From Shadow AI to managed AI: WatchGuard CEO on the next MSP opportunity

Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. For the last couple of years, we’ve spent a lot of time talking about how managed service providers can help their customers adopt artificial intelligence. But there’s another side of the opportunity that’s becoming increasingly difficult to ignore, helping customers manage and secure the AI they’re already using, whether their IT department knows about it or not.

WatchGuard’s recent cybersecurity hygiene report found that nearly two-thirds of employees are putting work-related information into AI tools that haven’t been approved by their organization. That’s an enormous potential security and governance problem. But for MSPs, it may also represent a significant new business opportunity. My guest today is Joe Smolarski, CEO of WatchGuard Technologies, who joins us fresh off the company’s North American Partner Conference in Nashville.

Joe argues that AI governance is quickly becoming a necessary part of the MSPs portfolio and that at least for the foreseeable future, it’s something MSPs should be able to monetize as a distinct managed service rather than simply absorbing into their existing offerings. We’ll discuss what that service might look like, how MSPs can demonstrate its value to customers, and why the transition from shadow AI to autonomous AI agents could make the stakes considerably higher.

We’ll also get into WatchGuard’s own AI strategy, including its efforts to let MSPs help shape its development roadmap, a commitment to delivering new AI agents every two weeks, and some interesting developments on the data governance front. It’s a conversation about the risks of AI, certainly, but perhaps more importantly, it’s about how MSPs can turn those risks into opportunities while preparing for what comes next. Let’s get right into it, my chat with Joe Smolarski.

Robert Dutt: Joe, thanks for taking the time. Good to talk to you again.

Joe Smolarski: Yeah, Rob, great to see you and great to be here. Thank you so much.

Robert Dutt: Your cybersecurity hygiene report found that almost two-thirds of employees are putting work-related information into AI tools that their organizations haven’t approved. That’s pretty remarkable. We’ve talked about shadow AI for a while, but we’re at the point where almost two-thirds of organizations, two-thirds of people in organizations are doing that kind of thing. Are we at the point where businesses have pretty much lost control of how AI is being adopted inside their organizations?

Joe Smolarski: They have, Rob, because this is a predicament unlike almost any other in the fact that there’s actually, the employees aren’t doing anything wrong from their perspective, not even close. They’re actually trying to be good employees, and they’re trying to be good employees because all of us, including me, are pressuring people that you’ve got to use AI, you’ve got to be more efficient. If you’re not using AI, you’re not tech forward and things like that.

That’s literally the corporate direction of every company at this stage because you feel like you’re going to not be able to compete with your competitors that are out there because if they get the AI advantage, et cetera. What’s happening, because a lot of the corporate AI deployments just aren’t where they need to be. They’re still kind of trialing things and kicking the tires and rolling some things out. Employees feel the pressure of, “I may lose my job if I’m not AI savvy and I’m not using AI to produce more,” et cetera.

They’re out there feeling like they’re being a progressive employee, downloading their own applications and whether it’s the standard stuff. Some of them are creating agents and it’s not even technical people. This is a tongue-in-cheek joke, but I joke that my sales team, they’re not technical, they’re salespeople. Yet my head of sales is out there creating agents to do things to automate the task. I always joke with them that if a sales guy can do it, anybody can literally do it. That’s the weird situation that we’re in.

You can’t shut it down because if you shut it down and you just block everything and take the maybe more conservative approach, then you’re going to be at a competitive disadvantage of these firms in particular like in the MSP world, et cetera, but also their end customers. So it’s very, very interesting time to be in this space right now.

Robert Dutt: You’ve got so much pressure coming in in both directions and the role of IT or whoever is overseeing this can sometimes be at odds with the executive crew that’s go hard, go fast.

Joe Smolarski: 100%. Yeah. At my last firm, I was trying to get an AI tool approved because I was getting pressure from the board and literally sat there for three months waiting for approval. I got disgusted and said, “Guys, I can’t wait anymore. I’m going to get fired. We’ve got to get this thing approved.” And I had to literally sign my life away and put my personal commitment that the tool was safe and those kinds of things. So yeah, there’s backlogs.

There’s all kinds of issues that are making it more complex, but we have to navigate it because as we all know, while obviously there’s smoke and mirrors and some of what you hear is bullshit, most of it is accurate and there’s no doubt this is a technology transformation unlike probably anything we’ve seen in a very, very long time.

