The Conventional Wisdom
Your TPRM team is hearing it from every vendor: "We've deployed AI-driven security monitoring." Board decks promise AI will detect anomalies faster than human analysts. The pitch sounds compelling, especially after Storm-0940 used an AI penetration-testing tool called ARTEX to compromise ConnectWise application credentials and target over 2,250 Microsoft 365 tenants. Some progressed from initial targeting to privileged cloud access in under three hours.
The reflexive response? Demand your vendors adopt AI-powered defense tools. Require attestations about machine learning threat detection. Add AI security capabilities to your SIG Core assessments.
Why We Disagree
AI didn't create the ConnectWise vulnerability. Human decisions did.
The Storm-0940 campaign succeeded because organizations granted ConnectWise application identities broad permissions across their Microsoft 365 environments. Those permissions persisted without continuous validation. When the credentials were compromised, the attackers inherited every access right customers had previously approved, no interactive user login required.
ARTEX automated reconnaissance and credential attacks, but automation isn't new. Password spraying has been standard tradecraft long before AI became a boardroom buzzword. What changed wasn't the sophistication of the attack vector. What changed was the attack surface: organizations had pre-authorized third-party applications with standing access to critical cloud resources.
Asking your vendors to deploy better AI monitoring misses the governance failure. You're treating a symptom while ignoring the disease: overprivileged third-party application access that nobody's actively managing.
The Evidence
Between October 10 and 14, Storm-0940 made over 151,000 failed sign-in attempts against 327 accounts at eight organizations. Microsoft observed no successful logins from that password-spraying campaign. The attackers then pivoted to compromised ConnectWise application identities, and those worked.
The distinction matters. Direct credential attacks failed. Pre-authorized application access succeeded.
Microsoft's disclosure confirms the attackers used Microsoft Graph to conduct reconnaissance, modify application credentials, and attempt privilege escalation. These activities occurred through legitimate API access. The attackers didn't need to bypass security controls because customers had already granted the necessary permissions.
ConnectWise contained the affected application connections, but that doesn't automatically revoke access for attackers who established additional footholds. Once privileged access is achieved, competent adversaries create persistence mechanisms. Shutting down the original entry point doesn't guarantee you've ejected everyone who came through the door.
What to Do Instead
Stop asking vendors what AI tools they've deployed. Start auditing what permissions you've granted them.
Inventory third-party application access across your cloud environments. Most organizations can't produce a complete list of applications with delegated permissions to their Microsoft 365, Google Workspace, or AWS tenants. Your vendor intake process captured the initial request. Your continuous monitoring of active arrangements should track whether those permissions still align with the current service scope.
Implement time-bound application credentials for non-interactive access. If a vendor requires standing API access, enforce credential rotation cycles shorter than your risk appetite for undetected compromise. ConnectWise customers who had 90-day credential lifecycles faced a fundamentally different risk profile than those using credentials issued years ago.
Require vendors to document the minimum privilege set needed for each service function. When ConnectWise requests Microsoft Graph permissions, your contract should specify exactly which API endpoints the service will call and why. Deviation from that scope should trigger immediate review, not passive logging.
Separate authentication from authorization in your Right to Audit clauses. Your contract might give you the right to audit ConnectWise's security controls, but can you audit what permissions their application actually uses in your environment? Most audit rights focus on the vendor's internal practices. Few extend to reviewing how the vendor's application behaves inside your tenant.
Build application access into your Incident Escalation procedures. When a vendor discloses a breach, your response plan should include immediate review of all application permissions that vendor holds. ConnectWise pulled affected services, but customer response required reviewing and potentially revoking delegated access rights, a step that isn't automatic.
When the Conventional Wisdom Is Right
AI-driven defense tools aren't useless. They're just insufficient.
If your vendor can demonstrate that AI monitoring detected anomalous API usage patterns and triggered automated Access Revocation before privilege escalation occurred, that's valuable. If their AI system flagged the reconnaissance activity Storm-0940 conducted through Microsoft Graph and initiated containment in minutes rather than hours, that capability matters.
But those controls sit downstream of the governance decision that created the exposure. You granted the application access. You defined the permission scope. You set the credential lifecycle. AI can help your vendor detect misuse of those permissions faster; it can't prevent you from granting excessive permissions in the first place.
The ConnectWise incident underscores a principle that predates AI by decades: least privilege isn't just an internal control. It's a third-party risk control. When you delegate access to a vendor's application, you're trusting not just their security posture but their ability to contain a breach before an attacker inherits your trust.
AI tools can accelerate both attack and defense. They can't fix a governance framework that treats third-party application access as a one-time approval rather than a continuously managed risk. Storm-0940 moved from targeting to privileged access in under three hours because the access was already there, waiting to be claimed.
Your vendors' AI capabilities matter less than your access governance. Fix the permissions model first. Then evaluate whether AI monitoring adds meaningful defense in depth or just expensive reassurance.
