Explorez tous les épisodes du podcast ChannelBuzz.ca

Todd Cione, chief sales officer at OpenText

OpenText is rethinking how it reaches and serves mid-market customers, putting partners at the centre of a significant transformation in its commercial strategy.

Speaking with In The Channel at OpenText World 2026 in Orlando, Todd Cione, executive vice president and chief sales officer at OpenText, described a “radical pivot” away from a direct sales approach that has struggled to provide sufficient coverage of the mid-market.

Instead, the company is increasingly turning to regional solution providers, systems integrators and other channel partners to extend its reach and deliver customer value.

The shift is part of a broader transformation under OpenText’s new One OpenText operating model, which brings together the company’s extensive technology portfolio and partner ecosystem around customer needs. For its largest 2,400 customers, OpenText has introduced client executives responsible for coordinating internal specialists and external partners.

Cione also sees a substantial opportunity to drive organic growth by expanding adoption of OpenText technologies across its existing base of more than 120,000 customers.

But realizing that opportunity requires more than encouraging partners to cross-sell. Cione points to financial incentives, technical and commercial enablement, and simpler programs and systems as essential investments. That includes reconsidering the historically significant costs associated with some partner training.

The conversation also explores the role of OpenText’s MSP-focused cybersecurity business, opportunities to extend the company’s portfolio into smaller customers, and the challenge of creating a more consistent partner experience without losing the specialization different types of partners require. OpenText’s existing Accelerate Partner Program illustrates some of the distinct requirements of its cybersecurity channel.

Cione says roughly half of OpenText’s revenue is currently influenced by partners, a proportion the company hopes to increase over time.

In this episode of In The Channel, Cione discusses what these changes mean for OpenText partners and where the company’s channel strategy goes next.

Read Full Transcript

Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the past 16 years. I’m Robert Dutt, editor at ChannelBuzz.ca, and your host for the show.

We’re coming to you from OpenText World 2026 in Orlando, where the company is laying out an ambitious vision for its future, positioning itself as a critical provider of trusted information and connected data for the emerging world of enterprise AI.

But delivering on that vision is going to take more than technology. It’s going to require some significant changes to how OpenText goes to market, particularly how it works with its partners.

That’s where today’s guest comes in. Todd Cione is OpenText’s president of Worldwide Sales, and I had the opportunity to sit down with him shortly after CEO Ayman Antoun laid out the company’s strategy in his opening keynote.

Todd describes what he calls a radical pivot in OpenText’s approach to the mid-market, moving away from a predominantly direct sales approach towards one that depends much more heavily on partners to reach and serve customers.

We also get into the company’s new One OpenText commercial model, the opportunities for partners to build businesses around more of OpenText’s extensive portfolio, and what it will take to make that cross-selling opportunity a reality.

And we discuss where the company’s substantial MSP-focused cybersecurity business fits into the broader strategy, as well as efforts to simplify the experience of working with OpenText across its many businesses.

It’s a conversation about some significant changes in how OpenText thinks about its channel, and what partners can expect as those changes take shape.

Let’s get right into it, my chat with Todd Cione.

Robert Dutt: Well, thanks for taking the time. I appreciate it. I imagine this has got to be a busy, active week for you and the whole team here.

Todd Cione: Thanks for having me, Robert. It’s a fantastic week, and very excited to have colleagues, partners, and clients here at OpenText World.

Robert Dutt: So we just sat in on a session where Ayman laid out a pretty ambitious vision for where OpenText goes from here. When you look at that strategy, when you were formulating that strategy, where do your partners fit into making that all a reality over time?

Todd Cione: Yeah, I think they play a critical role in the AI stack. I mean, put simply, no one vendor partner can deliver value across the entirety of the AI stack to a client. Shannon’s metaphor of a team sport, I think, is directly applicable. It takes an entire ecosystem working together to deliver the value that clients expect today.

Robert Dutt: Let’s talk about that ecosystem. Moving down the stack into the long tail of the channel, when you get beyond the GSIs, the technology partners, and start looking at the regional solution providers, the consultants, the implementation partners who are working directly with customers, large and small, but especially once you get into that mid-market and below size.

Todd Cione: Yeah, look, clients expect, whether they’re a large enterprise or they’re in the mid-market, they’re dealing with the same problems. They just have different amounts of resources available to them to solve problems. They need technology, they need expertise, but it’s that combination of technology and expertise where business value comes that they all expect.

Partners of all categories play a critical role. As you’re referencing, regional system integrators, resellers that are localized in markets, bring either local expertise on the marketplace or the country where they are serving and operating, or they bring some type of vertical expertise, whether it’s public sector or private sector. In that combination of their expertise and our technology is where I think the value lies for a client.

Robert Dutt: How do you see the transition that this whole industry, this whole world is in right now changing the definition of who is, or will be six months, a year, two years from now, an OpenText partner? I’m curious if the kind of things you’re looking for in the partner base are evolving as both the market itself and OpenText’s place within it evolves.

Todd Cione: Yeah, that’s a good question. I think if you look back on the last decade, just for context before we look forward, it’s important to recognize that we certainly have invested in a partner ecosystem and a partner channel. However, the expectation of value and scale was different previously than it is now, and it is going forward.

Partners unequivocally are core to our entire company, including our commercial model that I’m responsible for. That means large global system integrators and regional system integrators to extend the delivery of professional services expertise. That means cloud service providers to provide the infrastructure layer on that modern AI stack. That means technology providers like SAP, Salesforce, that we integrate into their systems of record. That also means technology providers that build applications, agents on top of our platform as well, and then resellers and distributors that provide scale.

Moving forward, this ecosystem is not only critical for clients because no one technology provider can provide the entire stack, but it’s core to OpenText. It is core to what we do. It’s going to be core to our product roadmap. You’re going to see more and more and more tomorrow. It’s core to how we bring value to our shared clients. It’s like an integrated part of our sales force that I’m responsible for.

Robert Dutt: How does that go-to-market continue to evolve, especially as that whole ecosystem that you describe gets more complex? We get into situations where it’s you plus an OpenText partner plus any number of those technology partners who may have their own channels, and sometimes there’s going to be overlap between their partners and your partners, but not always. It can create a complex ecosystem, and managing that is a little bit of a different beast.

Todd Cione: Yeah, certainly with more providers working together to provide a common solution for a client, there can be complexity. But put simply, our job is to simplify it. Our job is to integrate and work super closely with a partner ecosystem early in a sales cycle, in a value cycle with a client, so that we all have clarity on our roles and responsibilities. What part of the overall solution for a client are we going to provide? And that way there’s kind of a seamless experience, most importantly, for the client.

And so we work really, really, really hard on it. We’re not perfect. We’re learning a lot. Our teams are learning, but we’re making big investments, human investments in resources, to be able to bring that simplicity to clients, and then enablement investments for the teams that we do have.

Robert Dutt: Is it changing kind of the nature of the sales call, the sales motion, when you’ve got all those different folks potentially in the room to make something that hopefully will reach some of those outcomes that we’re all striving for on behalf of customers?

Todd Cione: Simple answer is yes. And the longer answer is, gone are the days where OpenText would show up just with a product specialist to our client by themselves. And here are the days where we’ve launched an initiative, an organizational structure, a program, a model called One OpenText that puts the client at the center of everything that we do and is partner-centric.

And with that, for our largest 2,400 clients globally, we have a client executive that we’ve deployed. And this is a new role that represents the breadth of OpenText for that client and is an orchestrator then of specialist resources, product specialists from OpenText, technical specialists from OpenText, but also partners working together to seamlessly, again, assemble that solution that brings value to the client. So it’s a new approach and a new model. Again, we call it One OpenText.

Robert Dutt: You’ve got such a broad portfolio of technology across information management, security, AI underneath it all, and other areas as well. Where do you see the biggest opportunities today for partners to build differentiated businesses around the portfolio rather than simply reselling product X or product Y?

Todd Cione: Yeah, that’s reselling. It’s not a lot of value. So put simply, our role in the modern AI stack is to provide trusted context and connected data. It’s a core, critical part of that AI stack, without which really an enterprise cannot get business value from AI.

So as it relates to a partner ecosystem contributing around OpenText, trusted context, and connected data, look, there’s tremendous opportunities. At the infrastructure layer, again, cloud service providers provide very, very valuable modern infrastructure in the cloud to enable AI. Systems of record providers, SAP, Salesforce, and others, obviously that’s where structured data sits. We integrate with those key systems of record, and then models and orchestrators. If you think about Cohere, really important, tight partnership. Then you have agents and applications as well.

For resellers and distributors, their ability to connect into tiers on that AI stack, understand the value that they can provide to localized clients in a local market or in a specific vertical, is the way to differentiate.

We know that we can’t be all things to all clients, and we won’t be. We need localized resellers and solution providers across the world, heavily in emerging markets. We also can’t be all things to all clients by vertical as well. Public sector, we depend very heavily on a very specific specialized channel to work with public sector clients, as an example.

Robert Dutt: It sounds like the key to the value is being the last mile. You can get that integration between yourselves and your technology partners to X percent, but there’s still going to be that little bit extra that needs to be done to make it really light up for a customer in their particular niche, their particular priorities, their particular business.

Todd Cione: Yeah, I think that’s a good way to put it, the last mile. Look, we actually have a direct sales force quite significantly at scale around the world. And even though we have strong coverage, I’d say amongst the best coverages in the marketplace, look, we know we don’t have comprehensive coverage, and we do need those localized partners, that last mile, using your phrase, to provide incremental value to clients.

Robert Dutt: How much of that is in place today versus something that you feel needs to be built out or evolved for the current market condition?

Todd Cione: Yeah, coverage is in place right now. Very publicly, Ayman, our CEO, has highlighted that we’ve invested in our commercial model this year, in FY27, hiring and staffing those client executive roles and then also our specialist seller roles. So that model’s in place.

We’ve also invested in partner development executives to be able to be experts on the localized partner ecosystem within markets. We’ve organized that structure into three geographies: an Americas geography, a Europe geography, and an APJ, Middle East, Africa geography.

Within those geographies, we have 15 markets. So small atomic teams, think of it, operating in markets that are each unique in and of themselves and have unique partner ecosystem requirements as well. Those market leaders then are accountable to work with local partners to execute and serve clients. So that is all in place right now.

Robert Dutt: One part of the business that we didn’t hear a lot about in the keynote is the MSP-focused business. I think that’s because it’s kind of historically been a little bit unto itself, but it’s a substantial business that’s been assembled over the years, largely through acquisitions. How do you think about its place in the broader OpenText strategy going forward?

Todd Cione: Yeah, that’s a fair question. And I’ll answer it this way. Look, we have a professional services, first-party OpenText PS team that’s important and will continue to be important to add value to clients. The purpose of our professional services team is to bring expertise around our technology to clients and to help us drive software growth for our shareholders. That’s the purpose.

So a managed service provider ecosystem plays an important connected partnership, even with our first-party PS organization as well. And look, that’s a shift. That’s a shift for OpenText. And it’s not a light switch. Shifts as significant as that take some time, but we’re in the midst of that.

I have a colleague, James McOrley, who, and Jack Miller, run our global PS team. And they’re working hard to invest not only in clients, but now in a partner ecosystem as well, so that managed service providers, RSIs, GSIs can be an extension of OpenText, and we’re not competing with them.

Robert Dutt: Particularly around that, that security and backup business that’s been built up through Carbonite and all those acquisitions over the years, and kind of has, over the last few years, become an MSP stack platform unto itself. How does that kind of fit into OpenText moving forward?

Todd Cione: Yeah, we’ve been very public on the breadth of our portfolio and focusing on a core, a core part of our portfolio. That includes content, that includes our IT operations management portfolio, it includes our business network portfolio, as well as our cyber enterprise portfolio.

Now, relative to your question, Robert, around the MSP ecosystem for cybersecurity, cybersecurity is a core focus of ours. We take those products to market directly and through an MSP channel. So it’s super, super important to us.

Robert Dutt: It sounds like one of your previous answers may have informed some of the way, but I’m just curious. Historically, many of those partners have come into the OpenText ecosystem through those acquisitions with a security or backup lens, whatever it was. But as you say, you’ve got a lot more going on. Is there an opportunity to bring more of that portfolio to MSPs? I have to imagine yes. And ultimately to the SMB and mid-market customers that those guys typically serve?

Todd Cione: Yeah, that’s a good question. Look, you’re right that SMB and the mid-market is such a massive marketplace. And the best way to cover and serve that client base is through a channel, period. So you’ll continue to see OpenText invest in channel partners to serve those market segments.

Robert Dutt: You’ve got such a broad portfolio built through acquisitions, including the MSP business, but there’s been a lot of talk, you guys have been pretty open about wanting to focus more on organic growth.

Is that a signal that the goal is to get more value out of the portfolio that you already have, particularly through better integration and cross-selling opportunities for partners, getting more of the partner base that’s maybe sitting over here in part of the business thinking more OpenText at large?

Todd Cione: Yes is the answer to the question. So by that, I mean we have over 120,000 clients globally, and the opportunity for those clients to get more value from OpenText sits with our ability to expand our portfolio into each of those client relationships.

On stage today, this morning, as an example, you heard a couple examples of that. Ochsner Health, a large integrated healthcare delivery network in the Southeast, uses very effectively our IT operations management platform to help them with asset management and discovery for acquisitions. And they’re just beginning to use other parts of our portfolio, just beginning to. And huge opportunity.

You heard from IBM on stage today. I think it’s a great example of AI actually in the enterprise that’s in action. And that came through an ecosystem. That came through integration with SAP, and SAP and OpenText working together. And that’s our content platform that IBM is leveraging today. Big opportunity for a large enterprise like IBM to use other parts of our portfolio.

And then particularly as you scale down into the mid-marketplace, we have a huge opportunity to scale the breadth of our products into our existing customer base. And that requires a partner ecosystem to do that.

Robert Dutt: What unlocks some of that cross-selling? Because it’s a thing where a lot of organizations are really interested in getting their existing partners selling more across the base. Because of course, it only makes sense. You’ve already got the relationship. They already know part of your business. So it’s a lot easier than ramping up a new partner at large.

But talking to folks who have put that stake in the ground, it can be challenging to get partners out of their comfort zone, their lane that they’re in, and thinking across the lines of business that you may have.

Todd Cione: Yeah. Put simply, value. Honestly, what unlocks it is value for the client first. The client has to see value in leveraging other technology from OpenText, and then value for the partner ecosystem.

We think about value for the partner ecosystem in a few components, Robert. First of all, it’s a value proposition that the partner has to understand for the client, number one. Number two, there have to be financial incentives for them in place to be able to leverage more of OpenText’s portfolio.

Number three, they have to be enabled to do that, both technically enabled, but also commercially enabled to do that. And then number four, we think about kind of a governance process that includes systems and tools and escalations and process to be able to support and serve them.

So we’re making investments across those four areas to enable the partner ecosystem to be able to cross-sell for our clients.

Robert Dutt: You talked a little bit earlier about the One OpenText kind of viewpoint, and having that viewpoint, I’m curious, do you see that logic extending to the partner base? Do you need to have a more unified partner experience across the various businesses, or is the diversity of those businesses such that it makes sense for them to kind of have their own approach, their own look and feel when facing partners?

Todd Cione: I think it’s a little bit of both, in that there’s no reason that we need to have complexity in contracts and in programs and systems and tools depending upon partner type or specialization. No reason at all. So we’re working to simplify that and ways that partners engage with us and vice versa.

But also we acknowledge that specialization within the partner ecosystem is critical. And a cybersecurity deep expert partner is not the same as a partner that’s been working on vendor invoice management and backup and recovery with SAP’s ecosystem. Very different.

So they need different types of enablement. They need different types of programs. But again, there’s a common denominator of systems, tools, process that needs to be simplified, and we’re committed to doing that.

Robert Dutt: On that first part, the kind of driving out complexity and making things as simple and streamlined as possible, where’s that at? And what do you see as the next big projects, milestones, demons to slay, however you want to phrase that?

Todd Cione: It is a long list, Robert, of simplicity that we’re working on. So you can start with programs. We’re working to simplify and bring consistency to our program infrastructure across all of our partner categories.

You can then go to enablement, and there’s different philosophies in the marketplace around enabling a partner channel, particularly technical delivery-oriented enablement.

In the past, OpenText has looked at that as a pretty important revenue stream for us to charge partners for, and we’re looking at different ways and have already introduced a few new programs to invest in a partner ecosystem so that they can take advantage of technical delivery competency-oriented training without maybe some of the historical heavy expense.

A couple examples.

Robert Dutt: Okay. How do you see the mid-market and below opportunity for OpenText? Enterprise has obviously kind of been the sweet spot historically, but I’m curious, especially when you’ve got that base of MSPs in the cybersecurity space who are primarily, I would say, transacting in the SMB space. Is there an opportunity to take the broader message down to that group, especially as AI becomes more baked in and complexity in terms of operator requirements hopefully declines over time?

Todd Cione: Yeah, that’s a good question. And our bread and butter and what we know extremely well is the large enterprise market segment. So you think about a billion dollars of annual turnover of clients on their side and above. And that’s what we do extremely well. And that’s our legacy.

Now, the mid-market, sub-one billion, maybe above 1,000 employees, roughly segmented, represents a huge opportunity for OpenText. And the way that we’ve gone to market there in the past has not enabled us to scale.

The metaphor I use is we’ve had a couple rowboats in the Atlantic Ocean rowing around for coverage in our direct inside sales model. And of course, you get much more coverage through a partner ecosystem.

So we’ve radically pivoted the way that we are trying to serve clients and new logo targets in the mid-market through a partner ecosystem. We have a couple leaders that are leading the charge there, and it’s a radical pivot that we’re in the midst of.

Now SMB and below, as you referenced, that’s 100 percent partner ecosystem. We’ve made some investments in technology to engage with that ecosystem and allow them to resell through a portal. We’ve modernized, and we still have room to improve and are still working on it, but we’ve made some investments, important investments for that ecosystem.

Robert Dutt: If we were having this conversation again at OpenText World next year, what would you hope has materially changed for partners? What should partners be looking for, expecting from OpenText over the next 12 years, 12 months or so?

Todd Cione: Yeah, well, we do have a long-term view while we execute in the short term. And I think, look, if you and I, when you and I, I hope we have an opportunity to talk next year at this point, what will have happened?

Outcomes that I expect to have happened is, today, directionally, half of our revenue is influenced by partners. Influenced meaning either resold or heavily influenced in some way in the buying decision by a client. That will have increased quite significantly 12 months from now, based on the investments that we’re making, the model changes that we’ve already introduced.

Robert Dutt: All right. That’s a big one the partners ask about, so I appreciate that. Yeah, that’s kind of where I wanted to go. I appreciate your taking the time, and thank you.

Todd Cione: Thank you, Robert. Appreciate the time, and thanks for the advocacy for OpenText.

Robert Dutt: Thanks again to Todd Cione for taking the time to join us here at OpenText World, and thanks to you for listening.

A few things that stood out for me from that conversation.

First, I think the scale of the change OpenText is making in its mid-market strategy is significant. Todd was pretty candid that the company’s previous direct sales approach simply wasn’t giving it the coverage it needed, and that partners are going to play a much bigger role in reaching those customers going forward.

Second, there’s the opportunity around OpenText’s existing portfolio. With more than 120,000 customers globally and a broad collection of technologies, there’s clearly an opportunity to bring more of those capabilities into existing relationships. But as Todd acknowledges, making that work means getting the incentives, enablement, programs, and partner experience right.

And third, I think it’s interesting that OpenText is looking to simplify how partners work with the company while recognizing that a cybersecurity specialist and an enterprise information management partner don’t necessarily need the same things. Finding that balance is going to be important.

There are still questions about exactly how the company’s existing MSP-focused cybersecurity business fits into the larger picture, particularly whether those partners will have the opportunity to take more of OpenText’s portfolio to their customers. That’s something I’ll be keeping an eye on.

And Todd gave us a useful benchmark to watch. Today, roughly half of OpenText’s revenue is influenced by partners, and he expects that number to grow significantly over the next year. We’ll see how that develops.

We’ll have more conversations from OpenText World here on In The Channel, so make sure you’re subscribed wherever you get your podcasts. And if you find these discussions useful, a rating, review, or recommendation to a colleague is always appreciated.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Today’s headline news for Canadian IT solution providers:

• OpenText stakes out its role as the trusted data foundation for enterprise AI: OpenText CEO Ayman Antoun used his keynote at OpenText World 2026 in Orlando on Tuesday to outline a strategy centred on providing the secure, governed enterprise information needed to make artificial intelligence useful in production environments.Rather than attempting to own every layer of the emerging AI technology stack, OpenText is positioning itself as a provider of the trusted data and context connecting enterprise information to AI applications and agents.Antoun argued that the limitations of enterprise data are becoming a major obstacle to AI adoption, suggesting that only about 20 percent of enterprise information is currently usable in agentic AI workflows.His broader argument is that AI models and agents cannot consistently deliver reliable business outcomes without accurate information, appropriate context and strong governance over how that information is accessed and used.

  OpenText sees an opportunity to provide that foundation across its existing portfolio of information management, business network, IT operations and cybersecurity technologies.

  The approach also relies on partnerships with companies providing complementary capabilities, including AI models, orchestration platforms and infrastructure.

  OpenText’s previously announced partnership with Canadian AI company Cohere illustrates that division of responsibilities: OpenText supplies the enterprise data and context layer, while Cohere provides models and orchestration through its North platform.

  For solution providers, the strategy could create opportunities around preparing enterprise data for AI, integrating business systems, implementing governance controls and helping customers move AI projects from experimentation into production.

  However, the keynote left questions about how those opportunities will extend across OpenText’s different partner communities, particularly its existing managed services business.

  ChannelBuzz.ca is covering OpenText World in Orlando this week, including interviews with OpenText executives and partners examining how the strategy translates into channel opportunities.

• ThreatLocker launches Zero Trust AI Control for AI agents: ThreatLocker has introduced Zero Trust AI Control, or ZTAIC, a new security capability designed to restrict what AI agents can access, execute and connect to within an organization’s environment.The October 20 announcement addresses a growing concern as businesses move from AI tools that generate information to agents capable of taking actions across applications and systems.Traditional AI guardrails typically rely on instructions or policies intended to influence how an agent behaves. ThreatLocker is taking a different approach, applying security controls independently of the AI system itself.ZTAIC is designed to enforce restrictions on application execution, file access and network connections, including when an AI agent invokes other applications, scripts or processes to complete a task.

  For example, an agent might be authorized to analyze information in a particular folder and generate a report, while remaining unable to access unrelated files or transmit information to unauthorized destinations.

  The offering builds on ThreatLocker’s existing Zero Trust platform, including application allowlisting, Ringfencing and Web Content Control.

