Bonus Episode: Dark Side, Light Side

 

Transcript:

Rich: [00:00:00] Running an MSP means you’re responsible for your clients’ security, but how confident are you in what you can actually see? If there are gaps in your defenses, chances are an attacker has already spotted them. Don’t miss the Kaseya Cybersecurity Summit: What a Hacker Sees That You Don’t. It’s a free virtual event on October 14th built specifically for MSPs and IT professionals who want real answers, not just theory.

Ethical hacker Jamie Woodruff will walk you through how ransomware actually gets in using real cases from his own work in the field. You’ll also get a plain language breakdown of today’s compliance mandates, FIPS 140-3, NIS 2, and cyber insurance requirements, and learn why resilience is just as critical as prevention.

If you want to see your [00:01:00] environment the way an attacker does, this is the event for you. Registration is free. Visit kaseya.com and click on Events to reserve your spot. And now, on with the show. And three, two, one, blast off. Ladies and gentlemen, welcome to another episode of the MSP Chat Podcast, your weekly visit with two talking heads talking with you about the services, strategies, and success tips you need to make it big in managed services.

This episode of the show is sponsored by Kaseya. My name is Rich Freeman. I am chief analyst at Channel Master, the organization responsible for this show. I am joined side by side virtually as I am on every episode by your other co-host. He is our CEO and chief strategist at Channel Master, and his name is Erick Simpson.

Erick, how you doing?

Erick: I’m doing great, Rich. How you feeling today?

Rich: I’m feeling terrific and despite the fact we’re exiting summer, the temperatures are cooling off a little bit here in in [00:02:00] Seattle. I’ve had a, a, a nice little stretch off the road recently, and I’m feeling rested and relaxed.

You?

Erick: Itching for a little travel, are you, Rich? It’s part of our existence these days, isn’t it?

Rich: Yes. Yes. Yes. You know me very well, and I know you as well. And yeah, there’s plenty of that coming up in the, the next few months, the the run between now and Thanksgiving. And we’ll be coming to you live from from most of those places on future episodes of the show.

But for now let’s dive into our, I’ll call it our story of the episode, ’cause this is a bonus episode of the show, like I said, sponsored by Kaseya. And we’re gonna be talking about security later in this episode. The topic or issue I wanna get into here is security related as well. And the thoughts I’m about to share here were sparked by some numbers out of Gartner recently.

And in order for you to understand why they kinda got my attention, I have to take you back in time approximately two years. About two years [00:03:00] ago, I was having a conversation with a senior, I think the senior-most security researcher at a very well-known security company I shall not name. And I asked him, “Who’s getting more benefit, more payoff out of AI right now?

Is it the attackers or the defenders?” And he said it’s absolutely the defenders, but not because the defenders are smarter or AI is a better technology for defense than it is for offense. The reason is that the attackers were still using the same old phishing lures that had been working for them for the last decade plus, and they were still working.

And these, these people didn’t get into hacking because they want a good, hard job. They’re looking for the easiest money they can get, so they’re not messing around with AI, is what he told me, this gentleman, two years ago. Here’s the Gartner stat that I ran into a few days ago. And this is based on survey data, so this is not a projection from Gartner.

They went out and they talked to a bunch of chief information security officers. [00:04:00] 41% of them reported at least one social engineering incident involving a deepfake in the past 12 months so this somewhat theoretical danger deepfakes social engineering, this is not theoretical anymore, right?

This is starting to very much, very rapidly starting to come off the whiteboard and into real life. Same goes, we’re gonna talk a little later on the show with Matt Sivak from Kaseya about email security. I’m 100% confident he would verify that AI is sort of democratizing business email compromise attacks.

It is much easier for anyone to create a much more convincing BEC attack. And here’s some very recent data from Coalition, a cyber insurer. BEC claims frequency is up 15% year over year in the last year driven by a spike in the second half of 2025. So it’s growing double digits and accelerating based on what Coalition is seeing.

Now, this next number from [00:05:00] Co- Coalition might sound reassuring at first, but it isn’t once you think about it. Claims frequency around BEC is way up. Claims severity is down 28% year over year. The claims are settling at an average loss of $27,000. So that sounds good until you start putting the math together there.

There are more and more attacks happening. They’re easier to do, they’re more convincing, and so it’s reasonable to surmise that the attackers are now going into that SMB space, going after smaller companies that were harder to target before which is why the claims are settling for smaller amounts.

But it means if I’m right, that SMBs are in more danger and not less. And this is one reason why, also from Gartner, and this is a projection, they are projecting that the market for securing AI will reach 4.8, just under 4.8 billion next year, 2027. That’s a 68.7% [00:06:00] increase from 2026, and it’s gonna go up another 60% to 7.7 p- billion in 2028, Gartner is projecting.

You start putting this all together. AI-related security threats, the, the frequency is growing rapidly right now. It’s already, the, the numbers are already very large. SMBs are more in the crosshairs th- than they have been before, and so clearly there there is a greater need.

So a, a few things there, basically. So I would say to the MSPs in our audience, first of all, you wanna take a good hard look at the security stack that you are bringing to your clients right now and make sure that it is able to handle this rapidly changing AI-inflected threat landscape out there.

We’re gonna get into some of that actually on the email security front with with Matt in a few minutes here. And then the other thing is this is a business opportunity for you as well. If you have a managed security offering of any kind you really need to be [00:07:00] bringing this to your clients right now.

It’s going to be good for your top line, but it’s also gonna be really beneficial for your clients. This is not a time to take AI security specifically lightly.

Erick: You know what’s interesting to me, Rich, is, the, the, the severity is it’s still is they’re asking for lower numbers, but the, the frequency is still there.

