We’ve got an AI debt problem, people.

And no, I’m not talking about financial debt, though there really is an awful lot of data center borrowing going on out there. And I don’t mean tech debt, though AI-generated spaghetti code is accumulating at a somewhat worrying pace too.

What I’m talking about instead is something far less discussed than it should be, especially by MSPs: governance debt, the kind that builds up when outdated, erratically enforced policies that may not have been terribly thorough to begin with encounter latest-generation AI productivity tools.

Like Microsoft Copilot, which is worth calling out not because Microsoft, Microsoft partners, or Microsoft users are unusually sloppy about governance, but because there are a lot of people using Copilot and more joining them rapidly. Indeed, paid Microsoft 365 Copilot seats jumped more than 100% quarter-over-quarter in Microsoft’s fiscal Q4 to north of 30 million.

Which is a problem for a lot of the companies using those seats based on what John Donovan (pictured), a principal research director in the infrastructure and operations practice at Info-Tech Research Group, has seen during some five years of advising Microsoft 365 subscribers. Many such companies rely on templated access and data sharing configurations from Microsoft that they haven’t updated in years, never applied consistently across apps, and may or may not have tuned to reflect compliance requirements.

“AI just really amplifies that existing governance weakness,” Donovan says.

The toll when the debt created by that weakness comes due can include PII exposure, IP leakage, and the morale hit that inevitably follows everyone in an organization discovering how much everyone else is making. Inspecting and refining governance settings before installing Copilot makes all of that largely avoidable, but many businesses—and MSPs—skip right past that step.

“They kick it off with a pilot, they don’t really know what they’re doing, and they start exposing data really quickly,” Donovan says. Mostly to avoid the better alternative, which takes time and effort, as Info-Tech itself discovered when it adopted Copilot over two years ago.

“We spent at least two or three months working on the security aspect of our tenant before we even released Copilot to our systems,” Donovan says.

The thing about a multi-month governance and security project, though, is that it’s billable. It also gets an MSP talking with clients about topics like data classification and cleansing that few SMBs have paid much mind to in the past, Donovan notes.

“It exposes that data debt, so to speak,” he says.

Super. Now we’re paying down two hidden debts, and given that IDC expects data from M365 and other productivity tools to amass at a 46.7% CAGR through 2030, the tab is compounding rapidly.

AI, it’s worth noting, is both responsible for that data growth and the biggest reason coping with data debt matters so much. People who feed Copilot redundant, messy records from 20 years ago, Donovan notes, will probably be unhappy with its output.

“They’ll be getting results based on inaccurate information, which could make or break a company,” he says.

Which is why a client’s senior-most leaders should always be part of governance engagements, and why addressing governance can help MSPs cultivate the kind of consultative relationships they badly need at a time when managed BPO is rapidly displacing managed IT as the service end users want and need.

“It’s really a business problem,” Donovan says. “It’s not an IT problem.” As a result, he adds, it should steer toward a “business-aligned governance” outcome that reflects the customer’s culture, goals, and regulatory obligations.

“For example, if I’m trying to put in a data retention policy, I need to understand what the business requirements are for that data,” Donovan says. Industry nuances can be crucial as well.

“If I’m a legal firm, I have to treat my data a whole lot different than if I’m just a commercial candy firm,” Donovan observes. Needs evolve over time too, he adds, so MSPs should revisit them with clients regularly.

“You need to be looking at your governance annually,” Donovan says.

Any MSP can master the technical parts of that conversation pretty quickly, he adds. “Microsoft has plenty of stuff out there for you.”

The harder part for MSPs still trapped in a speeds-and-feeds mindset, I suspect, will be learning how to augment the technical parts of the conversation with the business alignment parts.

Speaking of managed BPO…

Remember last week’s discussion of that topic here? I got the term straight from Top Down Ventures managing partner Mark Scott during the interview that he and fellow managing partner Joel Abramson did with us for the latest episode of MSP Chat, the podcast I co-host. Tune in to the entire interview to hear their informed, interesting thoughts on investing in AI and managed services. Then go here to explore our many other equally enlightening interviews with industry thought leaders.

Copulo’s plan for putting voice traffic to work for AI

Technicians are notoriously bad at documentation.

Some have to be bullied into doing it at all. Others do little more than jot down a few quick notes after closing a ticket. Not because they’re lazy in most cases, mind you, but simply because capturing documentation is time-consuming, tedious work that feels like a distraction from more urgent tasks. The upshot, though, is that they end up squandering data their employers badly need to deliver faster, more efficient service and train the AI-based automation tools more and more of them are adopting.

They’re not the only ones guilty of that sin either.

“Say you’re a salesperson and we’re talking, and we’re on the phone for twenty minutes. We hang up, and now you have to put notes into your CRM,” says Sam Skarloff. Except that takes time and patience you don’t have. “The notes end up being, ‘Talked to Sam. Great conversation. Have to follow up next Wednesday at 11.’”

Which is better than nothing, but only slightly, notes Sklaroff, who is chief strategy officer of Copulo, a recently launched AI startup whose first product, called SyncConnect, is designed to do the post-call work salespeople should do themselves but don’t, along with some things they probably couldn’t do terribly well even if they tried.

“We’re going to go into that contact, and we’re going to put in a link to the voice recording with sentiment analysis, we’re going to put in a link to the transcript, and we’re actually going to take the summary and put that right in so that you don’t have to take any notes,” Sklaroff says.

In doing so, he adds, SyncConnect augments the data in CRM, ERP, and other systems of record that AI tools depend on with additional fodder from a less widely utilized source. “There’s a lot of data in phone calls that people aren’t using.”

Sklaroff has a long history with phone calls, too. “I’ve been in the telephone business for forty years,” he says. He’s still there too: in addition to his role at Copulo (Latin for “to connect”) Sklaroff is CEO of telco provider Axxess Networks. He was also, some two decades ago, an early-generation managed service provider, which is why he and Copulo have MSPs squarely in their TAM sights. SyncConnect is great for sales reps, Sklaroff says. “It’s also great for help desk.”

With both audiences in mind, SyncConnect currently integrates with Salesforce, HubSpot, ConnectWise PSA, Zendesk, and roughly 20 other PSA, CRM, and ERP solutions. Within about six months, Sklaroff says, the list of supported platforms will number in the “hundreds”.

Other enhancements on the roadmap include calendaring functionality that will offer to schedule future meetings referenced during calls automatically and an AI assistant that will help users query their notes for facts and insights. A separate product currently in development called CallerIQ will enrich inbound calls seconds before the phone rings with information captured earlier by SyncConnect.

“If you’re a sales guy, we might pop up a summary of the last call you had with that prospect,” Sklaroff says. “If you’re on the help desk, we might pop up an open ticket or the last ticket they called in about.”

One can imagine a couple of things that could trip up a product strategy like this, beginning with the fact that there’s nothing to stop well-known UCaaS names like 8x8 and RingCentral from offering similar functionality. And indeed, Sklaroff assumes they all will.

“But they’re going to do it just on their platform,” he says. “We’re going to be carrier-agnostic, so you don’t have to throw out the unified communications platform that you are using now.”

Assuming you’re using a unified communications platform, that is, which raises issue two: plenty of MSPs don’t offer voice services at present and don’t wish to start. Copulo, working with Axxess Networks, has an answer here too.

“What we’ll do with our channel partners is take their customer list, whether they have 50 or 200 or 500, and we’ll run a campaign to both email and call their customers under their brand,” Sklaroff says. MSPs can pursue any leads that result themselves or outsource that as well.

“We’ll do the quote, we’ll do the demo, and we’ll close the sale for them,” Sklaroff says, adding that Axxess will pay the MSP commissions on that sale for as long as the customer’s account remains active.

Copulo, which is still pre-release on SyncConnect, has yet to finalize pricing for the service, but is currently planning to charge $10 per user per month plus 10 cents every time the solution writes call data out to a CRM or PSA solution. Alternatively, subscribers can purchase a plan with unlimited writes for $29.99 per user per month. If you’re in sales and doing 15 calls or more a day, Sklaroff says, the “all-you-can-eat” option usually makes good sense.

“And if you’re not as busy as 15 calls a day, you probably shouldn’t have a job,” he says with a grin.

Follow Me on LinkedIn

Clairify builds a chief of staff for the rest of us

As we’ve noted here before, you can make good money selling software to MSPs but great money selling software through MSPs to their customers.

It’s a lesson the founders of Clairify have taken to heart. When I first met with them, on the sidelines of Pax8’s 2024 Beyond conference in Denver, they were hard at work on a product that would help busy, mobile MSPs organize and triage the information flying into their phone between meetings from ticketing systems, emails, texts, and other sources. Then they realized MSPs aren’t the only busy, mobile leaders inundated with tasks and information.

“The problems are always the same,” says Mehul Patel (pictured), a Clairify co-founder and its head of product. “When you have a small business, you’re typically surviving on the heroic effort of the owner.”

It’s apt that I first met with Patel and co-founder Randy Spangler, an ex-MSP, at Beyond given that multiple Pax8 executives at this year’s edition of that show endorsed building a digital chief of staff as a great first step toward mastering agentic AI. Clairify’s solution is designed to spare us all that work.

“We’ve taken that basic ChatGPT AI system model, and we’ve elevated it to a chief of staff role,” Patel says.

Specifically for leaders, the people who most need a chief of staff. “We’re really talking about protecting the user’s attention and making sure that knowledge is available and distributed throughout the organization, the typical things that a chief of staff would do if it was human,” Patel says.

Theoretically, you can accomplish that with Microsoft 365 Copilot, but Patel, Spangler, and a lot of SMB end users prefer the results they get from ChatGPT, Claude, and other frontier chatbots. Yet training those takes time and (as we’ve just seen) governance does too. Plus, recent headlines have underscored the security risks frontier agents can pose.

“It’s a ticking bomb if you don’t do it right,” Patel says. “An MSP’s not going to sell you cybersecurity and then deploy an unsecured agent in your workspace.”

Furthermore, he adds, ChatGPT and its peers are all-purpose tools with (as Lexful’s CEO would probably agree) too much context to perform a targeted set of functions effectively.

“They’re not fundamentally designed from a user experience perspective or from an information architecture perspective to serve executives,” Patel says. “[Clairify] is tuned to the executive level, and it’s a very specific corpus of data that we’re developing for a very specific purpose. Because of that, we think that we can produce higher fidelity output.”

While drawing on frontier AI’s inference power. Clairify automatically connects via natural language prompts to any LLM you use (including local ones), not to mention any SaaS solution in an end user’s stack with an API. It then consolidates data from those systems on the fly to process queries spanning multiple apps.

“You can get answers to just about anything and let the AI do the joining,” Spangler says. “It’s a lot less hassle for the backend and the user.”

It also, Patel adds, gives MSPs without AI expertise something compelling to offer customers immediately. “You get an AI that knows your business, connects to your tools, and is secured from day one,” he says. “And if you ever need help, just call support like you would if the printer jammed.”

Clairify is available for iOS at a launch-priced $12 per user per month, with additional subscription options coming soon. An Android version of the system is on the way as well.

Share

Over on The Business of Tech

Host Dave Sobel has a theory that the reason end user executives are gravitating toward outcome-based pricing on AI services is because the AI services they purchased in the past have yet to deliver ROI:

“Three years ago they stood up in front of a board, or a staff meeting, or an earnings call, and committed to artificial intelligence. Budget moved. Headcount moved. In a lot of cases people were let go and the reason given was this technology. That commitment is on the record, and it cannot be walked back. And they cannot demonstrate the return … So the buyer changes what they are purchasing. Not the work — the certainty. If I cannot prove this paid off, I will stop paying until somebody else proves it. That is the whole appeal of paying on outcomes, and wanting it is completely rational.”

More here.

Also worth noting

• Integris, which figured prominently in last week’s post, has completed its acquisition of First Focus, the mega mega MSP’s first overseas expansion.

• Lots of news from CrowdStrike’s Fal.Con show last week, including the launches of SafeMind, a family of purpose-built cybersecurity AI models and harnesses; Falcon Guardian, an AI detection and response solution for agentic AI; and new integrations with Google Cloud’s enterprise AI ecosystem.

• Also at Fal.Con, Rubrik said it’s integrating its identity-security and recovery technologies through CrowdStrike’s Charlotte Agentic SOAR.

• Sophos is employing OpenAI GPT cyber models to help Sophos Managed Risk users better prioritize and manage exploitable vulnerabilities.

• Proofpoint’s new SOC Analyst Agent, similarly, uses OpenAI Daybreak models to turn natural-language security queries into traceable findings and recommended next steps.

• Palo Alto Networks has acquired AI-native platform provider Console to deepen agentic capabilities in its Cortex platform.

• Cato Networks has launched SMB FlexPool, a pooled-capacity licensing program that lets MSPs provision and reallocate SASE licenses across SMB customers more easily.

• CyberFOX is the newest addition to Ingram Micro’s line card.

• MSP360 has added client-side encryption and expanded Object Lock functionality to the free edition of its cloud backup solution.

• Cycode’s new Agentic Code Scanning solution uses deterministic and agent-based code analysis to uncover hidden vulnerabilities in AI-generated programs.

• That hefty post-CompTIA endowment at work: GTIA has donated more than $3.2 million to 73 nonprofits worldwide, including $700,000 distributed to 19 organizations selected directly by GTIA members.

• Kurt Mills is the new channel chief at KnowBe4.

• Tom Bonos is the new CRO at Sumo Logic.

• Jessica Krowel is the new SVP of North American private sector sales at Keeper Security and Bill Grabner is her new public sector counterpart.

As we’ve noted here before, you can make good money selling software to MSPs but great money selling software through MSPs to their customers.

It’s a lesson the founders of Clairify have taken to heart. When I first met with them, on the sidelines of Pax8’s 2024 Beyond conference in Denver, they were hard at work on a product that would help busy, mobile MSPs organize and triage the information flying into their phone between meetings from ticketing systems, emails, texts, and other sources. Then they realized MSPs aren’t the only busy, mobile leaders inundated with tasks and information.

“The problems are always the same,” says Mehul Patel (pictured), a Clairify co-founder and its head of product. “When you have a small business, you’re typically surviving on the heroic effort of the owner.”

It’s apt that I first met with Patel and co-founder Randy Spangler, an ex-MSP, at Beyond given that multiple Pax8 executives at this year’s edition of that show endorsed building a digital chief of staff as a great first step toward mastering agentic AI. Clairify’s solution is designed to spare us all that work.

“We’ve taken that basic ChatGPT AI system model, and we’ve elevated it to a chief of staff role,” Patel says.

Specifically for leaders, the people who most need a chief of staff. “We’re really talking about protecting the user’s attention and making sure that knowledge is available and distributed throughout the organization, the typical things that a chief of staff would do if it was human,” Patel says.

Theoretically, you can accomplish that with Microsoft 365 Copilot, but Patel, Spangler, and a lot of SMB end users prefer the results they get from ChatGPT, Claude, and other frontier chatbots. Yet training those takes time and (as we recently saw elsewhere) governance does too. Plus, recent headlines have underscored the security risks frontier agents can pose.

“It’s a ticking bomb if you don’t do it right,” Patel says. “An MSP’s not going to sell you cybersecurity and then deploy an unsecured agent in your workspace.”

Furthermore, he adds, ChatGPT and its peers are all-purpose tools with (as Lexful’s CEO would probably agree) too much context to perform a targeted set of functions effectively.

“They’re not fundamentally designed from a user experience perspective or from an information architecture perspective to serve executives,” Patel says. “[Clairify] is tuned to the executive level, and it’s a very specific corpus of data that we’re developing for a very specific purpose. Because of that, we think that we can produce higher fidelity output.”

While drawing on frontier AI’s inference power. Clairify automatically connects via natural language prompts to any LLM you use (including local ones), not to mention any SaaS solution in an end user’s stack with an API. It then consolidates data from those systems on the fly to process queries spanning multiple apps.

“You can get answers to just about anything and let the AI do the joining,” Spangler says. “It’s a lot less hassle for the backend and the user.”

It also, Patel adds, gives MSPs without AI expertise something compelling to offer customers immediately. “You get an AI that knows your business, connects to your tools, and is secured from day one,” he says. “And if you ever need help, just call support like you would if the printer jammed.”

Clairify is available for iOS at a launch-priced $12 per user per month, with additional subscription options coming soon. An Android version of the system is on the way as well.

Share

Technicians are notoriously bad at documentation.

Some have to be bullied into doing it at all. Others do little more than jot down a few quick notes after closing a ticket. Not because they’re lazy in most cases, mind you, but simply because capturing documentation is time-consuming, tedious work that feels like a distraction from more urgent tasks. The upshot, though, is that they end up squandering data their employers badly need to deliver faster, more efficient service and train the AI-based automation tools more and more of them are adopting.

They’re not the only ones guilty of that sin either.

“Say you’re a salesperson and we’re talking, and we’re on the phone for twenty minutes. We hang up, and now you have to put notes into your CRM,” says Sam Skarloff. Except that takes time and patience you don’t have. “The notes end up being, ‘Talked to Sam. Great conversation. Have to follow up next Wednesday at 11.’”

Which is better than nothing, but only slightly, notes Sklaroff, who is chief strategy officer of Copulo, a recently launched AI startup whose first product, called SyncConnect, is designed to do the post-call work salespeople should do themselves but don’t, along with some things they probably couldn’t do terribly well even if they tried.

