Signal // Noise #021 - 3rd Party Risk with Eric Tilds

MSPs are absorbing liability they didn't agree to take on — because their vendor contracts let it happen. Here's what to do about it.EPISODE OVERVIEWSignal // Noise #021 brings in a special guest: Eric Tilds, an attorney whose practice represents approximately 500 MSPs and MSSPs worldwide. With third-party software compromises happening weekly, Bob Miller and Chris Loehr sit down with Eric to break down what MSP vendor contracts actually say, why that language is costing service providers, and what a properly negotiated agreement looks like. This is not a legal theory episode. It's a practical session on what needs to change in your document stack right now.WHAT WE COVER- Why fewer than 5 of Eric's 500 MSP clients have their vendor contracts reviewed before signing- How standard vendor liability caps (typically one year of fees paid) leave MSPs exposed when a third-party compromise causes real damage- The three contract clauses that matter most: required security controls, mandatory breach notification, and indemnification- How the IDEsaster supply chain attack pattern connects directly to current third-party compromise risk- The GitHub repository breach carried out by Team PCP — and what it cost downstream- Why "they don't allow contract negotiation" is almost always false, and how to push back- What a vendor management program looks like for a 10-person MSP versus an enterprise shopKEY TAKEAWAYS- Your customer agreement and your vendor agreement need to work together — a gap in either one becomes your liability- If you haven't negotiated security control obligations into your vendor contracts, you likely cannot recover your actual losses- Documenting your vendor vetting process (including SOC reports) is as important as the vetting itself- Small MSPs are not exempt from this exposure — limiting your tool stack is a practical starting point- The community-wide answer is a unified front: MSPs collectively pushing vendors toward responsible contract languageABOUT THE SHOWSignal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Each incident episode runs the same event through five leading AI analysis tools (Claude, ChatGPT, Perplexity, Grok, and Gemini) and compares results live on air. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.RESOURCES- Cyber Constitution (free download): https://cyberconstitution.org- IRGame: https://irgame.aiTAGSthird-party risk, MSP security, supply chain attack, vendor contracts, cybersecurity law, MSP liability, third-party compromise, Team PCP, GitHub breach, IDEsaster, vendor management, cybersecurity podcast, Chris Loehr, Bob Miller, Eric Tilds, Signal to Noise podcast, MSSP, infosec, IT security, contract negotiation