As AI accelerates software development, AppSec becomes an MSP problem

Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show.

AI isn’t just changing how software gets built. It’s changing who can build it, how quickly they can do so, and potentially who has to worry about securing it.

With generative AI increasingly producing code and putting application development capabilities in the hands of people who may never have considered themselves developers, traditional application security processes face a pretty basic challenge: keeping up.

And that may have implications for MSPs and other solution providers that have historically regarded application security as a specialized discipline outside their core business.

My guest today is Jon Kozimor, vice president of channel at Checkmarx. We’ll talk about why the speed of AI-generated development is putting pressure on traditional security processes, where Jon sees new services opportunities emerging for partners, how MSPs can build or source the expertise they’ll need, and why the channel may increasingly find itself responsible for securing applications its customers can now create almost casually.

Let’s get right into it with Jon Kozimor.

Jon, thanks for taking the time. I appreciate it.

Jon Kozimor: Of course, of course. Thank you, Robert.

Robert Dutt: Let’s start with kind of the premise behind the conversation. We’ve spent a couple of years hearing and seeing how AI is going to transform the channel. I’m curious what you’re seeing that’s different now. What are you actually seeing that customers do with AI that changes the job that partners need to do?

Jon Kozimor: Yeah, and I’m going to do a little history here, Robert. I mean, I’ve been in the industry now 30-plus years, and in the channel a good two-thirds of that. And in working with partners, whether I was at EMC or HP or OpenText, there was always a need for partners’ services and also their expertise.

So that was always there. And I’ve seen partners, and most partners, evolve from being just, I’ll call it, traditional resellers to really value-added resellers providing that expertise.

The thing with AI is that it’s changing so rapidly. I use this example: We had our kickoff in January, and there’s a large amount of that content that just changed in the past eight months. And it’s no different for the customers.

The key that I see for the channel, and the pivot that I see them making, and I think it’s natural, customers are going to need partner expertise. Because you know why? Partners did client-server, partners did cloud, partners did VMware. We can name all of those, I’ll call them, transformational things that happened.

This is no different. I think it’s more complex, but I think the partners are going to be able to really give customers a view because they’ve seen it all across their customers, and they’ve seen it all across the lines they’ve sold. So I really think it’s a great opportunity for partners.

Robert Dutt: One thing that seems particularly different about AI, especially when you get into generative AI, is the speed at which customers can create things. Somebody who’s never been considered a developer suddenly can whip out an application, an automation, an agent, whatever the flavour may be.

What happens to the security side of things when you can create software so much faster than you can keep an eye on that or lock it down, and when you hand the ability to do that over to someone who isn’t coming at it from the rigour of an app-dev background?

Jon Kozimor: It’s a great, great question. And we’ve done certain reports, so I’ll kind of get us started with data. Fifty per cent of the code that’s generated today is done with AI.

The other interesting stat is 70 per cent of developers understand that there are vulnerabilities being deployed because there’s just more code being developed and more vulnerabilities.

And the issue that we have with that is, first of all, making sure that whatever you’re going to put in a production environment, let’s face it, it’s against the bad guys. It’s against cyberattacks. It’s against making sure that we don’t have bad guys not only accessing applications and data and doing bad things with it, but think about brand, et cetera.

What we’re doing, Robert, as being the leader in application security, is bringing not only the expertise and the deep IP we have, but dovetailing it into the speed of AI to make sure that we’re focused on the right vulnerabilities, but we’re also making sure that the application is secure, and we’re at the pace of development with AI, because that’s not going to change.

And the key part is to be at the pace. And the other thing I’ll introduce now is it’s not about the technology solution. It really comes down to governance, but it’s really change control.

The processes that most customers have today are not built for the speed of AI. And we’ll take coding development as an example, but you can use that in a lot of different ways. It’s really key to have those processes in place as well, where partners, I think, play a big role.

Robert Dutt: And I guess that’s true whether it’s something that’s vibe-coded, done by someone who’s not a developer, or someone who’s in a traditional developer role and is just pumping out stuff so much faster because they’ve got their AI assistant of choice riding shotgun and doing the legwork of actually tippity-tap typing it.

