Why simpler security could mean stronger security for MSPs

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. We’ve spent decades talking about people being the weakest link in cybersecurity, and despite enormous advances in security technology, that fundamental challenge does not seem to be going away. Kaseya’s new 2026 Cybersecurity Report finds that 68 per cent of respondents identify human error as their biggest cybersecurity concern, but the research also highlights another challenge that may be just as important for managed service providers, the growing complexity of security itself. Organizations are deploying more tools, implementing more controls, and facing more demanding compliance requirements.

All of those things are intended to make businesses more secure, but they also create additional work for IT teams that are already stretched thin. And it raises an interesting question. At what point does the complexity of managing cybersecurity become a security risk in its own right? Joining me to explore that question is Dave Baggett, senior vice president and general manager of Kaseya’s Security Suite business. Dave and I discuss why building security that can withstand human mistakes is more realistic than trying to eliminate those mistakes entirely, and why simplifying security operations may be one of the most important opportunities for MSPs. We also get into the role AI could play in making security tools easier to manage, the challenge of convincing customers to invest in cybersecurity before something goes wrong, and what Kaseya’s research suggests about the relationship between security maturity and MSP business performance.

It’s a wide-ranging conversation about making cybersecurity not just stronger, but more practical for the people responsible for delivering it. Let’s get right into it, my chat with Dave Baggett.

Robert Dutt: Dave, thanks for taking the time. I appreciate it.

Dave Baggett: Absolutely. Great to be here.

Robert Dutt: Let’s start with the headline finding from the report, you know, a little over two-thirds of respondents identify human error as the biggest cybersecurity concern. You know, we’ve talked about people being the weakest link in security for probably as long as security has been done forever. There’s still such a persistent problem, and, you know, have we actually made any meaningful progress on this?

Dave Baggett: I think we have. I think one way to think about this is it’s a lot easier to manipulate people if you’re a bad guy than it is to find some vulnerability in a software system or, you know, so in some sense it’s because it’s easier. And you know, social engineering is just, it’s just so easy to be creative there, right? And one of the things that sort of always impresses me is how creative these bad guys are. And I often wish they were working on fusion power or something useful because we probably would have solved it by now. We are making progress though. I mean, it’s certainly true that forever this has been the number one source of breaches as you know, manipulating people. But we have been making progress.

One thing we we’ve leaned into with Kaseya with our email security in particular is trying to make the human part of the defense, right? So certainly the AI that we use blocks lots of malicious emails, but we also put yellow banners on some emails and that doesn’t mean we think the mail’s bad. We just want the user to slow down and pay attention before they go buy gift cards or click that link or fire money to somebody. And we found that’s actually really effective. That if you limit the percentage of emails you do this with, so they don’t become blind to it. Number one, and number two, you put in meaningful information, not technical verbiage. When people actually do stop and think for a few seconds and that materially lowers not only the rates of clicking on bad links, but all these other kinds of things that social engineering causes people to do.

Robert Dutt: One of the central arguments in the report is that we should probably stop expecting people to make the right decision every time and instead build systems that can survive and get around mistakes. For that smaller MSP who’s managing security across dozens or hundreds of customer environments, what is making that shift look like in practice?

Dave Baggett: I think part of it is making the tools easier to use because one of the things that we saw a lot of MSPs report to us in this was, hey, we just don’t have the time to manage all these tools. We can’t hire people who know how to use these tools well enough. So one of the things we think a lot about is how can we use things like AI to make the tools themselves simpler? How do we make the tools work better with each other? Because we heard a lot of feedback from this report, hey, we have to go to 17 different places to do things. We don’t like that. One of the things that I’m really optimistic about actually is we kind of envision the whole user interface for all these tools radically changing.

So instead of going to a UI and pressing buttons and clicking stuff, I think you’re going to see MSPs and admins in general using more like Claude Code kind of interfaces or copilot where they’re using a natural language interface and we’re going to expose MCP servers and that sort of thing to make that possible. So that instead of going, you know, imagine, you know, an admin generating a report to show one of their customers. Right now they would go to, you know, a webpage that’s a report generating webpage. Just imagine that being typing, hey, make me a report that has this information. And then on the backend, what we’re doing is building a unified data layer so that everything is stored, everything is queryable via MCP servers and all the information is shared across all the components.

