Why does one managed-service provider outprice any single client's domain administrator as a target?

## The arithmetic Put the two targets side by side and price the operation the way the person running it does. **Target A — one client's domain administrator.** Cost: whatever it takes to get that credential. Return: one estate, of one company's size, with one company's data and one company's ability to pay. **Target B — the provider that administers two hundred such companies.** Cost: whatever it takes to get one engineer identity at the provider. Return: two hundred estates, each of which the identity is *already* entitled to enter. There is no second access problem. The rights were provisioned at onboarding; the intruder does not have to find a path into client 47, because the path is the product. The fixed cost is paid once. The marginal cost of the next victim is a sign-in. Any operation whose cost is dominated by getting the first foothold is transformed by that, which is why this pattern attracts crews with budgets and patience that a mid-sized company would otherwise never face. ## The list is part of the prize The second thing the intruder gains is the target list itself, and it is authoritative. The provider's console enumerates every client, and the relationship record says what role is held in each. Reconnaissance that would normally take weeks per victim is a page in an administrative interface. The intruder can also *sort* it: by client size, by sector, by which tenants hold the interesting data, by which clients are in a jurisdiction they care about. Selection is cheap, so they take the profitable ones and leave the rest. ## The budget mismatch, which is the part candidates miss The usual answer stops at *the provider might have weaker security than us*, which is true but shallow and sometimes false — plenty of providers are better run than their clients. The sharper version is structural rather than a judgment about competence: > A provider's security spending is sized to its **own** revenue. Its security *relevance* is sized to the **aggregate** value of its clients. A forty-person provider with a few million in revenue funds a security programme a forty-person business can afford, while holding privileged access across estates whose combined value is two or three orders of magnitude larger. No amount of diligence closes that gap, because it is not a diligence gap. It is a mismatch between who pays for the defence and who carries the loss. The corollary bites in the other direction too. Your risk from the provider is not only the provider's own hygiene; it is the hygiene of the provider's **weakest client**, because that client is a room the shared engineer identity walks into. ## What this predicts, and what it does not It predicts a change in the *class* of adversary, not merely the probability of an incident. Scarce capability — a purchased exploit, a long patient operation, a bespoke intrusion — is allocated by expected return. Your ninety-person firm does not justify it. The provider that administers two hundred ninety-person firms plainly does. So the honest sentence in an interview is: *by outsourcing administration we have not only inherited a partner's identity hygiene, we have joined a target whose value justifies attention we would never attract alone.* It does not predict that the provider is negligent, that in-housing is safer (an in-house team of one is not obviously better), or that the aggregation is avoidable. Aggregation is the entire economic point of managed services; the same multiplier that makes the provider a target is what makes competent administration affordable at all. ## Talking about it without hand-waving Two things make the argument concrete rather than rhetorical. First, name the multiplier as a number you can actually ask for: how many tenants does this provider administer, and does one engineer identity reach all of them or is the estate partitioned? Second, name what would blunt it: per-client credentials rather than one identity spanning the book, privilege that exists only during an approved engagement, and the smallest role that does the job. Those attack the multiplier directly — they turn *one identity, two hundred estates* back into two hundred separate access problems, which is exactly the economics the intruder came here to escape.