But… And I think you’re onto something. I think that these hackers and these criminals have figured out that, you know what? If we make our ask a little bit lower, then it might get under the radar more. Like something somebody could pay with a credit card or something, to impersonate, some invoice, some contract, or something that the business owner expects, that’s a typical bill.

They might go ahead and just process that payment without thinking about it. So that’s really dangerous [00:08:00] because now it just means that instead of the targeting that we’ve been seeing historically, like for these bigger whales and things like that, and remember, before AI came along and helped these criminals do these kinds of things, there was al- there was always this man in the middle kind of a thing where, an email would come from the purported CEO and letting the, accounting unit say, “Hey, I’m gonna be on a plane on an international flight.”

Like they figured out when this person was traveling and say, “I have no, connectivity, but I need you to pay this invoice to this vendor ASAP. Make sure it’s done before I land,” kind of a thing. Now, with deepfake and the proliferation of the advancement of just how good these these attackers’ messages are, their tactics, their techniques, and having someone…

I’ve seen demos, I’m sure you have too, Rich, of, a real attack happening in place where someone is [00:09:00] using AI and having a live conversation with someone else, and it is very hard to detect for some folks that, don’t have, cyber security training and things, end user awareness training and things like that could dupe a lot of people, and it’s happening now.

Rich: Yeah. Yeah. I and part of the equation here is $27,000 wasn’t worth an attacker’s while before. They were going after the whales because there was time and effort and labor involved in these attacks, and you wanted as big a payoff as possible. But if A- AI’s automating everything, if it’s automating this process of attacking businesses and can allow you to go after smaller businesses at scale, that’s like a whole new market basically for you to exploit.

And so it’s reasonable to, to assume that’s part of what’s going on here. I’ll also say, yeah as you were talking about demos and so on, you reminded me that our mutual friend Dave Sobel of the Business of Tech podcast… and this is [00:10:00] like a year and a half ago. He went out and created a deep fake version of himself doing an episode of his show just to see if he could and how convincing it was.

And again, a year and a half ago, it was extremely convincing. If he… he did this thing with me once where he showed me the real thing and then the deep fake, and I’m looking really closely. I correctly identified the deep fake, but if I wasn’t looking very closely, there’s no way I would’ve known.

And so yeah, this, this technology, it was already dangerous and powerful a year and a half ago. Can only imagine how much better it’s gotten since then.

Erick: And, the scary parallel of kind of what you said made me think about it is AI is empowering these, these cyber criminals to deploy these attacks at scale, meaning that they are becoming much more efficient without having to have a lot of people.

MSPs are leveraging AI to deploy their services at scale, right? So there’s the dark side, and there’s the [00:11:00] light side. And both are trying to thwart each other for, the, the wallets and the bank accounts of the end customers. It’s, Yeah. It’s interesting to think about that, right?

Both sides of the mirror.

Rich: Absolutely. The a- as we say, the deep fake is a very powerful social engineering technique for attackers right now. And as it happens, social engineering factors into your tip of the episode

Erick: Yes, Rich. And we’re gonna talk a little bit about how AI and these deepfakes and just the ability for these hackers to impersonate folks at a much more higher undetectable degree than ever before. So three quick tips for MSPs. A little bit of a refresher for some of the MSPs, but never enough refresher for their clients and their end users.

[00:12:00] The first thing that we wanna make sure that we’re teaching our clients and end users is to identify some of these really high-risk kind of requests that require independent verification. I’m talking about financial requests. I’m talking about technology requests, password requests.

We’ve seen deepfakes be successful where someone is impersonating, the IT provider themselves. So these attackers are getting really smart, taking a look at MSP’s websites. If they have a client list there, they’re targeting those folks and trying to impersonate them. Any kind of request to, change passwords and things like that, saying, “Hey, we’re doing some kind of a system upgrade.

We wanna, make sure that you work with us to make sure this works,” and they can intercept that kind of stuff. Privileged access, banking information, wire transfer information. There’s a lot of the, what’s old is new again kind of a thing. They’re just accelerating these requests and the success increasing [00:13:00] the success by using AI and deepfakes.

So anything that is, out of the ordinary when you’re working with clients and they’re, they are at risk here Create some sort of a third-party verification before they agree to do anything, whether that is, if it’s a financial request from the CEO, create an out-of-band verification process.

“I’m going to text the CEO on their cell phone, and they are going to reply to me with some s- that code or something to say, ‘Hey, just received this request from you. Is this legit? Shall I continue?'” And you can have, “Absolutely not,” and they can just, end the call or end that meeting session or whatever.

Do not process that invoice. Tip one, require independent verification. If it’s technology related, make sure that you’re training your clients and users to say, “Before we, process any kind of a request like this, here is how we do it.” Whether you have a platform that does two-factor verification, you’re in the [00:14:00] middle so that there is that layer before they agree to engage in a session with you or to, change their passwords with your help.

And typically let them know, just like we get emails all the time, Rich, from our financial institutions and things like that, letting us know, “Look, we will never ask you these three things.” So be aware if something like that happens, it is a little bit fishy or suspicious. So number one, have that understanding with your clients.

Number two, teach them how to have an internal safeguard with- from in their internal organization that you may not even be part of that conversation, right? This is day-to-day business for them. And then number three, Rich, update your security awareness training for the AI era. We’ve seen security awareness training for years in, in the space, and it was great, but now it’s got to be, mature to address these types of AI-influenced attacks, tells, [00:15:00] look for the AI tells, and make sure that in that AI training, you’re just reinforcing these extra additional security measures that when, someone gets a user’s password, all kinds of bad things can happen.

