-On (SSO) centralises authentication but does not address the fundamental issue: users still create and know their credentials. Multi-Factor Authentication (MFA) adds security layers but phishing attacks increasingly defeat SMS and app-based MFA. Microsoft reported a 74% increase in successful phishing attacks against MFA-protected accounts in 2024.

Zero Trust architectures assume breach and verify every transaction, but verification relies on credentials that users control. If the underlying credential is compromised, Zero Trust becomes a sophisticated system for authenticating attackers.

The common failure point across all these technologies: they conflate identity with access. Users prove who they are using credentials they created and control. This fundamental design makes credentials inherently phishable and governance inherently incomplete.

Separating identity from access control

The solution requires recognising that identity and access represent distinct concepts. Identity establishes who someone is; access determines what they can reach. Current systems blur this distinction by letting users create credentials that serve both functions.

MyCena Technologies has developed a patented approach that separates these functions entirely. Under this model, organisations generate all credentials using cryptographic processes. These credentials are encrypted and distributed to authorised users, but users never see the actual password. When authentication occurs, the credential is decrypted automatically without user visibility or input.

This architectural change makes credentials unphishable—users cannot reveal passwords they have never seen. For MSPs, it creates complete credential governance: every password is organisationally generated, cryptographically distributed, and centrally revocable. Auditors can trace the complete lifecycle of every credential without relying on user testimony or behaviour.

The compliance implications are significant. SOC 2 auditors can verify that all credentials are "restricted to authorised users" because unauthorised users cannot create them. ISO 27001 requirements for "controlled allocation" of access rights become automatically satisfied. NIS2's "appropriate technical measures" standard is met through cryptographic proof rather than policy documentation.

The path forward for MSPs

MSPs cannot afford to treat credential governance as a technical problem solved by layering additional tools onto user-controlled passwords. Regulatory frameworks increasingly require evidence of organisational control over credentials, not just monitoring of credential usage.

The shift toward organisational credential generation represents a fundamental architecture change, not a product upgrade. MSPs evaluating this transition should assess their current credential count, audit preparation costs, and client security requirements. The question is not whether credential governance will become mandatory—NIS2, SOC 2, and ISO 27001 have already made that decision—but whether MSPs will implement proactive solutions or await the next regulatory penalty.

The British Airways fine demonstrated that credential compromise carries existential risk. For MSPs managing hundreds of client environments, the stakes are proportionally higher. The technology now exists to eliminate this risk entirely. The only question is timing.

One vendor credential. Every operator they serve. The supply chain cascade.

When hackers breached Colonial Pipeline in May 2021, shutting down America's largest fuel pipeline for six days, investigators traced the attack to a single compromised credential belonging to a former employee. That one password — likely harvested from the dark web — gave DarkSide ransomware operators access to the entire network, triggering fuel shortages across the Eastern seaboard and $4.4 million in ransom payments.

The incident exposed a fundamental vulnerability in critical infrastructure: the cascade effect of credential compromise through supply chains. One breached vendor credential can unlock access to dozens of downstream operators, creating systemic risk that regulators are only beginning to understand.

The multiplier effect in critical infrastructure

In the energy sector, a single technology vendor typically serves multiple grid operators, pipeline companies, and power generation facilities. When that vendor's credentials are compromised, attackers gain potential access to every client in their portfolio. The mathematics are stark: one successful phishing attack can multiply into dozens of simultaneous infrastructure breaches.

This supply chain credential risk is particularly acute in industrial control systems, where vendors require privileged access to monitor and maintain critical operational technology. A single engineering firm might hold administrative credentials for wind farms across three states. A SCADA software provider could have remote access capabilities across dozens of water treatment facilities.

The problem extends beyond direct vendor relationships. Subcontractors, consultants, and temporary workers create additional credential pathways, each representing potential vectors for lateral movement through interconnected infrastructure networks.