The other thing we’re doing with AI is using AI, obviously we use AI to look for threats and we use AI to analyze things. Like for example, in INKY, the email solution we have, we can send an email to the AI and it’ll give you an analysis like an expert, right? It’s like a human expert. So you don’t need to have a human expert. But the other thing that I’m optimistic about is using AI to make recommendations about settings so that the admin doesn’t have to know every one of the thousand settings. I mean, some of these tools are really complicated, EDR for example, there’s lots of settings, the settings are hard to understand. So using AI to recommend to people, hey, you could suppress this noise, you could make these changes and so you’re not placing so much burden on the admin to know everything about the domain.

Robert Dutt: The research also talks about having a well trained internal IT or security team is the factor that is I think most frequently associated with coming back from an incident with rapid recovery. Exactly. So it seems like people are at the same time the biggest vulnerability and the most important defense, although obviously AI will be playing an important role there. I guess what I’m getting at is, you know, in this moment, how should MSPs be thinking about that balance between technology, automation, which also I guess follows under technology, but will treat as discrete for the purpose of this question, and human expertise?

Dave Baggett: I mean, I think that you’re going to still need to hire really, really good people. There’s no way we’re replacing all humans with AI anytime soon. You know, I think that what we’re looking at is, you know, people, when chess playing programs first came out, there is this funny term centaur chess, where you’d have a human use an AI to play another human using an AI. So the AI sort of augmenting the human’s ability. I think we’re going to see a mode like that for a while, where, you know, the AI is helping make more visible things that might be hard to see, you know, for a human, explaining to the human what these settings mean, for example, or, you know, another example is we have this tool, SaaS Alerts, which is cloud security.

And one of the things we’ve added to it is we’ve taken basically all of the knowledge of every Microsoft setting and baked it into an LLM. So now you can, as an admin, ask the LLM to look at your security posture in the Microsoft estate and then have it make recommendations to make fixes, and then it’ll actually go fix them for you. So this kind of human plus AI pair, I think is going to be the state of the art for quite a while. I think we, you know, at least we believe you need to have a human in the loop in most of these security contexts, rather than just have a bot go off and do things for you. I mean, you’ve seen lots of examples where it’s a bad idea to let these AI agents do whatever they think is sensible and they’ll go put your credit card information on the internet.

So for security, it’s going to be this kind of centaur mode, I think, for quite a while.

Robert Dutt: How realized is that at this moment in the state of tools that MSPs are using and where’s the biggest kind of, where’s the biggest bang for the buck opportunity to make that more real?

Dave Baggett: I mean, it’s real now in the sense that most of our products now have some sort of AI assistant capability and people always think of that as like a chat bot in the tool, but it isn’t just that. It’s things like alert suppression, an example that I gave earlier, which is what we call smart insights where you can take a result from EDR or email security and have an LLM analyze it. And in the case of the email security, we actually take all of the upstream analysis that we did and we put it in this form that’s digestible by the LLM and then it’ll come back and say almost like a human analyst. So you’re seeing a lot of that now. I think the leverage though, is going to come from again, all these things working together. Because one of the things that I realized, you know, I joined Kaseya by virtue of selling INKY, my company, last October.

And one of the things I realized was, you know, we had always, we’d been around for 10 years. We had always wanted to be the best at identifying malicious emails, right? Which sounds like a reasonable scope to go after. And for a very long time, we assumed you could do that simply by looking at the contents of the mail, which seems obvious, right? But in fact, now you’re seeing a lot of email born attacks where the bad stuff isn’t in the mail. Like it’s on SharePoint or something or, you know, it’s on a, you know, we’ll see, we’ll see examples of someone creating, you know, a PayPal account and then they’ll abuse the free form text for the memo or sometimes even the company name, you can put whatever you want in there and PayPal doesn’t filter it.

