{"id":26200,"date":"2026-11-10T09:03:20","date_gmt":"2026-11-10T14:03:20","guid":{"rendered":"https:\/\/www.sherweb.com\/blog\/?p=26200"},"modified":"2026-11-10T09:03:20","modified_gmt":"2026-11-10T14:03:20","slug":"cloud-attack-surface-security-msps","status":"publish","type":"post","link":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/security\/cloud-attack-surface-security-msps\/","title":{"rendered":"What MSPs need to know about the cloud attack surface"},"content":{"rendered":"<p><span data-contrast=\"auto\">Cloud adoption has fundamentally changed how businesses operate, but it has also reshaped how security works. For MSPs and SMB owners, the biggest shift is not just where systems live, but how they are accessed, managed, and protected.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">That shift has made the cloud attack surface bigger and harder to see. It now includes every account, service, integration and configuration an attacker could use to get in. This post covers what cloud security for MSPs looks like now that <\/span><a href=\"https:\/\/www.sherweb.com\/blog\/security\/identity-first-security-msps\/\"><span data-contrast=\"none\">identity has replaced the network<\/span><\/a><span data-contrast=\"auto\"> as the perimeter, where gaps tend to open up, how attackers take advantage of them and five ways to close those gaps.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"2\"><span data-contrast=\"none\">What makes cloud \u201ccloud\u201d?<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">At its core, cloud computing is defined by three key characteristics:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Users can access systems from anywhere<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Services can scale up or down instantly<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">The cost model allows businesses to pay only for what they use<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<\/ol>\n<p><span data-contrast=\"auto\">These capabilities make cloud incredibly attractive, especially for growing organizations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">But there\u2019s a deeper shift happening beneath the surface. Cloud removes the traditional network boundary. Users are no longer sitting behind a company firewall. They are logging in from home, on mobile devices or from other countries. Because of this, identity becomes the new control point. Access is no longer tied to a location. It\u2019s tied to who the user is and how they authenticate.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The same features that make cloud powerful also change the security model in ways many organizations underestimate.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"2\"><span data-contrast=\"none\">The security challenges cloud creates<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">As organizations move into cloud environments, protecting systems is only part of the job. The bigger challenge is managing access, trust and visibility across an environment that changes constantly.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><span data-contrast=\"auto\">1. I<\/span><span data-contrast=\"none\">dentity becomes the perimeter<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">If a user account is compromised, an attacker does not need to break through a firewall. They can simply log in and operate as if they belong. This puts enormous pressure on authentication, access policies, and permission management.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><span data-contrast=\"none\">2. Vendor risk gets more complex<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">SMBs often rely on multiple SaaS platforms, each with its own integrations and permissions. Over time, this creates a web of implicit trust between services. A single weak link can expose far more than expected. And as those services become business-critical, an outage becomes a significant risk of its own, with little control over when those services become available again.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span data-contrast=\"none\">3. Cloud sprawl grows costs and exposure<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Cost expansion introduces a different kind of risk. As businesses adopt more services and scale usage, they often lose track of what is running and who is using it. This is not just an operational expense issue. Every new service and integration expands the attack surface.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span data-contrast=\"none\">4. Misconfiguration becomes a silent threat<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Cloud platforms offer flexibility, but that flexibility makes it easy to leave gaps. Over-permissioned accounts, exposed storage or unused but active services can sit unnoticed until they are exploited. Data flow diagrams that were once created yearly or updated after major projects also tend to fall behind, because cloud environments change faster than those review cycles.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"2\"><span data-contrast=\"none\">How attackers exploit cloud environments<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Attackers have adapted quickly to these changes. Instead of trying to break into systems, they focus on logging in.