Faraz Siraj, vice president of global channels and alliances at Fortra, joins the podcast to talk about what it looks like to build a channel program around a cybersecurity platform assembled through more than 20 acquisitions – and why MSPs should be paying attention now.

Fortra’s portfolio spans offensive security tools like Cobalt Strike and Core Impact, data protection through Digital Guardian, and security awareness training via Terra Nova Security. It’s a wide footprint, and as Faraz acknowledges, many partners still know the acquired brands without realizing they’re all under one roof. The Fortra Protect partner program, launched in 2025 with guaranteed margins and a single FortraOne partner agreement, is the company’s answer to the fragmented discount structures and multiple contracts that came with all that M&A.

The conversation also digs into Fortra’s recent decision to sell its Alert Logic managed detection and response services to LevelBlue – a deliberate move to position the company as a software provider, not a services competitor to its own partners. Faraz is candid about where offensive security capabilities realistically fit into an MSP’s stack and where they don’t, and offers a practical on-ramp for Canadian partners through Fortra’s acquisitions of Ottawa-based Titus and Montreal-based Terra Nova.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show.

If I say the name Fortra, there’s a decent chance you might not immediately place it. But if I say Cobalt Strike, or Digital Guardian, or Alert Logic, or Titus, especially if you’re in Ottawa, those might ring a bell.

Fortra is the company that’s been quietly acquiring cybersecurity companies for the better part of a decade. More than 20 acquisitions in all, and now they’re trying to stitch it all together into a unified platform, pointed squarely at MSPs and MSSPs.

What makes this story interesting right now is they’ve recently made some moves that signal where they think they fit into the ecosystem. They sold off their Alert Logic managed services business to LevelBlue, which is a pretty clear statement. We make software, we’re not going to compete with you on service delivery. And they’ve rolled out a new partner program called Fortra Protect with guaranteed margins and a single partner agreement that covers the whole portfolio.

My guest today is Faraz Siraj, Fortra’s Vice President of Global Channels and Alliances, and I wanted to talk to you about what it looks like to build a channel program around a platform that was assembled through acquisition, how MSPs should think about the balance between offensive and defensive security capabilities, and whether there’s a Canadian go-to-market story here.

Let’s get right into it. My chat with Faraz Siraj.

Faraz, thanks for taking the time. I appreciate it.

Faraz Siraj: Great to be here.

Robert Dutt: Fortra has been built through a bunch of acquisitions. 20+, 25+ I think? For MSPs who know Cobalt Strike or Digital Guardian but don’t necessarily know the umbrella brand of Fortra, what’s the pitch for why they should think of you guys as a platform rather than sort of a collection of tools?

Faraz Siraj: Great question. Well, all of these products that we acquired over a, I’d say, a five-year period, it was around a little over 20 companies, we are going to platformization, and all of these will be available via the platform. And the platform provides a variety of tools to manage, and so MSPs would probably want to welcome that opportunity to utilize a single platform with multi-tenancy to help manage those solutions for their customers. It’s just a natural fit, and rather than having multi-screens, multiple interfaces to be able to provide those types of managed services, so it’s a very, very powerful way of bringing it all together.

Robert Dutt: For that MSP market, you guys sold off Alert Logic’s managed services business to LevelBlue a couple of months ago. What does that signal to MSPs about where you see Fortra sitting in the ecosystem moving forward, in terms of trying to be a technology brand behind the MSP?

Faraz Siraj: Well, that’s a perfect fit. I think we realized that the managed service business is not really what our strong suit is. And we aligned our Alert Logic business with a suitor that can take full advantage of that kind of business, and they’re very good at it. We, over time, realized that if you want to do that business, you have to really focus in on it, whereas we had other priorities.

And so what that tells the market and other partners out there is that we need our partners to be able to provide those managed solutions. We truly are in the business of making and providing software. We do not want to be in the services game. We want to have our partners provide those services, whether it is managed services or whether it’s installation services, optimization services delivery, we need our partners to do that.

And that’s what creates opportunity. And that’s what I’m really excited about with our platform play, as well as where our future direction is as a company around the products that we provide.

Robert Dutt: One of the most interesting things I think you guys talk about is the idea of MSPs balancing offense and defense. And I guess I want to dig into what that actually looks like in terms of the service delivery level. Where does offensive insight realistically show up in the day-to-day stack for an MSP?

Faraz Siraj: Well, it shows up everywhere, whether you realize or not. It is in whether it is vulnerability management, it’s in offensive security tooling, it is in pen testing, it is in simulations. That takes some knowledge and ability to provide those services around those capabilities. And that’s just from an offensive side. There is a need for support for those particular product sets. On the defensive side, it’s pretty simple. I mean, we have a lot of those defensive protection products, and we need our partners to be able to provide solutions around it.

Robert Dutt: Yeah, and MSPs, most I would dare say at this point, are defensive operators by nature. Prevent, detect, respond, deal with the problem. What can MSPs realistically do with offensive capabilities, and where should they not be trying to operationalize offensive capabilities in their stack?

Faraz Siraj: Well, the first thing that I would tell them is be comfortable with what you’re providing. Be comfortable with your capabilities that you can go to your market with, with your customers. If you don’t know it, you can certainly learn, but you don’t want to try to pigeonhole yourself into a technology that you’re unfamiliar with.

We can help with that. We have a lot of training. We have a lot of classes available through our Fortra Academy that can help them, and we have onboarding that we can help partners with. Again, it would be, I would think about the customer and work backwards. You would want to qualify the customer and qualify their needs. And if offensive security is something that is a pain point for your customer, then investigate it. And sometimes it’s not. And if it’s not needed, why would you want to venture and invest in an area that you’re unfamiliar with? Now I’d love for all of them to do it, but I’m an honest person. Sometimes it doesn’t make the right business sense.

Robert Dutt: You guys acquired Red Macros Factory to enhance Outflank Security Tooling. Cobalt Strike is used by red teams worldwide, but it’s also used by threat actors who are probably using cracked copies. That led Fortra and Microsoft to take joint legal action in the past. How do you talk to partners about selling offensive tools when some of those tools have been weaponized against their customers?

Faraz Siraj: It’s a discussion point. It’s also sort of a proof of concept in a twisted sort of way. Well, we do not support any illegal use of our products. We do not support using it for the wrong reasons, so to speak. We have strict legal language on it and we have gone to legal with Microsoft about those kinds of things, because we have strict requirements of how you’re going to utilize this tool.

If we find out that you’re using it for the wrong reasons, weaponization, we cut it off. And that’s part of the qualification. And that’s also part of the execution and inspection that we look at. These are very powerful tools and they are not for that purpose.

And just as another example is when we provide NFR gear, it’s meant for testing purposes and lab gear. You cannot be utilizing it to provide protection from as a customer standpoint, even though it’s not the same completely. It’s similar. And we just, we have to be very transparent and upfront about what these tools are about and how they’re supposed to be used.

Robert Dutt: Let’s talk about the program and what you guys are doing there. You’ve introduced guaranteed margins with Fortra Protect and the FortraOne agreement. What problem were you specifically trying to solve with that model and what was sort of the problem with how partners were engaging with Fortra before?

Faraz Siraj: Yeah, there’s several problems that we were addressing and yet we came to an innovative way on how to address it. So let’s look at a little history. When you acquire so many companies, your discount structure is all over the place. In Fortra transparency, we had discounts that were in the low 20s and going way north into the higher discounts.

And when partners want to work with you, they expect a certain discount table for all products. And when you’re all over the map, you can’t really do that. Additionally, we wanted to encourage our partners to look at the entire portfolio and be encouraged by representing all Fortra. We had different agreements and we had different programs by product lines and we needed to bring it all together.

And so as I joined, we did the FortraOne agreement, which brings everything into one unified legal agreement to be able to represent our products. And that’s the easy part. Second, we wanted to provide incentives to our partners to represent not only the products they’re familiar with, but all the other products that we had. And guaranteed margin was the best way to do it.

Now there’s no guesswork on partner profitability. You know what you’re going to be making. And when you know that upfront, you can now focus in on the real problem at hand is providing customer solutions. We can work on it jointly. I can tell you I’ve been in the industry long enough where I continuously talk to partners and their pain points are around profitability and the unknown. Working deals and then being squeezed or not knowing what they’re going to make until the very end. And you’ve spent all this time working on these solutions and then you are not going to kind of have that profitability that you want. That’s a big deal. And we took the guesswork out of it. And now let’s focus on the customer, which is quite from what I hear the most important thing.

Robert Dutt: I’ve heard the same thing, believe it or not. What do you see as sort of the, as you’re looking at the platform structure and trying to make it easier and more smooth for partners to sell across that, what are kind of the one or two top entry points for partners? And what do you see as sort of the next adjacencies that partners naturally gravitate towards as they get to know what all you guys are doing and get comfortable with the model?

Faraz Siraj: Yeah, I think the best entry point would be around data protection. And we offer so many varieties of security solutions, but the best way is around data protection. And let’s face it, data has been exploding and will continue to explode. There is a fun new variable out there called AI that is in the forefront of everybody’s minds. And it’s being utilized for the right reasons and the wrong reasons.

And whatever your case is, you need to protect your data with however which way it’s exposed. And so we have data protection solutions that will be enhanced by AI, but also will protect against AI because your data is the most valuable commodity that you have as a company. And so with our data protection, such as our DLP solutions, our data classification solutions, DSPM, that’s a great entry point. And then you can expand from there with the use of the platform. But that’s what I highly recommend for partners that are just getting into this.

Robert Dutt: You joined Fortra in late 2024, and this is being described as kind of the company’s first dedicated channel push. For Canadian MSPs who aren’t in the ecosystem currently, what’s the realistic on-ramp for working with you guys? And I’m curious where you’re at in the Canadian market in terms of is there a distribution and go-to-market story here, or is it sort of primarily still being built around the US model?

Faraz Siraj: No, it’s a true North American model. By the way, we acquired a few Canadian companies, and we have several Canadian MSPs already that we work with. We are always looking to expand within the Canadian market.

Companies that we acquired that are well-known in Canada, such as Terra Nova and Titus. Terra Nova out of Montreal. Titus was out of, I believe, Ottawa. Terra Nova, by the way, human risk management or security awareness training, if you want to call it, is an MSP’s dream. It can be branded by a partner, and it can be run as if it were the partner’s business. And we actually go to market heavily with a lot of Canadian companies for that particular product line.

If you ever wanted the easy button to get involved with Fortra, it would really be the Terra Nova product, human risk management, because everybody needs security awareness training. I go through it every six months at Fortra ourselves. I’m a user on product, but you need to have that refresher, because in the simplest forms, we are exposed to crazy stuff that comes to us, and you need to be trained on it.

So that’s where I would go from a market perspective, but we love our Canadian companies, and we’ll continue to operate that way.

Robert Dutt: It sounds like you’re open to adding additional MSPs, obviously. What do you find are some of the common threads among successful Fortra MSPs?

Faraz Siraj: It really is around providing good customer joint solutions. We obviously want to be in the software business, but we also want to be with partners that align to that software as well as providing the customer satisfaction. And so the ones that do it well are the ones that are able to bolt onto their services on top of the solution and do it well. And we’re not hearing about issues. In fact, the successful ones are the ones that are expanding those solutions and going into more and more customers.

The other piece of it is being able to be creative with billing for the partner so that it entices them to go out and obviously have partner profitability.

Robert Dutt: If an MSP is listening to this and they’re doing the standard defensive stack – EDR, SIEM, firewall – but they’ve never really offered anything on the offensive side, what’s the first conversation they should be having with customers? And how do they avoid turning offense into, you know, the once-a-year pentest PDF and call it a day kind of thing?

Faraz Siraj: Yeah, well, it really goes back to understanding the customer. Now, it starts with, yes, pen testing is very important, but it’s not just once a year. Given today’s threat landscape, you need to do that a lot more often.

Vulnerability management, those are the two major entry points. We built our vulnerability management tool from a mixture of six different technologies from six different companies, and we fused it together to make our own Fortra vulnerability management tool. Such companies like Tripwire, Digital Defense, Beyond Security, even a little bit of Alert Logic that was in there and there’s a couple others that I’m forgetting, but when you’re able to do that, it makes for a great value product.

Robert Dutt: Interesting conversation. I appreciate the colour around the partner program and I appreciate the idea of adding offensive capabilities to the MSP stack. I think that’ll be an interesting space to watch. Faraz, thank you very much for joining us.

Faraz Siraj: Oh, you bet. Thank you, Robert.

Robert Dutt: There you have it, Faraz Siraj from Fortra. I’d like to thank Faraz for his time. I appreciated his candor, especially on the managed services exit and the reality of what MSPs should and shouldn’t try to take on when it comes to offensive security.

Thank you for listening today. A couple things that stuck with me from this conversation. First, the Alert Logic move. When a vendor sells off their managed services business and tells you straight up, we’re in the business of making software and not competing with you on services, that’s worth paying attention to. Doesn’t guarantee anything, but it’s the right signal. And in a market where MSPs are constantly wondering which vendors are going to show up as competitors, it matters.

Second, the platform story. 20-plus acquisitions is a lot of integration work. And I think the jury’s still out on how seamless that experience actually is for partners day to day. But the FortraOne agreement and the guaranteed margin model suggest they’re at least thinking about the partner experience at the business level, not just the technology level.

And for Canadian MSPs specifically, the Terra Nova and Titus acquisitions mean there’s a local footprint here that a lot of people might not realize.

If you’re not subscribed to the ChannelBuzz.ca podcast, now’s a great time. You can find us on Apple Podcasts, Spotify, YouTube, and most podcast directories. If you’re finding value in these conversations, a rating or review goes a long way.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

1Password is a company many Canadian partners know, but the Toronto-based firm has evolved well beyond the password vault it’s historically been associated with. Now positioning itself as an Extended Access Management platform, 1Password recently expanded its global partner program, won the 2025 AWS Canada Rising Star Technology Partner of the Year award, and was named to CRN’s 2026 Security 100 list. The company counts more than 180,000 business customers, with over 75 per cent of its revenue now coming from the enterprise side.

Larissa Crandall, 1Password’s global vice president of channel and alliances, joins us to talk about what that evolution means for MSPs looking to build identity security practices. Crandall talks openly about the need to “myth bust” how partners think about 1Password, pointing to strategic integrations with CrowdStrike and Zscaler and the company’s growing presence in AI labs and enterprise security stacks as evidence of the shift.

The numbers that emerge are striking. Non-human identities – AI agents, service accounts, API keys – now outnumber human identities 82 to 1, according to Crandall, and SMBs remain largely unprepared for the challenge. That’s the gap MSPs can step into. She shares the story of an MSP that made 1Password mandatory across its entire customer base – not as an add-on, but as a baseline requirement – because you can’t credibly sell identity security if you haven’t secured the front door yourself.

On building a profitable practice, Crandall identifies three keys: proper discovery, understanding scope and complexity, and having the right skill sets on your own team before delivering it to clients.

Partners interested in learning more can visit the 1Password partner program page.

Robert Dutt: Hello and welcome to In the Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and as always, your host for the show.

If you’ve been following the cybersecurity conversation this year, you’ve probably noticed that identity keeps coming up – not as one item on the security checklist, but increasingly as the item.

The attack surface is shifting. SaaS sprawl, shadow AI, and a growing universe of non-human identities – things like AI agents, service accounts, and API keys – are creating access governance challenges that traditional security tools were never designed to handle. And for MSPs, that shift represents both a risk and an opportunity to build a real practice around identity security.

1Password is a company that a lot of us know, but the Toronto-based company has evolved beyond the password vault that many partners may remember. It’s now positioning itself as an Extended Access Management platform, recently expanded its global partner program, and counts more than 180,000 businesses among its customers.

Joining me today to talk about what that evolution means for the channel is Larissa Crandall, global vice president of channel and alliances at 1Password. We’re going to dig into why identity has become the front door to the security conversation, what MSPs need to understand about non-human identities before their customers start asking, and what building a profitable identity security practice actually looks like.

Larissa, thanks for taking the time. I appreciate it.

Larissa Crandall: Thank you so much for having me. Excited for a conversation.

Robert Dutt: We keep hearing that identity is the new security perimeter. For a lot of MSPs, the bread and butter is still firewall, endpoint, some MFA. Can you help me with what’s changing in the threat landscape that makes identity security an urgent, a “build a practice around it right now” kind of opportunity?

Larissa Crandall: Yeah, absolutely. AI is here to stay. I think the opportunity for MSPs is now. It’s prevalent. We’re seeing a lot of MSPs build practices around identity security, and those are the ones that are getting ahead of it, are leading the charge. I think for us personally, spending a lot of time with MSPs, the attack surface has changed. It’s no longer about human, it’s about non-human identities, and it spans across SaaS applications, endpoints, APIs, service accounts, and AI agents. All of the MSPs that are getting ahead of it are helping our customers and growing.

Robert Dutt: You guys have been around for 20 years now or so. I think for a lot of folks, the on-ramp, the familiar place is the personal password vault, of course. Some partners certainly are selling you alongside other tools, are working you into the mix. What would surprise a partner who hasn’t looked closely at 1Password in the last couple of years about where you guys are at right now?

Larissa Crandall: Love this question, because I’ve been talking to a lot of partners. As we’ve built out the partner program that we just launched and going to truly partner first, we have to – what I call – myth bust. A lot of how people perceived us is just traditional EPM, the Enterprise Password Manager business, into this true solution that’s attached to everything that they’re already selling. For instance, we have large integrations with CrowdStrike and Zscaler, and that’s getting the attention of some of the partners out there not realizing that we fit into that full conversation and that tech stack as a platform play, versus thinking of us traditionally just on that human-centric credential management play. We’ve definitely flipped the script, I would say, on having sellers think of us different. MSPs – we also have a lot that we’re doing with AWS, and that has changed some of the landscape for us here, is positioning that full technology solution.

Robert Dutt: You touch on partner first on the program launch. Can you walk me through what partner first means from a 1Password point of view at this point and the highlights there in terms of what it means to your partner base or your prospective partner base?

Larissa Crandall: Sure, absolutely. We built what I call a customer-centric partner strategy. What that means to us internally – and as I’ve shared this with our partner ecosystem – is however a customer wants to transact with us. Via AWS Marketplace, whether they want to work with us with a partner through Marketplace, if they want to work with their traditional reseller and VAR partners out there. We have obviously SMB customers, a lot around working with their MSPs. We have that all taken care of, where we have prescriptive partners across the globe as well as working with our distribution partners. What that means for us internally is we have worked through an entire strategy top-down. It goes from our executives all the way through our sellers that they’re to engage partners. Now it could be an existing account that we have that we’re wanting to bring a partner into. We’re also spending a lot of time with partners, both new and existing, teaching them the 1Password story and teaching them how we fit in what they’re selling today and what the opportunity is. Increased enablement, certifications, all of that. Again, it goes back to what I would say is that myth bust of how you think of us and what we’re doing, versus how we’re getting a lot of attention from partners that have talked with us previous but are seeing us different, talking about putting us in their AI labs and their security practices and a full wrapper into platform.

Robert Dutt: That’s two fronts of myth busting, or developing the stories to partners. Where would you say you’re at in getting that out there, broadly disseminated and well understood on both of those fronts?

Larissa Crandall: It’s a daily, right? I think it’s a daily spend. I spent this morning talking to two partners and they were both new. They were in a region that we have not spoken to before, and it was newer partners wanting to learn more because they’re hearing the market demand and they’re having customers call about 1Password and identity security. That has flipped as well, where identity security is no longer a “it’s a nice” – it’s needed. Same thing across MSPs. They’re building foundational practices as well around identity security and we’re having them come to us and say, “Teach us more. How do we build this? How do we do the discovery and how do we get in front of it?” Especially around AI.

Robert Dutt: You’ve talked about something you call the Access-Trust Gap – the space between what IT can see and control versus what employees are actually using to get their work done. Can you walk us through what that looks like in a real organization and the why as to why traditional IAM tools aren’t closing that gap?

Larissa Crandall: I have an example for you that I love to use, and it’s related to an MSP that we have that shared with us how they personally worked with 1Password. It’s a mature MSP that made a deliberate decision as a company to bring in 1Password and make it mandatory for all of their customers. Not an add-on – make it mandatory for all. They did that because they wanted to ensure that security was embedded into everything they did from the start and how they interacted with customers. The reason that they did that is they wanted to make sure – if they weren’t ahead of it and they weren’t giving customers a secure way to manage their credentials, they would find their own way. That’s the problem still. There’s spreadsheets, there’s shared sticky notes. You put it in your phone. That’s never good.