Robert Dutt: So to your point on that, that pressure that’s coming from both sides on the, we’ll call it the, you said the salesperson, the average employee, whoever that is in whatever role they’re in. Your research talks about AI governance and shadow AI as two of the biggest challenges that MSPs are helping their customers address, but are those really two separate problems or are they kind of the same thing from two different perspectives?

Joe Smolarski: Yeah, I would agree. It is the same thing and what is super, super important because we already concluded you can’t just be overly conservative and stop everything and block everything. Since you can’t, then you better know what’s going on in your environment because ultimately you have to understand how your employees are exposing the firm. So by using things like the WatchGuard stack, because very often it’s not just one tool. You can’t just pop in one tool. There’s so many ways that they can get around things.

They can use their corporate account, their personal account. They can do things in the network. They can create agents. You just don’t know where it’s happening. So by having the right governance in a cybersecurity stack, WatchGuard or others, you certainly get the visibility. You then can make some decisions. Is this the right people with the right tools that we want? What types of data are they putting in there? Many firms, we had 500 MSPs at our North American conference this week.

We asked, even basics, who has an acceptable use policy for all of their end customers? They don’t even have that when it comes to AI and things like that. So you can get a lot of the basics in place by knowing what’s happening in your environment by having shadow AI visibility and tooling to decide what to do. Then of course, you can set up rules and configurations and everything else to then go from there.

Robert Dutt: So let’s take this a little further from the MSPs perspective. We’ve been talking for a while about MSPs helping customers adopt AI. Is there now a significant opportunity in helping them manage and secure what they’re already using? Basically, is AI governance becoming a distinct managed service opportunity on top of rolling it out, developing it, strategizing it, et cetera?

Joe Smolarski: Yeah, it certainly is, Rob, from both sides. We talked about the one side of AI from a “you have to be using it from an efficiency perspective.” I talked with one of the larger MSPs in North America two days ago, and he said he’s changing his model. He’s now putting a business analyst as the first person to go to a new customer to sit with them and understand how their business works and how they can use AI, not in a way that just gets them frustrated because it’s giving them a poor experience, but one that’s tailored to their business, etc.

You have that side of it that you have MSPs absolutely monetizing the opportunity. Then on the security side, I think one of the good things is the media is doing the work for us in terms of one of the biggest challenges for MSP is the fact that they’ve got to educate their clients on why they need security and why they need this and why they need all these different components and it’s super tiring for MSPs to have to do that, etc. In the case of AI, literally at the top of world news over the last couple of weeks is Dario and Sam from the big LLM companies, Anthropic and OpenAI, saying that if we don’t slow this thing down, very bad things are going to happen in this world and that’s the leading opener on world news every night.

At least the businesses are seeing that and they they absolutely are recognizing I need help. Quite frankly, Canada in particular, but US as well, Canada runs on small and medium-sized businesses. That’s the bulk of the economy and none of them can hire an AI governance team, literally zero. That’s going to be the MSP and the MSP gets to monetize that and to your point, it’s a separate service that they can layer on top that the firms don’t need to be overly convinced because of all the attention being placed in the media, etc.

Robert Dutt: Especially as an MSP is spinning this up, what does it look like? How are we helping customers recognize the value before something goes wrong? I guess I’m curious, do you think customers are looking for MSPs to help with the governance or is it still something that MSPs have to educate them about and do that role that you’re describing of providing the information, even if it’s headline news?

Joe Smolarski: Yeah, it’s a little bit of both. Like I said, I think that the media has made our jobs a little bit easier because it’s not completely foreign to them and they don’t think you’re a crazy person by saying that very bad things can happen to your environment. Hey, listen, 60% of the firms that get hit with an attack or a major compliance fine or whatever, they’re out of business within four months. So that recognition is there, I think, at this stage for most of the MSPs.

And then listen, MSPs need help because you have MSPs of all sizes. Some are very, very large and in Canada, your F12s and others that, or even your telcos and things like that, that have a big presence. But most MSPs are on the smaller side, supporting the local businesses around their communities. And they need a large vendor that can help them, help them with resources, help them with educating their end customers and various webinars and things like that.