  Security teams can begin with recommended policies and adapt them to the requirements of individual environments.

  For Canadian MSPs, the development points to an emerging service opportunity around helping customers deploy AI agents safely.

  That work involves identifying which agents should be permitted, defining their access requirements, limiting their privileges and maintaining controls as they interact with other software.

  The announcement does not specify Canadian pricing, availability details or a new MSP-specific commercial program.

  While the technology is designed to reduce the risks associated with agentic AI, it does not eliminate the need for broader identity security, monitoring and governance.

• Flexera expands AI cost management into infrastructure and data platforms: Flexera has announced an expansion of its AI Cost Management platform, extending its existing capabilities for tracking AI applications, agents, models and token consumption into the infrastructure and data platforms supporting those workloads.The October 20 announcement adds autonomous optimization capabilities designed to balance cost and performance across cloud infrastructure, containers and AI data services.Flexera is also expanding its ecosystem of integrations with AI gateways, model-routing technologies, observability platforms and economic-control systems.The company’s existing Token Cost Control capabilities provide visibility into consumption across AI model APIs and applications, including identifying the users and agents responsible for spending.

  Those capabilities can support cost allocation, chargebacks, forecasting and governance.

  The expansion adds more attention to the infrastructure costs that can accumulate behind AI workloads, including compute resources and data-platform operations.

  Flexera expects automation for Snowflake environments to become available by the end of 2026, followed by Databricks automation in early 2027.

  The company is also working with vendors including Revenium and Ascerta, formerly Pay-i, to expand the information available for managing AI economics.

  A new AI cost-management maturity assessment is available to help organizations evaluate their practices.

  Flexera partner SoftwareOne is among the companies highlighting growing customer demand for financial visibility and accountability as AI moves into production.

  For Canadian solution providers, the opportunity extends beyond helping customers select AI technologies.

  Partners can potentially build services around measuring consumption, identifying inefficient workloads, allocating costs, implementing spending controls and connecting AI investments to business outcomes.

  The announcement builds on capabilities introduced earlier this year. Some of the newly described automation features remain scheduled for future release rather than being generally available today.

In Brief

• Grafana opens commercial marketplace for partner-developed plugins: Grafana Labs has announced general availability of the Grafana Marketplace, allowing verified technology partners and developers to sell commercial plugins through Grafana’s existing extension catalog.Announced October 20 at ObservabilityCON, the marketplace provides a new way for developers to generate recurring revenue from integrations they build and maintain for Grafana.The initial offering supports trials and monthly subscriptions for Grafana Cloud customers.Grafana Labs handles billing and payment support, while the partners developing the plugins remain responsible for technical support, maintenance and compatibility.

  Every marketplace listing is reviewed by Grafana Labs and must meet requirements covering security, software signing and handling sensitive information.

  The initial catalog includes integrations for network and security platforms, storage and virtualization systems, collaboration tools, and infrastructure cost management.

  Available plugins include connections to technologies from Cisco, Fortinet, VMware, NetApp, Dell, Microsoft, Nutanix, Proofpoint and others.

  Marketplace participants include Crest Data, Phenisys, Integration Plumbers, Helin Data and KensoBI.

  The commercial marketplace is an addition to Grafana’s existing plugin ecosystem, not a replacement for its free and open-source extensions.

  Developers can continue distributing free plugins without participating in the commercial program.

  For Canadian software developers, systems integrators and specialized solution providers, the marketplace offers a potential way to commercialize expertise in connecting enterprise technologies.

  Building an integration can require significant ongoing work to maintain compatibility, address security issues and support customers.

  Grafana’s new model is designed to make that work more commercially sustainable by giving developers access to customers already using the platform.

  The marketplace was introduced in preview earlier this year. The October 20 announcement marks its general availability.

• ConnectWise introduces technical webinars as cloud services remain suspended: ConnectWise said Tuesday that Cloud Backup, SaaS Security and Cloud Management remained unavailable while remediation and security validation continued following unauthorized access involving application identities. The company is planning a controlled, phased restoration but has not confirmed a timetable. It has also introduced technical webinars for partners, beginning October 20, to help administrators investigate Microsoft Entra ID logs, application credentials and permissions across their own and customer Microsoft 365 environments.
• Cycode expands Canadian operations after reporting substantial customer growth: Cycode says its Canadian customer base has grown 500 percent over approximately 18 months. The application-security company has established dedicated Canadian pre-sales, post-sales and customer-success teams, and names Jane Software, Clio, Tenstorrent, Benevity, BDO Canada and theScore among its customers. The company is emphasizing security for AI-assisted software development, although it has not disclosed the starting customer count behind its growth figure or announced a new Canadian partner program.
• Check Point expands AWS collaboration around cloud and AI security: Check Point has signed an expanded multi-year strategic collaboration agreement with AWS, building on an existing relationship established through a 2024 agreement. The companies will deepen integrations involving Amazon Bedrock, Bedrock AgentCore and other AWS services, while expanding access to Check Point’s security technologies through AWS Marketplace and co-selling arrangements. The focus includes protecting generative and agentic AI workloads.
• Bishop Fox introduces managed testing for emerging threats: Bishop Fox has launched Emerging Threat Testing, a managed service designed to determine whether newly disclosed vulnerabilities represent actual risks in a customer’s environment. The offering combines automated analysis with expert validation and provides findings intended to distinguish confirmed exposure from vulnerabilities that are not applicable. It is available within Bishop Fox’s Continuous Security Testing portfolio.
• FireMon integrates Akamai Guardicore segmentation policies: FireMon has introduced an integration with Akamai Guardicore Segmentation, allowing organizations to manage microsegmentation policies through the same governance environment used for firewalls and cloud security controls. FireMon provides policy visibility, normalization, change validation and auditing, while Akamai Guardicore continues enforcing segmentation rules. The integration is designed to simplify zero-trust policy management across hybrid environments.

Read Full Transcript

Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Wednesday, October 21, 2026, and here’s what’s happening in the channel today.

We’re starting today with OpenText World in Orlando, where OpenText CEO Ayman Antoun has laid out his vision for the company’s role in the emerging enterprise AI market.

And rather than trying to compete with every other company building AI models, agents and orchestration platforms, OpenText is staking out a particular part of the technology stack.

Antoun argues that one of the biggest obstacles to making AI useful in business isn’t the AI technology itself.

It’s the information that technology needs to work with.

During Tuesday’s keynote, he said only about twenty percent of enterprise data is currently usable for agentic AI workflows.

And he pointed to research suggesting that the overwhelming majority of AI pilots never make it into production.

His argument is that AI systems need more than access to information.

They need reliable, secure and governed information, with enough context to understand what that information means and how it should be used.

And that’s where OpenText sees its opportunity.

The company wants to provide the trusted data and context layer that connects enterprise information to AI applications and agents.

That means working alongside the companies providing the infrastructure, AI models and orchestration technologies, rather than necessarily trying to provide every piece itself.

It’s also a potentially important opportunity for channel partners.

Getting enterprise information ready for AI can involve integrating different systems, organizing data, establishing access controls and helping customers turn individual experiments into working business processes.

Those are areas where solution providers can play a significant role.

But there’s still an interesting question about how broadly that opportunity extends across OpenText’s partner ecosystem, including its existing MSP business.

Antoun’s keynote concentrated primarily on the enterprise AI opportunity, rather than detailing how the company’s managed services portfolio fits into the strategy.

And that’s something we’re exploring in our conversations with OpenText executives and partners here at the event.

The bigger message from Tuesday’s keynote is that OpenText doesn’t necessarily want to own every part of enterprise AI.

It wants to make the information underneath those AI systems trustworthy enough that businesses can actually put them to work.

As businesses begin deploying AI agents that can actually perform tasks, rather than simply answer questions, securing those agents is becoming an increasingly important challenge.

And ThreatLocker has introduced a new approach to addressing that problem.

The company announced Zero Trust AI Control, or ZTAIC, on Tuesday.

The idea is to give organizations technical control over what an AI agent can access, execute and connect to.

That’s different from the guardrails typically built into AI systems.

Those guardrails tell an agent what it should or shouldn’t do.

ThreatLocker’s approach is to enforce restrictions independently of the AI system itself.

For example, an agent might be authorized to examine documents in a particular folder and prepare a report.

But it shouldn’t necessarily be able to read unrelated customer records, execute unauthorized software or send information to an external destination.

And the challenge becomes more complicated when an AI agent uses other applications to complete its work.

An agent might launch a script, open a browser or invoke another program.

ThreatLocker says its new controls are designed to maintain the appropriate restrictions throughout those interactions.

ZTAIC builds on the company’s existing Zero Trust platform, including application allowlisting and Ringfencing.

It also includes recommended policies that security teams can customize.

For MSPs, there’s an interesting service opportunity here.

As customers adopt AI agents, someone needs to determine what those agents should be allowed to do, configure the appropriate controls and make sure the restrictions continue working as business processes change.

That’s not simply a software deployment.

It’s an ongoing security and governance responsibility.

ThreatLocker hasn’t announced detailed Canadian pricing or a new MSP-specific program as part of the launch.

But the broader direction is important.

If AI agents are going to become part of everyday business operations, organizations will need ways to enforce their security policies, rather than relying entirely on the agents to follow instructions.

And while security is one challenge for organizations putting AI into production, understanding what it’s costing them is another.

Flexera announced an expansion of its AI Cost Management platform Tuesday, adding new capabilities for controlling the infrastructure and data-platform costs associated with AI.

The company already provides tools for tracking AI applications, models, agents and token consumption.

Now it’s extending that approach into the cloud and data infrastructure supporting those workloads.

And that’s important because the cost of an AI application doesn’t necessarily end with the price of the model.

An agent may make repeated requests, process large amounts of information, access different data services and consume substantial computing resources.

A single business process can generate costs across several different systems.

Flexera wants to help organizations see those costs together and identify opportunities to reduce unnecessary spending.

The expansion includes autonomous optimization capabilities designed to balance performance and cost across infrastructure and data services.

The company is also working with AI gateway and model-routing providers to improve visibility into how organizations consume AI resources.

Some of the announced capabilities are still coming.

Automation for Snowflake is expected by the end of this year, with Databricks support following in early 2027.

Flexera has also introduced a maturity assessment to help organizations understand how well they’re managing AI spending.

For the channel, there’s a familiar opportunity here.

MSPs and solution providers already help customers manage cloud consumption, software licensing and infrastructure costs.

AI introduces some new measurements, including tokens and agent activity, but many of the underlying business questions are the same.

Who’s using the technology?

What’s it costing?

Where is money being wasted?

And is the organization getting enough value from what it’s spending?

As AI becomes a regular part of customer operations, answering those questions could become another recurring service.

In Brief –

Grafana Labs announced general availability of the Grafana Marketplace at its ObservabilityCON event on Tuesday.

ConnectWise says its Cloud Backup, SaaS Security and Cloud Management services remain suspended, and has introduced technical webinars to help MSPs investigate their Microsoft 365 environments while the company prepares for a phased restoration.

Cycode says its Canadian customer base has grown five hundred percent over approximately eighteen months, and has established dedicated Canadian teams to support customers adopting AI-assisted software development.

Check Point has expanded its multi-year collaboration with AWS, focusing on cloud and agentic AI security integrations and broader access to its technologies through AWS Marketplace.

Bishop Fox has introduced Emerging Threat Testing, a managed service designed to determine whether newly disclosed vulnerabilities actually affect a customer’s environment.

And FireMon has integrated with Akamai Guardicore Segmentation, bringing microsegmentation policies into its broader network-security governance platform.

Full details and links in the show notes or the blog post.

Later today on In The Channel, I’ve got a conversation with Todd Cione from OpenText World.

We discuss the role of partners in OpenText’s business and where the company sees opportunities for the channel.

Look for that episode after eleven o’clock Eastern this morning.

And if you haven’t heard it yet, yesterday on In The Channel I spoke with Dave Baggett from Kaseya about why simpler security could mean stronger security for MSPs.

We discussed findings from Kaseya’s latest cybersecurity research, the operational burden created by too many security tools, and how providers can improve their security practices.

That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

Dave Baggett, senior vice president and general manager of Kaseya’s Security Suite business

Cybersecurity has a complexity problem. And for managed service providers already struggling with limited resources and growing customer expectations, that complexity may be making it harder to deliver the protection businesses need.

That’s one of the themes emerging from Kaseya’s new 2026 Cybersecurity Report: Building Security That Survives Human Error, which surveyed more than 1,100 MSPs and IT professionals worldwide.

The research finds that 68 per cent of respondents identify human error as their biggest cybersecurity concern. But it also highlights the operational challenges created by security itself, including the time required to manage tools, maintain controls, and support users.

In this episode of In The Channel, Dave Baggett, senior vice president and general manager of Kaseya’s Security Suite business, joins us to discuss why stronger cybersecurity may increasingly depend on making security easier to manage.

Baggett argues that organizations need to design security around the reality that people make mistakes, rather than expecting users to behave perfectly. That means combining effective controls with systems that reduce the consequences of errors and simplify the work required to maintain protection.

The conversation also explores how AI could reshape security management, moving MSPs toward natural-language interfaces, more integrated security tools, and automated assistance with configuration and threat analysis. Baggett explains how Kaseya’s approach to connected cybersecurity fits into that vision.

Beyond the technology, Baggett discusses the challenges MSPs face in convincing customers to invest proactively in cybersecurity, the role of compliance in driving investment, and what Kaseya’s research reveals about the security practices of commercially successful MSPs.

The result is a discussion about making cybersecurity more effective, more manageable, and ultimately more sustainable for MSPs and their customers.

Read Full Transcript

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. We’ve spent decades talking about people being the weakest link in cybersecurity, and despite enormous advances in security technology, that fundamental challenge does not seem to be going away. Kaseya’s new 2026 Cybersecurity Report finds that 68 per cent of respondents identify human error as their biggest cybersecurity concern, but the research also highlights another challenge that may be just as important for managed service providers, the growing complexity of security itself. Organizations are deploying more tools, implementing more controls, and facing more demanding compliance requirements.

All of those things are intended to make businesses more secure, but they also create additional work for IT teams that are already stretched thin. And it raises an interesting question. At what point does the complexity of managing cybersecurity become a security risk in its own right? Joining me to explore that question is Dave Baggett, senior vice president and general manager of Kaseya’s Security Suite business. Dave and I discuss why building security that can withstand human mistakes is more realistic than trying to eliminate those mistakes entirely, and why simplifying security operations may be one of the most important opportunities for MSPs. We also get into the role AI could play in making security tools easier to manage, the challenge of convincing customers to invest in cybersecurity before something goes wrong, and what Kaseya’s research suggests about the relationship between security maturity and MSP business performance.

It’s a wide-ranging conversation about making cybersecurity not just stronger, but more practical for the people responsible for delivering it. Let’s get right into it, my chat with Dave Baggett.

Robert Dutt: Dave, thanks for taking the time. I appreciate it.

Dave Baggett: Absolutely. Great to be here.

Robert Dutt: Let’s start with the headline finding from the report, you know, a little over two-thirds of respondents identify human error as the biggest cybersecurity concern. You know, we’ve talked about people being the weakest link in security for probably as long as security has been done forever. There’s still such a persistent problem, and, you know, have we actually made any meaningful progress on this?

Dave Baggett: I think we have. I think one way to think about this is it’s a lot easier to manipulate people if you’re a bad guy than it is to find some vulnerability in a software system or, you know, so in some sense it’s because it’s easier. And you know, social engineering is just, it’s just so easy to be creative there, right? And one of the things that sort of always impresses me is how creative these bad guys are. And I often wish they were working on fusion power or something useful because we probably would have solved it by now. We are making progress though. I mean, it’s certainly true that forever this has been the number one source of breaches as you know, manipulating people. But we have been making progress.

One thing we we’ve leaned into with Kaseya with our email security in particular is trying to make the human part of the defense, right? So certainly the AI that we use blocks lots of malicious emails, but we also put yellow banners on some emails and that doesn’t mean we think the mail’s bad. We just want the user to slow down and pay attention before they go buy gift cards or click that link or fire money to somebody. And we found that’s actually really effective. That if you limit the percentage of emails you do this with, so they don’t become blind to it. Number one, and number two, you put in meaningful information, not technical verbiage. When people actually do stop and think for a few seconds and that materially lowers not only the rates of clicking on bad links, but all these other kinds of things that social engineering causes people to do.

Robert Dutt: One of the central arguments in the report is that we should probably stop expecting people to make the right decision every time and instead build systems that can survive and get around mistakes. For that smaller MSP who’s managing security across dozens or hundreds of customer environments, what is making that shift look like in practice?

Dave Baggett: I think part of it is making the tools easier to use because one of the things that we saw a lot of MSPs report to us in this was, hey, we just don’t have the time to manage all these tools. We can’t hire people who know how to use these tools well enough. So one of the things we think a lot about is how can we use things like AI to make the tools themselves simpler? How do we make the tools work better with each other? Because we heard a lot of feedback from this report, hey, we have to go to 17 different places to do things. We don’t like that. One of the things that I’m really optimistic about actually is we kind of envision the whole user interface for all these tools radically changing.

So instead of going to a UI and pressing buttons and clicking stuff, I think you’re going to see MSPs and admins in general using more like Claude Code kind of interfaces or copilot where they’re using a natural language interface and we’re going to expose MCP servers and that sort of thing to make that possible. So that instead of going, you know, imagine, you know, an admin generating a report to show one of their customers. Right now they would go to, you know, a webpage that’s a report generating webpage. Just imagine that being typing, hey, make me a report that has this information. And then on the backend, what we’re doing is building a unified data layer so that everything is stored, everything is queryable via MCP servers and all the information is shared across all the components.

The other thing we’re doing with AI is using AI, obviously we use AI to look for threats and we use AI to analyze things. Like for example, in INKY, the email solution we have, we can send an email to the AI and it’ll give you an analysis like an expert, right? It’s like a human expert. So you don’t need to have a human expert. But the other thing that I’m optimistic about is using AI to make recommendations about settings so that the admin doesn’t have to know every one of the thousand settings. I mean, some of these tools are really complicated, EDR for example, there’s lots of settings, the settings are hard to understand. So using AI to recommend to people, hey, you could suppress this noise, you could make these changes and so you’re not placing so much burden on the admin to know everything about the domain.

Robert Dutt: The research also talks about having a well trained internal IT or security team is the factor that is I think most frequently associated with coming back from an incident with rapid recovery. Exactly. So it seems like people are at the same time the biggest vulnerability and the most important defense, although obviously AI will be playing an important role there. I guess what I’m getting at is, you know, in this moment, how should MSPs be thinking about that balance between technology, automation, which also I guess follows under technology, but will treat as discrete for the purpose of this question, and human expertise?

Dave Baggett: I mean, I think that you’re going to still need to hire really, really good people. There’s no way we’re replacing all humans with AI anytime soon. You know, I think that what we’re looking at is, you know, people, when chess playing programs first came out, there is this funny term centaur chess, where you’d have a human use an AI to play another human using an AI. So the AI sort of augmenting the human’s ability. I think we’re going to see a mode like that for a while, where, you know, the AI is helping make more visible things that might be hard to see, you know, for a human, explaining to the human what these settings mean, for example, or, you know, another example is we have this tool, SaaS Alerts, which is cloud security.

And one of the things we’ve added to it is we’ve taken basically all of the knowledge of every Microsoft setting and baked it into an LLM. So now you can, as an admin, ask the LLM to look at your security posture in the Microsoft estate and then have it make recommendations to make fixes, and then it’ll actually go fix them for you. So this kind of human plus AI pair, I think is going to be the state of the art for quite a while. I think we, you know, at least we believe you need to have a human in the loop in most of these security contexts, rather than just have a bot go off and do things for you. I mean, you’ve seen lots of examples where it’s a bad idea to let these AI agents do whatever they think is sensible and they’ll go put your credit card information on the internet.

So for security, it’s going to be this kind of centaur mode, I think, for quite a while.

Robert Dutt: How realized is that at this moment in the state of tools that MSPs are using and where’s the biggest kind of, where’s the biggest bang for the buck opportunity to make that more real?

Dave Baggett: I mean, it’s real now in the sense that most of our products now have some sort of AI assistant capability and people always think of that as like a chat bot in the tool, but it isn’t just that. It’s things like alert suppression, an example that I gave earlier, which is what we call smart insights where you can take a result from EDR or email security and have an LLM analyze it. And in the case of the email security, we actually take all of the upstream analysis that we did and we put it in this form that’s digestible by the LLM and then it’ll come back and say almost like a human analyst. So you’re seeing a lot of that now. I think the leverage though, is going to come from again, all these things working together. Because one of the things that I realized, you know, I joined Kaseya by virtue of selling INKY, my company, last October.

And one of the things I realized was, you know, we had always, we’d been around for 10 years. We had always wanted to be the best at identifying malicious emails, right? Which sounds like a reasonable scope to go after. And for a very long time, we assumed you could do that simply by looking at the contents of the mail, which seems obvious, right? But in fact, now you’re seeing a lot of email born attacks where the bad stuff isn’t in the mail. Like it’s on SharePoint or something or, you know, it’s on a, you know, we’ll see, we’ll see examples of someone creating, you know, a PayPal account and then they’ll abuse the free form text for the memo or sometimes even the company name, you can put whatever you want in there and PayPal doesn’t filter it.

So people will create a real PayPal request, send it to the victim, and they’ll put in the memo, you know, you bought $150 steak knives, if this is an error, call this number, you know, and then like they call in their credit card harvesting scam. So you can’t actually look just at the contents of the mail. And this, I think, applies to basically all security contexts. And so where we’re headed and what I think is incredibly important for the whole industry is to make these tools talk to each other in real time. So we literally have a real time publish/subscribe event bus, where if INKY sees something weird, it can publish this. And then, you know, SaaS Alerts or whatever, EDR can pick it up, and the things are talking to each other. And that makes the sum better than the parts.

So I think we’re shifting from really a heuristic-based point solution world to more of an AI-assisted platform kind of world, where everything’s talking to everything else, and the AI is integrating all that information. And the other thing that’s tantalizing and isn’t really there yet, but I think we’ll get there in the next few years, is much more predictive cybersecurity. Like predict that this could be a problem, right? And the AI is clearly going to be capable of doing that with the right kinds of information. It’ll take a while to get there.

Robert Dutt: Something that caught my attention in the report is how much operational friction security itself creates. We talk about how important it is for MSPs to make sure their customers are doing MFA, make sure privileged account access management is set up right, make sure the compliance pieces are there, but that’s also consuming significant resources. We’re sort of reaching a point where the complexity of securing an organization is in itself a security risk. And I guess it has been historically, I mean, if you think back to, I guess the classic old school example would be, you know, we required a smarter password than the basics. Right. Not your dog man. One workaround is put it on a yellow sticky note on the monitor.