The scale of exposure

Recent data from the Cybersecurity and Infrastructure Security Agency reveals the scope of this vulnerability. CISA's 2023 Critical Infrastructure Threat Assessment identified credential compromise as the initial attack vector in 82% of successful breaches against energy sector targets, with supply chain relationships facilitating lateral movement in 67% of cases.

The Department of Energy's cyber incident reporting data shows that vendor-related breaches affect an average of 3.4 additional infrastructure operators beyond the initial target. In the most severe cases, a single compromised vendor credential has cascaded to impact up to 12 separate facilities across multiple states.

Financial losses compound accordingly. While direct breach costs for energy companies average $6.25 million according to IBM's Cost of a Data Breach Report 2023, supply chain incidents generate additional liability exposure. Colonial Pipeline's total incident costs, including business disruption and regulatory penalties, exceeded $90 million.

The North American Electric Reliability Corporation (NERC) reported 263 cyber security incidents across the bulk power system in 2022, with 34% traced to third-party credential compromise. Each incident triggered mandatory reporting requirements and potential compliance violations under NERC CIP standards.

Why current security tools fail the cascade test

Identity and Access Management (IAM) systems excel at managing internal user lifecycles but struggle with external vendor credential oversight. Most IAM platforms cannot enforce consistent credential policies across third-party relationships, creating governance gaps that attackers exploit.

Privileged Access Management (PAM) solutions address some vendor access challenges by creating secure credential vaults and session monitoring. However, they typically operate within individual organisational boundaries. When a vendor's PAM-managed credential is compromised at their home organisation, that breach can still cascade to client environments where the same vendor maintains separate access rights.

Single Sign-On (SSO) reduces credential proliferation but creates single points of failure. A compromised SSO credential grants access to multiple connected systems simultaneously. For vendors serving multiple infrastructure clients, SSO compromise amplifies rather than reduces cascade risk.

Multi-Factor Authentication (MFA) provides additional security layers but remains vulnerable to sophisticated phishing attacks. The Lapsus$ group demonstrated advanced MFA bypass techniques in their 2022 infrastructure targeting campaign, using social engineering to overcome authentication barriers.

Zero Trust architectures improve security posture by assuming breach and continuously validating access requests. However, they do not solve the fundamental problem: users still create, know, and control their own credentials. A compromised user can still authenticate legitimately within a Zero Trust framework.

Separating identity from credential control

The structural solution requires separating identity verification from credential ownership. Rather than allowing users to create and manage their own passwords and access tokens, organisations must retain complete control over credential generation, distribution, and revocation.

This principle shifts the security paradigm from "trust but verify" to "control and distribute". Under this model, users prove their identity through biometric or other verification methods, but never possess the actual credentials that grant system access. Instead, encrypted credentials are generated centrally and delivered directly to target systems without user visibility.

MyCena's patented approach implements this separation by removing human knowledge from the credential equation. Users authenticate their identity, but the organisation maintains exclusive control over the cryptographic keys that actually unlock system access. Because users never see or handle these credentials, they cannot be phished, stolen, or misused across multiple client environments.

This architecture prevents supply chain cascade failures by ensuring that even if a vendor's identity verification process is compromised, the underlying credentials remain secure and cannot be replayed against client systems. Each access session requires fresh cryptographic validation from the controlling organisation.

Regulatory convergence demands action

Multiple regulatory frameworks are converging on supply chain credential management requirements. The Transportation Security Administration's cybersecurity directives for pipeline operators explicitly require "cybersecurity risk assessments" of third-party remote access. The Securities and Exchange Commission's new cyber disclosure rules include materiality thresholds that treat vendor credential breaches as potentially reportable events.

NERC CIP-004 standards mandate "personnel risk assessments" for vendor access, while proposed updates to CIP-013 would strengthen supply chain cybersecurity requirements. The Federal Energy Regulatory Commission has indicated that future compliance examinations will focus heavily on third-party access controls.