This MSP shared that and said, “If we’re going to go preach this and sell 1Password, we’re going to basically do it ourselves.” If you leave it up to your own devices, employees will do it on their own and that’s the big risk. For us, that’s the big opportunity that we’re sharing with our partners to make sure that they know that – that is not the way to go. You need to make sure that you’re protecting it. You can’t begin to address that identity sprawl if you haven’t first secured the front door. When we say that to partners, we let that sink in. If you haven’t done it personally as an organization and you’re working with customers, you have to secure that front door. MSPs that are building the basics and getting ahead of it are going to nail this and be far ahead of their competition. I love that example because it’s a real life, “If I’m going to go sell it, I’m going to make sure that we’re using it ourselves.”

Robert Dutt: The new front, I think, that’s maybe catching MSPs a little bit off guard, that’s certainly building awareness, is the non-human identities side of things. You touched on AI agents a little earlier, the service accounts, the API keys – the things that need credentials but aren’t employees. How big of a governance problem is this becoming and what does it mean for an MSP who’s trying to help clients figure this out and navigate this problem?

Larissa Crandall: It’s a big problem. Non-human machines are growing every day, and a stat that we’ve been using and explaining this – just on the severity of it – with our partners, is non-human identities now outnumber human 82 to 1. Think about that. If that is the number of how much you would have to protect non-human, you can’t just think about it from that human perspective. “I log in, I do the right thing.” It’s everything that they don’t know. That gap, again, is helping customers get that visibility and control around that across human and non-human, is generally hard to replicate because you have to teach it.

That’s where, again, the partners come in and they bring that up and explain that. They’re ahead of it. What I will say, though, is SMBs are not ahead of that just yet. They’re not thinking about non-human every day, and that’s where partners can come in and being their true trusted advisor and explain that and explain the risk to their businesses. Because that’s their job – to keep businesses running – and that’s why customers go to them.

Robert Dutt: For an MSP who’s at the point of saying, “OK, I see your point. I see the opportunity around identity security. I need to build around this,” but they aren’t there yet necessarily – what does a profitable identity security practice look like? What are they selling? What services are they wrapping around it? Where do you fit into that stack?

Larissa Crandall: MSPs are all different. Obviously, they’re great about doing that first initial assessment and analyzing the infrastructure and set of tools and governance that they have. I think the first piece that we’re explaining, and we’re talking to MSPs, is just how to get started and how to build a practice around this. You first have to do that discovery. Most customers are not getting an accurate inventory of what they have. That piece, and explaining “if you do this, here’s the risk mitigation around it, this is how it could help your business.” The second piece I think that some don’t really truly understand is the scope complexity, meaning identifying the infrastructure, the dev, the security, the operations team, everybody else that’s all-encompassing around this.

I think the third is staffing. Some MSPs don’t realize, “OK, if we have this, how do we build a profitable practice?” – you need to ensure that you have the right skill set from your own teams to do that assessment up front. It’s a step-by-step, but you can’t do only one of those. Proper discovery, scope, and staffing are really key.

Robert Dutt: You guys are a Toronto-based company. For Canadian MSPs or resellers in the audience, is there anything specific about how you’re building the partner ecosystem up here in the market that they should know about, and what’s the first step that a partner should take who’s intrigued by this conversation and wants to find out more?

Larissa Crandall: Join a partner program. Obviously, I will say that. I think one of the proud moments for us right now is we launched a new partner program in February. Simplified, it did increase profitability and economics for them, and also did a complete overhaul of all the training, enablement, everything that they were asking for. It sounds simple, hard to do. We did this outside in. We spent a lot of time surveying Canadian resellers, MSPs across the world and really asking them what was needed around that. When we launched it, we had a record number of logins immediately on our partner portal in the first eight days of the program that we had seen in a while. That just goes to show that there’s just this strong pent-up demand for “Teach me and tell me more” because they’re hearing customers with some of these issues. We want to be there first and foremost and be proactive with them. Join the program. That’s what I would say. It’s very simple to start. I promise you, it’s a very profitable program. We’ll help you through and do all the onboarding and spend some time with us.

Robert Dutt: From a Canadian point of view, anything particular that you’re looking at in the market up here, as far as building the ecosystem or as far as how you view where the Canadian channel’s at with you guys?

Larissa Crandall: I’ve spent quite a bit of time there, talking to partners up there and spending some time with AWS. We spent a lot of time – we just won the Rising Star Award for Canada for the work that we’ve done in partnership with AWS. That has got a lot of press for us personally and what we’re doing and how we’re building solutions together. I would also say we have quite a bit of employees there, obviously. That’s been where we started. I would say a lot of loyal partners that have been with us through the entire journey. I would say that I’m hoping they’re pleased with all the changes and the added incentives there, and happy to talk to them.

Robert Dutt: All right, a few quick-answer lightning round type questions before we wrap up.

You touched upon this a little bit, but can you maybe elaborate? When you talk to MSPs who are doing identity security really well, what’s one thing that’s common amongst them? What’s the common thread amongst those who are doing well in this space?

Larissa Crandall: Great. I would say exactly how we started this conversation – that they have recognized that AI is here and here to stay, and the ones that have built in the forefront and done really well with enablement out to their customers around that human and non-human identity security space and explained it are crushing it. Those are the ones that we’re seeing seat count increase, seeing some of their large customers come on and do true – what I would say, we call it – wall to wall. Bring in customers that have done exactly what that mature MSP did and said, “If we’re going to go do this and preach it ourselves and sell it, we better make sure that we are doing it as a company.” We’re continually seeing that. The ones that really get that from the very beginning are the ones that are on the forefront and being proactive about it versus reactive. You have to be trusted advisors out there, especially to even the SMB community.

Robert Dutt: Finally, without naming any names if you don’t want to, what’s the worst password hygiene you have personally witnessed?

Larissa Crandall: I would say sticky notes. I would say everything that your grandparents have done, your parents have done. I think it’s one of those where we’re all guilty of – where do we put that password? Did you share it with someone? That’s the worst thing that you can do. Of course, I work here, I’m going to say it, but being a 1Password customer even before – and that’s the fun about being here. I could be in an airport, I’d have a 1Password sweatshirt on walking through and we’re this beloved brand out there because they started with us on that B2C journey and have moved and brought us through into their businesses today. It’s a great place to be.

Robert Dutt: Quite the evolution, and thanks for walking us through it, and good luck with the program rollout. Thank you so much for taking the time.

Larissa Crandall: Thank you so much, Robert. I appreciate it.

[MUSIC]

Robert Dutt: My thanks to Larissa Crandall from 1Password for that conversation.

A couple of things I want you to take away from it. First, that stat: non-human identities now outnumber human identities 82 to 1. If that number doesn’t make you rethink the scope of the identity conversation you’re having with customers, I’m not sure what will. Second, the MSP who made 1Password mandatory across their entire customer base – not as an add-on, not as an option, but as a baseline requirement for doing business. That’s the kind of conviction that turns a product into a practice. Whether 1Password is the right fit for your stack or not, the broader point stands: identity security is no longer a nice to have, and the MSPs who treat it that way are the ones building real recurring revenue around it.

Thanks for listening today. If you haven’t already, please do consider subscribing to or following the podcast in your podcast app of choice. We’re up on Apple Podcasts, Spotify, YouTube Music, iHeartRadio, and more. And if you’re old school and you like your RSS feed to be, well, an RSS feed, we got you covered too. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Joe Smolarski, CEO of WatchGuard Technologies, joins the podcast for a wide-ranging conversation about why the company believes 2026 is “the year of the cybersecurity-focused MSP” – and what that actually means beyond the tagline.

Smolarski came to WatchGuard in November after nearly a decade at Kaseya, where he served as president and COO. He’s been open about applying what he calls the “Kaseya playbook” to WatchGuard – driving down platform costs and consolidating tools to improve partner margins. In this conversation, we dig into what parts of that playbook he’s bringing, what he’s leaving behind, and why he believes WatchGuard can double MSP margins on cybersecurity.

We also explore WatchGuard’s latest threat research, which showed a 1,500% spike in unique endpoint malware, and what the company’s 2026 predictions – including the first fully autonomous AI-executed cyberattack and the extinction of crypto-ransomware – mean practically for MSPs and the customers they protect.

The conversation takes a Canadian lens as well. Smolarski discusses WatchGuard’s new partnership with Bell Cyber, the data sovereignty investments required to win that deal, and why he sees the Canadian market as ripe for its next level of MSP maturity – driven by regulation like Bill C-26 and the consolidation wave now reaching this side of the border. We also touch on WatchGuard’s 30th anniversary, what longevity means in a market full of startups and PE roll-ups, and how Vector Capital’s decades-long involvement shapes the company’s outlook.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show.

My guest this week is Joe Smolarski, the CEO of WatchGuard Technologies. Joe took the helm at WatchGuard back in November after spending nearly a decade at Kaseya, where he served as president and COO. He’s now leading a company that just celebrated its 30th anniversary, has been 100% channel-focused since day one, and is making a pretty bold claim that 2026 is the year of the cybersecurity-focused MSP.

Now, that’s the kind of line that can sound like vendor marketing if you’re not careful, so I wanted to dig into what’s actually behind it. We talked about the explosion in endpoint malware, why the shift from ransomware to pure data extortion changes the game for MSPs, what Joe is bringing from his Kaseya experience and what he’s leaving behind, and why he thinks Canadian MSPs are at a tipping point. We also get into the economics of it all – his promise to double MSP margins on cybersecurity, and how WatchGuard’s platform play is supposed to make that math work.

Let’s get right into it. My chat with Joe Smolarski.

Thanks for taking the time, I appreciate it.

Joe Smolarski: My pleasure, Rob.

Robert Dutt: Security has been one of the biggest, maybe the biggest, growth driver for MSPs for years, and your company is saying that 2026 is the year of the cybersecurity-focused MSP. Help me understand what makes this year different from the last three or four, where people have been seeing the same kind of momentum in security in the MSP space.

Joe Smolarski: Yeah, sure, Rob. I think ultimately many of the stats are clear, and they’re really eye-opening. I think no longer are MSPs having to educate and evangelize why it’s needed, because when you see eye-popping stats like the fact that cybercrime is the third largest GDP in the world behind the US and China, it’s like, holy cow, how the heck is that possible? But it’s escalated very, very quickly.

And unfortunately for SMBs, SMBs have become the focus of those attacks, and I think that’s becoming clearer and clearer every day. SMBs used to feel as though they’re not the focus, that the big guys will be the focus. But what we’ve seen – and unfortunately I have some firsthand experience – is that when cybercriminals attack the big guys, they have people come after them.

If you know my past, I served as president and COO of Kaseya for nearly a decade prior to becoming CEO at WatchGuard. And there, on July 2nd of 2021, we got attacked by Russian cybercriminals. When that occurred, within four hours I had the FBI and the White House and Department of Homeland Security and everybody else in my office, which was not very pleasant. So you get the attention when you’re a major provider, a big company. Look at Stryker right now, what they’re going through.

In that situation, within four hours, they’re all in my office. Within three weeks, we got the bad guys, and those bad guys are sitting in a federal prison right now. But that’s not the case when it comes to SMBs, and it’s a shame. I had access to a bunch of inside information within the government when we went through that, because we also hired the FBI lead as our CISO at that time. And what they say is they’re just overwhelmed. There’s no way that they could get to all of the attacks that are occurring. The big guys get attention and the small guys don’t, and that’s become prevalent.

So I think ultimately, this is the year for cybersecurity to get to that next level because the pace of attacks is picking up so much, in particular in the SMB market. We posted our bi-annual security report and showed a 1,500% increase over the last year, just in the velocity of attacks, which is scary. It’s scary for SMBs. And quite frankly, even if they have some of their own internal IT staff, they’re not going to be at the level that they require to stay protected. So they’re relying on the fantastic MSPs that are out there to get them to that next level.

I will say, I caught up with three or four large MSPs in Canada over the last week, just to prepare for this a little bit, just to get some of the latest trends directly from the MSPs themselves. And they said they still feel like Canada is a little bit behind when it comes to the US, just a little bit behind in terms of education and things like that. And certainly, small business is so prevalent in Canada, given how dispersed it is.

So they’re working on that. I know your government in Canada is working to increase regulation. I think some of the fighting back and forth with Trump and Carney has been interesting and ultimately fueling the Buy Canadian campaigns and some of that stuff. But you’ve got a lot going on. I know you’ve got a C-26 bill from an infrastructure perspective trying to be passed, just to make sure that the awareness is there for all businesses on what needs to be protected – supply chain and everything else.

But it’s a huge opportunity for the MSP market to take it to that next level, because from my perspective, Rob, you have to. What I’ve seen – and this is very, very unfair – is that when a small business even declines that next level of, say, platinum service from an MSP, they’re like, “I don’t need that. We don’t need that level of protection. We’re not willing to pay that amount.” If something negative happens, then unfortunately the MSP still gets blamed. And that’s ridiculous, but it’s the reality of the situation. So this is the year to capitalize on it. There’s enough news and information out there that supports everything. It’s an exciting year and, of course, a nervous year, because you’ve got to protect your clients and use the best technology and services to get there.

Robert Dutt: You touch on the 1,500% spike in endpoint malware in the second half. A quarter of those attacks are evading signature-based detection. At the same time, though, your team is predicting that crypto-ransomware is essentially going extinct this year as attackers say, “You know what? We’d rather just steal the data and extort you.” What does that shift mean practically for how MSPs need to think about protection and what they’ve been offering, given that ransomware has been such a driver for the last half decade or so?

Joe Smolarski: Yeah, I think ultimately you just have to make sure that you have layers of protection. To your point, lots of things get through. You could have the very best technology in the world, whether that’s WatchGuard or some of the other leading providers, and things can get through. Ultimately, that’s why you need the layers.

One of the things that you should also consider is the platform approach. There are many providers, WatchGuard being one of the leading providers in the MSP space. When you have a platform that gives you multiple layers and those layers get to be correlated together, it just increases your chances of detecting those things. You may see something on the firewall that’s not definitive evidence of something happening, but when you piece that together with what’s happening on the endpoint and you’ve got those two data points, you piece it together faster than point solutions can.

I think ultimately you need to make sure you have 24/7 SOC monitoring. Things that you didn’t think were possible – you thought you put in the best products to protect you, why do I need that, nothing should get through. You just threw the stats out there that things do get through. The only way to stop that is to catch those anomalies at one of the respective layers. If you’re at 99.9999%, you’ll get it at the product level. But what gets through – and with the velocity of attacks that is there – you’ve got to make sure you’ve got AI-based SOC solutions and MDR solutions backed up by great security professionals to ensure you’re protected.

Robert Dutt: On the AI tip, you guys have predicted the first fully autonomous, end-to-end executed-by-AI cyberattack this year. That’s a big call. What would that look like? And how do I, as a mid-market MSP, even begin to prepare for something like that?

Joe Smolarski: Number one, it should scare the heck out of us. It scares me. It certainly scares me, Rob. It’s a world that is evolving very quickly.

I think AI in and of itself – there are some anomalies. I’ve done a few interviews where I’ve said half of AI is bullcrap. Because so many people claim AI and everybody’s taking credit for it. Some of it’s real, some of it’s not. But what’s very real is the rate of acceleration of technological advancement, both for the good guys and unfortunately for the bad guys.

So I think you can’t fight AI attacks with human-based people. You need to fight AI with AI. There’s no way, from a rate of defense, pace of defense, that you can fight that with just good security professionals. You want to make sure, as the complexities of these attacks, the velocity of these attacks – because it is AI-based – continues to accelerate at an unprecedented pace, that you’re fighting that with AI-based solutions. Because it can match the speed and complexity of the response.

We’re seeing it. While we haven’t seen a complete 100% autonomous end-to-end, we’re seeing pieces that are getting very, very close. We have so many millions and billions of data points coming through and it’s getting scarier by the day. Our job is to stay ahead of that. We stopped billions and billions of attacks last year and we had seven reports come through of malware that maybe got through. So the success rate is phenomenal, but the only way that will stay phenomenal is if we just stay on top of that 24/7, 365 and read all the indicators of what the bad guys are doing and how we need to stay ahead of that to protect our MSPs and protect our end customers.

Robert Dutt: We talked about platformization a little bit off the top. I wanted to circle back to that. First, you’ve been pretty open about bringing the Kaseya playbook to WatchGuard – driving down platform costs, consolidating tools, increasing margins. But Kaseya can be a complicated word in the MSP space. Some partners hear it and think great economics. Others hear it and think about aggressive bundling or the friction of integrating acquisitions. Which parts of the playbook are you looking to bring to WatchGuard, and which parts are you consciously choosing to leave behind?

Joe Smolarski: Yeah, definitely. And listen, every company has its pros and cons. And certainly over there, I was the number two, not the number one, which is a difference, because you’ve got to abide by certain things. It had a fantastic leader with Fred and a great leader with Rania in the current leadership. But I think ultimately what always resonated – no matter, I say time and time again, even if somebody didn’t like certain practices at Kaseya – what always resonated was, “I need to lower my operating costs because my margins are too tight and I can’t scale efficiently.” It’ll be tough to get liquidity as an MSP if I’m not getting the proper margins and profitability. And we know that there’s a great opportunity for MSPs to get liquidity and have an event, because there’s a great rollup occurring in the industry.

So just making sure that the unit economics continue to get better. And the second component is just an integrated platform. It makes all the difference in the world. Imagine you hiring your next technician, your next engineer, and then you’ve got to reach out to seven different vendors to get that person set up. That engineer has to learn seven different platforms and seven different logins and swivel chair through all of it. So those two components, no matter what, always resonated with the base, whether they were Kaseya lovers or Kaseya haters, those two things always resonated. And those are some of the common components.

I think the benefit for me, and the reason why I left a very successful career at Kaseya – we did a lot of great things from a financial perspective, growing it tenfold in my tenure there – the reason why I left and the reason why I took that call is because WatchGuard just has a tremendous partner focus and is well respected in the industry. So you take that, you take the great products that we have, and then you have the focus on the unit economics that I’m certainly bringing to the table. It’s just very, very important.

Sometimes an MSP needs some bells and whistles and sometimes they just need it to work and be a world-class security solution that gets to lower their costs in parallel. And that’s what we’ve done. It’s just a great combination of a company that is 1,000% focused on the partner community. That’s all we do.

If you look at us compared to very amazing firms like a CrowdStrike – just phenomenal firms – but they’re not solely focused on MSPs. Prior to a decade ago when I joined Kaseya, I spent my life in the enterprise. And when you’re a firm dealing with enterprises and MSPs, I’m sorry, but it’s only natural that the enterprise gets the attention. They just do because, number one, if you look at how they segment their customer base, the Bank of America and the General Electric – when they call in, they’re going to get prioritized, let alone the human element. When you’re on support and you’re dealing with the big guy versus the little guy, it’s just different. You go above and beyond.

That’s why for us, we never try to mix the two. We want to make sure that we’re dedicated to the MSP community. It makes a massive difference in terms of focus. We understand that if we let an MSP down, this is their livelihood. You let an IT director down at Bank of America, his life keeps on going. But you let an MSP down and this is their absolute livelihood, and we just can’t let that happen. That’s embedded throughout the culture of WatchGuard, which we’re super proud of. You put great products on top of that and the focus on unit economics, and it’s getting that cost down so that we allow them to be more aggressive.

You and I talked earlier in the call about the fact that if an MSP offers a cybersecurity package and it gets declined, they’re still going to get blamed. So if we can keep getting that cost down to allow them to make sure all of their end customers are protected, it’s just a great thing for all. And that’s our genuine focus and we’re super excited about it.

Robert Dutt: You’ve said that you want to double MSP margins on cybersecurity, and that’s a very specific promise, one that I have to imagine gets a lot of MSPs’ ears perked up. Can you walk me through the mechanics of how that actually works? Is this pricing, is it operational efficiency through the platform? And what does that transition to higher margins look like for a Canadian MSP with, say, 500 managed endpoints?

Joe Smolarski: Yeah, listen, I think it’s all of the above, Rob. If you look at it, you can buy a dirt cheap solution and think that you’re saving money. But when it comes to cybersecurity, you buy a dirt cheap solution and then you get bombarded with alerts and noise and everything else. All you’re doing is increasing your operational headcount, your human capital. And you’re getting an absolutely nasty math equation that you just didn’t realize when you signed on the dotted line up front for the rock bottom price.

So it’s not solely based on price. This is a world where there is a ton of noise. And if you’re not efficient with what we’re providing to the MSP in terms of threat indicators and things like that, they just get overwhelmed and either have to overstaff to accommodate for it, or they miss important things and ultimately allow bad stuff to occur within their environments.

