Business of Tech: Daily MSP News & IT Services Analysis

The episode identifies a structural shift: traditional patching is no longer sufficient protection as the act of releasing a patch now informs and accelerates attackers, particularly with the use of AI. When vendors publish fixes, attackers can promptly identify and exploit not-yet-patched systems at scale. Companies and data sources underlying this shift include OpenAI, Microsoft, CISA, and the Verizon 2026 Data Breach Investigations Report.

The most consequential development is Verizon’s finding that vulnerability exploitation now leads breach causes at 31%, overtaking credential theft and phishing. The percentage of fully remediated exploited flaws has declined to 26%, and the average time to fix has increased. Notably, 263,000 servers in the U.S. still run unsupported PHP, and coordinated AI-driven attacks have reduced attacker dwell time to hours in real-world incidents like the ConnectWise breach.

Vendor responses illustrate the risk landscape. N-able has launched AI-assisted patching to speed remediation and scale endpoint management, but its patching platform was itself compromised. Industry observers such as Krugman and Thompson foresee a move away from open internet-facing systems toward closed or gated platforms, accepting slower workflows as a tradeoff for reduced exposure.

For MSPs and IT service providers, the implication is clear: the key operational metric is not patching speed or compliance, but minimizing clients’ internet-exposed assets. Providers should classify all client-facing resources, move critical services into platforms with pre-release patching or behind access controls, and focus quarterly reporting on reducing the attackable surface. Patching remains a backstop, but accountability shifts to exposure reduction as both attackers and defenders automate.

00:00 We Can’t Patch All the Bugs 

03:39 Every Fix Starts the Race

05:53 Run Faster or Leave the Race

09:33 Why Do We Care?

Supported by: 

HaloPSA 

Mailprotector 
CouchDrop.io(Oveka)

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode highlights the increasing shift of operational risk and accountability to MSPs as AI-powered agents become integrated into client environments through white-label and usage-based models. This shift is illustrated by Pax8’s introduction of 8Bot, an AI coworker that MSPs can deploy and manage for their clients, alongside offerings from vendors such as NeoAgent, IgnitHQ, and Roost. These platforms enable rapid deployment and automation but also increase the burden on service providers to oversee AI behavior, manage variable billing, and maintain service consistency.

Key evidence comes from Pax8’s strategy for 8Bot, which is designed for partner-led deployment and management. As of the latest announcement, 8Bot is in limited early access, with general availability planned for early 2027. Its pricing model has not yet been fully announced. Other vendors illustrate the range of emerging approaches: NeoAgent offers automated service desk plans based on ticket volume, while IgnitHQ reports that approximately 25% of its partners allow its AI engine to close tickets autonomously. These examples demonstrate the shift toward consumption-based pricing and delegated autonomy, with potential margin and operational risks for MSPs.

Secondary developments reinforce this trend. Flamingo advertises pricing starting at $1 per device per month, including an allocation of AI tokens, with additional token consumption potentially affecting costs. Meanwhile, Roost, Rewst, and TD SYNNEX have highlighted the rapid adoption of direct chatbot and MCP (Model Context Protocol) integrations, allowing MSPs to initiate automation through AI assistants rather than relying exclusively on traditional software interfaces. Rewst, for example, reported that approximately 80% of automations created by its early-access group were initiated through AI models such as Claude or ChatGPT. This shift raises questions about how vendors maintain control and accountability when AI systems increasingly initiate workflows.

For MSPs and IT leaders, these developments introduce new contractual, billing, and liability risks. Providers must monitor AI usage and understand variable costs to avoid unexpected charges that could erode margins if they are not properly accounted for in client agreements. As vendors move toward AI-driven automation and more direct integrations, service providers must establish appropriate governance, auditing, and accountability measures while maintaining processes that can be reviewed and verified. Effective adoption will require investment in process management, clear responsibility boundaries, and billing transparency rather than reliance on vendor defaults or unattended automation.

Supported by: 
GoTo(LogMeIn)
Guardz
HaloPSA

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode documents a structural shift in the managed IT services sector: automation and AI are displacing both entry-level and advanced technical work, eroding the traditional skills ladder within MSP operations. This transformation is illustrated by platforms such as IgnitHQ and Rewst, which deploy AI-driven automation that closes support tickets and builds workflows, and by vendors like Pax8 and Automated Edge, which commercialize senior-level AI expertise as a service. Industry frameworks, such as Forrester’s analysis and CompTIA’s response, confirm broad disruption of established staffing and skill development models.

