Dirty Frag: Understanding the Latest Linux Kernel Security Threat

By: Chris Bentkowski

Recently, security researchers identified two significant vulnerabilities, collectively known as Dirty Frag, affecting the Linux kernel. If you manage Linux servers or Kubernetes clusters, understanding these flaws is essential for keeping your environment secure.

What is “Dirty Frag”?

Dirty Frag (specifically CVE-2026-43284 and CVE-2026-43500) is a class of local privilege escalation vulnerabilities. In simple terms, it allows a low-privileged user or a malicious container to “break out” and gain full administrative (root) control over the host machine. The issue stems from how the Linux kernel handles certain types of network data, specifically “splice-backed packet fragments”. Under the right conditions, the kernel performs unsafe operations on memory that it should treat as private, leading to memory corruption.

Why it Matters for Kubernetes

In a Kubernetes environment, all containers on a node share the same underlying host kernel.

- Shared Risk: Because this is a kernel-level issue, standard pod isolation isn’t enough.

- The Breakout: If an attacker compromises a single pod, they could potentially use Dirty Frag to take over the entire node.

- High-Risk Scenarios: Clusters are at higher risk if they host untrusted workloads, are internet-facing, or are multi-tenant.

Is Your System Vulnerable?

The vulnerabilities affect a wide range of Linux kernel versions, dating as far back as 4.11 (released in 2017).

Affected Kernel Ranges:

- 4.11 up to 5.10.254

- 5.12 up to 5.15.204

- 5.16 up to 6.1.170

- 6.2 up to 6.6.137

- 6.7 up to 6.12.86

- 6.13 up to 6.18.27

- 7.0.0 up to 7.0.4

Note: Always check with your specific Linux distribution (Ubuntu, RHEL, Azure Linux) for their specific “fixed” version numbers, as many vendors backport security fixes.

How To Protect Your Environment

Security experts recommend a three-step “order of operations” to handle Dirty Frag:

- The Permanent Fix: Patching – The only permanent solution is to update your Linux kernel to a fixed version.   

For Standalone Servers: Apply vendor updates and reboot.

For Kubernetes/AKS: Perform a node image upgrade to ensure every worker node is running a patched VHD/image.

- Temporary Shielding: Module Blocking – If you cannot patch immediately, you can temporarily reduce your risk by blocking the specific kernel modules associated with the vulnerable paths: esp4, esp6, and rxrpc. 

The Catch: This only works if these features are compiled as loadable modules. If they are built directly into the kernel, this mitigation will not work.

Automation: Many teams use a DaemonSet in Kubernetes to automatically apply these module blocks across every node in a cluster.

- Defense-in-Depth: While waiting for patches, you can shrink your “attack surface” by: 

Minimizing the use of privileged containers.

Restricting pods from using hostNetwork or hostPID unless absolutely necessary.

Enforcing strict Pod Security Admissions.

Summary Checklist

- Identify if your nodes are running vulnerable kernel versions.

- Prioritize patching or reimaging nodes to a fixed baseline.

- Validate that updates were applied to existing nodes, not just new ones.

- Monitor for the presence of the esp4, esp6, and rxrpc modules if you aren’t using them.

How CloudFit Can Help

Keeping Linux environments secure requires more than simply applying patches. Organizations need visibility into vulnerable systems, a clear remediation plan, and confidence that updates are being deployed consistently across servers, clusters, and cloud environments.

CloudFit helps organizations identify security risks, manage vulnerability remediation, secure Kubernetes and cloud workloads, and maintain a strong cybersecurity posture through managed security and infrastructure services.

If you’re unsure whether your Linux servers, AKS environment, or Kubernetes clusters are affected by Dirty Frag, our team can help assess your exposure, validate your patch status, and implement security best practices to reduce risk.

Contact CloudFit today to learn how we can help strengthen your infrastructure against emerging threats and keep your environment secure.

References:

Comments are closed

The Mission Is Bigger Than CMMC: CloudFit’s Perspective on the Recent CMMC Phase II Pause

The recent Department of War announcement has understandably created questions across the Defense Industrial Base. While the implementation timeline for portions of CMMC may be changing, the mission itself has not.

The reality is that more than 220,000 organizations across the DIB are entrusted with protecting CUI and supporting our nation’s security. That responsibility has not been paused. Cyber threats have not been paused. The obligation to safeguard sensitive information under DFARS and NIST requirements has not been paused.

If anything, this moment presents an opportunity to ask a more important question.

Rather than focusing solely on compliance deadlines or certification milestones, we should be asking how we make meaningful cybersecurity achievable for every organization supporting our warfighters. A compliance requirement alone will never secure the DIB. True security comes from making secure environments, managed services, and proven cybersecurity outcomes accessible, repeatable, and affordable enough that organizations of every size can adopt them.

For too long, many companies have been forced to choose between expensive custom implementations, delaying security investments, or hoping they can achieve compliance on their own. That model does not scale to the size of the DIB, nor does it strengthen our national security posture.

At CloudFit, we believe there is a better path.

