“Instead of just saying, ‘Here’s a vulnerability,’ we’re saying, ‘Here’s the policy to deploy, here’s what changed, and here’s the next set of CIS-aligned recommendations you should work on. That feedback loop is what really differentiates us,” says CloudCapsule CEO Nick Ross.
When it comes to cybersecurity, MSPs have been chasing alerts, sorting through breach fallout and piling on more tools to solve the last problem. But CloudCapsule’s CEO said it’s time for a different playbook.
The Denver-based startup is more than just a maker of another Microsoft 365 security tool. CEO Nick Ross said CloudCapsule is giving MSPs a way to standardize security, automate fixes and turn cybersecurity from a reactive burden into a proactive, repeatable service.
He said the industry’s biggest challenge isn’t a lack of security tools but a lack of time, consistency and scalability.
“Partners are trying to secure hundreds or even thousands of Microsoft 365 tenants while Microsoft itself changes constantly,” Ross told CRN. “They’re trying to follow frameworks like CIS and NIST, grow their businesses and still have meaningful security conversations with customers. That’s an incredibly difficult balancing act.”
CloudCapsule’s technology attempts to reduce that by automating Microsoft 365 security assessments, collecting compliance evidence and translating technical findings into reports that MSPs can use directly with customers. According to Ross, the platform has mapped more than 250 Microsoft security data points while allowing partners to scan environments in about a minute.
And the company recently expanded beyond assessments with CloudCapsule Manage, a new product tier that lets MSPs find and fix Microsoft 365 security gaps across multiple customer environments, push policies at scale and document the work for compliance and cyber insurance.
Ross argued that the larger opportunity extends beyond Microsoft security. As organizations rapidly adopt generative AI tools and AI agents, MSPs are increasingly being asked to advise customers on AI readiness, governance and data protection.
CloudCapsule is responding by building AI readiness assessments, shadow AI investigations and governance capabilities to help MSPs understand where sensitive data lives before AI systems gain access to it.
Nearly two years after launch, Ross said the company has grown to more than 300 partners across 42 countries and is preparing for a Series A funding round.
David Lewian, CEO of Greenwood Village, Colo.-based Go West IT, said CloudCapsule understands the importance of clarity in compliance tools.
“We’ve used a lot of compliance platforms before, and the difficulty is getting our clients to understand, number one, why they should,” Lewian told CRN. “The language that’s used on the CloudCapsule platform to help people understand why each control is important is critical.”
CRN spoke further with Ross about why MSP security needs to become proactive, where Microsoft 365 customers remain most exposed and why AI governance could become the next major managed service.
What are your partners’ biggest pain points, and how is CloudCapsule addressing them?
Today there’s a huge gap in the amount of time it takes MSPs to run security assessments across Microsoft 365 environments and then scale that consistently across every customer while still trying to align with frameworks like CIS or NIST.
The real pain point is standardization. Partners are asking, “How do I make every customer secure? What does best practice even look like today when Microsoft changes constantly? How do I do this across hundreds or thousands of tenants while I’m also trying to grow my business?”
That’s what we’re solving. We want MSPs to spend less time figuring out Microsoft and more time actually improving their customers’ security.
You describe CloudCapsule as more than a security tool. What fundamentally needs to change in how MSPs approach cybersecurity?
The industry has been reactive for a long time. MSPs are incredibly good at responding after something happens—post-breach investigations, incident response, cleaning things up—but that’s not where we think the future is. When I was at an MSP we tracked a metric called reactive hours per endpoint per month. It’s basically a way of measuring how much time you’re spending reacting instead of preventing. When that number goes up, profitability goes down because your engineers are drowning in alerts.
We’ve also created this massive security tool stack across the industry. Every tool generates alerts. Every tool creates another dashboard. Eventually your technicians spend more time responding to noise than preventing actual problems. Our philosophy is to help MSPs shift into a prevention mindset. Yes, we provide software that scales Microsoft security, but we’re also trying to educate partners on building proactive security practices instead of constantly living in response mode.
Why do you think the industry has struggled to bridge the gap between identifying risk and actually fixing it?