Dave Baggett: Yeah, totally. And I think we’re there. It is far too complicated to administer all this stuff. And that’s something that the tool vendors like us have to do better at. MFA really was an interesting one because, you know, from a user standpoint, it is really annoying to constantly have to do multifactor auth all day, multiple times. And yet that’s probably the most important control you can have. And in fact, we often debated pre-Kaseya at INKY, should we even let a customer buy our stuff if they don’t have MFA turned on? Because we would tell them, look, yes, we can, we can find cases where your account’s been taken over your email account. Like we can look at outgoing mail and see why is this account sending out huge amounts of phish right now? Or why is it sending out a giant burst of spam?

But that’s not the way to deal with that problem. The way to deal with that problem is MFA to prevent the account from getting taken over. So that I thought was quite interesting because clearly what MSPs are reporting is they’re having lots of issues with users needing help, or maybe just complaining about MFA. And yet MFA is kind of the most important control. I think the other interesting thing is you’re starting to see some user experience improvement and security like passkeys instead of every website having passwords. And if we can escape the tyranny of the password, I think that would help a lot. Because even us, we have to rotate our passwords. And what sometimes happens is the laptop password will be out of the sync with the Entra password. So then you need to know two passwords. They don’t sync up immediately.

Some Microsoft sync issues. So yeah, this stuff is still really hard to use for users. And I think some of this is just we’re going to be stuck with it for a long time. But I do see some evidence that things like passkeys give me some hope that it’ll get better.

Robert Dutt: So especially when it’s showing that security teams are being pulled away from the higher value stuff for the routine requests and these kinds of, you know, the customer who needs support for those kinds of basic issues that you describe there. For an MSP that’s already stretched pretty thin, you know, how do you reclaim some of that time without compromising the security of your customer or yourself ultimately?

Dave Baggett: Yeah, I mean, we think of it in, I guess, two ways. One is moving more towards managed services where we’re doing a lot of the management for the MSP. And one of the things that we’ve done with the design of our SIEM product and our MDR product is making visible what the rules are and allowing admins to edit them. But only if they want to. So they don’t have to. If they want us to manage everything, we can. We heard that there are two types. There are some MSPs that really want to be doing this themselves. And there’s others that are like, “I don’t have time to do all that. You guys just do it.” So I think that’s one trend. Managed everything is kind of the way I see the world heading.

The other thing we discovered at INKY is if you can move things that are normally resolved by tickets into a self-serve workflow, that is a huge win for the MSP. So an example is if a user gets a spam, they can just click spam. We put a banner, right? And we put links below the banner and the link is either report this mail and then we ask them, “What do you think it is, save spam or phish?” Or you can actually set it so there’s just a link, spam, save phish. So if they click spam, we ask them, “Do you want to block this sender?” Which means they can make it so they don’t get the spam anymore. They can also say, “I want to get this, but I want it to go to my graymail folder.” Just that user experience alone massively cuts down on email-related tickets.

Because every MSP knows you get tons of tickets, like, “I don’t want to get this mail anymore and I keep reporting it as spam and it doesn’t go away.” Make it stop, right? So I think in areas where you can make this accessible to a normal user, you make the MSP less burdened with all these nuisance tickets, number one, and number two, actually end users are happier. That’s important.

Robert Dutt: The survey says that, well, everyone says, internal IT departments, MSPs themselves say customers are under-investing in cybersecurity. Is the problem that there’s not enough funds going into it? Is it an insufficient budget issue, or is it how it’s being distributed? Are organizations just not making effective use of the budget they do have?

Dave Baggett: It’s probably some of both, but I think there is a human nature element that MSPs have to deal with, which is, we kind of see two kinds of approaches. There’s the MSP approach of, look, we make bundles for you. Maybe we have good, better, best. You don’t get to pick what you have. You’re going to get what we tell you. Then there’s the other ones that basically allow customers to pick and choose. In the second model, there’s always this kind of human nature of hope springs eternal. We really need to spend money on this. We’re probably not a target. That’s one of the things I’ve heard for a decade is, “Well, we’re a small company. We’re not a target.” I’ll tell you something.

We have evidence that people, bad guys, use bots to scrape LinkedIn to figure out when someone changes jobs and then send a phish to that person pretending to be their boss. It’s totally automated. You don’t have to be a company that matters to anyone to get targeted this way. Getting the message across that, “Hey, you are at risk like anybody else. In fact, if you’re smaller, you might be more at risk.” You’re now being targeted with things like AI. I think that there’s a constant challenge of getting the MSPs and customers to understand you really need to invest in protecting yourself. It’s things like backups too. Don’t figure out you don’t have backups after the ransomware.

We’ve been saying this stuff for multiple decades, but there’s also a sense, I think, that we hear this fairly often like, “Oh, well, if I have Microsoft, I’m all set.” Well, not really. You need multiple layers.

Robert Dutt: What are the things in this area that struck me about the report? We’ve talked a lot in recent years across the channel community on selling on business outcomes and that sort of thing. We’re talking about only, I think, 11% of MSPs in your research say that their customers invest on cybersecurity primarily because of a clear business case and just 9% say demonstrated risk reduction is the main driver. Those seem catastrophically low, aren’t they? Business to incidents are much higher, compliance is higher. I suggest I think that MSPs have a lot of work to do when it comes to selling security as business investment rather than IT expense.

Dave Baggett: Yeah, and one of the things that we really try to do is show improvement, show value. So we’ll do a quarterly business review with an MSP and show them here’s all the stuff we found. We actually have tools that let the MSP create reports that show the value. Like here’s what we blocked in the last month to constantly remind customers, the MSPs customers, hey, it’s important that you have this stuff. So it is an investment that’s paying off. And that’s another thing that I think AI can really help with because you can basically pose to the AI query, find all the interesting stuff we blocked over the last month and it’ll go off and do it, presuming that you have this unified data layer and you have a data lake that has all the information in it.

And then the other aspect is that the information is organized well, according to some sort of taxonomy, so that it’s not just a big pile of data. It’s actually organized in a way that can be queried in a structured way. I think compliance as a motivator is not a bad thing, actually. Compliance drives a lot of behaviors. Even like 20 years ago, it was the thing that led to phishing awareness training, security awareness training generally. It was like cyber insurers started to say, look, if you don’t train people, you’re not going to get a policy, or we’re going to reduce the policy cost if you do security awareness training. And look how much that’s just, I mean, that’s now ubiquitous, right? Everybody has it. So I think compliance is not a bad thing.

One thing that the report found, which I found quite interesting, is the fact that you passed an audit previously doesn’t mean you can now. And MSP self-reported that, right? And the other thing that they self-reported is configuration drift is a problem. So maybe you passed the audit six months ago or three months ago, but someone went in and disabled MFA, and nobody noticed, right? Like on some account. So one of the things that we’re seeing is there’s now this kind of configuration enforcement area of cybersecurity, and there are multiple products in this area. Like for us, we have a component called Fortify, which is in SaaS Alerts, essentially makes sure you don’t drift this way. You can say, here’s my settings, here’s the defaults, and if they change, let me know. And in fact, if they change, put them back, right?

So I think this, you know, compliance as a driver is really good, but passing an audit doesn’t mean you’re secure. And even if you pass the audit two months ago, it doesn’t mean you pass it today. It’s a point in time thing, right? Right. Yeah.

Robert Dutt: One thing that struck me in the research is the difference between high-performing and low-performing MSPs with performance defined as revenue and growth goals met. Yeah. High performers more likely to have incident response plans, test them, and be a little bit ahead of the curve in terms of more advanced security technologies. What’s, I’m curious, and I imagine it’s going to be at least somewhat a little bit of both, but you know, what’s your interpretation of the relationship? Is stronger security making MSPs more successful businesses, or are successful MSPs better positioned to invest in more advanced security in technology and process?

Dave Baggett: That’s a really, that’s a really good question. I mean, and to your point, don’t just have backups. You should test the backups too, right? Don’t find out your backup wasn’t really good when you have an incident, right? So I would kind of lean towards the second scenario, I think the more sophisticated MSPs are probably able to grow faster, have more budget, able to sell more expensive tools maybe with even higher margins. So that kind of argues for kind of a virtuous cycle. I mean, I do think that, you know, there, we actually see like, we actually see some really interesting patterns. So we’ll see MSPs that are regional, you know, like I’m the MSP who handles Oklahoma. That’s my thing. And then we’ll see like more vertical focused ones. I’m the MSP that does dentist offices.

And it’s interesting because there’s, and of course there’s other models too, and they all can be very successful. But one of the things we try to think through is how do we do enablement for MSPs? How do we help MSPs grow? So we’re not just relying on organic growth from them or them being experts at sales. We feel like we need to help make that easier, even providing things like collateral that people can tailor. So for us, since we’re so MSP focused, it’s better for us if MSPs generally grow and generally grow faster. And like there’s sort of a, if you look at the industry for the past 15 years, 20 years, I mean MSPs have grown like crazy, not just individual MSPs, which now we’re seeing them get aggregated by private equity through giving these mega MSPs, but also just the number of MSPs.

I think there’s something like 40,000 in North America now. And arguably it would be impossible to be a small business now without an MSP because it’s just imagine, imagine you’re a 50 person accounting firm and you’re supposed to figure out how do I protect myself from cybersecurity threats? There’s 3,500 products at least. There’s probably 25 different areas of concern. How would any IT person at these companies make any sense of all that? And by the way, it constantly changes. And that’s something that came up in the survey about compliance too. Well, how am I supposed to be compliant? They keep changing the rules every quarter. So MSPs are absolutely essential to the functioning of small businesses now. And I actually think there’s an opportunity similarly with AI. How does the 50-person accounting firm figure out how to use AI?

Just for their everyday business. I think MSPs can play a role in that. Like essentially be the experts on this really, really difficult, complicated domain like security.

Robert Dutt: So, you know, you touch on backup testing and that’s something that your report found that higher performing MSPs are nearly twice as likely to test their client’s backups monthly, which seems like a pretty fundamental practice. Yeah, I guess what I’m curious here is what would you think are the things that a smaller MSP who’s maybe not in that higher performing group could start doing relatively easily, inexpensively, quickly to start moving towards what that higher performing group looks like?

Dave Baggett: I mean, a few things come to mind. One thing I’ll mention is that we actually recently put into our backup infrastructure screenshot verification. So we literally take a screenshot of the machine and use AI to analyze it to verify the backup completed. And the error rate is like 0.01% or something, it’s very, very accurate now. And so using AI to do these sorts of verification tasks automatically is a big opportunity, I think. But in terms of practices that MSPs who are early in their maturity could do, I mean, number one, like we talked about MFA, like don’t even talk to me if you don’t have MFA turned on. That is like your accounts are going to get owned if you don’t have MFA. Yes, it’s annoying for users, but you got to have that.

And don’t use SMS for it, use an authenticator app because the scary thing we’re starting to see is people can intercept these SMS messages. So even if you have MFA, you can still get your account owned, right? So that’s the number one. It’s near and dear to my heart and maybe I’m biased, but number two would be email security. If you look at every single report, not just ours, but like the Verizon report that comes out every year, every year for the past forever, email security has been, email has been the number one breach point. Like if you, if you, if you look at almost every breach that happens, something like Verizon says something 91% start with an email. It’s been declining a little bit as email security, I think is getting better. It’s still by far number one, like it’s by far number one.

People are not sitting there writing, you know, CVE vulnerabilities to get into someone’s browser. That’s, that’s, yes, people do that, but that’s not the volume. The volume is phishing people, right?

Robert Dutt: Take a look inwards at MSPs own operations, you know, MSPs spend obviously a lot of their time advising customers on security best practices, making it real, but they’re also businesses with their own employees, systems, credentials, vulnerabilities. So I guess the, the physician, heal thyself question, Yeah. Are MSPs generally as disciplined about security for themselves as an organization as they are about securing their customers?

Dave Baggett: I would say yes. Yeah. I don’t, I don’t see many MSPs that are not securing themselves. I don’t, I haven’t seen that as a big problem. And actually one of the, one of the things that I really like about working with MSPs and not just at Kaseya, but even at inky prior to the acquisition, we decided around 2022 to focus really entirely on MSPs. And one of the things I really liked about and like about the MSP community is it is entrepreneurial, it’s founders, you know, and that’s, it’s a very different thing. Selling into that cohort than it is selling to some giant enterprise, right? Now at Kaseya, we kind of do both. We do certainly mid market direct sales to companies, but the vast majority is MSP. And I think, you know, MSPs typically I would say are several things sort of characterized MSPs for me.

One is entrepreneurial spirit, willingness to try things because there got to be somewhat, you know, accepting of some change in the world to be a business owner, right? So but then also like incredible overwork, like not enough time to get everything done. And so one of the things that our CEO Rania is focused on, all of us focused, focused all of us on essentially is figure out ways to enable MSPs to do more with less, spend less and do more figure out how to increase their margins. And if we just do that one thing, we will win because that’s the thing that’s so hard for MSPs. There’s too much to do. I’ve never met an MSP that was bored or idle. MSPs aren’t going out playing golf every Friday, right? I mean, this is not, this is not the lifestyle if you want to be a golfer.

Robert Dutt: No, no, definitely not. To bring this all together, We talked about human error. We talked about sort of the complexity behind security and operational complexity. We talked about constrained budgets, the difference between those who are performing the best and their peers. If I’m listening to this as an MSP owner and I want to take a meaningful step towards improving my own or my customer’s security resilience this week, you know, what’s the most likely first step?

Dave Baggett: Well, and I mentioned some specific things. I think, you know, AI is going to change everything. So we have some MSPs that are already using AI to automate our products and solutions. before we’ve even made it possible to do it in a first-class way. They’re just doing it. And some of it’s really, really impressive. I got an email from an MSP yesterday that was like, here’s this AI agent that we wrote. Here’s what it does. And I’m like, wow, that was like really, really impressive. And so we’re going to make it possible for people to create their own agents. We’re going to make it possible for people to share the agents with each other, potentially monetize them. So the more people can start using AI in their day-to-day work.

And I’m not saying everyone should go and write a whole bunch of stuff that automates our thing, but I feel like, you know, and we see this a lot with coding because obviously the code assistants are where you’re getting a huge amount of leverage. It takes a while to figure out how to use these LLMs effectively. We now have an LLM that triages events in our SOC. And it’s going to take a while for us to tune that and figure out how to make it as good as it can be. It’s a learning experience, just learning how to use this new technology. I know that sounds a bit facile, but in my own experience, just trying to play with these things in a coding context, the answer is not, you know, one-shot code something and vibe code it, never look at the code. That’s not the right answer, right?

The right answer is something like constantly challenge the LLM. Did you make tests? Like, did you make sure that the abstraction barriers are maintained between the different components? Like almost treat it like a junior developer. And so I’ve sort of come away with this feeling like, man, you need to have a lot of experience just using this stuff. Even though, yes, it is magical in a lot of ways, it still requires, you know, finesse and taste to use it well. I think that’s going to be true for the use of these tools in a security context. Also, like you’re not just going to say AI fix, fix security now, please. Like that’s not going to ever be right. It’s going to be, did you verify that MFA is enabled for these accounts? Did you, like, and challenging it, right? And making it iterative.

Robert Dutt: So if I’m an MSP, start playing with it today. And if I have already started playing with it, think about what that next level, that next layer that I can start thinking about how to add on is and kind of build from there. And you’ll probably find your own path along the way as you identify what it’s good at, where it helps, et cetera.

Dave Baggett: It’s also funny because talking to developers who are new to using LLMs for coding, it’s like they don’t realize, I often tell them, like, why are you trying to do this yourself? Just ask the LLM to do it, right? No, I need to go and make sure they file. No, just ask. And it’s such a mindset change that even the way you approach work has to change, I think. And this is, I’m sure, equally true for sysadmin, DevOps kind of stuff, right? You know, I need to go and make sure all my VMs are, nope, nope, you don’t. You just ask Claude, right? And so, at least for me, it’s like I’ve benefited a lot from just using this stuff thoughtfully, which is why I share that. I mean, maybe this is not, maybe it’s more me than anybody else, but like, I just have found every day I’m learning something about how to use these things.

Robert Dutt: Yeah, no, I think that’s, I think it’s good advice and it’s, you know, it’s fundamental to doing it and the more you use it, the better you get at using it and the more you discover that you can do. So I think it’s sage advice.

Dave Baggett: It’s also funny because when people start using them in the beginning, they’re really polite and say please and stuff and you don’t need to.

Dave Baggett: Well, maybe the robot overlords will be mad at me in the future, but right now I’m pretty blunt with my LLMs.

Robert Dutt: Just do it. Yeah. All right. Dave, I appreciate your take the time. Thanks for walking us through the survey and some ideas on how MSPs can get the most out of their client’s security spend.

Dave Baggett: Absolutely. A lot of fun. Thanks.

Robert Dutt: Thanks again to Dave Baggett of Kaseya for joining us today and thanks to you for listening. Few things stood out for me from that conversation. First, I think there’s an important distinction between trying to eliminate human error and building security that can withstand it. People are going to make mistakes. They’re going to click things they shouldn’t, overlook warnings or struggle with complicated security requirements. The goal has to be making sure those mistakes don’t turn into major incidents. Second, I thought Dave’s comments about operational complexity were particularly interesting. We’ve spent years encouraging MSPs to add layers of security and for good reason, but every additional tool, control and management interface also creates work. If security becomes too difficult to administer, that introduces its own risks.

That’s where some of the opportunities around automation, integration and AI become particularly compelling, not necessarily replacing security professionals, but making their expertise go further by reducing the amount of time they spend on the tools themselves. And third, there’s the relationship between security maturity and business maturity. Kaseya’s research suggests that commercially successful MSPs are more likely to have mature security practices. That doesn’t necessarily mean one causes the other, but it reinforces the importance of treating security as an ongoing operational discipline, rather than simply a collection of products. I also appreciate Dave’s point that MSPs need to help customers understand the value of security before an incident or compliance requirement forces the issue.

That’s a business conversation as much as a technical one. You can find more about Kaseya’s 2026 Cybersecurity Report, along with links to the full research in the show notes at ChannelBuzz.ca. If you enjoyed the episode, please do subscribe to the podcast wherever you get your podcasts. And if you have a moment, a rating or review helps other people in the channel find the show. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Today’s headline news for Canadian IT solution providers:

• ConnectWise works to restore cloud services after Microsoft 365 security incident: ConnectWise continues investigating unauthorized access involving application identities associated with Cloud Backup, formerly known as SkyKick, after attackers used compromised credentials associated with the service to authenticate to customer Microsoft 365 environments.The company discovered the activity October 15 and subsequently disabled seven application identities. It also suspended Cloud Backup, SaaS Security and Cloud Management while conducting its investigation and validating remediation measures.

  As of Monday evening, the services had not been restored. Scheduled backups, access to affected backup archives and restoration capabilities remained unavailable, along with SaaS Security monitoring and certain Cloud Management functions.

  ConnectWise chief technology officer David Raissipour told CRN in an interview Monday that the disruption affects several thousand MSP partners worldwide. He said the company has made significant progress toward safely restoring services, although no restoration timetable has been confirmed.

  The underlying security incident extends beyond the operational disruption.

  Independent research by Huntress documented unauthorized Microsoft 365 authentication using a compromised ConnectWise Cloud Backup credential, with unauthorized sign-ins confirmed across more than 160 customer tenants.

  Huntress also identified activity in which a separate ConnectWise Cloud Management application assigned itself Global Administrator privileges in one tenant and added credentials to other trusted applications.

  That finding is significant because disabling the original affected application does not necessarily eliminate other credentials or permissions established during unauthorized activity.

  ConnectWise says the affected shared credentials have been invalidated. It has observed no successful threat activity in its monitored environments since October 17 at 1 a.m. Eastern.

  The company also reports no evidence that its stored backup archives have been accessed. Those findings do not establish whether individual live Microsoft 365 customer environments were affected.

  ConnectWise has expanded its technical guidance and published additional suspicious IP addresses for partners to investigate.

  MSPs are being advised to review their own Microsoft 365 tenants and every customer environment they manage, including dormant SkyKick connections. Recommended checks include application sign-ins, credentials, privileged roles, consent grants, policy changes and potentially unauthorized mailbox configurations.

  Partners should preserve relevant evidence and keep affected applications disabled until ConnectWise provides formal reconnection instructions.

  The incident highlights a growing security challenge for managed service providers: highly privileged third-party application identities can create exposure across multiple customer environments if their credentials are compromised.

  Because the investigation and service restoration efforts are continuing, affected providers should consult the ConnectWise Trust Center and live service-status page for developments after Monday evening.

• Cloudflare expands AI workspace integrations and deployment partnerships: Cloudflare has announced an expanded partner ecosystem for Cloudflare OS, its enterprise AI workspace designed to help organizations build and operate AI-driven workflows using existing business applications.New integrations connect the platform with applications including Asana, Box, Canva, ClickHouse, GitHub, Gong and Notion.Cloudflare OS allows users to describe tasks or automations in natural language, with the platform building workflows and connecting them to approved enterprise systems.Cloudflare says its approach emphasizes centralized security controls, limiting access to necessary data and providing visibility into AI activity. Its AI Gateway can also help organizations manage model selection and consumption costs.

  The company is working with managed-services and deployment organizations including EPAM, HappyCog and Towards AI to help customers implement the technology.

  Those partners can assist with identifying useful business processes, connecting enterprise applications, configuring controls and deploying AI agents.

  For Canadian solution providers, the announcement illustrates a growing services opportunity around AI implementation and governance.

  Rather than simply supplying AI software, partners may increasingly be responsible for integrating agents into customer workflows, controlling their access and managing their ongoing operation.

  Cloudflare has not announced a new Canadian MSP program or specific partner incentives as part of this expansion.

• Rewst makes AI-native MSP automation platform globally available: Rewst has announced worldwide availability of its new automation platform, allowing managed service providers to create workflows, forms, dashboards and client-facing applications through natural-language instructions.The October 13 release builds on capabilities previewed at Rewst’s FLOW conference earlier this year.The Rewst Agent can translate a description of an operational process into an automated workflow, using integrations and permissions already configured within the MSP’s environment.Users can inspect, test and modify the resulting workflows before approving them for deployment.

  Rewst says the platform maintains separation between customer environments and applies client-specific credentials and permissions to automated processes.

  The company reports that more than 110 MSPs participated in early access. During one 30-day period, those organizations collectively executed more than 1.25 million workflows and 58 million tasks across 340 integrations.

  Those are vendor-reported usage figures, rather than independent measures of productivity or cost savings.

  The platform is also designed to help MSPs create customer-facing applications and portals, potentially extending automation beyond internal service delivery into new billable offerings.

  For MSPs, the larger opportunity is to make automation accessible to employees who understand business processes but may not have specialized scripting or integration skills.