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">When access is available from anywhere, it\u2019s available to attackers as well. Credential stuffing, <\/span><a href=\"https:\/\/www.sherweb.com\/blog\/security\/multi-factor-authentication\/\"><span data-contrast=\"none\">MFA attacks<\/span><\/a><span data-contrast=\"auto\">, credential theft and session hijacking give them a direct path into business systems without triggering traditional alarms.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Cloud environments also give attackers opportunities to scale their activity. Compromised accounts can be used to spin up resources, host malicious content or run processes that the business ends up paying for. In many cases, this activity blends in with legitimate usage, making it harder to detect. On top of that, most businesses don\u2019t realize their cloud infrastructure is being used against them until they get the bill. Cloud services are designed to be on-demand, but visibility into them usually isn\u2019t, and that gap is where this activity hides.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Standardization across cloud platforms works in the attacker\u2019s favor. Once they understand how to exploit one environment, they can repeat those tactics across many organizations. This creates efficiency and increases the potential payoff.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Another important shift is how attackers maintain persistence. Instead of installing malware, they manipulate identity and access. They may add new users, grant elevated permissions or create hidden third-party integrations. This allows them to remain inside an environment even if the original entry point is discovered.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"2\"><span data-contrast=\"none\">How MSPs can close cloud security gaps<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Addressing cloud security requires a shift in mindset. Rebuilding the old perimeter won\u2019t work. The focus moves to controlling access, monitoring behavior and maintaining visibility across all services.<\/span><\/p>\n<h3>1. Strengthen access control<\/h3>\n<p><span data-contrast=\"auto\">The first priority is strengthening access control. Single sign-on combined with conditional access policies allows organizations to define who can access what, from where and under which conditions. Adding controls like device trust or IP-based restrictions helps reduce unnecessary exposure without limiting productivity. Adding a SASE service adds another layer of protection by controlling endpoint access, which also helps you fine tune conditional access policies.<\/span><\/p>\n<h3>2. Protect identity itself<\/h3>\n<p><span data-contrast=\"auto\">Multi-factor authentication is essential, but it\u2019s no longer enough on its own. Strengthening MFA should also be on the table, which means moving away from SMS and rotating codes toward FIDO tokens and challenge-based authentication methods. From there, <\/span><a href=\"https:\/\/www.sherweb.com\/blog\/security\/ispm-identity-security-msps\/\"><span data-contrast=\"none\">identity threat detection and response (ITDR)<\/span><\/a><span data-contrast=\"auto\"> tools provide visibility into suspicious behavior, such as impossible travel, abnormal logins or privilege escalation.<\/span><\/p>\n<h3><span data-ccp-props=\"{}\">3. <\/span>Improve visibility and response<\/h3>\n<p><span data-contrast=\"auto\">Visibility and response capabilities must also improve. Integrating logs from cloud platforms into a SIEM and pairing that with <\/span><a href=\"https:\/\/www.sherweb.com\/blog\/security\/edr-vs-xdr-vs-mdr\/\"><span data-contrast=\"none\">managed detection and response (MDR)<\/span><\/a><span data-contrast=\"auto\"> services gives MSPs and SMBs a way to detect and react to threats early. Without this visibility, attackers can operate unnoticed for long periods.<\/span><\/p>\n<h3>4. Make governance an active process<\/h3>\n<p><span data-contrast=\"auto\">Governance plays a critical role as well. Organizations need to actively manage permissions, enforce least privilege and regularly review access. Just because a user or integration needed access at one point, this does not mean it should persist indefinitely.\u00a0<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Governance can also help build buy-in. An IT steering committee that oversees governance gives stakeholders across the organization a better understanding of security risks and helps them feel like part of the solution.<\/span><\/p>\n<h3>5. Reinforce the shared responsibility model<\/h3>\n<p><span data-contrast=\"auto\">Cloud providers secure the infrastructure, but customers are responsible for how users access systems, how permissions are assigned and how data is used. Many security gaps exist simply because this responsibility is misunderstood or ignored.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"2\"><span data-contrast=\"none\">Securing the cloud starts with identity<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Cloud delivers speed, flexibility and cost efficiency, but it also redistributes risk. The traditional network boundary has been replaced by identity and access. As organizations grow their cloud footprint, they also expand their attack surface, often without realizing it.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Attackers are taking advantage of this shift by targeting users instead of systems and by turning the same scalability that benefits the business against it. They do not need to be sophisticated to be effective. They only need valid access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">For MSPs and SMB owners, the path forward is clear. Focus on controlling identity, limiting exposure, improving visibility and maintaining strong governance. When these elements are in place, the benefits of cloud can be realized without losing control of security.