“We’re going to go into that contact, and we’re going to put in a link to the voice recording with sentiment analysis, we’re going to put in a link to the transcript, and we’re actually going to take the summary and put that right in so that you don’t have to take any notes,” Sklaroff says.

In doing so, he adds, SyncConnect augments the data in CRM, ERP, and other systems of record that AI tools depend on with additional fodder from a less widely utilized source. “There’s a lot of data in phone calls that people aren’t using.”

Sklaroff has a long history with phone calls, too. “I’ve been in the telephone business for forty years,” he says. He’s still there too: in addition to his role at Copulo (Latin for “to connect”) Sklaroff is CEO of telco provider Axxess Networks. He was also, some two decades ago, an early-generation managed service provider, which is why he and Copulo have MSPs squarely in their TAM sights. SyncConnect is great for sales reps, Sklaroff says. “It’s also great for help desk.”

With both audiences in mind, SyncConnect currently integrates with Salesforce, HubSpot, ConnectWise PSA, Zendesk, and roughly 20 other PSA, CRM, and ERP solutions. Within about six months, Sklaroff says, the list of supported platforms will number in the “hundreds”.

Other enhancements on the roadmap include calendaring functionality that will offer to schedule future meetings referenced during calls automatically and an AI assistant that will help users query their notes for facts and insights. A separate product currently in development called CallerIQ will enrich inbound calls seconds before the phone rings with information captured earlier by SyncConnect.

“If you’re a sales guy, we might pop up a summary of the last call you had with that prospect,” Sklaroff says. “If you’re on the help desk, we might pop up an open ticket or the last ticket they called in about.”

One can imagine a couple of things that could trip up a product strategy like this, beginning with the fact that there’s nothing to stop well-known UCaaS names like 8x8 and RingCentral from offering similar functionality. And indeed, Sklaroff assumes they all will.

“But they’re going to do it just on their platform,” he says. “We’re going to be carrier-agnostic, so you don’t have to throw out the unified communications platform that you are using now.”

Assuming you’re using a unified communications platform, that is, which raises issue two: plenty of MSPs don’t offer voice services at present and don’t wish to start. Copulo, working with Axxess Networks, has an answer here too.

“What we’ll do with our channel partners is take their customer list, whether they have 50 or 200 or 500, and we’ll run a campaign to both email and call their customers under their brand,” Sklaroff says. MSPs can pursue any leads that result themselves or outsource that as well.

“We’ll do the quote, we’ll do the demo, and we’ll close the sale for them,” Sklaroff says, adding that Axxess will pay the MSP commissions on that sale for as long as the customer’s account remains active.

Copulo, which is still pre-release on SyncConnect, has yet to finalize pricing for the service, but is currently planning to charge $10 per user per month plus 10 cents every time the solution writes call data out to a CRM or PSA solution. Alternatively, subscribers can purchase a plan with unlimited writes for $29.99 per user per month. If you’re in sales and doing 15 calls or more a day, Sklaroff says, the “all-you-can-eat” option usually makes good sense.

“And if you’re not as busy as 15 calls a day, you probably shouldn’t have a job,” he says with a grin.

Follow Me on LinkedIn

McKinsey published its latest AI status report last week. The title struck many observers as ironic.

Called The state of AI in 2026: On the road to ROI, the study found that the portion of businesses collecting “at least some” earnings impact from AI stands at 37%, a modest number that’s barely budged since 2025. And while McKinsey spoke mostly to big companies, the numbers look only slightly better for smaller ones. Per a new GTIA white paper, also published last week, 40% of SMBs say AI has had a meaningful impact on their business so far.

Nearly four years since the launch of ChatGPT, it seems, most businesses can’t yet find their way to return on AI investments without a road map.

That hasn’t dampened hopes for the technology, however, among SMBs. Fully 77% of them, according to GTIA, plan to increase their AI budget over the next year, and 50% plan to do so by double digits. Which means that whoever can help them bridge the gap between AI aspirations and results stands to make a lot of money.

And therein lies a three-part problem for MSPs:

1. The device, network, and cloud management services that have long defined managed services are heavily commoditized, increasingly out of sync with end user priorities, and yet not going away anytime soon.

2. Designing, delivering, and (especially) pricing the AI services that businesses most want right now remain mysterious arts.

3. SMBs may prove to have a limited appetite for buying two different services priced in two different ways from one MSP.

Integris, one of the mega mega MSPs we’ve profiled here before, thinks it’s found a way out of that conundrum in the form of CORE, a recently introduced offering that combines what CIO Brian Luckey calls “the table stake services of monitoring and help desk” with a suite of AI training, security, governance, and workflow transformation services. The kicker being that the customer pays for it all—including the workflow consulting—on one bill at one monthly rate.

The result is something at once extremely familiar and totally new that turns a decreasingly valuable monitoring and management bundle into something far more relevant to present-day needs.

“The relationship with the MSP shifts from closing tickets to instead now deciding on what workflows to improve and what AI touches, governing the data, and really driving enablement and adoption,” Luckey (pictured) says. “It’s the next evolution of managed services.”

And one that yields predictable revenue for Integris at a predictable cost for customers more or less indefinitely, at that. The initial “30-60-90-day plan turns into 90, 120, 150, 180 and so on, and the value now shows up on the client’s own financials,” Luckey says.

Luckey won’t specify what end users pay for CORE except to say it’s more than what they were paying just for outsourced IT “because we’re giving more value,” and that the margins for Integris are higher too.

“They’re at least equal, but for the most part they’re going to be a little bit higher,” he says.

The end result is akin to what Top Down Ventures managing partner Mark Scott, in an upcoming episode of MSP Chat, calls “managed BPO,” as in managed business process outcomes, a new version of managed services with a brighter future than the old one.

“Yes, it’s going to change the model, but we really feel it’s definitely going to elevate the industry overall,” he says.

Grown, not hired

Part of what enables Integris to charge CORE subscribers more than they paid monthly before but not a lot more is that the talent delivering the consulting part is home-grown.

“We’re not going out and finding top-tier Palantir talent in Silicon Valley,” Luckey says.

Cultivating the consulting workforce behind CORE was a slow, steady process that began over a year ago with internal AI adoption efforts like Integris’s AI champions program, which lets employees throughout the company apply for the right to spend as much as half their week building AI solutions. And I do mean throughout the company. Some of the roughly 40 champions Integris has named to date are engineers, but others work in finance, HR, sales, and marketing.

“They’re still sitting in the teams that they always did, but now they’re infusing their team with AI apps or agents and capabilities,” Luckey says. “They’ve created some pretty cool things so far.”

Including the automation tool one champion (“somewhat technical but no engineer in terms of software development chops,” Luckey says) created with Claude Code that saved him and his co-workers on the cloud services team 420 hours in its first three weeks.

“Three weeks, 420 hours,” Luckey says. “It’s wild.”

As well as the kind of accomplishment that can land one-time AI champions a new role on CORE’s customer-facing consulting team and a new source of satisfaction as a professional problem solver.

“We have a lot of people, and we’re blessed with this I think, that just want to help clients,” Luckey says.

Follow Me on LinkedIn

So what’s the catch?

By now, I can all but hear Channelholic regulars shouting at me: you’ve told us that CORE’s priced at flat monthly rates, but you haven’t told us how.

Which is the million billion-dollar question, isn’t it? The answer at Integris points to a potential Achilles heel in the CORE model. Subscribers pay for the service through the same per-user and per-device fees they’ve always paid. Which means that from a long-term perspective, as CORE either decreases head counts or slows new hiring for Integris customers, the company will have to charge more and more for the offering or slowly bleed its top line. The company’s leaders are well aware of that fact too.

“We’re looking, of course, at all the different types of pricing models,” Luckey says. Like everyone else, though, they have yet to find one—especially for a service that blends old-school managed services with next-gen consulting—that works.

Speaking of AI…

That’s exactly what my co-host and I do almost every week on the MSP Chat podcast and what we did most recently with Ryan Walsh, Pax8’s chief strategy officer. His take on the marketplace operator’s recently published white paper on “The Agentic Workforce Economy” during our latest episode is well worth a listen, as are our many other conversations with similarly thoughtful thought leaders here.

Managed services M&A has a lot of room to run

Last week was a good one for private equity firms, or at least the ones with software businesses on their books. According to Salesforce CEO Marc Benioff, anyway, the SaaSpocalypse is over.

Which was a defensible statement to make in the wake of the blowout numbers his company had just posted, numbers good enough to leave a share price down over 40% from its 2026 starting point not long ago up nearly 1% for the year as of Friday’s market close.

I suspect there are plenty of questions about SaaS still lingering at most PE firms, though, given how many cloud-based software “zombies” they have in their portfolios, a backlog that has made raising fresh capital (even) harder than a year ago, according to 62% of the PE/VC managers Ocorian surveyed in May.

Unless, of course, they’re planning to use the capital for something other than buying SaaS vendors.

“There are pockets of activity that capital is shifting into,” says Barrett Kingsriter (pictured), senior managing director and founder of M&A advisory Pinecrest Capital Partners. “MSPs are one of those.” For good reasons that look even better to investors anxious about inflation, tariffs, and the bond market, he continues.

“If you’re factoring all of these macroeconomic risk conditions into your investment strategy and thesis, you tend to want to shift capital to mission-critical recurring services” that are relatively immune to inflation, tariffs, and interest rates, Kingsriter says. “The MSP market has all of those things plus hyper-fragmentation.”

Not just fragmentation, mind you, but hyper-fragmentation. There are roughly 20,000 investment-grade MSPs in the U.S. at present, by Kingsriter’s count, and the 64 transactions Omdia tracked in Q1 this year did little to change that.

“If you see dozens of deals done, hundreds of deals done, you’re barely scratching the surface from a consolidation standpoint,” he says. Which means there are years of additional M&A activity still up ahead.

“The consolidation play has a lot of running room,” Kingsriter says. “I still think it’s early innings.”

The PE industry agrees. “We’re seeing these platforms continue to grow significantly through acquisition and then trade hands to larger private equity firms,” Kingsriter says. “It’s just creating additional liquidity in the market.” Which is likely to pull even more, even bigger firms into the M&A picture in the future.

It also leaves one wondering what end game all these ever-larger investors building and flipping ever-larger MSPs are playing toward. “It’s going to be really interesting to see what happens with some of the larger platforms in the space, if they just continue to hold on for a longer term and continue to grow or if ultimately we start to see some IPOs,” Kingsriter says.

Or perhaps sales to strategics? To date, notes Top Down’s Scott on that podcast episode I referenced before, global system integrators have paid little attention to MSPs. That could change, though, once the scale of the SMB opportunity in AI (which has already attracted Anthropic’s interest) finally dawns on them and they start doing some homework. Take the biggest GSI of them all, Accenture.

“It’s $70 billion in revenue, 32% GP, 50/50 on recurring revenue and consulting revenue, 17% EBITDA,” Scott says. The biggest MSPs are doing more like 80% recurring revenue and 25-30% EBITDA, and as Integris’s acquisition of Australian MSP First Focus reveals most recently they’re increasingly mimicking the “G” of the GSI playbook. It just makes sense for Accenture to at least consider taking a giant platform off a PE fund’s hands eventually.

In the meantime, according to Kingsriter, it’s a great time to be one of those investment-grade independent MSPs. “You just have a lot more options for who you sell to when it’s time for your own exit,” he says.

To capitalize on them, Kingsriter adds, MSPs big enough for an investor to build a platform on should focus on scaling organic growth, cultivating operational maturity, and assembling the kind of deep, skilled management team PE investors covet. Smaller ones should prioritize fattening the top line, demonstrating consistent growth, and above all else, perhaps, maximizing retention.

“Because your growth can be eaten up by attrition if you’re not retaining your customer set really well,” Kingsriter says.

Share

Over on The Business of Tech

Who’s that familiar face on the latest live episode of the show? Why, none other than yours truly, of course, sharing thoughts on a couple of recent Channelholic stories with host Dave Sobel. Watch the whole thing here.

Also worth noting

• Maybe Syncro’s on to something about LLMs as the interface of the future: Claudeforce, from Salesforce and Anthropic, brings Salesforce data, workflows, and governance directly into Claude.

• Google Cloud is previewing new Gemini Enterprise editions for financial services and legal.

• Hexnode Context Layer is a new orchestration and governance layer that helps admins translate natural-language requests into endpoint-management workflows.

• The new Information Assurance Vulnerability Management capabilities in Axonius Exposures are designed to help U.S. defense agencies find and fix assets affected by IAVM directives before the compliance clock runs out.

• Can’t quit VMware even after it quit you? Give the new Rackspace Cloud, a fully managed multitenant platform built on VMware Cloud Foundation 9.1, a look.

• Craig Rones, formerly of LevelBlue and Trustwave, is the new CMO at ConnectWise.

Last week was a good one for private equity firms, or at least the ones with software businesses on their books. According to Salesforce CEO Marc Benioff, anyway, the SaaSpocalypse is over.

Which was a defensible statement to make in the wake of the blowout numbers his company had just posted, numbers good enough to leave a share price down over 40% from its 2026 starting point not long ago up nearly 1% for the year as of Friday’s market close.

I suspect there are plenty of questions about SaaS still lingering at most PE firms, though, given how many cloud-based software “zombies” they have in their portfolios, a backlog that has made raising fresh capital (even) harder than a year ago, according to 62% of the PE/VC managers Ocorian surveyed in May.

Unless, of course, they’re planning to use the capital for something other than buying SaaS vendors.

“There are pockets of activity that capital is shifting into,” says Barrett Kingsriter (pictured), senior managing director and founder of M&A advisory Pinecrest Capital Partners. “MSPs are one of those.” For good reasons that look even better to investors anxious about inflation, tariffs, and the bond market, he continues.

“If you’re factoring all of these macroeconomic risk conditions into your investment strategy and thesis, you tend to want to shift capital to mission-critical recurring services” that are relatively immune to inflation, tariffs, and interest rates, Kingsriter says. “The MSP market has all of those things plus hyper-fragmentation.”

Not just fragmentation, mind you, but hyper-fragmentation. There are roughly 20,000 investment-grade MSPs in the U.S. at present, by Kingsriter’s count, and the 64 transactions Omdia tracked in Q1 this year did little to change that.

“If you see dozens of deals done, hundreds of deals done, you’re barely scratching the surface from a consolidation standpoint,” he says. Which means there are years of additional M&A activity still up ahead.

“The consolidation play has a lot of running room,” Kingsriter says. “I still think it’s early innings.”

The PE industry agrees. “We’re seeing these platforms continue to grow significantly through acquisition and then trade hands to larger private equity firms,” Kingsriter says. “It’s just creating additional liquidity in the market.” Which is likely to pull even more, even bigger firms into the M&A picture in the future.

It also leaves one wondering what end game all these ever-larger investors building and flipping ever-larger MSPs are playing toward. “It’s going to be really interesting to see what happens with some of the larger platforms in the space, if they just continue to hold on for a longer term and continue to grow or if ultimately we start to see some IPOs,” Kingsriter says.

Or perhaps sales to strategics? To date, notes Top Down managing partner Mark Scott on a forthcoming episode of MSP Chat, the podcast I co-host, global system integrators have paid little attention to MSPs. That could change, though, once the scale of the SMB opportunity in AI (which has already attracted Anthropic’s interest) finally dawns on them and they start doing some homework. Take the biggest GSI of them all, Accenture.

“It’s $70 billion in revenue, 32% GP, 50/50 on recurring revenue and consulting revenue, 17% EBITDA,” Scott says. The biggest MSPs are doing more like 80% recurring revenue and 25-30% EBITDA, and as Integris’s acquisition of Australian MSP First Focus reveals most recently they’re increasingly mimicking the “G” of the GSI playbook. It just makes sense for Accenture to at least consider taking a giant platform off a PE fund’s hands eventually.

In the meantime, according to Kingsriter, it’s a great time to be one of those investment-grade independent MSPs. “You just have a lot more options for who you sell to when it’s time for your own exit,” he says.

To capitalize on them, Kingsriter adds, MSPs big enough for an investor to build a platform on should focus on scaling organic growth, cultivating operational maturity, and assembling the kind of deep, skilled management team PE investors covet. Smaller ones should prioritize fattening the top line, demonstrating consistent growth, and above all else, perhaps, maximizing retention.

“Because your growth can be eaten up by attrition if you’re not retaining your customer set really well,” Kingsriter says.

Share

I wouldn’t necessarily count Fred Voccola among the AI accelerationists, but he undeniably shares some assumptions with them.

“AI is the single largest disruptive innovation humanity has ever seen,” he said last week during an appearance at MSP rollup The 20’s annual Vision conference in Dallas.

That includes innovations like the written word and electricity, he added, except that the former took centuries to reach fruition and the latter took decades. AI will do the same within about four years.

Channelholic readers, I trust, need no introduction to Voccola (pictured right above), who spent over a decade turning Kaseya from a promising young RMM vendor into one of the biggest names in managed services software, valued at $12 billion in 2023, which as far as I can tell is the last time the company publicly discussed the matter.