And I’m sure Matt will have a lot to say about that when he comes on our interview segment in just a second. So the quick takeaway is AI is making it a lot easier for these hackers to impersonate, human beings, and if users aren’t trained to pay attention, on their worst day coming in, haven’t had enough sleep, haven’t gotten the coffee yet, and they see an email that just looks so similar to the emails that they get from your vendors or from, their CFO or their CEO, it just…

Before they take action, read it again, and then implement these security measures before taking that action with [00:16:00] the person or persons that need to verify it through whatever means that you created. So don’t just, verif- have them verify, basic information. They’ve got to verify the human behind the request.

So now it’s incumbent upon them to really double-check that it is really a human that is authorized to, guide you and ask you to do these things and have a s- you know, have a a unique way to verify them that any hacker would not even know about

Rich: Yeah, it, and obviously the threats are coming in not just via email or text.

Those deepfake attacks Gartner was talking about are both video and audio. Yeah … so-

Matt: Yeah …

Rich: how alert are you to the possibility that voicemail that the boss left for you on your phone isn’t actually the boss? And it occurs to me as you were talking about that a- and I just don’t know the answer ’cause I haven’t researched this yet, but I’ve got to believe the security awareness tools security awareness training [00:17:00] tools out there are, I hope, training people to recognize deepfakes in particular and some of the new BEC techniques and so on.

I certainly hope so because that’s really the kind of thing you have to do to get people so that the automatic, response to something like this is to question it and not just go ahead and send the money or or whatever that is. The other thing that occurred to me when you were talking there is I was listening to a podcast a couple of weeks ago and this person was talking about how he had a technique very much like the techniques you were talking about here set up with his grandmother.

Because the same people going after businesses are going after consumers, and particularly the elderly, who they consider, probably rightly, to be especially vulnerable. And she knew, she… He had trained her to know if you get a request like this, call me before you do anything kind of a thing, and it helped her a lot.

So this is good advice, [00:18:00] beyond the four walls of your office. Talk to your kids, talk to your spouse, and make sure your grandparents, make sure everybody is prepared for the possibility of being exploited by AI.

Erick: Yeah, two things there. The elderly, yeah, I’ve read all kinds of, articles and things like that where the social engineers, they’ll call and they’ll, the, the person will pick it up and, it’ll be a female or a male, but it’ll be like, “Grandma?”

“Oh, Erick?” “Yeah.” And then they just social engineer them to send them gift cards or whatever. “I’m… I need train fare. I need to do this.” It’s crazy. And on the, I had another thought on the social engineering point of of AI, but that one, man, dang it, that was a good one, too. It escapes me. But maybe it’ll come back here in a second.

Anyhow it’s just a, a really dangerous time for everybody and the AI security awareness training, yeah, they definitely have to increase their capability. So I remember what I was gonna say. It would be… I watched I’ve– I… Sometimes I get into these [00:19:00] binges, Rich. I don’t know about you, but I watch these YouTubers that will hack the hacker.

They, get some kind of a rec- I don’t know if they’re creating a honeypot or whatever to get these, these, these hackers to engage with them. And they’ll go through the motions of, okay, in a desktop sharing session, and then they will then…

They’ve got techniques to hack the hacker themselves and, delete all of their files and things like that, and they’ve got their webcam, going. They’re purportedly an IT person. And some of these are pretty funny. It’s like kind of this, I think, more for entertainment purposes.

But, the it’s just funny if you watch some of these things, you can kinda pick up on what those hackers are saying to, do the social engineering. There’s tons and tons of video like that on YouTube. But, the… for those of you listening, if you watched any of those and wanna drop a comment in this episode we’ll be sure to respond to it.

But yeah, it’s pretty wild. And they all have the same kind of sets of different scripts if you watch, one [00:20:00] or two or three of them in a row. It’s and how they engineer somebody to really basically, “Okay, I’m gonna send you this link. Log into this website. We’re gonna change your password.”

And of course, that’s the, the website that they control, and now they’ve got your credential, your identity. And now while they’re on the, the call with you, they’re already running that username and password against all of these different, logins to see if you’re using the same password and banking accounts and things like that, and it’s happening live in minutes.

It’s pretty scary.

Rich: I have not actually seen any of those videos. I’ll go check one or two of them out. There, there is something very satisfying about watching the attacker get attacked and and foiled in such spectacular fashion. But for now Erick and I are going to take a break, folks.

When we come back on the other side, I mentioned that Matt Sivilac from Kaseya, he’s their senior director of customer engineering over there. He’s gonna come back after the break and join us. He knows a whole lot about security, but [00:21:00] we’re gonna dive deep with him specifically into email security and changes in the threat landscape, changes in the tooling that you need and can use to protect yourself and your clients from those threats.

Very interesting conversation coming your way moments from now. Stick around. We’ll be right back

Welcome back, part two of this episode of the MSP Chat Podcast, sponsored by Kaseya. This is our spotlight interview segment, and we are very pleased to be joined by Matt Sivak. He is the senior director of customer engineering at Kaseya. He’s gonna get into the fact that for all the attention AI’s getting and deepfakes and all this other stuff, email remains the number one attack surface, the number one threat issue for MSPs and their clients to worry about.

We’re gonna talk about why that is, what’s evolving in email security, and what to do about it. Matt, welcome to the show.

Matt: Hey, thanks for having me, Rich. It’s great to be here, and I’d love to talk about email security, so [00:22:00] looking forward to this chat.

Rich: We will have it too. This is one of our favorite topics on the show, so this will be good stuff.

Before we dive into it, though just introduce yourself and your role at Kaseya, folks.

Matt: Yeah. So originally I was part of the Inky acquisition team or the team at Inky that was acquired by Kaseya back about a year ago now at this point. I was with Inky for eight years, started as the first SE and then worked my way up to the s- SE manager, sales engineer manager.

