# How can MSPs secure clients against holiday threats?

> Attackers time ransomware and phishing for holidays, when SOC staffing drops. A pre-break checklist for MSPs: DMARC, MFA, tested backups, on-call plans.

MSPs secure clients against holiday threats by doing the risky work *before* the break: enforce multi-factor authentication, confirm backups actually restore, patch internet-facing systems, move email authentication to enforcement, and publish an on-call plan clients know how to use. This isn't paranoia, attackers deliberately time ransomware and phishing for holidays and weekends because defenders run skeleton crews. The FBI and CISA documented the pattern in a joint advisory, and 2025 survey data shows it still holds. This guide covers what to lock down, in what order, and how to keep coverage honest while half your team is out of office.

![New Year cybersecurity for MSPs](/images/cms/68dff95c3b013a4bf16fab6d_img-tm0fdoihzh2u2n4yvvesm0ri.png)

## Why do cyberattacks spike during the holidays?

Because attackers get a longer head start. The joint FBI/CISA advisory [Ransomware Awareness for Holidays and Weekends](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-243a) spelled it out: criminals see holiday weekends as attractive windows because network defenders and IT support operate at limited capacity, giving intruders more time to find data, spread, and encrypt before anyone notices. The advisory cites real cases: the DarkSide ransomware attack on a US energy-sector company launched into Mother's Day weekend 2021, and the REvil attack on an IT-sector company over the July 4th weekend that year.

That July 4th case should worry MSPs most, because MSPs were the delivery mechanism. On Friday, July 2, 2021, REvil exploited Kaseya's VSA remote-management platform and pushed ransomware through roughly 60 MSPs to as many as 1,500 downstream businesses, timed precisely for the long weekend. CISA and the FBI published [joint guidance for MSPs on July 4 itself](https://www.cisa.gov/news-events/alerts/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa-supply-chain-ransomware-attack).

The pattern hasn't aged out. Semperis' [2025 Ransomware Holiday Risk Report](https://www.semperis.com/press-release/semperis-study-reveals-majority-ransomware-attacks-continue-during-holidays-weekends/), surveying organizations across ten countries, found 52% were targeted on holidays or weekends. It also explains why the tactic keeps working: 78% of companies cut security operations center staffing by half or more during those periods, and 6% cut it entirely.

## What holiday threats should MSPs expect?

Email carries most of the risk. In the FBI's [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), phishing and spoofing were the most-reported crime type at 191,561 complaints, and business email compromise (BEC) cost victims more than $3 billion. Total reported losses passed $20.8 billion, up 26% from 2024. Seasonal fraud stacks on top: the FBI's [holiday scams guidance](https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/holiday-scams) notes that non-delivery and non-payment scams cost victims more than $503 million in 2025, with credit card fraud adding another $282 million.

| Threat | Why it works during holidays | First line of defense |
|---|---|---|
| Phishing (fake delivery, invoice, e-card lures) | People expect shipping and order emails; staff are rushed | Email filtering plus trained, skeptical users |
| Exact-domain spoofing | Clients trust mail that "comes from" their own vendors | [DMARC](/learning/what-is-dmarc) at an enforcement policy |
| BEC and gift-card/wire fraud | Approvers are away, so "urgent" requests feel plausible | Out-of-band payment verification rules |
| Ransomware | Detection and response are delayed by thin staffing | Patched edge devices, EDR coverage, tested backups |
| RMM and vendor compromise | One tool reaches every client, and fewer eyes are watching | MFA on vendor portals, least-privilege access |

Note the reported ransomware number in the IC3 report (3,611 complaints and about $32 million) counts only direct reported losses and excludes downtime and remediation, so treat it as a floor, not the real cost.

## How should MSPs lock down client email before the break?

Work through every client domain, not just the noisy ones:

1. **Verify SPF, DKIM, and DMARC exist and pass.** A free [DMARC checker](/tools/dmarc) shows each domain's state in seconds.
2. **Move DMARC toward enforcement.** A `p=none` policy only observes; spoofed mail still lands. Step domains to `p=quarantine`, then `p=reject` once reports show legitimate senders aligned, here's [how quarantine and reject differ](/resources-post/dmarc-reject-vs-quarantine-whats-the-difference). A finished record looks like:

```
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com
```

3. **Meet the mailbox providers' rules.** [Google's sender guidelines](https://support.google.com/a/answer/81126) require anyone sending 5,000+ messages a day to Gmail to publish DMARC (even `p=none`), align the From: domain with SPF or DKIM, support one-click unsubscribe on marketing mail, and keep spam rates under 0.3%. [Microsoft applies similar rules](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730) to high-volume senders reaching Outlook.com, Hotmail, and Live addresses: since May 5, 2025, non-compliant mail can be rejected outright with a `550 5.7.515` error. A client whose January invoices bounce is a January churn risk.
4. **Keep reading DMARC reports through the break.** New failure sources appearing between Christmas and New Year deserve a look, not a snooze.

Be honest with clients about what this buys. DMARC stops attackers from sending mail as the client's exact domain. It does nothing against [lookalike domains](/learning/how-can-i-take-down-lookalike-domains) (`client-invoices.com` instead of `client.com`) or [BEC sent from a real, compromised mailbox](/learning/what-is-the-complete-guide-to-business-email-compromise-bec-attacks-in-2025). Those need layered controls: filtering, payment verification procedures, and user awareness. Doing this across dozens of client domains by hand is the painful part; it's the specific problem Palisade automates for MSPs, with per-client monitoring and guided enforcement.