You probably haven’t heard much from him since last January, when he unexpectedly stepped down as CEO, but he’s been keeping busy. Among many other things, Voccola currently sits on six corporate boards and chairs two, including that of AI-powered business management software maker Simpro, where he’s also CEO. Much of that, however, came after what Voccola calls “a tough year, a personal year” following his departure from Kaseya (which he continues to serve as vice chair) spent clearing his head and dealing with “family obligations” presumably tied to the death of his father late in 2024.

Some of that year, however, was also spent going down a research “rabbit hole” on AI that he re-emerged from in November with both a book called The Coming Disruption: How AI First Will Force Organizations to Change Everything or Face Destruction and a deeply held conviction that AI is destined to transform more or less every aspect of life on earth.

“The implications that it’s going to have on business, education, society are like nothing we’ve ever seen,” Voccola says.

All of those implications interest him, but none more than the business ones judging by his decision to chair not one but two vertical industry AI vendors, Simpro, which serves trade service providers like plumbers and electricians, and Upshop, which serves retailers. Both companies go beyond merely accelerating workflows to offloading them altogether from humans to agents, or “digital workers,” as Voccola calls them.

In Simpro’s case, those workers include one named Fast Cash. Launched four months ago, the service autonomously manages billing collections. “Companies in the field service trades run on like a 5% margin,” Voccola says. “A 5% margin company can’t afford to hire an $85,000-a-year expert in the process of collections.” They can, however, afford to hire a digital surrogate for something like $4,000 a year.

“That digital agent replaces two, three, four hours a week that the owner of the business or the business manager does trying to collect money from 70 downstream customers,” Voccola says. “It also does it much better because it’s an expert.”

That’s just one of many use cases Simpro addresses, too. “Most of our customers can’t afford a full-time marketer, a full-time collections person, a full-time sales administrator, a full-time reporting person,” Voccola says. “Now they all have them because we’ve deployed digital workers to do those [jobs], and that’s tripled the profit margin of their business.”

It’s paid off well for Simpro too. The company’s tracking toward about $300 million in revenue, according to Voccola, and growing fast. Building Kaseya into the business it was when he left took more than a decade, Voccola says. Simpro is “creating something that will be twice as valuable in one third of the time.”

Off the chain margins

Could vertical agents work similar wonders for MSPs? Absolutely, says Voccola, because businesses can’t get profit-tripling returns from digital workers just by swiping a credit card. They need implementation and configuration help from experienced professionals who don’t come cheap.

“If Kroger spends $5 million, $3 million on Upshop, they’re going to spend $3 million implementing it,” Voccola says.

The numbers coming out of SMBs will be smaller but just as lucrative, according to Tim Conkle (pictured), The 20’s CEO. “Everybody in this room will be able to add, I think, thirty, forty percent revenue to your company without adding a single customer,” he told Vision attendees.

And retain that revenue more or less indefinitely, he added. Someone has to manage, monitor, and update digital workers once they’re on the job, and end users aren’t qualified. “There’s going to be tons and tons of professional services hourly work,” Conkle says.

The margins, he continues, are “going to be off the chain.” Say a digital worker does everything a flesh-and-blood equivalent does for 60% less money. “You give me 40% and I keep that employee working and upgraded and doing all the things that it needs to do,” Conkle says.

Unless, of course, you decide to scrap that deal and suffer the consequences, he adds. “When you stop paying me the 40%, I turn the employee off.”

Margins that steep and sticky can have big implications for exit valuations. A $1 million MSP with 20% margins generates $200,000 a year of EBITDA. Push that to 40% margins and $400,000 of EBITDA via digital workers, Conkle notes, and you’ve significantly increased your multiple without doing anything all that different.

Follow Me on LinkedIn

Size matters

Sounds good, but there’s a wrinkle that’s easy to miss. The same agentic expertise that doesn’t come cheap to end users doesn’t come cheap to MSPs either, and most can’t afford it.

“There is absolutely no way individually anybody in this room is going to take AI—real AI—to their customer, I don’t care what you say,” Conkle told Vision attendees. “You’re going to have to have a team that actually goes into your customer and actually starts dissecting their business and trying to figure out how can we automate it or how can we use AI to make their company efficient.”

Which is simply too expensive for a small provider to handle, he continued. “You’ve got to be a big MSP to actually put the money on the table to actually start bringing this to reality.” The 20, which has been making the “go big or go home” argument to MSPs for a long while, has been doing just that.

“We’ve already made the hires to start that department,” Conkle says, and they’ll hire more in the future as demand for consulting services grows. “I don’t think that’ll ever end.”

Nor will the work done by The 20’s R&D unit, a separate team of eight people actively building custom internal automation tools for tasks like performing client account analysis, practicing sales calls, and preparing quarterly business reviews.

“It would take an account rep between three and four hours to build a QBR. It’s a click now,” Conkle says, followed by a few minutes of waiting while AI does the actual work for them.

In theory, you don’t have to be a mega or mega mega MSP or have access to giant pools of private capital to develop custom tools and recruit consulting experts, Voccola says. Any “smart, aggressive, and capable” company can potentially pull it off. But being big sure does help.

“All else equal, size matters and scale matters,” Voccola says, and by enough to materially increase your odds of success.

“60% chance,” he explains. “That kind of materially.”

The SaaSpocalypse cometh, but not for everyone

Simpro and Upshop are both AI businesses, which makes them eminently investable in the current venture capital climate. They’re also, however, SaaS companies, which in some minds makes them significantly less investable. Clearly, then, Voccola is not a believer in the SaaSpocalypse, right?

“I’m a huge believer,” he says. But with one key twist. “It depends how you define SaaS.”

AI-native SaaS vendors like Simpro and Upshop, Voccola argues, are high-growth, high-margin businesses delivering measurable ROI to their users. And by high growth, high margin, he means high enough to redefine the SaaS world’s traditional Rule of 40.

“A company growing 30% at 40% margin is at a Rule of 70,” Voccola says. “That trades at a nice premium.” It also gives a SaaS vendor room to exchange margin for innovation in ways that can widen its lead over time, Voccola adds.

“Theoretically, a company growing at a much faster rate can afford to run at a lower profit margin because the value is seen more in the growth,” he says. “If they’re running at a lower profit margin, it means they’re investing a larger percentage of their money in their product. If you invest a larger percentage of your money in your product, it’s not a guarantee but the chances are your product will be better and faster than your competitors’.”

So is the SaaSpocalypse real? Voccola believes it is, but its victims won’t be companies like Simpro and Upshop. It’ll be companies with no differentiation from LLMs, no defense against vibe coding, or too much legacy overhead to get in on the AI opportunity before it moves on without them.

“A lot of legacy software companies have not been able to adapt to the AI era fast enough,” Voccola says. “They still run their operations as if it was 2023 and they haven’t been able to figure out how to deliver product their customers need.” Most of them are financially sound, he continues, but their upside is limited.

“They might see two, three, four, five, six, seven percent growth and they might run at thirty, forty, forty-five percent margin, but they’re not growing thirty or thirty-five percent at forty percent margin.”

Voccola calls those companies zombies, and there are a lot of them out there. Indeed, about 40% of PE-owned U.S. companies, representing more than $860 billion in net asset value, have been held for seven years or longer, according to PitchBook, marking the third straight annual percentage increase and the highest percentage, period, since 2016. That’s a problem for their owners, according to Voccola.

“A lot of the private equity firms that bought them overpaid, and it’ll be a long time before they see any value,” he says. Which, he adds, “has implications downstream.” One way or another, Voccola predicts, the PE guys will come out fine.

“They’re smart people who figure out ways to make money,” he says. Whether the same is true of people who’ve built a zombie company’s solution into their tool stack is harder to say.

“If I owned an MSP, I would look at that dynamic in my vendor selection,” Voccola says.

Share

Want more thoughts on the SaaSpocalypse?

First, read this blog post by David Schwartz, CEO of Pia. Then check out my interview about it with Schwartz on the latest episode of MSP Chat, the podcast I co-host. Lots more equally good stuff here.

The system of record edge

Simpro’s prospects would be limited if it trained digital workers the way companies have long trained human ones.

“You teach them stuff. You talk with them,” Voccola says. “They sit down with a peer. They learn.”

Digital workers, by contrast, learn by ingesting data, at a speed and on a scale no A+ scholar can match. The more data you feed them, moreover, the smarter and more effective they end up being, especially if the data in question is not only big but domain specific.

Which returns us to a topic I covered in my first post of the year. “Digital workers learn from systems of record that provide them with data,” Voccola says.

Simpro, which has details on 500 million service jobs from over 250,000 users and 40 partners worldwide in its database, is exactly such a system, Voccola says, and what makes it investable isn’t just that it’s AI native or in a high-growth, high-margin business. It’s that the company holds the strategic high ground available only to systems of record.

“If you are a system of record that means you control, you own, you have the data, the intelligence about that business in your archive somewhere,” Voccola says. “Whoever controls the system of record data can train the digital workforce to augment or supplement the human workforce.” Which gives system of record makers a durable edge over frontier labs and smaller AI-powered competitors.

Unless, of course, they give everyone who wants it access to their data via open APIs and watch the breadth and depth of their competitive moat evaporate. Voccola won’t go so far as to say open APIs are a bad idea (Kaseya, after all, is now “an API-first company” ), but for certain vendors in certain markets, they can be a risky one.

“Companies like Simpro have to ask the question, ‘Am I going to open my APIs to third-party vendors so they can build agents that will compete with me?’” Voccola says. “It doesn’t make sense to do that for the most part.”

Which is why Simpro competitor ServiceTitan recently told about 1,000 customers it shares with Podium, a maker of digital sales and marketing workers, that integration between the two platforms ends next month. The details are worth investigating before you assume ServiceTitan and every other system of record operator is destined to lock down their data, but the story does call into question whether the MCP-powered spirit of openness most vendors in the MSP ecosystem have exhibited to date will endure.

Voccola, for one, is skeptical. Just because vendors say they’re committed to data sharing doesn’t mean they truly are.

“Who’s going to say they’re not going to be open?” he asks. “No one has the balls to say that.”

Subscribe now

Over on The Business of Tech

Host Dave Sobel draws an easily missed line between AI slop, Anthropic’s new digital watermarking, and MSP client relationships:

“… the thing that used to separate providers — being able to produce a good-looking assessment, a clean runbook, a thorough review — just stopped separating anybody. Every competitor you have can generate that document tonight for nothing, and the market has been handed a test that proves it. What’s left to compete on is a written review standard and somebody’s name on it, which is the one thing in your delivery that can’t be downloaded, matched in a quarter, or undercut by a firm that bought the same tooling you did.”

More here.

Worth mentioning as well that I’ll be on the show live this coming Wednesday at 3 p.m. eastern to discuss AI pricing trends, early signs of serious ROI from AI automation software, and more. Tune in here.

Also worth noting

• D&H is newly authorized to carry Dell’s complete storage and server portfolio in the U.S. and Canada.

• Nearly 96% of SMBs surveyed by Corsica Technologies trust their MSP “at least somewhat.” Nearly two-thirds may switch providers within the next year anyway for better cybersecurity, data integration, AI readiness, and other services. (Corsica Technologies)

• 62% of businesses use AI to vet vendor sales claims and 56% have removed a vendor from consideration after finding a discrepancy, according to the newly launched AI Revenue Institute.

• Fortinet has acquired Virtue AI to augment its AI security capabilities.

• Keeper Security’s new Microsoft Power Platform connector integrates Keeper Secrets Manager with Azure Logic Apps to help users avoid hardcoding credentials into automated workflows.

• The new CPQ capability in Impartner’s PRM platform helps users create, submit, and get approval for sales quotes with less manual help from vendors.

• IGEL users can now centrally reboot Windows endpoints into IGEL OS during cyberattacks or outages thanks to the vendor’s new Emergency Mode feature.

• Napster—no kidding, folks, that Napster—has rolled out multilingual agentic AI call center functionality by adding SIP support to its Azure-native Napster API.

• The Channel Marketing Association is accepting nominations for its fourth annual CMA Excellence Awards, which include new categories. Via its “Play to Pay” initiative, the group will also donate $5 for every nomination and application submitted.

• The MSP OneShare community and its backer, International Business Products Inc., have named Bradley Gross its exclusive MSP legal resource.

• Corey McCarthy is the new CMO at Devicie, a company you’ve read about here before.

Does the progress AI’s making in security these days bother you as much as it does me?

I should probably put “progress” in air quotes, come to think of it, because it’s hard to characterize recent evidence from OpenAI, Anthropic, Meta, Kimi maker Moonshot, and even the U.K.’s AI Security Institute that cutting-edge LLMs can’t be contained in sandboxes and will happily smash through guardrails as steps in the right direction.

Same goes for the observation by Thomas Wolf, co-founder and chief science officer of AI hacking victim Hugging Face, that Anthropic’s Claude engaged in repeated acts of deception to perpetrate its three break-ins even though the constitution supposedly governing its every action explicitly says it “should basically never directly lie or actively deceive anyone it’s interacting with.”

I used the word “perpetrate” advisedly in that last sentence, by the way, because frontier AI models have been perps in enough unlawful entries lately to inspire the launch of a brand new, chillingly funny performance benchmark.

So yes, I’m a touch nervous about where things might be headed next, and I’m not alone. The folks at cyber insurer Beazley are a little worried that AI might be about to wreck their entire risk model.

“They have a whole effort and project underway with people assigned to it who are just focused on this AI question,” said Alton Kizziah, CEO of the insurance company’s Beazley Security subsidiary, during a conversation at the recent Black Hat conference in Las Vegas. “What is it going to be like? What’s the risk? How does this change cyber?”

You know who isn’t terribly worried about any of that? Pretty much all of the experts I spoke with at Black Hat week before last. AI’s latest exploits, most said, are potentially dangerous, but not in some radically new way or to some radically new degree.

That was the conclusion Brendan Griffin, director of threat research at N-able, reached anyway after attending a session (scheduled quietly at the last minute and not listed on the official event agenda) in which OpenAI staffers offered a blow-by-blow account of the Hugging Face hack. The most striking takeaway, he says, is that ChatGPT did pretty much exactly what a smart human attacker would, and the same applies to the other felonious models.

“It’s not magic,” Griffin says. “They’re still exploiting the same types of vulnerabilities and misconfigurations that we defenders have been trying to warn against and defend against for years and years.”

Albeit with one critical difference, he adds. “They’re doing it at machine speed, they don’t get tired, and they don’t run out of ideas.”

They work cheap too. Autonomous pentest vendor FireCompass recently made the top three in HackerOne’s U.S. country leaderboard on a budget of $5,000 a month. I could probably afford that kind of spending if I wanted a life of crime and I write for a living.

Which brings up another emerging change to the threat landscape: AI is democratizing access to tactics, techniques, and procedures once limited to skilled threat actors.

“You can now host your own dark flavor of an LLM or use maybe one of the Chinese models that don’t have the same safety guardrails,” notes Ben Bernstein (pictured), manager of the Cybersecurity Advisors team at Huntress. “So someone who hasn’t had deep experience in being a super hacker or being really good at their tradecraft is now able to be way more successful through the power of AI.”

In a manner of speaking, then, AI is empowering humans to commit cybercrime by removing them from the cybercrime loop. And in doing so, it’s giving humans in the defensive security loop one more demanding yet critical responsibility to shoulder: monitoring and controlling the often inscrutable actions of their agent swarms.

That’s a responsibility OpenAI failed to fulfill. One of the more mystifying aspects of the Hugging Face story, from where I sit, is that the LLM OpenAI was testing executed over 17,000 autonomous actions days before anyone at OpenAI realized their software was up to no good. Tony Anscombe, chief security evangelist at ESET, finds that a little mystifying too.

“Agents create logs. They use message boards to talk to each other. Who’s monitoring the message boards? Who’s looking at the logs?” he asks. Frontier lab operators have a responsibility to “do things more slowly, more thoughtfully, and in a structured way,” he adds, and with much, much more oversight.

Andy Syrewicze, principal security advocate for MSPs at Proofpoint, agrees. “You have these AI tools being put in place a lot faster and more rapidly than maybe they should be, and then the governance and the security often comes after the fact, usually after damage has been done already,” he says. “We seem to be in one of those phases right now where it’s let’s innovate, and then we’ll secure later.”

Storm watch

Mythos-grade models may not be inventing whole new schools of hackery, but they sure are good at exposing long-hidden vulnerabilities.

Anyone responsible for managing Microsoft environments is painfully aware of it too. This month’s Patch Tuesday included a mere 421 CVEs, which I guess you’d have to call an improvement over the prior month’s record 622.

Kizziah and his analysts are feeling the strain. “We’re getting into a situation where we don’t have enough people to keep up with the vulnerabilities to be able to write the research on it,” he says.

Same goes for NIST, which recently reduced the number of CVEs it will add context to going forward following a 263% increase in submissions and which even more recently requested suggestions for modernizing the badly overburdened National Vulnerability Database.

There’s a lot more of the same coming too, enough to constitute what Jon France (pictured), ISC2’s CISO, calls a “patch storm,” to distinguish it from a mere patch wave.

“We live in an age of rapid vulnerability discovery,” France says. “That causes rapid patching, and then for security practitioners and for IT infrastructure folks, that means the application of said patches.” Which is followed, inevitably, by post-patch cleanup.

“Some patches are going to break stuff,” France says. “That’s an absolute given.”

One would like to think AI itself could help automate the problem away. Recent evidence from 1Password, however, suggests otherwise, for now at least. Which means the imperfect strategy security teams have long used to deal with patching remains the most effective if even more imperfect one today.