So people will create a real PayPal request, send it to the victim, and they’ll put in the memo, you know, you bought $150 steak knives, if this is an error, call this number, you know, and then like they call in their credit card harvesting scam. So you can’t actually look just at the contents of the mail. And this, I think, applies to basically all security contexts. And so where we’re headed and what I think is incredibly important for the whole industry is to make these tools talk to each other in real time. So we literally have a real time publish/subscribe event bus, where if INKY sees something weird, it can publish this. And then, you know, SaaS Alerts or whatever, EDR can pick it up, and the things are talking to each other. And that makes the sum better than the parts.

So I think we’re shifting from really a heuristic-based point solution world to more of an AI-assisted platform kind of world, where everything’s talking to everything else, and the AI is integrating all that information. And the other thing that’s tantalizing and isn’t really there yet, but I think we’ll get there in the next few years, is much more predictive cybersecurity. Like predict that this could be a problem, right? And the AI is clearly going to be capable of doing that with the right kinds of information. It’ll take a while to get there.

Robert Dutt: Something that caught my attention in the report is how much operational friction security itself creates. We talk about how important it is for MSPs to make sure their customers are doing MFA, make sure privileged account access management is set up right, make sure the compliance pieces are there, but that’s also consuming significant resources. We’re sort of reaching a point where the complexity of securing an organization is in itself a security risk. And I guess it has been historically, I mean, if you think back to, I guess the classic old school example would be, you know, we required a smarter password than the basics. Right. Not your dog man. One workaround is put it on a yellow sticky note on the monitor.

Dave Baggett: Yeah, totally. And I think we’re there. It is far too complicated to administer all this stuff. And that’s something that the tool vendors like us have to do better at. MFA really was an interesting one because, you know, from a user standpoint, it is really annoying to constantly have to do multifactor auth all day, multiple times. And yet that’s probably the most important control you can have. And in fact, we often debated pre-Kaseya at INKY, should we even let a customer buy our stuff if they don’t have MFA turned on? Because we would tell them, look, yes, we can, we can find cases where your account’s been taken over your email account. Like we can look at outgoing mail and see why is this account sending out huge amounts of phish right now? Or why is it sending out a giant burst of spam?

But that’s not the way to deal with that problem. The way to deal with that problem is MFA to prevent the account from getting taken over. So that I thought was quite interesting because clearly what MSPs are reporting is they’re having lots of issues with users needing help, or maybe just complaining about MFA. And yet MFA is kind of the most important control. I think the other interesting thing is you’re starting to see some user experience improvement and security like passkeys instead of every website having passwords. And if we can escape the tyranny of the password, I think that would help a lot. Because even us, we have to rotate our passwords. And what sometimes happens is the laptop password will be out of the sync with the Entra password. So then you need to know two passwords. They don’t sync up immediately.

Some Microsoft sync issues. So yeah, this stuff is still really hard to use for users. And I think some of this is just we’re going to be stuck with it for a long time. But I do see some evidence that things like passkeys give me some hope that it’ll get better.

Robert Dutt: So especially when it’s showing that security teams are being pulled away from the higher value stuff for the routine requests and these kinds of, you know, the customer who needs support for those kinds of basic issues that you describe there. For an MSP that’s already stretched pretty thin, you know, how do you reclaim some of that time without compromising the security of your customer or yourself ultimately?

Dave Baggett: Yeah, I mean, we think of it in, I guess, two ways. One is moving more towards managed services where we’re doing a lot of the management for the MSP. And one of the things that we’ve done with the design of our SIEM product and our MDR product is making visible what the rules are and allowing admins to edit them. But only if they want to. So they don’t have to. If they want us to manage everything, we can. We heard that there are two types. There are some MSPs that really want to be doing this themselves. And there’s others that are like, “I don’t have time to do all that. You guys just do it.” So I think that’s one trend. Managed everything is kind of the way I see the world heading.