## Which technical controls matter most when staffing is thin?

The FBI/CISA holiday advisory's mitigation list maps cleanly onto MSP practice. Before any extended break:

1. **Enforce MFA on admin accounts, remote access, and VPNs.** Pick [MFA types that resist fatigue attacks](/learning/mfatypesformsp), number matching or hardware keys over push approvals.
2. **Test a restore, not just a backup job.** The advisory's core ransomware mitigation is offline backups; a backup that has never been restored is a hope, not a control.
3. **Patch internet-facing systems first**: VPN appliances, firewalls, mail gateways, and above all your own RMM.
4. **Trim access.** Review vendor and RMM permissions, remove dormant admin accounts, and use time-bound credentials where the tooling allows it.
5. **Name the humans.** The advisory specifically tells organizations to identify which security staff are reachable on weekends and holidays. Put names and phone numbers in the runbook.
6. **Run a phishing refresher in early December.** [Regular simulations](/learning/why-run-regular-phishing-simulations) with holiday-themed lures (delivery notices, bonus announcements) prime users for exactly what's coming.

## How should MSPs plan incident response over the holidays?

Assume something fires while your senior engineer is on a plane:

- **Publish one escalation path.** Clients get a single phone number or address that reaches a real on-call human, with a defined response window.
- **Pre-write the communications.** Containment notices and client updates drafted in advance save an hour when it matters.
- **Keep playbooks reachable offline.** If ransomware encrypts the documentation server, a printed or offline copy of the [first-24-hours plan](/learning/msps-first-24-hours-after-data-breach) still works.
- **Tabletop it.** A 45-minute walkthrough ("Client X reports encrypted files on December 27, go") surfaces gaps far cheaper than the real thing.
- **Freeze changes.** No DMARC policy jumps, mail migrations, or firewall rewrites in the final week before a holiday. Ship them earlier or ship them after.

## What should MSPs tell clients before the break?

Send a one-page brief in early December: what you monitor over the holidays, what's frozen, how to reach on-call, and the three behaviors that matter most: verify payment changes by phone, be suspicious of delivery and gift-card emails, and report anything odd immediately rather than after the holidays. Pair it with a short reminder that shopping season scams target their employees personally, not just the business. Clients don't remember quiet holidays; they remember whether you were reachable during a loud one.

## Common issues

**DMARC has sat at p=none for a year.** Visibility mode was the plan, then nobody moved it. Review the reports, fix the legitimate senders that fail alignment, and schedule the step to quarantine for after the holidays: with a date, an owner, and a rollback plan.

**Backups are green but restores fail.** Jobs succeeding is not recoverability. Common causes: backups reachable (and encryptable) from production, retention too short, or application-level restores never validated. Do one full test restore per critical client before the break.

**MFA is "deployed" but bypassable.** Legacy protocols like IMAP/POP with basic auth, break-glass accounts excluded from policy, and MFA-exempt "service" mailboxes are the standard holes. Audit conditional-access exclusions before the holidays.

**Alerting was tuned for a full team.** An alert volume that a five-person team triages fine will bury a lone on-call tech. Suppress the informational noise and route only actionable, high-severity alerts to the holiday rotation.

**The RMM itself is the exposure.** Kaseya proved the blast radius. Restrict RMM admin logins by IP or device where possible, enforce MFA with no exceptions, and subscribe to your vendor's security advisories so a pre-holiday patch never sits unapplied.

## Frequently asked questions

### Should we change DMARC policies right before the holidays?

No. Moving a domain to `p=quarantine` or `p=reject` can affect legitimate mail flow if some sender wasn't aligned, and the holidays are the worst time to debug delivery. Make enforcement moves weeks before the break or hold them until after, but don't let that become an excuse for the domain that has sat at `p=none` all year.

### Does DMARC stop all holiday phishing?

No. DMARC prevents exact-domain spoofing: mail forged to appear from a domain you control. It does not stop lookalike domains, phishing from free webmail accounts, or messages from a genuinely compromised mailbox. It's one necessary layer alongside filtering, MFA, and user training, not a complete phishing solution.

### Do small clients really need holiday preparation?

Yes. Phishing and spoofing were the most-reported internet crime in the FBI's 2025 data at 191,561 complaints, and much of it is automated, attackers harvest whatever domains and mailboxes respond, regardless of company size. Small clients also tend to have the least coverage over breaks, which is exactly the gap the attacks are timed for.

### We can't staff a 24/7 SOC. What's the minimum?

The FBI/CISA advisory doesn't demand round-the-clock staffing: it asks organizations to identify, in advance, which security-capable people are reachable during holidays and weekends. For an MSP that means a named on-call rotation, high-severity alerts routed to a phone, documented escalation to your EDR/MDR vendor, and a client-facing response window you can actually honor.

### When should holiday preparation start?

Work backward from your change freeze. Restore tests, patching, MFA audits, and DMARC enforcement moves should be finished before mid-December, which in practice means starting in November, around the same time attackers begin ramping up their holiday shopping lures.

## Related reading

- [How can MSPs keep systems secure over the holidays?](/learning/how-can-msps-secure-systems-holidays)
- [How can small businesses dodge cyber traps during Black Friday sales?](/learning/threats)