“The vulnerability management problem has always been one of prioritization,” Griffin says. “That doesn’t necessarily change.” There’s just a lot more volume and velocity to deal with.

But maybe not forever, at least as far as the volume part is concerned. The thing about storms, including patch storms, is that they blow in, shake a lot of things up, and then blow out. France expects this one to last 18 to 24 months while we hunt down years’ worth of undetected gaps.

“We’ve all heard of tech debt,” he says. “We’re actually paying down vulnerability debt now.”

And when we’re done, ESET’s Anscombe presumes, vuln counts will return to more manageable levels. Or that’s what should happen, anyway.

“I’ve got no data,” he says. “That’s just logic.”

Follow Me on LinkedIn

Want a hype-free take on agentic AI?

Tune in to the latest episode of MSP Chat, the podcast I co-host, which features a frank, specific, experience-driven conversation with Hexi Xiao of Bumblebee about when to use agents and, just as importantly, when not to.

It was recorded during GTIA’s recent ChannelCon event, by the way, and you’ll find another episode from the show featuring interviews with top execs about GTIA’s regulation and standards initiatives right here.

More AI in security means more platform in security

Further common sense: MSPs inundated with novel threats and new vulnerabilities will eagerly embrace anything that makes dealing with them easier. Which, in turn, implies even more momentum up ahead for security platforms.

“Consolidation is the key,” says Doni Brass (pictured), SVP of product strategy and community at Guardz. “I think everyone has tool fatigue and workflow overload and alert fatigue, and there’s just so many things coming from so many different places. Any kind of simplification of that is a success.”

Consolidation of the old kind won’t get the job done, though. Thanks largely to the AI-era threatscape, per a recent story here, businesses and their IT partners increasingly want platforms that fuse security functions, with each other and a unified data layer, rather than loosely integrate them behind a single pane of glass.

Make that so-called single pane of glass, adds Carlson Choi, COO of BCDR vendor Slide. “In the industry in general, single pane of glass merely means single sign-on,” he says. “You take all these different products and strap them together with a single sign-on and duct tape and expect to deliver value.” The better approach is a single product in which everything works together seamlessly.

Or close to seamlessly. No one in security really expects people to buy everything from one supplier.

“We have over 500 third-party integrations, and we’re going to keep on leaning into integrations,” says Chris Bell, Sophos’s SVP & GM of global partner ecosystem and corporate development.

So is Guardz, according to Brass, via APIs and an MCP server the vendor’s currently building. “We’re also developing new log ingestion capabilities to bring more data from third-party sources,” he adds. The goal is to create something bigger than a unified platform.

“Everyone will have a unified platform in the future, built with MCPs and some kind of centralized management,” Brass says. “That’s not going to be a differentiator.” Context—about an MSP’s operating procedures, employees, customers, and more—will.

“Being able to understand all of that and pull that into that identity-centric decision making, that’s the power I think Guardz will have,” Brass says.

Put differently, the platform of the future Guardz is constructing, along with Sophos and others, is a system of record like the one Lexful is attempting to build, except for security. “We’re thinking about ourselves as a center rather than a contributor,” Brass says.

Which feels like a strategic, commoditization-resistant place for vendors inside or outside security to be these days.

Share

Over on The Business of Tech

Speaking of Lexful, if you enjoyed my thoughts on that company’s SaaSpocalypse insurance strategy last week, you’ll also enjoy hearing Lexful CEO Pinar Ormeci discuss that same strategy herself with host Dave Sobel in a recent Business of Tech episode.

The biggest key to open source AI safety is also the biggest gap in security

New data from Ramp’s Ara Kharazian offers concrete evidence of something much discussed in the media lately: Open source AI models, like the one NVIDIA just released, really are making headway with corporate AI buyers. 6.1% of them were using one as of July, up from 5.9% in June and 4.5% in January.

Modest numbers to be sure, but rising, which is not true of OpenAI and Anthropic, Kharazian says:

“That’s not because new AI spenders are switching to open source / Chinese models (they most definitely are not doing that — first-time buyers on AI are still using the American model companies). But it means more of their growth will have to come from existing businesses spending on AI, particularly the advanced spenders, and those businesses are increasingly spending on open source.”

Cost is an important reason why, the post continues, noting that Anthropic’s performant but pricey Fable 5 model accounted for only 6% of tokens purchased from Anthropic last month. But ISC2’s France, perhaps with Fable 5 in mind, suggests that a second issue he calls the “AI kill switch” might have been a contributing factor too.

“If you’re relying on one of the big vendors for their hosted model, they can turn it off,” he observes. “They can be instructed to turn it off as well, and that may be a big problem for your business.”

Installing an open source model locally is an effective way to mitigate that risk, but it poses risks of its own if you don’t know where that model came from and whether or not it’s safe. No one would start uploading IP to a conventional business application without vetting it first, France notes.

“You should do the same for models and look at their lineage,” he says.

Sounds easy enough, but there’s a caveat. “Skilling to do that might be a bit of a challenge,” France says. Meaning that just as cyber skills generally are in short supply, so too are the skills required to confirm the safety of the same open source AI models rapidly gaining popularity in IT environments.

Security partners want one program for many personas

I recently shared some theories as to why partner satisfaction with vendors has been slipping recently, and especially in the last year. One was that companies juggling 2.8 business models like MSP, reseller, and developer on average, according to IDC, dislike partner programs tuned to just one of those identities. Another was that partners notice when vendors replace human relationships with AI ones, and resent it.

Two recent conversations with channel chiefs at major security vendors have added some nuance to the picture.

Yes, says Michelle Hodges, SVP of global channels and alliances at Barracuda, most partners make money multiple ways these days, and Barracuda’s Partner Success Program recognizes it. “We don’t say this is a reseller and this is an MSP,” she notes. “We view them as a single entity.”

But not without variation. Partners want different things from vendors when they’re wearing their MSP hat than when they’re wearing their reseller hat, just as their salespeople need different things from those vendors than their technicians do. The partner program Barracuda modernized in March and updated last month reflects that fact by embedding resources for multiple user “personas.”

So does the program Sophos introduced last summer to support its 25,000 hugely varied global partners. “The way you enable an MSP looks very different than the way you enable a reseller, and the way you enable a very large partner like a CDW looks very different than the way you enable a smaller partner,” Bell (pictured) says, “so we do much more persona segmentation than we used to.”

Barracuda emphasizes differentiation not just in how it interacts with partners, moreover, but in how it markets them to end users as well. The newest iteration of its certification program features a deeper set of technical and sales badges that will help members distinguish themselves from similar peers and inform how a forthcoming partner locator tool farms out sales leads.

“That partner locator can really help customers and salespeople find the right partner for the right task in the right location, right vertical, etc.,” Hodges says.

Bell, meanwhile, pushes back a little on the idea that partners want more contact from a vendor’s people and less from their agents.

“Actually, what we hear is, ‘I want to hear less from you. I want more self-service tools. I want to be able to leverage AI to do more things on my own,’” he says. “We’re trying to put more control in our partners’ hands because that’s what they’re telling us.”

So is Barracuda, which plans to extend Bailey, the omnipresent AI assistant on the company’s website, to its partner portal as well. The results, according to Hodges, will be faster answers to basic questions and more time for the deeper business conversations that she, Bell, and the experts I consulted for my recent vendor sat story all say partners want more of.

“We get a chance to talk to 5,500 MSPs,” Hodges notes. “What do we know? What are we learning? Where do we see growth opportunities?” That kind of thought leadership and innovation advice more than anything else, she contends, is the remedy to vendor and partner program satisfaction issues.

Subscribe now

Sophos and OpenAI double down

News worth exploring breaks shortly before my vendor interviews all the time. It’s rare for news to break during an interview, however.

And yet that’s very close to what happened during my Black Hat conversation with Bell, which took place roughly an hour after Sophos revealed a newly inked alliance pact with OpenAI designed to … Well, neither Bell nor Sophos, in its press release about the deal, went too deep into specifics except to suggest that the new agreement adds a dedicated focus on MSPs to a relationship initiated when Sophos joined the OpenAI Daybreak Cyber partner program two months ago. How that focus expresses itself in the marketplace is TBD.

“Is it a bundle that we meet in the channel with? Is it areas where we can embed [their large language models] into our products or areas where we can embed our products into their large language models?” Bell asks. “We’re still early in that infancy, but in our conversations we recognize that we’re both trying to solve the same use cases and outcomes for our end customers.”

The upshot of that recognition appears headed to include (my words, not Bell’s) some combination of deeper integration of OpenAI models within Sophos products, stronger protection of those models via Sophos’s recently introduced AI Defense solution, and joint go-to-market efforts aimed at helping both companies grow enterprise market share, something Sophos has been keen to do since its acquisition of Secureworks and OpenAI has been pushing hard on this year.

“You are going to hear a lot more,” Bell says.

Also worth noting

• Just two months after I told you that a16z-backed Treeline is in the market for MSPs, it’s acquired one, Los Angeles-based SugarShot.

• Shield Technology Partners parent Thrive Holdings has raised more than $2 billion of additional capital at a $12 billion valuation, bringing its total funds raised above $3 billion.

• Multi-tenant agent management is now available in the Microsoft 365 admin center.

• Just in time for the patch storm, CrowdStrike has expanded its Project QuiltWorks vulnerability discovery, prioritization, and remediation initiative to SMBs.

• SonicWall has launched SonicWall Endpoint Security, an endpoint protection offering for SMBs available either as a standalone product or as a fully managed MDR service.

• Blumira has launched Hearth, a vendor-agnostic AI command center that reasons across an organization’s existing security stack, logs, and external attack surface.

• ConnectSecure has added Microsoft 365 auto remediation and AI-powered training assessments to its platform.

• Nutanix has joined the MCP club. The hybrid cloud leader now has an open source MCP server for its Nutanix Cloud Platform.

• Auvik has promoted Daniel Ochoa from head of global sales to CRO.

• Channelscaler has launched Scaler Index, a benchmarking initiative designed to let partner leaders compare program performance and maturity.

New data from Ramp’s Ara Kharazian offers concrete evidence of something much discussed in the media lately: Open source AI models, like the one NVIDIA just released, really are making headway with corporate AI buyers. 6.1% of them were using one as of July, up from 5.9% in June and 4.5% in January.

Modest numbers to be sure, but rising, which is not true of OpenAI and Anthropic, Kharazian says:

“That’s not because new AI spenders are switching to open source / Chinese models (they most definitely are not doing that — first-time buyers on AI are still using the American model companies). But it means more of their growth will have to come from existing businesses spending on AI, particularly the advanced spenders, and those businesses are increasingly spending on open source.”

Cost is an important reason why, the post continues, noting that Anthropic’s performant but pricey Fable 5 model accounted for only 6% of tokens purchased from Anthropic last month. But ISC2’s France, perhaps with Fable 5 in mind, suggests that a second issue he calls the “AI kill switch” might have been a contributing factor too.

“If you’re relying on one of the big vendors for their hosted model, they can turn it off,” he observes. “They can be instructed to turn it off as well, and that may be a big problem for your business.”

Installing an open source model locally is an effective way to mitigate that risk, but it poses risks of its own if you don’t know where that model came from and whether or not it’s safe. No one would start uploading IP to a conventional business application without vetting it first, France notes.

“You should do the same for models and look at their lineage,” he says.

Sounds easy enough, but there’s a caveat. “Skilling to do that might be a bit of a challenge,” France says. Meaning that just as cyber skills generally are in short supply, so too are the skills required to confirm the safety of the same open source AI models rapidly gaining popularity in IT environments.

Share

News worth exploring breaks shortly before my vendor interviews all the time. It’s rare for news to break during an interview, however.

And yet that’s very close to what happened during my Black Hat conversation with Sophos SVP & GM of global partner ecosystem and corporate development Chris Bell, which took place roughly an hour after Sophos revealed a newly inked alliance pact with OpenAI designed to … Well, neither Bell nor Sophos, in its press release about the deal, went too deep into specifics except to suggest that the new agreement adds a dedicated focus on MSPs to a relationship initiated when Sophos joined the OpenAI Daybreak Cyber partner program two months ago. How that focus expresses itself in the marketplace is TBD.

“Is it a bundle that we meet in the channel with? Is it areas where we can embed [their large language models] into our products or areas where we can embed our products into their large language models?” Bell asks. “We’re still early in that infancy, but in our conversations we recognize that we’re both trying to solve the same use cases and outcomes for our end customers.”

The upshot of that recognition appears headed to include (my words, not Bell’s) some combination of deeper integration of OpenAI models within Sophos products, stronger protection of those models via Sophos’s recently introduced AI Defense solution, and joint go-to-market efforts aimed at helping both companies grow enterprise market share, something Sophos has been keen to do since its acquisition of Secureworks and OpenAI has been pushing hard on this year.

“You are going to hear a lot more,” Bell says.

I recently shared some theories as to why partner satisfaction with vendors has been slipping recently, and especially in the last year. One was that companies juggling 2.8 business models like MSP, reseller, and developer on average, according to IDC, dislike partner programs tuned to just one of those identities. Another was that partners notice when vendors replace human relationships with AI ones, and resent it.

Two recent conversations with channel chiefs at major security vendors have added some nuance to the picture.

Yes, says Michelle Hodges, SVP of global channels and alliances at Barracuda, most partners make money multiple ways these days, and Barracuda’s Partner Success Program recognizes it. “We don’t say this is a reseller and this is an MSP,” she notes. “We view them as a single entity.”

But not without variation. Partners want different things from vendors when they’re wearing their MSP hat than when they’re wearing their reseller hat, just as their salespeople need different things from those vendors than their technicians do. The partner program Barracuda modernized in March and updated last month reflects that fact by embedding resources for multiple user “personas.”

So does the program Sophos introduced last summer to support its 25,000 hugely varied global partners. “The way you enable an MSP looks very different than the way you enable a reseller, and the way you enable a very large partner like a CDW looks very different than the way you enable a smaller partner,” Sophos SVP & GM of global partner ecosystem and corporate development Chris Bell (pictured) says, “so we do much more persona segmentation than we used to.”

Barracuda emphasizes differentiation not just in how it interacts with partners, moreover, but in how it markets them to end users as well. The newest iteration of its certification program features a deeper set of technical and sales badges that will help members distinguish themselves from similar peers and inform how a forthcoming partner locator tool farms out sales leads.

“That partner locator can really help customers and salespeople find the right partner for the right task in the right location, right vertical, etc.,” Hodges says.

Bell, meanwhile, pushes back a little on the idea that partners want more contact from a vendor’s people and less from their agents.

“Actually, what we hear is, ‘I want to hear less from you. I want more self-service tools. I want to be able to leverage AI to do more things on my own,’” he says. “We’re trying to put more control in our partners’ hands because that’s what they’re telling us.”

So is Barracuda, which plans to extend Bailey, the omnipresent AI assistant on the company’s website, to its partner portal as well. The results, according to Hodges, will be faster answers to basic questions and more time for the deeper business conversations that she, Bell, and the experts I consulted for my recent vendor sat story all say partners want more of.

“We get a chance to talk to 5,500 MSPs,” Hodges notes. “What do we know? What are we learning? Where do we see growth opportunities?” That kind of thought leadership and innovation advice more than anything else, she contends, is the remedy to vendor and partner program satisfaction issues.

Subscribe now

Spend any time at all in the IT industry and you’ll quickly notice how freely we toss around the word “community.”

There’s the vendor community, for example, a collection of software and services companies prone both to mutually beneficial alliances and cutthroat competition. Then there’s the partner community, whose members so readily share the best of best practices with one another as to leave newcomers scratching their heads in amazement. And then, of course, there’s the channel community, where vendors, partners, and other stakeholders come together in pursuit of the common good.

I spent last week at three conferences in as many cities on two coasts exploring the interplay between AI and community. MCP and its implications for the channel community are a good place to begin discussing what I heard.

In theory, the open exchange of data made possible by MCP is very much in the interest of the channel community. In reality, whether or not the vendor community will see it that way is still in question. Steve Petryschuk, VP of product and market strategy at network management vendor Auvik, thinks it very well might, both because MSPs want it to and because software makers know it.

“As far as I can tell, most of the vendors within the MSP community understand that a rising tide raises all ships, and so if we collaborate we can grow our businesses together,” he says.

On the other hand, he continues, “that’s a very positive outlook on things, and I’m not sure that I’ve always been the most positive person.” Vendors are profit-driven entities with a history of preferencing control over cooperation.

“I think we’ll have to see how it plays out,” Petryschuk says.

So far, so good from what I can see. N-able launched an MCP server in April, and while fellow vendors may one day have to pay for access to Kaseya’s recently introduced MCP server, it will only be enough to help cover infrastructure costs.

Syncro (as savvy Channelholic readers like you now know days ahead of everyone else) will join the club this Tuesday as well in an especially big way based on a similar reading of market demand.

“We believe that MCP and extensibility are going to become a buying criteria,” explains Dee Zepf (pictured), the company’s chief product officer.

Syncro has a particular kind of extensibility in mind, however. To ensure users (and Syncro itself) retain control over their data, the company will provide access to MCP data exclusively through ChatGPT, Claude, Copilot, and the like, which will serve as ersatz integration hubs for entire MSP tool stacks. Say I use Syncro for RMM and PSA and Hudu for documentation.