Jon Kozimor: A hundred per cent. And the key is, look, developers, their job is to develop great code, develop great applications that ultimately bring companies great, I’ll say, customer outcomes in terms of those applications. Obviously, this is revenue generation.

But the developers aren’t security experts. Never have been, right? So it’s like, you know, I’m running real fast. I’m able to run really faster, but maybe the treadmill I bought really isn’t equipped for this, right? So I’m breaking down and such, but ultimately it’s the speed to get to the outcome.

And we are understanding that and making sure, working with customers, that they have the right tools there that aren’t slowing them down, but make sure that whatever they’re developing is secure.

Robert Dutt: So when we’re at this point where code is being generated so much quicker, and the security has to be obviously considered, hopefully somewhere in there, add in the fact that perhaps some of that app dev is going on in places where not everyone in the organization knows it’s going on.

Where do you, in practice, see the AppSec or developer security process start breaking down in this new world?

Jon Kozimor: Yeah, I think it can really break down from starting the code because it’s so fast that, at the onset, you’re introducing issues regarding security.

So it’s really from beginning to end. I mean, it’s not like, well, once you get to this point of your lifecycle, this is really a problem. You’re creating code so quickly, the vulnerabilities are piling up.

So it really is from tap keyboard one. I’m probably being a little bit aggressive there, but it really is early stage. And it’s hence why we’ve developed tools and methodology to get at that early stage, because the quicker that you can address the vulnerabilities, the better, because it’s not going to propagate as you get, let’s say, halfway through or 90 per cent through.

You really have to have something that’s beginning to end. And really the big, I’ll call it, secret sauce of Checkmarx is our IP. It’s the platform, because that platform has been built over two decades.

And we not only have fantastic innovations, but we have so much that we’ve learned over those two decades that you’re now dealing with an end-to-end solution, development pace, but doing it securely at the front end and being able to have that IP that, through the entire lifecycle, a customer can leverage that expertise.

I’m really excited about what we’re bringing to the market, but I’m more excited when you think about two decades. You’re like, wow, I feel like I’m at a startup atmosphere of innovation, but being really, I’ll call it, cemented into a lot of just great IP that’s put into the solution.

Robert Dutt: You touched on how long you’ve been looking at the channel community, and I’ve also been watching the space for that kind of time.

And we’ve talked throughout that about how you’re not going to be able to survive on hardware resale. You’re going to have to become that trusted adviser. It’s been kind of the underlying message, whether that was through network convergence, whether that was through cloud, now well into AI.

That’s still there. I’m curious, though, what does the opportunity for the channel here look like in terms of helping their customers govern, secure, operationalize AI, sitting where you sit?

What’s basically really new for partners in terms of what they’re going to have to bring to the table to meet customer needs going forward?

Jon Kozimor: I think new for the partners that I’m seeing is they’re creating AI services, but not AI services for Checkmarx or Dell or name your brand.

They’re creating, I’ll call it, thought-provoking AI services that are dealing with AI as the opportunity in terms of what customers have, but also peeling that apart and looking at it in terms of where it is in the customer environment.

Let’s face it, I’m focused on AppSec, but you can talk about any piece of an environment and there’s an AI component.

So I see partners really starting to peel back the onion and doing it based upon all of the different solutions that they can bring together, and bringing it together with, I’ll call it, AI thought leadership.

So they’re not only coming into the customer and whiteboarding out, okay, this is how everything works. They’re also understanding what’s the customer outcome and what can we provide as expertise on the front end.

So it’s less to do with how do I get this server, software, et cetera, running as a point solution. It’s more to do with how do I harness all this technology, leverage AI in my business, doing it securely, but get to that outcome?

I think it’s all about customer outcomes. And it’s one thing out of our program that we have, which is really about, for us, predictability and profitability for partners. But it’s how do we work together to deliver that outcome?

Because Checkmarx doesn’t do that kind of work. We rely on our partner ecosystem, which I think is going to do a great job of providing that kind of expertise.

So I think, Robert, that’s where I see the opportunity for partners. And I am seeing our channel base embracing that.

Robert Dutt: It sounds like an opportunity for partners. This is going to speak into the managed services transition again.