For us, we really focus on simplicity of the platform and making sure that we can give you absolute world-class solutions. You do the research on WatchGuard – we have world-class solutions across the board with tremendous success rates. So give world-class solutions, limit the noise that an MSP has to deal with, and always be there for that MSP when something occurs. We have a six-minute response time on our SOC, which is best in the industry.

All of those things combined, along with very aggressive commercials. We have to be. We’re getting more and more aggressive when it comes to commercials and have a lot of great stuff planned for this year. I’ve been here four months, so give me a little bit of time, just a little bit. But we’re making progress every single day to continue to meet the needs of our MSP community. Get that price further down, improve the unit economics, and more importantly just provide a great simplified platform that simply works, and always show up when our customers need us.

Robert Dutt: You’ve shipped a lot of product in a short time. The Zero Trust Bundle, FireCloud, Open MDR with third-party support, the unified agent. For an MSP that’s currently running your firewalls, maybe another piece of the stack, what’s the realistic path, the realistic starting point to adopting the full platform, and how do you avoid the rip-and-replace fatigue that you can feel from vendors who are in the platform play?

Joe Smolarski: Yeah, we’re doing everything we can to avoid the fatigue. Not to kick anybody when they’re down, but we’ve had a flurry of major activity from SonicWall customers looking for relief from some of the challenges they’ve had. Our team has worked around the clock to put together fast, easy, white-glove migration using AI that can carry across profiles and configs to make it as easy as possible to reduce that fatigue when you do decide to move.

We definitely concentrate on reducing that fatigue through automated migrations using AI tools to make sure that some of those things happen. But fatigue aside, in terms of next logical steps – we’re blessed, we have 25,000 MSP partners, most of which are using our firewall solution, which we’re famous for. The red boxes. It’s world-class and extremely well respected.

If they’re just using the traditional firewall, the next easy logical step is to get the endpoint protection with fully managed SOC, because you need it and it just works so tightly together. Our goal when we work with our partners is just to show that one plus one truly does equal three. We work on that every day through additional integrations and ease of migration tools. We’re super excited about it, and we think it’s going to be a banner year for us. We had a record-breaking 2025 and think we’re just getting started at this stage.

Robert Dutt: Vector Capital has been involved with you guys for decades, which is pretty unusual for private equity. Your partners are making long-term bets on the platform – obviously, that’s the nature of the beast. What are you giving them in terms of assurance that there’s continuity of investment there, that this structure keeps going, that it doesn’t become a growth-for-exit kind of play?

Joe Smolarski: Yeah, well, I think you just answered it for me. You just said Vector’s been involved for decades. That is very rare, Rob. Very, very rare.

Number one, Vector’s just a fantastic partner. I’ve dealt with many different private equity firms. I’ve been in private equity my entire life – very prestigious ones. Insight was fantastic at Kaseya. But ultimately, Vector has been in this for the long run. Some of the principals at Vector have personal financial interest in this company, which just creates a loyalty and a common vision for us to build a great company. And they tell me that every single day. We don’t build for an exit. We want to build a great company. We believe we have a great image and perception and brand in the market today, and we’ll never do anything to compromise that.

Our focus is to build a great company, protect our partners, continue to build with our partners. Both myself, the WatchGuard team, and Vector – that’s the sole focus here. Because they’ve been involved for decades, it’s a little bit different than many other firms that are going through change of ownership every couple of years. And then they’ve got to cut costs and go through all that. We’ve had stability from that perspective, which is great.

We’re still a business. We’re a for-profit business. We’re not a charity. So of course we always have to make business decisions in an ever-changing business world. But I think that continuity has really made a big difference. Having a private equity firm that has a personal interest in this company has made a big difference for us, and I think our partners see that with the level of focus and dedication to the partner community.

Robert Dutt: Earlier in the conversation you mentioned data sovereignty. You mentioned some of the moves being made on the government side in terms of legislation. As you’re pushing a cloud-delivered security platform, how do you see data sovereignty factoring into that?

Joe Smolarski: Yeah, it always has to, because otherwise it’ll preclude you from being able to penetrate certain markets. Ultimately, that started decades ago in Europe, in terms of having to make sure that data is stored locally. Any major vendor needs to make sure that focus is there. Canada is catching up quickly in terms of many of those requirements.

Sure, it requires extra capital and build-out in terms of making sure we have local data centers and all of that. But at this stage of the world, unfortunately it’s getting more complex with all the wars and the turbulence that’s in the world now, which is unprecedented. So you’re going to get more of that – “No, it can’t leave the country, it’s got to be here” – more and more. All of us in the SaaS space need to be prepared for additional investments to accommodate for that. You’re not going to win and be able to get that business at a large scale without it.

Our business has quickly taken off in many key areas. You may have seen we just announced the Bell Cyber partnership this week. Bell is the largest telco in Canada, as you know better than me, and Bell Cyber is their cyber arm. They’re embedding WatchGuard to make sure their customers are protected. As part of that, we had to make sure that there are no data sovereignty issues when you’re going to the largest telco to get to their millions and millions of customers.

We’re super proud of that. WatchGuard – we’re not at the level of a gazillion-dollar firm, but we’re big, we’re serious, we have great technology. And to go and get the number one telco in Canada to use our solution for their cybersecurity offering is just evidence of how we’re attacking problems like that.

Robert Dutt: I’m curious, as you’ve looked over the landscape, do you see the Canadian market differently than the US in terms of MSP maturity, cybersecurity adoption, those kinds of market condition issues?

Joe Smolarski: I think the Canadian market is a fantastic market in this space that is ripe for the next level of maturity. As I mentioned, and this is not coming from my speculation, this is coming directly from some of the larger MSPs. I think F12 and Calvin caught up with them and a bunch of others earlier this week. Large, prestigious MSPs that are doing great things and growing significantly.

Canada is just a little bit further behind, needs a little bit more education from an end-customer perspective. As regulation comes up, that’s going to solve some of that. As some of the geopolitical stuff continues to occur, that’s going to happen. The consolidation that we saw in the US on the MSP side, starting maybe five, six, seven years ago, is starting to pick up in the Canadian market as well.

And that’s a great opportunity. To me, MSPs should be excited. When you see consolidation occurring and rollups occurring, that’s a chance for you to get a nest egg. What we’ve seen is MSPs can get some liquidity, either stay invested or exit, and then they go do it again because they’ve got the playbook. The MSP world’s not that complicated in the sense that there are playbooks on how you win. We certainly work with a lot of MSPs to share those playbooks.

The Canadian market is ripe for that next level of maturity. I am super confident that it’s going to accelerate, because you have a lot of great MSPs and technology providers taking advantage of that now, and it’s going to continue.

Robert Dutt: You guys just turned 30. In a market where a lot of security vendors either get acquired, completely change what they’re doing, or flame out, what does that longevity actually mean? What do you see as the selling points of it, and what do you see as the baggage of having that long of a history?

Joe Smolarski: Listen, the selling points are we’re not going anywhere. We’ve been doing this for 30 years. We haven’t done it for 30 years at a small level, Rob. We’ll approach a half a billion dollars in revenue by the end of this year, well over $120, $130 million profit. We’re doing great things. We’re big, we’re stable, and that longevity gives customers and partners the assurance that we’re not going anywhere.

Because I think you know it – there are many firms out there that look sexy. They’ve got the sizzle. They’ve been around for three years and everybody’s talking about them. And then I meet with many of these CEOs from an acquisition perspective, and you talk to them and you realize, “Oh, they’ve never made any money.” And when you’ve never made any money, sometimes you can get away with that because you sell and do your thing. But many other times, there’s a reckoning from a macroeconomic perspective, where money’s not free anymore and ultimately either make money or there’s going to be a problem.

In those situations, when you change hands and you get swallowed up by a bigger company at some minimal value because of economic challenges, you invested in something that’s not going to be there for very long. Customers love knowing, “I can go with WatchGuard. I know you’re going to be around forever, quite frankly.” And they see how we’ve evolved. We have not been stagnant.

On the positive front, we went from being the leading provider of firewall solutions, which are still very critical from a perimeter security perspective, in the MSP and SMB space. We protect many of the agencies that are protecting the world. Our firewalls are in government agencies throughout the United States and throughout Canada that are actually protecting our soldiers. Our solutions are in fighter jets. So we’ve got a lot to be proud of just in terms of that level of security that our government relies on us for, which is amazing.

What you need to fight against, just to make it a balanced conversation, is being stagnant. This is a fast-changing world. If you’ve been here for decades, you have to make sure that you’re staying up with technology, understanding how AI can help you do your job three times more efficiently. Many people can, some can’t, but many people can because they have great roots in technology and innovation.

So you just have to keep pushing the team to be aggressive, not stagnant. And that’s what you get with me, certainly. I know how to push people. I’m a little bit over-energetic, probably a few too many Celsius on a daily basis. My goal is to get the most out of people, but when you have a great team and a great foundation like we do, it’s not that tough.

Robert Dutt: Just to wrap it up, let’s go back, if we can, to that Canadian MSP that we were talking about – that SMB-focused MSP who’s been focused on the firewall side of the business but hasn’t really gone too much deeper. What’s the single biggest reason that you see for them to take another look at what you guys are doing right now?

Joe Smolarski: I think the progression of our platform is well beyond what people understand. The level of embedded AI throughout the platform is beyond what they would expect – if they looked at us three, four years ago, they just don’t understand where we’re at today. Ultimately, we have an AI-enabled platform that’s dedicated to the MSP and SMB market.

Sure, firms like CrowdStrike are fantastic. They’re not dedicated to this. For us to have technology on par with anybody that’s out there throughout the entire cybersecurity stack and to solely dedicate that to the MSP and SMB market – so when you have a problem and you go through a breach or anything else and you call in, you’re not competing with Bank of America, you’re not competing with these other massive companies. You’re our sole focus. We understand your business is your lifeline.

You get all of that sophistication and then a level of simplicity provided within the platform that is second to none, to just make your job way more efficient. That’s the ultimate selling point for us – that you can get everything you need throughout the cybersecurity stack from WatchGuard, plus that friendliness of just the pure partner focus and commitment.

We truly believe the next few years are going to define which MSPs become security leaders and which stay as commodity IT providers. The opportunity is enormous. The demand is structural. And the partners who build disciplined, automated, security-first practices are really going to thrive. We’d love to be their partner.

Robert Dutt: It’s a great point to leave it on. Joe, I appreciate your taking the time. This has been a great conversation. I think you’ve given partners lots to think about.

Joe Smolarski: Thank you so much, Rob. Take care.

Robert Dutt: There you have it. Joe Smolarski from WatchGuard Technologies. I’d like to thank Joe for his time. This was actually one of his first podcast appearances, and I thought he was remarkably candid throughout. I appreciate that. And of course, thank you for listening.

A few things that stuck with me from this conversation. First, the honesty about AI. When a CEO tells you that half of what’s being called AI out there is, in his words, bullcrap, but then makes a clear case for where it genuinely matters – fighting the velocity of AI-driven attacks with AI-driven defense – that’s the kind of nuance I think partners need to hear more of.

Second, the Kaseya question. Joe didn’t dodge it. He acknowledged the baggage, drew a line between what he’s bringing forward – the unit economics focus, the platform consolidation – and what belongs in a different chapter. Whether that distinction holds up over time is something we’ll all be watching, but I thought that was a fair answer.

And third, the Canadian angle. WatchGuard’s partnership with Bell Cyber is a significant validation of their platform in this market. And Joe’s observation that Canada is ripe for the next level of MSP maturity, driven by regulation like C-26 and the consolidation wave that’s hitting us now, is worth paying attention to.

If you found this conversation useful, I’d love it if you’d follow or subscribe to the ChannelBuzz.ca podcast. You can find us on Apple Podcasts, Spotify, YouTube, and most other podcast directories. And if you’re feeling generous, a rating or review goes a long way towards helping other folks in the channel find us.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

The ESET Women in Cybersecurity Scholarship is in its eleventh year globally and its fifth year in Canada. This year, ESET is awarding three $5,000 scholarships to Canadian women pursuing careers in cybersecurity, with applications open through April 8, 2026.

The numbers are substantial. Across North America, ESET has awarded $187,000 to 39 women since the program launched. In Canada alone, 14 women have received a combined $50,000 since 2021.

But here’s what caught our attention. When we asked ESET Canada country manager Bob Bonneau where past recipients have ended up, the answer was honest: they’ve largely gone to work at tech companies at the source of the technology, not at channel partners or MSPs. It’s a gap Bob acknowledged openly, and one he committed to thinking about differently as the program evolves.

That matters for the channel. Canada’s cybersecurity workforce gap is well documented — the ISC2 Cybersecurity Workforce Study puts women at roughly 22% of the global cybersecurity workforce, and Canadian numbers have been largely stagnant for two decades. Every MSP competing for security talent is drawing from the same thin pool, and retention is just as hard as hiring. As Bob put it, the second someone updates their LinkedIn with cybersecurity experience, the recruiters come calling.

Worth noting: the scholarship is open to any woman enrolled in or accepted to an accredited Canadian college or university, including those studying part-time while working. That means someone already in the channel who’s upgrading her skills could be eligible. If you’ve got someone on your team who fits, point her toward the application before April 8.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show.

If you’ve been in the channel for any length of time, you know that finding and keeping cybersecurity talent is one of the biggest operational challenges MSPs and other solution providers face. Canada needs to fill roughly 25,000 cybersecurity roles and produces fewer than 4,000 graduates a year. That math doesn’t work, and it’s not getting better fast enough.

One program that’s been trying to move the needle is the ESET Women in Cybersecurity Scholarship, now in its 11th year globally and 5th year in Canada. This year, ESET is awarding three $5,000 scholarships to women in Canada who are pursuing careers in cybersecurity. Applications are open right now through April 8th.

But I didn’t want to just tell you that the scholarship exists. I wanted to dig into the thinking behind it. Why a security vendor invests in something like this, what happens with the talent it produces, and whether programs like this are actually connecting to the channel or feeding the pipeline somewhere else entirely. My guest today is Bob Bonneau, country manager for ESET Canada, and he had some candid answers to those questions. Let’s get right into it, my chat with Bob Bonneau.

Bob, thanks for taking the time. Nice to chat with you again.

Bob Bonneau: Likewise, I appreciate being here. Thanks for the invite. It’s always a pleasure to catch up.

Robert: The ESET Women in Cybersecurity Scholarship is in its 11th year now, 5th year in Canada. Can you tell me what was the original thinking behind expanding the program here, and has the program evolved in ways you didn’t expect when you were thinking about that five or six years ago?

Bob: Yeah, for me, as you know, I took over the role of leading Canada about six years ago, and it was too soon in the first year for us to kind of jump on board. But having been exposed to what the US office had initiated from an ESET perspective in terms of the scholarship was certainly something that I thought was just a great initiative and something that I was excited to kind of join and be part of. So I quickly made plans to ensure that we were included in the next year, and we’ve been a part of it ever since.

I would say initially, we started with a single $5,000 scholarship, and as much as there was — it was an investment we were making that, contrary to popular belief where every vendor-invested dollar, especially in something like this, has to have some sort of ROI metrics to it — this didn’t have that. This is purely something that we felt passionate about needing to do, and we thought it addressed a couple of different main areas in our business that we were trying to address.

But when I look at the early days, it was funny because it is very much a marketing effort just to get the information out there that we’re in fact offering it. So I would say we had the $5,000 scholarship offered and we worked hard to get that communicated out so that we could get a good submission base to start to evaluate.

And if we fast-forward to going into this year, it’s now scaled to three $5,000 scholarships that we’re offering. What used to be largely an internal company effort — we would look at the submissions and evaluate them and select the winners — there’s now a 10-person selection committee made up of representation from business, tech partners, large customers of ours, our reseller community. So it’s really expanded from there, and it’s great to see.

Part of why we scaled it is because the volume of submissions has grown so much, which is great. But quite frankly, the impressiveness of the applicants just makes that job really hard. So it really has evolved to what we’re seeing today, and it’s been great to be part of that. It’s also evolved from a company perspective, which is great. Now having, I think we’ve got seven countries participating in it.

Robert: Wow. So far you guys have awarded $50,000 to 14 Canadian women through this program. When you look at where past recipients have ended up, they’ve largely gone to work at tech companies rather than, say, roles in the channel with partners or MSPs. Is that the intended outcome, or is there a gap between investing in the pipeline and seeing that young talent show up in the channel?

Bob: Yeah, it’s a great point. I think the effort was obviously established to address two main gaps that we have in our business today. One, obviously, the underrepresentation of women in technology. I think that number is hovering around the mid-20% in Canada, but it’s only grown from about 21% in 2001. So it’s been largely stagnant — a number that we wanted to, in at least our small way, try to impact. The broader challenge obviously is the skills shortage in cybersecurity, which there’s no shortage of articles around. I think the more recent data suggesting 25 to 30,000 open positions in Canada, with that gap expected to hit somewhere around 100,000 by 2035. And globally it’s even more ridiculous — it’s 4.8 million, I think, is the current number.

So two major challenges that we have in our industry, but you bring up a good point. I think initially it was less about — I don’t think we were thinking that deep in terms of how does this impact channel, how could it impact channel. I would say we’re engaging our channel partners through the effort, and they’re really enjoying being part of the selection committee and those types of things. We’re seeing partners, as a result of their participation in the selection committee, starting to do their own version of this, which is great to see.

But I think you’re right. I think there’s probably an opportunity for us to evangelize the channel part of the opportunity from an employment perspective as we’re doing some of this effort, and it’s probably something that we can look to in the future. But holistically, the gap and the challenge in terms of women in tech as well as just the skills shortage affects both our partner community and our customer base as well. So yeah, I think you bring up a good point. There’s probably an opportunity for us to maybe use our exposure to the applicants to try to evangelize the channel a little bit more going forward.

Robert: Well, and it’s often a good entry point for folks just starting out in cybersecurity. I can tell you that every MSP I’m talking to, one of their biggest challenges — the biggest challenge — is hiring the right people, especially in security, for the numbers that you point out. And I think as you say, maybe there’s an opportunity for you guys too. I mean, I understand that the goal of the scholarship is to grow the overall pool and then the market sorts it out. But it does occur to me — the scholarship itself isn’t strictly limited to students who are purely full-time at a school. If I’m a solution provider who has a female employee who also happens to be upgrading her skills at college part-time, they could theoretically be pointing her toward this. Is that a use case you’ve seen or thought about?

Bob: We haven’t seen it in terms of — we tend to see more full-time students applying. We haven’t seen those returning to either enhance their current skills or — actually, we have seen some submissions from part-time students. So let me correct that. But specifically from channel, not to date.

But you do bring up a great point. It’s one that we — I think if we look to subsequent years, next year, to really promote both the channel to the applicants who may be applying, but also to the channel to solicit those that might want to consider applying for it. For those that are doing some reskilling on their part, there’s probably an opportunity for us to evolve that.

Again, like I said, the initiative has been more philanthropic than it’s been carved down into how do we use this as an opportunity to work with the channel more. But I think you bring up a great concept and idea and one that I certainly will take under advisement and work with the team on for next year. I think they’re great ideas. Again, it’s part of the evolution of how this thing has grown and how we think about it. I think there’s a good opportunity to start to look at it a little bit more strategically around how we work with and engage the channel and use it to promote the channel a little bit more.

Robert: And it’s not too late. To your listeners, if you’re listening to this and you have a woman working for you that fits in that category, nominations are open through — correct me if I’m wrong here Bob — April 8th?

Bob: April 8th is when those submissions close, correct. So there’s still time to get your submissions in. We’re starting to see them come in now. It’s interesting — we see a big spike in those that have initiated, and we tend to see those applications get submitted closer to the deadline. So it’s really something that people are spending a lot of time working on, which is great. And I would say we really focused a little bit more on the cybersecurity element, whereas initially it was a little bit broader, more sort of STEM, and now we’re really trying to focus in on those applicants that are showing a real proficiency or directive toward cybersecurity.

Robert: Makes sense, given both where you sit and the need, which we’ve talked about and which everyone listening to this is no doubt well acquainted with. You guys added the Future Leader tier in Canada last year — a $1,000 award alongside the $5,000 Trailblazer level. What was behind creating that second tier, and what have you learned about reaching people earlier in the pipeline as you’ve done this?

