ConnectWise is moving towards phased service re-enrolment, but MSPs still need separate evidence that application identities did not establish persistence or access inside each managed Microsoft 365 tenant.
What changed
ConnectWise’s Friday update moved the incident from broad suspension towards phased re-enrolment, while Microsoft quantified a wider Storm-0940 operation using the ARTEX agentic penetration-testing framework. The immediate CISO decision is not simply when to reconnect.
Public record through 2026-10-26. Source references count citations across published briefings, including repeated sources. Explore the record and its limits →
What We Publish / What We Sell
D
Free · Public
The Daily
Five evidence-backed selections for security leaders, every weekday.
Security.io scores each dimension from 0–100. Exposure reflects cross-tenant reach and privileged placement; urgency reflects evidence-retention and containment windows; business consequence reflects backup, restore and managed-customer dependencies. Exposure: 92. Urgency: 96. Business consequence: 91. Focus the chart and use the up and down arrow keys for detail. Source: Security.io editorial assessment based on the selected primary disclosure, technical evidence and reporting.