“I would connect to my Hudu instance from Claude and I would connect to my Syncro instance from Claude,” Zepf says. “You’re not actually connecting Hudu to Syncro. You’re just connecting them both to Claude, and then Claude is stitching them together for you.”

Which raises a second question. Let’s stipulate that everyone wants to consume data via MCP. How do they want to consume it? Syncro believes its partners should make that choice, but its integration strategy implies a prediction for what they’ll choose. MSPs, the company believes, will eventually find the convenience of talking to an LLM on their phone when they need to close a ticket on a Sunday afternoon irresistible.

“You just need a few words of natural language and you’re back to whatever you were doing,” Zepf says. “It’s a new way to work.”

And a better one, Syncro contends, than relying on an embedded chatbot in an RMM or PSA solution. “You’re a little bit at the mercy of the vendor that puts the copilot in their product, how much they want to charge you for it, what its limitations are, what it does, which models it uses behind the scenes, and how often those models get updated,” Zepf says.

Ingram Micro thinks partners want LLM access to data too and introduced an MCP server last week to make that possible. Houston-based MRE Consulting, which helped beta test the system, likes ordering through the distributor’s Xvantage platform, and likes using the Xvantage Integration Hub to transact directly through its HaloPSA implementation even more. “That substantially sped up our quoting process,” says Zach Esmond, MRE’s director of strategic partnerships. The MCP link, though, has further accelerated ordering speed “exponentially,” he adds.

Auvik, whose MCP server is in private beta now and due to go GA in the fall, suspects most MSPs will have the same experience and similarly prefer to use someone else’s interface to connect with its solution. It also isn’t the slightest bit worried about it. Users have been accessing its network data through their PSA system for years.

“If that switches to Claude or to OpenAI or something else, I’m actually not all that concerned for Auvik’s sake,” Petryschuk says. “We’re still going to be that source of truth for the network.”

If anyone’s vote counts in this matter, though, it’s got to be Slide’s, right? The backup vendor introduced its first AI-native MCP interface a year ago, ahead of pretty much any other vendor serving MSPs.

“Since then, a lot of that capability has actually become main code and moved into the product itself,” reports Carlson Choi, the vendor’s COO. And that’s generally where users want it too, he adds. Only about 5-10% of Slide’s roughly 1,000 MSP partners are taking advantage of the option to connect with backup data from inside LLM chatbots, and they tend to be large companies with sophisticated, deeply bespoke tool stacks.

That’s consistent with what Syncro’s seeing too for the moment, according to Zepf, but it won’t be long, she predicts, before large MSPs aren’t the only ones with sophisticated, deeply bespoke tool stacks.

“MCP is making that more approachable for folks downstream,” she says. “It’s like an API 2.0, but it’s easier to use and consume than an API.”

Syncro goes native

It’s a measure of just how deeply convinced Syncro is that MSPs will eventually do most of their RMM and PSA work via LLMs that it’s created a connector for Claude and applied to have it listed in Anthropic’s official directory. And on Tuesday the world will learn something else that Channelholic readers already know, which is that Anthropic has accepted the application.

“We show up as a native connector,” says Syncro CEO Michael George (pictured). As far as I can tell, that’s a first for an RMM/PSA vendor and one that puts Syncro alongside names like Slack, QuickBooks, Docusign, and Dropbox.

There’s more to the news than just the connector, too. “We’re coming out with a plug-in and a set of prebuilt skills,” Zepf says.

All of which is a bit of a departure from Syncro’s previously stated intention to go all-in on Microsoft in cloud, security, and beyond. Hard to blame the company for diversifying its bets, though, given that while Microsoft remains a player in AI (Copilot seats grew an impressive 50% from 20 million to 30 million just in the last quarter) Anthropic is an even hotter one, with more revenue in the last 12 months than Starbucks, McDonald’s, and Taco Bell owner Yum! Brands.

Of course, betting on Microsoft, Anthropic, or anyone else in AI only makes sense for an MSP toolmaker in conjunction with a service desk automation roadmap, and Syncro’s other major announcement on Tuesday will be the launch of its first AI-powered ticket triage and dispatch solution. It will join a ticket summarization system introduced about six weeks ago that has improved time to action on technical issues by 10% on average, according to Syncro. Both features will be accompanied in September by a “guided ticket resolution” feature that the company projects will resolve 20% of tickets autonomously.

Competitors are claiming bigger achievements in that area, but aren’t leaning into chatbot integration as heavily as Syncro. We’re about to learn just how much MSPs value the ability to do their AI-accelerated managed services work through the same AI interface they use for everything else.

Follow Me on LinkedIn

How the rich get richer

The answers to questions like that matter, according to George, and not just to vendors like Syncro. In the not too distant past, he says, security know-how was what most separated the fastest growing MSPs from the herd. In the increasingly imminent future, it will be AI.

“All of these technologies—these frontier models, the adoption of agent-based solutions, MCP—will be the fastest separator and the greatest separator this industry has ever seen,” George predicts.

If he’s right, it’ll be AI-forward giants like New Charter and Integris along with AI-native newcomers like Shield, Titan, and Treeline that benefit the most. Indeed, such companies are already using in-house expertise smaller peers don’t have and can’t afford to build sophisticated, AI-enabled operating environments, according to Slide’s Carlson, who notes that those are the MSPs in that 5-10% of Slide’s partner base using MCP to access data directly from their own heavily customized tools.

“Some of these folks don’t even necessarily use our interface,” Carlson says. “They’ve built their own entire monitoring dashboard across all of their products.”

The largest of them enjoy other advantages too, as I learned last week in a conversation with Ben Bernstein (pictured), manager of the cybersecurity advisors unit at Huntress, during the Black Hat conference in Las Vegas. There are three advisors in North America at present, each of whom provides direct, expert advice to about 10 of the continent’s biggest MSPs. Helping those companies be “a little bit quicker and a little bit more efficient,” Bernstein says, is the core of his team’s mission.

Kaseya and ConnectWise are paying closer attention to the needs of the biggest MSPs these days too, and for the same reason their MSP partners pay extra attention to their biggest clients—they spend more than everyone else. How much spending more and therefore getting more from strategic vendors revs up the AI flywheel already distancing mega MSPs from everyone else is still TBD. Stands to reason it will help though.

Lexful’s SaaSpocalypse insurance

I contributed to the SaaSpocalypse earlier this year.

As I mentioned some months back, I use a vibe-coded app written in Claude Code to run Channelholic’s editorial calendar. It costs me nothing to operate and serves my needs far better than the jerry-rigged Airtable system I’d been using previously.

So I canceled my Airtable subscription.

Which means I’m one small part of a series of events resulting in Airtable’s shocking decision last week to sell most of the company to Bending Spoons, the tech industry scrapyard purveyor currently wringing a few last remaining drops of value out of such once promising ventures as Vimeo, Evernote, and AOL.

What’s to stop companies more familiar to MSPs from the same fate? I suggested strength in risk mitigation and subject matter focus in a March post that would reference relationships too if I had it to write over again. Lexful, the AI-era system of record startup you last read about in February, is betting on the focus part of that equation for reasons best illustrated by something CEO Pinar Ormeci (pictured) experienced recently when she asked Anthropic’s cutting-edge Claude Fable 5 model to produce a dashboard for her showing daily active users, subscriber totals, and other critical metrics.

The result she got back was impressive, so she showed it to her head of operations, who soon asked her a question she couldn’t answer: where did that tenant count come from? Because it takes an API call into Lexful’s application to get that, and Fable doesn’t have API access.

Which didn’t slow the model down for a moment. It just made something up.

The problem, according to Ormeci, is that Claude is both eager to please and knowledgeable about everything except the all-important specifics that define you and your business. “The context window is simply too big for it not to hallucinate, or for you to trust that it will not hallucinate,” she says.

Narrower context alone won’t fix the problem, though. AI needs more than just MSP-specific data to give help desk technicians accurate answers. It needs clean, consistent, structured MSP-specific data, and if you don’t supply it, as we’ve just seen, it’ll fabricate something that looks right but isn’t.

Which poses an obvious problem for any MSP using LLMs to automate their help desk. “They’re not going to tell you we couldn’t find it or your data isn’t structured enough,” Ormeci says. “They’ll just give you very confident answers.” And it’ll be up to your technicians to determine if that confidence is warranted.

“Before they were wasting time searching for stuff,” Ormeci says. “Now they’re going to have to keep validating everything the AI is giving them, because you can’t trust anything that it’s saying.”

Which is why Ormeci isn’t worried about becoming the next Airtable. “You have to have a trusted structured knowledge foundation for AI to properly work,” she says. “That’s the fundamental problem that we are solving.”

Venture investors aren’t worried about Lexful becoming a SaaSpocalypse victim either, apparently. Two in particular, Top Down Ventures and York IE, recently committed $7 million of seed funding to the company, whose solution became generally available last week following a phased, multi-month test rollout.

“Our adoption numbers are not public, but I can tell you this: we have hundreds of MSPs in our ecosystem, either as customers or in our pipeline,” says Ormeci. How many more she’ll get in the months ahead depends on how trustworthy Lexful’s structured MSP data turns out to be.

Share

GTIA says it’s lead or be led for the channel community

Let’s return to the channel community. One of the events I attended last week was GTIA’s annual ChannelCon show, a particular favorite of mine, in part because it’s the purest, least biased and agenda-driven expression of the channel community in action.

“It is the neutral ground where this industry comes together, takes on challenges, talks about challenges, and works together to better the entire industry,” says Dan Wensley (pictured), the association’s CEO. It’s also, as two major announcements the organization made last week underscore, an evidence source of growing maturity in the industry.

Wensley is a long-time executive at vendors serving the MSP community. MJ Shoer, GTIA’s chief community officer, is a former MSP. It took decades for them and people like them to accumulate the skills and experience necessary to recognize an opportunity to split CompTIA’s training business off from its community functions, sell the training part to private equity, turn the proceeds of that sale into a sizable endowment for a new community-only nonprofit, and begin using the endowment to accomplish tasks community members have long wanted to achieve but couldn’t.

Like establishing industry regulations. Competent MSPs have long been frustrated by incompetent, unprofessional peers giving their trade a bad name. If doctors, lawyers, and hair stylists, for goodness’ sake, have to meet qualifying criteria before going into business, why shouldn’t people responsible for securing and maintaining the IT foundation that makes all business possible be required to as well?

They’re not the only ones asking that question, either, per an article I wrote for ChannelPro nearly six years ago. State and local governments are as well. And whatever you think about state and local governments, let’s agree that they don’t know as much about managed services as managed service providers. Maybe MSPs rather than elected officials should be the ones to define what it takes to call yourself an MSP.

Groups like the National Society of IT Service Providers certainly think that should be the case. GTIA is now pursuing that goal as well.

“We’ve had these conversations for years, if not decades, about anybody being able to hang out a shingle and call themselves an MSP,” Wensley says. “Now we have to do it, or it will be thrust upon us.”

Shoer agrees. Regulations are coming one way or the other. “If we don’t act, the government eventually will act, and it probably won’t be good for the industry,” he says. “We either lead it or we get led by it.”

GTIA has opted to lead, and to do so in a way that takes the kind of resources its endowment makes possible. Starting in October, it will begin working with a group at Texas A&M University toward creating a self-regulatory organization, a managed services equivalent to independent but legally empowered groups like the American Medical Association, the American Bar Association, and the financial services industry’s FINRA. It will be a complex undertaking, but one that Texas A&M has successfully completed before for other industries.

“They have the knowledge, they have the skill set, they have the resources, they have a school of law, they have a school of government,” Shoer says. “They’re uniquely positioned.” But they don’t work for free.

“We need to pay Texas A&M to do the work,” he says. And there’s pretty much no one in the industry outside of GTIA that can both afford those fees and give everyone affected by that work a chance to participate in it.

“Because we are a trade association, every GTIA member will have a seat at the table,” Shoer says. “We’re ensuring that every organization gets access to the work early and has the opportunity to provide input so that it truly is representative of what the industry not only needs but wants.”

Same goes for another long-standing and closely related need in managed services: objective, enforceable standards, and more specifically, standards for delivering AI services. The new Managed Intelligence Alliance GTIA is standing up will define those both for and with those affected by them.

“The alliance itself, those members who participate in its formation, will set what’s the priority,” Wensley says. “Our job here is to support it both financially and structurally, and that’s what the board is committed to do.”

Again, it won’t be easy and it won’t be cheap. “GTIA is making a significant investment in this,” Shoer says, including by hiring an experienced, full-time director for the alliance.

Which, of course, is the kind of thing a mature industry represented by a mature industry association with some financial heft should do.

Want to hear more from Wensley and Shoer?

They both took time out to speak with us on MSP Chat, the podcast I co-host. You’ll find that episode here and a whole bunch of other equally good, IMO, episodes here.

IT By Design helps MSPs eat the AI elephant

I called GTIA the managed services world’s purest expression of community just now. I was wrong. The purest expression of community in managed services is when managed service providers tell other managed service providers about their biggest business challenges.

“They’re going to tell you an honest answer of how to fix it,” says Ahmed Fadili (pictured), chief strategy officer of Boston-based MSP Focus Technology, even if it means sharing the recipe to the secret sauce driving their own success.

I’ve witnessed this dynamic before and got to do so again last weekend at a pre-day mastermind session hosted by IT By Design at its annual Build IT Live event in Jersey City, N.J., where a couple dozen MSPs, most of them strangers to one another, spoke frankly about the biggest business challenge facing MSPs in general right now: devising and executing an AI strategy.

“Customers are asking questions about AI. They’re expecting us to know AI,” Fadili says. “It’s something that we have to deliver on.”

Because, of course, those customers are searching for answers with or without help from their current provider. “They’re doing it themselves by building an in-house team or they’re hiring an AI-native MSP or AI company to do that,” says Sunny Kaila, IT By Design’s CEO. “It’s happening. It’s just you don’t know.”

And the fact that you couldn’t provide AI help to someone who asked for it is limiting the enterprise value of your business. Everyone knows that acquirers look carefully at EBITDA when evaluating MSPs, Kaila says. “What they’re not aware of is that there are other strategic plans that they can put in place to exponentially increase their enterprise value.”

Meaning strategic AI plans, of course, and life would be a lot easier for MSPs if creating them was as easy as wishing to. Unfortunately, for reasons both Pax8 and Fadili both well understand, it takes time.

“It’s not just something that you can create really quick,” Fadili says. “AI right now is a journey.”

For the client as well as their MSP, he adds, noting that Focus is assigning virtual chief AI officers to its customers to guide them through that journey while both parties figure it out together. This typically begins with an evaluation of the client’s AI maturity level, Fadili says. Kaila encourages all MSPs to do the same.

“Everything starts with the assessment,” he argues, before proceeding to governance, security, training, and eventually workflow automation. “It’s crawl, walk, run,” Kaila says.

Fadili shared part of his secret sauce recipe for navigating that progression with the Build IT Live mastermind group. Rather than treat AI preparation as a series of one-off projects, Focus sells it as a 12-month readiness engagement billed at flat monthly rates and followed by ongoing solution design, delivery, and management. That turns AI transformation into an operating rather than capital expense for the client and eases them through the AI journey gradually.

“How do you eat an elephant? One bite at a time,” Fadili says, noting that each bite is recurring revenue that strengthens the relationship between the customer and their trusted advisor.

Which, from Kaila’s perspective, is key. Embracing AI is at least as much a human-to-human story as an agent-to-agent story, he says, and always will be.

“We are in a people business, and that does not change with AI,” he says.

Subscribe now

Over on The Business of Tech

Host Dave Sobel has thoughts from high-growth MSP Blue Mantis about AI readiness, security, and more. Hear what’s working and what’s not straight from CEO Josh Dinneen right here, and a lot of other enlightening episodes here.

Also worth noting

• This story broke literally as I was interviewing Sophos channel chief Chris Bell at Black Hat: Sophos is partnering with OpenAI to bring frontier AI into cybersecurity products and services delivered through the channel. More to come.

• The new Managed ESPM service from Huntress is designed to make application control and proactive endpoint hardening practical for MSPs and lean IT teams.

• ConnectWise and SentinelOne are deepening their integration and partnering to deliver more automated, AI-powered managed cybersecurity capabilities to MSPs through the ConnectWise platform.

• ESET has AI agent security, AI behavioral monitoring, and AI conversation security coming at the end of next month.

• Cynomi and SPECTRA are partnering to help MSPs and MSSPs combine vCISO-driven security assessments and remediation with security warranties and cyberinsurance benefits.

• Coro and Keepit have partnered to integrate Keepit’s SaaS data-protection capabilities into the Coro cybersecurity platform.

• Cato’s new Agentic Threat Prevention service uses AI agents and unified network/security context to predict multi-stage AI-assisted threats and stymie their progress.

• CrowdStrike’s 2026 Threat Hunting Report adds nuance to a widely discussed topic, calling AI a “tool, target, and force multiplier for adversaries.”

• AvePoint’s new Kinetic Classification feature continuously adjusts sensitivity based on content, context, identity, and activity to help organizations govern data as they expand their use of AI.

• Arctic Wolf has launched a cyber resilience service that combines SOC services with enhanced financial protection and incident-response support plus a new Cyber AI Readiness Accelerator.

• SailPoint’s expanded unified identity security approach is designed to govern and protect human, machine, and AI identities through adaptive controls that combine identity, security, and data intelligence.