Our vision has never been limited to helping organizations pass an assessment. Assessments are important, but they are a milestone… not the mission. Our mission is to help mission-critical organizations build secure, resilient environments that protect sensitive information every day while positioning them for whatever compliance requirements exist tomorrow.

easyCMMC represents one part of that vision. It demonstrates that organizations do not have to sacrifice security for affordability, nor should compliance require months of uncertainty, excessive consulting costs, or unnecessary operational burden. By delivering standardized, managed cybersecurity outcomes, we believe organizations can achieve stronger security while dramatically reducing the barriers that have historically prevented widespread adoption.

This strategic pause provides an opportunity for industry and government to continue an important conversation. Not simply about when organizations should be certified, but about how we collectively secure the DIB for the long term.

CloudFit remains more optimistic than ever about that future.

We believe protecting our nation’s defense supply chain requires scalable, high-value, low-cost cybersecurity solutions that organizations can actually implement, not just audit against. We remain committed to helping our customers protect CUI, strengthen their cybersecurity posture, and prepare for whatever direction the Department of War ultimately takes.

The objective has always been bigger than CMMC.

The objective is securing the DIB.

Comments are closed

How to Understand Your DoW Contract’s CMMC Requirements

Understanding your cybersecurity obligations starts with your contract, not the headlines.

The recent Department of War announcement pausing portions of the CMMC rollout left many contractors asking the same question:

“What should we do now?”

For some, the instinct has been to wait for more guidance. Others have assumed cybersecurity requirements have been put on hold altogether.

The reality is much simpler.

Now is the perfect time to take a closer look at your contracts and understand what they actually require.

At CloudFit, one of the biggest misconceptions we see isn’t that organizations misunderstand CMMC. It’s that many don’t fully understand the cybersecurity requirements already written into the contracts they’re performing today.

Before worrying about assessments, certifications, or technology, start with the document that defines your obligations.

Your Contract Determines Your Requirements

Cybersecurity doesn’t begin with an IT project.

It begins with your contract.

Every DIB contractor’s environment is different because every contract is different.

Some organizations only need to securely receive, review, and transmit Controlled Unclassified Information (CUI). Others may be required to process engineering drawings, CAD files, software code, or other sensitive data throughout their daily operations.

The important thing is understanding which situation applies to your organization.

We’ve worked with companies that initially believed every employee, every application, and every workflow needed to fall inside a compliant environment. After reviewing how they actually handled CUI, we discovered their required scope was much smaller.

On the other hand, we’ve also worked with organizations whose contracts required specialized engineering or development workflows that absolutely did need to be included.

The difference wasn’t the technology.

It was the contract.

Start by Looking for DFARS Requirements

One of the first things to identify is whether your contract contains Defense Federal Acquisition Regulation Supplement (DFARS) cybersecurity requirements, particularly clauses like DFARS 252.204-7012.

These clauses establish expectations for protecting CUI shared with contractors.

If your contract includes these requirements, your organization should understand how CUI is received, stored, processed, and transmitted throughout your business.

That doesn’t automatically mean every system you own needs to become part of your compliant environment.

It means you need to understand where CUI actually exists.

Don’t Overlook Flowdown Requirements

Even if you don’t contract directly with the Department of War, cybersecurity requirements may still apply.

Prime contractors frequently “flow down” security requirements to subcontractors performing work under the contract.

We’ve spoken with many organizations that assumed compliance requirements didn’t apply to them because they weren’t working directly with the government.

In reality, those obligations were already included in agreements with their prime contractor.

If you’re supporting a prime, don’t stop reading after the statement of work. Make sure you understand any cybersecurity requirements that have been flowed down to your organization.

What Actually Needs Protection?

One of the most common conversations we have sounds something like this:

“We need engineering software.”

“We need CAD.”

“We need specialized development tools.”

Sometimes that’s true.

Sometimes it isn’t.

The first question shouldn’t be, “What software do we need inside our compliant environment?”

It should be, “What types of CUI is our contract going to include?”

For many organizations, the answer is surprisingly straightforward.

They need a secure place to receive contract documents, communicate with customers, review technical information, and send responses back to the government or a prime contractor.

Others genuinely need additional applications because they’re actively creating or modifying CUI as part of their work.

Understanding that distinction is one of the most important parts of correctly scoping your environment.

Ask These Five Questions

Before making technology decisions, ask yourself:

- Where do we receive CUI?

- Who needs access to it?

- Where is it stored today?

- Do we modify or create CUI as part of our work?

- What does our contract actually require us to protect?

These questions often uncover that an organization’s cybersecurity needs are very different from what they initially assumed.

The CMMC Pause Doesn’t Change Your Starting Point

While portions of the CMMC rollout have been delayed, your contract remains the foundation for understanding your obligations.

If your contract requires you to protect CUI, that responsibility hasn’t changed.

The current pause simply gives contractors an opportunity to better understand their requirements before making long-term decisions about assessments or certification.

Organizations that use this time to properly scope their environments, review their contracts, and understand how they handle CUI will be in a much stronger position regardless of how future CMMC implementation unfolds.

Start With Understanding, Not Assumptions

At CloudFit, we don’t begin conversations by recommending technology. We begin by asking questions.

What does your contract require?

How do you store, process, and transmit CUI today?

Who needs access?

What workflows actually need to be protected?

Those answers drive everything else.

Because the best cybersecurity solution isn’t necessarily the largest or most complex one. It’s the one that’s appropriately scoped for the work your organization actually performs.