For critical infrastructure operators, the message is clear: credential cascade risk is transitioning from a cybersecurity concern to a regulatory compliance requirement. Organisations that cannot demonstrate robust vendor credential governance face increasing scrutiny from multiple oversight bodies.

The mathematics of supply chain credential risk are unforgiving. One compromised vendor affects multiple operators. Multiple operators create systemic infrastructure vulnerability. Systemic vulnerability attracts regulatory intervention and potential enforcement action. The most effective defence is preventing the initial credential compromise through organisational control rather than user responsibility.

Kaseya: how one MSP credential reached 1,500 downstream businesses in hours

On July 2, 2021, attackers compromised a single Managed Service Provider credential at Kaseya, triggering the largest supply chain ransomware attack in history. Within hours, the breach cascaded through approximately 60 MSPs to reach an estimated 1,500 downstream businesses across 17 countries. The attack's velocity exposed a fundamental weakness in how managed service providers control access to customer environments.

The REvil ransomware group exploited a zero-day vulnerability in Kaseya's VSA remote monitoring software, but the breach's devastating reach stemmed from compromised service credentials that provided administrative access across multiple client networks. This single point of failure demonstrated how traditional identity management fails when applied to the MSP model's inherently distributed architecture.

The MSP credential multiplication problem

Managed Service Providers operate on a fundamentally different access model than traditional enterprises. Where internal IT teams manage credentials within defined network perimeters, MSPs must maintain privileged access to dozens or hundreds of client environments simultaneously. This creates an exponential multiplication of attack surfaces.

Each MSP technician typically holds administrative credentials for multiple client systems, creating what security researchers term "credential sprawl." These credentials often persist across extended periods, accumulate as client bases grow, and frequently lack granular controls over specific access permissions. The problem intensifies when MSPs use centralised management platforms like Kaseya's VSA, which aggregate access to multiple client environments through single authentication points.

The Kaseya incident illustrates this multiplication effect in stark terms. Attackers needed to compromise only one pathway to reach Kaseya's MSP customers, who then became unwitting conduits to thousands of downstream businesses. The breach propagated through established trust relationships and legitimate access channels, making detection and containment exceptionally difficult.

The scale of MSP vulnerability

Recent data reveals the scope of this structural weakness across the managed services sector. According to Cybersecurity Ventures, the global MSP market reached $354.8 billion in 2023, with over 40,000 MSPs operating worldwide. Research from Datto shows that 82% of MSPs manage security for their clients, positioning them as critical infrastructure components rather than simple service providers.

The financial impact of MSP-related breaches reflects this systemic importance. IBM's Cost of a Data Breach Report 2023 found that breaches involving managed service providers cost an average of $4.82 million, compared to $4.45 million for standard enterprise breaches. The Kaseya attack alone generated estimated losses exceeding $70 million across affected businesses, according to cyber insurance claims data compiled by Marsh McLennan.

Regulatory scrutiny has intensified accordingly. The European Union's NIS2 Directive, implemented in October 2024, explicitly includes managed service providers within its scope of essential entities. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) issued binding operational directive 22-01, requiring federal agencies to implement specific controls for third-party service providers following MSP-related incidents.

Compliance frameworks are adapting to address MSP-specific risks. The updated ISO 27001:2022 standard includes enhanced requirements for supplier relationship security management, while SOC 2 Type II audits increasingly focus on credential management practices for service organisations.

Why traditional security tools miss the target

Conventional identity and access management solutions struggle with the MSP model's unique requirements. Identity Access Management (IAM) systems typically assume users belong to single organisations with defined roles, but MSP technicians must access multiple client environments with varying permission structures.

Privileged Access Management (PAM) tools attempt to address elevated permissions but often create operational friction that MSPs cannot afford. When technicians need rapid access to resolve client emergencies, complex approval workflows and session recording requirements can conflict with service level agreements and response time commitments.

