Professional Services Consultant

Why your African startup needs cybersecurity before pitching to investors. The ConnectWise breach: A wake-up call for African entrepreneurs. Last week, security researchers uncovered a significant breach at ConnectWise, a widely-used IT management platform trusted by thousands of companies worldwide. According to Microsoft's investigation, hackers linked to China exploited vulnerabilities in the platform and used AI-powered agents to rapidly infiltrate thousands of customer networks. The scale of this attack serves as a critical reminder: cybersecurity isn't just an IT concern - it's a business survival issue. For African entrepreneurs and startup founders, this breach carries an important lesson. Whether you're bootstrapping your business or preparing to pitch to investors, your company's security posture directly impacts your credibility, valuation, and ability to attract funding. What happened and why it matters. The ConnectWise incident demonstrates how sophisticated cyber threats have become. Hackers didn't manually breach each company - they used automated AI agents to scan, identify, and exploit vulnerabilities at scale. This means even small oversight in your security infrastructure could expose your business data, customer information, and intellectual property. For startups seeking funding on platforms like FundNaija, investors are increasingly asking tough questions about data protection, compliance, and security protocols. A single breach can tank your funding prospects and destroy investor confidence. Why this matters for founders. * Investor Due Diligence: Modern investors conduct security audits before committing capital. Demonstrating robust cybersecurity practices sets you apart from competitors. * Customer Trust: In Africa's growing digital economy, customers want assurance their data is safe. Security certifications and protocols become competitive advantages. * Regulatory Compliance: Many African countries are strengthening data protection laws. Being ahead of regulations protects your business from penalties. * Valuation Impact: Companies with strong security frameworks command higher valuations during funding rounds. Practical steps for your startup. Start by auditing your current security measures. Use strong authentication systems, keep software updated, and implement access controls. Consider cybersecurity insurance as you scale. Most importantly, make security a core value, not an afterthought. When you're ready to pursue funding, ensure your security documentation is investor-ready. At FundNaija, FundNaija, Inc. help founders present their businesses comprehensively - including operational resilience and risk management - to potential investors. Want to check your funding readiness? Try FundNaija's free FundScore to assess your startup's investment potential and identify areas for improvement, including operational security. Get funding-ready today. Create an AI-powered business plan and discover funding opportunities tailored to your business.

ConnectWise breach: your vendor's app identity is your attack surface. Last week's ConnectWise Cloud Backup incident did not start with a phished employee in your organization. According to Huntress, attackers signed in to Microsoft 365 tenants as the backup application itself, using a credential held by the vendor. No user, no device, no MFA prompt. If your security program stops at user accounts, this is the gap it describes. What happened. Huntress traced scripted activity from a single hosting IP starting October 13 and 14. By October 15, ConnectWise Cloud Management service principals had started assigning themselves directory roles, mostly Exchange Administrator, in about 50 tenants Huntress monitors. In one tenant, the Cloud Management Teams app added itself to Global Administrator and then modified two other applications. Huntress confirmed unauthorized sign-ins in 162 tenants as of October 16 and later reported roughly 1,000 tenants with sign-in activity from the attacker's address, more than 300 of them successful. Counts differ by source and keep moving, and the final number is still unclear. BleepingComputer reported that ConnectWise announced a Cloud Backup interruption on October 17 and disabled seven application identities. The company said it had no indicators that partner backup data was compromised. How the credential was obtained has not been disclosed. Why MFA and user controls did not help. Cloud Backup is a multi-tenant app. Each customer consented to it once, and that consent granted standing permissions inside their tenant. Microsoft described the event as an active supply-chain attack and assessed that the actor likely abused permissions customers had previously granted, according to Cybersecurity Dive. Because the sign-ins were app-only, user MFA and user-session revocation never entered the picture. Todyl, quoted by BleepingComputer, noted that disabling an app stops new tokens, while tokens already issued can stay valid until they expire. Persistence is the part that should worry a CIO. In at least one tenant, Huntress found client secrets planted on other applications, including an MSP management tool and Huntress's own app, set to expire in 2028. Disabling the ConnectWise apps does not remove credentials that were already added elsewhere. The recovery problem. This was a backup product. As of ITPro's October 20 report, Cloud Backup remained disabled with no confirmed restoration date. A tool bought to reduce recovery risk became a dependency on one vendor's identity, and while it is off, scheduled backups are not running. A third-party app audit you can start this week. * Inventory every enterprise application with consent in your tenants, including dormant ones. Huntress advises disabling, not deleting, the implicated ConnectWise and SkyKick apps, since deleting removes consent and forces a re-consent to restore service. * Review client secrets and certificates on all applications for anything added since October 13 that your team did not create. Check management and security tools first. * Look at directory roles held by service principals. Any vendor app holding Global Administrator or Privileged Authentication Administrator needs an owner and a written reason. * Search Entra audit and service principal sign-in logs for apps modifying other apps or assigning themselves roles, and for sign-ins from non-Microsoft IP ranges. * Put guardrails in place: application management policies to restrict or cap client secret lifetimes, tighter control over who holds Application Administrator roles, Conditional Access for workload identities, and Entra ID Protection for risky service principals. Huntress lists these as hardening steps. Then ask the question that this incident makes uncomfortable: if your backup vendor's identity were unavailable tomorrow, how would you restore a mailbox? A recovery path that depends on a single vendor's identity is a plan with a hidden single point of failure. Treat vendor apps like privileged users. Admin accounts usually get access reviews. OAuth apps with similar reach often do not. The ConnectWise incident is a reminder that consent is a standing grant, and it can be exercised by whoever holds the vendor's credential. Give each third-party app an owner, a permission review date and an exit plan. Reviewing your third-party access or recovery architecture? Talk to the Luby team about a practical assessment.