Need help understanding your contract requirements or determining the right environment for your organization? Our team is here to help. Learn how easyCMMC can simplify your path to secure CUI handling.

Comments are closed

5 Lessons Learned Supporting Organizations Through Level 2 CMMC Assessments

Key Takeaways

- Successful CMMC Level 2 assessments depend more on evidence maturity and operational consistency than on security tooling alone.

- Clearly defined shared responsibility between the customer, cloud provider, and service partners is critical to avoiding assessment risk.

- Incident response capabilities must be tested and supported by execution evidence, not just documented in a plan.

- Identity and access management controls receive significant scrutiny and require proof of ongoing enforcement.

- Organizations that standardize processes, governance, and control implementation are better positioned for smooth, defensible assessments.

As organizations across the Defense Industrial Base prepare for Cybersecurity Maturity Model Certification (CMMC) Level 2 assessments, many discover that achieving compliance is less about implementing new technologies and more about demonstrating that security practices are consistently executed, documented, and defensible.

Having supported organizations through numerous Level 2 assessments, we’ve observed recurring themes that separate successful assessments from difficult ones. While every environment is different, the same challenges tend to surface repeatedly once assessors begin reviewing evidence, interviewing personnel, and validating control implementation.

Here are five of the most important lessons we’ve learned along the way.

1. Level 2 Is Less About Tooling and More About Evidence Maturity

One of the most common misconceptions organizations bring into a Level 2 assessment is the belief that purchasing the right security tools automatically translates to compliance.

While technologies such as Microsoft Defender, Microsoft Sentinel, endpoint management platforms, and identity solutions are important components of a secure environment, they rarely become the primary obstacle during an assessment. Instead, organizations often struggle to produce clear, assessor-ready evidence that demonstrates how controls are implemented and maintained.

Assessors are not only looking for screenshots or configuration exports. They want to understand the complete story behind a control. That includes the policy that establishes the requirement, the technical implementation that enforces it, the procedures that support it, and the evidence that proves it is operating consistently over time.

In many environments, security processes exist but are not formally documented. Teams may be performing the right activities, but there is limited traceability between policies, technical controls, and operational execution. This creates friction during assessments and often results in lengthy evidence collection exercises.

We’ve found that organizations achieve better outcomes when evidence is treated as a deliverable rather than a byproduct. Standardized evidence templates, clear mappings between controls and artifacts, and centralized repositories make it significantly easier to demonstrate compliance. When policies, technical artifacts, and supporting narratives are linked together in a structured way, assessors can follow the evidence trail without requiring extensive clarification.

The lesson is simple: Strong security controls are important, but mature evidence management is often what determines how smoothly an assessment proceeds.

2. Shared Responsibility Confusion Creates Unnecessary Risk

Another recurring challenge involves shared responsibility.

Many organizations operate within cloud environments and rely on managed service providers, compliance partners, or other third parties to support portions of their security program. While these partnerships provide significant value, they can also introduce confusion about who is responsible for performing specific controls.

Questions around logging, monitoring, incident response, administrative management, and security operations frequently reveal gaps in understanding. Organizations often assume a provider is performing a function that remains their responsibility, while providers may assume the customer owns certain activities.

Assessors routinely probe these boundaries because they want to understand who is actually performing each control and how that responsibility is documented.

When ownership is unclear, organizations may struggle to explain operational processes consistently. Different stakeholders provide different answers, documentation becomes inconsistent, and confidence in the control implementation decreases.

The most successful organizations establish a formal Shared Responsibility Matrix that clearly defines ownership for every applicable control. Responsibilities should be mapped across the customer, cloud service provider, and supporting partners, then validated against actual operational practices.

Just as importantly, these responsibilities should align with the System Security Plan (SSP), supporting policies, procedures, and evidence artifacts. When ownership is documented and consistently reflected across assessment materials, organizations eliminate ambiguity and provide assessors with a clear understanding of how security functions are managed.

3. Incident Response Is Where Theory Often Breaks Down

Nearly every organization has an Incident Response (IR) plan.

Far fewer organizations can confidently demonstrate that the plan has been tested, validated, and executed in a realistic scenario.

During assessments, conversations about incident response often begin comfortably enough. Organizations can describe their documented procedures, escalation paths, and reporting requirements. However, confidence frequently declines when assessors begin asking questions about actual execution.

When was the last exercise conducted? What evidence exists from that exercise? How were lessons learned captured? How does the organization detect incidents and transition from detection to response?

These questions expose gaps that are difficult to identify through documentation reviews alone.

We’ve repeatedly seen organizations with strong IR policies but limited operational validation. Tabletop exercises have never been conducted. Roles and responsibilities remain unclear. Escalation timelines are not well understood. Detection tools operate independently from response workflows.

The organizations that perform best treat incident response as an operational capability rather than a compliance requirement.

Regular tabletop exercises, technical simulations, and structured runbooks help transform documented procedures into repeatable processes. More importantly, these activities generate evidence. Tickets, logs, timelines, after-action reports, and exercise records provide tangible proof that the organization can execute its response plan when needed.

Assessors want confidence that an organization can respond effectively to a real-world event. The ability to demonstrate tested processes and documented execution often carries significantly more weight than the existence of a well-written plan.