The other thing we discovered at INKY is if you can move things that are normally resolved by tickets into a self-serve workflow, that is a huge win for the MSP. So an example is if a user gets a spam, they can just click spam. We put a banner, right? And we put links below the banner and the link is either report this mail and then we ask them, “What do you think it is, save spam or phish?” Or you can actually set it so there’s just a link, spam, save phish. So if they click spam, we ask them, “Do you want to block this sender?” Which means they can make it so they don’t get the spam anymore. They can also say, “I want to get this, but I want it to go to my graymail folder.” Just that user experience alone massively cuts down on email-related tickets.

Because every MSP knows you get tons of tickets, like, “I don’t want to get this mail anymore and I keep reporting it as spam and it doesn’t go away.” Make it stop, right? So I think in areas where you can make this accessible to a normal user, you make the MSP less burdened with all these nuisance tickets, number one, and number two, actually end users are happier. That’s important.

Robert Dutt: The survey says that, well, everyone says, internal IT departments, MSPs themselves say customers are under-investing in cybersecurity. Is the problem that there’s not enough funds going into it? Is it an insufficient budget issue, or is it how it’s being distributed? Are organizations just not making effective use of the budget they do have?

Dave Baggett: It’s probably some of both, but I think there is a human nature element that MSPs have to deal with, which is, we kind of see two kinds of approaches. There’s the MSP approach of, look, we make bundles for you. Maybe we have good, better, best. You don’t get to pick what you have. You’re going to get what we tell you. Then there’s the other ones that basically allow customers to pick and choose. In the second model, there’s always this kind of human nature of hope springs eternal. We really need to spend money on this. We’re probably not a target. That’s one of the things I’ve heard for a decade is, “Well, we’re a small company. We’re not a target.” I’ll tell you something.

We have evidence that people, bad guys, use bots to scrape LinkedIn to figure out when someone changes jobs and then send a phish to that person pretending to be their boss. It’s totally automated. You don’t have to be a company that matters to anyone to get targeted this way. Getting the message across that, “Hey, you are at risk like anybody else. In fact, if you’re smaller, you might be more at risk.” You’re now being targeted with things like AI. I think that there’s a constant challenge of getting the MSPs and customers to understand you really need to invest in protecting yourself. It’s things like backups too. Don’t figure out you don’t have backups after the ransomware.

We’ve been saying this stuff for multiple decades, but there’s also a sense, I think, that we hear this fairly often like, “Oh, well, if I have Microsoft, I’m all set.” Well, not really. You need multiple layers.

Robert Dutt: What are the things in this area that struck me about the report? We’ve talked a lot in recent years across the channel community on selling on business outcomes and that sort of thing. We’re talking about only, I think, 11% of MSPs in your research say that their customers invest on cybersecurity primarily because of a clear business case and just 9% say demonstrated risk reduction is the main driver. Those seem catastrophically low, aren’t they? Business to incidents are much higher, compliance is higher. I suggest I think that MSPs have a lot of work to do when it comes to selling security as business investment rather than IT expense.

Dave Baggett: Yeah, and one of the things that we really try to do is show improvement, show value. So we’ll do a quarterly business review with an MSP and show them here’s all the stuff we found. We actually have tools that let the MSP create reports that show the value. Like here’s what we blocked in the last month to constantly remind customers, the MSPs customers, hey, it’s important that you have this stuff. So it is an investment that’s paying off. And that’s another thing that I think AI can really help with because you can basically pose to the AI query, find all the interesting stuff we blocked over the last month and it’ll go off and do it, presuming that you have this unified data layer and you have a data lake that has all the information in it.

And then the other aspect is that the information is organized well, according to some sort of taxonomy, so that it’s not just a big pile of data. It’s actually organized in a way that can be queried in a structured way. I think compliance as a motivator is not a bad thing, actually. Compliance drives a lot of behaviors. Even like 20 years ago, it was the thing that led to phishing awareness training, security awareness training generally. It was like cyber insurers started to say, look, if you don’t train people, you’re not going to get a policy, or we’re going to reduce the policy cost if you do security awareness training. And look how much that’s just, I mean, that’s now ubiquitous, right? Everybody has it. So I think compliance is not a bad thing.