Bob: Yeah, so it’s again part of the evolution. We initially said $5,000 times one, then it was $5,000 times two, and even when we got to the $5,000 times two, the applicant pool was so strong that quite honestly our selection committee — and again, this is made up of directors and general managers and VPs from all sorts of business, large enterprise customers, partners, other technology-aligned partners — they really just struggled with how do we pick just two. So we said, okay, well, what can we maybe do in terms of evolving the program?

That’s when we made the decision last year to offer five $1,000 bursaries. But as we pivoted back to this year, we pulled that back a little bit and went to three $5,000 scholarships, as opposed to the five $1,000 bursaries. Part of our thinking was we wanted it to be more impactful, even if it meant fewer people, and given just the cost of education and what’s happening today, it just felt like it was more relevant to offer $5,000 times three versus the additional $1,000 bursaries.

So that’s where we’re at today, and I think directionally that’s likely where it’ll continue to go. In terms of the stats from North America, there will be a total of $35,000 given this year — $20,000 in the US and $15,000 in Canada. And since inception for North America, there’s been over $187,000 awarded to 39 women. So we’re excited to evolve this. I think we’re tweaking it for the right reasons, and we’ll continue to tweak it. Some of the recommendations you made for going forward, I think, are certainly ones we want to take advantage of as well.

Robert: I love those relative American-to-Canadian numbers, given that we’re so used to either multiplying or dividing by 10 depending on which way you’re going. To see it so close to parity given market sizes, that’s a great sign. The Alumni Club is relatively new. What’s the vision there — is that mainly a networking thing for recipients, or are you trying to build something more structured that connects those folks to the industry longer term?

Bob: Yeah, I think it’s a bit of both. We first of all wanted to make sure that we have methods to maintain relationships with these folks, and to see where they end up and how they evolve, and to continue to be a support mechanism for them as they look to build their careers in this industry. So it really created that tether for us to keep in contact with them, which is great, and to continue to offer them some opportunity for mentorship.

We see a lot of students nowadays open to the idea of moving and traveling and seeing the world and maybe working in different locations. And because we’re global and we’re seeing more and more of our regions participate in it, there’s that opportunity for us to potentially help them in terms of building their career.

What we wanted to create was long-lasting relationships with our recipients, and not just hand them an award and bid them adieu and wish them all the best. So I think this is just another evolution, in part of the program, as well as the adoption. Like I said, we’re in seven countries now, and we continue to see countries added every year. We’re excited to be able to offer it, and like anything else, it’s just continuing to make sure that they’re aware it exists and that we encourage them to take advantage of it.

Robert: ESET picked up the CRN Gender Parity Award last year. How do you think about whether vendor-side diversity commitments actually translate out into the partner ecosystem? Is that connection real now, or is that still sort of aspirational?

Bob: That’s a great question, and I guess it’s going to be a little bit more opinion-based. But I do think the latter is true — I do think you’re starting to see some really good movement in the positive direction across both channel and vendor communities. Certainly when you look at where the gaps would have been in terms of women representation in our organization, we’re pretty proud of our mix. And the more that we engage, the more that we work with our partners, the more that we solicit folks to be part of even our selection committee — it’s surprising how many women are starting to hold higher positions within both our partner communities and within our commercial customers. So that’s great to see, and it’s great to see how excited they are to participate in a venture like this to try to continue to encourage that statistic to change.

Robert: My last question. If an MSP or other partner came to you and said, “I want to hire more women into security roles, but I don’t know where to start,” what would you tell them?

Bob: Well, first of all, I would probably say I don’t think it’s as difficult as it might appear to be. I think if you’ve constantly landed at that decision, that you want to try to do that, I think there’s enough opportunity to go and find those folks for those types of roles. I just think you need to decide that that’s something you want to address. When it’s just sort of passive, it may be a little bit more difficult to do if you’re just kind of waiting for it. But we’re happy to put them in touch with — there’s several organizations, there’s events happening now, even in Canada and Toronto and in the US, that are really communities based on women in cybersecurity. There’s a growing number of them. I think attending those, or being part of those, or reaching out to those communities is a great way to find good talent that’s really proactively working at their career in cybersecurity.

Robert: Some good advice there, and good luck finding those lucky winners for this year when those nominations close in just a little bit. Bob, thanks for taking the time.

Bob: Appreciated, as always. We look forward to seeing what the applicant pool looks like this year, and certainly going through the applications and reading what they have to say and what their submissions are. It’s a great part of what we do. We enjoy it every year, and we look forward to the event when we get to invite them and hand them the big novelty check at the end. The novelty check is always a fun time.

Robert: Yeah, for sure. Thanks so much.

There you have it, Bob Bonneau from ESET Canada. I’d like to thank Bob for his time and for being genuinely open about where the program is and where it could go. It’s not every day that a vendor admits on tape they haven’t fully connected a talent initiative to their channel and then commits to thinking about it differently.

A couple of things I want you to take away from this. First, the obvious one: if you know a woman in Canada who’s enrolled in college or university and has an interest in cybersecurity, point her toward the ESET Women in Cybersecurity Scholarship. Applications close April 8th — we’ll have a link in the show notes. And that includes women who might already be working in the channel and upgrading their skills part-time. There’s nothing that says this is only for traditional full-time students.

Second, and maybe more importantly: Bob’s comment about retention — that the second someone updates their LinkedIn with cybersecurity experience, the recruiters come calling — that should land for every MSP owner listening. You’re not just competing to hire these people. You’re competing to keep them. And if you’re not thinking about what makes your shop attractive to a 21-year-old with security skills and options, someone else is.

Thanks for listening. You can find In The Channel on Apple Podcasts, Spotify, YouTube, and most podcast directories. If you’re finding the show useful, a rating or review goes a long way. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

RSA week may be over, but the Canadian channel news cycle kept moving. Four stories this week that deserve your attention heading into April.

Sherweb goes global

Broadcom’s VMware reckoning

The silicon squeeze

The AI governance gap

Hello and welcome to In Case You Missed It from ChannelBuzz.ca. I’m Robert Dutt, editor of ChannelBuzz.ca, and this is your weekly look at the stories that matter for the Canadian IT channel community. March 30th, 2026.

Four stories this week. A Sherbrooke cloud distributor goes global after 28 years of bootstrapping. Broadcom’s VMware reckoning arrives just in time for a March 31st deadline. Intel and AMD both signal price increases that will squeeze your clients’ hardware refreshes. And two independent reports paint the same uncomfortable picture about where enterprise AI adoption actually stands.

Let’s get into it.

We’re starting this week with a feel-good Canadian story, and it’s a big one.

Sherweb, the Sherbrooke, Quebec-based cloud marketplace distributor, has secured a $125 million minority equity investment from Investissement Quebec. And here’s the detail that makes this significant: this is Sherweb’s first outside investment ever. The company has been bootstrapped and founder-owned since 1998. Twenty-eight years without a dollar of outside capital.

This comes on the heels of Sherweb’s expansion into the UK market, where they’re targeting over 11,000 MSPs. That move was built on their acquisition last year of Irish cloud distributor MicroWarehouse, so they’re not just parachuting in — they’ve got a beachhead.

Put those two announcements together and the picture is clear. This isn’t a company raising money because it needs to. This is a company that’s been profitable for nearly three decades, deciding it’s time to go global, and bringing in a strategic partner to fund the expansion and, notably, M&A.

CRN’s interview with Sherweb’s co-CEO made the ambitions explicit: AI marketplace expansion and acquisitions are on the table. For Canadian partners, this is worth watching. Sherweb has been a reliable, partner-first distributor for a long time. The question now is whether they can scale that model internationally without losing what made it work.

Now for a very different kind of story. The Broadcom VMware saga has been building for months, and this week several threads converge at once.

March 31st is the deadline for Broadcom’s termination of the VMware Cloud Service Provider program in Europe. CISPE, the European cloud infrastructure providers group, filed a formal antitrust complaint with the European Commission on March 19th, calling Broadcom’s actions — and I’m quoting here — a “death sentence” for smaller cloud providers. They’re asking for interim measures to block the shutdown while the complaint is investigated.

Broadcom’s response, per CRN, was that they “strongly disagree” and that the complaint “misrepresents the realities of the market.”

Meanwhile, Broadcom is making a very specific pitch to customers. Krish Prasad, who heads the VMware Cloud Foundation division, told CRN — and again, direct quote — “We have essentially solved the hardware shortage and the hardware cost issues with a software solution.” The argument is that VCF 9.0’s advanced memory tiering lets you offload expensive DRAM to cheaper NVMe storage, so the memory super-cycle becomes a reason to buy more VMware, not less. Prasad called it a “huge VCF tailwind.”

Here’s the irony, and it’s hard to miss. Broadcom is simultaneously telling customers they need VMware more than ever to survive the hardware crunch, while pushing licensing and program changes that are driving those same customers to look for alternatives.

And the data on customer sentiment is now documented. Independent analyst firm Virtified, founded by former Gartner VP Michael Warrilow, surveyed 450 VMware users across 14 countries and found roughly half plan to reduce their VMware usage by 2028.

That’s not channel chatter. That’s documented customer intent. Whether the EU complaint gains traction or not, the market is speaking.

Speaking of hardware getting more expensive — let’s talk silicon.

Intel had an interesting week. Their VP David Feng told CRN that the new Core Ultra Series 3 “Panther Lake” chips will help Intel regain market share in commercial PCs. The pitch: Panther Lake brings meaningful AI processing capabilities to the commercial fleet. This is Intel’s play to win back ground they’ve lost to AMD and Apple Silicon in the enterprise.

On the other hand — and this is from the same executive, same week — Intel confirmed it’s raising CPU prices for OEMs by roughly ten percent. Supply crunch, rising component costs, tariff pressure. The usual 2026 cocktail.

So Intel is counting on a commercial PC refresh cycle to reclaim market share, while simultaneously making that refresh more expensive for everyone involved.

And lest you think this is Intel-specific — AMD is also signaling GPU price increases of at least ten percent in 2026, driven by the same DRAM supply crisis.

For partners helping clients plan hardware refreshes right now, the message is straightforward: budget accordingly, and budget up. The cost pressure is structural, not temporary.

We’ll close this week with some data, and it tells a story every MSP needs to hear.

Auvik released their 2026 IT Trends Report this week. The headline finding: sixty-seven percent of IT professionals are optimistic about AI. But only five percent say AI is actually core to their operations today. Five percent. That is an enormous gap between enthusiasm and reality.

The governance picture is even more striking. Seventy-six percent of IT leaders believe their organization has an AI policy. Only forty-two percent of help desk staff agree. That’s not a gap, that’s leadership and the front line living in completely different realities about whether the rules even exist. Auvik also found that 61 percent of organizations discover unauthorized SaaS applications at least monthly. Shadow IT is not a hypothetical — it’s a standing Tuesday meeting.

And these findings aren’t isolated. The same week, Waterloo-based OpenText released a Ponemon Institute study of nearly 1,900 IT and security practitioners. Fifty-two percent of enterprises have deployed GenAI. But seventy-nine percent haven’t reached full AI maturity in cybersecurity. Only 41 percent have AI-specific data privacy policies.

Two independent studies, same week, same conclusion: AI is being deployed faster than organizations can govern it, secure it, or even agree on whether governance exists.

For MSPs, this is the opportunity in neon lights. Your clients are adopting AI. They think they have policies. Their front-line staff disagrees. Someone needs to fill that gap.

That’s your In Case You Missed It for March 30th, 2026. Sherweb going global, Broadcom’s VMware reckoning, the silicon squeeze, and the AI governance gap — confirmed from two independent angles.

Links to everything we talked about today are in the show notes at ChannelBuzz.ca.

If you’re finding this useful, subscribe wherever you get your podcasts — Apple Podcasts, Spotify, YouTube, most directories. Ratings and reviews always help us out.

I’m Robert Dutt for ChannelBuzz.ca. I’ll see you in the channel.

This is the first episode in an occasional In The Channel series called “Life after the channel” – conversations with people who built careers in the Canadian IT channel and then went on to do something completely different.

Martin McNicoll founded Gurus Solutions, originally ERP Guru, and grew it into one of NetSuite’s most decorated Canadian partners over nearly two decades – President’s Club, nine consecutive years as a Five Star Award winner, and offices from Montreal to Chicago. He sold the company in 2022 and turned his attention to something that had been brewing since a 50th birthday trip to Scotland: whisky.

Distillerie des Cantons de l’Est is a grain-to-bottle operation in Mansonville, Quebec, where Martin and his team are growing organic barley and rye using regenerative agriculture, distilling on-site, and aging their whisky in oak casks. First barrels went in in December 2024, with the first whiskies expected around 2028.

In this conversation, we talk about the failed attempt to buy a cask at Balvenie that started it all, the sale of Gurus and what made him finally say yes, why the skills he built running an ERP consultancy translate surprisingly well to running a distillery, and what it means to retrain a SaaS-speed brain for a product that takes years to mature. Martin also shares the story behind the McNicoll brand – his Scottish ancestors who came to Quebec with the 78th Fraser’s Highlanders in 1757 – and talks about the fight to get a distillery approved on Quebec agricultural land, replanting American oak for barrels that won’t be ready for 30 years, and what’s coming next, including a butterscotch liqueur later this year.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show.

This episode is a little different from what you’re used to hearing on In The Channel. It’s the first in what I’m hoping becomes an occasional series I’m calling “Life After the Channel” – conversations with people who built careers in the Canadian IT channel and then went on to do something completely different.

My guest today is Martin McNicoll. If you were in the NetSuite ecosystem in Canada at any point over the last two decades, you probably know Martin. He founded ERP Guru, which was later rebranded to Gurus Solutions, grew it into one of NetSuite’s top partners in the country, picked up every award in the book, and eventually sold the company in 2022. And then he went and did something that nobody saw coming. Martin’s now building a grain-to-bottle whisky distillery in the Eastern Townships of Quebec, growing his own organic barley and rye, aging his own barrels, and building a brand rooted in his family’s Scottish heritage going back to the 1700s. It’s a great story. So let’s get right into it, my chat with Martin McNicoll.

[MUSIC]

Robert: Martin, thanks for taking the time. Thanks for joining us.

Martin McNicoll: Robert, it’s great to be here with you today.

Robert: Nice to catch up. We ran into each other a lot at SuiteWorld. And for years, when I talked to Craig West about the channel in Canada for NetSuite, you guys would be one of the first names that came up. President’s Club, Five Star, the whole nine yards. And now you’re making whisky in the Eastern Townships. Walk me through that. How did we come to be where we’re at today?

Martin: Well, it’s a note on Craig. He was my RSM. He was the guy managing me and Gurus when you started. He wasn’t like head of the channel. He actually came down to Montreal to help me start the practice. So we connected for all that time.

But to go back to the whisky business, I’m a Scotch fan. I’m a whisky fan. And now, like eight years ago, for my 50th birthday, I went to Scotland with a bunch of friends and had a great time visiting distilleries for a full week, just drinking Scotch and having fun and eating good food.

And when we came back, a couple of years later, it was COVID. And COVID, I think, happened and a lot of people got ideas of what they really want to do. And I have a cottage in the Eastern Townships, which is, for your listeners, a bit up north of Vermont. I’m 15 minutes from Jay Peak, which is a ski resort in Vermont, on the Canada side. Beautiful place. And we stayed there for the first year of COVID.

We had amazing success with Gurus. I think for everybody in the channel, cloud services companies really boomed during that time. Everybody wanted to run their business from home. It was a great time. And I said, what can we do? We had supply chain issues our customers were trying to solve. And I said, what can I do? What can I contribute?

I started with ideas of being a farmer. These were shut down pretty fast. But a friend of mine said, you know what, we can grow barley and rye and we can make whisky. And I said, oh, that’s a great idea. And then the hunt was on. We found some land – I mean, that’s the only thing we could do during COVID, drive around and look for land – and found great land with a great combination of good water and enough acreage to grow the cereals. And it started like that.

And then a French company approached us to buy Gurus. And it was just the right timing. So everything happened. It just gave me more money to spend on booze, sort of saying.

Robert: As it should be. So to your point on that 2018 trip to Scotland, I read that the dream sort of began with a mission of bringing home a cask of whisky. Is that true?

Martin: It is true. We tried to, actually. When we went to the Balvenie and we said we’d like to buy one of your casks. And they looked at us like aliens. It’s like going to a Michelin restaurant and asking to buy the pan of the chef, right? Because the cask is part of the process. That’s what gives some of the aromas to the whisky. That’s where it’s aging. So you just can’t leave with the cask. You just can’t. I mean, I guess there were some barrel programs today, but you leave the cask there. You buy the liquid that’s in the cask, that’s all yours, but you can’t leave with the cask.

But that was funny. That led to very interesting conversations at the distilleries in Scotland. Crazy Canadians trying to buy a cask. That’s the IP. That’s the trade secrets of the industry.

Robert: So you had Gurus for 18 years, Alan Allman Associates comes knocking. You said initially you didn’t want to sell. What changed your mind? How much of it was about making room for the distillery that was already percolating in the back of your mind versus just feeling like it was the right time to do something new?

Martin: I mean, it was that. I wanted to dedicate more time, because at that point the guy running Gurus was my COO, Dominic, and he was doing a great job. I was taking more time off and giving him more bandwidth on the business to run it. And I wanted him to be the president and continue running it.

And these guys came in and they said, “We want to buy your company.” I said, “Okay, I’m not interested.” So they came back a couple times and the second time said, “Okay, how much do you want?” And I gave what I thought was a crazy number and they said yes. So I was done.

And today it’s one of the most profitable businesses they have in their portfolio, and they’ve added other ERPs to the mix buying other companies in North America. And for the French, Quebec and Canada is kind of the bridgehead to go to the rest of Canada and the US. They needed a company that can speak English, which Gurus dealt with very well all the time. Not all of them do. But it was great for them. A great acquisition on their side. I’m still sitting on their board in Montreal every quarter, so it keeps me connected to the business, having fun there and very proud to see the company continue to thrive.

Robert: You guys built Gurus through a string of acquisitions – Enabled Success, NetStra, MD Technical Resources. You had offices from Montreal to Chicago. When you look at what you’re doing now with the distillery – buying land, building infrastructure, hiring a master distiller – does it feel like it’s the same muscles that you built in building up Gurus, or is it completely different?

Martin: It is the same thing. That’s very funny. I thought it would be something else. It’s not. It’s just managing people, managing providers. I mean, the problems are different – it’s like a truck being stuck emptying a cargo of casks going to the distillery, or a pump that is broken. But it’s like following up with the providers, finding the right partners, researching, researching, researching, reading.

And all the skills that I’ve developed in BI and everything that we’ve built with Gurus is fully applied here at the distillery. So I started with cloud solutions first, and we’re using all the Google stack, which I always used, with their Google Cloud. All the data of the distillery is stored in a Google Cloud database and we can do analysis. It’s just great to look at it from a data perspective and have the right people to do the job. And I recognize what I’m good at and what I’m not good at. So I break stuff sometimes. That keeps me away from some pieces of equipment.

Robert: One thing that jumped out on the website for the distillery was the grain-to-bottle concept. You grow the grain, you distill it, you age it, you sell it. You control the whole chain. For 20 years you kind of sat as the middleman doing the consulting and implementation in between NetSuite and the customer. Was it something about that experience that made you want to own the whole thing this time around?

Martin: Definitely. And as you know, Robert, in the ERP channel, it’s not your software, it’s NetSuite. And my team understood the software, and the best successes we had were when we found a customer, sold NetSuite, understood the requirements, gave them a realistic estimate, implemented, and took them live with the right time frame. So that to me was like the perfect – everything that would work great, boom, boom, boom. We sold, we implemented, we took them live, converted all their data. Happy customers stayed with us for years.

And that was a bit of that, right? Where the channel model is changing – like the Salesforce model, even NetSuite is changing where there’s more of a side where you need to work with a direct sales team, which by definition have different objectives. Their objective is to sell the software for as much as possible. As for a partner, when you do the implementation, there’s a lot in it for you also in year two and year three. So you want the whole thing to go as smooth as possible. Different pros and cons there.

And I think that was definitely an inspiration in owning the whole supply chain and making the product. And even then, I need to buy bottles from China.

Robert: Yeah, it’s the classic case study, right? If one person could make a nail, it would be completely impossible to gather all the skills you would need to go from getting the metal out of the earth to producing a nail, much less a bottle of whisky, much less enterprise ERP.

The distillery website says patience is part of your essence, and whisky obviously is a product that has to age for years before you can sell a bottle. In the channel, again to the contrast you were just describing, everything’s about this quarter’s numbers, this year’s President’s Club. It’s fast, it’s iterative, things change very quickly, new features are added rapidly. How do you retrain your brain from SaaS speed to whisky speed?

