6 MSP Expert Takes For Supporting, Protecting Clients In ‘This Next Era Of AI’

Leaders at MSP vendors ranging from Slide to WatchGuard talk about how AI is creating new opportunities and fresh risks for the channel at the XChange NexGen 2026 conference.

Vendors and MSPs are making it clear at this week’s XChange NexGen event: There is a lot of concern and interest in helping customers build new capabilities using AI and protecting them from the many risks created by the technology.

“You will need to decide what vendors you’re going to work with in this next era of AI,” said Kelly Fyffe, community and channel manager for Westport, Conn.-based Slide, during a Monday presentation at the event hosted in Orlando, Fla., by CRN parent The Channel Company.

Mike Psenka, CEO, president and founder of Mount Pleasant, S.C.-based Moovila, said the proliferation of managed AI services is going to significantly increase project volume, resulting in a shift from “infrequent infrastructure upgrades to continuous delivery sprints.”

“The projects and the things that you’re setting up for your customers, even within an eight-week project, are going to change,” he said.

But the rise of AI means a slew of new security risks, with the technology unleashing an unprecedented wave of cyberattacks and creating fresh vulnerabilities for customers who use unsanctioned applications without proper guardrails put in place.

“The reality with shadow AI is you can’t actually manage and you can’t protect what you don’t understand and what you don’t see,” said Marc Laliberte, deputy CISO and vice president of information security at Seattle-based WatchGuard.

What follows are these and other MSP expert takes from vendors, in their own words, from XChange NexGen 2026 for supporting and protecting clients in “this next era of AI.”

Eric Peterson, senior partner success manager at Campbell, Calif.-based Barracuda Networks, on how MSPs can protect against cyberattacks launched through support

Think about this from an MSP perspective. Your technicians have access to a lot of customer environments. If someone can successfully impersonate a customer or an admin, your support process can open the door for an attack.

So, how do we address this? First, we need to be aware. You need to understand the credentials that are exposed and that can recognize unusual activity. Second, we need to authenticate and verify. Secure logins to all devices. Make sure that you’re verifying people who contact your help desk. Third, least privilege. Remove those standing admin rights. Give users and technicians a controlled way to access what they actually need. These aren’t three separate problems. They all work together.

Marc Laliberte, deputy CISO and vice president of information security at Seattle-based WatchGuard, on what MSPs need to do to contain security threats from shadow AI

The reality with shadow AI is you can’t actually manage and you can’t protect what you don’t understand and what you don’t see.

It’s tougher to see which tools users are signing up for with their business accounts. Even more difficult to see what they’re signing up for with personal accounts.

So, in order to combat shadow AI, the very first step has to be that discovery phase. Just see what is actually out there, personal versus corporate use. What permissions are we granting these applications and interconnectivity to our other business apps?

And then taking a step back and assessing what is the actual risk for this. Are they training on your data? Do they have the right retention and data protection agreements in place with you as a business for the scope that you’re giving these OAuth tokens? Are you restricting it to just the minimum required for that thing to work, or are you following their documentation and granting it potentially admin privileges within your tenants?

And then it can’t be a point-in-time review; it has to be an ongoing effort in order to catch the types of incidents that we’re seeing here.

Kelly Fyffe, community and channel manager for Westport, Conn.-based Slide, on how MSPs should look for vendors who are built to integrate
You will need to decide what vendors you’re going to work with in this next era of AI.

What we’ve seen is vendors are only as successful as the tools that they integrate with, and that’s going to be the future. You have to be able to integrate with AI.

When it comes to backup, we can all agree there really hasn’t been any innovation in backup in the last 15 to 20 years. All of those backup companies were built on a UI-first basis. They were built and designed for a technician sitting behind a workstation clicking buttons, whereas Slide differentiates itself by being built on an API-first model.