It sounds like an opportunity to package a lot of that up and offer that under my own brand, with Checkmarx and a bunch of other vendors sitting underneath that to facilitate it.

But is that kind of white-labelling, or “I’m the expert here, trust me, I will orchestrate this for you” approach resonating?

Jon Kozimor: A little bit. I think there’s a great opportunity for MSP use. We do it at the lower end of our market today, but we really see it as a potential opportunity.

I look at it, Robert, as a consumption model that the customer is looking for, and then what can the partner provide as the value-add, we’ll call it the different value equation.

So I think it can play a role, but I think it can get a little bit complex when you’re dealing with white-labelling and saying, here are all of the different kinds of outcomes.

I think MSPs are going to need to evolve to that. I don’t think that all of these pieces and parts can come together from an MSP perspective at the onset. I think we have more to learn, but I definitely think the MSPs can play a role.

Again, we use them today at a certain market space. I think we can definitely leverage it, but I think it also has to, again, I’m a big believer in the consumption model. How does the customer want to deploy something, and then how do they want to consume what they’re deploying?

Robert Dutt: Any trends you can comment on there, especially for that MSP that’s serving the SMB or lower midmarket type of customer, in terms of where things are at with that or where it’s likely to go?

Jon Kozimor: We’re seeing nice growth. We have a couple of partners that we work with that basically provide, I’ll say, a white-label service, but they definitely say it’s Checkmarx-run.

We’re just looking at great growth. It’s for really the smaller end user, but we’re finding some of these smaller end users are really growing and their consumption is growing.

Again, it gives us the opportunity because, look, we’re a fairly small company. It’s very, very difficult to service the entire base of customers, whether it’s global, the Americas, name your region.

The MSPs really help us scale for our business in that section today because, look, Checkmarx is a wonderful solution for application security, meant for the smallest to the largest.

And I think, well, not think, I know the MSP program that we have is helping us in that, we’ll call it, midmarket space.

Robert Dutt: Sitting where you sit, I imagine you’ve looked at a number of different types of partners, but I’m curious how this opportunity is shaping up.

We’ve kind of touched on the MSP side of things, but what about the traditional VAR? What about a partner that’s coming at it from a more traditional app-dev kind of role?

I’m just curious how you see the different aspects of the channel kind of playing into this.

Jon Kozimor: Yeah, I’m an ecosystem guy. I’ve always been that way, whether I was at the different companies I’ve been.

So my thing is there’s going to be that focus, we’ll call it, value-added reseller expertise partner that’s going to probably drive a lot of the value and a lot of the revenue.

But you may have unique value-added partners that aren’t necessarily doing the gigantic volume, but provide something to either a customer or to Checkmarx that has value to the marketplace.

We have hundreds of partners in our ecosystem. We have a percentage of partners that probably drive a lot of, I’ll just call it, revenue. But for me, you need an ecosystem.

To bet on just a couple of partners, nothing against those partners, I just think in the technology business there’s so many value-added resellers, from large ones to, say, a boutique-y one that’s in a state that just has some great trusted relationships and value for customers.

So that’s what we have built here and are continuing to grow, an ecosystem mentality focused, though, on those value-added resellers of the ecosystem that are really going to drive the most or the better customer outcomes.

Robert Dutt: What role do you see yourselves playing in that ecosystem facilitation?

On the continuum from a pretty programmatic partner-to-partner kind of structure to, “Hey, that sounds like an interesting opportunity. Do you know about Bob, who does whatever aspect of app dev you might need to add to your quiver to land that one?”

Jon Kozimor: Yeah. I mean, I come from HP, where they had Mercury Interactive, and I’ll use them as an example.

What a partner program they had. They had a tremendous amount of partners, both midsize, small and large, and I never saw a partner community that was so collaborative.

To your point, Robert, X VAR is working, and yeah, Y VAR is kind of a quote-unquote competitor, but they work together to figure out either on the front end of the transaction or mostly on the services that, “Hey, here’s my bench. Here’s your bench. Hey, we just did this.”

A lot of sharing happens. So I always try to do that. There’s going to be some circumstances where it works, others where it won’t, because let’s face it, there’s competition there.

But I’m a big believer in collaboration in the VAR community. And I saw it happen at HP and through my time working with the Mercury partners. Just a great community of partners.