Martin: I’m still impatient. But you know what, you go out in the field. And in the last couple years we had a lot of rain. And we had issues with weeds going into our fields, because we took fields that were used for hay to give to cows. So there’s a lot of seeds that you need to take out of that land. And we’re doing it with regenerative agriculture techniques, where we don’t use Roundup, we don’t use chemicals.

And sometimes you just sit there and you prepare the soil and then you go into the field and you make it super nice and you plant. And then two weeks later it’s full of weeds. Like hectares of weeds just popping up on top of your barley. And you’re like, yeah, what are you going to do? You try, you go in there first and you try to pull them out, and then you realize the scale of this. It’s impossible, right?

So patience is pushed on you, I would say, in agriculture. And for the whisky, I mean, we’re tasting it. I love whisky. And we have now barrels that are one year old. And these are rye – rye is something that grows very fast, very high, super easy. It’s like a weed in itself if you talk to the farmers. So we had a great crop of rye and we made our first rye last year.

So we were opening up that cask and tasting it now, and it is great. But you can taste after one year the immaturity of the whisky. So I think you have to trust your taste buds and say, okay, this is great. There’s something nice, nice colour, this is the direction I want it to take. But it’s not ready. So you sit on it, you put the cork on top of it, hammer it down, and then just wait again.

And I’m telling people, when is it ready? It’s going to be ready when it’s ready. It’s going to be great.

Robert: Can’t rush it. You’re working 60 acres of organic grain, you’re building your rickhouse, you’re hiring a master distiller, you’re planning a tasting centre. This doesn’t sound like a hobby thing for retirement. This is a full second career. Do you find you’re working harder now than you were when you were running Gurus?

Martin: Definitely. Because at the end, when you build a business, you assemble a team and people know what to do. You’ve got a PMO office, a back office, and a marketing team. And now you’re alone. So I’m like, can I get some help here? I have nobody. So you’re back into entering data in QuickBooks. No, I’ve solved that, I delegated that. But it’s tough.

And the problem is, when I sold the business, I told my wife I’m retiring. And she said, yeah, yeah, you’re retiring. But I didn’t think, and she didn’t think, it would be this intense in terms of running it. And you’re fighting against all the bureaucracy and you have to understand all the rules, environmental rules. And you have to understand, to be a farmer, you have to apply for a permit to be a farmer. So what’s your background, sir? Well, I’m a software engineer. So really, good thing. Do you know about farming? Absolutely not. Okay, what are you going to do about it? Well, I’m going to hire someone. Who is it? I don’t know. Well, you need to get the licence first.

So no, I found someone actually that really helped me and was working in the prairies in Saskatchewan for more than 10 years, working with cereals there. So it’s assembling a team, making it work together, putting all the resources in place so they can succeed. It’s the same thing.

What I like is the manual labour, which you don’t get in tech. I’ve lost some weight. So that’s good, being out there and working with the equipment.

One of the projects we’re working on now – for your listeners, we’re in March and mid-March in Quebec, it’s still very cold, it’s like minus 15 Celsius – so it’s the last time we’ll be able to go in the forest. And what we’re doing is harvesting some trees to plant oak trees. We’re introducing Quercus alba, which is the American oak, into our forest, because we have more forest than we have land. And the goal would be in, I don’t know, 30 years – I won’t be there – to make some barrels, maybe. So again, in that supply chain of getting there. But there’s no more oak in the area. It was all cut down for the lumber industry. So we’re replanting. That’s one of the side projects.

So we’re going to go out with the equipment on Friday and go in the woods and cut some trees. That’s something I didn’t used to do. And that’s what my job involves now. A chainsaw. I’m happy.

Robert: This is what you get to invent for yourself. And if you’re happy, that’s brilliant.

You’re making three types of whisky as I understand it – a single malt, you touched on the rye, and a Canadian bourbon, which is not a concept I’d heard before. Very interesting. I enjoy a whisky, I am not a well-educated drinker. But for those who are listening, what’s the vision of the distillery? What are you going for with the whisky products?

Martin: So we’re looking to develop high-end whisky. We’re talking about $100 bottles. So it really needs to be fine-tuned to the taste of the different products that you build.

When you talk about rye whisky, it’s mainly – the cereal has to be rye. Single malt is just barley. And when you talk about bourbon, or if you talk about bourbon in Kentucky, it’s mainly based out of corn. So we have corn also on the land and we’ve added some wheat that we’ve tried.

It’s a mix of different – they call it a mash bill. So our mash bill, the cereals that get taken into the equipment for the mash to create a beer. We make a beer, then we distill that beer and that’s the whisky at the end. The big difference is the cereals.

So that batch we had, I think it was two years ago, big winter, and we couldn’t get the rye out of our silos because of the amount of snow and ice that was out there. So we said, hey, we have some corn there. Why don’t we make some – it’s all Canadian whisky, right? If you look at the official denomination, it’s Canadian whisky. Don’t confuse marketing with the real stuff. But it’s a mash bill that involves more than 50% corn. In this one I think it’s 65% corn. And it has that – you’ll recognize it if you’re a bourbon drinker – that very sweet, mellow taste of corn that you get into the whisky. That’s what you get from bourbon. So that’s what we’re making with that corn.

Robert: I look forward to trying that, actually. Hopefully someday.

On your website, I love the clan story – the McNicoll ancestors coming over with the 78th Fraser’s Highlanders in 1757, fighting at Louisbourg and Quebec, settling in La Malbaie. And now you’re bringing that Scottish whisky tradition back to Quebec soil. How much of this, as well as the ability to play with the chainsaw and hopefully bring in some casks, how much of this is about honouring that heritage?

Martin: Well, that was a big part. When I started to enjoy more whisky and go back to Scotland, I went back to the land of my ancestors. So that was Portree, close to the Isle of Skye. And there’s another area also, another region, that there’s two big areas that the McNicoll clan were. So I got to visit that.

That was always part of the story. And then as I was publishing some of my content on Scotland, a professor from a university here in the Eastern Townships contacted me. He said, you know, I wrote a book on the McNicoll clan, the whole story. So we started to talk and that became a very nice collaboration between him and the distillery to tell more of the story, to the point where we decided to call the whisky McNicoll. So the whiskies are going to be called McNicoll, with the different types of whisky we’re going to sell.

The brand itself is my last name, which is an honour to this Scot who came to America, really, because they fought down, they went down to New York with the 78th, and the original dude came back north. And my mother has French ancestry – she’s a Chevalier, she’s French, French, French – and then Scottish, Scottish, Scottish. And then there’s a mix. You can see there’s a mix in between those two. And you look at the genealogy, and that professor went back and he found all the ancestors and all the churches here in Quebec and went down to New York, went to Scotland to find all the origins. Very interesting to see the different clans and the French into making our population today.

Robert: Very cool. You touched a little earlier on the bureaucracy and that kind of fun. You went through an interesting fight with Quebec’s Agricultural Land Protection Commission to get permission to build a distillery on farmland. Without getting too deep into the legal weeds, what was that like? And is that a challenge other people thinking about agritourism or value-added agriculture should be ready for?

Martin: Definitely. And doing business in anything that involves food – there are some guidelines and some rules of law that you need to follow, which is, I would say, much harder than to open a NetSuite provider or a NetSuite partner licence. I had offices all across the US and also in the rest of Canada. It was 100 times easier to open an office in California than to start an agri business in Quebec, or even I would say Canada. Some provinces are easier than Quebec, but it was always a challenge.

But I knew I was right. So one thing you learn is that you surround yourself with great people. My lawyers – that’s the thing you can do when you have money, you just lawyer up. But they were great at understanding everything that was going on. I found the expert and this woman knew exactly what was happening. She found some other people that were able to go through it. And we just had to go through all the legwork and convince the commission that what we’re doing is okay. And here’s why.

But it’s a process and it’s frustrating because you’re there and you want to do this project. And you’re like, I’m going to be environmentally friendly. I’m going to do this from the grain to the bottle. I want to do all those different things. And then you see all those obstacles. But I think it’s part of the challenge, going through them and winning. At the end, I won. So that’s what counts.

Robert: It is exactly what counts. So if someone in the channel who’s in a place that you were at when you were with Gurus is listening to this and thinking, I’d love to do something like that someday – not necessarily to be a competitor to you, but to sell the practice, go off and do something completely different, that’s their dream – what would you tell them, having gone through this process as far as you have now?

Martin: I think the fact that they have done it before – starting a consulting firm and running it and dealing with customers – they’ve built their knowledge and their expertise and their resilience into doing anything else. I would always say that implementing an ERP system is the Formula One of computer science, because you have so much complexity. And if you fail, the company can die. They will not operate. Products will not ship. Invoices will not go out. You can cripple a business by doing a wrong implementation.

So I would say you’re really prepared to do anything, in my mind, after the channel, after running that type of business. I think it’s just to look at what you like to do and what’s your ambition and take it head on.

Robert: Good advice. Good advice from someone who has done it and is doing it. And my last and no doubt most important question – when do we get to actually taste the whisky? When do you get to market with your products?

Martin: At least two years. So to be whisky, to be called whisky, it needs to be three years in a cask, in an oak cask. And for us, we just reached our first anniversary in December. So we still have a good two years to go. And we have to decide if we are going to put it in a bottle or not. We’re going to taste it and say, is it ready or not? And if not, I’m just going to sit on it again.

However, we’re coming out with a liqueur that we’re making. It’s a butterscotch liqueur that our master distiller has been developing. And he’s working also on another liqueur that we want to put out, and we’re going to sell locally. Just to get some things out of the distillery with a Scottish-type accent.

Our master distiller has also some Scottish ancestry. He went to school at Heriot-Watt University in Edinburgh to learn about the trade. So he’s got all those ancient recipes of Scottish liqueurs. We’re pulling out of that book to create some interesting products. So that should come in a couple of months, hopefully, if I can get my bottles from China.

Robert: Fascinating stuff. Good luck. It’s been very interesting catching up and it’s always fascinating to hear about the journeys of folks who’ve made a career in the channel and see what they’re doing afterwards. All the best with getting that liqueur out, and the longer term getting those three whiskies out the door.

Martin: Thank you, Robert.

Robert: There you have it – Martin McNicoll, formerly of Gurus Solutions, currently of Distillerie des Cantons de l’Est.

I’d like to thank Martin for his time and honestly for his openness. It’s not every day that someone walks you through what it’s actually like to trade quarterly SaaS targets for fields of organic barley and barrels that won’t be ready for three years.

A couple things that stuck out for me in this conversation. First, the idea that the same muscles that Martin built running a channel business – the acquisitions, the growth planning, the systems thinking – are the same muscles he’s using to build the distillery. Different industry, same instincts. I think anyone running a channel practice will recognize themselves in that.

And second, the patience piece. Martin talked about planting trees today for barrels he won’t use for 30 years. That’s a fundamentally different relationship with time than most of us have in the tech world. And I think that’s something worth sitting with.

If you want to learn more about what Martin’s building, you can find the distillery at distilleriedescantons.ca, and we’ll have a link for that in the show notes. Keep an eye out for the butterscotch liqueur, which should be available before the whisky is.

If you enjoyed the episode, do me a favour – follow or subscribe wherever you’re listening, whether it’s Apple Podcasts, Spotify, YouTube, wherever else you find your podcasts. And if you’re feeling generous, a rating or review goes a long way for a small show like ours.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

When Cisco CEO Chuck Robbins told investors the campus and data centre refresh is at “the top of the first inning” of a multi-year, multibillion-dollar opportunity, it raised an obvious question for Canadian partners: what does that inning look like here?

Erin Gertner, vice president of the Partner Organization and SMB Sales at Cisco Canada, says Canada is tracking with the global trend – and that the opportunity is being driven by a “perfect storm” of three converging forces: the largest last-day-of-support (LDOS) wave Cisco has seen in years, growing urgency around AI readiness, and increasing pressure around data sovereignty.

The AI readiness gap is particularly striking. Only 7% of Canadian organizations say they’re fully prepared to deploy AI – down from 9% the previous year – while 96% say the urgency has increased. That tension is creating real opportunities for partners who can lead with outcomes rather than product.

Gertner says the partners winning the biggest deals are those taking a consultative approach – running assessments, broadening the conversation beyond a like-for-like swap, and helping customers understand their full security and AI readiness posture. In one example, a security assessment nearly quadrupled the deal size compared to a straight hardware refresh.

The conversation also touches on where vertical demand is hottest (financial services and healthcare are leading), how the Secure AI Factory with NVIDIA translates for mid-market partners, the role of data sovereignty in driving on-prem modernization, and what smaller MSPs should be doing to get in the game. Gertner’s advice to partners who haven’t started? Reach out to your Cisco partner account manager or distributor and get access to the PXP data – the opportunity is there, and Cisco wants to make it easy to find.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and as always, your host for the show.

On Cisco’s most recent earnings call, CEO Chuck Robbins called the campus and data centre refresh the top of the first inning of a multi-year, multi-billion dollar opportunity. Double-digit growth in networking, six consecutive quarters. But that’s the global picture. What does the first inning look like in Canada?

My guest today is Erin Gertner, VP of the Partner Organization and SMB Sales for Cisco Canada. Erin sees what she calls a “perfect storm” converging right now – a massive wave of aging infrastructure hitting last day of support, growing urgency around AI readiness, and increasing pressure around data sovereignty. We get into what Cisco Canada is seeing on the ground, where partners are finding the most traction, and what separates the ones winning those deals from the ones leaving the door open for somebody else.

Let’s get right into it. My chat with Erin Gertner.

Erin, thanks for taking the time. I appreciate it.

Erin Gertner: Thank you so much, and thank you for having me, Robert. It’s nice to see you.

Robert Dutt: Nice to see you as well. It’s been a little while since Partner Summit when last we sat down, but I wanted to chat because of Chuck’s comments on the earnings call, talking about the top of the first inning on a multi-year, multi-billion dollar opportunity around campus refresh. Double-digit growth in networking for six consecutive quarters. That’s the global picture. I guess to throw it open, what does that top of the first inning look like from where Cisco Canada sits? Are we tracking with the US on this one? Are we still back in spring training? What does the Canadian opportunity look like in this moment?

Erin Gertner: I think we’re seeing something very similar to what Chuck spoke about on the earnings call. We are seeing a multi-year, multi-billion dollar refresh cycle taking place here in Canada. And I think it is the perfect storm of three things coming together.

One, we have a lot of aged infrastructure out there. Sometimes we call it last day of support, or LDOS. When we look in our portfolio, we’ve got the largest LDOS opportunity that we’ve had in many, many years this year and next year. We’ve been working with many of our partners as well as our account teams to start going out and pursuing those opportunities because we really do need to get in front of them.

But we’re also seeing the dynamics of a few other things taking place. One is AI readiness. I think you probably heard in our earnings call, Chuck talk about the success that we’re having in AI. A lot of that today is really centred in the world of the hyperscalers. In our last earnings call, I talked about doing over $2 billion worth of infrastructure with the hyperscalers. So there’s this huge influx of demand around AI. But where we haven’t really scratched the surface is AI in the enterprise. The hyperscalers are very well prepared, but now we’re starting to see this big wave of enterprise deployment, or at least enterprises thinking about the use cases and the ROI, because it is a board-level conversation.

And then lastly, and this is probably a topic you hear a lot about working in Canada, is around digital resilience and data sovereignty. You need a modernized, secure network in order to deploy AI, and the network is more critical than it’s ever been as you think about the role it’s going to play in the next few years. The ability to fuse together security into the network is really unique and core for Cisco and driving refresh.

I often talk to partners about the LDOS opportunity, and we used to get the question a lot of, “Why would a customer upgrade?” or, “How do I have this conversation with a customer?” because their response is often, “It all still works. Why bother?” I think AI especially is really giving them that reason to modernize, because while their network may work, it wasn’t necessarily built to run the applications that they’re going to need today and in the future. So it’s a really compelling conversation, and we’re seeing huge uptake and demand in networking.

Robert Dutt: You touch on the customer size, especially on the AI side of things. Looking across the Canadian market in terms of customer size, vertical, geography – is the refresh opportunity relatively evenly distributed, or is it concentrated? Where’s the heat at right now?

Erin Gertner: It’s been interesting. All of our account teams, some of which are verticalized, others which are organized geographically, talk a lot about where they’re seeing refresh opportunity.

A great example is what we’re hearing from financial services organizations. We had that long period of COVID, and then there’s been a ton of conversation around return to office. Our financial services team will tell you that there’s massive demand because if you listen to what the banks or insurance companies are doing, they’re asking people to come back to the office. Those networks, many of which were built in 2018 or 2019, can’t support the applications that are being driven in today’s world. They can’t even support the number of people they have anymore. [A lot of those organizations saw a boom.]

So there’s a huge network refresh taking place right now in that specific vertical. We’re also hearing a lot about mission-critical verticals like healthcare, where uptime is hugely important and security and resilience are top of mind. But it’s really spread throughout. Many companies had a long period of time where they spent a good majority of their budget on work from home and getting people set up for different use cases. Now that we’re living in this hybrid world, or a lot of organizations are back to work, that’s putting a huge change in demand on what is being asked from the network, plus everything that’s happened from the AI perspective.

Robert Dutt: You bring in a lot of different threads in terms of things that are driving this – AI readiness at the top of the list, aging infrastructure, data sovereignty, security modernization, probably a few more. What’s actually leading the charge in this moment for the conversations you’re having with Canadian partners and customers? I’m curious if one of those things is the leader and the others follow, or if there’s really a convergence where this is a big pile of conversation topics at the same time.

Erin Gertner: I think it’s a big pile of conversation topics at the same time, and it also depends on the partner you talk to and how they’re approaching a customer. Every partner has got a really interesting and different approach, especially when it comes to AI, and I love that about our partner community.

A lot of them are taking, for example, an advisory services-led approach, or they’re taking the approach of – I hate this expression, but it’s one that makes sense – eating your own dog food. I was with a partner last week and they were talking about a lot of the work that they had done to embed AI into their own workflows. Then they were taking their success out into the market and starting new conversations with customers they hadn’t historically had access to. All of that was leading to a network refresh conversation, because customers are excited about the opportunity with AI, and then the partner was able to embed the question around, “Well, are you ready? Do you have the right infrastructure in place?”

The conversation often is bigger than that, and obviously security is a huge area of concern when it comes to AI. I think that’s where Cisco is very uniquely positioned to win in this space. We’re seeing a lot of our competitors try to bring network and security together, and we’re really the only organization who can truly embed network and security together and then traverse it from the campus to the data centre.

Robert Dutt: To your point on dog food, I learned from a partner years ago that the way to phrase it is “drinking one’s own champagne.”

Erin Gertner: Oh, I like that expression a lot better. Thank you for that.

Robert Dutt: Let’s talk about the AI side of things. Cisco’s own AI Readiness Index showed that 7% of Canadian organizations feel they’re fully prepared to deploy AI, and that’s actually down a couple of points from 9% in 2024. 96% say it’s more urgent than ever. That’s a pretty big gap. How’s that tension showing up in the conversations that partners are having with their customers?

Erin Gertner: I’ve spoken to a lot of partners in the last little while, and again, each are taking a very individual approach. I think leading with outcomes and that consultative mindset – and it looks very different for each partner – but they’re all trying to understand what outcome a customer is trying to deliver, or what is the ROI, or what is that metric that’s going to help move a CEO’s agenda forward, or help them understand how they can build a true business case to build out a full AI deployment.

It’s hard, right? We’re going through our own transformation at Cisco. We’ve got a team of individuals who work with us internally building out our AI workflows, and even on my own team, we’re trying to do all these things to help our team adopt AI tools to make their lives easier and more efficient. You often hear that somebody’s job is not going to be taken by AI – it’ll be taken by somebody who knows how to use AI. It is even more critical than ever that organizations figure it out.

A lot of our partners have deployed some interesting things for themselves or worked through really interesting consulting engagements where they have use cases they can take out to market and help customers build that business case for themselves. They need to start small, they need to define what success looks like, and I think many customers have a long road there, but there’s certainly hope that we’re headed in the right direction.

Robert Dutt: Raj, the president of Cisco Canada, wrote an op-ed recently saying that Canadian businesses risk – I think the quote was – “Blockbuster-style failure” without having the right AI infrastructure. For a partner who’s sitting across the table from a customer who feels that urgency but hasn’t really started yet, what do you counsel that partner to advise the customer on? What’s the practical starting point? Where do you begin?

Erin Gertner: It’s tough. Again, it depends what type of customer they are and what their use case looks like. But I think for that customer, it’s really leaning back to outcomes – what is going to demonstrate success for that organization? The last thing you want anybody to do is go out and deploy an AI application and see absolutely no success out of it. That will move that executive’s agenda back probably a couple of years.