And then once Kaseya acquired us, I moved over to the product team. So now I work across the security suite at Kaseya, which of course includes Inky, my specialty, but also has my hands in the other parts of the pie of Kaseya with things like SaaS alerts and then all the other products they have there,

Rich: okay. We’re gonna go right into your wheelhouse on on email security for purposes of this conversation here. Talk a little bit… I alluded to there’s a lot changing in the tech world right now. Talk a little bit about how the the threat landscape, the email threat landscape [00:23:00] in particular, is changing and what generative AI is changing in terms of the the kinds of email attacks businesses are experiencing and who those attacks are targeting.

Matt: Yeah, there’s a couple key parts that I see changing pretty much automatically or overnight with generative AI. When LLMs came out to become more mainstream, I guess four years ago now, ChatGPT was first released, but every single, of course, month and week things get better and better. And so one of the main things is that the old tells are basically gone.

The old tells of things that are considered to be phishing, where you could see things like br- bad grammar, awkward phrasing, or generic greetings that are used for the first line of defense that we would check on is basically gone. Generative AI has democratized the ability to speak plainly in English, or in a better sense, a way that makes you seem like English is your first language.

So the people that are targeting you come in perfect English, so that tell itself is pretty much [00:24:00] gone. Now there’s still, of course, things that we can do for those non-generative AI emails that get sent all the time. Spam, gray mail, all that kinda good stuff that’s still sent, that bad grammar and awkward phrasing still work on.

But the actual phishing attacks that come today are typically perfect English, and that’s just because of gen AI and the sort of leaps and bounds that it’s made on that writing grammar style. Another thing I see very frequently, or maybe not frequently, but something I know is happening, is retr- is research at scale.

So previously, when we had generative… Or before generative AI, someone who was being targeted had to be researched manually by a person, and that limited the attacker’s ability to target many people at once because they would be researching their individuals by themself to figure out what would work in a phishing attack.

With LLMs, you can of course set up an agent to say, “Here’s my target. Here’s where their screenshot or [00:25:00] their things they do online is, their Facebook, their Instagram, their public personas. Go out and find everything related to this person or these people, and then come back to me with essentially a dossier of how these people look.”

The research part of it really is the scariest part, I think, because again, it’s really giving the attackers more context and more information to make phishing even more targeted for more people. So that’s what I’d say the two big things with gen AI is happening.

Erick: Matt, most of the public thinks that email security is preventing phishing and malware and things like that.

But once an attacker gets through, it’s almost like the tip of the iceberg, right? Because then all kinds of other things can happen once the attacker has, has gotten in. So can you describe what can happen days or even months after an attacker has infiltrated [00:26:00] through a phishing attempt?

Matt: Or even seconds these days too, with the automated scripts and all the potential that they have.

But I’d say the, the front door is still email. Majority of the threat vector is still that first line of defense of email is where most people are being targeted. It’s, of course, your public persona in your organization. You work with it every day. So email is that first step or your front door to what we now consider to be your identity.

Your identity is what lives inside of Entra or Okta or any of your identity providers that you utilize out there, and the way to get to that identity is typically through email. So a phishing email that’s sent with some login forms that are fake or device code phishing that they’re using these days where they’re sending a code that’s just six to eight digits asking you to type it into a random website and they get access to your actual identity in the cloud, is essentially what they’re going after.

There’s the classic forms of phishing that you would typically [00:27:00] see with a phishing attack, where a phishing attack is successful. You g- they get your username and password, they log into your Outlook mailbox, they start creating Outlook rules to start sending messages to other people. They spam your contacts with ways to make their access even greater, so they send the same phish from now your email address because it looks more legitimate.

But on top of all of that, what they’re trying to access these days is the actual identity piece. What’s important about accessing that layer is that it then gives them the avenue to go to all the other SaaS providers that are connected to your Entra or to your Okta. SSO, for what it’s worth, is amazing.

It’s makes it so that you don’t have to remember passwords for every different SaaS platform out there, but it also gives you that one-stop shop to essentially give… If a phisher gets access to that identity layer, they then could get access to the rest of the SaaS ecosystems that you are allowed to access when that one at one place, [00:28:00] which is, I’d say, the keys to the kingdom, so to speak.

So depending on what you use in your SaaS provider is where you can actually get targeted the most

Rich: So you, you’ve told us how the threat landscape has changed, and you’ve outlined just now some of the scary things that can happen after a successful breach. Wh- why aren’t the, the traditional kinds of email security tools that people in our audience are familiar with up to the job of protecting end users from these threats?

Matt: Yeah. The classic forms of email security are typically from indicator-based detection, your regex mapping techniques that you used to use in the past, or spam systems that were wholly built for spam detection and then have been adapted to phishing over time. They would do typical, like I said, indicator-based analysis with reputation lists, signatures, known bad URLs, things that have…

things that are caught that have already been seen. Where gen AI is typically novel attacks on [00:29:00] every single message. Now, of course, gen AI can become templates for the future that we would detect b- with some indicators. Not everything has to be fancy. Some of the classic techniques still work because once you create one generative AI template, it’s gonna be used many times.

But the traditional approaches of finding those new phishing kits are the problem today because, again, the indicators that I’m talking about previously with bad verbiage, bad language are gone. So your classic ways to detect those systems are a lot harder to do than they were even just, a couple weeks ago.

Every week there’s a new change. There’s a new LLM out there that’s able to do better, better techniques. And so what a provider needs to do today is step back and go back to the basics with phishing. What is the first principles of phishing and what is it trying to do? What is the intent of the mail that you’re receiving?

