Listen to the podcast
Read Transcript
Erick and Rich discuss Veeam’s addition of AI data to its data protection mission and what that says more broadly about challenges and opportunities in security for MSPs, as well as concrete tactics for retaining good clients and filtering out bad ones in 2026. Then they’re joined by Corey Nachreiner of WatchGuard for a conversation about AI in security generally and agentic AI in security specifically, as well as an early look at predictions in security for the new year. And finally, one last thing: a raccoon that got drunk as a skunk in a liquor store.
Discussed in this episode:
Raccoon goes on drunken rampage in Virginia liquor store and passes out on bathroom floor
Some guests on this podcast are clients of Channel Mastered. Compensation plays no part in their appearance or the content of the discussion unless the episode they appear on is a “bonus episode” explicitly labeled as sponsored.
Transcript:
Rich: [00:00:00] And 3, 2, 1. Blast off, ladies and gentlemen, welcome to another episode of the MSP Chat podcast. Your weekly visit with two talking heads, talking with you about the services, strategies, and success tips you need, make it big in managed services. My name is Rich Freeman. I’m Chief analyst at Channel Mastery, the organization responsible for the show.
I am joined this week as I am every week by your other co-host, our CEO and chief strategist at Channel Mastered. His name is Erick Simpson. Erick, how’s it going? Going great,
Erick: rich. Starting to feel temperatures drop a little bit. As we record this. We are in the first week of December, the last week of the last quarter of 2025.
[00:01:00] Wow, rich, we we just celebrated our hundredth episode a little while ago, and we covered a lot of news this year, but we’re not done yet, are we?
Rich: Not at all. Actually. We’ve got we’ve got some stuff to talk about here on this episode. We’ve got some really great interview guests coming up on this episode of the show.
We have an interview recorded actually a few weeks ago at I Nation Connect the ConnectWise event. And that is with Corey Riner, he’s the Chief Security Officer at WatchGuard. Very interesting conversation coming up. Speaking of ConnectWise, host of IT, nation Connect, we’ve got the CEO of that company coming on this show in a couple weeks time.
So lots of good stuff to go here on NSP chat in 2025.
Erick: Yeah, we’re gonna finish really strong, so I’m excited, but I’m really excited to dive into. Today’s episode. So what do you got teed up for us on the news story of the week, rich?
Rich: Our news story of the week this time around, comes to us from Veeam.
Very familiar name, very familiar, widely [00:02:00] trusted vendor in the channel. I’ve written about them a number of times obviously in channel Holic, my blog. I’ve attended some of their events. It’s been a little while since I’ve spoken to them though, and I made a point of doing that recently ’cause they have announced a couple of different things within the last few weeks that I think tell you a little bit about Veeam and where Veeam is going, but also about where security is going in the world of managed services right now.
So most recently, just within the last week or two, as people are getting this episode of the show, Veeam announced the launch. V 13, version 13 of the Veeam data platform, which in a lot of ways is entirely consistent with Veeam’s heritage and in some other ways tells you where Veeam has been going. Basically.
So Veeam is best known as a backup and recovery vendor. That’s really where they began. They have broadened into more of a data protection vendor. Over time and data protection has come to mean more than [00:03:00] backup and recovery, right? And so we’ve seen Veeam get into incident response. For example, through its acquisition of co wear.
They have, and this is all part of they, they’ve had these capabilities before, but they amplified them, enhanced them in V 13 of data platform. They’ve got anti ransomware functionality, anti-malware functionality of other kinds. They’ve basically turned what was originally a backup and recovery platform into a true data protection platform in the sense that they’re doing both security and backup.
Theme number one this ties into that we talk about pretty regularly on MSP chat is that. Particularly, not exclusively, but particularly in the world of security, it is all about platforms now. People wanna get more functionality with tighter integration from fewer vendors, especially in the world of security.
Where backup is the last line of defense. It’s a layer on the security stack. It’s pretty important from an MSP [00:04:00] standpoint and an end user standpoint to have all of that coming from one company. And so we’ve seen Veeam move and it’s taken them, two, three years basically.
This is an ongoing campaign. They’ve turned the meaning of data protection into both backup and security. And they’re actually very they make some pretty big claims about their detection and response capabilities in relation to other companies out there, but it is all still fundamentally about data there.
And this brings us to the other recent news story from Veeam. They announced not too long ago that they are acquiring a company called Security ai, S-E-C-U-R-I-T-I. Ai, this was a $1.725 billion acquisition. No joke. But it brings data security, posture management into ultimately this deal is still pending I should say.
So a lot of what I’m talking about here, I’m reading into things a little bit. I just interviewed them about this [00:05:00] yesterday as we’re recording, and they were very cagey about what they said because this deal is not done yet and they have to be cautious. But they will when that deal closes, as it almost certainly will now have data security, posture management, which is something we’ve talked about on the show.
Very important in the age of ai, right? You wanna know what data you have and where it is and who’s touching it. Because that data is AI gold and that makes it a target. But where they’re going at Veeam is with the security acquisition is actually. Even a little bit more interesting than that because if you are a data protection company in the age of ai, then you need to be aware not just of what you have and how it’s classified and who’s touching it, but how people are using it.
And you wanna have that information in real time. If you’ve got somebody in check GPT leaking confidential information out into the cloud, you wanna know about that as it’s happening and shut it down. I, if you’ve got somebody accessing [00:06:00] information via AI that they don’t or shouldn’t have access to just within the four walls of your business because your copilot implementation is internally leaky and so on, you wanna know about that.
There’s a whole new set of security challenges around ai. That pose risks for end users and are, therefore challenges for MSPs and MSPs are going to need tools that are capable of addressing these challenges. And ve now in its mission to be the ultimate data protection platform, meaning both security and backup.
We are seeing them move that in the direction of AI security. And this is something that I think we’re gonna see more and more of Erick, I won’t get deep into it, but our company, channel Mastered has a client that is building a product, has a product already that addresses this. There are enterprise oriented solutions out there that are specifically designed to provide AI security and [00:07:00] watch what people are prompting and so on.
Not a lot of multi-tenant SMSP oriented products. What Veeam is building is headed in that direction. What our client Kipling secure is building is headed in that direction. We’re gonna see a lot more of this, I think, going forward.