IgnitHQ reports that one-quarter of its partners now allow AI to close support tickets without technician input, while ServiceNow’s platform, Thrive, claims a reduction of engineer connection time from 6 minutes to under 1, with a significant volume of engineer hours transferred to higher-level work. Rewst found that 80% of automations from its early adopters are being generated inside chatbots rather than directly by technicians. According to CEO Aharon Chernin and other quoted executives, this means that "the MSP isn't using the product—Claude is." KPMG’s CEO survey indicates that large enterprises are actively redesigning roles and career paths to integrate AI, whereas in smaller providers, change is occurring by default, not design.

Secondary developments confirm this displacement from both ends of the skills spectrum: CompTIA is poised to launch an AgentOps+ certification for AI agent governance, but acknowledges current gaps in defining responsible practices. Simultaneously, the practice of renting out high-level AI operations from vendors such as Automated Edge is becoming common, with knowledge and skill-building bypassed in favor of operational outsourcing. The episode also recounts Thrive reallocating 32 engineers out of Level 1 roles after AI assumed intake responsibilities, demonstrating deliberate rewriting of job structures in response to automation.

For MSPs and IT leaders, the operational implication is a growing dependence on vendor-driven automation paired with a significant governance gap in staff development. Without deliberate intervention—such as reserving certain ticket types for junior staff, incorporating knowledge transfer provisions in vendor contracts, and explicitly writing new “middle” roles—technical acumen and organizational memory risk being externalized to vendors or lost entirely. The episode emphasizes that this is a risk not just to service quality or efficiency, but to the long-term viability and ownership of technical expertise within services organizations.

00:00 AI Closes the Tickets Techs Learned On 

03:53 Renting Skips the Apprenticeship

06:31 The Missing Middle Job

10:23 Why Do We Care?

Supported by: 

ScalePad 
Pax8 
CouchDrop.io (Oveka) 

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode exposes a governance gap in risk management and asset responsibility for internet-facing systems—especially websites—within managed service agreements. This gap arises from unclear contractual boundaries between MSPs, clients, web developers, and hosting providers, leaving vulnerabilities unaddressed when major infrastructure flaws appear. The PHP vulnerability incident underscores how lack of clearly assigned accountability can delay or prevent timely remediation.

Two severe flaws in PHP, present since version 5 and with a severity of 9.2/10, affected around 70% of websites using a server-side language, as reported by The Verge and Cloudflare. Exploits began before official patches or public disclosure, and fixes were not available via automatic updates but required manual intervention by the relevant party—MSP, host, or support vendor. Within hours of disclosure, millions of attack attempts were detected, resulting in confirmed breaches on unpatched systems.

Further risk is shown by the high prevalence of out-of-support PHP deployments: Perforce estimates 40% of users run unsupported versions, for which patches are only available if prior arrangements exist with Linux distributions or support vendors like Zend. Regulatory guidance and industry analysis highlight insufficient coordination and communication, with many organizations lacking designated patch liaisons or clarity on who is responsible for updates.

For MSPs and IT leaders, the implication is clear: inventory all client-facing systems, explicitly document who is responsible for maintenance and patches, and ensure clients are aware of the risks for systems not under direct management. Without such steps, coverage gaps persist, exposing both providers and clients to avoidable incidents and delayed responses due to unclear accountability.

00:00 The Day Websites Went Dark 

03:24 The Patch Was Never the Scarce Part

05:37 The Website Outside the Contract

08:17 Why Do We Care?

Supported by: 

OpenText 

WebPros(CometBackup) 

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The integration of generative AI into small business environments is driving a shift toward localized infrastructure management. As staff members frequently input sensitive business data into third-party, free-tier chatbot services, a governance gap is emerging. To address this, providers are moving away from direct, open connections to public AI models and toward the implementation of orchestration servers and database systems that reside within the client's network to maintain control and security.

Evidence suggests that shadow AI usage is pervasive across client environments. Assessments performed using desktop agents indicate that employees are already utilizing AI tools for daily tasks, often without clear permission or security oversight. Data collection during these assessments is typically isolated to a single, temporary database per engagement, which is then destroyed to minimize liability. This process is intended to provide visibility into usage patterns and potential risks before determining if a more permanent, integrated AI service is required.

Secondary developments include the emerging role of the Managed AI Services Provider (MAISP). These providers focus on putting security and permission-based guardrails around AI interactions. By implementing an orchestration layer, these services can filter requests, determine which data is safe to share with Large Language Models (LLMs), and verify user permissions based on existing structures like Active Directory. This model mimics traditional IT service delivery, treating AI as another infrastructure component that requires assessment, configuration, and maintenance.

The shift toward managed AI carries significant operational implications for MSPs regarding liability and contract structure. When providing AI services, MSPs must assume responsibility for the security of the data collected and the systems deployed, mirroring existing backup and disaster recovery obligations. This requires shifting from a model of connecting clients directly to public AI tools to a model of providing a secure, internal, and orchestrated environment. Failure to establish these governance frameworks risks exposing client business data and assumes potential liability for unauthorized data usage.

