MSP cybersecurity: Fixed budgets can’t cover school needs — Bryan Lukralle, CharterTS – MSP Radio: The Voice of the Solution Provider

The episode reveals a governance gap between mounting cybersecurity requirements and the operational realities facing MSPs serving charter schools and nonprofits. Charter Technology Solutions (CTS) exemplifies how regulatory mandates, cyber insurance controls, and evolving client demands confront fixed budgets and unique seasonal workloads in mission-driven verticals. Addressing these pressures necessitates major adaptations to vendor licensing models and new service design approaches to maintain basic security.

CTS reports managing over 100 school clients, deploying a lean security stack focused on MDR (addressing endpoint and cloud threats), email security, security awareness training, and cloud backup. This shortlist stems from the need to balance cost with non-negotiable protections, achieved partly by negotiating with vendors to exclude student accounts from licensing fees. Despite these efforts, only around half of CTS’s clients adopt the full cybersecurity package, reflecting financial tradeoffs and limited internal resources at schools.

Operational adjustments support these constraints, including shifting permanent staff roles seasonally to meet heavy summer project demand and relying on short internships to scale device provisioning. MFA adoption remains problematic due to client concerns about teacher burden and the technical challenges of securing student accounts. The episode also highlights a rising risk area: ad hoc adoption of AI tools by clients without adequate access controls, leading to sensitive data exposure through weak permissions.

For MSPs, these dynamics mean risk cannot be reduced through technology alone. Accountability for client decision-making, flexible contracts, and persistent education are necessary, especially when client governance lags technical change. The need to negotiate or customize vendor agreements adds contract risk, while unmanaged use of new technologies like AI introduces operational complexity and liability exposures that MSPs must track and address proactively.

Supported by:
Pax8
Mailprotector

NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.