Erick: Yeah, it’s really interesting, rich, and not the first time we’ve talked about a backup vendor leveraging the data in different ways that they are backing up for clients.
This is definitely something that, that I also agree that we will see a lot more of any vendor that has lots and lots of data is thinking about how to leverage ai for their clients and for adding functionality. And, I think I’m gonna see if I can see if I can hashtag AI RMM for this particular kind of category.
So it’s AI remote monitoring and management because yes [00:08:00] the biggest threat. Two organizations from a security standpoint is always going to be the users, right? We can secure the perimeter and we can secure the edge, and we can secure devices and, but we can’t secure what the users do. And yes, we’ve talked a lot about, this traction that businesses today have towards leveraging ai and they’re just, subscribing to, these chat solutions, chat GPT.
You’ve got, perplexity, you’ve got all these different things that users are bringing in, and that’s the one thing that the MSPs are not monitoring and helping manage. So I think there’s a huge opportunity for this category in growth. And I think you’re right. I think we’ll see it accelerate quickly in 2026.
It’s an opportunity. So MSPs perk up. This is another opportunity for you. To add value and help secure your clients and bring some governance to the wild west of ai,
Rich: add value, collect a little bit more [00:09:00] recurring revenue, and also set the foundation for the AI solutions. Your customers are gonna want your help in building and deploying.
You wanna be able, you want them to be able to operate those solutions securely. And a big piece of that I’m, instead of ai, RMM Erick, I’m gonna go with IDR AI detection and response. You wanna know if something insecure around data and ai is happening, detect that and respond to it in as automated fashion as possible.
So maybe that’s the product we know. EDR, we know MDR maybe we’re coining the phrase ai DR here.
Erick: Okay. I’m warming up to it. I like it Rich. Awesome. Alright,
Rich: Let’s move on to your tip of the week here. And we were just talking about we’re in the last month of the year, we’re headed towards New Year’s Day.
Here’s a good New Year’s resolution for the folks in our audience, not lose any clients in 2026 what is your tip of the week, Erick?
Erick: Yes, rich, as we know, MSPs wanna grow. They’re recurring [00:10:00] revenues. They’re always on the hunt for new client relationships. That’s their focus.
And in working with MSPs the way we do it, MSP mastered, we’re hearing a lot more about churn. So these MSPs now is the model that is ubiquitous. When I had my Ms P practice, we had to call it flat rate it because, it didn’t exist yet. Now. You are looked at strangely, I think if you’re a business owner and in the SMB and don’t have some sort of outsourced IT support and they’re typically going to be MSPs managed service providers, we’re seeing the competition there really heat up.
It’s very competitive and the job of our Ms P providers today is to distinguish and differentiate themselves and not turn out these customers over time because it is so competitive now that we’re seeing more churn, whether that’s self-inflicted or because, we’re not keeping up with the needs of our clients.
I’m [00:11:00] gonna tie this tip of the week around building, the typical league is building a proactive 2026 customer success and retention engine. But I’m gonna tie it back to AI a little bit because, hey, here we are, and we’re talking about these new solutions that are coming down the pike, the A IDR, the AI architect, the AI governance, the AI solution provider.
So this is a way to add more value, but not withstanding all that, just some three basic things that I think everyone should re review at the end of the year. Number one these struggles that MSPs have in getting clients to show up for strategic business reviews or q bs. I want to begin shifting away from QBR and call them strategic business reviews.
I, I’ve just decided that just now, rich, we want to add value to those conversations. And it’s not a report card that we’re letting the client, give us their impression of how good we’re doing. This is a way [00:12:00] to emphasize outcomes, to emphasize risk, to emphasize operational improvements, risk reduction, the things that we want to talk to the client about, to shore up their business so that they can grow without thinking about their technology or thinking about security.
Bringing in these new solutions that customers want to talk about. Security, ai, we want to shift those QBR into a more strategically valuable conversation. And I also want to take this point, this moment, to dispel the myth that it has to be a quarterly meeting. It doesn’t have to be a quarterly meeting.
Heck, we had clients where we were meeting with them weekly, rich, because they were moving so fast and growing so quickly. So if you’re doing strategic business reviews, and I want everyone to start calling it, and if it’s like an A, and name it what it is for that meeting, it’s a strategic AI business.
Reviews, a strategic security business review, get the client engaged, send an agenda out that says, these are the things we wanna talk [00:13:00] about. What else do you wanna talk about? Let’s prepare for this. It’s a serious conversation and add more value. And on top of that. We want the client to walk away with some actionable decisions they have to make in order for the MSP to add more value.
So not every quarter, not you may have clients that you have do one of these once a year, right? So if you think A, B, and C, which I always talk about Rich, it’s like the A clients get the most strategic meetings because they merit it. Your C customers, you may check in with them once a year. Your BC clients may be twice a year.
It just depends. So don’t treat everybody the same. Focus your efforts on the clients that are growing, but don’t look past the ones that you’re supporting. These are, customer success touches, right? So number two, identify a way to scorecard. Your clients all the way through. If you’ve got a hundred clients, then you’re gonna [00:14:00] scorecard all of them.
And you’re gonna look for early warning indicators that some of them may be at risk, maybe they’re not responding to your customer satisfaction surveys. Maybe they are, not responding to emails. You’re sending them out. Maybe they’re blowing off some of these strategic business reviews.
These kind of, are early warning indicators. The when the MSP knows Rich that the client is shopping around, is when they ask for their passwords and all that, right? So we don’t want that to happen when again, in front of it. Now, you also wanna go through every year and identify those clients that you want to, help find another home so that you can make more room for more of these strategic clients.
So there’s a risk mitigation churn mitigation strategy, but there’s also a. I want to, bring some more players on my team to win the championship this year. So that kind of goes hand in hand. I expect some of these clients, maybe that they’re not at risk from churning out necessarily, but maybe they just aren’t [00:15:00] growing.
Maybe they aren’t saying yes to your cybersecurity bundles, things like that makes it harder for you to work with them and you’re not adding as much value to them and they’re probably not paying you the margin that you would like because they may be a little bit more cost conscious.
Think about that as well, the end of the year, what are my bottom 10% of customers that if I help them find another home, like you notice I didn’t say terminate them, help them find another home, right? And make room for more a and d clients so you can scale. Without, more profitably, without having to hire many more technicians that way.