One thing that the report found, which I found quite interesting, is the fact that you passed an audit previously doesn’t mean you can now. And MSP self-reported that, right? And the other thing that they self-reported is configuration drift is a problem. So maybe you passed the audit six months ago or three months ago, but someone went in and disabled MFA, and nobody noticed, right? Like on some account. So one of the things that we’re seeing is there’s now this kind of configuration enforcement area of cybersecurity, and there are multiple products in this area. Like for us, we have a component called Fortify, which is in SaaS Alerts, essentially makes sure you don’t drift this way. You can say, here’s my settings, here’s the defaults, and if they change, let me know. And in fact, if they change, put them back, right?

So I think this, you know, compliance as a driver is really good, but passing an audit doesn’t mean you’re secure. And even if you pass the audit two months ago, it doesn’t mean you pass it today. It’s a point in time thing, right? Right. Yeah.

Robert Dutt: One thing that struck me in the research is the difference between high-performing and low-performing MSPs with performance defined as revenue and growth goals met. Yeah. High performers more likely to have incident response plans, test them, and be a little bit ahead of the curve in terms of more advanced security technologies. What’s, I’m curious, and I imagine it’s going to be at least somewhat a little bit of both, but you know, what’s your interpretation of the relationship? Is stronger security making MSPs more successful businesses, or are successful MSPs better positioned to invest in more advanced security in technology and process?

Dave Baggett: That’s a really, that’s a really good question. I mean, and to your point, don’t just have backups. You should test the backups too, right? Don’t find out your backup wasn’t really good when you have an incident, right? So I would kind of lean towards the second scenario, I think the more sophisticated MSPs are probably able to grow faster, have more budget, able to sell more expensive tools maybe with even higher margins. So that kind of argues for kind of a virtuous cycle. I mean, I do think that, you know, there, we actually see like, we actually see some really interesting patterns. So we’ll see MSPs that are regional, you know, like I’m the MSP who handles Oklahoma. That’s my thing. And then we’ll see like more vertical focused ones. I’m the MSP that does dentist offices.

And it’s interesting because there’s, and of course there’s other models too, and they all can be very successful. But one of the things we try to think through is how do we do enablement for MSPs? How do we help MSPs grow? So we’re not just relying on organic growth from them or them being experts at sales. We feel like we need to help make that easier, even providing things like collateral that people can tailor. So for us, since we’re so MSP focused, it’s better for us if MSPs generally grow and generally grow faster. And like there’s sort of a, if you look at the industry for the past 15 years, 20 years, I mean MSPs have grown like crazy, not just individual MSPs, which now we’re seeing them get aggregated by private equity through giving these mega MSPs, but also just the number of MSPs.

I think there’s something like 40,000 in North America now. And arguably it would be impossible to be a small business now without an MSP because it’s just imagine, imagine you’re a 50 person accounting firm and you’re supposed to figure out how do I protect myself from cybersecurity threats? There’s 3,500 products at least. There’s probably 25 different areas of concern. How would any IT person at these companies make any sense of all that? And by the way, it constantly changes. And that’s something that came up in the survey about compliance too. Well, how am I supposed to be compliant? They keep changing the rules every quarter. So MSPs are absolutely essential to the functioning of small businesses now. And I actually think there’s an opportunity similarly with AI. How does the 50-person accounting firm figure out how to use AI?

Just for their everyday business. I think MSPs can play a role in that. Like essentially be the experts on this really, really difficult, complicated domain like security.

Robert Dutt: So, you know, you touch on backup testing and that’s something that your report found that higher performing MSPs are nearly twice as likely to test their client’s backups monthly, which seems like a pretty fundamental practice. Yeah, I guess what I’m curious here is what would you think are the things that a smaller MSP who’s maybe not in that higher performing group could start doing relatively easily, inexpensively, quickly to start moving towards what that higher performing group looks like?