  The new platform is available globally to new customers. Existing customers will receive access progressively, while Rewst Classic remains supported.

In Brief

• Ottawa expands funding for Canadian AI adoption: The federal government has added C$500 million over five years to the Regional Artificial Intelligence Initiative, bringing total national funding to $700 million. The program supports eligible AI adoption and commercialization projects through regional development agencies. Applications are currently open in southern Ontario, with a January 19, 2027 final deadline and an earlier November 24 deadline for certain projects.
• Microsoft issues record October security update: Microsoft’s October 13 security updates addressed approximately 1,413 vulnerabilities across Windows, Office, SharePoint and other products. The release includes a Windows Shell security-feature bypass, CVE-2026-96951, that was already being exploited. MSPs should prioritize affected systems according to actual exposure and exploitation risk.
• Torq introduces new AI security operations partner program: Torq has launched Torq REV, a channel program for resellers, systems integrators, MSSPs and managed detection and response providers. The program includes deal protection, services-margin guarantees, technical enablement and different routes for partners to sell and deliver AI-driven security operations capabilities.
• Sabiki offers free Microsoft 365 AI-readiness assessments: Sabiki Security has introduced a free AI Readiness Scan designed to help MSPs and MSSPs identify risky Microsoft 365 configurations, excessive permissions and unmanaged non-human identities. The assessment performs more than 100 checks and includes selected automated remediation capabilities. Sabiki is positioning the free service as an entry point to its broader AIRM platform for monitoring and governing AI-agent identities.
• Canadian CISOs warn AI is accelerating security challenges: Kyndryl’s latest Canadian security-leadership discussions highlight concerns that AI is shortening the time available to identify and respond to vulnerabilities. Separately, Kyndryl’s 2026 modernization research found that only 46 percent of Canadian respondents were fully confident they understood their applications and dependencies before beginning modernization projects. The findings reinforce the importance of asset visibility and foundational security controls as organizations adopt AI.

Read Full Transcript

Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Tuesday, October 20, 2026, and here’s what’s happening in the channel today.

There’s a major security incident affecting ConnectWise and its managed service provider customers, and as of about nine o’clock Monday evening, the company is still working to restore several suspended cloud services.

ConnectWise discovered unauthorized access involving application identities associated with its Cloud Backup service, formerly known as SkyKick, last Thursday.

Over the weekend, the company disabled seven application identities and suspended Cloud Backup, SaaS Security and Cloud Management.

That means scheduled backups aren’t running, customers can’t access affected backup archives or restore data, and certain security monitoring and cloud management functions remain unavailable.

The disruption affects several thousand MSP partners worldwide, according to ConnectWise’s chief technology officer, David Raissipour, who spoke with CRN on Monday.

But there’s also a more serious security concern behind the service interruption.

Researchers at Huntress have documented unauthorized authentication to customer Microsoft 365 environments using compromised credentials associated with ConnectWise Cloud Backup.

They’ve identified unauthorized sign-ins across more than 160 customer tenants.

And in one environment, researchers found that a separate ConnectWise application had assigned itself Global Administrator privileges and added new credentials to other trusted applications.

That matters because simply disabling the original affected application may not remove additional access established during the attack.

ConnectWise says the affected shared credentials have been invalidated, and that it has not observed successful threat activity in the environments it monitors since early Saturday morning.

The company also says its existing backup archives remain encrypted and isolated, with no evidence they’ve been accessed.

And there are some encouraging signs on the recovery front.

Raissipour told CRN on Monday that the company has made significant progress in its investigation and remediation, although there’s still no confirmed restoration timetable.

For MSPs, the immediate priority is to review their own Microsoft 365 environments and every customer tenant they manage.

That includes checking application identities, authentication logs, permissions, administrator roles and any credentials that may have been added to other applications.

ConnectWise has published detailed instructions through its Trust Center, and is advising partners to keep affected applications disabled until formal restoration guidance is available.

The bigger lesson here is about the power, and potential risk, of trusted third-party integrations.

A backup platform needs extensive access to customer data to do its job.

But when the credentials associated with that access fall into the wrong hands, one compromised connection can potentially expose multiple customer environments.

This remains a developing incident, and listeners should check the ConnectWise Trust Center for updates after our Monday evening recording cutoff.

Cloudflare, meanwhile, is expanding the ecosystem around its enterprise AI workspace, Cloudflare OS.

The company announced Monday that it’s adding integrations with a range of widely used business applications.

Those include Asana, Box, Canva, ClickHouse, GitHub, Gong and Notion.

Cloudflare OS is designed to let employees describe tasks or workflows in ordinary language and have the platform build the necessary AI-powered automation.

The system can then connect that automation to the enterprise applications and information it needs.

Cloudflare says the objective is to make those connections useful without giving AI agents unnecessarily broad access to business data.

The platform runs within Cloudflare’s infrastructure and includes centralized controls for security, visibility and AI-model consumption.

But there’s also a significant services component to the announcement.

Cloudflare is working with organizations including EPAM, HappyCog and Towards AI to help customers deploy the technology.

Those partners can help identify business processes worth automating, connect existing applications, configure security controls and build AI agents around customer requirements.

And that’s an increasingly interesting opportunity for the channel.

Businesses may be able to buy access to an AI platform relatively easily.

But figuring out which processes should be automated, how the different systems should connect, and how to keep everything secure is a different challenge.

Those are areas where solution providers can bring considerable value.

Cloudflare hasn’t announced a new Canadian MSP program as part of this expansion.

But the broader direction is clear.

As AI moves from individual productivity tools into business workflows, integration, governance and ongoing management become increasingly important services.

And Rewst is bringing its next generation of MSP automation to market worldwide.

The company announced last week that its new AI-native automation platform is now available globally to new customers.

The idea is to make it easier for MSP employees to automate work without requiring everyone to become an expert in scripting or complex workflow design.

A technician or service manager can describe the process they want to automate in plain English.

The Rewst Agent then constructs the workflow using the integrations and permissions available in the MSP’s environment.

That could involve onboarding a new employee, reconciling software licenses, handling a routine service request or producing a customer report.

And the platform goes beyond traditional workflows.

It can also create forms, dashboards and client-facing applications.

Importantly, the resulting automation isn’t simply deployed without review.

Users can inspect and modify it before deciding whether it should go live.

Rewst says more than a hundred and ten MSPs participated in early access.

During one thirty-day period, those organizations collectively ran more than one-point-two-five million workflows.

Those are company-reported figures, but they illustrate the scale at which automation is already being used.

The more interesting question is what happens when building an automation becomes something that employees throughout an MSP can participate in.

That could reduce the amount of repetitive work handled by technicians.

It could also make it easier for MSPs to create new customer-facing services and applications using the systems they already manage.

The new platform is available worldwide for new customers, with existing customers moving over progressively.

In Brief – Ottawa has added another five hundred million Canadian dollars to its Regional Artificial Intelligence Initiative, expanding funding for eligible businesses adopting AI and Canadian companies commercializing AI technologies.

Microsoft’s October security update addressed approximately fourteen hundred vulnerabilities, including a Windows Shell security flaw that was already being exploited.

Torq has introduced a new partner program for AI-driven security operations, with protected opportunities, services-margin guarantees and support for resellers and managed security providers.

Sabiki Security has launched a free Microsoft 365 AI-readiness assessment to help MSPs identify risky configurations, excessive permissions and unmanaged AI-related identities.

And Kyndryl says Canadian security leaders are increasingly concerned about AI accelerating vulnerability exploitation while many organizations still lack a complete understanding of their application environments.

Full details and links in the show notes or the blog post.

Later today on In The Channel, Dave Baggett from Kaseya joins us to discuss why simpler security could actually mean stronger security for MSPs.

We look at findings from Kaseya’s latest cybersecurity research, the challenges created by managing too many security tools, and how MSPs can improve their operations while making better use of AI.

That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

Today’s headline news for Canadian IT solution providers:

• GTIA launches Managed Intelligence Alliance to establish standards for managed AI services: The Global Technology Industry Association has formally launched its Managed Intelligence Alliance, an initiative designed to help IT service providers deliver artificial intelligence to small and medium-sized businesses securely, responsibly and at scale.The Alliance was previewed at ChannelCon earlier this year and is being formally launched at Pax8 Beyond in Copenhagen.Pax8 is the charter member, with Rob Rae, the distributor’s corporate vice president of community and ecosystems, serving as chair.

  Founding participants include CrowdStrike, Cynet, F1 Information Technologies, Lyra, Microsoft, New Charter, NinjaOne, Rev.io and Sourcepass.

  The initiative will focus on four areas: open specifications to improve interoperability, capability standards for managed AI delivery, vendor-neutral accreditation, and research and guidance for the emerging market.

  GTIA says the resulting standards and accreditation frameworks will be published openly and made available at no cost, including to organizations outside its membership.

  The effort reflects a growing challenge for the channel. MSPs are increasingly being asked to help customers implement and manage AI, but common practices for delivering those services are still taking shape.

  GTIA hopes to help providers move beyond individual AI projects toward repeatable, governable managed services.

  The standards and accreditation programs remain to be developed. The announcement establishes the Alliance and its initial participants rather than introducing completed frameworks.

  For Canadian MSPs, the initiative could eventually provide a more consistent foundation for building managed AI offerings, demonstrating capabilities to customers and working across multiple vendors.

• Proofpoint agrees to acquire Varonis for $6.3 billion: Proofpoint and Varonis have entered a definitive acquisition agreement under which Proofpoint will acquire the data-security company in an all-cash transaction valued at approximately US$6.3 billion.Varonis shareholders will receive $49.75 per share. The transaction is expected to close in the first half of 2027, subject to shareholder approval, regulatory clearance and other conditions.Proofpoint is owned by private-equity firm Thoma Bravo. Ontario Teachers’ Pension Plan has also agreed to invest in Proofpoint in connection with the acquisition.

  The combination brings together Proofpoint’s capabilities in email security, threat protection and data-loss prevention with Varonis’ expertise in identifying sensitive data, analyzing access permissions, monitoring data activity and reducing exposure.

  The companies intend to develop a broader platform for protecting information accessed by employees, applications and AI agents.

  That strategy reflects an increasingly important security challenge: organizations need to understand not only which information is sensitive, but who and what can access it as AI becomes more deeply integrated into business operations.

  For solution providers, the proposed combination could eventually create opportunities around data security, AI governance, permissions management and managed security services.

  However, the companies will remain independent until the acquisition closes. No changes to their respective channel programs or immediate product integrations have been announced.

  The acquisition follows Proofpoint’s separate announcement last week of new Microsoft 365 security capabilities for its MSP platform.

• Upstream Works introduces partner-led Totalix contact-centre platform: Woodbridge, Ontario-based Upstream Works has introduced Totalix, a new omnichannel contact-centre platform designed to operate within the business applications employees already use.Totalix is the company’s Version 8 platform, announced October 14, with an expanded channel strategy detailed October 16.Upstream Works says a new Totalix tenant can be provisioned in approximately one minute, without the engineering work traditionally associated with contact-centre deployments.

  The platform supports a fixed per-agent monthly pricing model and includes Totalix Mobile, which extends customer-engagement capabilities to employees working outside conventional contact centres.

  The offering will be sold through Upstream Works’ network of more than 50 partners, including resellers, systems integrators, carriers, technology partners and advisors.

  Partners will be able to resell Totalix or host it for customers. The company is also introducing an enhanced partner program alongside the new platform.

  Another unusual element is Totalix YOUR, a program under which customers on qualifying three-year agreements can submit an annual feature request for inclusion in the product roadmap, subject to program terms.

  Early-adopter availability begins in November, with general availability scheduled for December 1, 2026.

  For Canadian solution providers supporting communications, CRM and customer-experience environments, the announcement represents an opportunity to deliver contact-centre capabilities with simpler deployment and more predictable recurring costs.

In Brief

• Cohere moves to acquire AI cybersecurity specialist AISLE: Toronto-based Cohere has signed a letter of intent to acquire AISLE, a cybersecurity company developing AI systems capable of discovering and helping remediate software vulnerabilities. The proposed transaction would strengthen Cohere’s security capabilities as it expands its sovereign AI platform for enterprises and governments. Financial terms were not disclosed, and the acquisition has not yet been completed.
• Keeper Security connects Tenable findings with privileged-access remediation: Keeper Security has announced new integrations with Tenable that connect cloud-security findings with credential management and privileged-access controls. Security teams can use the integrations to address selected identity and access risks through actions such as credential rotation, reduced standing privileges and just-in-time access. The goal is to reduce the gap between identifying an exposure and taking corrective action.
• Researchers warn MSPs about actively exploited Ahsay backup vulnerabilities: Huntress has documented attacks exploiting vulnerabilities in AhsayCBS backup management software, while new research from Bitdefenderprovides additional details about the activity. Ahsay’s earlier patches did not fully address the flaws. Providers running affected installations should apply the current hotfixes—10.3.4.45 for version 10 or 9.15.2.70 for versions 7 through 9—and investigate for evidence of compromise.
• Qualys expands automated vulnerability remediation: Qualys has introduced TruRisk Eliminate 2.0 with TruConfidence, adding AI-assisted remediation planning, patch reliability scoring, staged deployment and post-remediation health checks. The platform is designed to help security and IT teams address vulnerabilities while reducing the risk that automated fixes disrupt business operations. The update is generally available to existing TruRisk Eliminate customers.

Read Full Transcript

Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Monday, October 19, 2026, and here’s what’s happening in the channel today.

There’s a potentially significant development for the future of managed services, as the Global Technology Industry Association formally launches its Managed Intelligence Alliance.

The initiative is designed to help IT service providers build secure, responsible and repeatable AI services for small and medium-sized businesses.

It was previewed at ChannelCon earlier this year, and is being formally launched today at Pax8 Beyond in Copenhagen.

Pax8 is the charter member, with Rob Rae serving as chair.

And the founding participants represent a substantial cross-section of the industry.

They include CrowdStrike, Cynet, Microsoft, NinjaOne, Rev.io, Sourcepass, New Charter, Lyra and F1 Information Technologies.

The Alliance will focus on four areas.

First, open specifications to improve interoperability between AI systems.

Second, capability standards defining what providers need to deliver managed AI services.

Third, vendor-neutral accreditation.

And fourth, research and guidance to help the industry understand this emerging market.

One particularly interesting detail is that GTIA intends to make its standards and accreditation frameworks openly available at no cost.

That’s important because MSPs are increasingly being asked to help customers deploy and manage AI, but there’s not yet a common understanding of what that service should include.

Every vendor is developing its own approach to AI governance, security and management.

GTIA is attempting to help the channel establish some shared practices across those different technologies.

Of course, the Alliance is just getting started. The standards and accreditation programs still need to be developed.

But the bigger opportunity is clear.

If managed AI is going to become a sustainable service category, providers need something more repeatable than a series of individual consulting projects.

And GTIA is trying to help establish that foundation.

There’s also a major cybersecurity acquisition in the works.

Proofpoint has agreed to acquire Varonis in an all-cash transaction valued at approximately six-point-three billion U.S. dollars.

Varonis shareholders will receive forty-nine dollars and seventy-five cents per share.

The deal is expected to close in the first half of next year, subject to the usual approvals.

And there’s an interesting Canadian connection.

Ontario Teachers’ Pension Plan has agreed to invest in Proofpoint in connection with the acquisition.

Proofpoint is already a major provider of email security, threat protection and data-loss prevention.

Varonis specializes in identifying sensitive information, understanding who can access it, and monitoring how that data is used.

And bringing those capabilities together is particularly relevant as businesses begin deploying more AI agents.

An AI system may have legitimate access to business applications.

But that doesn’t necessarily mean it should be able to retrieve every document, customer record or piece of confidential information those applications contain.

Organizations increasingly need to understand both what their sensitive data is and how people and AI systems can interact with it.

That’s the broader security opportunity Proofpoint sees in the combination.

For partners, it could eventually mean a more comprehensive platform for data security and AI governance.

But the companies will continue operating independently until the acquisition closes, and there’s no announced change to their channel programs yet.

This follows Proofpoint’s separate announcement last week of new Microsoft 365 security capabilities for MSPs.

So we’re seeing the company expand on two fronts: building out its existing MSP offering, and pursuing a much broader data-security strategy through acquisition.

And a Canadian technology company is introducing a new contact-centre platform with a distinctly channel-focused approach.

Woodbridge, Ontario-based Upstream Works has unveiled Totalix, a new omnichannel contact-centre offering designed to run inside the business applications employees already use.

The company says a new Totalix tenant can be provisioned in about a minute, without the engineering work traditionally associated with deploying a contact centre.

That’s a significant change from projects that can take weeks or months to configure and integrate.

Totalix uses a fixed per-agent monthly pricing model.

It also includes a mobile offering that extends customer-engagement capabilities to employees outside traditional contact-centre roles.

And the company is taking the platform to market through its network of more than fifty partners.

That includes resellers, systems integrators, carriers and technology advisors.

Partners will be able to resell Totalix or host it for their customers.

Upstream Works is also introducing an enhanced partner program alongside the new platform.

Another interesting addition is a program called Totalix YOUR.

Under qualifying three-year agreements, customers can submit an annual feature request for inclusion in the product roadmap, subject to the program’s terms.

That’s an unusual way of giving customers a more direct role in shaping a product.

Totalix opens to early adopters in November, with general availability planned for December first.

For Canadian solution providers working in communications, CRM and customer experience, the opportunity is to deliver contact-centre services with simpler deployment and more predictable recurring costs.

In Brief – Toronto-based Cohere has signed a letter of intent to acquire AI cybersecurity specialist AISLE, expanding its ambitions in secure and sovereign enterprise AI.

Keeper Security and Tenable have announced integrations connecting cloud-security findings with privileged-access remediation, including credential rotation and just-in-time access controls.

Security researchers are warning MSPs about actively exploited vulnerabilities in Ahsay backup management software. Updated hotfixes are available, and providers should also investigate potentially compromised servers.

And Qualys has introduced TruRisk Eliminate two-point-oh, adding more automated remediation planning, staged deployment and post-change verification to its vulnerability-management capabilities.

Full details and links in the show notes or the blog post.

That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

Today’s headline news for Canadian IT solution providers:

• Acronis appoints former WatchGuard CEO Prakash Panjwani: Acronis has named Prakash Panjwani chief executive officer, effective immediately. He succeeds Jan-Jaap “JJ” Jager, who will remain a shareholder in the company.Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. During roughly a decade at WatchGuard, he helped transform the company from a firewall-focused vendor into a broader cybersecurity platform provider, expanding its capabilities in endpoint protection, extended detection and response, and managed security.Acronis is highlighting his experience building MSP-focused platforms, integrating security technologies and expanding businesses through organic growth and acquisitions.

  The company has increasingly positioned its portfolio around the convergence of data protection, cybersecurity, infrastructure management and service automation. Panjwani’s appointment suggests that strategy will remain central to its next stage of development.

  For Canadian MSPs, the important questions concern how Acronis will continue integrating those capabilities, simplifying service delivery and supporting partner profitability.

  No immediate changes to the company’s partner program, pricing or product roadmap were announced.

• Virtuozzo introduces smaller infrastructure deployments and updated GPU support: Virtuozzo Infrastructure System 8.0 introduces a lite deployment option designed for environments requiring just one or two servers.The new configuration combines compute, management and storage on local disks, eliminating the need for a separate shared-storage network in smaller deployments. Virtuozzo is targeting service providers, smaller businesses, branch locations and customers that need infrastructure running on their own premises.Version 8.0 also updates Nvidia support to R595 and vGPU v20, allowing dedicated and shared GPU resources on the same host. The company has also made its built-in migration tool for VMware vSphere 8 generally available.

  Virtuozzo says a one-server configuration can deliver approximately 53 percent lower total cost of ownership than VMware, although actual savings will depend on configuration, licensing and workload requirements.

  The lite deployment is not equivalent to a conventional high-availability cluster. Virtuozzo says customers requiring automatic virtual-machine failover need additional nodes and shared storage.

  For Canadian MSPs and smaller cloud providers, the release offers another approach to delivering managed infrastructure and localized AI workloads without requiring customers to commit to larger deployments from the outset.

• Proofpoint expands Microsoft 365 security capabilities for MSPs: Proofpoint’s MSP Platform business is introducing new security and management capabilities designed to help service providers strengthen customers’ Microsoft 365 environments ahead of broader AI adoption.The additions include Tenant Risk Exposure, a new capability within 365 Permission Manager that will highlight excessive sharing permissions, anonymous access, inactive guest accounts, public groups and other potential security exposures across Microsoft 365 tenants.Proofpoint is also introducing greater explainability for AI-powered email-security decisions, allowing administrators to better understand why messages are classified as suspicious or legitimate.

  Its Security Awareness Service is expanding adaptive training into Microsoft Teams, while a new AI Cyber Assistant inside the management console will help MSPs with onboarding, configuration, product guidance and customer consultations.

  The developments build on Proofpoint’s dedicated MSP Platform business, established following its acquisition of Hornetsecurity and expanded into North America earlier this year.

  For MSPs, the opportunity is to address two related problems: securing the data and permissions that AI systems may access, and reducing the technician workload associated with managing those controls across multiple customers.

  The new capabilities are scheduled to roll out during the fourth quarter of 2026. Canadian availability of individual features should be confirmed.

In Brief

• Commvault adds threat hunting to Microsoft 365 backups: Commvault has announced new security capabilities for Microsoft 365 backup data, including scanning protected Exchange, OneDrive, SharePoint and Teams content for malware, suspicious activity and other indicators of compromise. The technology is designed to help organizations identify trustworthy recovery points and reduce the risk of restoring compromised data. Early access is expected in the coming weeks, with general availability targeted for early 2027 as paid add-ons.
• Descope expands identity governance for internal AI agents: Descope has introduced Agentic Identity Hub 3.0, adding controls for organizations deploying internal AI agents and Model Context Protocol servers. The release includes agent ownership and approval workflows, least-privilege access enforcement, authentication and audit trails. The goal is to help organizations govern not just who an AI agent is, but what it is authorized to do.
• Intermedia expands healthcare communications integrations: Intermedia has expanded its healthcare communications offering with AI-powered patient engagement, appointment scheduling, digital forms, payments and connections to 15 electronic health record and practice-management systems. The company says the enhancements respond to demand from its channel partners for more industry-specific solutions. The development gives partners serving healthcare customers opportunities to connect communications with broader administrative workflows.
• VanishID targets AI-assisted help-desk impersonation: VanishID has introduced an automated response playbook designed to counter attackers who impersonate corporate help-desk personnel when contacting employees. The company says its platform evaluates exposed identity information and triggers appropriate countermeasures through existing security tools. The new playbook is available to current External Identity Protection customers.

Read Full Transcript

Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Friday, October 16, 2026, and here’s what’s happening in the channel today.