4. Identity and Access Controls Receive More Scrutiny Than Expected

Identity management consistently emerges as one of the most heavily scrutinized areas during Level 2 assessments.

Modern cybersecurity strategies increasingly rely on identity as the primary security perimeter, making access control practices particularly important. As a result, assessors spend significant time reviewing how organizations manage authentication, authorization, privileged access, and monitoring.

Common findings include inconsistent multi-factor authentication (MFA) enforcement, excessive privileged access, insufficient auditing, and limited visibility into administrative activity. In many cases, the required controls are technically implemented, but organizations struggle to prove that they are consistently enforced.

This distinction matters.

Assessors are not simply interested in whether a configuration exists today. They want evidence that demonstrates ongoing enforcement over time. Audit logs, sign-in records, privileged access histories, and monitoring reports help establish that controls are operating as intended.

Organizations that adopt standardized identity management practices tend to have fewer challenges during assessments. Consistent use of MFA, Conditional Access policies, Privileged Identity Management (PIM), device compliance controls, and centralized auditing creates a stronger foundation for both security and compliance.

Perhaps most importantly, these configurations should be supported by evidence that demonstrates historical enforcement. Being able to show not only the control itself, but also its continued operation, significantly strengthens an organization’s assessment posture.

5. Consistency Beats Perfection Every Time

The final lesson may be the most important.

Organizations often enter assessments believing they need a perfect environment. In reality, consistency is usually far more valuable than perfection.

Assessors understand that environments evolve. Technologies change, systems are updated, and organizations continue maturing their security programs. What assessors want to see is that controls are implemented consistently, governed appropriately, and managed through repeatable processes.

Inconsistent implementation creates far more concern than minor imperfections.

For example, an organization may have strong controls in one enclave while applying different standards elsewhere. Administrative procedures may vary between teams. Security configurations may differ across similar systems. Last-minute remediation efforts can introduce additional complexity and create uncertainty about whether controls are truly operational.

Consistency becomes even more important in cloud-centric environments where security capabilities may be distributed across cloud service providers, managed service providers, and the customer organization.

How a Phishing Attack Can Escalate Quickly

Author: Chris Bentkowski, Service Engineer at CloudFit

It only takes one click.

Despite significant advances in identity security, phishing remains one of the most effective attack methods because it targets people, not technology. Modern phishing campaigns are designed to steal more than just usernames and passwords. Increasingly, attackers are capturing legitimate multi-factor authentication (MFA) codes in real time, allowing them to bypass security controls that many organizations rely on.

What starts as a single phishing interaction can quickly escalate into a widespread security incident affecting multiple users, systems, and business operations.

Here’s how that escalation typically unfolds.

It Starts with a Convincing Login Page

Many phishing attacks begin with a user clicking a malicious link that redirects them to a fake login page designed to look identical to a trusted application.

Believing the page is legitimate, the user enters their username and password and, when prompted, provides a valid MFA code from their authentication application.

At that point, the attacker has everything they need to complete the authentication process and gain full access to the account, including the ability to establish control over authentication methods.

How the Attack Escalates

Once an attacker successfully signs in, the objective quickly shifts from accessing a single account to expanding throughout the environment.

Attackers commonly:

- Establish persistence to maintain long-term access.

- Expand access by compromising additional user accounts.

- Introduce unauthorized systems into the environment.

- Expose systems to the internet, increasing the risk of further compromise.

This demonstrates how a single compromised account can rapidly become a much broader organizational incident.

Internal Phishing and Lateral Movement

Once attackers gain control of a legitimate account, they often leverage the trust associated with that account to target others.

Common tactics include:

- Sending phishing emails to coworkers and external contacts.

- Sharing malicious files disguised as legitimate documents.

- Creating unauthorized access pathways, such as guest accounts or shared links.

Because these emails originate from a trusted internal account, recipients are far more likely to click links or open attachments. As a result, additional accounts can be compromised, allowing the attacker to continue moving throughout the organization.

How MFA Can Be Bypassed

Multi-factor authentication remains one of the most important security controls organizations can implement. However, attackers are increasingly designing phishing campaigns specifically to defeat it.

Rather than trying to crack MFA, attackers simply trick users into providing a legitimate authentication code on a malicious website.

When that happens, the attacker can:

- Complete the login process.

- Capture authentication session details.

- Potentially reconfigure or take control of MFA mechanisms.

This technique is commonly known as MFA phishing or token/session capture, where attackers use real-time user input to bypass authentication protections.

The Potential Impact

Once attackers establish access, the scope of the incident can grow quickly.

Organizations may be forced to:

- Reset multiple user accounts and MFA configurations.

- Remove unauthorized systems and access.

- Delete malicious emails and files.

- Investigate and remediate widespread malicious activity across the environment.

While incidents can often be contained with a timely response, recovering from a successful credential and MFA compromise can require significant effort across IT, security, and business teams.

How to Protect Yourself

Verify Before You Enter Credentials

- Only sign in through trusted, known URLs.

- Avoid logging in from links contained in unexpected emails or messages.

Never Enter MFA Codes on Untrusted Pages

- Your MFA code is just as sensitive as your password.

- If a login page or authentication prompt feels suspicious, stop immediately.

Watch for Common Red Flags

Be cautious of:

- Unexpected login prompts.

- Urgent requests to “verify your account.”