Saurabh Sandhir, CEO and co-founder of San Jose, Calif.-based Kipling Secure, on how AI agents can turn a routine task into a disaster

Back in April, a small company was using a Cursor coding agent running in production, and what seemed to be a routine task ran into a credential mismatch. It made one bad assumption. It guessed that the staging volume was isolated and it wasn’t. One API call, nine seconds, and the production database and every volume backup were gone.

The takeaway here is not that Claude or Cursor are bad. The takeaway is that agents now have tools, permissions and consequences. An AI assistant can give you a bad answer, but an AI agent can give you a very bad afternoon.

Todd Smith, senior vice president of sales at Rochester, N.Y.-based Calero, on how MSPs can gain visibility and control over clients’ rapidly expanding AI usage

We’re using AI. And some of you are using it on everything you do. You’re writing your emails with it. You’re engaging your spreadsheets with it. You’re dropping files in it. You’re creating your PowerPoints.

Others of you are like, “I sometimes ask a question.” And that’s fine. There are all of these different ways that we look at it.

But within these AI models, your customers have people coming into their organization that are utilizing AI, and they were familiar with where they were at before.

Now I come to a new business. “Hey, we give everybody a Claude license.” And I’m like, well, I use ChatGPT. That’s the one I know.

And so, what do I do at this organization? I use ChatGPT. It’s what I know. And all of a sudden, I’m dropping RFPs in a ChatGPT [account] that isn’t sanctioned, no guardrails. It’s on my personal account that I’m paying for. And the customer loses all the security behind it.

That is happening in every one of your clients today. And so step one for everybody in this room is you’ve got to give visibility to your clients of what they know about and what they don’t know about.

And then it becomes step two: seats. Is it consumption? Is it tokens? How much are we using? Who are our high users?

Step three: Now that I know who’s using it and that they’re using a lot of it, how do I put in guardrails?

I want to go over and say, “Carl, I need to know. Was it for this project?”

“Yep, it sure was. That was a sanctioned project.”

What about when Carl goes over on that? Do I want to just tell him. … Or do I want that to go to a supervisor that has to approve that to come out of their budget if they’re going to let it go over? It’s got to be guardrails.

Costs spike overnight. Most every customer that we talked to halfway through the year had already exceeded their budget. In fact, the last conversation I was in, customers said, “We go over our budget halfway through the month, every month. We’re not even making it to that anymore.”

But they keep paying the bill because they don’t know if they turn it off tomorrow what would happen. Because they don’t have visibility into it.

Mike Psenka, CEO, president and founder of Mount Pleasant, S.C.-based Moovila, on preparing MSPs for rising project volume in the AI era

Managed AI is going to multiply project volume, and it’s going to change the nature of projects for organizations as well.

So there’s going to be this shift from infrequent infrastructure upgrades to continuous delivery sprints. So there aren’t going to be these migrations anymore.

In the past it was server and network OS migrations occurring every three to five years, hardware refreshes. And the big risk was margin scheduling bottlenecks. That was a common issue. … But as we go to a managed AI MSP model, data hygiene, access audits, AI workflows, and the frequency is going to significantly increase.

And you’re going to have this prerequisite readiness and governance. But really one of the biggest changes that’s going to happen in this is change. Like, my God, in the last six to nine months, what has happened with AI? Where were we six to nine months ago? And where are we today?

And where are we going to be in six to nine months, and then another six to nine months, and another six to nine months?

And so, the projects and the things that you’re setting up for your customers, even within an eight-week project, are going to change.

So you’ve got a firewall install, a hardware refresh. You’re pretty dialed in about the steps and what’s going to happen with that. But that’s not going to be what it’s like on the AI management model.

There’s going to be constant change, change order process. So some of the things in the past that were problems that would occur occasionally are going to occur with a much greater level of frequency.

So as you adapt your business to this model, once again, this idea of having maturity around project management and what you’re going to have to do to this is going to become more important. […] Scope creep is going to become an even bigger issue in the coming years with AI projects and process because MSPs are going to be navigating into territory that they’re brand new to.