And that’s where your WatchGuard and your industry leaders will help the MSPs, at least with that entry level of why their end customers need it, et cetera.

Robert Dutt: So especially for that smaller MSP and especially the one maybe who hasn’t gone too far down this road, if I want to start offering AI governance services, what does that look like? What am I assessing? What am I monitoring? What am I delivering to a customer? What does the service model look like?

Joe Smolarski: Number one, one of the great things that MSPs have done is use tooling even before the ink is signed on a contract to just show the prospect at that stage what they are not aware of that’s happening in their environment. And a lot of the shadow AI tooling, including WatchGuard, can help you do that before you even sign a deal. So you can literally spend five minutes and configure some tools and it pops up and they’re able to say, “Mr. Acme Corporation, Mr.

Bob’s dental office or law office, are you aware that 93 of your employees have uploaded sensitive data in your environments? Are you aware that 120 of them have subscriptions for blah, blah, blah, that they’re being used in your corporate offices?” So that in and of itself is such a great way for an MSP not to have to do a ton of work, but literally very briefly, very quickly show a prospect and future customer that this is what’s going on in your environment and this is why you need me as an MSP to help you stay protected so that you’re not running blind because we know if you run blind in some of these areas, very, very bad things can happen, right?

You have your hugging face situations obviously at a big global scale, but that’s happening across the board, right? That’s happening when people are creating agents, not because they’re malicious, they’re creating agents because they’re afraid they’re going to lose their job, that if they don’t become more efficient and stay up with everybody that’s using AI, that they’re going to be obsolete. So they go and do these things with very good intentions and many IT departments haven’t caught up.

So this agent isn’t, the identity of that agent isn’t protected the way you would protect a human being and it goes off and does very, very bad things in an environment and can ultimately put somebody out of business exposing customer data, which obviously once things like that happen to SMBs, again, can be a business killer. Or if you’re a executive assistant at a dental office and she’s doing her best and she tries to get something done, but unfortunately uploads sensitive medical data in a tool, not knowing it’s going out into the ether and that’s a HIPAA violation, et cetera.

So it’s all of those things that companies like WatchGuard and others can help you fight against and get the visibility and then govern and stay on top of it while allowing them to progress their company’s efficiency efforts to keep up with the times and stay competitive.

Robert Dutt: From the MSPs perspective, how do you see the economics developing over time? Is this something that an MSP can package up and charge for separately or does it kind of, like so many things in various transitions of the past have over time, kind of been rolled into table stakes and just another responsibility that they have to deliver to customers because that’s what an MSP does.

Joe Smolarski: Understood. So I would say first, number one, you have to be doing something as an MSP. You have to be doing something. You must be doing something from a cybersecurity perspective to protect against AI. So whether it gets monetized or not, I do believe if you want to be in business 18 months from now, you have to be on top of that game just the way 15 years ago you were for antivirus or whatever it may be. So I think that’s the level, that’s the pace that’s happening right now.

The people smarter than me, billionaires in the investment world, they don’t talk about AI and kind of the models of today. Everybody knows where these things are going, the velocity and how fast the world is changing. So having that visibility, not as well, maybe it’ll happen, but knowing how fast these models are going to automate so many different things and do very, very promising things and very scary things, an MSP has to be in the game. So it’s not up for debate.

And then in terms of monetizing it, there’s no doubt to me in the next, call it midterm, 12, 24 months, that this should be an incremental service that’s being provided. This is not something that just gets folded in to the rest of the services and all of a sudden it’s part of your platinum package or whatever. I think it is so top of mind, not only for MSPs, but the world, SMBs, large companies and everything in between, that this should be a separate line item that you’re monetizing to keep them protected and sleeping well at night.

Robert Dutt: We’re coming off your partner conference just earlier this week as we speak, a little bit after that as this airs, I’m pretty sure. And there, I’m sure you guys were rolling out the company’s priorities, the product direction. How much of the roadmap right now is being shaped by AI governance opportunities that we’re talking about? And where do you see WatchGuard helping MSPs build those capabilities?

