October is Cybersecurity Awareness Month, which means MSPs everywhere are talking about security, risk, protection, and recovery.
Cybersecurity has become such a huge part of what MSPs do. It’s no longer just making sure antivirus is installed and hoping for the best. Today, we’re responsible for protecting devices, applications, networks, data, and users across every environment we manage.
Last week, I was at an event in Michigan with Tom Lawrence from Huntress and Alex Farling from Empath. Tom walked us through the Cyber Defense Matrix (Created by Sounil Yu). If you’ve been in the MSP space for a while, you’ve probably seen it before.
It’s a simple framework that maps five asset types:
- Devices
- Applications
- Networks
- Data
- Users
Against five security functions:
- Identify
- Protect
- Detect
- Respond
- Recover
What I love about frameworks like this is that they help you quickly visualize where your tools fit and where you might have gaps.
As we worked through the exercise, something clicked for me.
I don’t think I’ve ever really thought about where ImmyBot sits within a cybersecurity framework.
The Left Side of Boom
You’ve probably heard people talk about “left of boom” and “right of boom.”
The boom is the security incident.
Everything before the incident happens is left of boom:
- Identify
- Protect
Everything after the incident is right of boom:
- Detect
- Respond
- Recover
A lot of cybersecurity conversations understandably focus on the right side of boom. Threat detection, SOC services, incident response, recovery plans. Those are all critical.
But the reality is that every vulnerability patched, every device brought back into compliance, and every outdated application updated is reducing the chances that boom happens in the first place.
That’s where our conversation got interesting.
As Tom mapped different tools into the framework, ImmyBot showed up in several places.
Identify Devices
Immy Drift Check helps identify devices that have drifted away from your standards or fallen out of compliance.
You can’t fix what you don’t know about.
Identify Applications
App Checks help uncover missing, unmanaged, or outdated software throughout an environment.
Again, identification comes first.
Before you can protect something, you need visibility into it.
Protect Devices
ImmyBot’s patching capabilities help keep operating systems and supported software up to date, closing known vulnerabilities before they can become bigger problems.
Protect Applications
Application Updates help ensure the software users rely on every day stays current and protected as well.
When we talk about cybersecurity, we often think about the operating system, but some of the biggest risks come from neglected applications that haven’t been updated in months or years.
But ImmyBot Isn’t Just Left of Boom
Something else stood out during the discussion.
While ImmyBot clearly plays a role in Identify and Protect, it also shows up in Recover.
If a machine needs to be rebuilt after an incident, ImmyBot becomes part of getting that device back into service.
The ability to re-onboard a computer, redeploy applications, and reapply standards through automation makes recovery significantly easier than starting from scratch.
That’s not usually the first thing people think about when they think of ImmyBot, but it’s an important part of the story.
A Different Way to Think About Security
One of my biggest takeaways from that session was realizing that cybersecurity isn’t only about detecting bad things.
It’s also about making sure good things consistently happen.
Devices stay patched.
Applications stay updated.
Standards stay enforced (desired state).
Configuration drift gets identified and corrected.
When those things happen consistently, you’re strengthening your security posture long before an alert ever fires.
Seeing ImmyBot mapped onto the Cyber Defense Matrix was honestly pretty cool because it reinforced something I’ve always known but maybe hadn’t articulated this way before: ImmyBot plays a meaningful role in helping MSPs identify risks, protect devices and applications, and even recover more quickly when something does go wrong.
And that’s an important part of the cybersecurity story too.
Where Do You Place ImmyBot?
This conversation started with a matrix on a screen in Michigan, but I’m curious how other MSPs think about it.
Where does ImmyBot fit into your cybersecurity strategy?
Are there places within the Identify, Protect, Detect, Respond, or Recover framework where you’ve found unexpected value?
If something comes to mind, click my name in the signature and send me a message on LinkedIn, I’d love to know!
Written by: Anna Lang, Head of Partner Success at ImmyBot
Published on: October 22, 2026