- Unfamiliar file-sharing notifications.

- Emails that create unnecessary urgency or pressure.

Report Suspicious Activity Immediately

If something doesn’t seem right:

- Report phishing attempts using your organization’s reporting process.

- If you believe you’ve entered credentials on a malicious site, notify your IT or security team immediately.

The sooner an incident is reported, the faster it can be contained.

Key Takeaway

If an attacker captures both your password and your MFA code, they can gain full access to your account.

Today’s phishing attacks are designed to deceive users in real time, making them far more sophisticated than traditional email scams. Staying vigilant, verifying login pages before entering credentials, and reporting suspicious activity immediately can prevent a single phishing attempt from becoming a much larger security incident.

Comments are closed

CloudFit Software Named to the Inc. 5000 for the Fourth Time

LYNCHBURG, Va. — August 2026 — CloudFit Software has once again been named to the Inc. 5000, marking the fourth time the company has earned a place among the fastest-growing private companies in America.

The annual Inc. 5000 recognizes privately held U.S. companies demonstrating significant revenue growth over a three-year period. CloudFit previously earned a place on the list in 2021, 2022, and 2023, making its return in 2026 another milestone in the company’s continued growth.

For CloudFit, that growth has been driven by a simple mission: run every mission-critical workload.

Since its founding in 2018, CloudFit has grown from a team of former Microsoft leaders into a trusted technology partner serving organizations across government, defense, and commercial industries. Today, CloudFit helps organizations securely operate and optimize their Microsoft environments through cloud engineering, cybersecurity, compliance, managed services, Microsoft licensing, application development, and AI.

“This recognition is really about our people and our customers,” said Carroll Moon, Founder and CEO of CloudFit Software. “Our growth has always come from focusing on the mission in front of us, taking extreme accountability for the outcome, and serving our customers well. Being recognized by Inc. for the fourth time is an honor, and we’re incredibly grateful to the CloudFit family and the customers who continue to trust us with their most important workloads.”

Growth Built on Service

CloudFit’s fourth Inc. 5000 recognition comes during a period of continued expansion for the company.

In 2025, CloudFit was named Microsoft’s Global Defense & Intelligence Partner of the Year, recognizing the company’s work supporting mission-critical environments across the defense and intelligence community.

At the same time, CloudFit has continued expanding its capabilities across the Microsoft ecosystem, helping organizations navigate everything from Microsoft 365 and Azure licensing to secure cloud operations, cybersecurity, CMMC compliance, application development, and managed services.

That growth has not changed the philosophy CloudFit was built around: serve first.

CloudFit’s S.E.R.V.E. values — Servant Leadership, Extreme Accountability, Results Driven, Velocity, and Empowerment — continue to guide how the company approaches its customers, its employees, and the communities it serves.

Looking Ahead

Being named to the Inc. 5000 for the fourth time represents how far CloudFit has come, but the mission ahead remains much bigger.

As organizations face growing security requirements, evolving technology, and increasing pressure to modernize, CloudFit will continue investing in the people, expertise, and technology required to securely run the workloads its customers depend on every day.

“We’re proud of the growth, but growth itself has never been the goal,” Moon said. “The goal is to serve well, deliver outcomes for our customers, and make a meaningful impact. If we continue doing those things, the growth follows.”

CloudFit extends its thanks to its employees, customers, partners, and community who have contributed to the company’s journey and made this recognition possible.

About CloudFit Software

CloudFit Software is a Microsoft-focused technology company headquartered in Lynchburg, Virginia, with a mission to run every mission-critical workload. Founded in 2018 by former Microsoft leaders, CloudFit brings more than 140 years of combined Microsoft experience to organizations across government, defense, and commercial industries. CloudFit provides Microsoft licensing, cloud engineering, cybersecurity, CMMC compliance, managed services, application development, AI, and end-user support designed around secure, reliable outcomes.

Learn more about CloudFit Software at cloudfitsoftware.com.

Media Contact

Emma Lombardi, Senior Marketing Manager

emmalombardi@cloudfitsoftware.com

Comments are closed

Microsoft CSP Licensing: Why Buying Direct from Microsoft Doesn’t Always Make Sense

Key Takeaways

- Buying Microsoft licenses directly from Microsoft isn’t automatically the least expensive option. A Microsoft Cloud Solution Provider (CSP) may be able to offer more competitive pricing.

- There are different types of Microsoft resellers. Understanding whether you’re working through a direct or indirect model can help explain differences in pricing, service and turnaround time.

- Buying direct can make sense when speed and self-service are your biggest priorities, but your team takes on more of the licensing administration.

- Two Microsoft CSPs selling the same licenses can provide very different experiences. Internal processes, account prioritization and the number of handoffs involved matter.

- The right CSP should do more than process transactions. It should help you understand, purchase and manage your Microsoft licensing over time.

Most supply chains work the same way: the more people involved, the more expensive the product gets.

Think about a grocery store. A farmer produces something. A manufacturer packages it. A distributor gets it where it needs to go. The grocery store puts it on the shelf. Every business along the way has employees to pay, facilities to run and margins to make. By the time the product reaches you, those costs have been passed along.

Microsoft licensing works almost in reverse.

