Acronis released its first TRU Cyber Pulse report on November 9, bringing together earlier investigations rather than announcing a single new campaign.
Its practical focus is the reach of access: a compromised MSP technician, integration or management tool may expose several customer environments.
The report recommends tracing stolen identities into connected services, revoking sessions and tokens, and reviewing subsequent use. It also calls for AI-agent permissions to be enforced by tools and infrastructure.
Recovery tests should assume routine administration is compromised. Recommendations include separating backup administration and testing restoration of working services.
Providers should map dependencies and agree who can terminate access before an incident. These are recommendations, not measured guarantees of containment.
Image: AI-generated editorial illustration created for DaySec.