Joe Smolarski: Yeah. WatchGuard’s in a very fortunate position that we’ve got almost the entire stack covered. And again, a large part of our strategic direction is don’t just add more tools, but put the AI security capabilities in every layer of the stack, et cetera. And a good example of that is like we’ve been talking about with shadow AI. So with shadow AI, we’ve got it from a SaaS security perspective. And so we’ve got shadow AI in our CloudDR SaaS security application so that you can see what’s happening in all your SaaS applications and see what subscriptions are being signed up for and what tools are being signed up for.

You get visibility into all of that with our SaaS security, but you got to know what’s happening in the network, what agents are running, what other applications are running, what’s happening in a corner over here, et cetera. So we built the shadow AI capabilities and announced it to the world this week from a firewall perspective. The red Fireboxes that WatchGuard is so famous for. And then you’ve got your remote users and your remote users are out there and they’re doing anything they want.

They’re using their personal accounts and it’s much, much tougher to govern. So with our focus on remote user security and our SaaS application, we built it in there. So I could even see if you’re using ChatGPT or OpenAI or agents using your personal accounts as well to just make sure you’re covered across the board. So that’s on the AI security. And again, we’re doing it in every single layer. We’ve got it embedded in the endpoint, looking for algorithms using AI in our own models and everything else.

But then it’s also imperative to address the overwhelmed MSP that just doesn’t have the labor to keep up with all of these new things and everything else. So we launched our agentic workforce. We announced it in May, it’s called Rai, R-A-I. And ultimately, it became very real in this October time period. We flew in, we had MSPs from 20 countries around the world, but we flew in five contest winners. You may have seen, we launched a $10 million investment campaign that said, you know what, it’s funny, I actually, I went to the board about four months ago and told them I needed incremental funding to make sure that WatchGuard was ahead of the game from an AI perspective.

And my first pass, I got rejected, which is never good. You get pissed off and all of that. But what we went back with was, you know what, we are not going to define what we’re going to build with the 10 million. We’re going to have our MSPs, we have 25,000 MSPs, and we’re going to get the feedback from them on exactly what we need to build versus a bunch of mad scientists in a WatchGuard office on a whiteboard, et cetera. So we launched the campaign, we had five winners from around the world, and we brought them in and ultimately showed the fruits of their labor from an agent doing work on their behalf so that they can just get out of the mundane and focus on some of the more value add activities as well.

So it’s a heck of a time in the industry, and we believe WatchGuard is at the forefront of that.

Robert Dutt: Any surprises in what that surfaced, what MSPs told you they wanted needed to do for their customers as opposed to what you guys may have thought you were going to end up building going into it?

Joe Smolarski: Yeah, no doubt. We were super thrilled that we took that direction because for as much as we try, like every firm tries to stay super close to your customers and get feedback and listen, nothing better than putting some skin in the game for them and the fact that we’re going to go build if we like your ideas, we’re going to go build it and we’re going to give it to you and we’re going to help you automate your business without you spending any money. And that got people super excited.

And I think overall the focus on getting not even the super fancy things, but just get rid of the manual labor that I know when you see the power of AI that you can just get rid of that when we are doing a competitive displacement, right? There’s a lot of our competitors out there have had a bunch of, you know, major vulnerabilities and CVEs. So you got somebody coming across from one of those to become more secure. And it’s like, you know, AI is awesome at saying, I want to go from here to here, do a conversion for me.

And previously, that’s like a very time consuming effort. And in this situation, that’s what they’re asking for is cut out that labor, let me convert from one of your competitors over to you very quickly. And we’ve been able to do that. And we’ve been able to turn that around very quickly. So we’re excited and we are continuing to listen and can’t wait to get more ideas from each of the different regions, etc.

Robert Dutt: One of the big recurring challenges for MSPs is no doubt complexity. And this both potentially adds to it in that you’re adding another layer of service that you’re providing around AI governance, but at the same time, hopefully it’s using that AI to roll up some of that, make it more manageable. How do you help partners address this new need without making it a new layer of products and consoles and operational overhead and challenges?

Joe Smolarski: Yeah, it goes back to what I said earlier, Rob, which is, I think you hit it absolutely spot on, which is they just don’t want more tools. They can’t, they don’t, they don’t have the time to continue to keep up with this environment. It just doesn’t work. Labor will always be an issue in terms of hiring more people and the cost of that and the complexities of that and everything else. So, you know, our approach is just build it into what is already there in the stack and make sure each layer has the agentic controls and the shadow AI and all of those things versus, oh, you need to buy three more tools.