And then finally a customer success program that really takes into account more specific granular customer satisfaction surveys. And I know that a lot of the platforms that MSPs use, rich, are smiley face, sad face. At the end of a ticket, you’ll, you may get, a new client to the [00:16:00] users to, to complete those the, in the first 90 days or six months or so.
But after a while, we hear from partners that, we don’t really get that. Find a platform that allows you to craft very specific questions about the role that each end user plays in that business and what challenges they’re having. And get more feedback from them about the, these pains and challenges because the most successful.
Strategic business reviews we used to do, which always included. We did a quarterly custom survey to the end users in our clients’ organizations. And then we would sit down at those strategic business reviews and reflect back to the business owner. Here’s what we’re hearing from the users. And in many cases, they weren’t aware of some of these things.
Oh, really? It’s, they’re, it takes them 77 clicks to, process an invoice. Just like MSPs have the same problem, right? So does everybody else. And that allows us to become more valuable to those clients. And then the last bit to make those activities successful, rich, is to reflect back to [00:17:00] the folks that provided their feedback in the survey and said, Hey, thanks for completing the survey.
Here’s how your, the folks in your organization responded, not uniquely identifiable, but in on this question, 77% of you answered this. 30% of you answered that way. So now that. End user feels like, oh, my, my opinion counts. I’m actually getting something. And let ’em know, Hey, and we will be talking about these results with, your business owner when we come and meet with them.
So thank you again. So just a couple of things to help reduce churn, to identify at risk potential at risk clients, and then also to have a strategy for 2026 that says, Hey, I’m gonna help find homes for these folks so I can make more room for more A and b clients. Or, alternatively, I’m not spending enough time with my A clients because I’m dealing with VC customers.
And that might free you up to be a lot more strategically valuable to those clients that need your help to grow. Because the last thing we want is a client to leave us rich and say we’ve outgrown you, right? And that’s [00:18:00] our fault Then.
Rich: A few quick thoughts. I, I like all that advice a lot.
One of the things I like about turning a quarterly business review into a strategic business review is it gets people out of that quarterly fixation, as you said. Absolutely. The best MSPs I know will meet with some clients once a year and others twice a year. Stop thinking as a quarterly business review as the the ideal or the model.
What’s important is that it’s a business review, and in particular, when you call it a strategic business review, you are putting the spotlight on what is gonna be most important in terms of your relationship with the client going forward. As AI automates a lot of the sort of maintenance work that MSPs have historically done.
As we’ve said over and over again on the show, your value add to the client is going to be that strategic technology advisor function. And so this is a strict strategic business review where we’re gonna talk about opportunities to get better at that. To the [00:19:00] point about ai automating technical work more and more as we go forward.
There’s at least one big MSP rollup that I’ve written about, that used AI to automate the service dispatch function and then take the people who were doing that before and turn them into customer success managers. Yeah, I think by and large what we’re seeing right now in the managed services world is that people are not using all these great new AI tools out there to reduce the number of people they have on the payroll.
They’re just using those people in different ways. And one of the things AI is going to enable you to do is invest more time and effort and expertise in customer success so that the AI is gonna help you be smarter and dedicate more time and attention to that function. And then AI can also help you with an early warning indicator.
There’s a a solution I think we’ve talked about on the show before. I don’t really know where it is in its rollout phase. It’s a brand [00:20:00] new AI solution for managed service providers called, or the company that makes it, it’s called Cyt, CYFT. But I know one of the things they have on their roadmap is an AI tool that will just be listening and snooping in on every call that every technician has with every customer listening for early warning indicators of unhappiness and issuing appropriate alerts.
So AI is gonna make people more effective there. And last quick point is, even without ai, I would think, Erick, you know better than I do. Telling your technicians, telling the customer facing parts of the company. One of the things I want you to do is be my early warning indicator of you see or hear anything that tells you this client is less than delighted with us.
And as Bill Gates one wrote in a well run company, bad news travels fast. I wanna know right away if there’s a problem. And I want you to be my early warning indicator. Yeah. So a couple of thoughts there on
Erick: the AI front, I think also [00:21:00] we know that there are solutions out there that are built around AI to help prepare for these strategic business reviews as well.
Gathering all this data that the MSP has and all these different various platforms and putting together preparing for those strategic. So I definitely forecast that those solutions will mature, where you can actually natural language say, Hey, I’m having a meeting with so and we wanna talk about this opportunity.
Build me an agenda, build me some talking points. Just the the stuff we do right now with these chat bots, right? But it’s gathering that data from that customer. So I think that’s gonna be super helpful as well. And give those, these MSPs a much more confident and authoritative approach to having these strategic business reviews that are gonna add value for those client relationships.
And then the and the last one was when you said, Hey, give us, early warning signs. I remember so vividly back in the day with RMSP and me before I went out to meet a client for a strategic business [00:22:00] review or just a client meeting or just a phase review for a project we were in.
I’d stop by, the service desk and I’d ask every, I’d say, Hey guys, I’m going out to meet clients, so and is there anything I need to know? Above before. ’cause I’ve walked into, a landmine and when I get there and it’s we’ve had this ticket open for saying it. I’m like, oh my goodness.
And then, okay, let me go deal with that. We’ll reschedule this meeting. Let me make sure that we take care of that for you right now. As having the assistance of AI and the team to be aware and in tune to give us that, that, the early warning system that you coined there, I think is super valuable.
Rich: Yeah, run, running an organization where the left hand knows what the right hand is doing and vice versa is a real customer retention driver. So yeah. Good, good. Final tip there. Enough of us, let’s move on to our interview segment. We’re gonna take a quick break. When we come back, we will be joined by Corey Riner, the Chief Security Officer at WatchGuard, and a conversation that we recorded at [00:23:00] ConnectWise IT Nation Connect about a month ago.
As we’re recording this episode right now, we had so many great conversations at the show. We’re still working our way through some of them. Lots of good stuff coming from Corey, so stick around. We’re gonna be right back
and welcome back to part two of this episode of the MSP Chat podcast, where once again, we are coming to live from ConnectWise IT Nation Connect 2025. In Orlando, Florida, and this time we are pleased to be joined by Corey Reiner. He is the Chief Security Officer at WatchGuard. Corey, welcome to the show.