Single Sign-On (SSO) solutions reduce password fatigue but create single points of failure, as demonstrated in the Kaseya breach. When attackers compromise SSO credentials, they gain broad access across connected systems. Multi-Factor Authentication (MFA) provides additional security layers but remains vulnerable to sophisticated phishing attacks and social engineering techniques that specifically target MSP environments.

Zero Trust architectures promise comprehensive access control but struggle with the MSP model's inherent need for cross-organisational access. Traditional Zero Trust implementations assume clear network boundaries and consistent policy enforcement, neither of which align naturally with MSP operational requirements.

These tools share a common limitation: they assume users should hold and control their own credentials. This fundamental assumption breaks down in MSP environments where credential compromise can cascade across multiple organisations within hours.

Separating identity from access control

The structural solution requires abandoning the assumption that users must hold their own credentials. Advanced credential control systems generate, encrypt, and distribute access credentials without users ever seeing or storing them. This separation of identity from credential possession eliminates the primary attack vector exploited in MSP breaches.

Under this model, organisations maintain complete control over credential lifecycle management. When technicians need access to client systems, the credential control system generates temporary, encrypted credentials that authenticate automatically without user intervention. Users prove their identity through separate authentication mechanisms, but never possess the actual credentials required for system access.

This approach renders traditional phishing attacks ineffective because users cannot surrender credentials they do not hold. Even if attackers compromise user devices or steal authentication tokens, they cannot extract credentials for lateral movement across client environments.

For MSP environments, this architecture provides granular control over access scope and duration. Organisations can generate client-specific credentials with defined time limits and restricted permissions, ensuring that access to one client environment cannot compromise others. Centralised revocation capabilities allow immediate response to security incidents without depending on user compliance or device recovery.

The path forward for MSP security

The Kaseya breach revealed that MSP security cannot be solved by layering additional authentication requirements onto fundamentally flawed credential models. As regulatory pressure increases and cyber attacks grow more sophisticated, managed service providers must implement structural solutions that address root causes rather than symptoms.

The shift toward credential control represents a fundamental change in access management philosophy. Rather than trying to secure credentials in user hands, organisations must reclaim direct control over the access mechanisms themselves. This transition requires careful planning and gradual implementation, but the alternative is continued exposure to cascade failures that can impact thousands of businesses within hours.

For MSPs, the question is not whether to implement stronger credential controls, but how quickly they can deploy solutions that separate identity from credential possession. The next major supply chain attack may already be in progress.

HIPAA, HITECH, and NIS2: what they actually require on credential access

The €9.7 million fine levied against French healthcare technology company Dedalus in October 2024 under GDPR exposed a critical blind spot in healthcare cybersecurity. While the Paris-based firm had implemented comprehensive encryption and access controls across its patient data systems, investigators found that weak credential management practices had left administrative accounts vulnerable to compromise. The breach affected 490,000 patient records across multiple EU hospitals—a stark reminder that sophisticated security architectures can crumble at their most basic access point.

The Healthcare Credential Crisis

Healthcare organisations face an unprecedented regulatory convergence. HIPAA's Security Rule demands "unique user identification" and "automatic logoff" procedures. The HITECH Act's breach notification requirements create financial exposure averaging $10.93 million per incident according to IBM's 2024 Cost of a Data Breach Report. Now, the EU's NIS2 Directive, which came into force in January 2024, extends these requirements across the healthcare supply chain, mandating "appropriate and proportionate" cybersecurity measures for essential service providers.

Yet most healthcare IT departments approach credential security through a fundamentally flawed assumption: that users can be trusted to create, manage, and protect their own access credentials. Clinical staff routinely set passwords like "Hospital123!" across multiple systems. IT administrators share privileged accounts through encrypted messaging apps. Third-party vendors receive temporary credentials that remain active months after contracts end.

This approach places individual users—already managing complex clinical workflows under pressure—as the weakest link in regulatory compliance chains that can trigger eight-figure penalties.

