DEV Community

Gary Austin
Gary Austin

Posted on Originally published at thesecuritygator.hashnode.dev

The Acting CISO: The Weekly Cadence

#security #msp #sysadmin #cybersecurity

The acting CISO: the weekly cadence that turns "you handle our security" into a job

In a survey commissioned by Sophos, a security vendor, MSPs estimate that 46% of their customers rely on them to act as CISO. Only a third say they are completely confident they can document compliance continuously across customers. Our read: the gap looks like a missing cadence more than a missing tool. A cadence is a practical starting point to adapt: the same few questions, answered the same way, on a schedule, with the evidence kept. Here is what the survey does and does not say, what the latest vulnerability news teaches about inventory, and a six-step weekly loop you can adapt.

A client says it in a kickoff call, a renewal meeting, or a ticket at 4:40 on a Friday: "You handle our security, right?"

Say yes, and you may have accepted a job. Our read: nobody may have written the job description, scoped it, budgeted it, or decided what "handled" means when a firewall CVE drops on a Tuesday. Our read: the client may assume someone is watching, deciding, and keeping records.

Our read: that is the acting CISO problem, and it is mostly an operations problem, not a security-product problem.

The job may not be written down

A survey commissioned by Sophos, a security vendor, put a number on the pattern. Read it with that in mind: Sophos sells security products and announced a CISO-service offering in the same release. We do not discuss that product, and The Security Gator is not affiliated with Sophos or any vendor named in this post.

The method, because it matters:

  • Who was asked: 800 MSPs for the Sophos-commissioned survey, senior to board-level stakeholders, across the US, UK, Germany, France, Singapore, Australia and Brazil.
  • Who ran it: Vanson Bourne, commissioned by Sophos. Fieldwork was April 2026. The release describes the research as independent and vendor-agnostic.
  • What it measures: MSP perception and practice. It does not measure customer security outcomes.

The headline, in the Sophos-commissioned survey: on average, MSPs estimate that 46% of their customers rely on them to act as CISO. That is an MSP estimate, not a count of customers, and a vendor-commissioned one. Treat it as a signal about how the market describes the role, not as a measurement of anyone's client base.

Two more figures from the Sophos-commissioned survey, each an MSP-reported number. In the Sophos-commissioned survey, 84% of MSPs expect demand for CISO services to rise over the next 12 months, which is an expectation, not a measurement. In the same Sophos-commissioned survey, 99% provide at least one cybersecurity compliance service.

Our read: if that sounds like your week, the useful question is not "which tool do we buy". It is "what do we do every week, and can we show it".

What the survey says about the gap, and what it cannot

The part worth a sysadmin's attention is the delivery side, again as the Sophos-commissioned survey reports it:

Finding (MSP-reported) Value
Offer full compliance program management 58%
Offer the full range of compliance services evaluated in the survey 6%
"Completely confident" they can continuously monitor, manage and document compliance across customers 33%
Use a single tool or platform for compliance and CISO-type activities 36%
Use multiple tools 53%
Use a fully or semi-automated process for consolidated posture reports 86%
Still require some manual effort for those reports 55%
Can generate those reports quickly through a fully automated process 31%

The release characterizes multi-tool setups as delivery that "remains complex, disjointed, and potentially harder to scale." That is Sophos's framing, and it comes from a vendor with a product to sell. Sophos's Scott Barlow adds: "The challenge now is delivering that leadership consistently and efficiently across a growing customer base."

Our reading, labeled as ours: the phrase to take from this is "only a third say they are completely confident". Not "MSPs are failing". Confidence in continuous documentation is a high bar, and 33% saying "completely" tells you where the hard part is, not that anyone is doing badly.

What the survey cannot tell us:

  • Whether any given MSP's acting-CISO work is contracted, scoped or insured. Open question.
  • Whether the customers believe what the MSPs estimate.
  • Whether more automation produces better outcomes. The survey also includes a hypothetical estimate about time saved by a unified platform. It is a guess about a product category in a vendor-commissioned survey, so we are not repeating it as a benefit.

Our read: the pattern in the Sophos-commissioned table is the point: lots of services offered, thin confidence in continuous documentation, and 55% still need some manual effort on posture reports. A repeatable cadence is a practical starting point for exactly that.

The Pulse is an inventory lesson

Three items from the news, read 2026-10-11 via The Hacker News and cybersecuritynews.com. Our read: each is a different way of asking "do you know what you are running". A scope line before the list: CISA KEV due dates bind Federal Civilian Executive Branch agencies only. They are a useful priority signal for everyone else, not an obligation. We print no severity scores here; KEV does not publish one, and any score belongs to the article that cites it.

1. Five older flaws, added to KEV. CISA added five flaws to the Known Exploited Vulnerabilities catalog on 2026-10-08 (federal due date 2026-10-11, federal civilian agencies only): ProFTPD CVE-2015-3306 (improper access control, file read/write), ONLYOFFICE Docs CVE-2021-3199 (path traversal, possible remote code execution), Strapi CVE-2023-22894 (cleartext storage of sensitive information), Apache Struts CVE-2016-3081 (command injection when Dynamic Method Invocation is enabled) and ISC BIND CVE-2015-5477 (reachable assertion leading to denial of service via TKEY queries). The Hacker News ties the activity to "a China-linked threat actor known as Flax Typhoon"; the joint advisory it links, from agencies in AU, CA, JP, NZ, ES, UK and US, concerns a China-based company, Integrity Technology Group. The article does not say that advisory names Flax Typhoon. A CISA official, Chris Butera, is quoted referring to Chinese government-affiliated actors generally. CVE years: ProFTPD 2015, ONLYOFFICE 2021, Strapi 2023, Struts 2016, BIND 2015. Our read: nothing here is new software. It is software somebody forgot.