Corey : Thank you so much, rich. It’s a pleasure to be back with you.
Rich: We’ve known each other for for quite a while. Yeah. For folks in the audience who don’t know you or who knows, don’t know WatchGuard, give him a little background. Yeah.
Corey : So first of all, I’m Cory Riner, the CISO of WatchGuard Technologies been there for a long time.
Previously. The CTO we’re a company that focuses on bringing enterprise [00:24:00] grade security to the mid-market through MSPs. We’ve always lived and breathe through channel, and the MSPs are the channel that we think really hit that mid-market and SMB, like we’re never gonna be trying to directly sell to them because they go to MSPs for their IT and security services.
So I mentioned just cybersecurity. We started with a network security pedigree, so we’re well known for fire boxes. Whether that be hardware, software, cloud-based firewalls. But we’ve expanded hugely in the past 10 years. So now we have a full endpoint, security suite, full identity, MFA suites, we have new SSE products that have come out NDR products.
So most of the cybersecurity needs of N-A-S-M-B or MSP providing to them, we can serve that in our platform.
Rich: So these these conversations are normally not news conversations. And by the time the show airs, this will be old news. But I gotta ask because as of two days ago, you guys have a new CEO.
Yeah. Yeah. So tell folks you know who that [00:25:00] is and what that means for your partners.
Corey : Yeah, so that’s Joe Smoky. We’re very happy to have a CEO although we’re we’re happy with vats, who is an interim CEO from our board organization. He did a lot to help continue to grow us with a fantastic Q3. But Joe has just joined us, and he’s previously known from the last seven and a half years from being from K.
And I think the best way WatchGuard is looking to grow. We want to continue to help the Ms. P market and MSPs grow. And if I were to talk about him, I think what he did at Kaseya in the seven and a half years he is there, I think he took it from 150 million in revenue to 1.5 billion and they went from a valuation of 1 billion to 15 times 15 billion.
So very good growth. So happy to know him. Obviously Kaseya knows the channel, like ConnectWise, we were talking about Kaseya to the ConnectWise event, and by the way, we support ConnectWise manage and Autotask PSAs and Halo as well. But yeah, [00:26:00] very happy to have them.
Erick: Corey, as long as we’re talking about news this week from WatchGuard.
Yeah. Tell us about the integration news you announced on Tuesday. So we’re talking
Corey : about WatchGuard Cloud, PSA. So yes, WatchGuard, we work with MSPs, we know the tools they use and we know the PSA and even the RMMs are super important to them. So we’ve always had integration for a while with the firebox the network security appliance directly.
But what we announced is it’s now in WatchGuard Cloud for all of our platform, whether that be identity endpoint network, all of it’s in there in WatchGuard Cloud. And the integration is a very deep integration. Like we know how much all these MSPs rely on ConnectWise. So it’s not just basic things for management or opening tickets, but it’s a full closed loop ticketing system.
So why is that important? We want to save them time and money, we can automate opening tickets. Say if a network interface goes down, you want to know that we’ll open a ticket, but what if it was an anomaly and it [00:27:00] comes back five minutes later? We don’t wanna waste your tech’s time. We will close the ticket too.
That’s just one example. It also automates asset management licensing. So the important thing of knowing what licenses and when the renewals are for your customers so you can get that reoccurring monthly revenue is also important. All of that’s connected through the PSA system as well. And as I mentioned before, not just ConnectWise manage, but also Autotask PSA and Halo PSA as well.
Yeah.
Rich: Obviously for like multiple years now, at this point, there has been a ton of talk about AI in security. Absolutely. Every security vendor out there has felt compelled to do something involving ai. And sometimes from my perch in the media, it feels a little bit like checking off a checkbox.
We’re there too, how’s the
Corey : word?
Rich: Bingo. Yeah. So from your perspective, what, what does meaningful AI innovation in security look like?
Corey : The reality is if you haven’t been doing this for 12 [00:28:00] years, are you really doing it there? We talk about AI as a buzzword, is something that’s really happened the past three years, maybe really taken off the last two years, but it’s been the backbone of cybersecurity for a long time.
And WatchGuard had some internally and some of this we’ve gotten mature from acquisitions. But let’s take pandas pandas security, that’s the endpoint company we acquired to get WatchGuards advanced EPDR. They have been doing machine learning based detection from malware for 12 years. So it’s not new to them.
It’s very meaningful part of our product. It’s the reason we have our zero application, our zero trust application service. One of the reasons like AI is not just a buzzword, it works. My favorite anecdote about how great machine learning was at proactively catching new malware is Panda as a company around 13 years ago, noticed that even though they sold security, anti-malware [00:29:00] software every quarter or so, about 220 customers running their software would get infected by malware.
That’s like embarrassing, right? You sell anti-malware, but you’re still taking support cases where your customers get hit by malware. And to them, they wanted to fix that, and that’s when they started 12 years ago. To do this machine learning thing. The result is all kinds of crazy, like we say, ai, but it’s really in 70 different ML models.
It’s really a long data science, a long process of doing this, but within the first two years of them starting their ML process over a decade ago, their support cases dropped to just tens. And then over the rest of the 10 years, we just don’t get calls. If people are using our locked mode, which includes file submission to the cloud that has very quick AI analysis, it works.
So yeah, AI is used a lot for a buzzword. So I recommend customers dig into how long have you been doing this? And [00:30:00] do they know the difference between ai? Is it’s all machine learning based? It’s not really that new. It’s just a new buzzword in my opinion. And we have a lot of that data science at WatchGuard that has been very mature.
Erick: It reminds me, Corey in another lifetime, we were one of the first MSPs in the industry and in fact, we were so early that we called our services flat rate it ’cause we had been doing it. And then, oh, it’s MSP. So it’s got, it reminds me of what you just described.
We’ve been doing it for 12 years, it’s machine learning and now we are able to capitalize on that. Yes. And deliver services for MSPs. So I’m gonna ask you a different kind of an AI question because you know what, it wouldn’t be a conversation if we didn’t talk about AI these days.
