The Making of a Threat: Shadow Channels

The term shadow channel conjures feelings of fear and paranoia just from its name, but the concept itself is as simple as it is insidious. It's a winner take all creep to conquer the company service by service. A managed company purchases a service which the managed service provider (MSP) doesn't offer, isn't competitive on, or else they're already shopping around for other solutions. Things develop and the other service provider begins to either expand their offerings, or place doubt on the previous MSP's expertise and ability. It ends with a transition, a draw, or an eviction.

The general strategy which makes a shadow channel work (turning a foot in the door into more) can be useful for you, but it's harmful when used against you. Pushing your way into a company's services can provide a way to get a new client, but a competitor can use the same edge against you. A strategy is like a weapon, you want the best one on your side and not in your face.

There are actions you can take to prevent shadow channels from being as large of a threat, but they're all time dependent. A channel grows slowly and turns into a waterfall if you don't check it. To know what to do, you need to understand the nature of a shadow channel, how it operates and succeeds, and the nature of your relationship to know what to do. There are no objectively right answers, but there are wrong ones.

The Birth of a Threat

A shadow channel seemingly grows from a simple transaction or a service. Some of these will be direct, others will be borne from rogue IT at a company. The threat comes when the competitor gets your client's ear and undermines you. This sounds like regular competition, but the difference is in the execution.

There are so many ways to accomplish the same basic task in tech, and each solution has different metrics and benchmarks. How does a non-technical company make sense of and compare 10ms network latency to 3ms data latency? There really aren't "right answers" to technical problems but sales may tell your client otherwise.

While another company offering a service can be harmless, it becomes a liability if it has to be integrated into the environment. You lose control of that asset but you have to keep it secure and functional without limiting it. It takes a more sinister turn when the new vendor begins to complain about the way things are done or starts to creep in.

The salesperson for this other service assured your client it's safe to have administrative access to the network, and your client "isn't stupid". Like social engineering, this competitor is preying on a lack of understanding and human weakness to elevate themselves. Now you have to share the keys to the kingdom with your competitor and support them as they (potentially) undermine you.

It's not something to fear monger over, but it is something to be aware of. If a company is providing a technical solution to your client, are they a threat or are they scratching an itch you don't? If that itch is something you could scratch, why are they moving to someone else?

Fragmentation and Jealousy

A managed service contract is a bit like a relationship; it's more complicated than just an exchange. You need to be aware of perception and the mechanics of your relationship with your client. A person's feelings in the matter don't need to be justified for them to hold an opinion, and you have a lot of people between your business, your clients, and other vendors. A breakdown in communication becomes a breakdown in process. The other companies don't necessarily care if it makes the client less secure and makes your job that much harder, most just want their money.

Shadow channels work because they either impress the company with one service or transaction and grow the relationship, or else they poison the client's opinion of their current MSP. If your client just cares about the best bang for their buck, they may leave even if the other provider has only put their best foot forward to show off. Some providers will try to use gimmicks such as security audits with shaky premises to paint the narrative that the current MSP doesn't know what they're doing. A bad security audit is one thing, but a bad security audit from fraudulent or manipulated data is another.

You can try to say something, but if it makes it this far, you just end up sounding jealous or defensive. This channel often relies on a more emotional angle to try and either generate attraction to the new product, or to sabotage what you already have. To make matters worse, your competitor isn't going to advertise they're working to kick you out. You need to be ahead of the curve without tipping everyone off or run the risk of losing the battle.

Finding the Cure

Shadow channels rely on taking advantage of the business practices of a client or their MSP. They spotlight your weaknesses either by showing that they're "better" (if they actually are, it's just competition at this point) or by sabotage. The evidence might not be right, but that doesn't mean the target knows enough to know better. You can fight this by staying organized, communicating with your client, and trying to find them solutions before solutions find them.

Not every company offering a service is playing a game, but more and more are. The more you can get from a client, the more profitable they are, especially if you have a standardized setup. When a client buys into your workflow, (ideally) both of you benefit. Your competitors operate the same way, just with different parameters. How can you make it harder to switch without being nasty about it?

What is your client doing and why? You need to be aware if you're providing anything which touches on security as it can impact your client's efforts as much as your own. If you offer a competitive service, this makes the whole situation that much more urgent. Why didn't they pick you? Be honest with yourself and try to address if it is worth addressing.

You have to know your client and how they react to plan around how you respond. If they're more emotional, how can you play on that angle without being manipulative? If they're more analytical, how do you show yourself to be the better value even if the numbers don't look as good? There are multiple metrics for value, you just have to know which are worth measuring.

Conclusion

Perception is reality, so if you can control the perception, you get more control of the outcome. If your service costs more, what does it do better that is of value to your clients? If your clients don't like something about a service, how can you either show them why it's useful or change it to make them feel in control of the process?

Understand what makes shadow channels work and shut them down before they can cause damage. If a competitor targets you on your security, how do you disprove them without getting defensive? What are the security implications of rogue IT and why is it a threat to the client? You can't win every battle even if you are competitive, but you can increase the odds if you can shut the threat down soon enough.

Some clients don't even want to know they have IT, others want to hold the reins the whole way. How can you satisfy your client's needs without letting another company get their ear and without making it unprofitable for yourself? While shadow channels aren't necessarily the boogieman they're made out to be, they can and will poach clients if you don't understand them or act on them. Prevent them from getting a hold or else you'll get pushed out.