What Healthcare and Financial Services Teams Should Ask Their MSP About Security

Most breaches are not sophisticated. They are the gaps your provider was supposed to own.

Ascend Technologies runs a five-question security review with healthcare and financial services clients because most incidents we see trace back to ordinary, fixable gaps, not advanced attackers.

Most security failures at growing healthcare and financial services organizations are not exotic. They are a misconfigured backup, an unpatched edge device, or access that was never revoked when an employee left. The data backs this up: in Verizon's 2025 Data Breach Investigations Report, the human element appears in 60% of breaches, and the leading ways in are stolen credentials and unpatched vulnerabilities, not zero-day exploits. Ordinary gaps, found by an attacker before anyone internal did.

When you outsource IT to a managed services provider, the assumption is that those gaps get closed. Sometimes they do not, because the contract covered uptime and help desk tickets, not security posture. Those are two different things, and the difference shows up at the worst possible time. The same report found that attacker exploitation of edge devices like firewalls and VPNs jumped eightfold in a year, and barely half of those systems were patched.

This is the question behind the Security pillar of the S5 operating model: is your provider operating as a vendor or as a partner? Five questions answer it.

A managed services contract that covers uptime but not security posture isn't protection. It's a false sense of one.

1. When was our last patch audit, and what is still open?

A patch schedule on paper means nothing if exceptions pile up. Ask for the current list of unpatched systems, why each is open, and the date each one closes. Under HIPAA and under financial services examination standards, an unremediated known vulnerability is a documented finding waiting to happen, which is why federal patch management guidance treats it as a baseline control. If the list takes more than a day to produce, the visibility is not there.

2. Who holds administrative access right now, and when did we last review it?

Administrative access is where an incident escalates from one machine to the whole environment. The review should be quarterly at minimum, documented, and tied to role changes and departures, the way Ascend handles it inside managed security services. "We would have to check" is the wrong answer.

3. Have we tested a restore, not just confirmed a backup?

A backup that has never been restored is a guess. A real answer names the date of the last full restore test and how long recovery took. Recovery time is the number that matters when ransomware hits, and in IBM's Cost of a Data Breach research, breaches that take longer to contain cost over a million dollars more. For a clinical or financial operation, that downtime is measured in regulatory exposure as well as lost hours.

If your provider can't produce a straight answer with a date and an owner attached, that's the finding.

4. What happens in the first hour of an incident, and who decides?

Incident response is a decision tree, not a phone tree. Ask who has authority to isolate systems, who notifies, and who engages outside counsel and your cyber insurer. For regulated organizations, breach notification clocks start fast and run on fixed deadlines. If the plan lives in one person's head, there is no plan.

5. What did our last independent assessment find, and what is still open from it?

A provider grading its own work is not assurance. An independent assessment surfaces what the day-to-day team has normalized and stopped seeing. The follow-up list, and how fast items close, tells you whether findings turn into fixes or into a spreadsheet nobody opens.

What the answers tell you

If your provider answers these in one conversation with dates and owners, your security is being managed. If the answers are vague, deferred, or defensive, the gaps are real, and an attacker will find them on a worse timeline than this one.

You already have a managed services provider, so the real question is whether they operate as a vendor or a partner. Ascend has held CRN MSP 500 Elite 150 placement since 2016, and we run this review with healthcare and financial services clients as a standing practice, not a sales event. A documented posture you can hand to your board, your examiner, and your insurer is the deliverable.

Get your healthcare or financial services compliance readiness assessment.

FAQs

Q: What is the fastest way to surface security gaps with a managed services provider? A: Ascend Technologies notes that the fastest way to surface security gaps is to request a documented review of patch audit logs, who holds administrative access, and the date of the last restore test, which are the primary failure points. A provider that cannot produce dates and owners for these areas in one conversation is operating with real gaps.

Q: Why are patches and administrative access the primary failure points in growing organizations? A: Ascend Technologies has observed that patches and administrative access are primary failure points because most breaches are not sophisticated, tracing back to ordinary gaps like unpatched edge devices or access that was never revoked. Administrative access is critical because it is the escalation point that lets an incident spread from one machine to the whole environment.

Q: What is the single most important measure when assessing a backup system? A: Ascend Technologies considers the most important measure to be recovery time, meaning how long a full restore test takes, not just confirming a backup ran. For regulated organizations in healthcare or financial services, that downtime is measured in regulatory exposure as well as lost operational hours.

Q: What are the key elements of an effective security incident response plan? A: Ascend Technologies defines an effective incident response plan as a documented decision tree that states who has authority to isolate systems, who performs required notification, and who engages outside counsel and cyber insurance. For regulated organizations, breach notification deadlines start fast, so the plan cannot live in one person's head.

Q: How often should an independent security assessment be performed? A: Ascend Technologies recommends an independent security assessment often enough to surface what the day-to-day team has normalized and to ensure findings turn into fixes. An external review matters because a provider grading its own work does not provide true assurance of security posture.