And then understanding if the person sending the message is allowed to gain access to what that intent is [00:30:00] asking for. And by intent let’s say like they’re asking for money or they’re asking for a password. If it’s coming from some random person, that intent may be benign, but it’s not something they should be asking for.

So that’s something that you need to look for from not just indicator examples, but more of an agnostic level of going back to the first principles of phishing to see not just how the mail’s being delivered, but the actual body content and how that is looking. That is getting to be why traditional approaches are struggling and why new techniques that need to be built more frequently.

Erick: Yeah, Matt you mentioned how, these LLMs are really supercharging these bad actors. It’s funny in a really painful way to see that these LLMs are now getting so crazy that they’re actually breaking out of their guardrails and attacking other LLMs and things like that.

And Rich and I and everybody today I think has… I won’t say everybody, but most folks that are in our industry have dabbled with some of [00:31:00] these LLMs. And, context and intent is something that, that w- we’re trained to prompt to get the best response. But you’re talking about understanding content and intent from identifying a threat rather than just, just what’s in the email body.

And you mentioned a couple things like asking for money and things like that What else are you seeing out there that AI is enabling folks to do to, to get in… get past somebody’s defenses that thinks, “Oh no, this is legit email.” Like what… obviously you mentioned some things around, it, it can now speak or s- you know the way it writes is more familiar, right?

No longer are we having broken English and things like that. My, rich uncle from Nigeria kind of bad emails. But can you walk us through this con- this intent and content thing so that our listeners- Yeah … can be looking out for that?

Matt: Yeah. It goes back to the point of what [00:32:00] is the email actually asking for in it?

When you get an email from someone from the outside, there’s typically some sort of request or some sort of ask that’s happening. And really that’s not the part that we’re trying to look at to see if that’s dangerous. It’s that given the intent of the mail or what the email’s asking for, and then all the other indicators that we have access to, the sender profile for what the person who’s sending you the email looks like.

Have you talked to them before? Is it a first-time sender? Does the domain authenticate SPF, DKIM, and DMARC? Is the domain they’re asking or they’re coming from allowed to send mail on behalf of the type of request they’re asking for in the body? The key part about all of email security in general, if we take a step back from even LLMs in general, is that security already happens at the delivery layer, but the delivery layer itself doesn’t inherently trust the domains of what they’re claiming to be from.

It just says that the domain you’re sending from is allowed sent, allowed to send mail on behalf of that [00:33:00] domain. The entire phish is typically in the body of the email where you can just write whatever you want, put any images, put any text you want. And so the hard part with email security is correlating the body content of the mail to actual delivery infrastructure that message comes from.

Understanding that, say, it looks like a Microsoft email, but is being delivered from a domain that has nothing to do with Microsoft is the, the Holy Grail. You have to put those two pieces together to understand it all What intent does with our LLM analysis or our generative AI analysis today is it gives us another indicator to say, does this email ask for something specific, whether it’s something like authentications, payment-related information?

Is there an ultimatum in the email? It’s asking you to do something or else. Is there confusable text inside of the message? And really putting that intent all together with everything else is really the combination we’re looking for. If an email is flawlessly written in English, it has some sort of AI written CEO level ask with urgent payment, [00:34:00] that has no bad keywords with no bad links, the intent of the message itself is asking for, say, gift cards, where that’s a super simple example, but it could be a different style of intent, and it’s coming from something that’s delivered to look like a CEO of your organization, but maybe it’s not coming from their address.

So putting those two pieces together is where understanding that intent and context of the ask of the message gives us just one more layer of indicators that we can now use on top of the things that we’ve lost previously with the language detection no longer being… The language level detection no longer being viable.

Now we truly need to understand the ask, where previously, without generative AI analysis, we can’t get to that intent of the mail in a scalable fashion. Regex matching can only go so far, but today we can feed an entire message in and get out the intent of the message in a matter of milliseconds.

Because what are LLMs really good at? They’re really good at reading text and then [00:35:00] delivering a text result based on that. And there’s also some cool new technologies out there that happen every day. I know over this past weekend, the new Jev LLM came out that’s like a Model zero or Brain zero or Brain one, I think is what they call it, where there’s a couple different ways your brains work for how you make decisions, where the level one that they talk about is if you see a shirt that’s blue, instinctively you know it’s blue, so you don’t need to use any reasoning on top of that.

If a message looks like it’s asking for payments, then it looks like it’s asking for payments. That simple bit of information gives us stuff at millisecond speed to be able to make smarter decisions against all these attackers that are generating threats every single day,

Rich: you mentioned generative AI just now.

I- take us behind the scenes a, a little bit just in terms of helping folks in the audience understand the difference between the email security software they’re probably using right now and the email security software they need. What is it that a modern email security system is doing so that [00:36:00] the the millisecond generative AI analysis is a good example.

But he- help us understand a little bit better, what, what is going on behind the scenes that allows these latest generation tools to suss out intent and context? Are they asking different questions, connecting to different things?

Matt: Yeah, so it’s a whole bunch of different ways to get indicators first.

What can we use to find specific parts of a mail or understand specific parts of the mail to make a smarter decision at decision time? So for us it’s many different layers, but the two common layers that I talk about are how we can see the message as a person, and then how we can understand it as a person.

And that’s our, MKY’s whole philosophy is how can we do the same thing a person does? When you look at a message instinctively, like I just mentioned, that brain level one sort of concept. If you look at a message and see it branded as Microsoft, you just pick up on that in a second, in a sub-second, because you’ve been trained over the past [00:37:00] years of your lifetime to look and identify for brands.

