Penetration Testing for IT Support Companies in the UK

The Irony of the Unsecured IT Firm

IT support and managed service providers occupy a privileged position in their clients' security architecture. They hold administrative credentials for client systems, remote monitoring and management (RMM) access to endpoints and servers, backup data containing sensitive business information, and often the master keys to client email, identity, and cloud infrastructure.

This makes them one of the highest-value targets in the cybercrime ecosystem — not for what they hold directly, but for the lateral access they provide to every client they serve. The Kaseya VSA ransomware attack in 2021 exploited exactly this trust relationship: compromising a single MSP tool propagated ransomware to approximately 1,500 businesses downstream.

Against this backdrop, the idea that an IT support firm's own website might be insecure is both common and genuinely consequential. The website is the public face of a business that clients trust with privileged access. Weaknesses in that public face can be exploited to phish clients, harvest credentials, or establish a foothold for deeper compromise.

What Attack Surface Does an IT Support Website Expose

Client portal and ticketing systems

Many IT support firms expose a client-facing helpdesk portal where clients log tickets, view their service status, and access documentation. These portals contain incident histories, system configuration details, and support conversations that can include credentials shared during troubleshooting. Inadequate access controls — IDOR vulnerabilities, session management weaknesses — can allow one client to access another's ticket history.

Remote support tooling exposed to the web

RMM platforms and remote desktop tools that are accessible from the public internet represent significant risk. If these are protected only by weak credentials and lack multi-factor authentication, they become direct entry points to client systems. An attacker who compromises the IT firm's web-facing management tools has immediate access to every client endpoint under management.

Job application and contact flows

IT firms receive CVs, technical assessments, and detailed contact forms. Malicious attachments in apparent job applications are a primary social engineering vector against IT companies specifically. While this is not purely a web vulnerability, the file handling and processing associated with web-submitted applications is within scope for a web security assessment.

Staff and admin portals

IT support firms often have internal web tools — documentation wikis, internal helpdesk systems, configuration databases — that are accessible from the internet for remote work. These should be protected by MFA and network-level access controls, but frequently are not.

The firm's own website as a phishing vector

If an attacker can inject content into an IT support firm's website — via a stored XSS vulnerability, a compromised CMS plugin, or a subdomain takeover — they can use the firm's trusted domain to host phishing pages targeting the firm's clients. A message that appears to come from "your IT support provider" asking clients to enter credentials or install a remote access tool is far more convincing than a cold phishing email.

Why IT Support Firms Are Specifically Targeted

Beyond the access they hold, IT support firms are targeted because they are perceived to be understaffed on their own internal security. The firms that provide security services to clients frequently have less mature internal security programmes than you might expect — their expertise is deployed outward, not inward.

Supply chain attacks against MSPs have increased substantially. The pattern is consistent: attackers identify an MSP, compromise its management infrastructure, then use that access to deploy ransomware or exfiltrate data across the entire client base simultaneously. A single MSP compromise can yield dozens of victims.

The Trust Dimension

For an IT support company, security is the product. Clients are hiring the firm specifically because they trust its technical judgment and competence. A security incident that exposes client data, sends phishing emails from the firm's domain, or results in a client network compromise via the MSP's infrastructure is not just a regulatory problem — it is a fundamental failure of the value proposition.

Clients who are procurement-conscious — larger businesses, regulated entities, public sector organisations — increasingly require their IT support providers to demonstrate security certifications and provide evidence of security assessments. Cyber Essentials certification, a web security assessment report, and documented access control policies are becoming standard requirements in IT services procurement.

What a Penetration Test of an IT Support Website Covers

A web application penetration test for an IT support company examines the public website and any internet-facing web applications. This includes injection testing on all forms and input fields, authentication and session security on any login portals, access control testing between client accounts in ticketing or portal systems, enumeration of subdomains and legacy systems, review of exposed administrative interfaces, TLS configuration quality, HTTP security headers, email authentication configuration, and information disclosure via HTTP responses or JavaScript bundles.

For RMM platforms and remote support tools that are accessible from the public internet, the scope may extend to testing authentication strength, multi-factor authentication implementation, and API exposure — though full assessment of these tools typically requires a dedicated engagement.

What Good Looks Like

IT support firms that take their own security seriously typically have: DMARC at enforcement policy on their own domain; MFA enforced on all staff accounts, particularly RMM and remote access tools; network-level access controls (IP allowlisting or VPN requirement) on internal web tools; a regular web security assessment of client-facing portals; and Cyber Essentials or Cyber Essentials Plus certification.

Achieving this baseline is both a security improvement and a commercial differentiator. An IT support firm that can demonstrate its own security posture is better positioned in enterprise sales, in insurance negotiations, and when responding to the inevitable client questions following a high-profile MSP attack in the news.

Yrzo AI runs 75+ automated security checks and delivers a full written report in under 20 minutes. Starting from £149 at yrzoai.dev.