Last Friday, a backup service used across the managed services industry disclosed that someone had been signing in to its customers' Microsoft 365 tenants as the backup application itself. No password was guessed. No multi-factor prompt was bypassed. The attacker simply was the software everybody had already trusted.
For some of our clients, the affected application was isolated automatically within about a minute of the vendor's announcement. For the rest, our engineers switched it off by hand. Both groups were protected. But only one was protected at machine speed, and the line between them was not technical.
For at least one client it was drawn at a renewal meeting. That client had been offered the identity threat detection service that delivers the automatic shut-off, and declined it on cost. That was a legitimate business call, and it was theirs to make. But a no given across a renewal table is still a security decision, and it deserves to be treated like one: written down, owned by a named person, and put back on the table at every review.
Here is the short version. In the AI era, your risk is set less by the controls you bought than by the controls you declined, and whether anyone treated that as a decision.
Every AI capability you switch on arrives the same way that backup tool did: as an application you consent to, with standing access to mail, files, chats and directory data. Copilot connectors, third-party agents, meeting assistants, AI features inside your CRM. The AI rollout is, underneath, a consent rollout.
Two things from this week should worry any business with 50 to 1,000 staff. First, one investigator found malicious sign-ins in tenants that no longer had an active backup subscription. The contract had ended; the consent had not. Second, the protection gap fell exactly where a control had been declined on cost.
They review who can sign in, and almost never review what can sign in. User access gets an annual audit. Application consents granted three years ago for a trial nobody remembers get none.
They read their provider's silence as assurance. If your provider stopped recommending something after you said no once, that is not agreement. It is a provider protecting a renewal.
And they decline controls on price without recording it as a decision. A control declined in a commercial meeting and never written down is a risk nobody accepted, which means nobody owns it.
The managed service model was built to keep customers comfortable. A managed intelligence provider has to be willing to make them uncomfortable, and to put it in writing. When an attacker can move through hundreds of tenants in hours, "the client said no" cannot be the end of the conversation. From here, every control a client declines will be recorded as a named risk acceptance and raised again at every review.