One Security Baseline. Room for Every Client.

Steve built his managed services practice around lessons from incident response. In the compromises he investigated, legitimate remote-access software was a recurring way for attackers to establish a foothold.

He wrote custom code to detect remote-access installations, alert through his remote management platform, and run uninstall scripts. Keeping those detections current became increasingly difficult alongside the rest of his work. On a good week, he could update his own solution twice.

He kept his existing scripts in place, but needed a way to offload the daily upkeep while fitting the different applications, operating systems, and workflows of his clients.

Working with the MagicSword team, Steve helped shape a multi-tenant workflow: manage a central policy baseline and adapt it to individual customer environments, rather than maintain every client policy independently.

Clients with older Windows systems presented another constraint. Steve worked directly with engineering on AppLocker compatibility for the environments he manages. This gave him a way to extend the approach while clients planned upgrades at a pace their budgets could support.

At the time of the interview, Steve described his client approach as strictly block-list. He was not running a full default-deny allow-list across those clients. Their dynamic workflows made usability and business continuity central to his rollout decisions.

He described extended learning-only periods to collect telemetry and understand client environments. If an adjustment is needed, returning to an audit policy offers a practical way to investigate.

Steve reported no critical operational outage caused by MagicSword in his deployments to date. He had not observed an incident where MagicSword caught something his EDR missed at the time of the interview; he values the additional layer of control and the ability to strengthen it progressively.

MagicSword reduced the legwork of researching and maintaining remote-access detections. Steve still investigates emerging threats, checks relevant intelligence streams, and adds other protections where a client’s environment calls for them.

Centralized policies reduced the overhead of working at the individual client level. In annual service reviews, he could also explain the additional protections he was bringing to the service; clients were receptive to that value.

Steve emphasized his access to the engineering team and the speed of follow-up when requirements or questions surfaced. Multi-tenancy and AppLocker support grew from practical discussions about the environments he needed to protect.

For a smaller MSP, that relationship mattered: he could build a security posture that grows with his clients while keeping day-to-day operations stable.