Proactive Security: How MSPs can keep up with a 29-minute attack

Proactive security is a continuous loop of finding, prioritizing and fixing exposure before an attacker uses it, backed by response that runs at machine speed. Attackers now move laterally within 29 minutes of the first compromise. Rule-based playbooks and human-only monitoring can’t match that clock. MSPs need a unified, increasingly agentic approach that scans and mitigates continuously.

Key takeaways

✓ Lateral movement can start 29 minutes after the first attack, faster than most manual response processes.

✓ Proactive security is a whole loop (discover, prioritize, mitigate, respond), not just exposure management.

✓ Fragmented tools slow that loop down. Unified platforms keep it inside the attacker’s clock.

✓ Agentic security automates the repeatable work so your people focus on decisions that matter.

Introduction

Twenty-nine minutes. That’s roughly one team meeting, and it’s how long attackers now need to go from a first foothold to moving laterally through a client’s systems.

For MSPs, that number changes the conversation. Security built on rules, written into a playbook and watched by a human, was designed for a slower threat. The attackers it was built to stop now use AI tools too. A weakness that went unsolved by human attackers for 20 years can now fall in seconds, as one panel at a recent MSP event noted.

This article explains what proactive security means in practice, why a single exposure tool isn’t enough, and how MSPs can build a service that moves at the speed of the threat. It draws on WithSecure’s session for MSPs on building new services in the age of AI.

In this article, you’ll learn:

• Why response time is now the first thing clients should ask about
• What a complete proactive security loop contains
• How to move from reactive alert handling to continuous mitigation

Why is a 29-minute attack window a problem for MSPs?

A 29-minute window means any security process that depends on a person reading an alert, finding a playbook and acting will often finish after the attacker has already spread. Speed has become the first dimension of risk.

Most security operations were built around a familiar rhythm: an alert fires, an analyst triages it, a runbook guides the response. That works when attackers are slow. It struggles when the interval between first access and lateral movement is shorter than a shift handover, a ticket queue or a lunch break.

Three pressures make this harder for MSPs:

• Small and mid-sized businesses are now the main target. Cyber criminals don’t discriminate. Small manufacturers, logistics companies and universities face the same ransomware gangs and malware as large enterprises.
• Attackers have AI tools. Same threats, now with faster discovery, faster exploitation and faster iteration.
• Clients have fewer resources. Small and mid-sized companies are reported to be twice as likely to describe their cyber resilience as insufficient.

Key points

• Speed is the new baseline. Detection that is accurate but slow still loses.
• Rules and playbooks remain useful, but they need automation behind them.
• Your clients need enterprise-level expertise designed for their scale, not enterprise tooling shrunk down.

That last point matters. Mid-sized companies don’t need a scaled-down version of an enterprise stack. They need enterprise-level expertise in a form they can actually run.

What does proactive security actually include?

It is more than exposure management

Many vendors use “proactive” to mean exposure management: finding vulnerabilities and misconfigurations before attackers do. That’s a vital part, but it’s one part.

At WithSecure, proactive security is the whole loop. It covers:

1. Discovering assets, identities, cloud resources and software, including the ones nobody logged.
2. Prioritizing exposure by real risk, not by raw severity scores.
3. Mitigating weaknesses, ideally dynamically and without waiting for a maintenance window.
4. Detecting and responding when something gets through anyway.

The loop never stops. When a new CVE (Common Vulnerabilities and Exposures) entry is published or a new asset appears, the cycle runs again.

Why the loop must live in one place

These steps used to sit in different tools, run by different teams, producing different reports. At a 29-minute clock, every handoff between tools costs minutes you don’t have.

When discovery, prioritization, mitigation and response share one platform and one data model, a newly published CVE can be matched to a client’s real exposure and mitigated within that client’s environment. No export, no ticket, no waiting for someone to reconcile three dashboards.

This is the design logic behind WithSecure Elements: a unified, multi-tenant platform that covers endpoint, identity, cloud, collaboration, exposure management and AI-powered managed detection and response (MDR) through one console and one lightweight agent.

Why must security become agentic?

Agentic security means software agents carry out defined security tasks, such as triage, enrichment, prioritization and containment, within guardrails that people set. It matters because human attention is the scarcest resource in any security operation.

The goal isn’t to remove people. It’s to let automation take the night shift, while experts handle judgment calls.

What agentic security does well

• Filters and contextualizes alert noise before a human sees it.
• Connects findings across endpoint, identity and cloud to show the whole attack path.
• Suggests or applies mitigation the moment a weakness is confirmed.

What people still do

• Set the policy and risk appetite for each client.
• Decide on high-impact actions.
• Talk to clients about what happened and what to change.

For a lean MSP team, this split is what makes 24/7 coverage realistic. WithSecure also delivers monitoring through its Co-security model, so partners don’t need to build their own security operations center (SOC). Your team keeps the client relationship. Our experts extend your coverage.

How to build a proactive service that keeps pace

Here is a practical path for MSPs starting from a traditional detection and response offering.

1. Measure your own clock. Track the time from detection to containment for recent incidents. If it’s measured in hours, find where the minutes go: triage queue, tool switching, approvals.
2. Consolidate the loop. Map the tools involved in discovering, prioritizing, mitigating and responding. Every separate console adds friction. Look for a platform where these functions share data natively.
3. Automate the repeatable. Start with the actions you’d always take: isolating a host, blocking a known-bad indicator, applying a known fix. Let agents run those inside clear policy limits.
4. Add continuous exposure visibility. Move from periodic scans to a constant view of each client’s exposure. The aim is to close the door before anyone tries the handle.
5. Report in business terms. Show clients reduced exposure and faster response. Outcomes, not dashboards, keep partners and their clients confident.

Common challenges and solutions

Frequently asked questions

Q: What is proactive security? Proactive security is a continuous loop of discovering, prioritizing and mitigating exposure before attackers exploit it, combined with fast detection and response. It goes beyond exposure management to cover the full cycle, so weaknesses are fixed and incidents are contained at machine speed.

Q: How fast do attackers move after the first compromise? Attackers can now move laterally within 29 minutes of the first attack. That is faster than most manual, playbook-driven response processes, which is why automation and unified tooling are becoming essential for security services.

Q: What does agentic security mean? Agentic security uses software agents to perform defined tasks, such as triage, prioritization and containment, inside guardrails set by people. It reduces response time and alert fatigue, and it lets human experts concentrate on decisions and client conversations.

Q: Do MSPs need their own SOC to offer proactive security? No. MSPs can combine a unified platform with a Co-security model, where the vendor’s experts provide 24/7 monitoring and response. The MSP keeps the client relationship and revenue while avoiding the cost of building and staffing a SOC.

Conclusion

Attackers have AI. They move in 29 minutes. Your clients, many of them small and mid-sized businesses, are their targets. That’s the reality, and it isn’t going away.

The good news is that the answer is concrete. Run the full proactive loop. Keep it in one platform. Let automation handle the repeatable work and let your people advise. That’s how you stay inside the attacker’s clock, and how you build a service clients value.

Watch now: Proactive Security in the AI World: How MSPs Build New Services