But we are also really encouraging partners to talk through: Are they ready? You can have the best use case out there, but do you have a good data strategy? Do you have a good security strategy? Have you thought about modernizing your network? Is sovereignty important to you? And if it is, do you want to start thinking about potentially building that on-prem, or taking a different approach than maybe what you have historically done, because there are new considerations being layered on top of all of that.

Robert Dutt: Talk to me about the Secure AI Factory side of things. Tim Coogan called it the partner opportunity of this year. I’m curious how that translates practically for Canadian partners. Is this a play mostly for the big SIs, or are you finding mid-market partners who are finding a role in the AI infrastructure buildout?

Erin Gertner: I think it’s a little bit of both. We’re having conversations around Secure AI Factory with some of our largest partners because it is really unique. Our relationship with NVIDIA is truly one of a kind, and we’re actually creating products together. I know everybody has done a great job of partnering with NVIDIA in the market, but our relationship with them is a little bit different.

What I love about the whole notion of Secure AI Factory is the fact that it’s everything built together. We make it really easy. We’ve pre-built all the CVDs. We’ve essentially created a blueprint for partners and customers to go out and deploy an entire AI pod. That includes everything from networking to servers to security to observability. We can even include storage, even though we don’t make it – we’ve got a bunch of great storage partners.

Is it going to work for a small customer being serviced by a small partner? Probably not. It might be outside the scope of what they’re doing. But for mid-sized customers who are running interesting workloads and they want them on-prem, and especially for bigger customers who want to scale and deploy really quickly, or partners who have a ton of depth and capability in that space, the Secure AI Factory is a great solution.

Robert Dutt: For a Canadian partner who’s looking at this refresh opportunity, where are you seeing the most traction in terms of the technology stack? Is it campus switching, data centre modernization, Wi-Fi, security? What’s the entry point that’s helping partners produce pipeline right now?

Erin Gertner: We’ve done a lot of work with partners. We’ve got a tool called PXP – I think you’ve probably had some exposure to it – but we’ve been doing quite a few workshops with our partners to help them understand where their opportunity is. PXP does a great job of being very data-rich and data-centric. As we go through the enablement with partners, it gives them a good sense of what their refresh opportunity looks like.

Then we are trying to make sure we enable them around the broader conversation. You don’t want to just be refreshing a switch for a switch. Our best partners are taking that data and – again, to your question, some partners, let’s say their history was really in the data centre – data centre networking is probably their biggest opportunity because that’s where they’ve sold the most in the past. For more broad-scale partners, it could be a combination of two or three different things.

What we’re really trying to coach them to do is take that opportunity and don’t refresh a switch for a switch. Help the customer understand what outcome they’re trying to achieve. Do they have the right security posture? What’s their Wi-Fi strategy? What’s their device strategy? We’re trying to help them take that data and broaden the conversation into something that’s more outcome-driven. Our best partners are doing an excellent job of that and building really big, interesting deals alongside their customers.

Robert Dutt: In doing that, when you’re looking at the services layer, are there any particular areas that you find are especially productive? Assessments, design, migration, managed services post-deployment – where are partners getting the most return from focusing their energy?

Erin Gertner: Consulting services has been a huge one. We’ve got a great assessment program and we have some partners who are doing a great job leveraging it and seeing a ton of success. I was in a partner QBR the other day and they were giving an example of having done a security assessment with a customer that significantly broadened the scope of the deal and helped the customer understand where they had some vulnerabilities in their current infrastructure. That deal almost quadrupled in size. Partners are doing a great job with that.

What we’re really trying to encourage partners to do is make sure we’ve got an adoption plan for every software deal out there upfront, because we want to make sure anything our customers buy from our partners, they have a great experience with. If they aren’t doing a good job of adopting that and showing value all the way throughout the chain, we’re not going to see a renewal at the end.

The other thing we’ve been talking a lot about with our leadership team is some of what’s happening in the industry right now with some of the shortages that are industry-wide. In COVID, we saw something similar happen – a lot of supply chain constraints. Then there was this really long ingest period that happened afterwards because customers just had so much technology. We are really encouraging our partners and our teams to make sure we’re leading with services, so there is an outcome attached to the end and there is a plan with the customer to consume the technology so they can get the most out of what they’ve bought from us.

Robert Dutt: We talked a little bit about the big guys, the SIs, and the opportunity around AI Factory. For the smaller partner, that long-tail 15-to-20-person MSP that’s living in Meraki and maybe doing some security, is this a real opportunity for them, or is this fundamentally a larger VAR and SI play? Where it is accessible to that SMB-focused partner, what does the on-ramp look like?

Erin Gertner: It’s absolutely accessible for that SMB partner. I also have the SMB part of our business, so this conversation is very close to my heart.

Given the IT skills shortage that is very dominant in the Canadian market, we are seeing a lot of customers who don’t want to manage their own network. As customers grow – let’s say they were a very small customer four or five years ago and they chose more of a consumer-grade solution at that time – as they want to move into a more enterprise-type solution with security and all the other bells and whistles embedded in it, a lot of those customers are choosing not to manage that themselves. But they want to be in the same place as their competitors, because the expectation is they grow and scale just as fast, probably faster in fact, as a big company.

A lot of those companies are born in the cloud, leveraging tons of cloud applications, so the way they create their foundation is even more critical than ever. We have a bunch of great small to mid-size partners who are doing awesome things in that space and growing pretty significantly, actually gaining a lot of market share because of their agility and their ability to manage something at a cost-effective price.

Robert Dutt: You mentioned the importance of data sovereignty in the conversation. The federal government has launched a call for proposals for sovereign AI data centres of over 100 megawatts, and we’ve seen Cohere get a lot of federal backing for their data centre build. Is data sovereignty a driver in this enterprise refresh, or is it a parallel conversation that’s happening at the same time?

Erin Gertner: I think it’s a bit of a parallel conversation, but it’s certainly driving a huge – not even refresh – just huge modernization effort. A lot of it is centred around Canadian organizations who are worried about data sovereignty, or who are worried that sovereignty requirements might hit them in the next few years. They’re trying to prepare themselves by building out new types of data centres on-premise – new data centres to support applications coming back on-prem.

While maybe they haven’t built everything on-prem today, we are seeing a massive surge in companies starting to think about what that might look like. For customers who had almost all of their applications in the cloud previously, their data centre network didn’t necessarily support the low-latency, really high-bandwidth requirements that would come into play if they start putting mission-critical applications back on-prem.

We are seeing a lot of customers starting to think about what they would need to build to support sovereignty requirements, or if they’re going to continue to live in a hybrid world – which, let’s be honest, the majority of Canadian organizations are probably going to live in that world, and that’s all good – the network they have today probably doesn’t support that in the way they’d like either.

Robert Dutt: Let’s talk about what you’re doing to support partners through this process. What are the incentives, enablement resources, the programs that are particularly relevant to Canadian partners who are looking at this opportunity and going after it?

Erin Gertner: I think we’ve been pretty declarative about wanting to be the critical infrastructure for the AI era. We’re doing a lot of enablement with our partners. We’ve aligned our incentives, both front-end and back-end, to this opportunity. We’re doing a lot of workshops to help our partners understand where those opportunities lie and help them understand how to go out and capture them.

We’ve also been running a lot of demand generation alongside our partners around our AI strategy, what that looks like, as well as showcasing the innovation that Jeetu has put forward in our portfolio around network and security coming together, because I do think it’s a great story and one that maybe not everybody knew. Some people probably think we’ve still got two different platforms with Catalyst and Meraki, where the truth is those have come together in the last year.

With our acquisition of Splunk, there’s a lot that’s been infused into the network. Jeetu has also done a fantastic job of creating a really innovative security portfolio, a lot of which is actually embedded into the network layer. So there’s been a lot of education that we’ve had to do with both our partners and our customers to make sure they’re able to go out and tell that story to the market. I think Tim Coogan said this best – our job is to create that innovation, and then our job is also to help enable our partners to go out and be an extension of our sales force and help them deliver value to customers based on that innovation.

Robert Dutt: What do you see as separating the partners who are winning these refresh deals from those who aren’t? What are the best partners doing differently?

Erin Gertner: Again, I think really leading with that outcomes-based conversation and not just doing a like-for-like refresh. The ones who are going out and really taking a consultative approach, they’re winning a lot more and they’re winning much larger deals. I was on with a partner yesterday who was showcasing some of the work they’d been doing around AI and sharing with us some of the success they had just recently had, and they’re winning amazing deals by taking a very consulting-led approach.

What we have seen in the past from certain partners is they go in and focus very much on that refresh opportunity, and then they almost leave the door open for another partner to come in and have a conversation around networking, observability, and all the other aspects around that critical infrastructure. So the best partners are the ones who are leading with the whole portfolio.

I know we’re going to talk about 360 as well, but we’re really trying to incentivize our partners to build a lot of skills and technical depth around our solutions, and the ones who are really good at being able to tell the story of how our whole portfolio comes together – that “One Cisco” story that we often talk about – they’re the ones who are winning the most.

Robert Dutt: If I’m a Canadian partner listening to this and I haven’t really started leaning into that refresh opportunity yet, what should I be doing about this on Monday morning when I show up to work? And looking further out, we’re in the top of the first – what do you see the second and third innings looking like here in Canada?

Erin Gertner: Firstly, reach out to us. However you engage with Cisco, whether it’s through one of our distributors – who are amazing and have access to all of our tools – or reach out to your partner account manager at Cisco. We can provide all the training required on how to have the right conversation, as well as access to all the data you need to help you figure out where you should start and which customers are due for a refresh or have a refresh opportunity in the next six months. We can make it really easy for our partners to know where to spend their time and get a pretty fruitful payoff, both on the front-end and the back-end with us.

What do I think the second and third innings might look like? I think we’re still really at the infancy of that. We’ve seen a few customers go down the refresh path – probably our largest customers have gone down the refresh path. Some of them have modernized networks or they’ve gotten to where they think they need to be to support AI applications. But I do think we’re going to see some of our smaller customers start to catch up.

I also think we’re still really at the infancy of the success of AI. We talk a lot about the role of agentic AI and how that’s going to proliferate through organizations in the future. I don’t know that many customers have figured that out yet today. There are some who are really at the edge of innovation and who’ve done an amazing job with that, but it isn’t mainstreamed yet. As agentic AI really starts to roll out, the demands on your network and the demands around security especially become even more complex and even more critical.

I think that’s going to be the next wave. A lot of companies have done a good job of finding one or two use cases, maybe small ones, that have delivered value for them in AI. But there are very few organizations – and we talked about it through the AI Readiness Index – very few organizations who have really found tremendous value from AI today, but they will in the future.

Robert Dutt: I think you’ve done a great job of setting up the game for Canadian partners here. Good luck with the rest of the ballgame, and thanks so much for taking the time.

Erin Gertner: Thank you.

Robert Dutt: There you have it, Erin Gertner from Cisco Canada. I’d like to thank Erin for her time on this one, and thank you for listening.

A couple of things that stood out to me. First, how strongly the consulting and assessment-led approach is paying off. Partners who are going in and helping customers understand the full picture – security, AI readiness, network modernization – aren’t just winning deals. They’re winning deals that are three and four times the size of a like-for-like refresh. And the other is something Erin said that I think is worth sitting with: there’s no AI without a network. Simple statement, but it reframes the entire refresh conversation for partners who aren’t sure where AI fits into what they do.

If you’re enjoying In The Channel, you can find us on Apple Podcasts, Spotify, YouTube, and most podcast directories. Follow, subscribe, leave a rating or a review if you’re feeling generous. It all helps.

Till next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

RSA Conference 2026 produced hundreds of announcements from San Francisco’s Moscone Center this week. We curated the ones that matter for Canadian IT channel partners into three themes: agentic AI as the new attack surface, identity and hardware resilience, and partner economics.

The big theme: agentic AI is the new attack surface

The dominant message from RSA 2026 was clear — AI agents are a brand new attack surface, and the security industry arrived with its first wave of answers.

Identity and resilience

And here’s what you can sell

Further reading

Hello and welcome to a special midweek edition of In Case You Missed It from ChannelBuzz.ca. I’m Robert Dutt, and this week, RSA Conference 2026 took over San Francisco’s Moscone Center. Hundreds of announcements, dozens of press releases, and a whole lot of noise. So we went through the pile and pulled out what we think actually matters for Canadian IT channel partners. Let’s get into it.

If there was one defining message from RSA this year, it’s this: the AI agents your clients are starting to deploy? They’re not just productivity tools. They’re a brand new attack surface, and the security industry just showed up with the first wave of answers.

Cisco made the biggest splash, extending their Zero Trust framework to treat AI agents as a new identity type. Their pitch: if an AI agent can browse, query, and act on behalf of a user, it needs the same visibility, access controls, and real-time monitoring as any human on the network.

CrowdStrike came in heavy across multiple days. Their Next-Gen SIEM now ingests Microsoft Defender for Endpoint telemetry with no Falcon sensor required — which is a big deal for MSPs managing mixed Microsoft environments. They also launched Shadow AI Discovery, which finds unauthorized AI applications running across client environments. If you’ve ever had to track down rogue SaaS subscriptions, imagine that problem, but with AI tools that can actually take actions on behalf of employees. CrowdStrike also introduced Agentic MDR — managed detection and response that operates at machine speed against AI-driven threats.

Proofpoint went after the same problem from the email and collaboration side, launching their AI Security platform and Agent Integrity Framework. Their angle: securing the “agentic workspace” where humans and AI agents are operating side by side across email, cloud, and collaboration tools like Teams and Slack.

And Black Duck brought their Signal platform to general availability — agentic application security designed specifically for AI-generated code. When your developers are using AI to write code, who’s checking the AI’s work? That’s the gap Signal is designed to close.

They weren’t alone. Arctic Wolf launched what they’re calling the world’s largest commercial agentic SOC. Darktrace rolled out a managed email security offering for MSSPs. Huntress expanded their identity threat detection to Google Workspace. The message from the industry was unanimous: agentic AI security is not a future problem. It’s a right-now problem.

If you’re advising clients on AI adoption, the security conversation just got significantly more complex. And that complexity is an opportunity — because your clients are going to need help navigating it.

RSA — the company, at their own conference — made two announcements that pulled in opposite directions, and that was the point. They launched ID Plus Sovereign Deployment — fully air-gapped, on-premises identity security for environments where cloud is not an option. Think regulated industries, government, anyone with serious data sovereignty requirements. For Canadian partners dealing with OSFI E-21 or federal procurement, that’s directly relevant.

At the same time, they announced an expanded Microsoft partnership around M365 E7 and passwordless authentication. So RSA is going both directions: as sovereign as you need on one end, as deeply cloud-integrated as you need on the other.

On the hardware side, Dell announced quantum-ready commercial PCs with post-quantum cryptography built into the firmware, AI-powered ransomware recovery for their PowerProtect line, and an extension of their managed detection and response service to cover AI data platforms like PowerScale. HP made a similar hardware security move from their own event in New York this week, launching TPM Guard to protect TPM-to-CPU communications from physical attacks. The common thread: the security conversation is moving below the operating system and into the silicon.

Two announcements that translate directly to partner economics.

Barracuda — a hundred percent channel company — advanced their BarracudaONE cybersecurity platform alongside updates to their Partner Success Program. Platform investment and partner investment at the same time. That’s the kind of announcement that tells you a vendor is serious about the relationship, not just the product.

And Sectigo launched a new partner platform built around the reality that SSL certificate lifespans that are already shrinking and headed to 47 days. When certificates need to be renewed every 47 days instead of every year, that’s either a massive headache or a recurring revenue opportunity. Sectigo is betting that partners who automate the process will turn a compliance burden into a managed service.

That’s RSA Conference 2026 through the Canadian channel lens. Agentic AI security dominated the conversation. Identity and hardware resilience matured. And a couple of vendors made moves that directly affect your bottom line. Links and details for everything we covered are in the show notes. We’ll be back on Monday with the regular edition of ICYMI. Until then, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Rob Scott, co-founder of Monjur and managing partner at Scott & Scott LLP, joins the podcast to talk about what’s broken in the average MSP’s contract stack and what it takes to fix it. Rob has spent more than 27 years at the intersection of technology and law, and his firm works with over a thousand managed service providers across North America.

The conversation covers the three biggest areas of contract risk Rob sees across the MSP community: agreements that haven’t kept pace with the services being delivered, unaddressed vendor and third-party liability, and missing data processing agreements in an increasingly complex regulatory environment. Rob walks through practical provisions most MSPs don’t have but should, including a “security recommendations” clause that shifts liability to customers who decline recommended protections.

Rob also digs into why AI is changing the contracting equation in both directions – from the new service attachments MSPs need when delivering AI-powered services, to the risks of using unsupervised LLMs for contract drafting – and offers a candid assessment of where Canadian MSPs stand relative to their American counterparts when it comes to contracting maturity. The conversation wraps with a practical starting checklist for MSPs who know their contracts are out of date but don’t know where to begin.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show.

My guest today is Rob Scott. Rob is the co-founder of Monjur and managing partner at Scott & Scott LLP, where he’s spent more than 27 years at the intersection of technology and law. His firm works with over a thousand managed service providers across North America on their contracts, and he recently launched Monjur Pilot, an AI-powered legal assistant built specifically for MSP contracting.

Now, I know what you’re probably thinking – contracts aren’t exactly the sexiest topic in the channel. But here’s the thing. Most MSPs, I think, know their contracts are out of date, and they also know that they should do something about it. They just don’t. And in a world where the threats are evolving, AI is changing the service landscape, and the regulatory environment, particularly here in Canada, keeps getting more complex, the gap between what your contracts say and what your business actually does is becoming a real liability. Rob has seen what happens when that gap catches up to you, and he’s got some very practical advice about what to do about it.

Let’s get right into it. My chat with Rob Scott.

Rob, thanks for taking the time. I appreciate it.

Rob Scott: Thank you for having me.

Robert Dutt: You’ve been working with MSPs on their contracts for, I think it’s over two decades. What’s the state of the contract stack for the average MSP in 2026, and how wide is the gap between what most MSPs are actually running on and what they should be running on?

Rob Scott: That’s a great question. When I look at contracts, I see three big areas of risk for MSPs. One is that their agreements don’t keep up with their services. In the MSP world, that means you’re offering compliance advisory services without proper compliance advisory contracts. We call that service attachment for managed compliance. You’re now working with clients in and around AI and AI products, which are using a pre-AI customer contract. These are the things that change with frequency in IT, and for MSPs, that means one area of contract protection – static agreements don’t fit with emerging service offerings like tech.

Sometimes their agreements don’t keep up with their services, and other times, their agreements are not reflected for trends in the marketplace or specific risks. For example, ransomware attacks or emerging cybersecurity risks. MSPs don’t frequently have, for example, very clear-cut exclusions from responsibility for the criminal acts of third parties. Similarly, their contracts don’t limit their liability for acts or omissions of vendors. We monitor the terms and conditions of over 1,200 vendors in the MSP channel, and our clients get their customers to sign a waiver for any acts or omissions of those third parties. That’s an area – what I call vendor risk – which many MSPs are exposed.

Then the third big category is regulatory risk, operating with customers in regulated markets without the appropriate data protection agreements and data processing agreements that are required by both international, federal, and state laws. Those are the areas where most MSPs have been underserved by traditional legal services, which have caused many to move in the direction of do-it-yourself, which has many exposing themselves to unsupervised LLMs. While contracting for MSPs is very complex, they really have not been well-served by traditional legal services.

Robert Dutt: The open LLMs is what keeps me up at night. Shadow AI is a concern for lawyers, or at least us, as much as it is for MSPs. Shadow AI in their customers’ organizations, us for different reasons. But the MSPs are faced with a challenging choice between choosing fast and inexpensive do-it-yourself legal protection that lacks accountability and supervision, or traditional legal services that can be slow, can be expensive, and can be out of touch with what MSPs do. Many of my clients have shared stories about interactions with lawyers, not fondly, in part because the lawyers had no clue what they did, and they felt like they were paying the legal fees to explain to the lawyers what an MSP does.

Rob Scott: And so it’s been a challenge for many MSPs to get legal protection that’s both fast, affordable, and offered by MSP-specific attorneys.

Robert Dutt: You touch on the problem of keeping up with technology trends. I’m thinking in broader terms than that. What about whole directions of risk, I guess I would say. The example I think of is we’re doing a lot of tracking of the trend of abuse of trust. Attackers not breaking in, but logging in through trusted identities, VPNs, software supply chain attacks, those kinds of things. Basically, when the threat itself has shifted so fundamentally, how far behind are most MSPs in terms of accounting for that in their contracts?