Absolutely. So what role do you see Agentic AI playing kind of today? And in the future, like we’re having a lot of these agentic AI discussions
Corey : about this. It’s a big deal. Yeah. By the way, it’s one of our, it is gonna be one of our predictions for the next year, is [00:31:00] that there’s going to be a breach where it’s a fully autonomous agentic AI that does the entire kill chain.
The beginning’s not autonomous. The, there’s still gonna be a human threat actor picking a subject, but everything from the recon to enumerating all the identities you want to learn about, to exploiting weakness to AI based tool creation, making the malware to lateral movement internally. We have all the individual pieces in different AI tools that can do all that.
And ag agentic, really ag agentic is just a fancy word for connecting LLMs and other AI things to being able to connect to all the network in different services we use as humans, we’re basically giving them the keys to have the power to any API out there, you can now just do it instead of just telling me what to do, you can do it for me.
And so now that AI has all the tools to research quicker and better than a human can write a better spear phishing email than a human can code malware quicker and [00:32:00] better than a many of the non-technical humans can. It’s all gonna be automated. So agen, it is one of those things where you can only fight fire with fire.
Agentic AI is cool because giving it that connection, agen is just APIs and con connections to other things. It’s gonna be powerful for us as security defenders. It’s gonna allow us to automate our socks, it’s gonna allow us to automate it, but the same power we get from it, threat actors get from it. So I think we’re going to start the agent AI cyber war starting next year.
And this whole idea of machine against machine being what cyber turns into is going to start happening. Not like in the terminate or kill each other way, but in defining and defending vulnerabilities way.
Erick: That’s what I was hearing in the back of my brain. I was hearing, so we are gonna be fighting sky mask.
Yeah,
Corey : but the funny thing is, if you follow security researchers, they’re always ahead of the game, but it takes a while for people to believe ’em. In 2014, DARPA [00:33:00] funded the Grand Cyber cyber challenge. It was a def con challenge where they got a bunch of universities. To create AI servers. They all were given a bunch of network services to same things.
Cyber works. Yeah, exactly. And they’re like, okay, each of you universities, your AI has to automatically find vulnerabilities in the def, in the their stuff and attack them while also finding vulnerabilities in your stuff and patch it. And they did both and the best AI model won. But it proved that both on the auto defense and the auto attack thing, it’s already been happening and people are just catching up with the technology.
And now when the threat actors get their hands on it, you better have AI as a defense when that happens.
Erick: It’s the updated version of that old movie war games. It’s now Silent war. Oh
Corey : yes. Remember? Yeah. And it’s the sad, edging above it by saying that. By the way, one of my fa that is my hacker originally, a lot of people pick hackers, but war games.
Ah, I had a 300 BOD coupler modem just like Matthew Broderick and. [00:34:00] While I wasn’t war dialing to get into nuclear defense in my local neighborhood, I wanted to find every BBS. So I certainly war dialed. Yeah, that’s awesome.
Rich: So you were looking down the road for us at something some threat activity we can anticipate in 2026 that’s AI powered, but looking at where we are today, I’m curious, just over the course, like over the last kind of 12 months what kind of threat activity has AI been adding to the
Corey : picture?
One of the things that, two years ago felt like it may be a little silly, we would tell people, DeepFakes are going to allow people to become your CFO or become your voice on the phone. And they’re like, yeah, technically it’s theoretically possible, but are they gonna really weaponize?
Yes. One the deep fakes. Two years ago we were watching deep fakes where people had six fingers and. Now in, in it’s crazy, a year. A, the one thing we have to worry about all of this AI is the evolution of the technology is going to be so short. If you think of the internet, which [00:35:00] seemed, we’ve had it for 40, 50 years.
If you include arpanet, that’s in human spend. That’s a short amount of time, but that’s 50 years it took to evolve. AI is evolving every month faster than we can keep up. So DeepFakes are now very convincing and they’re already weaponizing them there. There’s two cases I can think of. One was a Hong Kong based organization where they started getting a typical, an accountant, someone in finance got an email from their CFO.
And by the way, right when they got his email from the CFO, apparently this accountant was properly suspicious. ’cause for the normal email thing, we know that maybe that’s not my CFO, but instead of trying to weirdly get him to do an account transfer, he said, will you join me on our teams video? I dunno if it was Teams or Slack, but on a video call to talk to me.
And he got on a video call and his CFO and a couple of other executives were there on video in, according to him telling him about this account transfer. He should deep faking on video. Exactly. Yeah. They were masquerading. Yeah. [00:36:00] And by the way, there’s real time tools now where you can literally press a button in your Mark Zuckerberg, right?
And so they actually used the technology and they transferred, I think it was 25 million Singapore dollars from this Hong Kong location. A similar situation happened in the UK for about 220 thousand pounds. But they’re using it all the time. They’re using audio already for Phish. A year ago we were talking about this will probably happen.
But with the technology, it didn’t seem like it may take a while for them to really weaponize it. One of the predictions we have is deep fake audio and video is gonna be the norm in phishing and scams. Now, it’s going to be used a lot.
Erick: I’ve seen some examples and I’m blowing away and it, I, to me it’s it’s just a couple of years ago when, the iPhone and Android started releasing like your little fake avatars that you had a little in your face and it was just a little emoji.
Yeah. A little emoji, a little dragon or whatever. And now they’re basically having people transfer money because they’re having a conversation that is so realistic [00:37:00] that, the victim cannot tell what’s going on.
Corey : I couldn’t, I might’ve told Rich this story before, but Mark Le Liberty is, he is my right hand person.
He is the director of our SOC and someone I’ve worked with and spoke with for a long time. A good guy, hacker as well. And. As an experiment, we run a podcast as well. So he certainly has audio from me. He did a thing where he created a piece of audio that basically at the time we had a different CEO, Prakash Pani and he created audio saying, Hey this is Corey Prakash, I wanna resign a CTO and you should make mark the CTO.
And by the way I also wanna give all my Lego sets to mark and to me it sounded like me saying that isn’t that insane and it costs $5 in simple tools. It
Erick: fools you. Yeah. It’s your voice. That’s nuts. Yeah. Yes, obviously AI is going to be the number one threat, moving forward in terms of, hacking and ransomware and all these things that MSPs have to guard against.
But other than ai, from where you’re sitting, [00:38:00] what other big changes in security kind of happened this year that you’ve, that kind of stand out to you?