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Good cloud security is not about locking everything down. It\u2019s about making sure the right people have the right access under the right conditions, and that anything outside of that is quickly detected and addressed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"2\"><span data-contrast=\"none\">Want to compare notes with MSPs facing the same challenges?<\/span><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Identity attacks, SaaS sprawl and misconfigurations are showing up across client environments everywhere. The <\/span><a href=\"https:\/\/info.sherweb.com\/cybermsp-community\/\"><span data-contrast=\"none\">CyberMSP Community<\/span><\/a><span data-contrast=\"auto\"> is a vendor-agnostic peer network where MSPs share what&#8217;s working, what isn&#8217;t and what they&#8217;re seeing in the field<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cloud adoption has fundamentally changed how businesses operate, but it has also reshaped how sec","protected":false},"author":188,"featured_media":26201,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[753],"tags":[448,919],"class_list":["post-26200","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cloud","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cloud security for MSPs: 5 ways to close the gaps | Sherweb<\/title>\n<meta name=\"description\" content=\"Cloud security for MSPs starts with identity. See how attackers exploit cloud environments and 5 ways to close the gaps across your clients.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cloud security for MSPs: 5 ways to close the gaps | Sherweb\" \/>\n<meta property=\"og:description\" content=\"Cloud security for MSPs starts with identity. See how attackers exploit cloud environments and 5 ways to close the gaps across your clients.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\" \/>\n<meta property=\"og:site_name\" content=\"Sherweb\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sherweb\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-10T14:03:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"480\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Roddy Bergeron\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@SherWeb\" \/>\n<meta name=\"twitter:site\" content=\"@SherWeb\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Roddy Bergeron\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\"},\"author\":{\"name\":\"Roddy Bergeron\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/#\/schema\/person\/f6a0c8e1d541dbeb57fd3e025b325795\"},\"headline\":\"What MSPs need to know about the cloud attack surface\",\"datePublished\":\"2026-11-10T14:03:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\"},\"wordCount\":1279,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage\"},\"thumbnailUrl\":\"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg\",\"keywords\":[\"Cloud\",\"Cybersecurity\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\",\"url\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\",\"name\":\"Cloud security for MSPs: 5 ways to close the gaps | Sherweb\",\"isPartOf\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage\"},\"thumbnailUrl\":\"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg\",\"datePublished\":\"2026-11-10T14:03:20+00:00\",\"author\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/#\/schema\/person\/f6a0c8e1d541dbeb57fd3e025b325795\"},\"description\":\"Cloud security for MSPs starts with identity. See how attackers exploit cloud environments and 5 ways to close the gaps across your clients.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage\",\"url\":\"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg\",\"contentUrl\":\"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg\",\"width\":1200,\"height\":480,\"caption\":\"Cloud security for MSPs: 5 ways to close the gaps\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.sherweb.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\/\/www.sherweb.com\/blog\/category\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What MSPs need to know about the cloud attack surface\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/#website\",\"url\":\"https:\/\/www.sherweb.com\/blog\/\",\"name\":\"Sherweb\",\"description\":\"More than a cloud marketplace\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.sherweb.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.sherweb.com\/blog\/#\/schema\/person\/f6a0c8e1d541dbeb57fd3e025b325795\",\"name\":\"Roddy Bergeron\",\"description\":\"Roddy Bergeron's career has taken various paths including government auditing, nonprofit work, public\/private partnerships with the State of Louisiana, helping build an MSP by building their managed service, managed security, vCISO and compliance programs, and now as the Cybersecurity Technical Fellow with Sherweb. Roddy has obtained many certifications over the years including his MCSE, CCNA:Security, CEH, CCSP, CISSP and CSAP. Our MSP community is extremely important to Roddy and he loves giving back to the community that has helped him out so much over the years. Roddy hopes to continue to help other MSPs succeed and raise the cybersecurity tide for our industry.