Rob Scott: I would say very far behind. I would say overall, the customers that we talk to, the people we meet, are either on some do-it-yourself approach that really hasn’t been updated by an experienced attorney, or hasn’t been updated recently to reflect the emerging threat landscape as you described it. But we’re constantly updating our agreements to properly reflect detailed terms and conditions about these emerging threats.

And I’ll give you an example. We have in our MSA a provision called security recommendations. And what that provision says is the MSP may from time to time give the customer recommendations about security compliance. For example, multi-factor authentication. And if the client does not accept or move forward with those proposals, anything that happens as a result that those things could have prevented is 100% on the customer – the MSP is off the hook.

And so when I think about emerging technology and the changing threat landscape, a lot of it has to do with how you manage the communications and the risk associated with that. And MSPs have had the hard choice in the past of having to either tell a client, “No, I’m not going to support you,” or, “Hey, I’m going to give you this waiver to sign.”

And this whole topic of declination of services around point solutions that deal with emerging threat factors has been a common issue with MSPs. They go to the customer. They’re like, “You’re exposed. You need these advanced security features.” I mean, there’s new stuff all the time, but right now, it’s a lot of focus on zero trust. And so it’s not inexpensive to implement a zero trust model within a business. And if an MSP wants to implement zero trust, the customer has to cooperate to buy those things. And the customer doesn’t understand them well enough to know what they do or why they need it. So their first reaction is to say, “No, it’s too expensive.” And that puts the MSP at risk, because I tell the MSPs, my opinion is their network is only as strong as its weakest link. So if you let these customers on that you know are overly risky, that puts the whole portfolio of customers at risk.

And that’s a lot of what you’re talking about with those threat vectors. Those threat actors are thriving on being patient. And it’s not just like, “Do we have guards at the front door?” It’s like, “We need guards in every room.” They’re already in. So that’s one of the things that I think most people think about. Cybersecurity is like hacking events or ransomware events, but so much more of it is they’re in your networks, they’re able to move around, they’re squirreling their way into different areas, and they’re being very patient waiting for that opportune moment. And so it’s not just about keeping people out, it’s also about catching them after they get in. And that’s where a lot of these emerging technologies and emerging threats are posing unique challenges from a cybersecurity perspective.

And the question is, “How are your agreements evolving?” And that’s where making sure that your vendors are all on there. So if there’s any act or omission of a vendor, that you can be covered for it. And the things that happen in cybersecurity, like criminal acts of third parties, is expressly excluded. I don’t think you need to go into as much of the specific threats. If you get a strong and enforceable exclusion against the criminal acts of third parties, almost every cybersecurity risk that would be impactful to an MSP is also a criminal act by the person who perpetrates it.

Robert Dutt: About a year ago, you did a piece around the theme of “Your MSA is broken and AI is to blame.” We’re a year further in, things have only accelerated. MSPs are selling Copilot bundles, offering AI-powered services. Their customers are deploying AI tools whether the MSP knows about it or not. From the customers’ point of view, how far behind are most MSP contracts relative to the AI services that they’re delivering or their customers are using today?

Rob Scott: We came out with a special service attachment for managed AI in 2024. And at that time, people said, “I don’t really need it. We don’t know what we’re doing yet.” Today, people come to Monjur just because of that attachment.

And the way that attachment is built is, number one, you don’t have the right definitions in your current agreement for things like AI input, AI output, the model, the trainings – all of these things that are relevant to AI that wouldn’t be in a master services agreement for managed services. Beyond that, you need your service descriptions. Is this AI readiness assessments? Is this app dev? Are we building RPA and automations? What is it exactly that the services entail? And so that’s a big part of it. And our structure is designed to cover just about every AI service that an MSP could do.

But it’s also important to make sure that you have the proper exclusions and client obligations. So when you think about exclusions, it’s like the MSP shouldn’t be responsible if the legal world changes and suddenly that client’s use becomes illegal. Think of helping customers deploy voice agents. And then it becomes clear that you can’t use a voice agent to do cold calling, or voice agents get outlawed altogether. It needs to be clear that the MSP is not taking the responsibility for how government reacts to the impact of AI.

Similarly, there should be an obligation on the customer’s part to be committed to ethical use of AI. Responsible AI is something that I put in as a mutual obligation to all parties to a contract that I write around AI. I think it’s foundational for humans to be committed to responsible AI.

So there’s things – just a few examples – but things that you wouldn’t see in an MSA. So ask yourself, why would you expect your pre-AI MSA to protect you in an AI world? The answer is MSPs increasingly are offering AI-related services under contracts that weren’t built for these services, and those that are, are putting themselves at significant risk. And it’s not necessary, because there is a ready-made solution for MSPs to protect themselves when engaged in selling Copilot, helping clients with AI projects, which we’re all going to be doing.

Let’s get it straight. This is not new. This is not a temporary blip. I think the only temporary part of it is this AI distinction. I don’t think there will be, in the long run, a distinction between AI tools and non-AI tools. All tools will be AI. So the way things are going, MSPs need to be prepared for that. All of what so many more MSPs are now in the territory where they would be protected by a specific service attachment that doesn’t exist in their contract stack today.

Robert Dutt: The other side of that equation of AI use in the MSP is that a lot of MSPs themselves are tempted to use some of the generic LLMs to draft or review their own contracts. Where do you see the line between that being helpful and that being dangerous?

Rob Scott: I don’t think MSPs should be forced to choose between using AI and using attorneys. I think that’s the state of the market today. They’re faced with these unsupervised LLMs that are risky, where there’s no accountability. They’re telling you, “Don’t use this for law,” and you’re using it for law. If you have a bad outcome, whose fault is it?

The New York State Senate has got a Senate bill, which I think will be the first of many, that would make it illegal for LLMs to give out legal advice, because it’s doing way more harm than good. I think the one thing to think about the perspective on this is lawyers are getting sanctioned and held in criminal contempt for using AI, and the AI is making mistakes. If it’s going undetected by the lawyers, why do you think you’re in a position to supervise the AI to protect your legal interests?

I mean, it gets it wrong so much. The accuracy of legal outputs from unsupervised LLMs is so low that it is like playing Russian roulette. So I don’t blame the MSP. I just think that the future is attorney-supervised AI, where the customer starts with a template that is lawyer grade. I think if you put Monjur Pilot up against these unsupervised LLMs and you draft an agreement starting with a Monjur template versus starting with nothing and an unsupervised LLM, your first pass is a totally different thing.

And then the second thing is lawyers need to be in the loop at the last mile. You should be able to press a button within your AI and say, “Submit for legal review,” and the lawyer should be able to just look at it in-app and finish what you built. So you start with a legal template that’s legal grade. You operate in a legal-grade AI environment that has the proper guardrails, and you make sure that attorneys supervise all of the work that the clients are doing, so that the MSP no longer has to choose between fast and inexpensive and slow and sometimes cost-prohibitive.

So we think that AI unlocks something pretty special for the Monjur subscriber, which is the benefit of having your lawyers at your fingertips 24/7 through a trained AI legal assistant. But that’s not a replacement for your lawyers. It just supplements your relationship with your lawyer. So in this way, we deliberately call them legal assistants because they play the same role as a legal assistant in a law firm. The legal assistants don’t practice law without the lawyer supervision. They help the clients get better service from the lawyers.

And that’s the role of AI in the Monjur vision, which is attorney-supervised LLMs that provide a safety layer on top of the LLM of your choosing. So our system is called “at any LLM,” but in each instance, we’ve implemented prevention of hallucination and preservation of context through RAG architecture that allows our legal assistants to give responses that the lawyers feel they can stand behind and nevertheless supervise.

Robert Dutt: Our audience is primarily Canadian MSPs and other types of IT solution providers. You serve over a thousand MSPs across North America, including Canada. What are the things that Canadian MSPs need to be thinking about in their contracts that their American friends don’t? I’m thinking PIPEDA, I’m thinking Quebec’s Law 25, the cross-border data question and data sovereignty, but I’m curious what you see as the biggest gaps from the Canadian side specifically.

Rob Scott: I think the ones that you mentioned are sort of at the surface, in the sense that those are concrete, objective things. Like, the data processing agreement for our US customers has different regulations in it than our Canadian customers, and the Canadian ones contain the laws that you mentioned.

The bigger issue that I see in Canada is a cultural issue. This idea that contracts are not important because we’re not in America where everybody sues at the drop of a hat. We don’t value legal protection in the same way that people might in the US, because the threat of litigation in their mind is lower than maybe the threat of litigation in the minds of the MSPs in America.

My response to that is I acknowledge the differences between the US and Canada as relates to litigation and dispute resolution, but I don’t think that that means that Canadian MSPs don’t benefit from having great contracts. It’s more of a question of what level of risk is being mitigated and the best way to mitigate it. I fear that too often in Canada, it’s not a question of does your DPA properly reflect Law 25 or PIPEDA. It’s a question of, are your agreements well thought out at all, because maybe you don’t think that it’s that important to have good agreements.

And it’s about 15 years culturally and mindset-wise behind the MSP market that I began working on. Where early on in America, there was a large sentiment that a handshake deal is good enough. I deal with my friends and I don’t perceive a high risk of litigation. And if someone wants to get out of my contract, they’re not happy with me, I let them go anyway. Why do I need all this paperwork?

And I think that’s a big thing that we have to work on for education with MSPs in Canada, which is you don’t have to be in a litigious market like America to benefit from good contracts.

Robert Dutt: Well, and here’s an interesting aspect to that cultural thing too. A lot of Canadian MSPs are serving clients on both sides of the border, or are using US-based vendor tools to deliver services to their Canadian customers. How should MSPs be thinking – even if they’re functional just in Canada in terms of customer base – how should they be thinking about cross-border exposure in their contracts?

Rob Scott: Well, look, I think that unless you know, for example, where every data subject resides in every system that you manage, you could be in Canada with customers with data subjects in their systems that you manage all over the US. And the laws run by where the data subject resides. So that’s one of the big challenges.

And then the other challenge is, don’t you want to put yourself in the position where you can say yes to as many deals and customers as possible? And don’t you want to make sure that you have compliant agreements that will allow you to operate in multiple markets?

And we have a lot of MSPs, I would say, that are on the Monjur platform that are enjoying dual libraries. So a set of agreements in English for the US, a set of agreements in Canada in English for English-speaking provinces, and then a set of agreements in Quebec, specifically for Quebecois law, presented in French. So we do offer some granularity in terms of localization in each market. And our strategy is we partner with local law firms in each jurisdiction to localize and maintain the updates of our agreements. And so we have a law firm that we work with in Quebec and several others in other provinces, including one in Toronto, where we partner with them to keep the agreements updated for those markets.

Robert Dutt: I think for a lot of MSPs, contracts are in the category of necessary evil, something they grudgingly do to avoid getting sued – or in some cases don’t do well enough to avoid getting sued. But I wonder if there is a case to be made for treating your contract stack as a competitive advantage, and if so, can you walk me through what that looks like in practice? How you can take a solid contracting situation and use it as a way to help your organization grow, and not just stay out of trouble when things go wrong.

Rob Scott: Yeah. So I think it’s an excellent question. I think the first part of it is something that now jives to me going to the dentist. Like, I know I have to go to the dentist. If I want to not have cavities, I have to go to the dentist. If I don’t want gum disease, I have to go to the dentist. I hate to go to the dentist. I’m so anxious when I get there, I tell them, please don’t take my blood pressure until we’re done, because it’ll just make it worse when you give me a really high blood pressure reading. I’m only going to be more anxious.

And I think with MSPs, that’s real too, as it relates to law. Many don’t feel comfortable with the subject matter. Many have had bad experiences. Many, like you say, would say it’s a necessary evil, but they try to avoid it as much as possible. Even if you caught them in a quiet moment of reflection to ask them if they really needed it, they would say yes, but they would go back to their office after that and lose track.

And this is why I think dynamic agreements that auto-update are so important for MSPs. I think legal needs to work in the background. And MSPs, I think, as a group, are carrying a very heavy cognitive load around contracting. A lot of the senior people that run MSPs are not contract people. It’s way out of their element. It doesn’t play to their strengths. It drains them of their energy. They’re constantly second-guessing whether they’re getting it right.

And what I think about competitive advantage, we talk in terms of the maturity model. Maturity level one: legal protection. You have the legal protection in place. Maturity level two: standardization and efficiency. Standardization and efficiency is like, how well have you collapsed your contracting processes into your sales process, so sales and contracting is one seamless step? So that’s kind of level two. Are all of your customers efficiently on the right paper? Can we update their terms without having to go get a signature?

This is how Monjur enables MSPs to grow revenue fast. We remove the friction from the sales process. We make deals go faster. We make it less likely that customers are going to want to comment or request changes to agreements. So that’s level two.

Level three is what we call contract intelligence. Using AI to optimize revenue opportunities. Making AI context-aware of your renewals, of your upgrades, of what people are paying, who is using a lot of resources but not paying for very much. These are the opportunities where contract intelligence drives better decision-making as well as automation to fuel efficiency to grow revenue faster.

So it really depends on where you are on this maturity level about how it helps you grow. Initially it may make it harder to grow while you’re getting the right legal protections in place. But ultimately you want something that can scale with your business, and that means dynamic versus static agreements.

Robert Dutt: My last question – I want to make this as concrete as possible. If you’re talking to a Canadian MSP owner, let’s say a 15-person shop doing managed services, building out security, starting to do AI in there too, they know their contracts are out of date or in bad shape but don’t really know where to start. What are the first two or three things that you’d tell them to do right now, right away, to get that ball rolling and to hopefully see the most improvement in the situation?

Rob Scott: Well, one of the things that I would say is benchmark what you’re currently using. Do an assessment of where you are. We have some tools online that can help you walk through an assessment of your current contracts, and we’ll also review them for you for free. If you have a contract, you’re an MSP in Canada and you want to understand what the gaps are relative to best practices, we’ll use our toolset to analyze your agreement, compare it to what we think are best practices in Canada, and do a report for you. We do that as part of our consultation process. There’s no fee for that. That’s a complimentary review. If you could get an experienced attorney to help you benchmark it, great.

The other thing to think about is updating your vendor list and asking yourself the question, “How am I protecting my MSP against acts or omissions of the vendors in my tech stack?” If you don’t have a good solution for that, then you need to be thinking about something like our schedule of third-party services, which allows you to list all your vendors and contains a waiver of the right for your clients to sue you. Now we’re covering a really big category of risk with that one attachment.

Then emerging services – advanced security and AI. You need specific agreements for these things. You can’t just continue to operate under the agreements that you were using pre-AI in the AI world. You can’t start offering compliance-related advisory services like GRC and other advanced security and compliance offerings without the appropriate contract. We call it the service attachment for managed compliance. Similarly with AI, we have a service attachment for managed AI.

You really need to be thinking about, do your agreements cover the services that you’re offering, delivered through the tech stack that you’re delivering it through, and in a way that’s compliant with the emerging framework of regulations that impact you and your customers? Given all of that – and we cover that with our data processing agreement – you can see why static agreements for MSPs can become very challenging very quickly.

If I was in the process of trying to figure out a way to manage risks for my MSP in Canada, I would be looking for a service that would give me dynamic updates that was specific to managed services, that was customizable for me and my customers. And think about this question: if my client were to sue me in court tomorrow, how confident am I that my current agreements would hold up in court? If the answer to that is, “I’m not so sure,” or “I’m not that confident,” or “I’m sure it would be a problem,” then getting a complimentary review of your current agreements and a game plan to move forward with broader protection is probably a good idea.

Robert Dutt: All right, I appreciate that. It’s a lot to think about, and it’s an area that I don’t think we focus on as much. We tend to get caught up in the tech stack and all that, so I appreciate your taking the time to share some wisdom on where things are at with contracts and where they’re going.

Rob Scott: Thank you. Thank you very much. I appreciate you having me.

Robert Dutt: There you have it. Rob Scott from Monjur. I’d like to thank Rob for his time. He brought a lot of depth to a topic that frankly doesn’t get a lot of attention in channel media.

A few things that are sticking with me from this conversation. First, the idea of the security recommendations clause – building language into your contract that says if you recommend a security measure and the client declines, anything that could have been prevented is on them. That’s the kind of provision that can save your business, and I’d wager a lot of MSPs listening don’t have it.

Second, his point about Canadian MSPs being about 15 years behind their American counterparts on contracting maturity – not because the laws are weaker, but because the culture around litigation is different up here. That’s a gap that works until it doesn’t.

And third, the question he posed that I think every MSP should sit with: why would you expect your pre-AI master service agreement to protect you in an AI world? If you’re selling Copilot bundles or managed AI services on a contract you wrote five years ago, you’ve got some homework to do.

If you’re enjoying the ChannelBuzz.ca podcast, we’d love it if you’d follow or subscribe. You can find us on Apple Podcasts, Spotify, YouTube, and most podcast directories. And if you have a minute to leave a rating or review, that goes a long way in helping other folks in the channel find the show.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Labor is roughly 75% of a managed service provider’s cost of goods, which makes compensation strategy one of the biggest levers in the business. In this episode of In The Channel, Robert Dutt sits down with Peter Kujawa, EVP and GM of Service Leadership and IT Nation at ConnectWise, to dig into the findings of the 2026 Annual IT Solution Provider Compensation Report.

The conversation starts with the Canadian data, which shows that solution providers in this market are planning the lowest pay increases of any region surveyed – just 7% of employees are seeing raises above 6%, and 42% are getting 3% or less. Kujawa attributes that to macro-economic softness, pullbacks in hiring by large tech firms, and the return-to-office trend reducing the remote competition for talent that was driving up wages in 2021 and 2022.

From there, the discussion turns to what separates top-quartile firms from the rest. Best-in-class MSPs pay their service teams roughly $10,000 less on average, but the reason isn’t underpayment – it’s a staffing model built on a higher ratio of Level 1 technicians, made possible by unified tech stacks and narrower customer profiles. Those same firms use three times as much incentive-based compensation as bottom-quartile operators, yet industry-wide adoption of incentive pay has barely moved despite years of data supporting it.

The episode also covers early data on AI and automation in the service desk, where digital workers are starting to show up in Level 1 and Level 2 roles, and a look at sales and marketing investment benchmarks – including why the most profitable firms are adding lead generation roles instead of sales headcount.

The full report is available from Service Leadership for $2,000 USD, or free for MSPs who contribute their data during the annual survey period.

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show.

If you run an MSP, labor is your single biggest cost – roughly 75 cents of every dollar you bring in. So knowing what to pay, who to pay more, and where you might be over or under investing in your people isn’t just an HR exercise, it’s a profitability question.

Service Leadership, part of ConnectWise, has been benchmarking compensation across the IT solution provider space for years, and they’ve just released their 2026 annual report. What makes this year’s data especially interesting for our audience is that it includes dedicated Canadian data, and the Canadian picture looks quite different than the rest of the market.

My guest today is Peter Kujawa, Executive Vice President and General Manager of Service Leadership and IT Nation at ConnectWise. Peter is a former MSP operator himself, and he brings a practitioner’s eye to the data that I think you’ll find really useful. Let’s get right into it, my chat with Peter Kujawa.

Robert Dutt: Peter, thanks for joining us. Appreciate it.

Peter Kujawa: Yeah, happy to be here. Thanks for having me on.

Robert Dutt: I guess the name of the report kind of says what it does on the tin, but for listeners who aren’t familiar with the Service Leadership compensation report, can you kind of give us the 60-second version of what it is, how long it’s been running, and why you guys choose to run it?

Peter Kujawa: The compensation report has run – I think this is our seventh or eighth edition of it – but what’s significant is we’ve been running it as an annual report for the last four years. The reason that we’ve made it an annual report is because when we hadn’t run the report for seven years – Service Leadership last had run it in 2015 – in 2021, wage inflation was running so high and causing so many challenges for MSPs that we were getting a lot of questions about what I should be paying my people, what are increases looking like, I’m getting requests for 10, 12, 14% increases, is this in line with the market. And we didn’t have the data. And we’re data people – we like to be able to not talk in theoretical, but talk in data. And so we decided to dust off the older methodology and we ran the report in 2022. It was so successful that we decided to make it an annual report.

And so every year in October and November, we open up our portal and MSPs from all over the world enter their data into the system. Anybody who enters their data gets a free copy of the report. We publish it, and anybody else can still buy a copy of the report for $2,000 US. But the value of it’s incredible.