That’s not our approach. That’s not going to be our approach because of the exact reasons that you said of just people being overwhelmed and no longer having the staff to keep up with the top, the new tool du jour and it just won’t work.

Robert Dutt: So you’ve got a chance to get the latest and greatest out there with the help of your MSPs. You know, as you look out over the next 12 months without necessarily pre-announcing anything, of course, but what are you most excited about being able to do to just make a meaningful difference for how MSPs deliver their services in this area over the next six months or a year? It’s hard to look too far in the future at this point in the game.

Joe Smolarski: Yeah, for me, listen, if you talk to my head of engineering, Jay Misra, he’ll tell you, “Joe, I’ve got the foundation now. Now I can move super fast.” So I think five months ago we announced it in terms of Ray and what we’re doing from an agentic perspective. In October, we showed it to the world, but the foundation now is built, and now we can move super fast from the next set of agents we’ve committed to the world, a new agent being published every two weeks to continue to move the needle, et cetera.

So I think it’s those kinds of things. And then of course, we had some validation, WatchGuard’s working on a large acquisition around making sure not only do we tell you what’s happening from a shadow AI perspective, but making sure from a data governance perspective that we can stop it. If we see sensitive data being copied into certain tool sets from an AI, et cetera, before you expose your company and expose yourself to violations and potentially going out of business, being able to stop those things as well.

So that’s what we heard they need. And that’s what we’re very, very quickly working to fill that gap. And we’re excited about things like that and just the ability to move so much faster. We have time and time. We had an idea just, and this applies to all companies, not just cybersecurity, but we take things from idea to even brand new product, but idea to production in short time periods now, thanks to the amazing tooling that’s been put out there by these AI providers, things that would have never been possible.

We had an idea of, you know, WatchGuard’s an expert on the network from all 30 years of firewall experience and everything else, but we didn’t have an NMS tool. So MSPs had to go and do exactly what you and I just said is very frustrating, Rob, and download another tool and put in something else and those kind of things. We had an idea in April and we launched it in October and things like that just, it wasn’t possible before. So that’s the fun part of this time.

I caught up with some other MSP software CEOs that we had as guests, including Chris Day from ScalePad and some others. Chris is a Canadian as well, right? I’m sure you know Chris very well. So Chris was at the conference, but if you see like the pace at which he’s running every single week, he personally, even though he’s a CEO of a large company, posting like major advancements like that, that’s a super fun time to be in this space and be able to operate at that velocity.

Robert Dutt: So far, or at least the early days of the game have been about shadow AI and identifying and managing that. How does the game change as agents become much more prominent as they’re becoming at a business level and even in recent weeks down to the personal level with meta and with dots and with everything going on on that side?

Joe Smolarski: Listen, for as much as AI is real and for as much hype as there is, AI still isn’t moving the needle inside most companies yet. And that’s just the fact that if you ever go and ask people to be honest and not feel like they’re going to expose their weaknesses, most companies have done an awful lot and they know what’s possible and they’re on the brink of really cool things, but they haven’t gotten the ROI yet. They haven’t really got things at a finish line, but we know that’s not because of weakness of AI.

That’s just maturity and that maturity is coming fast and furious. It’s coming in Q4 of 26 and it’s certainly coming every quarter of 2027. So that’s where we just have to be prepared for that onslaught. If we worry about the bad guys, we’ve been talking about the adversaries and all these people in other countries that are state-sponsored and whether it’s Russia, China, or anything else, trying to attack our firms, etc. But I strongly believe that the big enemy is going to be the first agentic breach that’s not coming from a clever attacker.

It’s coming from an agent that nobody knew had admin rights and it’s sitting out there doing very bad things because that is what can occur. You do need to make sure that you’ve got the platform in place. We’ve talked about it. You’ve done many, many podcasts on it. You as an MSP, you as a small to medium-sized business, maybe if you’re Citigroup or RBC or some major corporation, maybe you can put individual point solutions in. Nobody else can though. You need a platform that’s talking to each other.

It’s correlating data and making sure it minimizes the noise for you. Then that’s really where the opportunity is to be able to keep up with this fast-moving world and both exciting, scary, all in one.