There’s a significant leadership change at Acronis, one of the largest technology platform providers serving managed service providers.

The company has appointed Prakash Panjwani as its new chief executive officer, effective immediately.

He replaces Jan-Jaap Jager, who will remain an Acronis shareholder.

Panjwani is a familiar name in the cybersecurity business, particularly for anyone who’s followed WatchGuard over the years.

He spent roughly a decade as WatchGuard’s CEO, helping transform the company from a firewall-focused vendor into a much broader security platform provider.

That included expansion into endpoint security, extended detection and response, and managed detection and response.

Before WatchGuard, Panjwani also served as CEO of SafeNet.

And that background is particularly interesting given the direction Acronis has been taking.

The company has been steadily bringing together data protection, cybersecurity, infrastructure management and service automation.

The objective is to give MSPs more of the capabilities they need through a single platform, reducing the number of separate tools and management environments they have to operate.

That’s a familiar strategy across the MSP technology market.

But the challenge is making the different components work together well enough that partners actually become more efficient.

Acronis says Panjwani’s experience integrating security technologies, building channel businesses and driving growth through acquisitions makes him well suited to its next stage of development.

For MSPs, there are several questions worth watching.

Will Acronis accelerate its expansion into managed security?

Will it continue adding capabilities through acquisitions?

And how will it balance a broader platform strategy with the need to keep its products straightforward and profitable for service providers?

The company hasn’t announced specific changes to its partner program, pricing or product roadmap.

But the choice of CEO offers a pretty clear indication of the experience Acronis wants leading its business.

And incidentally, if Panjwani’s former employer sounds familiar, yesterday’s In The Channel featured current WatchGuard CEO Joe Smolarski.

More on that conversation in a moment.

Virtuozzo, meanwhile, is making it possible to deploy its cloud infrastructure platform on considerably smaller systems.

The company has released version eight of Virtuozzo Infrastructure System, with a new lite deployment option that can operate on just one or two servers.

That may sound like a relatively small technical change.

But it has potentially significant implications for the economics of delivering managed infrastructure.

Traditional infrastructure deployments can require multiple servers and shared storage, even when the customer’s actual workload is fairly modest.

That can make it difficult to justify the initial investment for smaller organizations or individual locations.

Virtuozzo’s new option combines compute, management and storage on the same server, using local disks rather than requiring a separate storage network.

The company is targeting smaller businesses, branch offices and customers that need infrastructure running on their own premises.

Version eight also updates Nvidia GPU support, allowing providers to run dedicated and shared GPU workloads on the same host.

And Virtuozzo’s built-in migration tool for VMware vSphere eight is now generally available.

That makes the release particularly relevant to partners looking for alternatives to VMware.

Virtuozzo says a one-server configuration can deliver approximately fifty-three percent lower total cost of ownership than VMware.

Of course, that’s a vendor-provided comparison, and the actual economics will depend on the customer’s requirements.

There’s also an important distinction between a smaller deployment and a highly available one.

A single-server configuration doesn’t provide the same resilience as a multi-node cluster.

Customers that need automatic virtual-machine failover will still require additional infrastructure.

But for MSPs and smaller cloud providers, this could create opportunities to offer managed infrastructure, private cloud services and localized AI workloads at a lower entry point.

And in a market where both infrastructure costs and data-location requirements are getting more attention, that flexibility may be increasingly valuable.

Proofpoint is also expanding its security platform for managed service providers, with a new set of capabilities focused on Microsoft 365.

The company says the additions are designed to strengthen the security foundations organizations need before expanding their use of AI.

And the most interesting part is that many of those foundations involve problems MSPs have been dealing with for years.

Things like excessive permissions, outdated guest accounts and files that are shared more broadly than they should be.

Those problems become more significant when AI applications can access and work with the same information.

Proofpoint is introducing a capability called Tenant Risk Exposure within its 365 Permission Manager.

It will give MSPs and administrators a clearer picture of risky sharing settings and permissions across customer environments.

That includes anonymous access, external users, public groups, inactive guests and accounts that no longer have an appropriate owner.

The company is also adding more explanation to its AI-powered email-security assessments.

The idea is to help technicians understand why a message was classified as suspicious or legitimate, making it easier to investigate unusual decisions or false positives.

And Proofpoint is extending its adaptive security awareness training into Microsoft Teams.

It also has a new AI Cyber Assistant coming to its management console, designed to help MSPs with product configuration, support and customer consultations.

These additions build on the dedicated MSP business Proofpoint established after acquiring Hornetsecurity.

The larger story is that securing Microsoft 365 increasingly involves more than stopping malicious email.

MSPs also need to understand how information is shared, who can access it, and what happens when AI systems start working with that data.

And they need to manage those controls efficiently across multiple customer environments.

Proofpoint says the new capabilities will roll out during the fourth quarter.

In Brief – Commvault is adding threat-hunting capabilities to Microsoft 365 backups, helping organizations identify compromised data and determine which recovery points are safe to restore.

Descope has launched Agentic Identity Hub three-point-oh, with new governance and access controls for internal AI agents and the systems they connect to.

Intermedia has expanded its healthcare communications offering with AI-powered patient engagement and connections to fifteen electronic health record and practice-management systems.

And VanishID has introduced an automated response playbook designed to counter attackers who impersonate corporate help-desk personnel when contacting employees.

Full details and links in the show notes or the blog post.

If you haven’t heard it yet, yesterday’s In The Channel features WatchGuard CEO Joe Smolarski, discussing how AI governance is becoming a new managed-service opportunity.

We talk about how MSPs can help customers identify and secure the AI tools employees are already using, why Joe believes AI governance should become a separately monetized service, and how WatchGuard is adapting its roadmap to support those opportunities.

That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

Joe Smolarski, CEO of WatchGuard

Artificial intelligence is creating a new challenge for managed service providers: helping customers secure and govern AI tools that employees may already be using without their organizations’ knowledge.

According to WatchGuard’s 2026 Cybersecurity Hygiene Report, 64 per cent of employees are using AI tools their employers haven’t approved for work. For WatchGuard CEO Joe Smolarski, that makes AI governance an increasingly important opportunity for MSPs.

In this episode of In The Channel, Smolarski argues that MSPs need to move beyond simply helping customers adopt AI to providing ongoing visibility, governance and security. He believes those capabilities should become separately monetized managed services rather than being absorbed into existing security packages.

Speaking following WatchGuard’s IMPACT North America partner conference in Nashville, Smolarski also discusses how the company is adapting its product roadmap to support those opportunities.

That includes a $10 million AI investment initiative shaped by MSP feedback, the expansion of WatchGuard’s Rai agentic AI workforce, and a commitment to delivering new AI agents every two weeks. Smolarski also outlines the company’s efforts to strengthen its ability to prevent sensitive information from being exposed through AI applications.

The conversation explores the growing divide between larger MSPs developing their own AI capabilities and smaller providers that increasingly depend on technology partners for expertise and automation.

And looking ahead, Smolarski warns that autonomous AI agents could introduce a new category of security risks, particularly when agents operate with privileges that organizations don’t fully understand or control.

For MSPs, the challenge is no longer simply helping customers adopt AI. It’s determining how to manage it securely, deliver those services efficiently, and build a sustainable business around them.

Read Full Transcript

Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. For the last couple of years, we’ve spent a lot of time talking about how managed service providers can help their customers adopt artificial intelligence. But there’s another side of the opportunity that’s becoming increasingly difficult to ignore, helping customers manage and secure the AI they’re already using, whether their IT department knows about it or not.

WatchGuard’s recent cybersecurity hygiene report found that nearly two-thirds of employees are putting work-related information into AI tools that haven’t been approved by their organization. That’s an enormous potential security and governance problem. But for MSPs, it may also represent a significant new business opportunity. My guest today is Joe Smolarski, CEO of WatchGuard Technologies, who joins us fresh off the company’s North American Partner Conference in Nashville.

Joe argues that AI governance is quickly becoming a necessary part of the MSPs portfolio and that at least for the foreseeable future, it’s something MSPs should be able to monetize as a distinct managed service rather than simply absorbing into their existing offerings. We’ll discuss what that service might look like, how MSPs can demonstrate its value to customers, and why the transition from shadow AI to autonomous AI agents could make the stakes considerably higher.

We’ll also get into WatchGuard’s own AI strategy, including its efforts to let MSPs help shape its development roadmap, a commitment to delivering new AI agents every two weeks, and some interesting developments on the data governance front. It’s a conversation about the risks of AI, certainly, but perhaps more importantly, it’s about how MSPs can turn those risks into opportunities while preparing for what comes next. Let’s get right into it, my chat with Joe Smolarski.

Robert Dutt: Joe, thanks for taking the time. Good to talk to you again.

Joe Smolarski: Yeah, Rob, great to see you and great to be here. Thank you so much.

Robert Dutt: Your cybersecurity hygiene report found that almost two-thirds of employees are putting work-related information into AI tools that their organizations haven’t approved. That’s pretty remarkable. We’ve talked about shadow AI for a while, but we’re at the point where almost two-thirds of organizations, two-thirds of people in organizations are doing that kind of thing. Are we at the point where businesses have pretty much lost control of how AI is being adopted inside their organizations?

Joe Smolarski: They have, Rob, because this is a predicament unlike almost any other in the fact that there’s actually, the employees aren’t doing anything wrong from their perspective, not even close. They’re actually trying to be good employees, and they’re trying to be good employees because all of us, including me, are pressuring people that you’ve got to use AI, you’ve got to be more efficient. If you’re not using AI, you’re not tech forward and things like that.

That’s literally the corporate direction of every company at this stage because you feel like you’re going to not be able to compete with your competitors that are out there because if they get the AI advantage, et cetera. What’s happening, because a lot of the corporate AI deployments just aren’t where they need to be. They’re still kind of trialing things and kicking the tires and rolling some things out. Employees feel the pressure of, “I may lose my job if I’m not AI savvy and I’m not using AI to produce more,” et cetera.

They’re out there feeling like they’re being a progressive employee, downloading their own applications and whether it’s the standard stuff. Some of them are creating agents and it’s not even technical people. This is a tongue-in-cheek joke, but I joke that my sales team, they’re not technical, they’re salespeople. Yet my head of sales is out there creating agents to do things to automate the task. I always joke with them that if a sales guy can do it, anybody can literally do it. That’s the weird situation that we’re in.

You can’t shut it down because if you shut it down and you just block everything and take the maybe more conservative approach, then you’re going to be at a competitive disadvantage of these firms in particular like in the MSP world, et cetera, but also their end customers. So it’s very, very interesting time to be in this space right now.

Robert Dutt: You’ve got so much pressure coming in in both directions and the role of IT or whoever is overseeing this can sometimes be at odds with the executive crew that’s go hard, go fast.

Joe Smolarski: 100%. Yeah. At my last firm, I was trying to get an AI tool approved because I was getting pressure from the board and literally sat there for three months waiting for approval. I got disgusted and said, “Guys, I can’t wait anymore. I’m going to get fired. We’ve got to get this thing approved.” And I had to literally sign my life away and put my personal commitment that the tool was safe and those kinds of things. So yeah, there’s backlogs.

There’s all kinds of issues that are making it more complex, but we have to navigate it because as we all know, while obviously there’s smoke and mirrors and some of what you hear is bullshit, most of it is accurate and there’s no doubt this is a technology transformation unlike probably anything we’ve seen in a very, very long time.

Robert Dutt: So to your point on that, that pressure that’s coming from both sides on the, we’ll call it the, you said the salesperson, the average employee, whoever that is in whatever role they’re in. Your research talks about AI governance and shadow AI as two of the biggest challenges that MSPs are helping their customers address, but are those really two separate problems or are they kind of the same thing from two different perspectives?

Joe Smolarski: Yeah, I would agree. It is the same thing and what is super, super important because we already concluded you can’t just be overly conservative and stop everything and block everything. Since you can’t, then you better know what’s going on in your environment because ultimately you have to understand how your employees are exposing the firm. So by using things like the WatchGuard stack, because very often it’s not just one tool. You can’t just pop in one tool. There’s so many ways that they can get around things.

They can use their corporate account, their personal account. They can do things in the network. They can create agents. You just don’t know where it’s happening. So by having the right governance in a cybersecurity stack, WatchGuard or others, you certainly get the visibility. You then can make some decisions. Is this the right people with the right tools that we want? What types of data are they putting in there? Many firms, we had 500 MSPs at our North American conference this week.

We asked, even basics, who has an acceptable use policy for all of their end customers? They don’t even have that when it comes to AI and things like that. So you can get a lot of the basics in place by knowing what’s happening in your environment by having shadow AI visibility and tooling to decide what to do. Then of course, you can set up rules and configurations and everything else to then go from there.

Robert Dutt: So let’s take this a little further from the MSPs perspective. We’ve been talking for a while about MSPs helping customers adopt AI. Is there now a significant opportunity in helping them manage and secure what they’re already using? Basically, is AI governance becoming a distinct managed service opportunity on top of rolling it out, developing it, strategizing it, et cetera?

Joe Smolarski: Yeah, it certainly is, Rob, from both sides. We talked about the one side of AI from a “you have to be using it from an efficiency perspective.” I talked with one of the larger MSPs in North America two days ago, and he said he’s changing his model. He’s now putting a business analyst as the first person to go to a new customer to sit with them and understand how their business works and how they can use AI, not in a way that just gets them frustrated because it’s giving them a poor experience, but one that’s tailored to their business, etc.

You have that side of it that you have MSPs absolutely monetizing the opportunity. Then on the security side, I think one of the good things is the media is doing the work for us in terms of one of the biggest challenges for MSP is the fact that they’ve got to educate their clients on why they need security and why they need this and why they need all these different components and it’s super tiring for MSPs to have to do that, etc. In the case of AI, literally at the top of world news over the last couple of weeks is Dario and Sam from the big LLM companies, Anthropic and OpenAI, saying that if we don’t slow this thing down, very bad things are going to happen in this world and that’s the leading opener on world news every night.

At least the businesses are seeing that and they they absolutely are recognizing I need help. Quite frankly, Canada in particular, but US as well, Canada runs on small and medium-sized businesses. That’s the bulk of the economy and none of them can hire an AI governance team, literally zero. That’s going to be the MSP and the MSP gets to monetize that and to your point, it’s a separate service that they can layer on top that the firms don’t need to be overly convinced because of all the attention being placed in the media, etc.

Robert Dutt: Especially as an MSP is spinning this up, what does it look like? How are we helping customers recognize the value before something goes wrong? I guess I’m curious, do you think customers are looking for MSPs to help with the governance or is it still something that MSPs have to educate them about and do that role that you’re describing of providing the information, even if it’s headline news?

Joe Smolarski: Yeah, it’s a little bit of both. Like I said, I think that the media has made our jobs a little bit easier because it’s not completely foreign to them and they don’t think you’re a crazy person by saying that very bad things can happen to your environment. Hey, listen, 60% of the firms that get hit with an attack or a major compliance fine or whatever, they’re out of business within four months. So that recognition is there, I think, at this stage for most of the MSPs.

And then listen, MSPs need help because you have MSPs of all sizes. Some are very, very large and in Canada, your F12s and others that, or even your telcos and things like that, that have a big presence. But most MSPs are on the smaller side, supporting the local businesses around their communities. And they need a large vendor that can help them, help them with resources, help them with educating their end customers and various webinars and things like that.

And that’s where your WatchGuard and your industry leaders will help the MSPs, at least with that entry level of why their end customers need it, et cetera.

Robert Dutt: So especially for that smaller MSP and especially the one maybe who hasn’t gone too far down this road, if I want to start offering AI governance services, what does that look like? What am I assessing? What am I monitoring? What am I delivering to a customer? What does the service model look like?

Joe Smolarski: Number one, one of the great things that MSPs have done is use tooling even before the ink is signed on a contract to just show the prospect at that stage what they are not aware of that’s happening in their environment. And a lot of the shadow AI tooling, including WatchGuard, can help you do that before you even sign a deal. So you can literally spend five minutes and configure some tools and it pops up and they’re able to say, “Mr. Acme Corporation, Mr.

Bob’s dental office or law office, are you aware that 93 of your employees have uploaded sensitive data in your environments? Are you aware that 120 of them have subscriptions for blah, blah, blah, that they’re being used in your corporate offices?” So that in and of itself is such a great way for an MSP not to have to do a ton of work, but literally very briefly, very quickly show a prospect and future customer that this is what’s going on in your environment and this is why you need me as an MSP to help you stay protected so that you’re not running blind because we know if you run blind in some of these areas, very, very bad things can happen, right?

You have your hugging face situations obviously at a big global scale, but that’s happening across the board, right? That’s happening when people are creating agents, not because they’re malicious, they’re creating agents because they’re afraid they’re going to lose their job, that if they don’t become more efficient and stay up with everybody that’s using AI, that they’re going to be obsolete. So they go and do these things with very good intentions and many IT departments haven’t caught up.

So this agent isn’t, the identity of that agent isn’t protected the way you would protect a human being and it goes off and does very, very bad things in an environment and can ultimately put somebody out of business exposing customer data, which obviously once things like that happen to SMBs, again, can be a business killer. Or if you’re a executive assistant at a dental office and she’s doing her best and she tries to get something done, but unfortunately uploads sensitive medical data in a tool, not knowing it’s going out into the ether and that’s a HIPAA violation, et cetera.

So it’s all of those things that companies like WatchGuard and others can help you fight against and get the visibility and then govern and stay on top of it while allowing them to progress their company’s efficiency efforts to keep up with the times and stay competitive.

Robert Dutt: From the MSPs perspective, how do you see the economics developing over time? Is this something that an MSP can package up and charge for separately or does it kind of, like so many things in various transitions of the past have over time, kind of been rolled into table stakes and just another responsibility that they have to deliver to customers because that’s what an MSP does.

Joe Smolarski: Understood. So I would say first, number one, you have to be doing something as an MSP. You have to be doing something. You must be doing something from a cybersecurity perspective to protect against AI. So whether it gets monetized or not, I do believe if you want to be in business 18 months from now, you have to be on top of that game just the way 15 years ago you were for antivirus or whatever it may be. So I think that’s the level, that’s the pace that’s happening right now.

The people smarter than me, billionaires in the investment world, they don’t talk about AI and kind of the models of today. Everybody knows where these things are going, the velocity and how fast the world is changing. So having that visibility, not as well, maybe it’ll happen, but knowing how fast these models are going to automate so many different things and do very, very promising things and very scary things, an MSP has to be in the game. So it’s not up for debate.

And then in terms of monetizing it, there’s no doubt to me in the next, call it midterm, 12, 24 months, that this should be an incremental service that’s being provided. This is not something that just gets folded in to the rest of the services and all of a sudden it’s part of your platinum package or whatever. I think it is so top of mind, not only for MSPs, but the world, SMBs, large companies and everything in between, that this should be a separate line item that you’re monetizing to keep them protected and sleeping well at night.

Robert Dutt: We’re coming off your partner conference just earlier this week as we speak, a little bit after that as this airs, I’m pretty sure. And there, I’m sure you guys were rolling out the company’s priorities, the product direction. How much of the roadmap right now is being shaped by AI governance opportunities that we’re talking about? And where do you see WatchGuard helping MSPs build those capabilities?

Joe Smolarski: Yeah. WatchGuard’s in a very fortunate position that we’ve got almost the entire stack covered. And again, a large part of our strategic direction is don’t just add more tools, but put the AI security capabilities in every layer of the stack, et cetera. And a good example of that is like we’ve been talking about with shadow AI. So with shadow AI, we’ve got it from a SaaS security perspective. And so we’ve got shadow AI in our CloudDR SaaS security application so that you can see what’s happening in all your SaaS applications and see what subscriptions are being signed up for and what tools are being signed up for.

You get visibility into all of that with our SaaS security, but you got to know what’s happening in the network, what agents are running, what other applications are running, what’s happening in a corner over here, et cetera. So we built the shadow AI capabilities and announced it to the world this week from a firewall perspective. The red Fireboxes that WatchGuard is so famous for. And then you’ve got your remote users and your remote users are out there and they’re doing anything they want.

They’re using their personal accounts and it’s much, much tougher to govern. So with our focus on remote user security and our SaaS application, we built it in there. So I could even see if you’re using ChatGPT or OpenAI or agents using your personal accounts as well to just make sure you’re covered across the board. So that’s on the AI security. And again, we’re doing it in every single layer. We’ve got it embedded in the endpoint, looking for algorithms using AI in our own models and everything else.

But then it’s also imperative to address the overwhelmed MSP that just doesn’t have the labor to keep up with all of these new things and everything else. So we launched our agentic workforce. We announced it in May, it’s called Rai, R-A-I. And ultimately, it became very real in this October time period. We flew in, we had MSPs from 20 countries around the world, but we flew in five contest winners. You may have seen, we launched a $10 million investment campaign that said, you know what, it’s funny, I actually, I went to the board about four months ago and told them I needed incremental funding to make sure that WatchGuard was ahead of the game from an AI perspective.

And my first pass, I got rejected, which is never good. You get pissed off and all of that. But what we went back with was, you know what, we are not going to define what we’re going to build with the 10 million. We’re going to have our MSPs, we have 25,000 MSPs, and we’re going to get the feedback from them on exactly what we need to build versus a bunch of mad scientists in a WatchGuard office on a whiteboard, et cetera. So we launched the campaign, we had five winners from around the world, and we brought them in and ultimately showed the fruits of their labor from an agent doing work on their behalf so that they can just get out of the mundane and focus on some of the more value add activities as well.

So it’s a heck of a time in the industry, and we believe WatchGuard is at the forefront of that.

Robert Dutt: Any surprises in what that surfaced, what MSPs told you they wanted needed to do for their customers as opposed to what you guys may have thought you were going to end up building going into it?

Joe Smolarski: Yeah, no doubt. We were super thrilled that we took that direction because for as much as we try, like every firm tries to stay super close to your customers and get feedback and listen, nothing better than putting some skin in the game for them and the fact that we’re going to go build if we like your ideas, we’re going to go build it and we’re going to give it to you and we’re going to help you automate your business without you spending any money. And that got people super excited.

And I think overall the focus on getting not even the super fancy things, but just get rid of the manual labor that I know when you see the power of AI that you can just get rid of that when we are doing a competitive displacement, right? There’s a lot of our competitors out there have had a bunch of, you know, major vulnerabilities and CVEs. So you got somebody coming across from one of those to become more secure. And it’s like, you know, AI is awesome at saying, I want to go from here to here, do a conversion for me.

And previously, that’s like a very time consuming effort. And in this situation, that’s what they’re asking for is cut out that labor, let me convert from one of your competitors over to you very quickly. And we’ve been able to do that. And we’ve been able to turn that around very quickly. So we’re excited and we are continuing to listen and can’t wait to get more ideas from each of the different regions, etc.