The Cannata Report's 2026 Outstanding Veteran Award nominees. Five veterans featured in this year's Veterans Way column will be recognized at the 41st Annual Awards & Charities Gala. The Cannata Report will announce the recipient of its 2026 Outstanding Veteran Award at its 41st Annual Awards & Charities Gala on November 19, 2026, at The Madison Hotel in Morristown, New Jersey. The award is given in recognition of outstanding military service and dedication to supporting fellow veterans transitioning to civilian life and a career in the office technology industry. The five nominees for the Outstanding Veteran Award have each been profiled this year by Frank G. Cannata in Veterans Way, a monthly column presented by U.S. Bank. Their stories show how military experience continues to shape their work and their contributions to the office technology industry. "Each of these nominees has faced challenges with discipline, determination, and a willingness to serve others," said Frank G. Cannata, founder of The Cannata Report and Veterans Way columnist. "Their stories show the strength of character our military helps develop, and the lasting value veterans bring to our industry. It has been a privilege to share their stories, and each is deserving of this nomination." The nominees for The Cannata Report's Outstanding Veteran Award are: Alison Hall, an accounts payable specialist at Impact Networking, served for nearly nine years in the U.S. Navy Reserve as a member of the Military Police at Naval Station Great Lakes. She credits her service with strengthening the adaptability, discipline, consistency and resilience she brings to her civilian career. David Anthony Ramirez, a solutions technical support manager for Toshiba America Business Solutions, served in the U.S. Army and California Army National Guard. His military work included equipment records, parts and logistics support in Germany, Italy and California. Antonio Romeuzuleta of Konica Minolta Business Solutions U.S.A. served in the U.S. Navy as an aviation structural mechanic responsible for fighter jet life-support and safety systems. He also serves as co-chair of BRAVE, Konica Minolta's employee resource group for veterans. Deepak Sharma, service director for Kyocera Document Solutions' Southeast Region, served as a U.S. Army combat engineer, including tours in Afghanistan. After leaving the military, he pursued technical training and began his career in the office technology industry as a copier technician. Hannalora Van Nevel leads U.S. Bank's Issue Management & Complaints Team. She served in the U.S. Army and Minnesota Army National Guard, drawing on the attention to detail and adaptability she developed during her military service in her work today. This year's Gala beneficiary is the Precision Medicine for Military Veterans Initiative, a partnership between City of Hope, Translational Genomics Research Institute (TGen), part of City of Hope, and Soteria Precision Medicine Foundation. The initiative provides precision medicine navigation for veterans battling cancer, with a particular focus on Special Operations Forces veterans who may have experienced unique environmental and occupational exposures during their military service. The Cannata Report's 41st Annual Awards & Charities Gala - themed Resilience in recognition of the office technology dealer channel's durability and adaptability, as well as paying tribute to veterans fighting cancer - welcomes back Platinum Sponsors Hytec Solutions and TD SYNNEX, while ConnectWise, Distribution Management, and Katun Corporation return as Gold Sponsors. ECI Software Solutions and PEAC Solutions join the Gala as Silver Sponsors, HP will once again host the Cocktail Reception, and Xerox returns to host the After Party. To make a donation to the charity or inquire about attending, please contact Frank G. Cannata at [email protected].