Dave Baggett: I mean, a few things come to mind. One thing I’ll mention is that we actually recently put into our backup infrastructure screenshot verification. So we literally take a screenshot of the machine and use AI to analyze it to verify the backup completed. And the error rate is like 0.01% or something, it’s very, very accurate now. And so using AI to do these sorts of verification tasks automatically is a big opportunity, I think. But in terms of practices that MSPs who are early in their maturity could do, I mean, number one, like we talked about MFA, like don’t even talk to me if you don’t have MFA turned on. That is like your accounts are going to get owned if you don’t have MFA. Yes, it’s annoying for users, but you got to have that.

And don’t use SMS for it, use an authenticator app because the scary thing we’re starting to see is people can intercept these SMS messages. So even if you have MFA, you can still get your account owned, right? So that’s the number one. It’s near and dear to my heart and maybe I’m biased, but number two would be email security. If you look at every single report, not just ours, but like the Verizon report that comes out every year, every year for the past forever, email security has been, email has been the number one breach point. Like if you, if you, if you look at almost every breach that happens, something like Verizon says something 91% start with an email. It’s been declining a little bit as email security, I think is getting better. It’s still by far number one, like it’s by far number one.

People are not sitting there writing, you know, CVE vulnerabilities to get into someone’s browser. That’s, that’s, yes, people do that, but that’s not the volume. The volume is phishing people, right?

Robert Dutt: Take a look inwards at MSPs own operations, you know, MSPs spend obviously a lot of their time advising customers on security best practices, making it real, but they’re also businesses with their own employees, systems, credentials, vulnerabilities. So I guess the, the physician, heal thyself question, Yeah. Are MSPs generally as disciplined about security for themselves as an organization as they are about securing their customers?

Dave Baggett: I would say yes. Yeah. I don’t, I don’t see many MSPs that are not securing themselves. I don’t, I haven’t seen that as a big problem. And actually one of the, one of the things that I really like about working with MSPs and not just at Kaseya, but even at inky prior to the acquisition, we decided around 2022 to focus really entirely on MSPs. And one of the things I really liked about and like about the MSP community is it is entrepreneurial, it’s founders, you know, and that’s, it’s a very different thing. Selling into that cohort than it is selling to some giant enterprise, right? Now at Kaseya, we kind of do both. We do certainly mid market direct sales to companies, but the vast majority is MSP. And I think, you know, MSPs typically I would say are several things sort of characterized MSPs for me.

One is entrepreneurial spirit, willingness to try things because there got to be somewhat, you know, accepting of some change in the world to be a business owner, right? So but then also like incredible overwork, like not enough time to get everything done. And so one of the things that our CEO Rania is focused on, all of us focused, focused all of us on essentially is figure out ways to enable MSPs to do more with less, spend less and do more figure out how to increase their margins. And if we just do that one thing, we will win because that’s the thing that’s so hard for MSPs. There’s too much to do. I’ve never met an MSP that was bored or idle. MSPs aren’t going out playing golf every Friday, right? I mean, this is not, this is not the lifestyle if you want to be a golfer.

Robert Dutt: No, no, definitely not. To bring this all together, We talked about human error. We talked about sort of the complexity behind security and operational complexity. We talked about constrained budgets, the difference between those who are performing the best and their peers. If I’m listening to this as an MSP owner and I want to take a meaningful step towards improving my own or my customer’s security resilience this week, you know, what’s the most likely first step?

Dave Baggett: Well, and I mentioned some specific things. I think, you know, AI is going to change everything. So we have some MSPs that are already using AI to automate our products and solutions. before we’ve even made it possible to do it in a first-class way. They’re just doing it. And some of it’s really, really impressive. I got an email from an MSP yesterday that was like, here’s this AI agent that we wrote. Here’s what it does. And I’m like, wow, that was like really, really impressive. And so we’re going to make it possible for people to create their own agents. We’re going to make it possible for people to share the agents with each other, potentially monetize them. So the more people can start using AI in their day-to-day work.

And I’m not saying everyone should go and write a whole bunch of stuff that automates our thing, but I feel like, you know, and we see this a lot with coding because obviously the code assistants are where you’re getting a huge amount of leverage. It takes a while to figure out how to use these LLMs effectively. We now have an LLM that triages events in our SOC. And it’s going to take a while for us to tune that and figure out how to make it as good as it can be. It’s a learning experience, just learning how to use this new technology. I know that sounds a bit facile, but in my own experience, just trying to play with these things in a coding context, the answer is not, you know, one-shot code something and vibe code it, never look at the code. That’s not the right answer, right?