The Data Reality

Healthcare credential vulnerabilities generate measurable business risks. Verizon's 2024 Data Breach Investigations Report found that 81% of healthcare breaches involved compromised credentials, with the median time to containment reaching 287 days—nearly double the cross-industry average of 194 days.

The regulatory exposure compounds annually. HHS.gov data shows healthcare breach notifications have increased 239% since 2018, with penalties under HIPAA's corrective action plans averaging $2.2 million per incident. Under NIS2, healthcare organisations now face additional fines up to €10 million or 2% of global turnover.

More critically, the Ponemon Institute's 2024 study of healthcare cybersecurity found that 89% of surveyed organisations experienced at least one cyberattack in the past 24 months, with credential-based attacks representing the primary attack vector in 67% of successful breaches. The average cost per stolen healthcare record reached $408—more than twice the global cross-industry average of $165.

Why Current Solutions Miss the Mark

Healthcare IT leaders typically deploy layered security approaches: Identity and Access Management (IAM) platforms, Privileged Access Management (PAM) solutions, Single Sign-On (SSO) systems, Multi-Factor Authentication (MFA), and comprehensive Zero Trust architectures. These tools address important security perimeters but share a fundamental design flaw—they assume users should create and control their own credentials.

IAM systems excel at managing user lifecycle and permissions but rely on user-generated passwords that remain vulnerable to phishing, social engineering, and credential stuffing attacks. PAM solutions secure privileged accounts through password vaults, yet still require users to retrieve and enter credentials, creating exposure windows during authentication processes.

SSO reduces password proliferation but creates single points of failure—compromise one credential and attackers gain broad system access. MFA adds authentication factors but cannot prevent credential theft when users can see and potentially share their primary passwords. Zero Trust frameworks verify access requests continuously but still depend on initial authentication using user-controlled credentials.

The core issue persists: as long as users can see, remember, or share their credentials, those credentials can be compromised through human-targeted attacks that bypass technical security controls.

The Structural Solution

A different approach eliminates the fundamental vulnerability by separating user identity from credential access entirely. Rather than users creating passwords they can remember and potentially compromise, organisations can generate cryptographically secure credentials that users never see or hold.

MyCena's patented credential control technology implements this separation architecturally. The system generates unique, complex credentials for each user-system combination, encrypts them immediately, and distributes access through secure channels that prevent credential visibility. Users authenticate normally through biometric or device-based factors, but never interact directly with underlying passwords.

When staff need to access clinical systems, the platform retrieves and injects credentials automatically without displaying them on screen or storing them in browser memory. IT administrators can revoke access instantly across all systems without requiring password resets or user intervention. Third-party vendors receive time-limited access that expires automatically without leaving residual credentials in organisational systems.

This approach makes phishing attacks technically impossible—users cannot share credentials they have never seen. Social engineering fails because staff cannot reveal passwords they do not know. Credential stuffing becomes irrelevant when each access point uses unique, machine-generated credentials that change regularly without user involvement.

Strategic Implementation

Healthcare leaders should evaluate their current credential strategies against specific regulatory requirements rather than security vendor marketing claims. HIPAA's "minimum necessary" standard, HITECH's breach notification thresholds, and NIS2's proportionate security measures all point toward the same conclusion: organisations must control credentials as strictly as they control patient data.

The implementation path requires three strategic decisions. First, audit existing credential exposure across clinical systems, administrative platforms, and third-party integrations. Second, establish credential generation and distribution policies that remove user visibility from the authentication process. Third, integrate automated credential management with existing IAM and security infrastructure to maintain operational continuity while eliminating human-based vulnerabilities.

The regulatory landscape will continue expanding. Healthcare organisations that eliminate credential visibility today will find compliance straightforward tomorrow. Those that continue relying on user-managed passwords will face escalating risks as regulators demand more stringent access controls across increasingly complex digital healthcare ecosystems.

The technical solution exists. The regulatory requirement is clear. The business case is quantified. The only question remaining is implementation timeline.