It can actually be more expensive to buy licenses directly from Microsoft than to purchase them through a Microsoft Cloud Solution Provider (CSP). That’s because Microsoft has built an extensive partner network to help sell and manage its licenses, taking some of the administrative work off Microsoft’s plate while giving qualified partners room to offer customers competitive pricing.

For customers, that’s generally a good thing. But it also means that where you buy your Microsoft licenses matters more than you might think.

Why Can Buying Through a Microsoft CSP Cost Less?

With physical goods, every additional company in the supply chain adds another layer of cost. Software-as-a-service has different economics.

Microsoft doesn’t necessarily want to handle every quote, subscription change, agreement, renewal, billing question and licensing request for every customer itself. At Microsoft’s scale, that’s a tremendous amount of administrative work.

The partner ecosystem helps solve that problem.

Qualified Microsoft partners can receive licenses at pricing that gives them room to resell those licenses competitively. Microsoft reduces some of the effort involved in managing the customer relationship, the CSP builds a business around making that process efficient, and some of the available margin can be passed along to the customer through better pricing.

So unlike our grocery store example, adding the right company to the purchasing process doesn’t necessarily add another markup for the end customer. It can actually create savings.

That distinction becomes particularly important as an organization’s Microsoft footprint grows. A small difference in per-license pricing might not seem significant when you’re buying a handful of seats. Across hundreds of users, multiple products and recurring subscriptions, the economics start to look very different.

What’s the Difference Between Microsoft CSP Resellers?

There are multiple ways to purchase Microsoft licensing.

You can buy directly from Microsoft. You can work with a provider operating directly within Microsoft’s partner programs. Or you can work with an indirect reseller that purchases through another provider upstream.

An indirect reseller can still offer better pricing than purchasing directly from Microsoft. But every additional layer can affect how much room there is on pricing and, just as importantly, how quickly information and orders move.

If your provider has to send your request to another organization, which then has to process it through its Microsoft relationship, you’ve introduced another handoff.

That doesn’t automatically make an indirect reseller a bad choice. It simply means customers should understand what they’re buying into.

When evaluating a Microsoft CSP, don’t stop at asking whether the company sells Microsoft licenses. Find out how its relationship with Microsoft works and what that means for you.

When Does Buying Directly from Microsoft Make Sense?

There’s a clear advantage to Microsoft’s self-service model: Speed.

If you know exactly what you need, you can purchase it and get moving. There’s no waiting for someone to prepare a quote or process an order.

For a startup experimenting with infrastructure, a small business purchasing a handful of licenses or a team that simply needs something right now, that convenience can outweigh other considerations.

The trade-off is that your organization owns more of the administration.

Someone has to understand what you’re buying. Someone has to allocate licenses, manage subscriptions, keep track of agreements and monitor renewals. As products, users and agreements accumulate, somebody needs to maintain a clear picture of what the organization actually has and what it’s paying for.

Microsoft provides tools to help, but your team still has to use and understand them. That’s why the decision often comes down to what your organization values most. If you need something immediately and are comfortable managing licensing internally, buying direct may work perfectly well. If you’re spending significantly on Microsoft and want to reduce both cost and administrative work, a CSP becomes much more compelling.

Should You Consider a Microsoft Enterprise Agreement?

For larger organizations, a Microsoft Enterprise Agreement (EA) is another way to purchase Microsoft licensing at scale. EAs can make sense when licensing needs are significant and relatively predictable, but the longer-term structure may offer less flexibility than some organizations want as their needs change.

If you’re approaching an EA renewal, that’s a good time to compare your options rather than automatically renewing the same purchasing model. Look at what you’re actually using, what you’re committed to, and how your needs have changed. Then compare that against what purchasing through a Microsoft CSP could look like.

The goal isn’t to move away from an EA simply for the sake of moving. It’s to make sure the way you’re buying Microsoft still makes sense.

What Happens After You Get a Microsoft Licensing Quote?

Price gets most of the attention when organizations compare licensing providers. The operating model behind that price deserves some attention too.

Imagine working with a traditional large licensing provider.

You start with a salesperson. They understand what you need and provide a quote. You approve it, and your information moves to contracting. Contracting handles the Microsoft agreement. Another department handles invoicing. Once everything is complete, you’re introduced to an account manager or customer service representative.

Now, a few months later, you need additional licenses.

Your request may move from customer service back to sales, then through contracting or invoicing before the licenses are actually procured. Every one of those steps makes sense organizationally. Collectively, they create a lot of handoffs.

Handoffs take time. They can also mean repeating information, waiting for internal approvals and figuring out who actually owns your request. The problem can become more noticeable when you’re a smaller customer of a very large provider.

A CSP serving organizations with thousands or tens of thousands of seats has to prioritize its resources. If your company needs 300 licenses and another customer needs 10,000, the economics naturally favor the larger account.

Again, that’s not necessarily a sign of poor service. It’s a consequence of the provider’s business model. But if you’re the 300-seat organization waiting on an order, you probably care quite a bit.

Is the Biggest Microsoft CSP Always the Best Choice?

Scale can be valuable. Large providers may have extensive resources, established processes and enormous purchasing volume.

But those advantages don’t automatically translate into a better experience for every customer.

The better question is how the provider’s operating model fits your organization.