Robert Dutt: How do you think MSPs are doing in keeping up with that transition? I’m curious. We’re acknowledging that some are going to be ahead of the game, some behind the game, but as a community, how are we doing in terms of getting our arms around shadow AI and getting that managed, but also starting to think through what happens as that starts to take action on the agentic side of things.

Joe Smolarski: Yeah, I would say it probably follows the rest of the world. The larger MSPs that are starting to roll up the industry, they’ve been at it for a couple of years now. They have good foundations. Some of them have made acquisitions to get some of the core foundational pieces. I was with some of the larger MSPs this week and made moves like that. I think the larger ones believe that they are going to have a competitive advantage. The smaller ones have struggled and they’re behind.

They need to pick a partner that they can get help from because otherwise they won’t be able to keep up with all of the massive players that are out there. You see it. Everybody sees it. This was a very decentralized, disjointed, industry of tens of thousands of small players. That roll-up has occurred over the last five years. I think it’s accelerating. I think AI will make that even greater from an acceleration perspective. But you can keep up if you choose the right partners that can help you bridge that gap.

Even though you’re small, you’ve got a big company that can back you up that focuses in on the MSP, knows the space, give you the tooling, give you some of the expertise to help you bridge that gap.

Robert Dutt: Last one for me, if you were running an MSP today, what’s the one thing you’d be doing to try to position the business for the opportunities and the challenges that we’ve been discussing around AI governance in particular?

Joe Smolarski: Yeah, I would say you have to get in front of it now. It is a rate of change that’s occurring that’s unlike anything that’s been out there before. This isn’t a situation like the movement to the cloud from SaaS applications and maybe I’ll do it now. Maybe I’ll sit on exchange for a couple more years and eventually get people over. You’ll be out of business if you don’t get in front of this movement now because while we said the ROI isn’t there yet, it will be. Everybody knows that.

Everybody knows they’re going to have a competitive disadvantage. I’m talking their end customers. Therefore, everyone is using the tooling now at this stage. Older generations, newer generations, everyone is because they don’t want to lose their jobs. They don’t want to be obsolete. Therefore, an MSP just has to say, “I have to get on this now.” If you’re big enough to do a lot of things on your own, amazing. Most are not. 99% of MSPs are not.

They’ve got to pick a horse to ride from a major platform provider and just double down and then just go, go, go. Now is the time. It’s both scary and can put an MSP in a very vulnerable position, but it’s also a great opportunity given all of the news, all of the media. It’s a capital financial opportunity for MSPs to jump on and now is the right time.

Robert Dutt: Never a dull moment at the intersection of security and AI.

Joe Smolarski: A hundred percent.

Robert Dutt: Joe, thanks again for the time. I appreciate it. I appreciate the insights and yeah, thank you.

Joe Smolarski: Always a pleasure, Rob. Thank you so much. Take care.

Robert Dutt: There you have it. Joe Smolarski, CEO of WatchGuard Technologies. Thanks to Joe for joining us and of course, thank you for listening. Few things that stood out for me from that conversation. First, the AI governance opportunity is starting to look a lot more concrete. We’re moving beyond the abstract question of whether businesses should be using AI and into the much more practical reality that employees are already using it, sometimes in ways their employers don’t understand or control.

That creates an opening for MSPs to help customers identify what’s happening, establish appropriate policies and manage the risks. And Joe was quite clear that he believed those capabilities should represent an additional revenue opportunity rather than simply another responsibility bundled into existing services. Second, I thought WatchGuard’s approach to developing its own AI capabilities were interesting, particularly the decision to have MSPs help determine what the company should prioritize.

The example of using AI to automate security product migrations is a useful reminder that some of the most valuable applications of AI may be the least glamorous, eliminating repetitive work and giving MSPs more time to focus on their customers. And third, there’s the question of what happens when AI stops simply answering questions and starts taking action. Joe’s prediction that a major security incident could come from an AI agent with privileges nobody realized it has is a compelling reminder that identity, access, and governance will only become more important as these technologies mature.

If you enjoyed the conversation, you can subscribe to the podcast wherever you get your podcasts, on Apple Podcasts, Spotify, YouTube, everywhere you find shows. And if you have a moment, please do rate or review the show. It helps other people in the channel discover us. Till next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.