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/roddy-bergeron-cissp-ccsp-csap-33432573\/\"],\"url\":\"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/author\/roddy-bergeron\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cloud security for MSPs: 5 ways to close the gaps | Sherweb","description":"Cloud security for MSPs starts with identity. See how attackers exploit cloud environments and 5 ways to close the gaps across your clients.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/","og_locale":"en_US","og_type":"article","og_title":"Cloud security for MSPs: 5 ways to close the gaps | Sherweb","og_description":"Cloud security for MSPs starts with identity. See how attackers exploit cloud environments and 5 ways to close the gaps across your clients.","og_url":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/","og_site_name":"Sherweb","article_publisher":"https:\/\/www.facebook.com\/Sherweb","article_published_time":"2026-11-10T14:03:20+00:00","og_image":[{"width":1200,"height":480,"url":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg","type":"image\/jpeg"}],"author":"Roddy Bergeron","twitter_card":"summary_large_image","twitter_creator":"@SherWeb","twitter_site":"@SherWeb","twitter_misc":{"Written by":"Roddy Bergeron","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#article","isPartOf":{"@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/"},"author":{"name":"Roddy Bergeron","@id":"https:\/\/www.sherweb.com\/blog\/#\/schema\/person\/f6a0c8e1d541dbeb57fd3e025b325795"},"headline":"What MSPs need to know about the cloud attack surface","datePublished":"2026-11-10T14:03:20+00:00","mainEntityOfPage":{"@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/"},"wordCount":1279,"commentCount":0,"image":{"@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage"},"thumbnailUrl":"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg","keywords":["Cloud","Cybersecurity"],"articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/","url":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/","name":"Cloud security for MSPs: 5 ways to close the gaps | Sherweb","isPartOf":{"@id":"https:\/\/www.sherweb.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage"},"image":{"@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage"},"thumbnailUrl":"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg","datePublished":"2026-11-10T14:03:20+00:00","author":{"@id":"https:\/\/www.sherweb.com\/blog\/#\/schema\/person\/f6a0c8e1d541dbeb57fd3e025b325795"},"description":"Cloud security for MSPs starts with identity. See how attackers exploit cloud environments and 5 ways to close the gaps across your clients.","breadcrumb":{"@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#primaryimage","url":"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg","contentUrl":"\/blog\/wp-content\/uploads\/Hero_1200x480-1-8.jpg","width":1200,"height":480,"caption":"Cloud security for MSPs: 5 ways to close the gaps"},{"@type":"BreadcrumbList","@id":"https:\/\/www.sherweb.com\/blog\/security\/cloud-attack-surface-security-msps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sherweb.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.sherweb.com\/blog\/category\/security\/"},{"@type":"ListItem","position":3,"name":"What MSPs need to know about the cloud attack surface"}]},{"@type":"WebSite","@id":"https:\/\/www.sherweb.com\/blog\/#website","url":"https:\/\/www.sherweb.com\/blog\/","name":"Sherweb","description":"More than a cloud marketplace","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sherweb.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.sherweb.com\/blog\/#\/schema\/person\/f6a0c8e1d541dbeb57fd3e025b325795","name":"Roddy Bergeron","description":"Roddy Bergeron's career has taken various paths including government auditing, nonprofit work, public\/private partnerships with the State of Louisiana, helping build an MSP by building their managed service, managed security, vCISO and compliance programs, and now as the Cybersecurity Technical Fellow with Sherweb. Roddy has obtained many certifications over the years including his MCSE, CCNA:Security, CEH, CCSP, CISSP and CSAP. Our MSP community is extremely important to Roddy and he loves giving back to the community that has helped him out so much over the years. Roddy hopes to continue to help other MSPs succeed and raise the cybersecurity tide for our industry.","sameAs":["https:\/\/www.linkedin.com\/in\/roddy-bergeron-cissp-ccsp-csap-33432573\/"],"url":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/author\/roddy-bergeron\/"}]}},"tag_names":["Cloud","Cybersecurity"],"_links":{"self":[{"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/posts\/26200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/users\/188"}],"replies":[{"embeddable":true,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/comments?post=26200"}],"version-history":[{"count":2,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/posts\/26200\/revisions"}],"predecessor-version":[{"id":26203,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/posts\/26200\/revisions\/26203"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/media\/26201"}],"wp:attachment":[{"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/media?parent=26200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/categories?post=26200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/r-swca2-app15-sherwebbl-change-font-czgcf8cmcjh3asb3.canadacentral-01.azurewebsites.net\/blog\/wp-json\/wp\/v2\/tags?post=26200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}