Corey : I think this year and next year is we are finally, especially like MSPs, largely, mostly probably take care of SMB in the mid-market enterprise tends to have to not outsource as much, so there zero trust.
Something that has been around for a bit. By the way, zero trust is another one of those, buzzwords where, to me, zero of trust is the least privileged principle finally being adopted properly, but zero trust. We’d be talking about insecurity for maybe under a decade, but right around there, it’s not heavily adopted.
But I think this is the year that SMBs really start to operationalize it. I think between the technology has become easy enough that it’s not quite as complex to, to handle hybrid networks in very convenient ways and make sure individual access to tools based on this continuous [00:39:00] validation of who you are is much easier now.
But I also think it’s because there’s so many hacks that have proven that usually the attack is somehow already coming from the inside with a, a person, so Zero Trust will definitely be operationalized in 2026 and is already starting this year.
Erick: And is it taking this long? Simply because we’re now getting more of a handle on all these cloud and SaaS applications as well because of, everything’s moved from the premise to the cloud.
All the data goes back and forth.
Corey : I think we have acronyms like Sass E and not to hammer Gartner, but if you think about SASS e Secure Access Service Edge, do you intuitively know what that means? I never did but when you think about what you were talking about, what every MSP out there knows is I still will have a perimeter, there’s still office as a perimeter.
But that’s just one tiny thing. Half my applications are Azure and AWS I’m using SaaS applications like M 365, which I have total different control [00:40:00] of. Remote work is not the exception, it’s the rule now. So yes, this hybrid network where all of those things need the same general security policy, but they’re total different paradigms of operation.
And in the past, how do you manage that? You have to get four or five different tools and have different policies set up on all of them. So I think we’ve finally won people understand the zero trust message and kind of get what ss e they that need SS E is a bad acronym, but that need, what it describes is a very important need.
And like I said, I think early things as, as far as firewall as a service and ZTNA might have been hard to install, but platform companies like us that have, we started with perimeters, so we already have perimeter protections. Now we have cloud protections, now we have M 365. Rather than them having the piecemeal security for all of those, we have it in one platform.
So when we add ZTNA and firewall as a service, it’s easiest [00:41:00] for us to take our cloud platform and auto configure that for them, rather than have them set up different VMs in different places. So I think we’ve simplified it and I think at the beginning it took a while for the, like them to really push the message of Sass EI remember when SASS e first came out as a term, most people didn’t know what it was, but you, if you talk to them about the hybrid issue, they knew exactly what you’re talking about.
Erick: Yeah. You weren’t calling somebody a smart ass when you said sassy, right?
Corey : Yeah. I’m being a little sassy by saying Gartner Sassy acronym is not very good and not as intuitive. It’s the proper idea. Their idea is exactly on, but I don’t know why they picked that service. Yeah. Anyways, sorry.
Hopefully Gartner doesn’t kill me.
Rich: Yeah they don’t listen to anything. We’re good. We’re good. You can say anything you want about it. You’ve already given us a few examples. No kidding. It’s a highlight of the holiday season for me every year when the WatchGuard security predictions list comes out.
Thank you. You’ve given us a few already and you mentioned off the air before, this is work in progress. We’re recording in November. [00:42:00] Yeah, but I, go ahead, hit me. What are some security predictions for 26?
Corey : So one other like area we’re looking at that, it’s we’re trying to add to the prediction to also make it new because it’s clearly happening, but we’ve been talking about software or digital supply chain attacks growing and becoming the target.
I think 2025 has really set up 2026 for the year, where the primary way that we’re doing software attackers are doing software, supply chain attacks, will be through open source repositories. So through 2025, like a, just so I’m sure your community knows a software supply chain attack means you’re using hundreds of vendors.
Maybe you have really good, you’ve built up very good security for your organization, but you’ve also brought in different technologies inside your perimeter or inside your hybrid network to, to do things for you because you’ve given them trust. But if they have some sort of vulnerability, suddenly despite all your security, that’s the weak link that gets people inside your [00:43:00] network.
The common example is, of course SolarWinds, the Ryan product, fantastic product. A lot of m MSPs and IT practitioners used it, but unfortunately when it was Trojan that for people that used it in 2025, there’s been many, we know attackers are using this to get into many big companies. From an attacker’s threat point, if you can find a very popular service or application that people use and that becomes something you can Trojan eyes, you’re going to get a ton of victims.
And lately they’ve been going after different, well-known legitimate open source repositories. NPM, is a popular way to get Python packages if you’re a Linux user. It’s had three different situations all in the year where many of its packages were basically booby trapped with malware payloads.
Yeah. Yeah. Pi. Another place where you can get Python libraries, the same thing. And then we have older cases, which were one-off open source cases like what was the compression XYU till [00:44:00] no one I knew even technical people knew what XYU till is, but it’s just a compression library that every Linux distro uses.
It’s like the most ubiquitous thing out there, even though no one knew its name. A Chinese threat actor spent five years in a long con to become one of the developers thought that Open Source group accepted as a legit developer.
Erick: Wow.
Corey : And then they booby trapped it with a open SSL backdoor. So that was the old way of doing it, was that long con.
Now they’re finding ways to infect lots and lots of applications in things like NPM and that’s been successful for them over and over. So we think threat actors are gonna target. There’s many different places, where open source, legitimate, like the well known where you would go to get the official package repositories exist.
We think threat actors are going to use that in supply chain attacks in 2026. And if you think about it, I’m talking Linux and I’m sure the MSPs, they’re actual people use Windows computers. But every IO [00:45:00] OT device, every networking device, there’s so many devices that are sitting in your office that IOT or OT device is just the Linux platform.
And even though it has some proprietary company software on it, 75% of it is just open source packages to do the basics. So if you think about, if those developers are just grabbing those packages, suddenly their product becomes Trojan ICE in these attacks. So yeah, expect software supply chain attacks through open source libraries next year.
Erick: So thinking ahead 2026 from an MSP’s point of view. ’cause we’ve put the fear of God in them now. Oh, sorry. Now we’re,
Corey : they can fix it though.
Erick: We’re frontline of defense. We’re recruiting them to, to guard against Skynet. Give me like three things that an MSP should be actively.
