Free guide for MSPs

Reaching Zero Standing Privilege

How to score your MSP against each phase of the PAM journey, what Microsoft already covers, and what to ask a PAM vendor before you buy.

Get the free guide
Free guide. Short form below.
SOC 2 Type 2 attestationGDPRCCPA
Cover of Reaching Zero Standing Privilege, CyberQP's PAM buyer's guide
Why it matters

Admin accounts are the prize

An MSP's admin accounts are the most valuable thing an attacker can take from it, because each one opens a door at every client it touches. Zero standing privilege removes that prize: no account holds admin rights while nobody is using them, so there's nothing sitting live to steal.

This guide is for the people who own the decision at an MSP: owners, CEOs, and the service delivery and security leads who will live with the result. It explains what zero standing privilege means in practice and walks through the eight phases of the PAM journey. It also gives you a scorecard and a set of vendor questions you can use whatever platform you end up running.

Inside

What the guide covers

Why standing admin access is an MSP problem
How one compromised account becomes an incident across a whole client list. Three documented MSP incidents from 2021 to 2026 and what governments have told MSPs to do about it.
The eight phases, one at a time
For each phase: what it does, what good looks like, where MSPs usually stall, and what to ask a vendor.
What Microsoft already gives you
Windows LAPS, Entra ID PIM and granular delegated admin privileges (GDAP), and exactly where each one stops.
A 90-day rollout plan
Week-by-week order of work built around a pilot client, plus decisions to make before go-live.
How to evaluate a PAM platform as an MSP
The criteria analyst reports don't score for MSPs, and five requests that separate a demo from a deployment.
A scorecard for your own MSP
Score each phase 0 to 2, re-run after 90 days to show clients what changed.
Free download
Get Reaching Zero Standing Privilege
Free guide for MSPs
Get the guide