Here’s a fun nightmare: hackers breached ConnectWise, a giant IT platform most people have never heard of — and through it, spied on thousands of companies that never touched the product directly. The victims didn’t get hacked. Their vendor did. They just got the consequences.
Welcome to modern small-business security, where your safety is only as strong as the weakest app you’ve ever clicked “Connect” on. And in the AI era — where every new tool wants a login, a token, and the keys to your accounts — that list is longer than you think.
How a Vendor Breach Becomes Your Breach
Businesses run on connected tools now: schedulers that post to your socials, AI assistants plugged into your email, dashboards reading your sales data. Each connection is a door, and each door is held by somebody else’s security. Attackers have figured this out:
- One breach, thousands of victims. Compromise the platform, inherit access to everyone plugged into it.
- AI agents raise the stakes. Automated tools with broad permissions can be turned fast — in the ConnectWise case, sign-ins were attempted at machine speed.
- Forgotten connections never expire on their own. That app you tried once in 2023 may still hold a valid token today.
The 15-Minute Connected-App Audit
- List your logins’ children. In Google, Meta, and your other main accounts, find the “connected apps / third-party access” page. Screenshot it. That’s your real attack surface.
- Revoke anything you don’t recognize or no longer use. No mercy round: if nobody can say what it does, it goes.
- Shrink permissions. Tools should get the least access that works — read-only beats full control, one account beats all accounts.
- Rotate and revoke keys properly. Deleting a key is not the same as revoking it. (A major AI tooling company learned that one the hard way this month.)
- Put a human kill-switch on agents. Any AI tool acting on your accounts should have spending limits, scoped permissions, and a person who can pull the plug.
The Bottom Line
You can’t control your vendors’ security. You can absolutely control how many doors into your business exist and how wide each one opens. Fifteen minutes of revoking and scoping today is cheaper than one very bad phone call later.
Stardust Fallout plugs AI into client marketing with the guardrails on — scoped access, human approval, and tools we’d trust with our own accounts. Want the power without the exposure? Book a consultation.
Quick Questions
How do I find what apps are connected to my accounts?
Check the security or privacy settings of your Google, Meta, and Microsoft accounts for “third-party access” or “connected apps” — every major platform keeps a list, and lets you revoke from it.
Should I stop using AI tools?
No — the answer is scoped, supervised use: least-privilege permissions, approval steps for anything public or financial, and regular audits. The risk isn’t AI; it’s unattended AI with unlimited keys.
How often should I do this audit?
Quarterly is a good rhythm for a small business, plus any time a vendor you use announces a breach.