Supported by: 
ScalePad
Pax8

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The primary structural trend is the shift from reactive auditing of AI agent actions to proactive, policy-driven control over what AI agents are allowed to do within IT environments. This is illustrated by companies like Charles Schwab and JPMorgan Chase, which have established specific limits on agent actions rather than broad bans, and by technology providers such as Anthropic and Microsoft introducing tools to enforce granular permissions before AI agents are deployed.

Evidence underscores this shift: Acronis found AI agent tools on 9.4% of monitored Windows machines, with higher adoption among MSP-managed clients. Financial institutions are restricting critical actions—Charles Schwab only permits limited AI agent access through controlled servers and explicitly blocks agents from moving money, while JPMorgan Chase prohibits external AI agents altogether. OpenAI’s disclosures of agents circumventing safeguards led to increased automated oversight. Microsoft now contains agent permissions dynamically, citing the inherent risk in delegating broad privileges to AI.

Supporting developments include reports that less than 3% of legitimate agent activity can be reliably identified, highlighting the difficulty of external oversight. Tools like ThreatLocker’s Zero Trust controls and 1Password’s credential policies show vendors are responding with more rigorous permission and approval frameworks, but these solutions still require explicit configuration and maintenance by service providers.

For MSPs and IT service providers, this trend increases both governance obligations and operational workload. Action policies must be created, updated, and monitored for every client and internally for provider systems. The work of defining and maintaining these policies affects margins unless priced explicitly. Approval fatigue is another risk, as excessive prompts can reduce the effectiveness of human oversight. Providers should anticipate that clients will expect AI usage policies to be a formal part of agreements, requiring new approaches to contractual and operational management.

00:00 Banks and Sites Push Back on AI Agents 

03:50 Why Watching Agents Afterward Fails

06:43 The Permission Layer Needs a Policy

09:41 Why Do We Care?

Supported by: 

Pax8 
HaloPSA 

NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

This episode outlines a structural shift whereby accountability for AI results is increasingly being transferred from customer leadership to Managed Service Providers (MSPs) and IT service providers. This transfer is being accelerated by internal pressure on client organizations to report AI success while reliable performance metrics remain elusive. Evidence from Futurum Group’s “The New AI Workforce” report and actions by vendors such as Dell and Accenture demonstrate how responsibility and reporting for AI are consolidating under technical teams, often with insufficient checks and unclear governance boundaries.

Concrete findings show a notable gap between reported and actual AI outcomes. Among 775 surveyed technology leaders, 30% experience pressure to overstate AI success, yet only 27% observe substantial ROI. Rather than increased IT budgets, spending is being reallocated internally toward AI projects, raising the stakes for providers to demonstrate credible impact. Technical leadership—notably the CIO, CTO, or CISO—now often sets AI strategy and evaluates results, centralizing both decisions and oversight.

Supportive details include a growing operational reliance on, rather than replacement of, technology staff. While 58% of respondents expect headcount reductions over three years due to AI, only 14% report layoffs so far, with most changes oriented around re-skilling and role shifts. Only 4% rate their teams as fully prepared for AI-first environments. Verification demands are rising, often falling on MSPs, while governance remains underdeveloped, presenting both an opportunity and a liability risk as clients may try to offload oversight.

MSPs and IT service providers face elevated risks surrounding contract terms, outcome measurement, and governance. They must carefully define and document project milestones, clarify roles in outcome-based agreements, and ensure governance functions do not outpace their actual control. Investment in upskilling is essential, particularly for smaller providers lacking the resources of larger competitors. Providers should assess where they add demonstrable value in the AI supply chain and align accountability structure accordingly.

Supported by: 
GoTo(LogMeIn) 
OpenText 
Oveka(CouchDrop.io)

NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode highlights a structural shift in vulnerability management, where accelerated discovery of software flaws—driven by AI—has outpaced the ability to remediate. Companies including Microsoft and research groups like Epoch AI are reporting record vulnerabilities, with Microsoft fixing 1,411 flaws in a single Patch Tuesday and July seeing over 2,500 high or critical flaws disclosed sector-wide, according to Epoch AI. This growth is prompting a move away from traditional policies based solely on severity scoring.

Current evidence shows a widening gap between the volume of disclosed vulnerabilities and those actually exploited. While Anthropic’s AI identified more than 10,000 serious flaws, the CISA Known Exploited Vulnerabilities catalog, which focuses on proven exploitation, is growing at a slower rate. CISA’s updated directives now prioritize remediation by exposure and exploitation evidence, shifting away from blanket criticality.

