Security Notice: ConnectWise Cloud Backup (Formerly SkyKick)
Published Date: 10/27/2026
Version: 1.0
Executive Summary
AvePoint is aware of the recently reported security incident involving ConnectWise Cloud Backup, formerly SkyKick, in which a compromised vendor application credential was reportedly used to gain unauthorized access to customer Microsoft 365 environments.
AvePoint is not impacted
Based on our review and the information currently available through our internal security monitoring and assessment processes, AvePoint is not impacted by this incident.
While no provider can guarantee immunity from every threat, AvePoint Cloud Backup incorporates multiple technical, operational, and organizational controls designed to reduce both the likelihood and impact of this type of attack.
Protection of AvePoint Application Identities
- AvePoint Cloud Backup accesses Microsoft 365 through Microsoft's consent framework using application identities with only the permissions necessary to provide the service.
- Authentication uses certificate-based methods rather than client secrets or customer user credentials.
- Certificates and related secrets are protected within Azure Key Vault using layered security controls. Access to these credentials is restricted and governed through technical and administrative safeguards.
- Sign-in activity, privileged access, administrative operations, and security events are continuously monitored for anomalous behavior. Documented incident response processes are maintained to support timely detection, investigation, and response.
Protection of Customer Data
- Customer backup data is encrypted, and access is limited to authorized service functionality operating under the customer's instructions.
- Each customer's backup data is encrypted using customer-specific encryption protections and stored in logically separated tenant containers.
- Customers may also utilize their own encryption keys and storage options where supported.
Additional Customer Control Options
- Customers may elect to use Bring Your Own Application (BYOA), allowing them to register and control the application identity within their own Microsoft Entra ID environment.
- Under the BYOA model, customers manage permissions, credential lifecycle, and consent decisions.
- Customer-provided certificates are encrypted and protected through technical and administrative controls designed to prevent unauthorized access.
- Regardless of deployment model, customers retain visibility into the application within their own Entra ID environment and may monitor activity, apply controls, or revoke consent at any time.
Independent Validation
AvePoint's security and privacy program is independently assessed through certifications and attestations including ISO 27001, ISO 27017, ISO 27701, SOC 2 Type II, CSA STAR Level 2, FedRAMP Moderate, CMMC Level 2, IRAP, Protected B, ISMAP, DESC CSP Security Standard, Cyber Essentials Plus, TISAX, and the Singapore Data Protection Trustmark.
Additional information, certifications, and audit reports are available through the AvePoint Trust Center for qualified customers.
We would be happy to arrange a discussion with our Security team to review these controls in more detail or discuss customer-owned application configurations.