Robert Dutt: One of the big recurring challenges for MSPs is no doubt complexity. And this both potentially adds to it in that you’re adding another layer of service that you’re providing around AI governance, but at the same time, hopefully it’s using that AI to roll up some of that, make it more manageable. How do you help partners address this new need without making it a new layer of products and consoles and operational overhead and challenges?

Joe Smolarski: Yeah, it goes back to what I said earlier, Rob, which is, I think you hit it absolutely spot on, which is they just don’t want more tools. They can’t, they don’t, they don’t have the time to continue to keep up with this environment. It just doesn’t work. Labor will always be an issue in terms of hiring more people and the cost of that and the complexities of that and everything else. So, you know, our approach is just build it into what is already there in the stack and make sure each layer has the agentic controls and the shadow AI and all of those things versus, oh, you need to buy three more tools.

That’s not our approach. That’s not going to be our approach because of the exact reasons that you said of just people being overwhelmed and no longer having the staff to keep up with the top, the new tool du jour and it just won’t work.

Robert Dutt: So you’ve got a chance to get the latest and greatest out there with the help of your MSPs. You know, as you look out over the next 12 months without necessarily pre-announcing anything, of course, but what are you most excited about being able to do to just make a meaningful difference for how MSPs deliver their services in this area over the next six months or a year? It’s hard to look too far in the future at this point in the game.

Joe Smolarski: Yeah, for me, listen, if you talk to my head of engineering, Jay Misra, he’ll tell you, “Joe, I’ve got the foundation now. Now I can move super fast.” So I think five months ago we announced it in terms of Ray and what we’re doing from an agentic perspective. In October, we showed it to the world, but the foundation now is built, and now we can move super fast from the next set of agents we’ve committed to the world, a new agent being published every two weeks to continue to move the needle, et cetera.

So I think it’s those kinds of things. And then of course, we had some validation, WatchGuard’s working on a large acquisition around making sure not only do we tell you what’s happening from a shadow AI perspective, but making sure from a data governance perspective that we can stop it. If we see sensitive data being copied into certain tool sets from an AI, et cetera, before you expose your company and expose yourself to violations and potentially going out of business, being able to stop those things as well.

So that’s what we heard they need. And that’s what we’re very, very quickly working to fill that gap. And we’re excited about things like that and just the ability to move so much faster. We have time and time. We had an idea just, and this applies to all companies, not just cybersecurity, but we take things from idea to even brand new product, but idea to production in short time periods now, thanks to the amazing tooling that’s been put out there by these AI providers, things that would have never been possible.

We had an idea of, you know, WatchGuard’s an expert on the network from all 30 years of firewall experience and everything else, but we didn’t have an NMS tool. So MSPs had to go and do exactly what you and I just said is very frustrating, Rob, and download another tool and put in something else and those kind of things. We had an idea in April and we launched it in October and things like that just, it wasn’t possible before. So that’s the fun part of this time.

I caught up with some other MSP software CEOs that we had as guests, including Chris Day from ScalePad and some others. Chris is a Canadian as well, right? I’m sure you know Chris very well. So Chris was at the conference, but if you see like the pace at which he’s running every single week, he personally, even though he’s a CEO of a large company, posting like major advancements like that, that’s a super fun time to be in this space and be able to operate at that velocity.

Robert Dutt: So far, or at least the early days of the game have been about shadow AI and identifying and managing that. How does the game change as agents become much more prominent as they’re becoming at a business level and even in recent weeks down to the personal level with meta and with dots and with everything going on on that side?

Joe Smolarski: Listen, for as much as AI is real and for as much hype as there is, AI still isn’t moving the needle inside most companies yet. And that’s just the fact that if you ever go and ask people to be honest and not feel like they’re going to expose their weaknesses, most companies have done an awful lot and they know what’s possible and they’re on the brink of really cool things, but they haven’t gotten the ROI yet. They haven’t really got things at a finish line, but we know that’s not because of weakness of AI.

That’s just maturity and that maturity is coming fast and furious. It’s coming in Q4 of 26 and it’s certainly coming every quarter of 2027. So that’s where we just have to be prepared for that onslaught. If we worry about the bad guys, we’ve been talking about the adversaries and all these people in other countries that are state-sponsored and whether it’s Russia, China, or anything else, trying to attack our firms, etc. But I strongly believe that the big enemy is going to be the first agentic breach that’s not coming from a clever attacker.

It’s coming from an agent that nobody knew had admin rights and it’s sitting out there doing very bad things because that is what can occur. You do need to make sure that you’ve got the platform in place. We’ve talked about it. You’ve done many, many podcasts on it. You as an MSP, you as a small to medium-sized business, maybe if you’re Citigroup or RBC or some major corporation, maybe you can put individual point solutions in. Nobody else can though. You need a platform that’s talking to each other.

It’s correlating data and making sure it minimizes the noise for you. Then that’s really where the opportunity is to be able to keep up with this fast-moving world and both exciting, scary, all in one.

Robert Dutt: How do you think MSPs are doing in keeping up with that transition? I’m curious. We’re acknowledging that some are going to be ahead of the game, some behind the game, but as a community, how are we doing in terms of getting our arms around shadow AI and getting that managed, but also starting to think through what happens as that starts to take action on the agentic side of things.

Joe Smolarski: Yeah, I would say it probably follows the rest of the world. The larger MSPs that are starting to roll up the industry, they’ve been at it for a couple of years now. They have good foundations. Some of them have made acquisitions to get some of the core foundational pieces. I was with some of the larger MSPs this week and made moves like that. I think the larger ones believe that they are going to have a competitive advantage. The smaller ones have struggled and they’re behind.

They need to pick a partner that they can get help from because otherwise they won’t be able to keep up with all of the massive players that are out there. You see it. Everybody sees it. This was a very decentralized, disjointed, industry of tens of thousands of small players. That roll-up has occurred over the last five years. I think it’s accelerating. I think AI will make that even greater from an acceleration perspective. But you can keep up if you choose the right partners that can help you bridge that gap.

Even though you’re small, you’ve got a big company that can back you up that focuses in on the MSP, knows the space, give you the tooling, give you some of the expertise to help you bridge that gap.

Robert Dutt: Last one for me, if you were running an MSP today, what’s the one thing you’d be doing to try to position the business for the opportunities and the challenges that we’ve been discussing around AI governance in particular?

Joe Smolarski: Yeah, I would say you have to get in front of it now. It is a rate of change that’s occurring that’s unlike anything that’s been out there before. This isn’t a situation like the movement to the cloud from SaaS applications and maybe I’ll do it now. Maybe I’ll sit on exchange for a couple more years and eventually get people over. You’ll be out of business if you don’t get in front of this movement now because while we said the ROI isn’t there yet, it will be. Everybody knows that.

Everybody knows they’re going to have a competitive disadvantage. I’m talking their end customers. Therefore, everyone is using the tooling now at this stage. Older generations, newer generations, everyone is because they don’t want to lose their jobs. They don’t want to be obsolete. Therefore, an MSP just has to say, “I have to get on this now.” If you’re big enough to do a lot of things on your own, amazing. Most are not. 99% of MSPs are not.

They’ve got to pick a horse to ride from a major platform provider and just double down and then just go, go, go. Now is the time. It’s both scary and can put an MSP in a very vulnerable position, but it’s also a great opportunity given all of the news, all of the media. It’s a capital financial opportunity for MSPs to jump on and now is the right time.

Robert Dutt: Never a dull moment at the intersection of security and AI.

Joe Smolarski: A hundred percent.

Robert Dutt: Joe, thanks again for the time. I appreciate it. I appreciate the insights and yeah, thank you.

Joe Smolarski: Always a pleasure, Rob. Thank you so much. Take care.

Robert Dutt: There you have it. Joe Smolarski, CEO of WatchGuard Technologies. Thanks to Joe for joining us and of course, thank you for listening. Few things that stood out for me from that conversation. First, the AI governance opportunity is starting to look a lot more concrete. We’re moving beyond the abstract question of whether businesses should be using AI and into the much more practical reality that employees are already using it, sometimes in ways their employers don’t understand or control.

That creates an opening for MSPs to help customers identify what’s happening, establish appropriate policies and manage the risks. And Joe was quite clear that he believed those capabilities should represent an additional revenue opportunity rather than simply another responsibility bundled into existing services. Second, I thought WatchGuard’s approach to developing its own AI capabilities were interesting, particularly the decision to have MSPs help determine what the company should prioritize.

The example of using AI to automate security product migrations is a useful reminder that some of the most valuable applications of AI may be the least glamorous, eliminating repetitive work and giving MSPs more time to focus on their customers. And third, there’s the question of what happens when AI stops simply answering questions and starts taking action. Joe’s prediction that a major security incident could come from an AI agent with privileges nobody realized it has is a compelling reminder that identity, access, and governance will only become more important as these technologies mature.

If you enjoyed the conversation, you can subscribe to the podcast wherever you get your podcasts, on Apple Podcasts, Spotify, YouTube, everywhere you find shows. And if you have a moment, please do rate or review the show. It helps other people in the channel discover us. Till next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Today’s headline news for Canadian IT solution providers:

• Slide names Austin McChord interim CEO as Michael Fass departs: MSP-focused business continuity and disaster recovery vendor Slide has appointed co-founder Austin McChord interim chief executive officer, effective immediately, following the departure of co-founder Michael Fass.McChord is best known to the channel as the founder of Datto, which became one of the MSP market’s most prominent technology vendors before its acquisition by Kaseya. He subsequently co-founded Slide with Fass, another Datto veteran, to develop a new BCDR platform built specifically for managed service providers.Slide says it now serves more than 1,000 MSP partners worldwide. Fass led the development of its initial product and helped establish the partner relationships behind that growth.The company hasn’t disclosed a reason for his departure or announced whether it will seek a permanent replacement.In original reporting from CRN, several MSP partners expressed confidence in McChord’s leadership and credited both founders with building a business focused on service-provider needs. CRN also noted Slide’s Canadian data-centre investment, intended to support customers with domestic data-residency requirements.The leadership change raises an important question for MSPs evaluating the company: whether McChord’s more direct involvement will bring a new phase of product development and expansion, or primarily provide continuity as Slide continues growing.
• Arctic Wolf expands AI-era security with new endpoint protection, visibility and agentic SOC capabilities: At its Security Operations Summit Wednesday, Arctic Wolf introduced three major developments designed to improve threat prevention, visibility into AI use and transparency around automated security decisions.Aurora Adaptive Threat Protection uses AI-driven analysis of endpoint activity to identify potentially malicious behaviour across sequences of events. The technology is designed to interrupt and reverse attacks before they progress, while operating alongside existing endpoint protection and EDR investments. It is currently available in beta to Arctic Wolf customers.SwarmView is designed to give customers greater visibility into how Arctic Wolf’s AI agents and human security analysts investigate threats, including the evidence considered and the role of human oversight. Initial beta availability is planned for this fall.The company also introduced Shadow AI Discovery, which will inventory sanctioned and unknown AI tools using network, identity and endpoint telemetry. Initial availability is planned for November.For MSPs and security service providers, the announcements reflect a broader shift toward automated security operations that must also be explainable, governable and capable of identifying risks created by customers’ own AI adoption.
• N-able research finds MSPs struggling with AI-driven security complexity: New research from N-able suggests MSPs are rapidly adopting AI-powered security technologies while struggling with increasing alert volumes, operational complexity and limited confidence in autonomous remediation.The company’s AI Fog Report: When the Signal Becomes the Noise surveyed 595 cybersecurity decision-makers and practitioners in the United States and United Kingdom, including 182 verified MSP respondents.Among MSPs, 86.8 percent reported an increase in security alert volumes over the previous year. Another 61 percent said alert noise interfered with incident response daily or several times a week.Despite that pressure, 82.4 percent of MSP respondents had increased their use of AI-powered security tools, and 88.5 percent had made security-policy exceptions to accommodate AI. Yet just 23.6 percent said they fully trusted autonomous AI remediation.Across the full survey, respondents identified duplicate alerts from overlapping tools and AI-generated alerts lacking sufficient context as leading sources of low-quality security signals.The findings point to a challenge for MSPs: adding more AI to security operations doesn’t necessarily make those operations easier to manage. Providers increasingly need tools that improve prioritization, explain their decisions and preserve appropriate human oversight.

  The N-able-commissioned research covers U.S. and U.K. respondents, not Canadian organizations, but its findings address operational challenges relevant to Canadian MSPs.

In Brief

• LogicMonitor advances governed autonomous IT: LogicMonitor has introduced new capabilities across its Autonomous IT platform, connecting infrastructure, application and digital-experience information with AI-assisted investigation and controlled operational workflows. Its Edwin AI capabilities can work through existing environments such as Microsoft Teams, Slack and ServiceNow, while a new MCP interface provides read-only access to monitoring context. The development gives MSPs another potential route from monitoring services toward governed automation.
• Zoho Canada expands government procurement access: Zoho Canada has gained new public-sector procurement qualifications, including a place on Supply Ontario’s CRM Vendor of Record list, approval under Canoe Procurement Group’s ERP program, and qualification across all three bands of the federal Artificial Intelligence Source List. The Cornwall, Ontario-based operation is positioning its Canadian-hosted applications for government modernization projects. The qualifications make participation in procurement easier but don’t guarantee contracts or establish new reseller rights.
• Optro adds partner funding and distribution track: Optro has expanded its Partner Connect program with technology and distributor tracks, plus Partner Growth Funding for qualifying partners’ marketing, enablement and practice development. TD SYNNEX is participating in the expanded distributor model, which is intended to make Optro’s governance, risk and compliance platform easier to procure through channel partners.
• NordLayer introduces AI-use visibility and prompt controls: NordLayer has launched AI Scout, a platform for discovering sanctioned and unauthorized AI tools, monitoring actual usage and identifying potential data exposure. The product includes prompt-level data-loss prevention that can warn, redact or block sensitive information before submission, along with visibility into MCP servers used by coding agents. NordLayer says the offering is available now.

Read Full Transcript

Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Thursday, October 15, 2026, and here’s what’s happening in the channel today.

There’s a significant leadership change at Slide, the business continuity and disaster recovery vendor built specifically for MSPs.

Co-founder Austin McChord has taken over as interim CEO, replacing fellow co-founder Michael Fass, who has stepped down.

For anyone who’s been around the MSP business for a while, McChord is a familiar name.

He founded Datto and built it into one of the most prominent technology vendors serving managed service providers.

After Datto was acquired by Kaseya, McChord eventually returned to the market with Slide, co-founding the company with Fass, another Datto veteran.

The idea was to build a modern BCDR platform specifically for MSPs.

Slide says it now serves more than a thousand MSP partners worldwide, and has expanded internationally, including an investment in Canadian data-centre infrastructure.

Fass played a central role in developing Slide’s initial product and establishing its partner relationships.

The company hasn’t said why he’s leaving, or whether it plans to search for a permanent CEO.

McChord’s appointment is effective immediately.

CRN spoke with several MSP partners about the transition, and the reactions were generally positive.

Partners interviewed by CRN expressed confidence in McChord’s ability to lead the company, while recognizing the work Fass had done to get Slide to this point.

For MSPs, the bigger question is what happens next.

McChord has a history of building technology companies around the needs of service providers, and his more direct involvement could be significant as Slide grows.

But there’s no announced change in strategy or product direction yet.

So this is one to watch, particularly for partners evaluating alternatives in the backup and disaster recovery market.

Arctic Wolf, meanwhile, has introduced a series of security innovations designed for an environment where both attackers and defenders are increasingly using AI.

The company made three significant announcements Wednesday at its Security Operations Summit.

The first is Aurora Adaptive Threat Protection.

It’s a new endpoint security capability designed to identify malicious intent by looking at how activity develops across a sequence of events.

That’s an important distinction.

An attacker may use legitimate tools, valid credentials and ordinary administrative commands.

Individually, those actions may not appear suspicious.

But when examined together, they can reveal a developing attack.

Arctic Wolf says the technology is designed to identify those patterns, interrupt malicious activity and reverse the attack chain before significant damage occurs.

It’s intended to work alongside existing endpoint protection and EDR tools, rather than requiring customers to replace them.

The capability is currently in beta.

The second announcement is SwarmView.

Arctic Wolf already uses AI agents alongside human analysts in its security operations.

SwarmView is designed to show customers more of what happens during those investigations.

That includes which agents contributed, what evidence they considered, and where human experts became involved.

The idea is to make automated security decisions more understandable and accountable.

Initial beta availability is planned for this fall.

And the third announcement is Shadow AI Discovery.

That will help customers identify both approved and unknown AI applications operating across their environments, using information from network, identity and endpoint systems.

Initial availability is planned for November.

Put the three together, and there’s a clear direction.

Arctic Wolf wants to use more automation to prevent and investigate threats, while giving customers greater visibility into both their own AI usage and the security decisions being made on their behalf.

For MSPs, that balance between automation and accountability is becoming increasingly important.

And new research from N-able suggests security providers have good reason to be cautious about handing too much control to AI.

The company’s new AI Fog Report examines how organizations are using AI-powered security tools, and whether those tools are making security operations easier or more complicated.

The research surveyed five hundred and ninety-five cybersecurity decision-makers and practitioners in the United States and United Kingdom.

That included one hundred and eighty-two verified MSP respondents.

And the MSP findings are particularly interesting.

Nearly eighty-seven percent of MSPs reported an increase in security alert volumes over the past year.

Sixty-one percent said alert noise interferes with their ability to respond to incidents either daily or several times a week.

So there’s already a significant operational burden.

At the same time, more than eighty-two percent of MSP respondents said they’d increased their use of AI-powered security tools.

And eighty-eight and a half percent said they’d made security-policy exceptions to accommodate AI.

But here’s the disconnect.

Just twenty-three-point-six percent of MSP respondents said they fully trust autonomous AI remediation.

In other words, MSPs are adopting AI to help manage security, but most aren’t yet comfortable letting it make and execute decisions without human oversight.

Across the full survey, two of the leading sources of low-quality security signals were duplicate alerts from overlapping tools and AI-generated alerts that lacked sufficient context.

That’s an important finding.

The problem isn’t necessarily that security teams can’t detect enough threats.

It’s that they’re receiving more information than they can efficiently interpret and act upon.

For MSPs managing multiple customer environments, that challenge can multiply quickly.

The opportunity for security vendors is to improve prioritization, context and explainability.

And the opportunity for MSPs is to build operating models that use automation without surrendering accountability.

The research didn’t include Canadian respondents, but the underlying challenges are certainly familiar to the Canadian MSP market.

In Brief – LogicMonitor has introduced new capabilities for governed autonomous IT, connecting infrastructure and digital-experience monitoring with AI-assisted investigation and controlled operational workflows.

Zoho Canada has gained new government procurement qualifications covering Ontario CRM purchasing, Canoe’s ERP program and all three bands of the federal Artificial Intelligence Source List.

Optro has expanded its partner program with new technology and distributor tracks, along with funding opportunities for qualifying partners building governance, risk and compliance practices.

And NordLayer has launched AI Scout, providing visibility into organizational AI use, prompt-level data-loss prevention and monitoring of the systems that AI coding agents can access.

Full details and links in the show notes or the blog post.

Later today on In The Channel, WatchGuard CEO Joe Smolarski joins us to discuss the changing security challenges facing MSPs in the age of AI, and how WatchGuard is responding to those challenges.

And if you haven’t heard it yet, yesterday’s In The Channel features Checkmarx channel chief Jon Kozimor.

We discuss how AI-assisted coding is accelerating software development, why traditional application security practices are struggling to keep up, and what that means for MSPs who may increasingly find themselves responsible for securing customer applications and AI-generated code.

That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

Jon Kozimor, vice president of Americas channels at Checkmarx

Artificial intelligence isn’t just changing how developers write software. By making it possible to produce code more quickly — and allowing people without traditional development backgrounds to create applications, automations and agents — it’s also changing the application security challenge. Recent research from Checkmarx suggests AI-generated code is already becoming commonplace, while security practices struggle to keep pace.

That’s creating a potentially larger role for the channel, according to Jon Kozimor, vice president of channel at Checkmarx.

In this edition of In The Channel, Kozimor discusses why existing development and application security processes can struggle to keep pace with AI-generated code, and why partners have an opportunity to help customers close that gap.

For MSPs in particular, that could mean application security becomes increasingly difficult to treat as somebody else’s specialty. Kozimor argues that MSPs will need to develop AppSec expertise themselves or gain access to it through vendors and other partners as they take greater responsibility for customers’ technology environments.

There is also a managed services opportunity. Checkmarx already works with partners delivering Checkmarx-powered services to smaller customers, Kozimor says, and the company’s AppSec Partner Program specifically supports managed service providers delivering AppSec as a Service. Kozimor expects the ways customers consume application security services to continue evolving alongside AI.

We also discuss how different types of channel partners can participate, the still-unsettled question of how much responsibility partners should assume for customers’ AI use, and what MSPs can do now to identify gaps in their capabilities and prepare for growing customer demand.

Read Full Transcript

Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show.

AI isn’t just changing how software gets built. It’s changing who can build it, how quickly they can do so, and potentially who has to worry about securing it.

With generative AI increasingly producing code and putting application development capabilities in the hands of people who may never have considered themselves developers, traditional application security processes face a pretty basic challenge: keeping up.

And that may have implications for MSPs and other solution providers that have historically regarded application security as a specialized discipline outside their core business.

My guest today is Jon Kozimor, vice president of channel at Checkmarx. We’ll talk about why the speed of AI-generated development is putting pressure on traditional security processes, where Jon sees new services opportunities emerging for partners, how MSPs can build or source the expertise they’ll need, and why the channel may increasingly find itself responsible for securing applications its customers can now create almost casually.

Let’s get right into it with Jon Kozimor.

Jon, thanks for taking the time. I appreciate it.

Jon Kozimor: Of course, of course. Thank you, Robert.

Robert Dutt: Let’s start with kind of the premise behind the conversation. We’ve spent a couple of years hearing and seeing how AI is going to transform the channel. I’m curious what you’re seeing that’s different now. What are you actually seeing that customers do with AI that changes the job that partners need to do?

Jon Kozimor: Yeah, and I’m going to do a little history here, Robert. I mean, I’ve been in the industry now 30-plus years, and in the channel a good two-thirds of that. And in working with partners, whether I was at EMC or HP or OpenText, there was always a need for partners’ services and also their expertise.

So that was always there. And I’ve seen partners, and most partners, evolve from being just, I’ll call it, traditional resellers to really value-added resellers providing that expertise.

The thing with AI is that it’s changing so rapidly. I use this example: We had our kickoff in January, and there’s a large amount of that content that just changed in the past eight months. And it’s no different for the customers.

The key that I see for the channel, and the pivot that I see them making, and I think it’s natural, customers are going to need partner expertise. Because you know why? Partners did client-server, partners did cloud, partners did VMware. We can name all of those, I’ll call them, transformational things that happened.