Who handles your account after the sale? How many people or departments does a simple licensing request need to move through? How quickly can the provider respond when you need to add users? Who keeps track of agreements and renewals? Can someone actually help you understand your licensing, or are they primarily there to process transactions?

Those questions become especially important for small and mid-sized organizations that may represent a relatively small account to a very large licensing provider.

You’re buying the same Microsoft products either way. The difference is everything that happens around them.

What Should a Microsoft CSP Actually Do for You?

Price matters. So does expertise.

Microsoft’s ecosystem includes Microsoft 365, Azure, security, identity, endpoint management, and multiple cloud environments. Licensing decisions don’t exist separately from the technology those licenses enable.

A good CSP should be able to explain what you’re buying, help you understand your agreements and give you useful guidance when your environment changes.

That doesn’t always mean recommending another product. Sometimes the right answer is a different license. Sometimes it’s a different purchasing structure. Sometimes you already have what you need.

That’s where an indirect reseller starts becoming much more useful than a place to process an order.

What Should You Ask Before Choosing a Microsoft Cloud Solution Provider?

There isn’t one universally correct way to buy Microsoft licenses.

For some organizations, Microsoft’s direct self-service model is exactly what they need.

Sharetru and CloudFit Software Partner to Secure CUI Beyond the CMMC Enclave

New integration gives defense contractors a controlled, auditable way to exchange CUI with external partners without expanding access to their internal environment.

Lynchburg, VA, October 13, 2026 – Sharetru and CloudFit Software today announced a strategic partnership that introduces a new approach to secure CUI exchange for the Defense Industrial Base, combining CloudFit’s fully managed easyCMMC enclave with Sharetru’s FedRAMP Moderate authorized managed file transfer capabilities.

CMMC enclaves provide defense contractors with a controlled environment for working with CUI. But CUI rarely stays inside one organization. It must move between primes, subcontractors, suppliers, consultants, and government customers, creating additional risk each time information crosses the organizational boundary.

The CloudFit and Sharetru integration is designed specifically for that point of exposure.

Rather than provisioning external users into the organization’s Microsoft environment, easyCMMC remains the protected internal workspace while Sharetru provides a dedicated path for CUI moving in and out. External partners authenticate through Sharetru, keeping outside identities out of the organization’s directory and eliminating the need for tenant accounts or guest licensing.

“Protecting CUI inside a secure environment is only part of the equation. Our customers also need a secure, practical way to share that information with the partners they work with every day,” said Carroll Moon, CEO of CloudFit Software. “By bringing CloudFit and Sharetru together, we’re helping organizations maintain control and visibility as CUI moves beyond the enclave, without unnecessarily extending access to their internal environment.”

The integration also gives organizations greater control and evidence around external file movement. Administrators explicitly grant access and sharing permissions, while file-level audit activity is forwarded into Sentinel DCE so security teams can monitor activity at the boundary alongside the rest of the environment.

Sharetru Federal operates within MIS Sciences Corporation’s GovPoint Cloud Services FedRAMP Moderate boundary, which includes NIST SP 800-53 Rev. 5 Moderate baseline controls, 3PAO validation, continuous monitoring, and annual assessment. CloudFit brings deep Microsoft expertise to easyCMMC, with more than 140 combined years spent working at Microsoft across its leadership team, and was named Microsoft’s 2025 Partner of the Year for Defense and Intelligence.

“Sharing CUI with outside partners is a daily reality for defense contractors, and it shouldn’t force a choice between security and usability. Together with CloudFit, we’re making secure external exchange of CUI practical, so organizations keep full control over their data without adding administrative burden for their teams,” said Brendon Ainsworth, CEO at Sharetru.

Together, CloudFit and Sharetru provide a purpose-built model for how CUI actually moves through the defense supply chain: a secure environment for working with CUI and a controlled gateway for moving it beyond that environment.

To learn more about the CloudFit and Sharetru integration, contact CloudFit or Sharetru to schedule a demonstration.

About CloudFit Software

CloudFit Software is a Microsoft cloud and cybersecurity company helping organizations securely adopt, manage, and optimize Microsoft technologies. Named Microsoft’s 2025 Global Defense & Intelligence Partner of the Year, CloudFit delivers managed cloud, cybersecurity, compliance, Microsoft licensing, and IT solutions to organizations with complex security and regulatory requirements. Its easyCMMC solution provides Defense Industrial Base organizations with a fully managed, purpose-built environment for handling CUI and meeting CMMC requirements. With deep Microsoft expertise across Commercial, GCC, GCC High, Azure, and Azure Government environments, CloudFit helps customers simplify secure operations while providing the hands-on support and guidance they need to succeed.

About Sharetru

Sharetru provides secure file sharing and managed file transfer for organizations that handle sensitive and regulated data, replacing email attachments, consumer file-sharing tools, and legacy FTP servers with a single governed platform. Every transfer — whether a person uploading a file to the web application, sharing a link, or a system moving files by SFTP, FTPS, or API — is authenticated, logged to a named user, and retained for audit visibility. Sharetru is SOC 2 Type II certified and HIPAA audited, and its Sharetru Federal offering is FedRAMP Moderate Certified. Founded in 2001 and headquartered in Las Vegas, Nevada, Sharetru is used by hundreds of organizations to move sensitive files with a documented, auditable record of who accessed them, when, and from where. For more information, visit www.sharetru.com.