Marketing has done- I guess, wonders and also other things to our brains to make you know exactly what brand you’re looking at. But that’s not just for brands, it’s for every different part of it. If you see a new message that looks like junk, it’s probably just junk. You instinctively think it’s junk because it’s got some simple tells to it.

So the first part about it, us, is to understand or try to understand as a human does, when we look at the message, what do we think it is? And so the first thing we do with Inky is we use computer vision to see what the message looks like to a person. And then we use some OCR techniques to pick out things that we think are what’s known as brand indicative, but also to look at the difference between the rendered version of the mail versus the underlying raw copy of the mail that’s delivered in the text format, the ML file.

The rendered version of the mail has all the cool things that you as a person can see, and exactly what is the phisher’s intent for the person receiving the message should be seeing [00:38:00] themselves. But the raw copy of the mail could have a whole bunch of obfuscation techniques where there’s zero-width font or there’s color text on background of white color text with a white coloring background to try to trick systems to say, like there’s a whole bunch of garbled information in between the things that are rendered to a person.

Rendering it allows us to see that brand identification, like I said, as well as be able to do things like Q- QR code analysis. If a QR code is only able to be seen when it’s rendered, that’s what our computer vision check is doing first. So really it’s the first thing is how do we see the message, and then understand it.

And the way we used to understand it was with those simple checks, those regex matching techniques. But that has shifted entirely to our generative AI analysis layer, where we can essentially feed those messages into our homegrown models themselves and be able to run these at millisecond speed to understand what does it look like to a person, and what is the intent of the message.

Put that together, that’s how we figure out [00:39:00] if something is dangerous or not.

Erick: Matt, back in my MSP days, we used to, list out kind of the activities that we would do to protect our clients from a security perspective, and there was like email security, and there was like firewall stuff and things like that.

Matt: Sure.

Erick: And a lot of partners today still are selling based upon these kind of technical outcomes. Rich and I speak a lot on the podcast about the need to migrate our messaging towards business outcomes and being more strat- strategically valuable to our end customers. So when I think back about how, these, these categories have been listed out inside of security, email security, things like that, you’ve made the point that email security can’t be kind of its own island anymore.

Why not? What’s… What else are you thinking about when, MSPs are thinking, “Oh, it’s email security, it’s in my other bundle”? What’s different now and what should MSPs be thinking about?

Matt: Yeah, it mainly comes [00:40:00] back to the identity layer. Email used to not be in the identity layer.

It technically was with its own, email and password to get into your email inbox, but you probably had other accounts to different places that were not associated with the same… They could’ve been the same user and password, but, everything became so grouped together these past six to seven years now, that everything relies on you as the identity layer being the one-stop shop that controls every bit of access you have inside of your organization.

So email, like I said before, is that front door, but it is the front door to your entire en- identity ecosystem. It is the place that gets compromised the quickest, but also the place that has the best detection layer to be able to find things quickest. Once someone’s inside of your account, it becomes increasingly difficult to see that as malicious activity unless you have good identity protection in place.

And that’s really where the, the two layers of Kaseya comes in, like I mentioned earlier, [00:41:00] with Inky being that front door layer of email security, both inbound, outbound messages, as well as internal threats being detected. But then on top of that is our identity layer with SaaS alerts. SaaS alerts is able to sit inside of your identity ecosystem, inside of Entra, inside of Google Workspace, inside of Okta, to see if there is techniques being used by malicious actors where they’re logging in from weird locations that seem like impossible travel, or never being sent from, or never being logged in from a location that you as a person have logged in before.

So the main step is still, again, to get into whatever is controlling your email your email login. But typically these days, that means it’s, is your identity layer. So if your phish comes in and a user gets compromised using a phishing email that wasn’t detected, they now have access to that identity layer where SaaS alerts on our team or on our side can get another stab at it.

So if anyone goes and tells you that [00:42:00] email security is 100% foolproof or s- or solved, they’ll be lying to you. Sometimes Inky misses things. Sometimes every other provider out there will miss things. Something will happen. But having a de- defense in depth approach with email security being that front door and then SaaS alerts identity pr- protection being what’s guarding the keys to the kingdom on top of that, gives us another chance, another opportunity to detect that threat before it actually spreads throughout your environment.

And really that is that’s the whole ballgame these days. Once they get access to your identity, that, that layer there is where they can get more and more information from your systems.

Rich: Y- some of this is implicit in what you’ve been s- saying, but we have a sense now for what’s different about the threat landscape, what’s different about the capabilities you need to deal with those threats.

Tell the folks in the… And this could be like a checklist. Tell the folks in the audience, if I’m evaluating email security tools, what am I looking for that tells me this is a tool [00:43:00] that’s up to the challenge and not an old school email security solution that isn’t gonna get the job done?

Matt: Yeah, I’d say there’s a couple, there’s a couple things. First is the intent-based detection, not just the indicator-based detection. They need to understand the intent these days to be able to quickly and out on the fly be able to scan things that haven’t been seen before. So intent-based detection is a really cool technique that previously, like I said, with those signal indicator threats of things like bad language or language from a different grade level.

Intent-based detection works on all new styles of emails because, again, there’s always going to be intent of the message, and we can really hone that in to a s- specific layers or specific categories that we see are what’s likely being asked for. So the cool thing about that is basically it took away our entire regex matching system overnight, because we don’t need it anymore.

We just ha- need to know the intent of the mail, and we get all the same sort of information that we did [00:44:00] before. So having that as a baseline is what you should be looking for. Visual analysis is another one. Inky renders every single message using a headless Chrome browsers to actually visually see what they look like before it’s delivered to your users, and doing that for every single message and not sampling is something they should be doing.

