cyberpolycrisis.com

ConnectWise: Customer service report

Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 15

Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.

Download PDF

Give accurate answers and preserve customer commitments

Use precise language about confirmed information access and ongoing investigation. Do not infer that customer data was exported merely because an application was installed. Conversely, avoid using normal login availability as reassurance about application permissions.

Your immediate priorities

  • Route account-specific information questions to the designated data and incident owners.
  • Record customer concerns without requesting mailbox exports or confidential documents in ordinary chat.

How to work through the decision

Use one approved, dated account of what is known, what is still being checked and when the next update is expected. Avoid diagnosing compromise from a customer’s description alone. Record the minimum information needed to route a case; passwords, payment card details and recovery codes do not belong in ordinary support chat. Track unresolved orders and promised follow-ups separately from general incident questions.

Evidence to ask for

An approved explanation separating service availability, access evidence and unresolved scope.

Does our answer distinguish possible access from verified activity involving this customer?

Work with the next person

Send the business manager a concise list of customer effects, unresolved commitments and recurring questions. Escalate new security evidence through the incident channel, preserving the original report without circulating sensitive material.

Continue with the business manager report for this topic.

A scenario to rehearse

Illustrative exercise, not an observed customer incident: Every user changes their password, but a malicious application credential still authorizes access to business files. The exercise requires the identity team to find and invalidate the separate application path.

What a useful outcome looks like

An approved explanation separating service availability, access evidence and unresolved scope. Keep the decision dated and return to it if new evidence changes the scope.

Sources and further reading

What does this mean for your business?

Use the Cyber Health Review to turn the research into priorities for your own operating model.

Contact help@cyberpolycrisis.com