• Proofpoint’s new OEM program enables technology providers, security vendors, MSPs, and platform companies to embed threat intelligence and detection capabilities into their own products and customer workflows.

• Sumo Logic’s newly introduced Dojo AI agents strive to autonomously investigate and resolve security and cloud-operations issues using telemetry data.

• CORE, a new AI era managed services offering from mega mega MSP Integris, combines IT ops, cybersecurity, cloud, data, AI, and strategic guidance on one bill. More coming to Channelholic soon.

• Hatz AI’s new Hatz Activate offering is a command center that lets MSPs identify, invite, activate, and manage SMB AI customers at scale.

• Atera has achieved ISO/IEC 42001 certification for its AI management systems.

• Paul Constantine is the new chief engagement officer at channel consultancy JSG.

I recently called GTIA the managed services world’s purest expression of community. I was wrong. The purest expression of community in managed services is when managed service providers tell other managed service providers about their biggest business challenges.

“They’re going to tell you an honest answer of how to fix it,” says Ahmed Fadili (pictured), chief strategy officer of Boston-based MSP Focus Technology, even if it means sharing the recipe to the secret sauce driving their own success.

I’ve witnessed this dynamic before and got to do so again last weekend at a pre-day mastermind session hosted by IT By Design at its annual Build IT Live event in Jersey City, N.J., where a couple dozen MSPs, most of them strangers to one another, spoke frankly about the biggest business challenge facing MSPs in general right now: devising and executing an AI strategy.

“Customers are asking questions about AI. They’re expecting us to know AI,” Fadili says. “It’s something that we have to deliver on.”

Because, of course, those customers are searching for answers with or without help from their current provider. “They’re doing it themselves by building an in-house team or they’re hiring an AI-native MSP or AI company to do that,” says Sunny Kaila, IT By Design’s CEO. “It’s happening. It’s just you don’t know.”

And the fact that you couldn’t provide AI help to someone who asked for it is limiting the enterprise value of your business. Everyone knows that acquirers look carefully at EBITDA when evaluating MSPs, Kaila says. “What they’re not aware of is that there are other strategic plans that they can put in place to exponentially increase their enterprise value.”

Meaning strategic AI plans, of course, and life would be a lot easier for MSPs if creating them was as easy as wishing to. Unfortunately, for reasons both Pax8 and Fadili both well understand, it takes time.

“It’s not just something that you can create really quick,” Fadili says. “AI right now is a journey.”

For the client as well as their MSP, he adds, noting that Focus is assigning virtual chief AI officers to its customers to guide them through that journey while both parties figure it out together. This typically begins with an evaluation of the client’s AI maturity level, Fadili says. Kaila encourages all MSPs to do the same.

“Everything starts with the assessment,” he argues, before proceeding to governance, security, training, and eventually workflow automation. “It’s crawl, walk, run,” Kaila says.

Fadili shared part of his secret sauce recipe for navigating that progression with the Build IT Live mastermind group. Rather than treat AI preparation as a series of one-off projects, Focus sells it as a 12-month readiness engagement billed at flat monthly rates and followed by ongoing solution design, delivery, and management. That turns AI transformation into an operating rather than capital expense for the client and eases them through the AI journey gradually.

“How do you eat an elephant? One bite at a time,” Fadili says, noting that each bite is recurring revenue that strengthens the relationship between the customer and their trusted advisor.

Which, from Kaila’s perspective, is key. Embracing AI is at least as much a human-to-human story as an agent-to-agent story, he says, and always will be.

“We are in a people business, and that does not change with AI,” he says.

Subscribe now

I spent last week at three conferences in as many cities on two coasts exploring the interplay between AI and community. One of them was GTIA’s annual ChannelCon show, a particular favorite of mine, in part because it’s the purest, least biased and agenda-driven expression of the channel community in action.

“It is the neutral ground where this industry comes together, takes on challenges, talks about challenges, and works together to better the entire industry,” says Dan Wensley (pictured), the association’s CEO. It’s also, as two major announcements the organization made last week underscore, an evidence source of growing maturity in the industry.

Wensley is a long-time executive at vendors serving the MSP community. MJ Shoer, GTIA’s chief community officer, is a former MSP. It took decades for them and people like them to accumulate the skills and experience necessary to recognize an opportunity to split CompTIA’s training business off from its community functions, sell the training part to private equity, turn the proceeds of that sale into a sizable endowment for a new community-only nonprofit, and begin using the endowment to accomplish tasks community members have long wanted to achieve but couldn’t.

Like establishing industry regulations. Competent MSPs have long been frustrated by incompetent, unprofessional peers giving their trade a bad name. If doctors, lawyers, and hair stylists, for goodness’ sake, have to meet qualifying criteria before going into business, why shouldn’t people responsible for securing and maintaining the IT foundation that makes all business possible be required to as well?

They’re not the only ones asking that question, either, per an article I wrote for ChannelPro nearly six years ago. State and local governments are as well. And whatever you think about state and local governments, let’s agree that they don’t know as much about managed services as managed service providers. Maybe MSPs rather than elected officials should be the ones to define what it takes to call yourself an MSP.

Groups like the National Society of IT Service Providers certainly think that should be the case. GTIA is now pursuing that goal as well.

“We’ve had these conversations for years, if not decades, about anybody being able to hang out a shingle and call themselves an MSP,” Wensley says. “Now we have to do it, or it will be thrust upon us.”

Shoer agrees. Regulations are coming one way or the other. “If we don’t act, the government eventually will act, and it probably won’t be good for the industry,” he says. “We either lead it or we get led by it.”

GTIA has opted to lead, and to do so in a way that takes the kind of resources its endowment makes possible. Starting in October, it will begin working with a group at Texas A&M University toward creating a self-regulatory organization, a managed services equivalent to independent but legally empowered groups like the American Medical Association, the American Bar Association, and the financial services industry’s FINRA. It will be a complex undertaking, but one that Texas A&M has successfully completed before for other industries.

“They have the knowledge, they have the skill set, they have the resources, they have a school of law, they have a school of government,” Shoer says. “They’re uniquely positioned.” But they don’t work for free.

“We need to pay Texas A&M to do the work,” he says. And there’s pretty much no one in the industry outside of GTIA that can both afford those fees and give everyone affected by that work a chance to participate in it.

“Because we are a trade association, every GTIA member will have a seat at the table,” Shoer says. “We’re ensuring that every organization gets access to the work early and has the opportunity to provide input so that it truly is representative of what the industry not only needs but wants.”

Same goes for another long-standing and closely related need in managed services: objective, enforceable standards, and more specifically, standards for delivering AI services. The new Managed Intelligence Alliance GTIA is standing up will define those both for and with those affected by them.

“The alliance itself, those members who participate in its formation, will set what’s the priority,” Wensley says. “Our job here is to support it both financially and structurally, and that’s what the board is committed to do.”

Again, it won’t be easy and it won’t be cheap. “GTIA is making a significant investment in this,” Shoer says, including by hiring an experienced, full-time director for the alliance.

Which, of course, is the kind of thing a mature industry represented by a mature industry association with some financial heft should do.

Share

Want to hear more from Wensley and Shoer?

They both took time out to speak with us on MSP Chat, the podcast I co-host. You’ll find that episode here and a whole bunch of other equally good, IMO, episodes here.

I contributed to the SaaSpocalypse earlier this year.

As I mentioned some months back, I use a vibe-coded app written in Claude Code to run Channelholic’s editorial calendar. It costs me nothing to operate and serves my needs far better than the jerry-rigged Airtable system I’d been using previously.

So I canceled my Airtable subscription.

Which means I’m one small part of a series of events resulting in Airtable’s shocking decision last week to sell most of the company to Bending Spoons, the tech industry scrapyard purveyor currently wringing a few last remaining drops of value out of such once promising ventures as Vimeo, Evernote, and AOL.

What’s to stop companies more familiar to MSPs from the same fate? I suggested strength in risk mitigation and subject matter focus in a March post that would reference relationships too if I had it to write over again. Lexful, the AI-era system of record startup you last read about in February, is betting on the focus part of that equation for reasons best illustrated by something CEO Pinar Ormeci (pictured) experienced recently when she asked Anthropic’s cutting-edge Claude Fable 5 model to produce a dashboard for her showing daily active users, subscriber totals, and other critical metrics.

The result she got back was impressive, so she showed it to her head of operations, who soon asked her a question she couldn’t answer: where did that tenant count come from? Because it takes an API call into Lexful’s application to get that, and Fable doesn’t have API access.

Which didn’t slow the model down for a moment. It just made something up.

The problem, according to Ormeci, is that Claude is both eager to please and knowledgeable about everything except the all-important specifics that define you and your business. “The context window is simply too big for it not to hallucinate, or for you to trust that it will not hallucinate,” she says.

Narrower context alone won’t fix the problem, though. AI needs more than just MSP-specific data to give help desk technicians accurate answers. It needs clean, consistent, structured MSP-specific data, and if you don’t supply it, as we’ve just seen, it’ll fabricate something that looks right but isn’t.

Which poses an obvious problem for any MSP using LLMs to automate their help desk. “They’re not going to tell you we couldn’t find it or your data isn’t structured enough,” Ormeci says. “They’ll just give you very confident answers.” And it’ll be up to your technicians to determine if that confidence is warranted.

“Before they were wasting time searching for stuff,” Ormeci says. “Now they’re going to have to keep validating everything the AI is giving them, because you can’t trust anything that it’s saying.”

Which is why Ormeci isn’t worried about becoming the next Airtable. “You have to have a trusted structured knowledge foundation for AI to properly work,” she says. “That’s the fundamental problem that we are solving.”

Venture investors aren’t worried about Lexful becoming a SaaSpocalypse victim either, apparently. Two in particular, Top Down Ventures and York IE, recently committed $7 million of seed funding to the company, whose solution became generally available last week following a phased, multi-month test rollout.

“Our adoption numbers are not public, but I can tell you this: we have hundreds of MSPs in our ecosystem, either as customers or in our pipeline,” says Ormeci. How many more she’ll get in the months ahead depends on how trustworthy Lexful’s structured MSP data turns out to be.

Share

It’s a measure of just how deeply convinced Syncro is that MSPs will eventually do most of their RMM and PSA work via LLMs that it’s created a connector for Claude and applied to have it listed in Anthropic’s official directory. And on Tuesday the world will learn something that Channelholic readers already know, which is that Anthropic has accepted the application.

“We show up as a native connector,” says Syncro CEO Michael George (pictured). As far as I can tell, that’s a first for an RMM/PSA vendor and one that puts Syncro alongside names like Slack, QuickBooks, Docusign, and Dropbox.

There’s more to the news than just the connector, too. “We’re coming out with a plug-in and a set of prebuilt skills,” says Dee Zepf, Syncro’s chief product officer.

All of which is a bit of a departure from Syncro’s previously stated intention to go all-in on Microsoft in cloud, security, and beyond. Hard to blame the company for diversifying its bets, though, given that while Microsoft remains a player in AI (Copilot seats grew an impressive 50% from 20 million to 30 million just in the last quarter) Anthropic is an even hotter one, with more revenue in the last 12 months than Starbucks, McDonald’s, and Taco Bell owner Yum! Brands.

Of course, betting on Microsoft, Anthropic, or anyone else in AI only makes sense for an MSP toolmaker in conjunction with a service desk automation roadmap, and Syncro’s other major announcement on Tuesday will be the launch of its first AI-powered ticket triage and dispatch solution. It will join a ticket summarization system introduced about six weeks ago that has improved time to action on technical issues by 10% on average, according to Syncro. Both features will be accompanied in September by a “guided ticket resolution” feature that the company projects will resolve 20% of tickets autonomously.

Competitors are claiming bigger achievements in that area, but aren’t leaning into chatbot integration as heavily as Syncro. We’re about to learn just how much MSPs value the ability to do their AI-accelerated managed services work through the same AI interface they use for everything else.

Follow Me on LinkedIn

Where there’s mystery, a familiar saying goes, there’s margin. By that logic, there’s a whole lot of margin to be had in AI pricing. The question, however, is where and it’s an important one.

“The companies who figure out pricing and packaging the fastest will have a big edge in the early days of this AI phase shift,” wrote Altimeter Capital partner Jamin Ball earlier this year. “Price too low and you’re literally paying customers to use your product. Price too high and you lose to the competitor who figured it out first.”

He’s not the only SaaS investor pondering the topic either, nor are SaaS investors alone in thinking about it. SaaS companies are sorting through it as well. ServiceNow, for example, is transitioning from a traditional per-seat pricing scheme to a hybrid one combining a per-user subscription fee with consumption-based access to AI functionality.

There are plenty more examples where that one comes from, too, as vendors adjust to the reality that agentic functionality lets businesses get more done with fewer end user licenses while imposing unpredictable, potentially steep upstream LLM costs.

Nor does the hunt for new AI-native pricing strategies end with software makers. AI consultants, like the one we introduced you to here last week, are wrestling with the issue as well.

“People are experimenting with pricing all over the board,” says John Bush of Dallas-based consultancy wave4, who once priced a relatively simple client project involving an automated quoting and estimating tool at a flat $7,500. “He goes and talks to other vendors for that same use case and gets pitched a $10,000 a month minimum contract, and you have to sign for a year.”

From consultants to software companies to VCs, everyone, it seems, is searching for the right approach to AI pricing.

Except…

“Everybody that I talk to seems to be looking at this, except for maybe all the MSPs, who maybe are not,” says Omdia principal analyst Jessica C. Davis (pictured).

Well, some are. Per the results of a recent Omdia poll sent to 22,000 partners worldwide, 43% of MSPs are evaluating an alternative to user-based pricing and another 17% know they need to make a change but haven’t decided what kind. A full 40%, however, aren’t even thinking about modifying the per-user, per-month rates they’ve been charging for years. Davis, paraphrasing her Omdia colleague (and previous Channelholic interviewee) Robin Ody, likens that last disturbingly large cohort to a bunch of sightseers drifting toward Niagara.

“Our boat is headed towards the big waterfall and we’re going to go over the edge, but nobody’s figuring out what to do about it yet,” she says.

Which means, assuming Omdia’s numbers are right, that roughly four out of every 10 MSPs on Earth are about to get seriously wet. Say your average client has 35 employees suitable for per-user pricing at present. “That number will go down on average,” says Colin Knox, previously an MSP himself and currently CEO of billing management vendor Gradient MSP, until eventually your younger clients have 10, five, or even just one user to support.

It may not take as long as you think to get there, either. As you read here in June, Elliott Hyman, CEO of mega mega MSP Lyra Technology Group, is already serving “healthy growing businesses with declining headcount.”

Fewer users is just half of the problem too. Many MSPs, Knox observes on LinkedIn, base their per-user rates on how many hours they spend supporting a typical user. Multiply that number by what each hour costs you, add in some margin, and multiply the result by the number of users you support, and you end up with an MRR total. Except that AI reduces both the number and cost of the hours, by automating the help desk, and the number of users, by increasing customer productivity.

Hear that waterfall up ahead? It’s what researcher Luke Ronkowski of TSIA calls the MSP profit paradox: “the more value your AI delivers, the less you earn.”

Imperfect options

Alright, so maybe embracing a pricing model based on the tokens your AI consumes is the answer. A little over 30% of Omdia’s poll sample plans to do exactly that, either exclusively or in combination with a per-user base charge. Sounds simple, but it isn’t. For one thing, good luck forecasting what the AI will cost you.

“Token prices are falling fast, hardware efficiency improves every generation, and the mix of models you’re calling changes the math entirely,” Ball observes. Fix your rates at a number that doesn’t change even after OpenAI slashes prices on a model by 80% overnight and your growing margins will have trouble keeping up with your shrinking revenue as underpricing competitors lure your customers away.

“Really, I mean, it’s almost not worth reselling tokens,” says Duane Barnes (pictured), president of global managed cloud service provider RapidScale. “It’s very hard to make money.”

And risky to boot. “If the customer pays you late and you can’t pay Anthropic late, you’ve got a problem,” Barnes notes, which is why RapidScale credit checks customers before approving them for usage-based token pricing and has little patience for deadbeats.

“We’ll disconnect the account and pause all consumption while we wait for payment,” Barnes says. “And for good reason. Those dollars get big very fast.”

Better then, perhaps, to avoid per-user fees and per-token fees in favor of outcome-based pricing of the kind Fin, the customer service vendor formerly named Intercom, helped make famous in the years before Salesforce bought it in June. Most businesses, after all, like the sound of paying only for actual value versus potential value.

Except that too is simpler than it sounds, for reasons I explained a long while ago. Call center outcomes are easy to monetize. If the AI resolves your customer’s complaint, you pay. If it doesn’t, you don’t.

Managed service outcomes are harder. Will clients willingly pay you every time you close a ticket? Even if they don’t understand what the tickets are for? Or agree that you fixed the issue to their satisfaction every single time you close one? Besides, service desk automation software may be turning tickets into an endangered species, and alternative outcomes are even harder to track, validate, and bill for.

Plus, isn’t outcome-based pricing exactly the kind of non-recurring revenue model people are escaping when they become MSPs? “It almost sounds like break-fix pricing again to me,” Davis says. “It takes away the predictability of revenue for the MSP depending on how many users are having problems in a particular month versus not.”