What we’re able to do with the report that nobody else can is, because we measure profitability of the industry worldwide, we’re able to correlate what companies – what MSPs – are paying their people, and profitability. So in other words, you’ll see in the report entire sections of analysis saying, what is it that the top quartile most profitable companies are doing differently in terms of paying their people than the bottom quartile? So that provides a lot of really useful guidance.

But really the meat of it is when you go into the actual tables. We have over 60 positions that we collect compensation data on from MSPs. And you can see, based on experience level, what MSPs are paying their people for these positions.

One of our objectives going in was to be able to provide a report that only shows data from the industry. All of our data is industry-specific data. And why that’s important is, while a hospital system or an enterprise company or others may have level one help desk positions, or they might have project engineers or other positions that sound like MSP positions, in reality, the jobs of those positions are different than they are at MSPs. It’s really hard when you go out and you do a market-based compensation study to really understand, as an MSP, what I should be paying my people versus what enterprise pays for similar positions. So our data is industry-specific. We collect it every year. It’s really recent. We carve it up by region and do different things to give value to MSPs all over the world.

Robert Dutt: You’ve said in the past that we’re in the golden age of running an MSP. The compensation data from this year’s report – does it back that up? Does it complicate things? Basically, what’s the headline here in terms of the compensation trend?

Peter Kujawa: I would say both. And so first of all, yes, I said that – including last week at London from the main stage keynote. The last six years have been the best profitability years ever for the industry. Best in class has done better than ever. Bottom quartile has lost less money than ever. Still in many cases losing money, but that’s a different discussion.

However, MSPs’ largest source of cost is what they pay their people. Delivering services is, by definition, a services-based business. So if I’m delivering managed services, I’m spending about 25% of my cost of goods on my tools. The other 75% or so is on my people. And MSP employees have historically had wage increases at about twice the rate of CPI.

So the challenge for MSPs has been, I’m having to pay my people these increases, I’m seeing my cost of labor going up at twice the rate of inflation, I can only increase my customer’s cost by a certain degree. I probably can’t increase them year over year for too many years in a row at twice the rate of inflation. So I need to figure out how to be more efficient in my business.

The good news for MSPs is that crazy wage inflation we saw back in ’21 and ’22 has mitigated in three of the four geos. The only exception is Europe. So it’s gotten better, but wage inflation is still a huge issue for MSPs.

Since 2013, we measure the relationship between service revenue and the cost of your service team and wages. It’s one of our most important KPIs at Service Leadership. And we haven’t seen any improvement in that since 2013, despite the tools getting better, despite pricing increasing. MSPs have been stuck because wage inflation has been so hot.

And so yes, the last six years have been the best time ever for MSPs. But MSPs have to fix this issue with labor costs. And so that’s what’s so exciting about AI and automation, the things that we’re doing at ConnectWise with zofiQ and our platform. These are things that give MSPs the opportunity to finally get ahead and really take a bite out of this labor cost issue.

Robert Dutt: Let’s talk about Canada specifically. Your data shows that Canadian solution providers are planning the lowest pay increases of any region. I think it was only 7% of employees are getting raises north of 6%, 42% getting 3% or less. What’s behind that?

Peter Kujawa: Well, I think there’s a bunch of things that are going on right now. Number one is, depending on the region, there’s some economic softness. And when there’s softness in the economy in general, that comes into the labor pool. So if other companies are not adding staff at the same rate, it takes some of the pressure off of MSPs in that area. So there’s definitely some of that going on.

I think also just the overall tech economy, especially in North America – we’ve seen a lot of announcements about significant cuts from some of the larger tech companies. And that has a way of bleeding down into the MSP space. We saw the opposite in 2020 and ’21 and ’22, and that was all these companies are hiring and they’re adding remote labor all over. And all of a sudden, local MSPs are having to compete with some of the biggest tech companies in the world for their local talent because of remote work.

Well, many of those – A, many of those companies have been cutting a lot of jobs and it’s been very publicized over the past year. B, remote work has changed as well. We have analysis in there showing that most companies in the MSP space have returned to the office. And that’s definitely something that I think you’ve seen in big tech as well. So those two things have taken some of the pressure off and improved those really high-level increases. And I think that’s what we’ve seen in three of our four markets.

Robert Dutt: In terms of the Canadian numbers, I’m curious if you see them making – is it a company choice? Is it discipline, or is it a sign that Canadian MSPs are under more financial pressure than their peers in other markets?

Peter Kujawa: I’d have to run and take a look at the data on the profitability of the Canadian market compared to some of the other markets right now. I’m not aware of any of that being an issue right now, but I could certainly take a look at that, Robert, and get back to you. I think it’s more a case of the North America trends on labor. It’s probably indicative of a general softness in the Canadian economy and just some concerns that companies have. When companies are concerned about what’s going on today in the macro economy in their region, they pull back on hiring. Well, when they pull back on hiring, that creates less opportunities for the employees of the MSP to jump ship and go somewhere else and get a big bump.

Second of all, I think MSPs are known as great training grounds for tech employees, and the tech employees know this. Recruiters know this. MSPs are really fertile recruiting ground. Well, it’s a lot more tempting to take that offer when it looks like the economy is red hot and everybody’s growing. When it looks like, you know, things are pretty good for me at the MSP – I like what I do, and yes, I could go to this other company, but we’re seeing all these cuts at all these other companies, and my MSP is doing fine and growing and has been good to me – maybe I’m happy with a normal increase and maybe that huge increase I was looking at getting is not as tempting and I’m maybe not going to leverage it. So I think all these things tie together when you’re looking at what goes on in wage inflation in our industry.

Robert Dutt: So from the other point of view, it kind of cuts the chances of it becoming a retention issue. As you say, there’s those kinds of loyalty factors built in. One of the more counterintuitive findings is that best-in-class MSPs – the top quarter in profitability – gave roughly three times fewer large pay increases than bottom quartile firms. What are they doing differently?

Peter Kujawa: Yeah, it’s an interesting question. There’s a few factors that tie in. There’s some other linkage to what the best in class is doing differently, but I think specifically in terms of increases, there’s a couple things that play out.

Number one is the best in class have built a business that is much easier to recruit somebody into and get that person to be productive faster. And what I mean by that is best-in-class companies are servicing a more narrow target customer profile. They are much more likely to have their customer base on a singular tech stack. So they’re not servicing multiple vendors per each thing that they offer.

So let’s say, for example, firewall support – just a basic example. A best-in-class company is much more likely to have unified on a single vendor and have 100% of their managed service clients on that vendor’s products. As a result, it’s a lot easier for a new tech coming in to understand their offerings, to become productive faster. So they hire more level one techs and they’re able to recruit those techs and get them up and running easier.

That gives them an advantage when there’s techs that are thinking of leaving and they need to match a higher increase in order to keep that tech. If you know that we’re going to lose a certain number of techs a year and we’re going to need to replace a certain number of techs a year and it’s fine, we’ll deal with it, we have the engine that’s capable of sustaining and bringing them in – well, then I’m more likely, when a tech comes in on a Friday and says, “Hey, I’ve got this offer. I like it here, but it’s a 20% increase or 15% increase. If you match it, I’ll stay” – well, if I’m a bottom quartile shop and I have all this additional complexity in my organization, it’s harder for me to get somebody up and running. I’m probably more likely to match that or come close to it if they stay. If I’m a best-in-class shop, I’m much more likely to say, “Hey, you’ve been great here. Glad we hired you two years ago or whenever. Keep in touch. And if you know anybody who’d be a good fit, send them our way.”

So that’s one factor.

Number two is, when you work at a bottom quartile MSP, it’s not a lot of fun. Process is not as good. As I said, you don’t have as much of a unified tech stack and target customer profile. As a result, the quality of your service delivery tends to suffer. You’re probably getting yelled at more often by your customers. It’s just, in general, not as enjoyable of a place to be.

Best-in-class shops grow the fastest. When you’re working at a best-in-class MSP that’s growing at twice the rate of a bottom quartile MSP, that means there’s going to be more opportunity for you from a career perspective. Life is a lot more fun when you’re at a faster growing, more profitable firm. So those companies are able to be more discerning on the increases that they give.

I think the other factor at play is the best-in-class MSPs tend to be much better at using data to make decisions. And that’s not just for what they pay their people – they use data and really understand what’s going on in their business, in their industry. They’re less likely to just throw around increases for the sake of increases, and they run their businesses in a tighter way. So I think there’s several things that tie into that.

Robert Dutt: It sounds like the takeaway, the lesson, is not so much “pay less” as it is structure the organization more intentionally, more thoughtfully, and you’re able to – for all these reasons that you outline – keep people or better react when folks do want to move away for a much higher paycheck.

Peter Kujawa: Yeah. Run your business at a higher operational maturity level, and you will get all sorts of other benefits from it, including this.

One of the other slides that is in there that’s tied into what you just said is, we looked at on average, by category of employee, what is the best in class, median, and bottom quartile pay in each category. And one of the questions I get a lot from the report is, on average, the best in class pays their managed services team $10,000 a year less than the bottom quartile. It’s about $75,000 for bottom quartile, about $65,000 for best in class.

So the question is, well, if I go work at a best-in-class MSP, am I being underpaid? Do I have to take a pay cut to go work at a best-in-class MSP, or are they just not fair with what they pay their people? The answer is, that’s not the way to look at that data. The best in class is able to pay less on average because, if you look at a managed service team, you have level one techs, level two techs, level threes. You also have service managers, you have vCIOs, project managers or project coordinators. So you have all these people that constitute the team, but the majority of the positions are your techs – level one, two, and three techs.

Our data says that the best in class have a much higher percentage of level one techs. The bottom quartile have a much higher percentage of level two and three techs. So if I have two MSPs side by side, and they both have 10 techs in their tech team, but one of them has two level ones and the other eight are a mix of level twos and threes – well, those level twos and threes cost a lot more. So if I have another MSP that has 10 techs but six of them are level one techs and four of them are level two and three, those level one techs cost a lot less. If I add all those up and I divide by the number of employees I have, my average cost per tech is much lower if I have more level one techs than if I have more level two and three techs.

So you can go to work at a best-in-class MSP and do well. In fact, they pay more incentive pay as a percentage on average. So if you’re really a rock star and you go in and do a great job at the business, you should actually be able to make as much or more money.

Robert Dutt: You talked before about the 14% or so of gross margin benchmark for marketing spend. Are there similar concrete benchmarks in this report that an MSP owner could take back to their business this week and immediately act on in terms of improving profitability or improving the business?

Peter Kujawa: Yes. There’s a number of them. I would say it would depend on the size or maturity of the MSP what they would act on or take back. But if nothing else, the first thing I would suggest is go into the actual data tables and see how your people compare and understand if – first of all, no MSP leader or owner ever hears from their people, “You know, I think we’re kind of overpaid. Why don’t we – we would like to see our pay reduced to the market,” right? There’s a constant pressure to do two things when you’re running an MSP. Number one is to pay more. Number two is to add more bodies.

So I would go back first and foremost, look at the tables and say, here’s what I have for people, here’s their experience level, here’s where they’re at. How am I comparing to what I’m seeing in the market? That would be number one.

Number two is I would, regardless of the size of the MSP, look at my incentive pay for both managers and staff positions. I would take a look at what percentage of total annual earnings are tied to incentive. The best in class on average ties about three times as much to incentive pay as the bottom quartile, for both staff and for managers.

Well, how do they do that? There’s some best practices to incentive compensation. What you don’t want to do is go out tomorrow and just cut a percentage of pay out of your people’s base and shift it to incentive and say, “Hey, great news guys. Effective today, I just cut your pay by 10%, but now you get an incentive and you can actually earn a little bit more.” That will not go well.

So there’s best practices for how to implement this. Start with your managers. Build the incentive, make sure you’ve got it right, you’re measuring it right. Then roll it out to your staff positions. What you’re incenting is really important. You want to make sure you’re tying it to the greatest degree of what they have control over. And you’re not just tying everything to the profitability of the business or sales growth. There are other things that people tend to have more influence over. So really understand incentive pay and how to leverage that as well.

Depending on the size your MSP is, there’s also some really interesting information in there about some of the staffing composition. For example, we know that – you cited the 14% of gross margin should be invested in sales and marketing. That’s true. About 4% or so of that tends to go to marketing. About 10% of that tends to go to sales. But what’s interesting is, when we looked at staffing FTEs by role, the best in class are actually adding more lead gen people in marketing and the bottom quartile are adding more salespeople. So they’re both trying to grow their business. They’re both focused on new logo acquisition. But the best in class has learned that salespeople are expensive. They’re hard to find great ones. It takes a while to get them productive. When I have a good one, I’m much better off to invest some additional money in my marketing engine and use that marketing engine to drive more leads back to my salespeople and make sure that my salespeople are really doing what they’re best at all day. The bottom quartile tends to just add more sales bodies and hope that they can be more productive.

So there are some differences in the report that get into some of those best practices. It’s part of the reason the ConnectWise partner program was designed the way that it was – to really help with lead gen and to help MSPs tackle some of those challenges. Because it’s really frustrating when you add salespeople and you’re spending a lot of money and you’re not seeing new sales come in. You want to make sure that they’re really productive.

Robert Dutt: This year you’re tracking digital workers for the first time – AI agents, automation bots. How widespread is adoption right now amongst the firms in your data set? Are we talking about 5% experimenting, or is this something that’s pretty material in the results?

Peter Kujawa: At this point, the data told us about what we expected, which is we’re really early on. Our goal this year was to collect a baseline number. And what we saw was that most MSPs as of last year did not yet have full-time digital workers, but where we did see them was in level one and level two tech roles, which – that’s where we’re seeing it in the industry in general. So that makes perfect sense to us. What we think we’ll see is, over the next couple of years, those numbers are going to start to ramp up pretty significantly.

Robert Dutt: When you look at firms that are deploying digital workers and you look at their compensation data side by side, are they paying fewer people more, or are they just running leaner?

Peter Kujawa: I think at this point, because of how early on they are, they’re just getting up and going. But where we’re starting to see the gains is you’re starting to see a little bit of a shift in the staffing model mix. Back to that firm that has 10 employees in their help desk – let’s say they’re best in class and they have six of those are level ones, three of them are level twos and they have one level three. What we’re starting to see is, as the report says, there’s about 23% or so turnover in your level ones. So as they are losing some of their level one techs, they’re not backfilling some of those positions at all or as quickly.

As they’re building these efficiency gains into their help desk and starting to see some automation gains, we are starting to see some impact in profitability and in that staffing model. Again, we’re really in the early, early stages of this. We think it’ll start showing up significantly in the Service Leadership data by later this year, because our profitability data is always a quarter behind by definition. But anecdotally, some of the MSPs that we talk to are starting to see those gains, and they are starting to see that manifest with their level one staffing particularly.

Robert Dutt: It’s going to be an interesting space to watch and see what that looks like as that trend line develops. If you’re a Canadian MSP owner, particularly a smaller MSP, and you could look at only two or three data points from this report to kind of pressure test your own comp strategy, what would you be looking at first?

Peter Kujawa: I would look first at the data tables of the average by experience per position. So I would first start with all my most common positions. For most MSPs, those are going to be level one and maybe level two techs. And I’m going to look at by experience, what am I paying each of my people? So I’m going to use that. And then I’m going to go into my other positions through my organization. I’m going to use that to really pressure test – am I paying correctly?

Number two is I would go in and look at my incentive pay. Do I have something tied to performance for every one of my people? If I do, am I doing this the right way? Have I set up the plans in a way that’s going to lead to better results for the business and for the employee when the employee does great? I mean, that’s one of the measures of an optimal incentive plan – when the employee overperforms and gets paid on an overperformance, everybody’s happy. If the employee is happy but the owner of the business is unhappy because the employee hit their overperformance, well, that’s bad. I’ve got a problem with my incentive.

So I’m going to look at how I structured the incentive for everybody. Those would be number one and number two.

Number three, I’m going to start looking at, depending on the size of MSP I am, what should my model be evolving into? I’m going to use this as part of my budgeting. So depending on the fiscal year timing, you might be early-stage fiscal year, you might be late-stage if you do a mid-year fiscal year. Regardless, I’m going to start looking at this data and start modeling it out to see how does this fit into my budget for next year. What should I be starting to plan on for changes I’m going to want to make in my compensation structure? Because you really want to get ahead of those and make sure that they fit into the overall business goals of what you’re trying to do.

Robert Dutt: You mentioned near the top of the interview that wage inflation peaked in 2022. It’s been easing since. Is that a reason for MSPs to breathe easier, or is it masking something that they should be watching?

Peter Kujawa: Yeah, it’s the opposite. In 2022, wage inflation was running upwards of 10% or more. We were seeing these crazy increases out in the market as a norm. But on the flip side, we were also seeing managed service organic revenue growth running at its peak – about 25%. And the reason it was so hot was a mix of a few things, but a significant contributing factor was price increases on managed service offerings. MSPs got much better at that time at understanding, I have a gun to my head from all this wage inflation – I better start doing some uncomfortable things with increasing pricing for my customer base. And they did. And we saw that in the data, which got the MSPs through it. They were able to maintain profitability, et cetera. So that was the good news.

The bad news is that you can’t increase prices at that level indefinitely. And so yes, wage inflation is better, but again, we’re back to more of a normal increased cadence on pricing. And yet MSP wage inflation, even though it’s much, much better than 2022, still runs about twice the rate of CPI.

MSPs cannot take their eye off the ball with this. It’s really important as we go forward that MSPs be focused on where can I drive efficiency gains in my business. Where do I have waste today? Forget AI and automation for a second. Are there employees that I’ve been carrying that are not producing, but I like them, and so I keep them around? I just haven’t been disciplined at making some tough decisions. If that’s the case, make those tough decisions first.

Second is, every MSP out there needs to be focused on automation and AI. It’s not for luxury reasons. It’s for survival reasons. The industry is changing rapidly. Every MSP needs to be focused on how can I get more efficient with my cost of labor and how can I make sure that as I’m growing my business, I’m not growing my labor cost at an equivalent rate to the growth of my business.

These things will ensure that not only will the MSP survive, but they should be able to improve their profitability. If they’re bottom quartile, get up to median. If they’re median, get up to best in class. And really be well positioned for the evolution of the industry over the next few years.

So yes, it’s good news that wage inflation has improved. But it hasn’t taken the pressure off at all for MSPs to focus in on AI and automation.

Robert Dutt: And my last question – what’s one thing that surprises you in this year’s data that you didn’t expect to find there?

Peter Kujawa: That’s a great question, because nothing surprises me at this point ever looking at the data year in and year out. I think I continue to be really surprised by the bottom quartile and the median. We’ve been talking for years about incentive pay and tying your employees to performance. And yet we’re not seeing the needle move significantly in the bottom quartile and the median in that regard.

I would have expected by now, with how many years we’ve been talking about this and publishing this data, that we would have seen some more significant improvements in tying employees’ pay to performance. But we’re not really seeing that significantly change.

So again, if I’m a smaller, midsize MSP, or even a larger MSP, I’m going to use the report as an opportunity to go in and look at what we’re doing in that regard and make sure that we’re doing what we can to tie employee performance to their pay.

Robert Dutt: It makes a lot of sense. I think that disconnect is a big neon sign pointing towards an opportunity to optimize. Peter, I appreciate your taking the time and walking us through so much of this data. There’s some real value in there for the MSP community.

Peter Kujawa: Well, thanks for having me, Robert. Enjoyed the interview.

Robert Dutt: There you have it – Peter Kujawa from ConnectWise and Service Leadership. I’d like to thank Peter for his time. He brought a lot of substance to this one. And thank you for listening.

A few things I’m taking away from the conversation. First, that Canadian stat. We’ve got the lowest planned pay increases of any region in the report. Peter’s read on that is that it’s less about financial pressure and more about a macro environment that’s eased the competitive pressure on talent. Whether that’s a strategic advantage or a risk you’re not seeing yet is worth thinking about.

Second, and this might be the most actionable piece – the best-in-class firms aren’t just paying less. They’re paying differently. More incentive-based comp, smarter staffing mix, investing in lead gen over sales headcount. That’s a playbook, not just a data point.

And third, if you’re not using incentive pay yet, you’re in the majority, but that’s not necessarily where you want to be.

We’ll have a link to the report in the show notes. If you’re enjoying the ChannelBuzz.ca podcast, do me a favor and follow or subscribe wherever you’re listening. We’re on Apple Podcasts, Spotify, YouTube, and most of the major directories. And if you’ve got a minute to leave a rating or a review, that goes a long way to helping other folks in the channel find the show.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.