Robert Dutt: So help me with how, or what do you see as some of the common first steps for partners who are looking to start moving in this direction?

What works to get in line with customers or even out ahead of customers in how they’re approaching AI and kind of presenting themselves as that expert, that outcome provider that you’ve laid out?

Jon Kozimor: I think first it comes down to really baseline to, I’ll call it, advanced enablement, sharing with the manufacturer and sharing, obviously, with different folks in the VAR community that a partner may have, and getting also, I’ll say, thought leadership.

No one can predict what AI is going to do tomorrow, never mind a year from now.

I think it’s almost like the gut instinct of these partners. They’ve been in business for years. I’ve worked for some that have been doing this for many, many years. They’ve seen it.

Go with your gut instinct in terms of what’s worked before, and I would just move forward with that.

Obviously, do it in a thoughtful way to make sure that you have all of the things you need to provide that customer with that outcome.

But I think the VARs should just use your gut, use the expertise that you have around you, and use the leadership, because you know what? Those leaders have done tremendous things with their companies.

I think they just have to continue to do it. Don’t let AI be intimidating. Let it be an opportunity that you’ve dealt with before.

Robert Dutt: Alongside security, I think there’s the issue of responsibility, and I’m curious how that’s going to play out in the longer run.

If I’m the partner helping a customer safely operationalize AI, how much responsibility am I assuming for what the customer ultimately builds or does with it and where that all goes?

Where should partners draw the line between “We secure and govern this environment” and “This is on you, the risk is on you, Mr. Customer”?

Jon Kozimor: Yeah, I think it’s an interesting conversation because a lot of customers are saying, “Well, what’s your AI policy if this happens?”

I think we’ll be at a crossroads, and we’ll have to use expertise from legal and such.

I think it’s what the partner feels comfortable with technically, what’s there, and then I think it comes down to what they feel comfortable with. What kind of responsibility do I want to take?

Because I know a lot of partners want to take responsibility. It’s just tough to define it in this world of AI.

I’ll give you a simple part of a transaction, Robert. You and I both know, right? Partner sells it, I’ve got the end-user licence agreement, partner’s responsible for their services, but ultimately I hold that.

I think in this world of AI there’s going to be different asks from customers, and I think we’re going to have to work together as a community and figure out, well, what’s reasonable, what’s over the top, et cetera.

So I think it’s a bit of a TBD. But again, I think partners should go with what their gut tells them.

I mean, the ultimate outcome is what customers are looking for. Don’t go over your skis. Use your judgment. They’ve done it in the past, so this is no different.

Robert Dutt: It’s going to be interesting to see how that affects contracts and basically how different partner organizations think about that kind of thing.

But yeah, I think you’re right. It probably is early innings at best of this game, and we still don’t even know what the game is in some cases because things will continue to change at breakneck speed, it seems.

Jon Kozimor: A hundred per cent. The speed I’ve never seen. And again, I go through the different inflection points that we addressed early on. I’ve not seen it change like this.

It’s just something all of us are going to have to deal with and come up with methodologies to move forward with.

Robert Dutt: My perception is that AppSec has historically been a specialization that some MSPs would get into, others would say, “Eh, you know, that’s not really my business.”

Might have a relationship or a connection to answer that if a customer wants it answered, or not.

But when customers can kind of casually create applications, can MSPs still say that?

How much AppSec expertise does the mainstream-focused MSP need to develop at this point in time, and how do they solve for that?

Jon Kozimor: Yeah, I think they have to definitely develop expertise if they don’t have it, or obviously bring in expertise from the marketplace, because they’re the tip of the spear, right?

I mean, the MSP is really going to take on the role of being that vendor and probably having an aggregate of solutions, whether that’s us and three or four others that’s white-labelled.

So I think the bottom line for the MSPs is they’ve got to have the right bench.

And if they have a relationship with a manufacturer, which obviously they have, it’s just having that right back-and-forth communication that’s open. And the MSP, if there’s a gap, they call it out and they fix it.

I don’t think this is going to be one, especially around application security, where you’re not going to want to make sure that you’re fully ramped up, staffed up and have all the knowledge you need to make sure with what you’re doing.