Thinking about and taking action to prepare for this next evolution [00:46:00] of, defense against these threat actors for themselves, supply chain and their customers three. Gotcha.
Corey : So for them themselves they should be, following the same security practice they tried to give their customers.
And one of the things to do is put MFA on all your remote access. There have been many situations where I love MSPs. They’re usually way smarter than customers as far as security, but it turns out that it was an MSP that got a lot of their customers infected. ’cause for instance, they were using a security product of some sort to do remote access.
One of their credentials got stolen in some way, like a phishing attack. And if they didn’t use MFA or didn’t protect the management interface. The attacker used their own security tool to push ransomware out into the product.
Erick: Yeah. Sometimes they forget that they are also part of that supply chain.
Corey : They’re absolutely a part of the supply chain, so make sure to use those practices. And to me, MFA is a big one. If you think about it. MSP, it’s [00:47:00] almost always remote management, by definition. Yes, they will go on site often, but to monitor constantly preg, you have to, yeah, you have to have remote access, right?
But that’s why they need that to be super secure. So find ways to secure it. The number one tip, the easy one is just MFA, those logins. Even if the login is exposed to the internet, which by the way, you shouldn’t do either. At least if it’s MFA and the credential leaks, you’re gonna be somewhat protected.
Next thing though is don’t expose management interface directly. You should have a secure connection. And in the past, I would say VPN, right? Here’s the new tip. You need to start transitioning from VPN to ZTNA. Like I’m a company that has products that are IPSec, S-S-L-V-P-N. They’re useful tools.
They have security, but those technologies expose a port that you have to expose everywhere because you don’t know where your remote technician’s gonna be. So you can’t just limit the access control. This, you have to say, everyone can [00:48:00] get to this portal to at least attempt to log in
Erick: that port 33 89, is that
Corey : Yeah.
Is that or is that’s for RDP, for instance. Yeah, but it could be 4 4 3 or 8 4 4 3 for SS LVBN. Exactly. It could be I IP SEC portal for the login. Yep. The issue is because you don’t know where remote people are coming from, you expose a portal, one that exposes the authentication possibility if you don’t have MFA, but two, even security vendors like us will have vulnerabilities if there’s ever a vulnerability in there.
That’s a attack surface a guy could take, care could use to get into your network. Yeah. One of the beauties, besides all the zero trust access and the individual continuous validation of users, one of the simple things that ZTNA offers is it’s no longer your firewall gateway or your gateway exposing a port to the world.
It’s a cloud hosted service that is taking outgoing connections from your remote and outgoing connection from the firewall and connecting them, right? The [00:49:00] cloud becomes the connection point for that. So as long as the vendors cloud pop, and by the way, we’re putting all our investment in securing our pop against these attacks, as long as we are doing things securely, you don’t have to worry about an attacker doing some vulnerability on your infrastructure to get in.
So ZTNA is just a more secure way to do remote access. And if you’re doing management. Make sure ZTNA is the first barrier before you offer the remote access or the remote management to your other users.
Erick: And generally it’s easier to use than old VPN seems when you’re, man, all these remote, user workloads and all that.
Yeah. The
Corey : beauty with ZTNA is because we know one day you might be connecting to this office one day you might be connecting, there’s no concept of logging on every morning. It’s just on as long as you don’t turn it off. And when you open your laptop, you can get to all these places. You’re not going to an IP address and logging in, you’ve logged in already to the computer.
So we know and we give you access to the [00:50:00] resources that you’re allowed. So it’s very easy to use and it’s now easier to set up too with platform companies like ours.
Erick: Alright, so that’s two.
Corey : Gotcha. Bring us
Erick: home. Bring us home.
Corey : For software supply chain attacks I think you, you definitely need to focus on third party risk management as a MSP when you select your vendors just the same way end users do.
Like we’re the situa, your vendors hopefully are trustworthy and good intentions, but intentions aren’t enough. You should push back. And when you pick a vendor, it shouldn’t just be on how easy the product is, but what is your security practice? WatchGuard, how often do you patch, what is your secure software development lifecycle?
Do you have a static analysis testing before you release a product? Are you doing all the things you should to secure yourself? So make sure that third party validation is part of the bus, the buying decision when you’re picking what to use in your tech stack. And I think the main takeaway there, there’s all kinds of detail on what to look [00:51:00] for, but the main thing is you’re gonna find some vendors who will be like, dude, I’m glad you asked.
I have a trust center one, I have these three compliances. And if you know about these compliances, I have to do all of this best practice in order to get a PCI Sac D level of compliance. So that’s a shortcut to knowing I’m good, but also I have a trust center where I’m gonna give you my SLAs for everything I’m going to, I have a P cert page, a product security incident response page where I’m going to transparently talk about vulnerabilities and make sure you patch, they’ll be happy to answer your questions and proud of it.
Whereas you find other vendors are like, oh, I’m gonna have to talk to engineering. I’m not quite sure yet. And that doesn’t mean it’s bad, but it’s certainly not at the maturity level that they’re, they know exactly how serious they take security. So really it comes down to the supply chain of we’re all partners with each other.
A rising tide is gonna affect all boats as well as the lowering tide and the vendors that you should pick are the ones that are trying [00:52:00] to rise the tide of security for everyone. And you should do that for all your partners.
Rich: Do you have or know of a good list of those questions to ask or,
Corey : there’s something called the SIG questionnaire.
I wouldn’t recommend sending someone the full SIG questionnaire, which is 1,024 some questions, but the SIG is a standardized set of security questions. So the way we do it at WatchGuard is for the mature companies, we don’t want them to have to fill out a super questionnaire. So the first thing is we ask if you have compliance.
I, if you have a certification like ISO 27 0 1 A PCI or some sort of SOC two a Type two certification. Everyone knows what the requirements of best practice are. So right away, they’re meeting a base set of security controls and requirements that frankly, many companies don’t live up to.
So the shortcut is to find that, and then you may not have to ask questions. If they don’t have that go to sig, they have different levels of questionnaire, and we don’t want to, when we’re doing [00:53:00] our security validation, our first thought is, how much data am I sharing with you? How much access am I giving you to my network or my data?
And how critical is that data? So if it’s some sort of vendor that I don’t know is not gonna have access to our most sensitive data, we may just send the basic sig one and not worry about the risk of that vendor. But if on the other hand we know like literally if you hack their network, they’re going to be in a core part of our service, then we might make sure they ask certification and send one of the Biggers.