This is no different. I think it’s more complex, but I think the partners are going to be able to really give customers a view because they’ve seen it all across their customers, and they’ve seen it all across the lines they’ve sold. So I really think it’s a great opportunity for partners.

Robert Dutt: One thing that seems particularly different about AI, especially when you get into generative AI, is the speed at which customers can create things. Somebody who’s never been considered a developer suddenly can whip out an application, an automation, an agent, whatever the flavour may be.

What happens to the security side of things when you can create software so much faster than you can keep an eye on that or lock it down, and when you hand the ability to do that over to someone who isn’t coming at it from the rigour of an app-dev background?

Jon Kozimor: It’s a great, great question. And we’ve done certain reports, so I’ll kind of get us started with data. Fifty per cent of the code that’s generated today is done with AI.

The other interesting stat is 70 per cent of developers understand that there are vulnerabilities being deployed because there’s just more code being developed and more vulnerabilities.

And the issue that we have with that is, first of all, making sure that whatever you’re going to put in a production environment, let’s face it, it’s against the bad guys. It’s against cyberattacks. It’s against making sure that we don’t have bad guys not only accessing applications and data and doing bad things with it, but think about brand, et cetera.

What we’re doing, Robert, as being the leader in application security, is bringing not only the expertise and the deep IP we have, but dovetailing it into the speed of AI to make sure that we’re focused on the right vulnerabilities, but we’re also making sure that the application is secure, and we’re at the pace of development with AI, because that’s not going to change.

And the key part is to be at the pace. And the other thing I’ll introduce now is it’s not about the technology solution. It really comes down to governance, but it’s really change control.

The processes that most customers have today are not built for the speed of AI. And we’ll take coding development as an example, but you can use that in a lot of different ways. It’s really key to have those processes in place as well, where partners, I think, play a big role.

Robert Dutt: And I guess that’s true whether it’s something that’s vibe-coded, done by someone who’s not a developer, or someone who’s in a traditional developer role and is just pumping out stuff so much faster because they’ve got their AI assistant of choice riding shotgun and doing the legwork of actually tippity-tap typing it.

Jon Kozimor: A hundred per cent. And the key is, look, developers, their job is to develop great code, develop great applications that ultimately bring companies great, I’ll say, customer outcomes in terms of those applications. Obviously, this is revenue generation.

But the developers aren’t security experts. Never have been, right? So it’s like, you know, I’m running real fast. I’m able to run really faster, but maybe the treadmill I bought really isn’t equipped for this, right? So I’m breaking down and such, but ultimately it’s the speed to get to the outcome.

And we are understanding that and making sure, working with customers, that they have the right tools there that aren’t slowing them down, but make sure that whatever they’re developing is secure.

Robert Dutt: So when we’re at this point where code is being generated so much quicker, and the security has to be obviously considered, hopefully somewhere in there, add in the fact that perhaps some of that app dev is going on in places where not everyone in the organization knows it’s going on.

Where do you, in practice, see the AppSec or developer security process start breaking down in this new world?

Jon Kozimor: Yeah, I think it can really break down from starting the code because it’s so fast that, at the onset, you’re introducing issues regarding security.

So it’s really from beginning to end. I mean, it’s not like, well, once you get to this point of your lifecycle, this is really a problem. You’re creating code so quickly, the vulnerabilities are piling up.

So it really is from tap keyboard one. I’m probably being a little bit aggressive there, but it really is early stage. And it’s hence why we’ve developed tools and methodology to get at that early stage, because the quicker that you can address the vulnerabilities, the better, because it’s not going to propagate as you get, let’s say, halfway through or 90 per cent through.

You really have to have something that’s beginning to end. And really the big, I’ll call it, secret sauce of Checkmarx is our IP. It’s the platform, because that platform has been built over two decades.

And we not only have fantastic innovations, but we have so much that we’ve learned over those two decades that you’re now dealing with an end-to-end solution, development pace, but doing it securely at the front end and being able to have that IP that, through the entire lifecycle, a customer can leverage that expertise.

I’m really excited about what we’re bringing to the market, but I’m more excited when you think about two decades. You’re like, wow, I feel like I’m at a startup atmosphere of innovation, but being really, I’ll call it, cemented into a lot of just great IP that’s put into the solution.

Robert Dutt: You touched on how long you’ve been looking at the channel community, and I’ve also been watching the space for that kind of time.

And we’ve talked throughout that about how you’re not going to be able to survive on hardware resale. You’re going to have to become that trusted adviser. It’s been kind of the underlying message, whether that was through network convergence, whether that was through cloud, now well into AI.

That’s still there. I’m curious, though, what does the opportunity for the channel here look like in terms of helping their customers govern, secure, operationalize AI, sitting where you sit?

What’s basically really new for partners in terms of what they’re going to have to bring to the table to meet customer needs going forward?

Jon Kozimor: I think new for the partners that I’m seeing is they’re creating AI services, but not AI services for Checkmarx or Dell or name your brand.

They’re creating, I’ll call it, thought-provoking AI services that are dealing with AI as the opportunity in terms of what customers have, but also peeling that apart and looking at it in terms of where it is in the customer environment.

Let’s face it, I’m focused on AppSec, but you can talk about any piece of an environment and there’s an AI component.

So I see partners really starting to peel back the onion and doing it based upon all of the different solutions that they can bring together, and bringing it together with, I’ll call it, AI thought leadership.

So they’re not only coming into the customer and whiteboarding out, okay, this is how everything works. They’re also understanding what’s the customer outcome and what can we provide as expertise on the front end.

So it’s less to do with how do I get this server, software, et cetera, running as a point solution. It’s more to do with how do I harness all this technology, leverage AI in my business, doing it securely, but get to that outcome?

I think it’s all about customer outcomes. And it’s one thing out of our program that we have, which is really about, for us, predictability and profitability for partners. But it’s how do we work together to deliver that outcome?

Because Checkmarx doesn’t do that kind of work. We rely on our partner ecosystem, which I think is going to do a great job of providing that kind of expertise.

So I think, Robert, that’s where I see the opportunity for partners. And I am seeing our channel base embracing that.

Robert Dutt: It sounds like an opportunity for partners. This is going to speak into the managed services transition again.

It sounds like an opportunity to package a lot of that up and offer that under my own brand, with Checkmarx and a bunch of other vendors sitting underneath that to facilitate it.

But is that kind of white-labelling, or “I’m the expert here, trust me, I will orchestrate this for you” approach resonating?

Jon Kozimor: A little bit. I think there’s a great opportunity for MSP use. We do it at the lower end of our market today, but we really see it as a potential opportunity.

I look at it, Robert, as a consumption model that the customer is looking for, and then what can the partner provide as the value-add, we’ll call it the different value equation.

So I think it can play a role, but I think it can get a little bit complex when you’re dealing with white-labelling and saying, here are all of the different kinds of outcomes.

I think MSPs are going to need to evolve to that. I don’t think that all of these pieces and parts can come together from an MSP perspective at the onset. I think we have more to learn, but I definitely think the MSPs can play a role.

Again, we use them today at a certain market space. I think we can definitely leverage it, but I think it also has to, again, I’m a big believer in the consumption model. How does the customer want to deploy something, and then how do they want to consume what they’re deploying?

Robert Dutt: Any trends you can comment on there, especially for that MSP that’s serving the SMB or lower midmarket type of customer, in terms of where things are at with that or where it’s likely to go?

Jon Kozimor: We’re seeing nice growth. We have a couple of partners that we work with that basically provide, I’ll say, a white-label service, but they definitely say it’s Checkmarx-run.

We’re just looking at great growth. It’s for really the smaller end user, but we’re finding some of these smaller end users are really growing and their consumption is growing.

Again, it gives us the opportunity because, look, we’re a fairly small company. It’s very, very difficult to service the entire base of customers, whether it’s global, the Americas, name your region.

The MSPs really help us scale for our business in that section today because, look, Checkmarx is a wonderful solution for application security, meant for the smallest to the largest.

And I think, well, not think, I know the MSP program that we have is helping us in that, we’ll call it, midmarket space.

Robert Dutt: Sitting where you sit, I imagine you’ve looked at a number of different types of partners, but I’m curious how this opportunity is shaping up.

We’ve kind of touched on the MSP side of things, but what about the traditional VAR? What about a partner that’s coming at it from a more traditional app-dev kind of role?

I’m just curious how you see the different aspects of the channel kind of playing into this.

Jon Kozimor: Yeah, I’m an ecosystem guy. I’ve always been that way, whether I was at the different companies I’ve been.

So my thing is there’s going to be that focus, we’ll call it, value-added reseller expertise partner that’s going to probably drive a lot of the value and a lot of the revenue.

But you may have unique value-added partners that aren’t necessarily doing the gigantic volume, but provide something to either a customer or to Checkmarx that has value to the marketplace.

We have hundreds of partners in our ecosystem. We have a percentage of partners that probably drive a lot of, I’ll just call it, revenue. But for me, you need an ecosystem.

To bet on just a couple of partners, nothing against those partners, I just think in the technology business there’s so many value-added resellers, from large ones to, say, a boutique-y one that’s in a state that just has some great trusted relationships and value for customers.

So that’s what we have built here and are continuing to grow, an ecosystem mentality focused, though, on those value-added resellers of the ecosystem that are really going to drive the most or the better customer outcomes.

Robert Dutt: What role do you see yourselves playing in that ecosystem facilitation?

On the continuum from a pretty programmatic partner-to-partner kind of structure to, “Hey, that sounds like an interesting opportunity. Do you know about Bob, who does whatever aspect of app dev you might need to add to your quiver to land that one?”

Jon Kozimor: Yeah. I mean, I come from HP, where they had Mercury Interactive, and I’ll use them as an example.

What a partner program they had. They had a tremendous amount of partners, both midsize, small and large, and I never saw a partner community that was so collaborative.

To your point, Robert, X VAR is working, and yeah, Y VAR is kind of a quote-unquote competitor, but they work together to figure out either on the front end of the transaction or mostly on the services that, “Hey, here’s my bench. Here’s your bench. Hey, we just did this.”

A lot of sharing happens. So I always try to do that. There’s going to be some circumstances where it works, others where it won’t, because let’s face it, there’s competition there.

But I’m a big believer in collaboration in the VAR community. And I saw it happen at HP and through my time working with the Mercury partners. Just a great community of partners.

Robert Dutt: So help me with how, or what do you see as some of the common first steps for partners who are looking to start moving in this direction?

What works to get in line with customers or even out ahead of customers in how they’re approaching AI and kind of presenting themselves as that expert, that outcome provider that you’ve laid out?

Jon Kozimor: I think first it comes down to really baseline to, I’ll call it, advanced enablement, sharing with the manufacturer and sharing, obviously, with different folks in the VAR community that a partner may have, and getting also, I’ll say, thought leadership.

No one can predict what AI is going to do tomorrow, never mind a year from now.

I think it’s almost like the gut instinct of these partners. They’ve been in business for years. I’ve worked for some that have been doing this for many, many years. They’ve seen it.

Go with your gut instinct in terms of what’s worked before, and I would just move forward with that.

Obviously, do it in a thoughtful way to make sure that you have all of the things you need to provide that customer with that outcome.

But I think the VARs should just use your gut, use the expertise that you have around you, and use the leadership, because you know what? Those leaders have done tremendous things with their companies.

I think they just have to continue to do it. Don’t let AI be intimidating. Let it be an opportunity that you’ve dealt with before.

Robert Dutt: Alongside security, I think there’s the issue of responsibility, and I’m curious how that’s going to play out in the longer run.

If I’m the partner helping a customer safely operationalize AI, how much responsibility am I assuming for what the customer ultimately builds or does with it and where that all goes?

Where should partners draw the line between “We secure and govern this environment” and “This is on you, the risk is on you, Mr. Customer”?

Jon Kozimor: Yeah, I think it’s an interesting conversation because a lot of customers are saying, “Well, what’s your AI policy if this happens?”

I think we’ll be at a crossroads, and we’ll have to use expertise from legal and such.

I think it’s what the partner feels comfortable with technically, what’s there, and then I think it comes down to what they feel comfortable with. What kind of responsibility do I want to take?

Because I know a lot of partners want to take responsibility. It’s just tough to define it in this world of AI.

I’ll give you a simple part of a transaction, Robert. You and I both know, right? Partner sells it, I’ve got the end-user licence agreement, partner’s responsible for their services, but ultimately I hold that.

I think in this world of AI there’s going to be different asks from customers, and I think we’re going to have to work together as a community and figure out, well, what’s reasonable, what’s over the top, et cetera.

So I think it’s a bit of a TBD. But again, I think partners should go with what their gut tells them.

I mean, the ultimate outcome is what customers are looking for. Don’t go over your skis. Use your judgment. They’ve done it in the past, so this is no different.

Robert Dutt: It’s going to be interesting to see how that affects contracts and basically how different partner organizations think about that kind of thing.

But yeah, I think you’re right. It probably is early innings at best of this game, and we still don’t even know what the game is in some cases because things will continue to change at breakneck speed, it seems.

Jon Kozimor: A hundred per cent. The speed I’ve never seen. And again, I go through the different inflection points that we addressed early on. I’ve not seen it change like this.

It’s just something all of us are going to have to deal with and come up with methodologies to move forward with.

Robert Dutt: My perception is that AppSec has historically been a specialization that some MSPs would get into, others would say, “Eh, you know, that’s not really my business.”

Might have a relationship or a connection to answer that if a customer wants it answered, or not.

But when customers can kind of casually create applications, can MSPs still say that?

How much AppSec expertise does the mainstream-focused MSP need to develop at this point in time, and how do they solve for that?

Jon Kozimor: Yeah, I think they have to definitely develop expertise if they don’t have it, or obviously bring in expertise from the marketplace, because they’re the tip of the spear, right?

I mean, the MSP is really going to take on the role of being that vendor and probably having an aggregate of solutions, whether that’s us and three or four others that’s white-labelled.

So I think the bottom line for the MSPs is they’ve got to have the right bench.

And if they have a relationship with a manufacturer, which obviously they have, it’s just having that right back-and-forth communication that’s open. And the MSP, if there’s a gap, they call it out and they fix it.

I don’t think this is going to be one, especially around application security, where you’re not going to want to make sure that you’re fully ramped up, staffed up and have all the knowledge you need to make sure with what you’re doing.

You obviously are going to have mistakes. We all do. But you don’t want to have propagation of that based upon not having the right knowledge base to give the customer ultimately what they need.

Robert Dutt: So it sounds like it’s going to be a mix of hiring or building that expertise, partnering with other organizations for it, and maybe even down the road, who knows, consuming it as a type of managed service themselves.

Who knows where things will go, right?

Jon Kozimor: Yeah. And you know what? It’s a word I’ve used, and I’ve used it here. I talk about the consumption model.

And consumption model sounds very transactional. It really isn’t. It’s about the value at the end of the consumption model, but what’s the best way to do it? Not only from a transaction perspective, but from a solution perspective.

So I think we’re going to see different, I’ll call it, consumption models be born out of AI. I can’t predict when, but if I use AI pace, it’s probably going to happen pretty quickly.

Robert Dutt: And go in directions we may not expect, which is always fun.

Jon Kozimor: No doubt, Robert. No doubt.

Robert Dutt: Finally, let’s make this as actionable as we can, given that by the time this comes out a week from now or whenever it goes out, things may have changed entirely because AI.

Jon Kozimor: We may have to do another one of these in a couple of weeks.

Robert Dutt: For an MSP who’s listening to us and agrees with the argument, but hasn’t themselves really gone that far into the AI application security slash governance, that whole practice area, what are the first two or three things that they should be doing now to be ready for what customers are going to want, need, require, demand over the next year or so?

Jon Kozimor: I think the first thing is, and I’m open to all conversations, is to get with the manufacturer and the provider and really find out how we’re supporting our customers and what we’re doing day to day, whether that’s customer success, our sales team, obviously our technical folks in development, and get close to that.

And come up with your own, whether it’s a gap chart or however they want to assess, but it’s almost like doing an internal assessment.

This is what we do for customers. The MSPs know exactly what they do for customers every day. They’re doing a great job.

Take that and use that as a methodology, and then get close to the manufacturer, get close to the space, ask the curious questions.

The key part is you know what you need to do in terms of what you do every day. Figure out the gaps, because they would know that, but then it’s going to be about just having those right conversations.

I’m a big believer in it. Establish those relationships with development of the manufacturer, with customer success, with the different leaders within the organization, so there’s a streamlined communication.

Because look, their success is our success. That’s what I look at from a channel perspective, MSP, name the partnership, because I have different ones.

If we have good communication, honest communication and two-way, I think that’s the biggest thing, Robert, I would do.

Get curious and make sure that you’ve got a really good understanding of what’s needed, and then fill the gaps if you have any.

Robert Dutt: The good news is, I can’t speak for you, but I’m sure your experience is probably the same. There is no shortage of curiosity around the topic of AI and where it’s going in the channel.

I think that bodes well for this community.

Jon, once again, I’d like to thank you for taking the time. Interesting conversation, and we live in interesting times.

Jon Kozimor: Yeah, Robert, it was great to meet you. Thank you for the opportunity. We’re really looking forward to working with all of our channel partners in the ecosystem, and this was a great time. Thank you.

Robert Dutt: Thanks again to Jon Kozimor, vice president of channel for the Americas at Checkmarx, for joining us.

A few things that stand out for me from that conversation.

First, the speed of AI-assisted development is becoming a security issue in its own right. If organizations can produce vastly more code, much more quickly, security processes have to keep pace, and many of the processes organizations have today simply weren’t designed for that.

Second, application security may become harder for mainstream MSPs to regard as somebody else’s specialty.

As customers use AI to build more applications, automations and agents, partners are going to need access to the expertise required to secure them.

That doesn’t necessarily mean building all that expertise internally. It could mean hiring, partnering with specialists, working more closely with vendors, or eventually consuming some of those capabilities as managed services themselves.

And third, there’s a business opportunity attached to that responsibility.

Jon says Checkmarx is already working with MSPs delivering its technology as part of services aimed at smaller customers, and expects new consumption and delivery models to emerge as AI adoption continues.

As always, you can find more from In The Channel at ChannelBuzz.ca, and if you enjoy the show, please subscribe or follow wherever you get your podcasts, and consider leaving us a rating or review. It helps people in the Canadian channel find the show.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Today’s headline news for Canadian IT solution providers:

• IonQ agrees to acquire Elisity for up to $1.3 billion: Quantum computing company IonQ has entered a definitive agreement to acquire zero-trust security specialist Elisity in an all-stock transaction valued at up to US$1.3 billion, including as much as $150 million in performance-based earnouts.Elisity specializes in identity-based microsegmentation, using information about users, devices, workloads and AI agents to establish and enforce network access policies. The company says its technology has more than 100 enterprise deployments.IonQ intends to combine Elisity’s existing zero-trust security capabilities with its post-quantum cryptography and quantum key distribution technologies.

  The acquisition reflects an effort to address two overlapping security challenges: protecting enterprise networks against today’s attacks and preparing infrastructure for future quantum-related threats.

  For solution providers, the combination could eventually bring network segmentation, identity security and quantum-readiness projects closer together. However, the companies have not announced a new Canadian channel program or a completed integrated offering.

  The transaction is expected to close in the fourth quarter of 2026, subject to regulatory approval and other closing conditions.

• TD SYNNEX brings AI agents into partner operations: At its Inspire conference last week, TD SYNNEX introduced new agentic capabilities for PartnerFirst, including an MCP connector that allows partner-built AI applications to access distributor data and business functions.The connector supports 53 operations involving products, pricing, inventory, quotes, orders and other transactions. A new Agent Bridge provides prebuilt AI agents and tools for creating automated workflows, while the existing PartnerFirst Agent gains 40 additional capabilities.The distributor also launched FinOps Fusion, designed to help partners monitor and optimize customers’ AI token spending across cloud and on-premises infrastructure.

  The offering includes cost visibility, optimization recommendations, training and managed FinOps services. An AI token-consumption assessment is planned for later this year.

  Together, the announcements point to two emerging opportunities for partners: automating their own operations and developing recurring services around customers’ AI consumption.

  The PartnerFirst announcement covers North America, although availability of individual capabilities in Canada should be confirmed.

• Pax8 finds SMBs building AI faster than they can govern it: New research from Pax8 suggests small businesses are increasingly creating their own AI applications and workflows, often without the controls needed to manage them.The Q3 2026 Pax8 SMB AI Pulse surveyed 1,150 business decision-makers in the United States, United Kingdom, Germany and Sweden.Among businesses already engaged with AI, 67 percent reported developing at least one AI solution in regular use. Another 35 percent had discovered unauthorized AI tools, agents or workflows operating in their businesses during the previous six months.

  Cost management is another emerging problem. Among businesses that paid for AI during the past year, 49 percent received at least one unexpectedly high bill. That figure reached 57 percent among U.S. respondents.

  Pax8 also found that 55 percent of AI-engaged business decision-makers personally spend at least three hours a week reviewing or correcting AI-generated work.

  For MSPs, the findings point to opportunities around AI discovery, governance, security, cost monitoring and ongoing management.

  The research did not include Canadian respondents, but the challenges it identifies are relevant to Canadian service providers supporting SMB customers.

In Brief

• Ingram Micro patents Xvantage integration framework: Ingram Micro has received a U.S. patent for its Vendor and Customer Agnostic Framework, or VCAF. The technology is designed to connect vendor, distributor and solution-provider systems using their existing data formats and workflows, reducing the need for individually developed integrations. It represents another milestone in Ingram’s effort to turn Xvantage into a broader operating platform for the channel.
• IRONSCALES and Todyl integrate email security for MSPs: IRONSCALES has announced an OEM integration with Todyl, bringing AI-powered email threat detection and automated remediation into the Todyl Security Platform. MSPs will be able to manage email security alongside Todyl’s SASE, endpoint, SIEM, MXDR and governance capabilities. Availability is expected during the fourth quarter.
• Netrio expands managed cybersecurity services: Netrio has launched eight integrated cybersecurity offeringsaimed at midmarket customers. The portfolio spans security operations, vulnerability management, endpoint protection, identity, third-party risk, penetration testing, compliance and consulting. The MSP is positioning integrated IT and security delivery as an alternative to managing multiple providers.
• Reach Security raises more than $50 million: Reach Security has secured more than $50 million in Series B financing and introduced Reach Everywhere. The initiative uses APIs, an MCP server and partner integrations to make continuously validated security-control information available across enterprise workflows. The funding will support product development, integrations and international expansion.
• Ridge Security introduces local AI penetration testing: Ridge Security has launched RidgeOne, a self-contained penetration-testing appliance combining its RidgeGen platform with an AI model running locally on Nvidia DGX Spark hardware. The system is designed to conduct autonomous security testing without sending sensitive test data to an external AI provider. It eliminates external AI token charges, although hardware and software licensing costs still apply.

