{"id":12700,"date":"2025-10-14T09:00:00","date_gmt":"2025-10-14T08:00:00","guid":{"rendered":"https:\/\/mspglobal.com\/blog\/?p=12700"},"modified":"2025-10-13T15:19:12","modified_gmt":"2025-10-13T14:19:12","slug":"mind-the-security-gap-how-to-scale-like-a-pro-with-zoe-rose","status":"publish","type":"post","link":"https:\/\/mspglobal.com\/blog\/mind-the-security-gap-how-to-scale-like-a-pro-with-zoe-rose\/","title":{"rendered":"Mind the (security) gap: how to scale like a pro with Zo\u00eb Rose"},"content":{"rendered":"\n
Zo\u00eb Rose is a Security Operations Tower Manager at Canon EMEA, with a career spent helping organizations navigate the messy reality of scaling securely. She\u2019s seen first\u2011hand how rapid growth\u2014especially the kind that happens \u201cnaturally\u201d\u2014can leave behind a trail of undocumented processes, mismatched tooling, and hidden vulnerabilities that only surface when it\u2019s too late.<\/p>\n\n\n\n
Her perspective is grounded in the realities of day\u2011to\u2011day operations: the gaps that appear when responsibilities aren\u2019t clearly defined, the risks of shadow IT when user needs aren\u2019t met, and the cultural shifts required to make security part of the business rather than a blocker.<\/p>\n\n\n\n
At MSP GLOBAL 2025, Zo\u00eb will cut through the buzzwords to show MSPs and IT leaders what robust security architecture really looks like in high\u2011growth environments. Drawing on her experience supporting organizations during and after breaches, auditing third\u2011party providers, and advising on M&A due diligence, she\u2019ll share the red flags, best practices, and practical fixes that will allow you to scale with confidence.<\/p>\n\n\n\n
Ahead of her session, we spoke to Zo\u00eb about the most common security blind spots in fast\u2011scaling organizations, how MSPs can uncover the \u201cunknown unknowns\u201d before they become breaches, and the strategic investments that will get today\u2019s architecture ready for tomorrow\u2019s threats.<\/p>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
You\u2019ve said \u201cwe grew naturally\u201d often signals trouble. What are the most common security gaps you see in fast-scaling organizations?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
I saw a presentation recently that said: big organizations have the people, the skills and the resources, so tooling isn’t as important. The small companies don’t have the resources or the people, and so the tooling is a lot more important.<\/p>\n\n\n\n
If you’re a small organization and you’re trying to keep up with enterprises, you probably have a restricted budget, so the first thing you think of is: what can I get by with for the time being? Many have the best intentions, but they don’t have the proper tooling for the use case that they’re trying to build to.<\/p>\n\n\n\n
A common failure is that companies don’t design for growth in mind. They’re giving individual permissions or unique scenarios without documenting it, or even if its actually needed. If that’s documented and it fits with the plan, then it makes sense. But often it’s, \u201cThis cheaper tooling fits, so let’s go with that\u201d or \u201cWe’ll add that tool later\u201d or \u201chere\u2019s a tooling that\u2019s well known” without doing the proper analysis on if it covers the requirements.<\/p>\n\n\n\n
Another big one is, \u201cWe hired a third party because it is not our core competency\u201d. I get that, but do they report to you? How do you maintain that they’re doing what they say they’re doing?<\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
For IT leaders who are trying to build a scalable security architecture, where should they start when resources are limited but risks are growing?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
Understand what your business is. Security does not secure everything completely \u2014 I wouldn’t have a job if it was the case! The reality of security is: securing your environment whilst balancing the ability to get work done. You can ask yourself, what do I need to protect? What are my assets? What are my workflows? What is my inherent risk? What am I trying to protect against? What is my threat map? Understand what your landscape is, and what tooling do you have in place?<\/p>\n\n\n\n
Shadow IT is a big problem in so many organizations. Unfortunately, that’s because we’re not identifying our requirements. You may have the shiny tool, but in reality, what is needed? Once you know that, it’s going to be a lot easier and more effective to implement a secure-by-design approach.<\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
How can MSPs proactively identify and address the \u201cunknown unknowns\u201d in a client’s environment before they become breaches?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
The important part is knowing where your responsibility is. I\u2019ve dealt with a lot of situations where the client and their third party were overlapping duties, or worse, they had huge gaps that neither party knew they had the responsibility for. If you’re following best practices and know your responsibilities, then you’re already in a better state than a lot of other companies.<\/p>\n\n\n\n
Get things in writing. If your client says, \u201cAccess our environment through RDP. Here’s a password that we all share.\u201d You should get in writing that you’ve advised them not to do this and why you’ve advised them not to. It shows you\u2019re going above and beyond. You\u2019re already giving a benefit to having a relationship and building trust. Be proactive.<\/p>\n\n\n\n
And yes, sometimes clients will not listen. If something is breached, if a password is stolen, you’ve made that recommendation. You’ve met your responsibility <\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