This helps detect things like logos, QR c- QR codes and image-based content, as well as the differences between that raw copy of the mail that could be visually obfuscated to what the actual person sees. Having that is essentially two emails in one for us to do analysis against. So visual analysis is a big one.

I always am keen to having pre-delivery inline analysis being one of the check boxes you should have. There’s of course a ton of good API-only solutions out there, but one of the things with them is that they deliver mail before it’s ever scanned because it has to be in the inbox or it has to be delivered prior to them knowing that there’s a message to be scanned.

So being inline analysis I always think is key. [00:45:00] And on top of all this, there’s always something to be said about techniques like time of click link protection. If you’re not rewriting links and protecting links, not only at initial analysis time, but at link click time You’re missing a layer of detection that happens after an email is delivered.

Sometimes links are defanged before they’re ever delivered, and then 10 seconds later they go active. So not having time click analysis is one of those major layers of protection that Inky offers on top of everything that you’ve heard today to be able to detect against that. And then on top of everything beyond all that, there’s a new layer of detection that’s happening more and more frequently with our outbound mail protection and specifically account takeover detection.

If your email security layer isn’t monitoring outbound emails for essentially the same thing you’re monitoring on the inbound, an outbound phish is, if not more dangerous of a tell than an inbound phish is because a user’s compromised or they’re doing something malicious themself, and now they’re sending out from your domain, [00:46:00] killing your reputation.

So not only do you need inbound mail security, you need internal and as well as outbound as well

Erick: Yeah, we’re starting to see that more and more of emails coming from someone that we know, and then they’ll catch it but maybe a day later and go, “Hey-” don’t open that email.” It’s a little late now.

Exactly.

Matt: The damage is done, unfortunately.

Erick: Yeah. So Matt, for the MSPs in our audience that, maybe need to step their game up how should they be thinking about this new risk, what it means to them, their clients? And give them two or three steps that they can take immediately to identify this risk and maybe think about doing something about it to protect themselves and their clients.

Matt: Yeah. I’d say the one thing is to stop… if you are evaluating email security solutions, I’d say is that any of the old ways you may have evaluated with known phish samples and you getting a score back from these known phish samples, it’s probably a thing of the [00:47:00] past. If you’re not doing a new level of validation, whether with live email with a client, then you’re not seeing what’s happening on a day-to-day basis.

Old ways that we would detect things are essentially dead. And so if you’re using a phishing kit simulation vendor to evaluate a new vendor, you’re probably gonna get all 100% and be able to detect those, because those are the simple things these days. If they’re not evaluating per person threats, then it’s not, I’d say, a good test, and it’s better to get into at least a silent mode or some sort of behind the scenes mode to evaluate mail to see if you’re, either you as the the client or one of your customers as the client to see what it looks like is, I would say, a necessity these days.

Another way to think about all this in general is that Inky… or not Inky, email is part of your identity now. You may still think about it as email itself, but it is truly part of your identity layer, and so treat [00:48:00] it as such and as important as such. So having email security on top of maybe the default ones you get from Google Workspace or Defender Plan 1 or Plan 2 may be something you need to look at.

Of course those two solutions do, do what they’re good at, but we know for a fact that even behind those two platforms, we’re still detecting more and more threats on a daily basis. And one of the things is really just trying to ensure that we- really get a good onboarding when you start using a new tool itself.

‘Cause a lot of features to these new tools, especially Inky if you’re not onboarded properly, not turning all the bells and knobs on, I think that’s one thing to always think about too, is make sure you have a good onboarding experience with the new tool you bring on,

Rich: matt, really interesting conversation.

To, to an even greater extent than before this conversation, I really have a feel for the fact that it is a whole new world, a whole new ballgame- Yeah … both in terms of email threats and the protection you [00:49:00] need from those threats. Thanks for that. For folks in the audience who wanna get in touch with you, follow up on something that you said, or just learn more about the the technology and the functionality that you’ve been discussing, where should they go?

Matt: To follow up and if you wanna talk to me directly, matt.sivilac, so I think my name’s been on the screen the whole time, @kaseya.com, so [email protected]. I’ll happy to answer any questions, anything at all. You find me on LinkedIn and chat me, no problem. Pretty unique name, so easy to find

Rich: All right.

Matt Sivak from Kaseya, thank you for joining us on MSP Chat. Folks, Erick and I are gonna take a quick break now. When we come back on the other side, we’re gonna share some thoughts about this enlightening conversation with Matt have a little fun, wrap up the show. Stick around. We are gonna be right back

Welcome back to part three of this episode of the MSP Chat Podcast, sponsored by Kaseya. Thank you again [00:50:00] to Matt Silvack from Kaseya for joining us for that conversation about email security. We shone a spotlight on one dimension of the changing threat landscape out there in the AI era.

A lot of things we could kinda follow up on. First thing that struck me is you were talking before the interview about, the, the light side and dark side of AI. It was very clear. This, th- this conversation was a perfect illustration of that because the same AI that is allowing the attackers to research you and devise these extremely convincing email threat techniques and so on, is allowing defenders to identify those te- techniques, protect people from them.

It is a force for good and a force for evil, and it is incumbent upon MSPs basically to make sure that they’re doing the best they can to keep pace with the force for evil side of that by exploiting everything AI can do for them and their clients to keep everybody safe. The other thing is and I won’t name the company, but I, here at [00:51:00] Channel Master we, we were consulting for a, an email security vendor once upon a time.

And they describe themselves we describe them as a- an AI powered email security platform. I honestly did not appreciate until this conversation just how different a current generation AI powered email security tool is from the email security tools that MSPs have known and used for many years.

