Common Failures and Official Sources
Managed security scope gaps: the assets, hours and actions quotes often leave out
The devices, accounts, hours and response actions managed security quotes often leave out, how to find them and what closing them costs.
A managed security service protects only what is in scope. Gaps typically appear in five places: assets the provider never sees (servers without agents, cloud tenants, a branch office, contractor laptops, operational technology), identities (cloud admin accounts, service accounts, shared mailboxes), hours (business-hours review sold as monitoring), actions (detection without authority to respond), and people and processes (leavers' accounts, untested backups, no incident plan). Each gap is cheaper to close before an incident than after. Find them by reconciling your own inventory against the provider's monitored-asset list every month, reading the exclusions in the statement of work, and asking what would happen in specific scenarios.
This guide is part of managed security failures and official sources. Costs are illustrative.
Where gaps hide
| Gap | How it happens | Why it matters | How to find it |
|---|---|---|---|
| Unmanaged devices | New laptops not enrolled, contractor devices, old PCs | Attackers use the weakest device | Compare device inventory with EDR console count |
| Servers and virtual machines | Agents not installed on legacy or vendor-managed servers | Servers hold the most data | Ask for a server list from the provider |
| Cloud identity and email | Endpoint-only MDR | Phishing and account takeover start here | Check whether sign-in and mailbox-rule alerts are in reports |
| SaaS applications | Accounting, CRM, file-sharing platforms not connected | Data leaves without touching an endpoint | List apps with sensitive data and their log options |
| Branch and home offices | Firewall coverage only at head office | Remote sites become entry points | Map all sites and connections |
| Operational technology | Production equipment, building systems on the same network | Hard to patch; can halt operations | Ask for network segmentation review |
| Service accounts and admin accounts | Excluded from MFA "for compatibility" | Prime targets for attackers | Review MFA exception list quarterly |
| Hours | "Monitoring" means business hours | Many attacks run nights and weekends | Ask for shift schedule and night response example |
| Response actions | Provider may only notify | Delay lets damage spread | Pre-approved action list in the SLA |
| Recovery | Restoration excluded from MDR | Business stays down | Check IR terms and backup restore tests |
Scenario questions that reveal gaps
Ask each provider to walk through these, in writing:
- A staff member's Microsoft 365 account signs in from another country at 11 p.m. on a Saturday and creates a forwarding rule.
- Ransomware begins encrypting a file server that has no EDR agent because the vendor of the line-of-business software forbade it.
- A contractor connects a personal laptop to the office Wi-Fi.
- The accounting SaaS shows a bulk export of customer records.
- A former employee's account, never disabled, logs in to the VPN.
Each answer tells you what is seen, who is told, and what is done. "We would not see that" is a useful answer; it shows you where to add scope or a compensating control.
Closing gaps: illustrative costs
Illustrative example. A 45-person Laval distributor reconciles its inventory against an MDR contract covering 45 laptops at $22 per endpoint per month and finds:
| Gap found | Fix (illustrative) | Calculation | Yearly cost |
|---|---|---|---|
| 3 servers without agents | Server agents at $50 a month | 3 × $50 × 12 | $1,800 |
| 6 warehouse terminals unmanaged | Endpoint agents at $22 | 6 × $22 × 12 | $1,584 |
| Microsoft 365 identity not monitored | Identity add-on at $4 per user | 45 × $4 × 12 | $2,160 |
| Production network flat with office | Segmentation project, one-time | fixed | $7,500 |
| No restore test | Twice a year | 2 × $600 | $1,200 |
Current MDR cost: 45 × $22 × 12 = $11,880. Recurring additions: $1,800 + $1,584 + $2,160 + $1,200 = $6,744 a year, plus the $7,500 project. Year one total: $11,880 + $6,744 + $7,500 = $26,124 before GST and QST. Not every gap must be closed with a paid service; some can be closed by removing old devices or accounts, or by a documented compensating control.
Keeping scope current
- Make the provider send a monthly asset report: monitored devices, servers, identities and log sources.
- Add a step to your onboarding and offboarding process for staff and devices: enrol, remove, disable.
- Review new software and sites with the provider before they go live.
- Do a quarterly MFA exceptions review.
- After any merger or new site, re-baseline the scope.
Use the Cyber Centre's baseline controls as a cross-check; see baseline controls and CyberSecure Canada. Scope must also match what your insurer was told; see cyber-insurance requirements. For log sources, see SIEM pricing.
Frequently asked questions
Is it acceptable to exclude some systems?
Sometimes, for example a vendor-controlled machine. Document the reason, isolate it on the network, and monitor what you can around it.
How often should scope be reviewed?
Monthly by report, and fully at least once a year and after significant changes.
Who is responsible for a gap?
Contractually, whoever the agreement says; legally, your business remains responsible for protecting personal information it controls. Write the inventory and exclusions into the statement of work.
What about personal phones used for work?
Decide a policy: managed work profiles, conditional access, or no corporate data on personal devices.
Sources
- Canadian Centre for Cyber Security — baseline controls and guidance on asset management
- Office of the Privacy Commissioner of Canada — safeguards principle under PIPEDA
- Commission d'accès à l'information du Québec — security measures for personal information