2. Palo Alto Networks PAN-OS GlobalProtect / Prisma Access, CVE-2026-0257. An authentication bypass. Per cybersecuritynews.com (2026-10-11), ransomware groups named as Qilin and Settra are reported to be exploiting it to create unauthorized VPN sessions and reach internal networks, per ReliaQuest. Palo Alto disclosed it on 2026-05-13 and rates it High; Panorama and Cloud NGFW are not affected. The detail that matters for this post: exposure depends on configuration, specifically authentication override cookies being enabled plus a particular certificate configuration. Mitigation per the article: upgrade per the vendor's fixed-version table, disable authentication override cookies you do not need, and use a newly generated certificate dedicated to them. Users re-authenticate after the patch. The article does not state KEV status. CISA's Known Exploited Vulnerabilities catalog does: the flaw was added on 2026-05-29 with a federal due date of 2026-06-01 (federal civilian agencies only), and the catalog marks known ransomware campaign use. We checked the catalog on 2026-10-13.

3. N-able N-central, CVE-2026-18577, an August callback. An authentication bypass from incomplete patching of CVE-2026-18556. CISA added it to KEV on 2026-08-03 (federal due date 2026-08-06, federal civilian agencies only). N-able acknowledged that "a limited number of customers" were compromised and has not disclosed the scale; the fix is in version 2026.3 HF1. It is older than the other two items, and it is here because it is the MSP's own management tool.

Our read, and it is an opinion: all three are things an acting CISO is expected to know about without being told. A forgotten legacy service. A VPN whose exposure depends on a setting, not just a version number. The tool that manages client environments. We are not claiming anyone's client was compromised through these beyond what the sources report, and we do not know which of these products you run.

Our read: that last point is the lesson. If your inventory holds only product names, "are we exposed?" is a research project. If it holds version and configuration notes per client, it is a lookup.

The six-step weekly cadence

This is our framing, not from any source: a practical starting point to adapt. One loop, same day each week, same shape every time.

  1. Inventory. What systems, accounts and internet-facing services exist per client, and who owns each one. If it has no owner, that is the first finding.
  2. Exposure check. What is internet-facing, which version, and which configuration options matter. The GlobalProtect item is the reminder: the version was only half the answer.
  3. Known-exploited check. Compare the inventory to the CISA KEV catalog on a fixed day each week. Remember the due dates are federal-civilian only; use them to rank, not to excuse.
  4. Risk register. The top items, each with an owner, a decision (fix, accept or transfer) and a date.
  5. Evidence. Keep what you checked and when: screenshots, exports, ticket links. This is what turns "we looked" into something you can show.
  6. One-page report. Same shape every time: what changed, what you decided, what is open, what you need from the client.

A minimum viable record per client service, in whatever you already use (a spreadsheet, a PSA custom field, a YAML file in a repo):

client: example-co
service: vpn-gateway
exposed_to_internet: true
product: ""
version: ""
config_notes: ""
owner: ""
last_checked: YYYY-MM-DD
kev_checked: YYYY-MM-DD      # compared to the catalog on this date
decision: fix | accept | transfer
decision_date: YYYY-MM-DD
evidence: ""
Enter fullscreen mode Exit fullscreen mode

Our read: none of this is exotic. Its value is that it is the same every week, so the week-over-week diff becomes the report.

Role clarity, and what we do not know

The cadence is the operational half. The other half is a sentence in writing: what you are accountable for, and what you are not. Which systems are in scope, who decides on the client side, what "acting CISO" means in your service description and what it does not. We cannot tell you what that sentence should say for your contract, and we do not give legal advice on liability, insurance, or whether a title like "vCISO" has regulatory meaning. For any specific agreement, that is a question for counsel.

What we do not know, stated plainly:

  • Whether the 46% reflects your clients. It is a vendor-commissioned survey of MSPs' own estimates, averaged across 800 firms in seven countries.
  • Whether acting-CISO work is usually contracted, scoped or insured. The sources do not say.
  • Who among you runs the products in the Pulse. If you do not know either, see the inventory section.
  • Current status. Pulse details were read on 2026-10-11 from news coverage. Check the KEV catalog and the vendor advisories directly before acting on any of it.

Take the loop with you

The cadence above is the argument. If you want the discipline of a written, repeatable response in one place, our standing free field guide, The Leaked-Secret Response Kit (Gatorbyte #016), is built in the same spirit: a first-hour runbook, a secret hunt, a secrets register with owner, revocation path and expiry columns, and an evidence register. It runs offline as a Windows app: a portable .exe with a one-file .html alongside, no account, no server, no network requests. Free to use inside your organization and with your clients, including in paid engagements.
→ https://thesecuritygator.gumroad.com/l/gb016-leaked-secret-response-kit

The kit is a practical starting point to review and adapt for your organization; not legal, compliance, or audit advice, and not a substitute for a forensic investigation or your incident-response plan. The Security Gator is not affiliated with Sophos, Vanson Bourne, Palo Alto Networks, N-able, or any vendor named in this post.

Sources:

Top comments (0)