Resources are the biggest constraint. You’ve got alerts coming from every direction. Microsoft changes constantly. There are multiple admin portals for a single tenant, and then you’re expected to manage hundreds or even over a thousand customers. There’s also a knowledge problem. It’s one thing to know something is wrong. It’s another thing to know what secure actually looks like beyond a checklist. That’s why we align to frameworks like CIS and NIST and automate evidence collection. Instead of spending hours gathering technical information, partners can focus on having proactive security conversations with customers.
What we’ve found is that partners start building entire security programs around our platform because the reporting is already there. They don’t have to translate Microsoft’s terminology or explain complicated security language. They can spend their time helping customers continuously improve instead of constantly reacting.
What Microsoft 365 security gaps surprise MSPs the most?
People are usually shocked by how much they find in the first minute. We can scan a tenant in about 60 seconds, and we routinely see Microsoft Secure Scores sitting around 40 to 45 across our customer base. That’s incredibly low. That tells us there are still major gaps in identity protection, endpoint security, email security and governance even when organizations already have third-party security tools.
The other thing we see constantly is governance issues: stale user accounts, old devices, people who were never properly offboarded. That creates attack surface that most organizations don’t even realize exists. When we onboard a partner, they almost always have that moment where they say, “I had no idea any of this was happening.” That’s really the beginning of continuous improvement.
How do you think cyber insurance requirements are changing expectations for MSPs?
Cyber insurance has become much more evidence-based. We actually built cyber insurance templates into our platform because carriers increasingly want proof instead of simply checking boxes.
We’re seeing major providers ask for Microsoft Secure Score. Whether they fully know how they’ll use that information yet is another question, but they’re asking for it.
The bigger issue is claims. We’ve seen situations where organizations said they had MFA enabled, but after an investigation it turned out they didn’t. If what was attested to isn’t actually true, insurers may have grounds not to pay a claim. That makes accurate evidence incredibly important.
What differentiates CloudCapsule Manage from other security platforms?
Visibility by itself isn’t enough anymore. Manage lets partners see security gaps, but it also lets them push policies directly into customer environments. What our partners consistently tell us is that the context matters. We explain why something is risky, how to fix it, how it affects end users and what should happen next.
Instead of just saying, “Here’s a vulnerability,” we’re saying, “Here’s the policy to deploy, here’s what changed, and here’s the next set of CIS-aligned recommendations you should work on.”
That feedback loop is what really differentiates us.
How are you approaching AI governance?
We’re seeing organizations enable Copilot or other AI tools and suddenly employees discover payroll files, termination letters or sensitive documents they were never supposed to see. AI doesn’t create those permission problems, it exposes them.
Then you add AI agents into the mix, where users can create their own agents and connect data sources. If your data governance wasn’t great before, AI accelerates that problem dramatically. Our focus starts with AI readiness. Where is your sensitive data? Who has access? What’s overshared? What governance exists?
Long term, MSPs are going to need to become advisors around AI governance because SMBs generally don’t have data governance officers. They don’t have teams dedicated to this. We want to give MSPs the tools to scale that service.
So where is CloudCapsule investing next?
A big focus is investigations. We’re building investigations that combine alerts, notifications and guided workflows. Instead of overwhelming partners with raw security events, we want to give them meaningful investigations they can act on.
We’re also releasing shadow AI investigations so MSPs can identify what AI applications are actually being used inside customer environments. Another big area is AI readiness and governance. We think there’s a real opportunity to provide governance capabilities tailored specifically for the SMB market.
How do customer feedback and partners influence your roadmap?
Our roadmap is actually public inside the product. Partners can see what we’re building, vote on features and send feedback directly to our development team.
Manage was the number one feature request since we launched, and it’s changed the conversations we’re having. Right now, almost every discussion comes back to AI readiness. Partners are asking us how they help customers adopt AI securely, how they manage data governance and how they automate response actions. The advantage we have is that almost everyone on our team comes from the MSP industry. We’re not a software company trying to guess what MSPs need…we lived those challenges ourselves.
Finally, what’s your message to MSPs considering CloudCapsule?
If you’re looking for a way to assess Microsoft environments at scale, get value almost immediately and help customers improve security continuously, that’s exactly what we’re built for.
But I also think we’re more than software. We want to be an extension of their team. We want to help them build stronger security practices, grow their businesses and prepare for where security is headed next.
