The Costs and Consequences of Poor Patch Management and How MSPs Can Capitalize

By N-able Guest Blog 2

The high-level impacts of spyware, ransomware, rootkits, spambots, hijackers and other online attacks that can enter a company’s network through unpatched vulnerabilities are clear: decreased productivity, lost revenue and damaged reputation. What happens if sensitive personal or financial information is stolen–and what happens if that loss results in legal action? And if an SMB’s systems are knocked offline, what is the cost of that downtime in terms of both human resources and lost opportunities?

SMBs are generally aware of the consequences of not patching. Unfortunately, the way they go about patching is outdated, with many still doing the task on their own or having a technician install patches manually across their workstations and devices on an irregular, ad hoc basis.

If it takes a combined two hours each month to manually update a single system and the SMB has 100 computers across its organization, it’s easy to do the math and see the time, talent and money being wasted on mundane tasks. But the consequences of not doing them are severe, so finding a better way to get the job done should be a top priority for every organization.

Overcoming Customer Objections to Managed Patching

With so much at stake–and so much time, costs and complexity involved–why aren’t more SMBs adopting a fully managed, outsourced approach to patching? And why aren’t MSPs actively marketing patch management to their customers? Because SMBs and MSPs alike are overlooking the importance and value that managed patch management brings to the table. Common excuses include, “We’ll patch the system if we hear about a problem,” or, “If we’re compromised, we can deal with it using antivirus.”

The reality is, exploits move quickly–they are capable of spreading through a company’s network in a matter of minutes. But with SMBs or technicians making manual system updates, the chances of being able to react before an infection takes hold are slim. In addition, even the best antivirus software in the world can’t protect against malware. Some types of vulnerabilities, such as rootkits, can’t be caught by antivirus programs: They might be disguised as legitimate system API calls, for example, and require difficult, time-consuming manual effort to locate and remove.

For all of these reasons, it’s easy to see that an outsourced patch management strategy delivered by a reliable, trusted MSP can give SMBs the protection they need at a cost they can afford. And from the MSP’s perspective–many of whom still rely on basic, labor-intensive patching tools that eat into their profitability–incorporating an automated patching solution into their managed service offering gives them an easier way of delivering patches that is both low effort and high return.

Making Patch Management Work for the MSP

The challenge for most MSPs is that while patching is a relatively low-cost service to deliver, on its own it does not offer high enough margins to sell as a standalone managed service. As a result, patching is usually available only as part of a more comprehensive service offering that is too expensive for most SMBs. Fortunately, there is a middle ground where MSPs can meet the patching and security needs of their cost-averse, reactive customers and build their own business at the same time.

Some remote monitoring and management solutions, such as N-able’s N-centralplatform, allow MSPs to offer “freemium”licenses for select services to help them get a foot in the door. Free monitoring probes can be deployed throughout a customer’s network, gathering the data necessary to paint a clear picture of the company’s current patching status and where vulnerabilities need to be addressed. By providing this kind of free consultation, MSPs can win their customers’ trust and eventually sell them on a solitary recurring service to fix their current vulnerabilities and keep them secure moving forward–an approach that is likely to be much more appealing to them than a costly, full-blown managed service package.

Make Your Move

The benefits of patch management for SMBs are clear: A fully managed approach gives them the assurance that their networks are protected and devices secured, which reduces system downtime. Cost and time savings also work in the SMBs’ favor, with MSPs offering a fixed monthly fee while saving their clients the hassle of worrying about patch installation.

For MSPs, the decision to offer any kind of service ultimately boils down to return on investment. The centralized, streamlined management of patching reduces support ticket volume and improves support response times–and can even help build recurring revenue from purely reactive customers who would typically purchase very little in the way of managed services. It’s a smart move, no matter how you look at it.

As channel strategy manager for N-able by SolarWinds, David Weeks works closely with the company’s top tier partners and major accounts worldwide to understand their needs, provide insight into current market conditions, and offer strategic sales and marketing recommendations. A regular presenter at N-able’s global and regional summits, David is passionate about ensuring the success of N-able’s partner base. Guest blogs such as this one are published monthly and are part of MSPmentor’s annual platinum sponsorship.