The right answer is something like constantly challenge the LLM. Did you make tests? Like, did you make sure that the abstraction barriers are maintained between the different components? Like almost treat it like a junior developer. And so I’ve sort of come away with this feeling like, man, you need to have a lot of experience just using this stuff. Even though, yes, it is magical in a lot of ways, it still requires, you know, finesse and taste to use it well. I think that’s going to be true for the use of these tools in a security context. Also, like you’re not just going to say AI fix, fix security now, please. Like that’s not going to ever be right. It’s going to be, did you verify that MFA is enabled for these accounts? Did you, like, and challenging it, right? And making it iterative.

Robert Dutt: So if I’m an MSP, start playing with it today. And if I have already started playing with it, think about what that next level, that next layer that I can start thinking about how to add on is and kind of build from there. And you’ll probably find your own path along the way as you identify what it’s good at, where it helps, et cetera.

Dave Baggett: It’s also funny because talking to developers who are new to using LLMs for coding, it’s like they don’t realize, I often tell them, like, why are you trying to do this yourself? Just ask the LLM to do it, right? No, I need to go and make sure they file. No, just ask. And it’s such a mindset change that even the way you approach work has to change, I think. And this is, I’m sure, equally true for sysadmin, DevOps kind of stuff, right? You know, I need to go and make sure all my VMs are, nope, nope, you don’t. You just ask Claude, right? And so, at least for me, it’s like I’ve benefited a lot from just using this stuff thoughtfully, which is why I share that. I mean, maybe this is not, maybe it’s more me than anybody else, but like, I just have found every day I’m learning something about how to use these things.

Robert Dutt: Yeah, no, I think that’s, I think it’s good advice and it’s, you know, it’s fundamental to doing it and the more you use it, the better you get at using it and the more you discover that you can do. So I think it’s sage advice.

Dave Baggett: It’s also funny because when people start using them in the beginning, they’re really polite and say please and stuff and you don’t need to.

Dave Baggett: Well, maybe the robot overlords will be mad at me in the future, but right now I’m pretty blunt with my LLMs.

Robert Dutt: Just do it. Yeah. All right. Dave, I appreciate your take the time. Thanks for walking us through the survey and some ideas on how MSPs can get the most out of their client’s security spend.

Dave Baggett: Absolutely. A lot of fun. Thanks.

Robert Dutt: Thanks again to Dave Baggett of Kaseya for joining us today and thanks to you for listening. Few things stood out for me from that conversation. First, I think there’s an important distinction between trying to eliminate human error and building security that can withstand it. People are going to make mistakes. They’re going to click things they shouldn’t, overlook warnings or struggle with complicated security requirements. The goal has to be making sure those mistakes don’t turn into major incidents. Second, I thought Dave’s comments about operational complexity were particularly interesting. We’ve spent years encouraging MSPs to add layers of security and for good reason, but every additional tool, control and management interface also creates work. If security becomes too difficult to administer, that introduces its own risks.

That’s where some of the opportunities around automation, integration and AI become particularly compelling, not necessarily replacing security professionals, but making their expertise go further by reducing the amount of time they spend on the tools themselves. And third, there’s the relationship between security maturity and business maturity. Kaseya’s research suggests that commercially successful MSPs are more likely to have mature security practices. That doesn’t necessarily mean one causes the other, but it reinforces the importance of treating security as an ongoing operational discipline, rather than simply a collection of products. I also appreciate Dave’s point that MSPs need to help customers understand the value of security before an incident or compliance requirement forces the issue.

That’s a business conversation as much as a technical one. You can find more about Kaseya’s 2026 Cybersecurity Report, along with links to the full research in the show notes at ChannelBuzz.ca. If you enjoyed the episode, please do subscribe to the podcast wherever you get your podcasts. And if you have a moment, a rating or review helps other people in the channel find the show. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.