You obviously are going to have mistakes. We all do. But you don’t want to have propagation of that based upon not having the right knowledge base to give the customer ultimately what they need.

Robert Dutt: So it sounds like it’s going to be a mix of hiring or building that expertise, partnering with other organizations for it, and maybe even down the road, who knows, consuming it as a type of managed service themselves.

Who knows where things will go, right?

Jon Kozimor: Yeah. And you know what? It’s a word I’ve used, and I’ve used it here. I talk about the consumption model.

And consumption model sounds very transactional. It really isn’t. It’s about the value at the end of the consumption model, but what’s the best way to do it? Not only from a transaction perspective, but from a solution perspective.

So I think we’re going to see different, I’ll call it, consumption models be born out of AI. I can’t predict when, but if I use AI pace, it’s probably going to happen pretty quickly.

Robert Dutt: And go in directions we may not expect, which is always fun.

Jon Kozimor: No doubt, Robert. No doubt.

Robert Dutt: Finally, let’s make this as actionable as we can, given that by the time this comes out a week from now or whenever it goes out, things may have changed entirely because AI.

Jon Kozimor: We may have to do another one of these in a couple of weeks.

Robert Dutt: For an MSP who’s listening to us and agrees with the argument, but hasn’t themselves really gone that far into the AI application security slash governance, that whole practice area, what are the first two or three things that they should be doing now to be ready for what customers are going to want, need, require, demand over the next year or so?

Jon Kozimor: I think the first thing is, and I’m open to all conversations, is to get with the manufacturer and the provider and really find out how we’re supporting our customers and what we’re doing day to day, whether that’s customer success, our sales team, obviously our technical folks in development, and get close to that.

And come up with your own, whether it’s a gap chart or however they want to assess, but it’s almost like doing an internal assessment.

This is what we do for customers. The MSPs know exactly what they do for customers every day. They’re doing a great job.

Take that and use that as a methodology, and then get close to the manufacturer, get close to the space, ask the curious questions.

The key part is you know what you need to do in terms of what you do every day. Figure out the gaps, because they would know that, but then it’s going to be about just having those right conversations.

I’m a big believer in it. Establish those relationships with development of the manufacturer, with customer success, with the different leaders within the organization, so there’s a streamlined communication.

Because look, their success is our success. That’s what I look at from a channel perspective, MSP, name the partnership, because I have different ones.

If we have good communication, honest communication and two-way, I think that’s the biggest thing, Robert, I would do.

Get curious and make sure that you’ve got a really good understanding of what’s needed, and then fill the gaps if you have any.

Robert Dutt: The good news is, I can’t speak for you, but I’m sure your experience is probably the same. There is no shortage of curiosity around the topic of AI and where it’s going in the channel.

I think that bodes well for this community.

Jon, once again, I’d like to thank you for taking the time. Interesting conversation, and we live in interesting times.

Jon Kozimor: Yeah, Robert, it was great to meet you. Thank you for the opportunity. We’re really looking forward to working with all of our channel partners in the ecosystem, and this was a great time. Thank you.

Robert Dutt: Thanks again to Jon Kozimor, vice president of channel for the Americas at Checkmarx, for joining us.

A few things that stand out for me from that conversation.

First, the speed of AI-assisted development is becoming a security issue in its own right. If organizations can produce vastly more code, much more quickly, security processes have to keep pace, and many of the processes organizations have today simply weren’t designed for that.

Second, application security may become harder for mainstream MSPs to regard as somebody else’s specialty.

As customers use AI to build more applications, automations and agents, partners are going to need access to the expertise required to secure them.

That doesn’t necessarily mean building all that expertise internally. It could mean hiring, partnering with specialists, working more closely with vendors, or eventually consuming some of those capabilities as managed services themselves.

And third, there’s a business opportunity attached to that responsibility.

Jon says Checkmarx is already working with MSPs delivering its technology as part of services aimed at smaller customers, and expects new consumption and delivery models to emerge as AI adoption continues.

As always, you can find more from In The Channel at ChannelBuzz.ca, and if you enjoy the show, please subscribe or follow wherever you get your podcasts, and consider leaving us a rating or review. It helps people in the Canadian channel find the show.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.