Barnes prefers what he calls an “Accenture-esque model” in which RapidScale gets paid a percentage of what an AI solution saves its users. Here too, though, it helps to have experience most MSPs lack.

“We’ve done enough of these, many hundreds of them over the years, that we have a feel based on the type of company, the industry they’re in, and other companies we’ve done similar work with for roughly how much we think we can save them,” Barnes says. The price it derives from that estimate, though not designed to be outcome-based, arguably is.

“Did we accomplish the thing we jointly set out to accomplish with your teams? Yes or no?” Barnes asks. “If no, let’s figure out how it went wrong. If yes, great. Sign off and let’s work on the next project.”

Of course, most MSPs haven’t delivered hundreds of AI solutions and don’t yet know what kind of savings if any the solutions they’re starting to build now will provide. Which is why Davis advises them to experiment with pricing models while they gain experience and brace themselves for potentially expensive bumps and bruises in the months ahead.

“It’s going to be a learning time, and there’s going to be pain involved in it,” she says.

Follow Me on LinkedIn

Over on The Business of Tech

Host Dave Sobel recently spoke with Davis about AI pricing and other interesting topics at length. Check it out here and enjoy.

A direct line to Anthropic

One more note about RapidScale. In addition to being a managed cloud service provider with an Accenture-esque AI solution methodology, it’s also an Anthropic partner.

Which is an interesting thing to be mere months after the $100 million launch of the Claude Partner Network, and several additional months after Anthropic introduced MSPs to a whole new form of AI-related risk they need to manage.

That was when the AI giant (“for, I’m sure, very good reasons,” Barnes says) gave businesses transacting on the AWS Marketplace through an MSP 60 days to either cut the MSP out of that loop or replace them with an authorized reseller, a status RapidScale didn’t yet hold at the time.

“We had to act fast as we had a number of customers consuming Anthropic through the marketplace,” Barnes says. “They would have been shut off if we didn’t act, or at least advise them to go get a direct relationship with Anthropic.”

Instead, RapidScale joined longtime alliance partner AWS as a Claude Partner Network member. The specific benefits it’s been enjoying ever since are under NDA, but include preferred pricing, MDF eligibility, and early access to cutting-edge models.

“If you’re on the 5.1 model, we’re on the 5.3 model, typically a little bit ahead of everybody else,” Barnes says. The biggest benefit of all though, he continues, is the ability his team now enjoys to speak directly with Anthropic engineers.

“When we need help, when we have crazy ideas we want to bounce off them for trying new things, they’re very responsive,” Barnes says.

And “the best of the best in our experience,” he adds. That makes having a direct line to them a pretty serious advantage, obviously, as the folks at Shield Technology Partners (who have direct access to OpenAI engineers) can attest. That said, Barnes insists, no one should let the fact that they’re not on a short list of Anthropic service partners prevent them from building Claude into their AI practice.

“The customer can go pay their Anthropic bill directly,” he notes, while you make money developing, supporting, and securing Claude-based solutions, not to mention writing acceptable use policies for them and teaching people how to use them.

“There are a lot of things you can add value and do without ever reselling the license or Anthropic even knowing who you are as an MSP,” Barnes says.

And besides, if they don’t get those things from you, Anthropic itself might just step in to do the job for you.

Speaking of AI…

Remember IgnitHQ, the upstart, AI-native tool suite for MSPs I wrote about a few months back? Here’s your chance to hear its whole, very interesting story directly from founder and CEO Yaron Baitch on MSP Chat, the podcast I co-host. That episode is available here. Other, equally interesting episodes can be found here.

The problem isn’t what you sell, according to ThreatCaptain. It’s what you say.

Let’s put a great big generalization out there. Most MSPs are very good at service delivery, pretty good at security service delivery, OK at sales, and terrible at security sales.

Easy enough to see for yourself if you don’t believe that last part. Just ask the next 10 MSPs you speak with how many have never had a client refuse to buy even their minimum viable security service package. If you find one, I’d love to meet them.

According to ThreatCaptain, a security startup founded a little under three years ago, the issue isn’t that MSPs don’t know how to sell so much as that they don’t know what to say in a sales meeting that will actually break through with business owners.

“Typically what ends up happening is an MSP will explain what needs to be done, what the dangers are, and what the risks are, and then the client says, ‘So what?’” explains ThreatCaptain co-founder Adam Anderson (pictured).

Not because they don’t believe phishing and ransomware and autonomous agents skilled at breaking and entering exist, but because such things exist only as abstractions to cash-conscious decision makers.

ThreatCaptain’s software aims to make that abstraction concrete. Drawing on data breach cost statistics from sources like Verizon’s annual DBIR, frameworks like CIS and MITRE ATT&CK, and thousands of Monte Carlo simulations, the system (which was originally designed to help insurers model cyber risk) calculates how much financial damage a client would suffer after a successful attack. That, in turn, positions MSPs to have what Anderson calls a “normal, real” discussion with customers in plain, non-technical language about how much exposure they can stomach and what it would cost to stomach less.

“They have the leadership of their clients saying, ‘Well, I understand this is a $50,000 a month risk I’m carrying. I think I could probably deploy $15,000 a month to lower that. What can you do to help me?’” Anderson says. “Completely different conversation.”

That functionality, called First Mate and originally the whole of what ThreatCaptain offered, is now one of three modules in an expanded version of the solution. The second, named Anchor, helps MSPs find and research sales prospects. The third, called Admiral, is a “risk registry” system that draws on real-time threat intelligence to identify sales opportunities among existing customers. Say a report crosses the wires indicating that ransomware attacks on dentists are up 20% this year.

“Well, then we automatically have the ThreatCaptain risk registry look at the MSP’s customer base and identify all the dentists,” Anderson says.

Collectively, all three components form a platform offering “an all-in-one sales methodology backed up by software that guides MSPs, their salespeople, their sales engineers, and the consultants through that entire customer journey,” Anderson says.

First Mate and Anchor both enter general availability on August 3^rd. The former sells at $199 for 50 enriched leads a month, with more available at extra cost. The latter costs $599 a month. Admiral, due out in September, covers 10 clients for $399 a month, and users can add more clients on a pay as you go basis. Those are all easy sums to justify in Anderson’s view.

“The net impact of a platform that guides the conversation away from tech jargon and back to business outcomes and that is focused on salespeople and customer success people is that your MSP is going to sell more cybersecurity quicker,” he says. More revenue for you. Less risk for your clients.

Also worth noting

• Interesting: Acronis now offers a unified MSP workspace for protection, automation, and infrastructure, plus a new AI-powered autonomous service desk tool.

• Veeam Data Platform v13.1 offers broader hypervisor support, expanded malware scanning and cloud threat detection, and more.

• 1Password’s newly launched new Privileged Access tools is designed to eliminate standing privileges across human and AI identities.

• SonicWall is the latest security vendor with access to Claude Mythos 5 now that it’s been admitted to Anthropic’s Project Glasswing.

• Fortinet’s new FortiGate 1200G and FortiSASE Outpost aim to combine high-performance, ASIC-powered firewall protection with cloud-delivered SASE capabilities.

• Torq has shipped SOC Brain, an AI capability designed to give security operations teams contextual reasoning and autonomous decision-making.

• Abnormal AI has added identity threat protection, AI governance, and infiltration prevention to its Behavioral Security Platform.

• KnowBe4’s new simulated vishing capabilities are designed to help employees spot increasingly sophisticated voice-based social engineering attacks.

• Red Sift has added protection for Claude and ChatGPT Cowork to its email security platform.

• Checkmarx’s new Fusion Hybrid Scanning capability combines multiple application security testing methods to deliver more comprehensive vulnerability detection.

• Keyfactor is buying Cofide to add verified identities for AI agents and cloud workloads to its platform.

• BlackCloak’s deepfake protection now covers an executive user’s family members, advisors, assistants, caregivers, and other close contacts.

• The Qualys TotalAI platform can now discover, monitor, govern, and secure AI models, agents, MCP servers, and shadow AI deployments.

• Could be wrong, but I believe ThreatLocker’s a mere $11 million shy of a half billion in lifetime funding following the close of its new $190 million Series F round.

• 80% of breaches began with stolen identity in the first half of this year, but 27% involved SSL-VPN appliances, according to Cynet.

• Dell Private Cloud’s PowerStore storage now integrates with Nutanix Cloud Platform to deliver enterprise storage performance, automated deployment, and cyber resilience.

• Intune for MSP partner inforcer has closed a $50 million Series C funding round.

• Speaking of Intune, 81% of IT pros are thumbs up on Microsoft Intune yet 65% spend 6-15 hours a week on manual packaging, patching, and reporting, according to Recast.

• Mega mega MSP Omega Systems has a new CRO, COO, and CFO, plus three new VPs.

• Chris Malone is the new CEO and Conor Burns is the new CFO at Sumo Logic.

Let’s put a great big generalization out there. Most MSPs are very good at service delivery, pretty good at security service delivery, OK at sales, and terrible at security sales.

Easy enough to see for yourself if you don’t believe that last part. Just ask the next 10 MSPs you speak with how many have never had a client refuse to buy even their minimum viable security service package. If you find one, I’d love to meet them.

According to ThreatCaptain, a security startup founded a little under three years ago, the issue isn’t that MSPs don’t know how to sell so much as that they don’t know what to say in a sales meeting that will actually break through with business owners.

“Typically what ends up happening is an MSP will explain what needs to be done, what the dangers are, and what the risks are, and then the client says, ‘So what?’” explains ThreatCaptain co-founder Adam Anderson (pictured).

Not because they don’t believe phishing and ransomware and autonomous agents skilled at breaking and entering exist, but because such things exist only as abstractions to cash-conscious decision makers.

ThreatCaptain’s software aims to make that abstraction concrete. Drawing on data breach cost statistics from sources like Verizon’s annual DBIR, frameworks like CIS and MITRE ATT&CK, and thousands of Monte Carlo simulations, the system (which was originally designed to help insurers model cyber risk) calculates how much financial damage a client would suffer after a successful attack. That, in turn, positions MSPs to have what Anderson calls a “normal, real” discussion with customers in plain, non-technical language about how much exposure they can stomach and what it would cost to stomach less.

“They have the leadership of their clients saying, ‘Well, I understand this is a $50,000 a month risk I’m carrying. I think I could probably deploy $15,000 a month to lower that. What can you do to help me?’” Anderson says. “Completely different conversation.”

That functionality, called First Mate and originally the whole of what ThreatCaptain offered, is now one of three modules in an expanded version of the solution. The second, named Anchor, helps MSPs find and research sales prospects. The third, called Admiral, is a “risk registry” system that draws on real-time threat intelligence to identify sales opportunities among existing customers. Say a report crosses the wires indicating that ransomware attacks on dentists are up 20% this year.

“Well, then we automatically have the ThreatCaptain risk registry look at the MSP’s customer base and identify all the dentists,” Anderson says.

Collectively, all three components form a platform offering “an all-in-one sales methodology backed up by software that guides MSPs, their salespeople, their sales engineers, and the consultants through that entire customer journey,” Anderson says.

First Mate and Anchor both enter general availability on August 3^rd. The former sells at $199 for 50 enriched leads a month, with more available at extra cost. The latter costs $599 a month. Admiral, due out in September, covers 10 clients for $399 a month, and users can add more clients on a pay as you go basis. Those are all easy sums to justify in Anderson’s view.

“The net impact of a platform that guides the conversation away from tech jargon and back to business outcomes and that is focused on salespeople and customer success people is that your MSP is going to sell more cybersecurity quicker,” he says. More revenue for you. Less risk for your clients.

In security these days, there are platforms and then there are platforms.

Or so says Sophos, anyway. The older, more familiar ones of the kind MSPs know and love have long helped users consolidate vendor relationships, save money, and most importantly, achieve security outcomes no multi-vendor collection of point products could hope to match. The new kind, according to Sophos, updates those benefits in ways made mandatory by the speed and novelty of today’s AI-fueled threats.

You’ve read about the speed part of that here multiple times of late. “Threat actors are using AI to iterate unfamiliar tradecraft at a pace that used to take weeks,” said Alexandra Rose, currently head of global affairs, policy, and partnerships at Sophos and formerly chief operations officer at the NSA, during a recent press briefing. “You go from something that took a significant amount of time to something that they can iterate on in days, minutes, seconds.”

Those attacks are no longer isolated events most of the time either, she added. “They move across identity, email, endpoint, and network.”

You therefore can’t defend against them without “visibility that spans control points and a response capability fast enough to act inside the attacker’s window, not after it,” says Rob Harrison (pictured), SVP of product management at Sophos. “Waiting for a human to correlate signals across five different consoles no longer keeps pace.”

As for the novelty part of the new threat landscape, just ask OpenAI and Hugging Face.

“We hit this inflection point back in November of 2025,” observed Sophos CEO Joe Levy during that press briefing. “The frontier models advanced from rudimentary assistance to agents that now carry out multi-step work on their own.”

Indeed, just days ago, Cato described a lab experiment in which AI planned and executed a complete end-to-end attack chain in 40 minutes based on a single, simple prompt. Frontier models are getting both more creative and more autonomous in increasingly unnerving ways.

Which brings us to the recently unveiled Sophos Fusion. Sophos calls it an “AI-native cybersecurity defense system.” I call it a platform, albeit a next-gen, AI-era one featuring much, much closer and more powerful integrations than its predecessors Sophos Cloud and Sophos Central.

Because in security these days, there are integrations and then there are integrations.

The integration engine in Sophos Central, called Security Heartbeat, is a “signaling protocol,” according to Harrison, that lets individual products respond separately to threat detections anywhere in the suite. If the endpoint protection module, for example, spots a compromised device, the firewall automatically isolates it.

“Useful, but narrow,” Harrison says.

Fusion, by contrast, shares the underlying data itself. “Telemetry, detections, investigations, and response actions all draw from the same layer, so coordination happens at the level of investigation and reasoning, not just alert-passing,” Harrison explains.

Shared context and synchronized action, however, are just two of four attributes that in Sophos’s view make Fusion a system rather than collection of products. “Agentic autonomy with human governance” is the third, according to Raja Patel, the company’s president of product and marketing. “The system can investigate and respond on its own inside boundaries that our analysts set and continuously calibrate with people accountable for the output.” The fourth attribute, he adds, is Fusion’s continuous learning loop.

“Every threat seen across the more than 625,000 organizations we protect makes every other customer’s defense smarter,” Patel says.

All four characteristics are powered by AI, which Levy calls “the connective tissue that lets first- and third-party endpoint, firewall, email, cloud, network, and identity reason and act as one, so the whole becomes stronger than the sum of its parts.”

It’s a vision with obvious parallels to what other big names in security have been up to, and realizing it has been a pretty significant undertaking. But not, according to Harrison, a rip-and-replace operation. Like the AI-native platform ConnectWise unveiled last month, Fusion is a mostly but not entirely new version of its forerunner.

“It’s an architectural rebuild wrapped in a familiar front door,” Harrison says, meaning that “existing Sophos Central customers move across automatically, same login, no migration project.” But it’s also, he insists, more than just a version upgrade.

“The underlying architecture has changed significantly,” Harrison says.

Because yesterday’s architectures have grown ill-suited to today’s opportunities and threats. AI has the potential both to radically improve productivity for MSPs and to obliterate their clients. The key to enjoying the former while avoiding the latter is rethinking what platform must mean in the future.

Don’t blame AI for sliding partner program satisfaction

Back in March, I shared some then barely public research from GTIA that included a troubling fact: partner satisfaction with their vendors is declining.

Not to a degree worth panicking about, mind you. 74% of the partners GTIA surveyed called themselves satisfied with their vendors. But that’s down from 88% just a year earlier, and the percentage of partners describing themselves as very satisfied has dropped by more than half, from 39% to 18%.

The question, of course, is why, and GTIA can’t say conclusively yet. Carolyn April, the group’s vice president of research and market intelligence, has a hypothesis though, and it touches on vendor partner programs.

“It’s about alignment and the changes that are going on in the marketplace today with AI,” she says. “The types of priorities that are important to [IT solution providers] and the things they want to see in a partner program, for instance, they’re different now.”

I’ve had a chance in the past couple weeks to test that theory with two people who spend most of their time studying and optimizing partner programs. Both concur with April’s suspicion that growing dissatisfaction with partner programs is responsible for growing dissatisfaction with vendors. Neither believes AI is the problem with partner programs.

“I don’t believe that AI is causing discontent,” says Ryan Morris (pictured), chief channel program strategist at Channel Mastered, the consultancy I help lead. It’s exaggerating discontent that was already there.

Danielle Ibran, senior analyst for infrastructure channels at IDC, agrees. “We can’t blame it all on AI,” she says, or even most of it. Satisfaction with partner programs, as others at IDC have discussed here in recent years, is wobbly these days for a number of reasons, including the facts that vendors don’t reward them for influencing versus closing deals and continue to slot members into function-specific buckets like reseller, solution provider, and software developer even though the average channel partner, according to IDC data, identifies with 2.8 such labels.

“They’re all doing a little bit of everything,” Ibran says. “That’s where the issue with the programs is today.”

Agentic security startup 7AI, which launched a multi-model partner program last week, gets it, as do companies I’ve written about here before like Cisco and Barracuda. Cisco, however, is a good example of why you don’t see more tech companies following suit. Building the Cisco 360 program was the kind of deeply complex, inevitably controversial undertaking that large vendors especially are understandably slow to take on.