What lessons have you learned from supporting organizations during and after a breach that MSPs should kind of take note of?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
Looking at what was done wrong is so critical because if you don’t take that view, you’re going to miss things that you can learn from and improve on.<\/p>\n\n\n\n
You need a culture where people feel safe to admit when they’ve done something wrong or where they’ve seen bad practices. People can be the strongest asset. Tooling is designed to do certain things, but it does not think consciously. It doesn’t know your job, especially if you’re getting a phishing email from someone you have an existing relationship with. The users, on the other hand, they can make that assessment.<\/p>\n\n\n\n
I’m still shocked today at the number of customers that I\u2019ve worked with who didn’t have a risk register. It doesn’t have to be fancy. It could be an Excel document. Knowing your environment, likely risks, this is going to put you in a good place to know how to protect yourself and identify where you have gaps. <\/p>\n\n\n\n
How are you going to recognize an incident if you don’t know what’s going on? The tooling is designed to detect unusual activity, but if everything is unusual, you\u2019ll have an exhausted security operations team.<\/p>\n\n\n\n
Also, invest in the right areas. If you’re spending so much money on security that it’s impacting your core competencies, you’re doing it wrong. If you’re spending nothing, you’re also doing it wrong. The business needs to have a relationship with security and IT. But IT and security also need to have a relationship with the business.<\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
In your experience of auditing third-party clients, what are the red flags MSPs and their clients should watch out for?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
From an MSP perspective, a client who is constantly ignoring your advice. If an incident happens, they may even try to blame you. Make sure in your clauses you know exactly where your responsibility is. It takes time, money, effort and resources to investigate a breach. Make sure that that is very well defined.<\/p>\n\n\n\n
From an auditing perspective, if it is not documented, it does not exist. If you don’t follow a governance process, if you don’t manage the relationship, review documents and dashboards, then it’s probably not happening.<\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
When scaling rapidly, how should IT leaders balance pressure to deliver new capabilities or new technology quickly with the need to bring in layered security controls that won’t impact innovation?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
You need to have a plan. Ask yourself: what is the goal? What is your architecture? What are the things that I need to comply with?<\/p>\n\n\n\n
For a parent company with smaller companies, have your plan, know what the requirement to meet is and know what your plan is when you’re buying your company. It could be you don’t ever actually plan to embed them. That’s valid, but they still need to meet the relevant requirements. If you want to embed them, how much work is that going to be? Look at what they have in place.<\/p>\n\n\n\n
I\u2019ve had companies being purchased tell me they have had no security incidents in the last 12 months. If you’ve had no security incidents, it doesn’t mean you’re secure\u2014it means you don’t know. To me, that is a massive red flag.If a company tells me they’ve had incidents, resolved them, actively taking learnings from it and implementing tools, that looks a lot more attractive to me because they’ve consciously thought about it and they’re trying to improve. That means they probably know the environment better.<\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
If you could give one piece of advice to an MSP that is supporting a client that’s going through a high-growth phase, what would it be?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
So many IT projects fail because they didn’t document the requirements. They didn’t talk to the users. If it doesn’t let people get their job done, there’s going to be shadow IT.<\/p>\n\n\n\n
Make sure any risks are documented and you’re very clear of what their responsibility is and have it in writing. So if a breach happens because of a poorly designed system or process, and you warned them, you can say you did your job. You need to protect yourself. The client is going to have to take the responsibility.<\/p>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
What strategic security investments should IT leaders prioritize during a scale-up phase to ensure today\u2019s architecture can handle tomorrow\u2019s complexity and threat landscape?<\/h3>\n<\/div>\n<\/div>\n\n\n\n
\n
\n<\/figure>\n<\/div>\n\n\n\n
\n
Look at what your inherent needs are and what makes sense in your environment. But as a general trend, identity is a very important area. Threat actors are trying to do the least amount of work to get the most back, and the way to do that is to take over existing accounts by manipulating the end user.<\/p>\n\n\n\n
If you know what’s in your environment, your users and what their usual activity is, you can flag things outside the norm, which is going to be effective in stopping attacks. There are lots of solutions out there that you can go with. Choose what makes sense to you and your existing vendor relationships.<\/p>\n<\/div>\n<\/div>\n\n\n\n
![\"MSPGlobal\"](\"https:\/\/mspglobal.com\/blog\/wp-content\/uploads\/cropped-fav_mspg-1.png\")
<\/figure>\n<\/div>\n\n\n\n![\"\"](\"https:\/\/mspglobal.com\/blog\/wp-content\/uploads\/11412015_10203374282797533_7115620044027034593_o.jpg\")
<\/figure>\n<\/div>\n\n\n\n\n