Read Full Transcript

Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Wednesday, October 14, 2026, and here’s what’s happening in the channel today.

Quantum computing company IonQ is making a major move into enterprise cybersecurity, with an agreement to acquire zero-trust security specialist Elisity.

The all-stock transaction is valued at up to one-point-three billion U.S. dollars, including up to one hundred and fifty million dollars in performance-based earnouts.

Elisity specializes in identity-based microsegmentation.

Essentially, its technology identifies users, devices, applications and workloads, and then uses that information to determine which systems should be allowed to communicate with one another.

That helps organizations contain attacks by limiting how far a compromised device or account can move through a network.

It’s an established security market, and Elisity says it already has more than a hundred enterprise deployments.

So why is a quantum computing company buying a zero-trust security business?

IonQ wants to combine Elisity’s network security capabilities with its own post-quantum cryptography and quantum key distribution technologies.

That brings together two problems enterprises need to address.

The first is securing networks against threats that exist today.

The second is preparing for a future in which sufficiently capable quantum computers could undermine some of the cryptographic protections those networks depend on.

For solution providers, that’s an interesting combination.

Network segmentation and identity security are already practical customer projects. Quantum readiness is a longer-term undertaking involving inventories, assessments and infrastructure planning.

IonQ sees an opportunity to bring those requirements together.

But this is a strategy, not a completed product integration. The companies haven’t announced new Canadian partner arrangements.

The acquisition is expected to close in the fourth quarter, subject to regulatory approval and other conditions.

TD SYNNEX, meanwhile, is putting more AI directly into the way its partners do business.

At its Inspire conference last week, the distributor introduced a new set of agentic capabilities for its PartnerFirst platform.

One of the most interesting additions is a Model Context Protocol connector, or MCP connector.

It gives AI applications built or used by partners access to fifty-three supported business operations involving distributor data and services.

That includes things like product information, pricing, inventory, quotes and orders.

The idea is that a partner’s own AI tools can interact with TD SYNNEX without someone having to move back and forth between applications or manually re-enter information.

TD SYNNEX is also introducing Agent Bridge, with prebuilt agents and tools for creating automated workflows.

And the existing PartnerFirst Agent is gaining another forty capabilities.

But there’s a second part to the announcement that may be just as interesting for MSPs.

It’s called FinOps Fusion.

The offering is designed to help partners understand and manage their customers’ AI token consumption across cloud and on-premises environments.

It includes spending visibility, optimization recommendations and training, along with the opportunity to provide ongoing managed FinOps services.

An AI token-consumption assessment is also planned for later this year.

Put those announcements together and you can see two directions in which distribution is changing.

One is automating the operational work partners already do with distributors.

The other is helping partners build services around managing customers’ AI costs.

That’s a meaningful evolution from distribution as primarily a purchasing and fulfillment relationship.

The PartnerFirst announcement covers North America, although the precise Canadian availability of individual capabilities still needs to be confirmed.

And new research from Pax8 suggests small businesses are building AI solutions considerably faster than they’re developing the ability to manage them.

The company’s third-quarter SMB AI Pulse surveyed eleven hundred and fifty business decision-makers across the United States, United Kingdom, Germany and Sweden.

Among businesses already engaged with AI, sixty-seven percent said they had developed at least one AI solution that was now in regular use.

These aren’t necessarily sophisticated enterprise AI systems.

They can include automated workflows, custom integrations and AI agents that carry out multi-step tasks.

But building something is one thing. Governing it is another.

Thirty-five percent of AI-engaged businesses said they’d discovered unauthorized AI tools, workflows or agents operating in their organizations during the previous six months.

And cost management is becoming another problem.

Among businesses that paid for AI in the past year, forty-nine percent received at least one bill higher than they expected.

In the United States, that figure was fifty-seven percent.

Pax8 also found that fifty-five percent of AI-engaged business decision-makers personally spend at least three hours a week reviewing or correcting AI-generated work.

There’s an interesting disconnect here.

Small businesses are embracing AI because they expect it to make them more productive.

But they’re also creating new work around security, governance, oversight and managing unpredictable consumption costs.

And much of that work is likely to land with their technology providers.

For MSPs, that creates opportunities to discover what AI customers are already using, put policies around it, monitor spending and help make those systems reliable.

It’s also a reminder that managing AI may become as important a service as deploying it.

The survey didn’t include Canadian businesses, but the challenges are certainly relevant to the Canadian SMB channel.

In Brief – Ingram Micro has received a U.S. patent for technology designed to connect vendor, distributor and partner systems without requiring individually developed integrations, another milestone in its Xvantage platform strategy.

IRONSCALES and Todyl have announced an OEM integration that will bring AI-powered email security and automated remediation into the Todyl platform for MSPs, with availability expected this quarter.

Managed service provider Netrio has introduced eight integrated cybersecurity offerings for midmarket customers, spanning security operations, vulnerability management, identity, compliance and consulting.

Reach Security has raised more than fifty million dollars in Series B funding and introduced Reach Everywhere, an initiative to bring continuously validated security-control information into other enterprise tools and workflows.

And Ridge Security has launched RidgeOne, a self-contained AI penetration-testing appliance that runs its AI model locally, keeping sensitive testing data inside the customer’s environment.

Full details and links in the show notes or the blog post.

Later today on In The Channel, we chat with Jon Kozimore of Checkmarx on the impact AI-assisted coding is having on MSPs’ security practices.

And if you haven’t heard it yet, yesterday’s In The Channel takes us to Calgary, where Fortinet’s Gord Phillips discusses the company’s new thirty-million-dollar cybersecurity innovation hub.

We talk about how Western Canadian partners can use the facility’s technical labs, meeting space and other resources, and why Fortinet sees Calgary as an increasingly important centre for cybersecurity and operational-technology security.

That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

Fortinet's new Calgary cybersecurity innovation hub gives Western Canadian partners access to meeting and event space, technical labs and Fortinet expertise, with more capabilities still to come. Western Canada chief Gord Phillips joins In The Channel to discuss the investment and Fortinet's larger ambitions for Calgary's cybersecurity ecosystem. https://channelbuzz.ca/2026/10/fortinet-wants-calgary-cybersecurity-hub-to-be-a-home-base-for-western-canadian-partners-47594/

CyberFOX acquires Optimize365 as it builds a broader security platform for MSPs. Plus, Microsoft introduces security boundaries for Windows AI agents, and AWS cuts Marketplace fees to make professional services more attractive for partners. https://channelbuzz.ca/2026/10/the-buzz-cyberfox-buys-optimize365-microsoft-secures-windows-ai-agents-aws-cuts-marketplace-fees-47638/

Flare has launched a new partner program as the Montreal cybersecurity company looks to expand its channel reach. CRO John Williamson and director of partner marketing Eunice Leung join In The Channel to discuss how partners can bring threat intelligence to the midmarket and build services around the technology. https://channelbuzz.ca/2026/10/flare-launches-partner-program-to-take-cyber-threat-intelligence-downmarket-47569/

TD SYNNEX agrees to acquire specialty distributor BlueStar, HPE unveils its first AMD-powered ProLiant Gen13 servers, and Cisco brings collaborative AI agents and broader workplace intelligence to Webex. https://channelbuzz.ca/2026/10/the-buzz-td-synnex-buys-bluestar-hpe-launches-proliant-gen13-and-cisco-puts-ai-agents-in-webex-47628/

New KnowBe4 channel chief Kurt Mills sees significant opportunities to evolve the security vendor’s channel model as it looks toward its next stage of growth. He joins In The Channel to discuss distribution, Canadian coverage, partner program changes and why he says KnowBe4 “can do better” with MSPs. https://channelbuzz.ca/2026/10/knowbe4-channel-chief-mills-looks-to-bring-greater-focus-distribution-to-partner-strategy-47567/

Frontline Managed Services buys KL Software and launches an intelligent applications business, WatchGuard adds AI and secure-access capabilities for MSPs, and Dell expands its AI Data Platform to help enterprises turn their data into usable fuel for AI. https://channelbuzz.ca/2026/10/the-buzz-frontline-buys-kl-software-watchguard-expands-ai-security-and-dell-tackles-the-ai-data-gap-47596/

As AI use spreads through SMB organizations, many businesses don't know which tools their employees are using or what data they're sharing with them. Barracuda's Brian Downey joins In The Channel to discuss why that creates both a security challenge and a new advisory opportunity for MSPs. https://channelbuzz.ca/2026/10/barracuda-to-msps-on-ai-security-dont-wait-for-customers-to-ask-47563/

Broadcom addresses Insight's VMware authorization, Schneider agrees to acquire PTC, and Anthropic launches deployment-engineer training, plus CData, Helix, Partner Tech and Augmentt. https://channelbuzz.ca/2026/10/the-buzz-broadcom-explains-insights-vmware-removal-schneider-bids-for-ptc-and-anthropic-invests-in-deployment-skills-47584/

In The Channel sits down with BeyondID co-founder and CEO Arun Shrestha at Oktane 2026 to talk about the KeyData Cyber merger, Okta's partner-first services transition, and why MSPs can't afford to leave identity as an afterthought. https://channelbuzz.ca/2026/10/oktane-2026-beyondid-ceo-arun-shrestha-on-keydata-cyber-ai-agents-and-the-identity-opportunity-for-msps-47550/

AppDirect acquires AI avatar company Soul Machines, CyberFOX signs a North American distribution agreement with TD SYNNEX, and RSA launches an agentic identity platform for regulated industries. Plus Fortinet's Calgary hub, NinjaTech AI's fixed-fee AI employees, and Microsoft on agents as the customer. https://channelbuzz.ca/2026/10/the-buzz-appdirect-buys-soul-machines-cyberfox-lands-td-synnex-deal-rsa-takes-on-ai-agent-identity-47547/

Six months ago, Okta Canada's Ryan Sydor talked about investment: a data cell, 600 employees, a plan to triple the business. At Oktane 2026, the story is demand - for agentic identity, for agent security, and for partners who can advise rather than sell. Sydor on board mandates, the Blueprint Alliance, Microsoft coexistence, and 100 per cent partner growth. https://channelbuzz.ca/2026/09/okta-canada-check-in-agentic-ai-hits-the-boardroom-partner-contribution-doubles-and-the-pitch-is-sell-better-not-more-47541/

Okta has unveiled the Okta Partner Accelerator, a ground-up rework of its Elevate partner program, at Oktane 2026. Laura Padilla, Okta's head of partners, walks In The Channel through the three-track structure, the customer-outcome metrics that gate the elite tier, the expansion of partner-delivered professional services to every deal, and the AI agent security opportunity she thinks partners are still early on. https://channelbuzz.ca/2026/09/okta-rebuilds-its-channel-program-the-partner-accelerator-brings-three-tracks-and-a-services-first-bet-47527/

Rising hardware costs and customer budget pressure are making IT infrastructure deals harder to close. Mitsubishi HC Capital Canada's Jim Moschos explains how MSPs and VARs can use financing to protect margins, manage cash flow and support multi-year technology commitments. https://channelbuzz.ca/2026/09/how-financing-can-help-channel-partners-navigate-higher-it-costs-47386/

Plugable CEO Lynn Smurthwaite-Murphy joins In The Channel to discuss the company's evolution from a consumer favorite on Amazon to a channel-focused peripherals vendor, the strategic value of its recent Acer Gadget investment, and how its new Thunderbolt 5 AI enclosure offers MSPs a modular approach to local artificial intelligence. https://channelbuzz.ca/2026/09/plugable-ceo-lynn-smurthwaite-murphy-on-bringing-amazon-tested-peripherals-to-the-it-channel-and-introducing-modular-ai-hardware-47370/

TD Synnex adds Microsoft and Cisco data to PartnerFirst, Barracuda merges MSP and reseller tracks, and AWS pushes outcome-based AI pricing. Plus: Blumira and DNSFilter integrate, OpenAI agents breach Hugging Face, and TD SYNNEX Canada Inspire dates are set. https://channelbuzz.ca/2026/09/the-buzz-td-synnex-deepens-partnerfirst-barracuda-collapses-partner-tracks-and-aws-pushes-outcome-based-ai-billing-47390/

Kiteworks chief information security officer Frank Balonis joins In The Channel to explain what Canadian partners need to know about CPCSC, how it differs from CMMC, and why the window to get ahead of Level 2 requirements is already closing. https://channelbuzz.ca/2026/09/frank-balonis-on-why-canadian-partners-need-to-start-cpcsc-prep-now-and-what-cmmc-taught-us-47365/

Today's Buzz covers KnowBe4's new channel chief, CBTS's push to put AI agents into production, and Sublime Security's CrowdStrike integration, plus counter-tariffs on U.S. tech, browser security, and research on why internal AI SOC builds fail. https://channelbuzz.ca/2026/09/the-buzz-knowbe4-names-kurt-mills-channel-chief-cbts-launches-forge-agents-and-sublime-security-integrates-with-crowdstrike-47376/

Technology expense management doesn't show up on most MSPs' radar - but according to Jason Wieser, SVP of channel sales at Calero, it probably should. In this episode, Wieser makes the case for TEM as a genuine recurring revenue practice, and explains why SaaS sprawl has become the front door into the conversation. https://channelbuzz.ca/2026/08/is-technology-expense-management-the-msp-practice-you-havent-considered-46442/

Red Hat's Kevin Kennedy says the era of clearly defined partner swim lanes is over - and the company's partner program has had to fundamentally rethink how it rewards partners to match the way business actually gets done. https://channelbuzz.ca/2026/08/red-hats-kennedy-on-why-the-swim-lanes-are-gone-and-what-the-partner-program-looks-like-now-46421/

ePlus acquires Daymark Solutions for its Microsoft cloud push, Cohesity adds specializations and rebates to its Aspire partner program, and Exclaimer debuts MSP Connect with PSA integrations. Plus, IBM deploys thousands of AI agents and CrowdStrike warns on frontier AI threats. Here's your Wednesday, August 26 channel briefing. https://channelbuzz.ca/2026/08/the-buzz-eplus-buys-daymark-cohesity-expands-aspire-partner-program-and-exclaimer-builds-an-msp-lane-47353/

Cisco has launched its Sovereign Critical Infrastructure portfolio in Canada, giving government, financial institutions, and healthcare providers a new option for air-gapped, on-premises deployment. Cisco Canada president Raj Juneja says the offering is open to the full partner ecosystem, with certifications consistent with existing portfolio requirements. https://channelbuzz.ca/2026/08/cisco-brings-sovereign-infrastructure-to-canada-with-air-gapped-portfolio-47344/

Cisco Canada launches its Sovereign Critical Infrastructure portfolio with Bell as lead partner, ScanSource acquires MicroAge for $220.5 million to augment partner services, and ESET Canada names three Women in Cybersecurity Scholarship winners. Plus CrowdStrike expands Project QuiltWorks to SMBs, Palo Alto Networks and NTT Data sign a $1 billion pact, and Auvik promotes Daniel Ochoa to CRO. https://channelbuzz.ca/2026/08/the-buzz-cisco-canada-launches-sovereign-critical-infrastructure-scansource-buys-microage-for-220-5-million-and-eset-canada-names-cybersecurity-scholarship-winners-47348/

ESET Chief Security Evangelist Tony Anscombe joins In The Channel to unpack the 2026 SMB Cyber Readiness Index. We discuss the confidence paradox, the collision between cyber insurance and MSPs, why AI headlines distract from phishing fundamentals, and why monthly micro-training is the antidote to checkbox compliance. https://channelbuzz.ca/2026/08/esets-tony-anscombe-on-why-breached-smbs-feel-more-confident-and-where-msps-fit-in-the-insurance-collision-47302/

Dynabook Canada president and CEO Carmine Cinerari joins In The Channel to discuss the company's new nationwide distribution partnership with TD SYNNEX Canada, and what it looks like to execute a channel-first strategy when memory prices are rewriting the economics of endpoint hardware. https://channelbuzz.ca/2026/08/buffering-the-madness-dynabook-canada-on-building-a-channel-in-the-age-of-ramageddon-46425/

Coro chief executive Joe Sykora talks platform consolidation, automated alert remediation, and the agentic AI question reshaping how MSPs should think about their security stacks. https://channelbuzz.ca/2026/08/coro-ceo-joe-sykora-on-the-case-against-frankenstein-security-stacks-46418/

Wil Santiago, chief security and trust officer at Blackpoint Cyber, joins In The Channel to unpack the company's 2026 Annual Threat Report - and what thousands of real SOC incidents reveal about how attackers are using trusted credentials and IT tools to get inside MSP environments undetected. https://channelbuzz.ca/2026/08/logging-in-not-breaking-in-blackpoint-cybers-wil-santiago-on-the-2026-threat-landscape-46428/

Blumira unveils a universal AI command center for security tools, Vistera launches a Canadian-built professional services platform for SMBs, and CrowdStrike warns that Punk Spider ransomware attacks on MSPs are up 134 percent. Plus ConnectSecure expands M365 security, GTIA warns on AI adoption gaps, and Verizon channel chief Mark Tina departs for Humana. https://channelbuzz.ca/2026/08/the-buzz-blumira-launches-universal-ai-security-command-center-vistera-brings-ai-professional-services-to-canadian-smbs-and-crowdstrike-warns-on-ransomware-targeting-msps-47306/

Sanjib Sahoo joins the podcast to discuss Ingram Micro's record Q2 results and how the Xvantage platform is moving the channel from 'instinct to intelligence' with the new XI Hub and MCP Server. https://channelbuzz.ca/2026/08/from-order-takers-to-order-makers-sanjib-sahoo-on-ingram-micros-ai-revenue-intelligence-momentum-47251/

Expel launches the first MDR for the full AI attack surface, Huntress CEO Kyle Hanslovan says autonomous AI attacks are already here, and Myriad360 acquires F3 Technology Partners to cross $1 billion in revenue. Plus Nutanix and Halo announce MCP integrations for MSPs, and CRN names its Annual Report Card winners. Here's your Wednesday, August 12 channel briefing. https://channelbuzz.ca/2026/08/the-buzz-expel-extends-mdr-to-ai-attack-surface-huntress-warns-on-autonomous-adversaries-and-myriad360-crosses-1-billion-47282/

Exabeam says it used to treat MSSPs like regular resellers, with deal-by-deal discounts that made margin predictability nearly impossible. Global channel chief Craig Patterson and senior director of service provider alliances Peter Stratis join In The Channel to explain what changed - and what it means for Canadian service providers building managed SIEM practices. https://channelbuzz.ca/2026/08/exabeam-rebuilds-its-mssp-commercial-model-to-fix-the-economics-of-managed-siem-46431/

Schneider Electric debuts a multi-chemistry UPS platform for distributed environments, Ingram Micro says hundreds of partners are using its Xvantage Integration Hub and MCP Server, and D&H Distributing picks up Dell's full enterprise storage portfolio in the U.S. and Canada. https://channelbuzz.ca/2026/08/the-buzz-schneider-electric-brings-multi-chemistry-ups-to-the-edge-ingram-micro-connects-ai-to-partner-workflows-and-dh-expands-dell-storage-distribution-47254/

The new president of TD SYNNEX Canada talks about his transition from SHI, respecting Mitch Martin's 35-year legacy, and why Canadian channel players should be "proud and loud." https://channelbuzz.ca/2026/08/chris-fabes-brings-three-sided-channel-view-to-td-synnex-canada-47239/

Michelle Biase has been president and managing director of HP Canada for eighteen months. In that time, the company has grown its Canadian sales team by fifty percent, shifted to a unified One HP go-to-market model, and watched AI PC sales accelerate to nearly two-thirds of PC volume. In this episode, she sits down with In the Channel to talk about what partners actually did with early AI PC seeding units, how HP IQ is landing in the channel, the practical realities of memory-driven pricing volatility, and why partners should be paying more attention to the software and solutions layer. https://channelbuzz.ca/2026/07/michelle-biase-on-what-hp-canada-learned-from-a-year-of-seeding-ai-pcs-to-partners-47158/

Access Group president Mark Sutor joins In The Channel to discuss the Trust X Alliance Global Leadership Summit, the TXA AI agent, and how Canadian partners fit into a rapidly expanding global peer community. https://channelbuzz.ca/2026/07/mark-sutor-on-trust-x-alliance-in-the-ai-age-the-original-distributor-as-platform-47143/

TD SYNNEX appoints Chris Fabes as President of Canada, Huntress warns of massive Azure CLI password spray attacks targeting non-human identities, and MSSPs face an employee retention problem driven by invisible manual work. https://channelbuzz.ca/2026/07/the-buzz-td-synnex-names-chris-fabes-in-canada-huntress-flags-azure-cli-password-spray-attacks-and-mssp-retention-moves-beyond-salary-47163/

Exclusive Networks' Carrie Hopkins joins In The Channel to talk about building a hyper-focused cybersecurity distribution model in Canada, the launch of the Ignition channel incubator, and why some of what Exclusive is doing might remind certain channel veterans of something they've seen before. https://channelbuzz.ca/2026/07/exclusive-networks-carrie-hopkins-on-building-specialist-distribution-in-canada-and-what-ignition-means-for-partners-46440/

OpenAI's inaugural Partner Network is officially live with $150 million in backing, Carbon60 represents Canada on the 2026 MSP 501, and RecordPoint has launched a channel-first global partner program. https://channelbuzz.ca/2026/07/the-buzz-openai-launches-partner-network-carbon60-makes-the-msp-501-and-recordpoint-goes-channel-first-47118/

HPE vice president of North America channel and partner ecosystem Jeremiah Jenson sits down with ChannelBuzz.ca for the final word on HPE Discover 2026, from the show floor temperature to the specific opportunities he sees for Canadian partners in networking, hybrid cloud, and the "great VM reset." https://channelbuzz.ca/2026/07/hpe-channel-chief-jenson-on-discover-2026-the-canadian-angle-and-what-partners-should-stop-doing-47105/

Microsoft fixes 570 flaws including 3 zero-days, Citrix gives partners a new services angle with Platform Flex, and AI compliance is moving from policy paper to recurring operations. https://channelbuzz.ca/2026/07/the-buzz-microsoft-drops-570-july-patches-citrix-flexes-services-and-ai-compliance-shifts-to-ops-47108/

Xerox IT Solutions Canada executive vice president Curtis Dery joins In The Channel at HPE Discover 2026 to discuss the partner perspective on HPE's new 90/9 financing, expanded credit lines, channel-only product expansion, and why he believes AI has created a level playing field for partners for the first time in their careers. https://channelbuzz.ca/2026/07/xerox-it-solutions-curtis-dery-on-hpes-financing-moves-channel-only-expansion-and-why-ai-is-a-digital-goldmine-47096/