Historical Scan: Uncover 180 Days of Hidden Identity Threats at Client Onboarding

See What Was Hiding in Not-so-plain Sight

A new client signs the contract. Within hours, you’re already able to show them identity threats that were putting their business at risk before you came into the picture. Not hypothetical risks. Real risks that were lurking in their environment are detected when their Microsoft 365 account connects with CompassOne by Blackpoint.

That’s what a historical scan by Blackpoint delivers: proof of value on day one.

Why Is It So Hard to Prove Security Value During Client Onboarding?

New clients want proof they made the right choice, and they want it fast. But most security tools only start protecting an environment the moment they’re deployed. Anything that happened before that point often stays invisible unless it turns into an incident.

That gap can create a trust problem. The first few weeks of a new engagement are when a client decides whether they made the right decision. Without something concrete to show them, that decision rests on promises and trust instead of proof. The pressure to demonstrate value grows quickly.

According to the 2026 Kaseya State of the MSP Report, the percentage of MSPs that struggle to quickly demonstrate value to clients nearly doubled year over year, rising from 10% to 19%.

What Is a Historical Scan?

A historical scan is an optional look-back feature of Identity Threat Detection and Response (ITDR) that you can run when a new client onboards to Blackpoint’s CompassOne platform. It reviews up to 180 days of Microsoft 365 account activity and identifies the exposures that were already in the client’s environment, before your team ever touched it.

So instead of starting with a blank slate, MSPs gain immediate visibility into suspicious activity, misconfigurations, and identity risks that may have gone unnoticed for months. The result is a clear understanding of what was already present, helping MSPs quickly establish a security baseline and uncover risks that require immediate attention.

What Identity Threats Does a Historical Scan Find?

A historical scan can identify risks like:

• Dormant or unused accounts still carrying excessive privileges
• Sign-ins from unexpected locations or at unusual times
• Mailbox forwarding rules or permissions set up without the client’s knowledge
• Legacy authentication methods still enabled and exposed
• Risky app consent grants and suspicious Teams activity

Blackpoint has found that 20% of organizations had a business email compromise hiding in their environment when they were onboarded.

What’s Included in the Historical Scan Report?

Finding exposures is valuable. Explaining their impact in a way clients understand is what turns those findings into proof of value.

Every historical scan includes a customer-ready report featuring:

• Plain-language analysis generated by Blackpoint’s AI SOC, explaining what happened and why it matters.
• MITRE ATT&CK mappings for every high- and critical-severity finding, connecting exposures to known attacker tactics and techniques.
• A fully formatted report that is automatically generated and downloadable within CompassOne.

The report is ready to share with clients by then next day, if not in hours, giving MSPs a tangible way to demonstrate value from the beginning of the relationship.

How Do MSPs Remediate What the Scan Finds?

A list of past exposures doesn’t do much on its own. The findings come with prioritized remediation guidance, so your team knows exactly what to fix first, why it matters, and how to address it. Onboarding turns into a focused path from discovery to a more secured environment.

If a finding is identified as a critical threat, CompassOne automatically generates a Forensic Report. It documents exactly what happened, giving you and your client a record you can point to for compliance, cyber insurance, or the conversation that follows a critical finding.

What Do MSPs Gain From Running a Historical Scan?

Faster trust with new clients

Historical scans help MSPs demonstrate immediate value by showing clients exactly what was discovered and what risks have now been addressed.

They also help:

• Give sales and account teams an onboarding success story that is evidence-backed.
• Build trust by showing findings and actions taken.
• Establish MSPs as a strategic security advisor earlier in the relationship.
• Reinforce the value of ITDR and the services the MSP provides to their clients.

When clients can see the risks that already exist in their environment, the importance of continuous protection becomes much easier to understand. The historical scan gives MSPs a clear answer when new clients ask, “What have you actually done for us?”

A starting point for ongoing detection and response

The historical scan isn’t a one-time assessment. It’s the beginning of the detection and response workflow that protects every client, every day after onboarding. The exposures found in the historical scan and the threats caught in the weeks that follow run through the same process: detection, analysis, containment, and prioritized remediation guidance, without a gap between where the historical scan ends and ongoing protection begins.

For MSPs, that means one workflow, one security story, and one continuous line of protection to bring to every client, from the first scan onward.

Turn Onboarding Into a Proof Point

See how the Historical Scan & Report helps MSPs uncover hidden exposures, strengthen client relationships, and create opportunities for long-term growth.

Download the Solution Brief →