But just look up sig questionnaire, SIG and you’ll find some easy security questions.
Rich: Alright, Corey Riner thank you so much for taking time out of the show here to join us on MSP chat.
Corey : Yeah, absolutely. A pleasure, rich. Yeah, it was great to be with you.
Rich: For folks in the audience who would like to follow up with you, learn more about watch card, where should they go?
Corey : I feel like if you just go to cycl simplicity.org, it will take you to our thought leadership blog, which is not about product. It’ll give you an [00:54:00] introduction to me and my team talking about general security and we also have a 4 4 3 podcast on that blog. So that will get to know us. And because it’s on the WatchGuard site, if you’re interested in product after that, you learn something or you have a need, you’ll have find links to our site through simplicity.org.
Erick: We’ll link
Rich: to that in the show notes. Yes,
Corey : absolutely. Yeah. And and the podcast as well.
Rich: Yeah.
Corey : Thank you. Yeah.
Rich: Yeah. Once again, thank you very much for joining us. Yeah. Folks, Erick and I are gonna take a break here. When we come back on the other side, we’re gonna chat a little bit more about this conversation, furry Riner.
Have a little of fun. Wrap up the show. Stick around. And be right back
and welcome back to part three of this episode of the MSP Chat podcast. And once again, we thank Corey Riner for joining us at the IG Nation Connect event where he like everyone else there was on the run and very busy. We appreciate him taking some time out to speak with them. It, it’s an interesting thing.
I always [00:55:00] look forward to WatchGuards predictions for the next year. ‘Cause Corey drives the creation of those and he’s always got the most interesting list of pretty much any vendor out there. So it was good to get a very early preview of him of of some things to look for in 2026.
And it was really interesting Erick, ’cause we recorded that interview, I wanna say on November 7th. Almost exactly a week later. So one of the things he says in that interview is, in 2026, you’re gonna see the first hack in which AI does the entire thing end to end the entire kill chain. It’s gonna identify the vulnerability plot around it, execute, et cetera.
I think it was eight days, seven or eight days after we recorded that interview, Andro publishes some research about something very similar. Not precisely like what Corey was talking about, but very close. And so it, it tells you both the kind of foresight Corey has in the realm of security and how quickly things are moving in the age of [00:56:00] ai.
That before we even got to 2026, that kind of thing was already happening. We’ll see. How much worse that kind of thing gets in terms of the speed with which, attacks happen and the creativity e exhibited by AI and designing and executing them.
Yeah, it’s gonna be
Erick: I think you and I have joked about that old sci-fi movie, the Colossus, the Forman Project, where these two supercomputers are edging war against each other because, humanity is no longer relevant. I think that trope has been played out, ever since in every sci-fi movie where, AI and, Skynet takes over.
But yeah it’s it’s scary to think that, we measly humans have to, figure out ways to combat AI and build smarter AI to combat the, it’s a ping pong game, right? The other ai and this AI and yeah. Brave new World rich.
Rich: Indeed. And that leaves us folks with time for just one last thing.
And you’ll remember on the [00:57:00] previous episode of the show that previous episode or maybe the one before that when we were sharing our one last thing with you. It was about a parrot that had gotten into a coffee shop and it was stealing the coffee. So it turns out animals like coffee as much as people do, certainly as much as I do.
And, I like a nice drink now and again, Erick too, I do know my limit as well. And this week we have a story about an animal that did not know its limit. We are recording here just days after Thanksgiving and over the Thanksgiving weekend, a raccoon in, ashland, Virginia broke into a liquor store started smashing up some of the bottles on the the bottom shelf there, and had a little too much tied one on I think you would say, did not know his or her limit, and was found there.
Just spread eagle on the ground drunk as I won’t say, drunk as a skunk. Drunk as a raccoon. Basically when employees came back to the store. So yeah, just because you have access [00:58:00] to a shelf full of alcohol folks, moderation, everything in moderation, even if you’re a raccoon
Erick: and rich, we have to post the link to the article because the photo of the raccoon in the, on the bathroom floor just face down spread eagle.
It’s classic. And, I Two thoughts, right? Stay away from the bottom shelf stuff. You’re gonna, you’re gonna clean out a shelf of liquor, get to the top shelf stuff if you’re gonna do that kind of stuff. And then, again, Rocky raccoon, the mixologist for this episode of the MSP Chat podcast.
Know Your Limits. And I know that the story ends with, they called animal control, they took him to the vet. The vet said, okay, he’s fine. Nothing wrong with him, except probably for a massive raccoon sized hangover.
Rich: Absolutely. Yeah. Rocky, the Mcal just hadn’t occurred to me until now.
But probably one of the mistakes Rocky made was mixing spirits, which we all know not to do. And yeah, drinking whatever was at hand. [00:59:00] So lesson learned the hard way for Rocky Raccoon.
And folks that is all the time we’ve got for you on this episode of the show. We thank you very much for joining us.
We’ll be back in a week’s time with another episode for you. Until then, we’ll simply remind you this is both a video and an audio podcast, which means that if you are listening to us right now, but you’d like to check us out on video, you can go to YouTube, book up MSP chat if you are watching us on YouTube.
But you wanna check us out on audio because you’re into audio podcast. Go to Google, apple, Spotify, wherever it is, get your audio podcast. You’ll probably find us there and wherever it is that you find us, please subscribe, rate, review. It’s gonna help other people find the show and enjoy it just like you do.
This show is produced by the Great Rest Johns. It is edited by the great Riley Simpson there, part of the team with us here at Channel, mastered, ready, willing, and able to create a podcast for you. But podcasts are really just the tiniest sliver of what we do for our clients at Channel Mastered, where our mission is to help vendors build and perfect MSP channels.
[01:00:00] You can learn all about that at our website, www.channel Mastered.com. Channel Mastered has a sister organization called MSP Mastered, that’s Erick working one-on-one with MSPs to help them grow and optimize their business. You can learn more about that at www.mspMastered.com. So once again, thank you for joining us.
We’ll see you in a week. Until then, we will simply remind you, you can’t spell channel. Without [01:01:00] MSP.
Check out more episodes
