Failures, incidents and official sources
Why managed security arrangements fail: ten patterns and the clause or test that prevents each
The common ways managed cyber security disappoints Australian businesses, from scope gaps and unmonitored weekends to untested backups and retainers that are only discounts.
Managed security arrangements rarely fail because the technology is bad. They fail because of gaps between what the business thought it bought and what the contract and setup actually deliver: devices and accounts left out of scope, alerts that nobody acts on overnight, response authority nobody agreed, backups that were never tested, and contracts that turn out to cover "acknowledgement" rather than containment. Each pattern below comes with the contract clause, test or habit that prevents it. The patterns are generic; no real company's incident is described.
This is the pillar guide for failures and sources. Read it with 24/7 monitoring gaps, the first 72 hours of a ransomware incident, pen-test authorisation, cyber insurance and the official sources guide.
The ten patterns
| # | Pattern | What it looks like | Prevention |
|---|---|---|---|
| 1 | Scope drift | New laptops, a new cloud app or a second site never added | Scope schedule plus a quarterly reconciliation of devices against the monitoring console |
| 2 | Business-hours "24/7" | Alerts queued overnight and reviewed in the morning | Contract states who triages at night and the containment target for P1 at all hours |
| 3 | No authority to act | Provider sees ransomware starting but waits for a phone call | Written containment rules and an after-hours approval chain |
| 4 | Identity blind spot | Endpoint is watched but a stolen Microsoft 365 password is used from overseas | Identity monitoring and MFA on every account in scope |
| 5 | Untested backups | Backups exist but cannot be restored quickly, or were encrypted too | Isolated or immutable copy and a documented restore test at least each quarter |
| 6 | Response stops at containment | Device isolated; investigation and recovery billed at emergency rates | IR scope and rates agreed in advance, ideally a retainer |
| 7 | Logs too short | Breach discovered after logs have rolled over; cannot tell what was accessed | Retention long enough for investigation and the NDB assessment |
| 8 | Report nobody reads | Monthly PDF filed unread; risks accumulate | Short monthly review meeting with three actions and an owner |
| 9 | Supplier compromise | The provider's own remote access tool is abused | Due diligence on the provider's security, MFA on its access, access logging |
| 10 | Locked-in exit | Data and configurations held hostage by long notice and vague handover | Exit clause with deliverables, time frames and fees |
Pattern deep dive: scope drift
Businesses change every month. A new starter gets a laptop that is imaged without the security agent; a team adopts a file-sharing app nobody told IT about; a branch opens with a consumer router. None of this is in scope, so none of it is monitored.
Test: every quarter, export the list of devices and accounts from your device management or Microsoft 365 admin console and compare it with the provider's monitored list. The difference is your unprotected surface. Ask the provider to include this reconciliation in the monthly report.
Pattern deep dive: the response gap
A common sequence: the MDR service detects suspicious behaviour at 1:40 am on a Saturday, raises a ticket and emails your IT contact. Nobody reads email until Monday. The contract's "15-minute response" was met, because response was defined as acknowledgement.
Fix: define each step (detect, triage, notify, contain), require phone escalation for P1 incidents, and give the provider authority to isolate devices and disable accounts without waiting. See SLA and contract questions.
Pattern deep dive: backups
The Essential Eight lists regular backups as one of its eight strategies for a reason: they decide whether a ransomware attack is an inconvenience or a crisis. Backups fail when they are connected to the same network and encrypted with everything else, when backup admin accounts use the same credentials as the domain, or when nobody has ever timed a full restore.
Test: restore a whole server and a sample of files to a separate environment, time it, and record the result. If it takes three days to restore the line-of-business system, that is your downtime estimate.
The money side of failure
Failures are expensive in ways that do not show up in the managed service fee:
- Emergency response at hourly rates if there is no retainer.
- Notification and legal costs under the Privacy Act's NDB scheme.
- Reporting obligations under the Cyber Security Act if a payment is made.
- Downtime: staff who cannot work, orders not processed.
- Insurance: a claim may be complicated if controls stated in the proposal form were not in place.
Avoid the trap of buying more products to fix a process gap. Most of the patterns above are fixed by definitions, tests and habits rather than another tool.
A one-page health check
- Do the monitored devices and accounts match what we actually have?
- Who acts on a P1 alert at 2 am on a Sunday, and are they allowed to contain it?
- When did we last restore from backup, and how long did it take?
- How long are logs kept?
- Who reads the monthly report, and what did we change last month?
- What does the contract say about response beyond containment?
- How would we leave this provider, and how long would it take?
If you cannot answer three or more of these, start with the due-diligence checklist.
Frequently asked questions
Our provider says we are "fully protected". How can we check?
Ask for the scope list, the monitored device count, the last restore test and the containment rules in writing. "Fully protected" is not a contract term.
Should we switch providers after a bad incident?
Not automatically. First find out whether the failure was the provider's, the scope's or your own process. Then decide. An independent post-incident review helps.
Who is responsible if the provider misses an attack?
That depends on the contract, including any liability cap. Legal obligations under the Privacy Act and Cyber Security Act stay with your business.
Can we complain about a provider?
Raise it with the provider first, in writing. For contract disputes, small businesses can seek help from the Australian Small Business and Family Enterprise Ombudsman or a state small business commissioner.
Sources
- ASD's Australian Cyber Security Centre — Essential Eight and guidance on managed service providers
- Office of the Australian Information Commissioner — preparing for and responding to data breaches
- Australian Small Business and Family Enterprise Ombudsman — help with disputes
- business.gov.au — cyber security checklist for small business