Yeah, at… The more Matt was talking about it, the more I realized this is just a whole different species of software. It’s not a question of inflecting AI, adding a little AI in here and making it smarter at this and faster at that. This is a very different kind of solution, and the more you’ll understand the threats that you’re up against, the more you realize, understand why you need that kind of current generation tool right now

Erick: Yeah.

What the couple things that, you know, and there were a lot of things that struck me, but [00:52:00] just the one thing that I, that kind of dials back into kind of my tip of the week was understanding not just the subject line and how it’s written, right? Some of that some of those email tools can identify this is, not English or properly, worded or something like that.

But when he got into the whole intent, understanding the intent of what’s in the email and the context of how it’s being presented, that kind of blew me away because it… now it’s oh now today’s advanced, email solutions, and especially, INKY is taking some of that burden off of the things I was talking about initially.

You’re getting an email, have a secret, way to confirm that and all this. If, the AI-powered email security solution itself, which just basically says nope, that’s not even gonna end up in the inbox. That’s obviously a phishing attempt or something else.” It makes [00:53:00] things a little bit easier for MSPs to manage, and it certainly helps keep end users out of trouble.

So I never thought about, going that much deeper into what’s going on. And a couple other things that, I even mentioned during the conversation wow, the whole, understanding that there’s zero size font hidden in there that you can’t read and font and images of things that are basically the same color as the background that a human being would not be able to detect.

And putting all of these different things together and at, at, in milliseconds is what we need because you know how we are, Rich. We see something, we click, right? And oh, that’s interesting. Let me go to that website. And all of a sudden now, I’m in their clutches. So the advancement in saying AI, again, score one for the light side of the AI battle.

But yeah, that’s just the, the minimum requirement nowadays for email security. And [00:54:00] I remember when I was an MSP, we sold basically sometimes what came on the PC when we d- when we deployed it to the clients, right? Name your, pick your bloatware of antivirus back in the day, right?

There was all kinds of them. And then later we got a little bit smarter and then started, standardizing and deploying things. But, had no idea that, that technology would have to evolve so much more quickly because of the hackers out there and what AI is allowing them to do. Five years ago, who would’ve thought

Rich: Yeah.

And th- this is the time, if you have not re-evaluated, rethought your r- security strategy broadly, email security specifically, this is a really great time to do that, because as we’ve said, the, the newest technology out there isn’t an enhancement, it isn’t an improved version of what you may be running right now.

It’s a very different thing, and it’s what you and your clients need already and it’s only gonna get more [00:55:00] true over time. And folks, that leaves us with time, speaking of time, for just one last thing, and it comes to us here from my hometown of Seattle, where I am podcasting right now as we speak.

And in fact, it’s coming from a location about a 12, 15-minute walk from where I’m sitting right now in my home office. You… We have all been, maybe more than we would even care to admit, to convenience stores. Guess what? Someone has opened here in Seattle, the world’s first inconvenience store where you can find all sorts of inconvenient goods.

The, For example, you can purchase a landline iPhone that when answered only plays Vertigo by U2. And then my f- my favorite and here’s the tech angle on this, they also are selling pre-tangled USB cords. These are the kind of goodies that you can get at the inconvenience store.

Now I should say, this is an art project. It’s it’s a pop-up thing. I don’t know how long it’s gonna be there. The, the people who are responsible for it [00:56:00] call it, “Your favorite corner store reimagined entirely by artists,” and art is inherently inconvenient. In a society that rewards efficiency and mass productions, artists do things the hard way including pre-tangling the USB cords for you.

Like I said, this is not a long walk away from where I’m sitting right now. I only learned that this existed yesterday. Haven’t gone there yet, but I’m very tempted to go and and take a few pictures to share with you and our audience.

Erick: How fun. That’s a pretty unique unique art installation.

It reminds me of, on YouTube folks that, say, “Hey, remember these toys from the ’80s?” “Remember this,” “your appliances from the ’70s?” And things only people that were born in this decade know about. So this is a little twist on that. It’s oh, here’s, the inconvenience of technology and living life and things like that.

Heck, Rich, I’ve got a whole drawer full of pre-tangled USB cables here, so I’m good on that front. But it turns out there might be a market for [00:57:00] them, so you can monetize those tangled USB cords it apparently. This is what artists have have taught us.

Are you kidding me, Rich? I’m a technician and an engineer.

I need every single one of those 36 tangled USB cords. You never know when I need that one specific one. Exactly. Ex- I don’t think I’ve ever thrown a dongle away, but,

Got a whole drawer full of those, too.

Rich: Yeah. Yeah, absolutely. Folks, that is all the time we have for you on this episode of the MSP Chat Podcast sponsored by the folks at Kaseya.

Thank you very much for joining us. We will be back on Friday with another regular episode of the show. Until then, I will simply remind you this is both a video and an audio podcast, which means that if you’re listening to us right now but you would like to check us out on video, you can go to YouTube.

You’ll find us there at MSP Chat. If you’re watching us on YouTube but you like to listen to podcasts as well, you can go to Google or Apple, Spotify, wherever you get your audio podcasts. You’ll also find MSP Chat there, and wherever [00:58:00] you find us, please subscribe, rate, review. It’s gonna help other people find and enjoy the show just like you.

This show is produced by the great Riley Simpson, part of the team with us here at Channel Mastered, where we help vendors build, grow, and optimize thriving MSP channels. You can learn all about the many ways we do that at our website, which is located at www.channelmastered.com. Channel Mastered has a sister organization called MSP Mastered.

That’s Erick and his team working directly with MSPs to help them grow and optimize their business. Learn more about that at their website, www.mspmastered.com. So once again, we thank you very much for joining us here on the show. We’ll see you soon. Until then, we will remind you as we always do, you cannot spell channel without [00:59:00] MSP.