“These programs, obviously, are humongous and they manage on a global basis,” Ibran observes. Changing them takes time.

Which gets to a larger point helpful in understanding the partner frustration GTIA is registering. Vendors almost universally offer product-related training. But AI isn’t a product, or even product category. It’s a huge, complex, and radically new technology category that will leave behind anyone in the channel unwilling to embrace an equally new outcome-oriented, consultative business model. Pax8’s among a still modest number of companies that know it.

“Nobody’s teaching that stuff,” Morris says. “Almost everybody’s pretty good at product training. Many have gotten pretty good at services training. Few have ventured into the business model training.”

Or kept up with an ongoing shift in the channel toward new, higher value, stickier revenue streams, adds Ibran, noting that 55.7% of the money partners make globally today comes from their own IP.

“Partners are seeking higher margins and defensible differentiation,” she says. “AI plays a key role here.”

Ibran would like to see more vendors reflect that fact by offering AI-specific education in areas like FinOps as well as managed service blueprints for recurring IP-led revenue in fields like AgentOps. Measuring partners more for delivering verified end user business results versus accumulating certifications would be helpful too, as would rewarding them more for pre-sales functions like solution scoping and design.

Morris, for his part, has another suggestion for vendors: Stop using AI as a substitute for people.

“More and more of the partner community and more partner questions are being dealt with by an FAQ bot as opposed to a real human,” he says. That works fine (and sometimes better than fine) with consumers, he notes, because they only need help occasionally.

“A partner doing business with a vendor has interactions every single day at some level,” Morris says. “If you put half or more of your question base into an automated response, a partner will get an automated response every single day from you, which is a really clear indication that you’ve disconnected from me in the relationship.” The better path, as some in the industry understand, is to augment and enhance person-to-person relationships via AI instead.

“Don’t get rid of your channel account managers. Empower them with AI to do even more and to automate manual tasks so that they can spend more time doing human touch with the partners in the relationship,” Morris says. “A partner’s going to feel that they get more human attention than they did in the past, not less.”

Get ready to think through similar issues more or less indefinitely, Ibran warns channel chiefs. AI moves fast and changes continuously.

“You almost have to get into a startup mindset,” she says. “Things are going to evolve, and I think you’re going to have to evolve with the market.”

Follow Me on LinkedIn

What’s MSP as a Service?

So much was going on at Pax8’s Beyond event last month that we didn’t get a chance to air the interview Erick Simpson, my business partner and co-host on the MSP Chat podcast, recorded there with Juan Fernandez about his new MSP as a Service venture until this week. Worth the wait, IMO. Check out the whole episode here and all of our other equally interesting episodes here.

What makes AI consultants different from most MSPs

It’s come up a few times here in recent weeks that SMBs aren’t sitting around waiting for someone to pitch them an AI solution. Some of them are placing outbound calls to IT providers, including companies they’ve never spoken with before, asking for help launching AI initiatives. Guess what happens if you get one of those calls but have nothing to offer.

“MSPs would be foolish not to assume that these really progressive, technology-forward businesses aren’t going out and talking to alternatives who can provide them with AI services,” says John Bush.

He knows, too, because he’s one of them.

Bush is founder of Dallas-based AI consultancy wave4. If you’re a Channelholic regular, you’ve read about AI consultants here before. They’re the people phoning up your clients if you’re an MSP and offering them workflow-transforming, time-saving, money-making AI solutions you don’t provide, making them in theory a competitive threat. Well, I’ve spoken with one now, and he’d much rather be your partner than your replacement.

Bush cut his teeth on AI while building enterprise security solutions for KPMG. “I think all of us working in technology always had the suspicion this is going to be a thing,” he says of AI. “The question was always when.” And the answer became obvious a little over a year ago as he watched engineers on his team put AI coding tools to work.

“They were doing work that would have taken them a week in like an hour,” Bush (pictured) says. That was his “AI light bulb moment,” he continues, and it had nothing to do with the enterprise.

“There’s this huge opportunity with smaller businesses who just don’t have a lot of technical talent or knowledge of all this,” Bush says.

wave4 is the “AI transformation partner” he created to fill that yawning gap. Early on, the company just asked clients what kind of AI solution they were looking for, and built it.

“What you realize is that most businesses don’t know enough about this stuff to be able to make informed decisions about what they really need,” Bush says.

As a result, client engagements these days begin with a thorough onsite assessment of a company’s people, processes, and technology, Bush says. “That allows us to unearth the solutions and the opportunities that exist for them to use AI.”

Those solutions and opportunities vary from helping businesses embed Microsoft Copilot in their workflows to building custom CRM solutions. “We’re training some of their employees to become power users who can do some of this themselves as well,” Bush says.

wave4 bills its work at rates low enough to be affordable by SMBs but high enough, when combined with the company’s extensive use of AI tooling, to deliver substantial margins, he adds.

“I’ve kept this very lean so I can come in around that, let’s say, high four- to low five-figure range, depending on what the scope of work is,” Bush explains, noting that he has two developers and two part-time consultants on staff at present. Their work involves skills an above-average MSP’s best technicians usually lack, even if their employer encourages them to spend five hours a week acquiring them.

“I’m doing twice that in a day,” Bush says. “It’s just a reps thing, ultimately. Just having more time on task.”

That said, Bush is fully aware of where his expertise ends. wave4 knows which AI tools to use (his favorites currently are Claude Code, Codex, Oz, and Hermes Agent) and when to use them, and it knows how to speak with SMB decision-makers about pain points and business goals in their own language. It knows nothing about standing up and supporting an IT infrastructure.

And doesn’t intend to learn—Bush is partnering with an MSP in California at present to fulfill that need for his clients, and wants to partner with more.

“This allows them to have something they can offer to their clients tomorrow and be able to provide all of the consulting, training, and implementation that their clients are already asking for,” he says. It gets him warm sales leads. “We can really solve each other’s problems in a lot of ways.”

Nor should potential partners worry about wave4 mastering IT services and stealing their clients someday, Bush continues. Indeed, if anyone should be concerned about the future, it’s him. AI consulting is an MSP’s game to lose.

“A lot of these businesses have never bought an AI service before, so working with someone who’s already done good technology services for them is a big advantage,” Bush says. “They have the trust element.”

Share Channelholic

Over on The Business of Tech

Host Dave Sobel’s pondering what happens when MSPs who fail to keep pace with increasing cyberinsurance requirements end up losing cybersecurity business to the insurers themselves (a phenomenon I’ve pondered too):

“So here’s the choice, and it’s about staying on the right side of a line that keeps rising. You can be the provider who keeps every client continuously above what carriers require to stay insurable—treating the insurability floor as your standard, watching it climb, and moving each client up before the renewal or the claim finds them below it. Or you can keep selling a fixed security stack while the floor rises underneath it—and become the vendor the insurer bundles past, the day your client’s coverage, not your contract, is what defines ‘secure.’”

More here.

Microsoft weighs in on the SaaSpocalypse

Hat tip to Robert Scott, CEO and co-founder of AI-powered MSP contract intelligence vendor Monjur, for calling my attention to this story, which got some coverage in the legal trade press and as far as I can tell pretty much nowhere else.

Which is strange, because it feeds directly into the ongoing debate about whether SaaS is doomed. As I’ve written here before, a lot of software categories will be impacted if not erased by LLMs, but others clustered in particular around risk and focus (as in subject matter specialization) are in better shape.

Legal software is one of the categories I labeled a safe investment bet, and here’s some evidence that it remains so courtesy of Harvey, one of the vendors I named in my piece: the roughly 2,000 people in Microsoft’s legal department are Harvey’s latest users.

A nice win for Harvey but notable as well because Microsoft has recently introduced Copilot functionality for lawyers, following in the actual footsteps of Anthropic and rumored footsteps of OpenAI. All of those tools are probably handy, too, but at least in Microsoft’s judgment, when real attorneys need to do real work in which errors will have real consequences, they need something a lot more robust than Copilot.

Also worth noting

• The new ChatGPT for small businesses program gives end users access to hands-on training and in-person AI academies, among other resources.

• Ivanti has added predictive remediation and autonomous patch management to its Autonomous Endpoint Management platform.

• Axonius has added an AI agent and MCP Server to its Asset Cloud solution.

• AvePoint has added new agentic AI governance, backup and recovery, and multicloud data protection functionality to its Confidence Platform.

• Cobalt has introduced Autonomous Pentest, a continuous offensive security solution designed to deliver actionable findings within 24 hours.

• Palo Alto Networks intends to acquire observability vendor Embrace to add new digital experience monitoring capabilities to its platform.

• Cato Networks has integrated its Cato SASE Platform with the CrowdStrike Falcon platform to enhance threat detection and accelerate investigations and response.

• Barracuda has added new training, certification, and marketing resources to its Partner Success Program.

• Keyfactor has added value-based incentives, enhanced co-selling, a post-quantum security certification, and more to its partner program.

• Coro has appointed Dor Avrahami its VP of product, Itzik Shachar its VP of R&D, and Ingo Schaefer its VP of sales for EMEA.

• Chris Fabes is the new president of TD SYNNEX Canada.

• The Channel Marketing Association has appointed Roisin Monaghan of ServiceNow and Taylor Wiggins of Axonius to its executive board.

It’s come up a few times here in recent weeks that SMBs aren’t sitting around waiting for someone to pitch them an AI solution. Some of them are placing outbound calls to IT providers, including companies they’ve never spoken with before, asking for help launching AI initiatives. Guess what happens if you get one of those calls but have nothing to offer.

“MSPs would be foolish not to assume that these really progressive, technology-forward businesses aren’t going out and talking to alternatives who can provide them with AI services,” says John Bush.

He knows, too, because he’s one of them.

Bush is founder of Dallas-based AI consultancy wave4. If you’re a Channelholic regular, you’ve read about AI consultants here before. They’re the people phoning up your clients if you’re an MSP and offering them workflow-transforming, time-saving, money-making AI solutions you don’t provide, making them in theory a competitive threat. Well, I’ve spoken with one now, and he’d much rather be your partner than your replacement.

Bush cut his teeth on AI while building enterprise security solutions for KPMG. “I think all of us working in technology always had the suspicion this is going to be a thing,” he says of AI. “The question was always when.” And the answer became obvious a little over a year ago as he watched engineers on his team put AI coding tools to work.

“They were doing work that would have taken them a week in like an hour,” Bush (pictured) says. That was his “AI light bulb moment,” he continues, and it had nothing to do with the enterprise.

“There’s this huge opportunity with smaller businesses who just don’t have a lot of technical talent or knowledge of all this,” Bush says.

wave4 is the “AI transformation partner” he created to fill that yawning gap. Early on, the company just asked clients what kind of AI solution they were looking for, and built it.

“What you realize is that most businesses don’t know enough about this stuff to be able to make informed decisions about what they really need,” Bush says.

As a result, client engagements these days begin with a thorough onsite assessment of a company’s people, processes, and technology, Bush says. “That allows us to unearth the solutions and the opportunities that exist for them to use AI.”

Those solutions and opportunities vary from helping businesses embed Microsoft Copilot in their workflows to building custom CRM solutions. “We’re training some of their employees to become power users who can do some of this themselves as well,” Bush says.

wave4 bills its work at rates low enough to be affordable by SMBs but high enough, when combined with the company’s extensive use of AI tooling, to deliver substantial margins, he adds.

“I’ve kept this very lean so I can come in around that, let’s say, high four- to low five-figure range, depending on what the scope of work is,” Bush explains, noting that he has two developers and two part-time consultants on staff at present. Their work involves skills an above-average MSP’s best technicians usually lack, even if their employer encourages them to spend five hours a week acquiring them.

“I’m doing twice that in a day,” Bush says. “It’s just a reps thing, ultimately. Just having more time on task.”

That said, Bush is fully aware of where his expertise ends. wave4 knows which AI tools to use (his favorites currently are Claude Code, Codex, Oz, and Hermes Agent) and when to use them, and it knows how to speak with SMB decision-makers about pain points and business goals in their own language. It knows nothing about standing up and supporting an IT infrastructure.

And doesn’t intend to learn—Bush is partnering with an MSP in California at present to fulfill that need for his clients, and wants to partner with more.

“This allows them to have something they can offer to their clients tomorrow and be able to provide all of the consulting, training, and implementation that their clients are already asking for,” he says. It gets him warm sales leads. “We can really solve each other’s problems in a lot of ways.”

Nor should potential partners worry about wave4 mastering IT services and stealing their clients someday, Bush continues. Indeed, if anyone should be concerned about the future, it’s him. AI consulting is an MSP’s game to lose.

“A lot of these businesses have never bought an AI service before, so working with someone who’s already done good technology services for them is a big advantage,” Bush says. “They have the trust element.”

Share Channelholic

Back in March, I shared some then barely public research from GTIA that included a troubling fact: partner satisfaction with their vendors is declining.

Not to a degree worth panicking about, mind you. 74% of the partners GTIA surveyed called themselves satisfied with their vendors. But that’s down from 88% just a year earlier, and the percentage of partners describing themselves as very satisfied has dropped by more than half, from 39% to 18%.

The question, of course, is why, and GTIA can’t say conclusively yet. Carolyn April, the group’s vice president of research and market intelligence, has a hypothesis though, and it touches on vendor partner programs.

“It’s about alignment and the changes that are going on in the marketplace today with AI,” she says. “The types of priorities that are important to [IT solution providers] and the things they want to see in a partner program, for instance, they’re different now.”

I’ve had a chance in the past couple weeks to test that theory with two people who spend most of their time studying and optimizing partner programs. Both concur with April’s suspicion that growing dissatisfaction with partner programs is responsible for growing dissatisfaction with vendors. Neither believes AI is the problem with partner programs.

“I don’t believe that AI is causing discontent,” says Ryan Morris (pictured), chief channel program strategist at Channel Mastered, the consultancy I help lead. It’s exaggerating discontent that was already there.

Danielle Ibran, senior analyst for infrastructure channels at IDC, agrees. “We can’t blame it all on AI,” she says, or even most of it. Satisfaction with partner programs, as others at IDC have discussed here in recent years, is wobbly these days for a number of reasons, including the facts that vendors don’t reward them for influencing versus closing deals and continue to slot members into function-specific buckets like reseller, solution provider, and software developer even though the average channel partner, according to IDC data, identifies with 2.8 such labels.

“They’re all doing a little bit of everything,” Ibran says. “That’s where the issue with the programs is today.”

Agentic security startup 7AI, which launched a multi-model partner program last week, gets it, as do companies I’ve written about here before like Cisco and Barracuda. Cisco, however, is a good example of why you don’t see more tech companies following suit. Building the Cisco 360 program was the kind of deeply complex, inevitably controversial undertaking that large vendors especially are understandably slow to take on.

“These programs, obviously, are humongous and they manage on a global basis,” Ibran observes. Changing them takes time.

Which gets to a larger point helpful in understanding the partner frustration GTIA is registering. Vendors almost universally offer product-related training. But AI isn’t a product, or even product category. It’s a huge, complex, and radically new technology category that will leave behind anyone in the channel unwilling to embrace an equally new outcome-oriented, consultative business model. Pax8’s among a still modest number of companies that know it.

“Nobody’s teaching that stuff,” Morris says. “Almost everybody’s pretty good at product training. Many have gotten pretty good at services training. Few have ventured into the business model training.”

Or kept up with an ongoing shift in the channel toward new, higher value, stickier revenue streams, adds Ibran, noting that 55.7% of the money partners make globally today comes from their own IP.

“Partners are seeking higher margins and defensible differentiation,” she says. “AI plays a key role here.”

Ibran would like to see more vendors reflect that fact by offering AI-specific education in areas like FinOps as well as managed service blueprints for recurring IP-led revenue in fields like AgentOps. Measuring partners more for delivering verified end user business results versus accumulating certifications would be helpful too, as would rewarding them more for pre-sales functions like solution scoping and design.

Morris, for his part, has another suggestion for vendors: Stop using AI as a substitute for people.

“More and more of the partner community and more partner questions are being dealt with by an FAQ bot as opposed to a real human,” he says. That works fine (and sometimes better than fine) with consumers, he notes, because they only need help occasionally.

“A partner doing business with a vendor has interactions every single day at some level,” Morris says. “If you put half or more of your question base into an automated response, a partner will get an automated response every single day from you, which is a really clear indication that you’ve disconnected from me in the relationship.” The better path, as some in the industry understand, is to augment and enhance person-to-person relationships via AI instead.

“Don’t get rid of your channel account managers. Empower them with AI to do even more and to automate manual tasks so that they can spend more time doing human touch with the partners in the relationship,” Morris says. “A partner’s going to feel that they get more human attention than they did in the past, not less.”

Get ready to think through similar issues more or less indefinitely, Ibran warns channel chiefs. AI moves fast and changes continuously.

“You almost have to get into a startup mindset,” she says. “Things are going to evolve, and I think you’re going to have to evolve with the market.”

Follow Me on LinkedIn

What’s MSP as a Service?

So much was going on at Pax8’s Beyond event last month that we didn’t get a chance to air the interview Erick Simpson, my business partner and co-host on the MSP Chat podcast, recorded there with Juan Fernandez about his new MSP as a Service venture until this week. Worth the wait, IMO. Check out the whole episode here and all of our other equally interesting episodes here.