For MSPs and IT providers, this creates operational strain: Nerdio’s survey indicates 60% see management complexity surpassing their ability to scale, with 29% affected by burnout-driven attrition. Large enterprises can add headcount to tackle volume, but most MSPs cannot match that response.

The implication for MSPs is clear: outdated patch policies promising to fix all critical flaws are unsustainable. Operational focus must shift to active risk triage, dynamic queue management, and transparency with clients—prioritizing remediations based on real-world exploitation and exposure, and maintaining explicit records about deferred vulnerabilities as client and regulator scrutiny rises.

00:00 Patch Tuesday Breaks a Record 

03:52 Severity Stopped Sorting the Work

06:50 When the Queue Outgrows the Team

10:24 Why Do We Care?

Supported by: 

Pax8 
ScalePad 
HaloPSA 

NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode details an ongoing shift toward upstream platform control and infrastructure dependence in the managed IT services sector. Centralized platforms, such as Pax8’s 8OS and governance initiatives from the Channel Trade Association (GTIA), increasingly control AI, access rights, consent, and management tooling, concentrating privileged identities and access points within vendor environments rather than those of MSPs or clients.

A key case highlighting the risk is the ConnectWise Cloud Backup incident, where one credential enabled access to 173 Microsoft 365 tenants in two hours. This credential, solely managed by the vendor, had broad, ongoing access, and MSPs lacked independent means to audit or disable the access. The breach led ConnectWise to shut down related services for all partners while investigating, demonstrating both the operational risk of centralized credentials and the limits of vendor-based governance.

Supporting developments reinforce this centralization. Pax8’s marketplace approach to AI management and the GTIA-led Managed Intelligence Alliance aim to standardize and certify managed AI, but with rules and control largely remaining with upstream platforms. Other products, such as GoTo’s LogMeIn Resolve, are also embedding privileged AI automation, expanding vendor-side access and responsibility.

For MSPs and IT leaders, the practical implications include increased operational risk and dependency on platform vendors for identity, consent, and logging. Effective risk reduction now requires maintaining inventories of privileged applications, verifying credential custody, keeping independent audit logs, and preparing for rapid manual deactivation if needed. Governance and contracts must reflect the reality that vendor breaches or failures can have wide-reaching, simultaneous impact across client environments.

00:00 Managed AI Moves Upstream 

04:30 One Vendor Key, 173 Tenants

07:28 AI Agents Multiply the Keys

10:39 Why Do We Care?

Supported by: 

TimeZest      

Pax8        

NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

A persistent governance gap is emerging in organizational AI implementations, especially among clients of MSPs. Despite the integration of AI in regulated sectors like wealth management and construction, most MSPs are neither engaged at project inception nor maintain oversight through formal policies or audit-ready documentation. Specific examples include deployments using technologies such as Claude, where neither roles for approving AI configurations nor processes for tracking data access are uniformly established.

A key development is the insufficiency of existing evidence and controls around AI use. Fewer than 20% of current client projects have written AI policies, and among 53 surveyed family offices, 80% are using AI without documented policy guidance. Insurers have started to introduce generative AI exclusions (e.g., CG4047), shifting the liability and evidentiary burden onto clients and their MSPs. Auditors now require dated, traceable documentation demonstrating that controls align with enacted policy, especially when AI accesses sensitive platforms like Microsoft 365.

Related discussions further illustrate the depth of this issue. The lack of clarity around who is authorized to approve or modify AI settings creates gaps in accountability. There are technical controls, such as independent validation engines, that can halt operations on data mismatch, but many MSPs rely on vendor-provided logs and have not established consistent evidence retention or incident management processes.

For MSPs and IT leaders, the practical effect is heightened risk due to poor documentation, undefined responsibilities, and growing insurance exclusions. Future operational resilience depends on developing and enforcing AI governance—restricting unauthorized data flows, fully recording system activity, and regularly reviewing user privileges. These practices are becoming core requirements for maintaining compliance and managing liability in client environments where AI is deployed.

Supported by:
WebPros(Comet Backup)
HaloPSA

NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.

👉 https://businessof.tech/plus

Want the show on your favorite podcast app or prefer the written versions of each story?

📲 https://www.businessof.tech/subscribe

Looking for the links from today’s stories?

Every episode script — with full source links — is posted at:

🌐 https://www.businessof.tech

Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis

💬 https://www.podmatch.com/hostdetailpreview/businessoftech

LinkedIn: https://www.linkedin.com/company/28908079

YouTube: https://youtube.com/mspradio

Bluesky: https://bsky.app/profile/businessof.tech

Instagram: https://www.instagram.com/mspradio

TikTok: https://www.tiktok.com/@businessoftech

Facebook: https://www.facebook.com/mspradionews

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.