Comments are closed

Telix to Present at the Morgan Stanley 24th Annual Global Healthcare Conference and H.C. Wainwright 28th Annual Global Investment Conference

Melbourne (Australia) and Indianapolis, IN (United States) | September 9, 2026

Telix advises that Dr. Christian Behrenbruch, Managing Director and Group CEO and Kevin Richardson, CEO, Precision Medicine will present at the upcoming Morgan Stanley 24th Annual Global Healthcare Conference and at the H.C. Wainwright 28th Annual Global Investment Conference, both in New York, NY.

Presentation details:

Morgan Stanley 24th Annual Global Healthcare Conference

Date: September 14, 2026

Time: 9:15 a.m. EDT (11:15 p.m. AEST)

H.C. Wainwright 28th Annual Global Investment Conference

Date: September 15, 2026

Time: 10:30 a.m. EDT (12:30 a.m. AEST, Sep 16)

Both sessions will be webcast live, and accessible through Telix’s Investor Relations website.

For more information including how to register, please visit: https://ir.telixpharma.com/events-presentations.

Reliable access and availability of Ga-68 radiopharmaceuticals

Key thought leaders share their perspectives. This article has been reproduced with permission from Cardinal Health.

There when you need it: we asked five leaders across the nuclear medicine industry to share their specific experiences with one of the four key advantages of Gallium-68* (Ga-68) PET imaging: availability and reliable access on demand.

Industry experts

All five experts have had a positive experience due to:

Reliability of local production on a generator

Providers can obtain Ga-68 via compact and readily available generators, which makes the isotope locally accessible at hundreds of nuclear pharmacies across the country. As a result, providers can rely on dependable and convenient access when scheduling patients.

Receiving doses where and when needed

“The ease of scheduling is real: we can schedule our patients with the confidence that the product will be on-site on time,” Dr. Spier said. The key is having Ga-68 available locally instead of being shipped by air or ground from a major metropolitan area.

About half of Rio Grande Urology’s patients drive an hour or more to their facility, so reliability is very important. “It can be devastating if a patient drove 150 miles and the procedure had been cancelled because the radioisotope wasn’t available,” he added. “You would create a lot of discontent from the patient, who may never want to come back.”

Overcoming cyclotron constraints

Dr. Sohi noted that cyclotron-based products have the potential to create scheduling challenges, such as needing to order well in advance of the scan. But with Ga-68-based products produced on a local generator, American Molecular Imaging can order and often receive a dose within the same day.

“The local availability of Ga-68 enables us to fill gaps in our schedule, such as those caused by cancellations or patient add-ons,” he said. “It’s also more convenient for patients who need to schedule their scan at a particular time — such as in the morning or over the weekend — due to such things as work commitments or a lack of transport.”

Dr. Lavaf noted a similar experience at Desert Regional Medical Center. “Ga-68 is much easier to access than isotopes produced on a cyclotron alone, so we can more easily schedule patients any time,” he said. They are now able to open more time slots and start scanning patients in the morning as well as the afternoon.

Maximizing the use of PET/CT cameras

Sarasota Memorial Hospital has two PET/CT cameras that operate Monday through Friday. When it comes to scheduling Ga-68 scans, any challenges are caused more by the availability of the scanner than the isotope.

“We have not experienced any restrictions on when we can order Ga-68; we can typically get it when we need it, any time of day,” Kaplan said. “There has never been a shortage or challenge getting a dose when needed — unlike our past experience with other radioisotopes. The reliability is key.”

Robust access to Ga-68 supports the hospital’s operational goals as well. “At the end of the day, hospitals need to maximize the use of our cameras. The availability of Ga-68 helps ensure we can fill those time slots.”

The future is here

All five leaders reported having a positive experience with the availability and reliable access of Ga-68 PET imaging. With several FDA-approved imaging agents already in the market and numerous clinical trials underway investigating its use in the diagnosis of various types of disease, Ga-68 is making an impact. And the opportunity has just begun.

4 key advantages of Ga-68:

and reliable access on demand

in scheduling patients

to meet growing patient demand

Note

The views and opinions expressed in this piece are based on the physicians’ individual clinical experiences. However, results may vary for individual physicians and patients. This material is intended for informational purposes only and should not be construed as medical guidance.

*Gallium-68 (Ga-68) is a key radioisotope in nuclear medicine, largely employed in conjunction with specific ligands which target somatostatin receptors (SSTR) as a mechanism to accurately image neuroendocrine tumors (NET) as well as prostate specific membrane antigen (PSMA) in the imaging, diagnosis and staging of prostate cancer. Today, Ga-68 is the most widely used diagnostic isotope in ongoing theranostic clinical trials (source: clinicaltrials.gov analysis, data on file).

Safety statement: Gallium-68, when paired with a variety of targeting molecules (ligands), is a radioactive agent and should be handled by or under the control of qualified and licensed physicians with appropriate safety measures to help minimize radiation exposure. Any radiation-emitting product may increase the risk for cancer, especially in pediatric patients. Adhere to the respective dose recommendations for specific Ga-68 products and ensure safe handling to minimize the risk for excessive radiation exposure to either patients or healthcare workers.

© 2026 Cardinal Health. All Rights Reserved. Lit. No. 1NPS25-4052108-02 (02/2026)