ОБ ЭТОМ ЭПИЗОДЕ
Today’s headline news for Canadian IT solution providers:
- ConnectWise works to restore cloud services after Microsoft 365 security incident: ConnectWise continues investigating unauthorized access involving application identities associated with Cloud Backup, formerly known as SkyKick, after attackers used compromised credentials associated with the service to authenticate to customer Microsoft 365 environments.The company discovered the activity October 15 and subsequently disabled seven application identities. It also suspended Cloud Backup, SaaS Security and Cloud Management while conducting its investigation and validating remediation measures.
As of Monday evening, the services had not been restored. Scheduled backups, access to affected backup archives and restoration capabilities remained unavailable, along with SaaS Security monitoring and certain Cloud Management functions.
ConnectWise chief technology officer David Raissipour told CRN in an interview Monday that the disruption affects several thousand MSP partners worldwide. He said the company has made significant progress toward safely restoring services, although no restoration timetable has been confirmed.
The underlying security incident extends beyond the operational disruption.
Independent research by Huntress documented unauthorized Microsoft 365 authentication using a compromised ConnectWise Cloud Backup credential, with unauthorized sign-ins confirmed across more than 160 customer tenants.
Huntress also identified activity in which a separate ConnectWise Cloud Management application assigned itself Global Administrator privileges in one tenant and added credentials to other trusted applications.
That finding is significant because disabling the original affected application does not necessarily eliminate other credentials or permissions established during unauthorized activity.
ConnectWise says the affected shared credentials have been invalidated. It has observed no successful threat activity in its monitored environments since October 17 at 1 a.m. Eastern.
The company also reports no evidence that its stored backup archives have been accessed. Those findings do not establish whether individual live Microsoft 365 customer environments were affected.
ConnectWise has expanded its technical guidance and published additional suspicious IP addresses for partners to investigate.
MSPs are being advised to review their own Microsoft 365 tenants and every customer environment they manage, including dormant SkyKick connections. Recommended checks include application sign-ins, credentials, privileged roles, consent grants, policy changes and potentially unauthorized mailbox configurations.
Partners should preserve relevant evidence and keep affected applications disabled until ConnectWise provides formal reconnection instructions.
The incident highlights a growing security challenge for managed service providers: highly privileged third-party application identities can create exposure across multiple customer environments if their credentials are compromised.
Because the investigation and service restoration efforts are continuing, affected providers should consult the ConnectWise Trust Center and live service-status page for developments after Monday evening.
- Cloudflare expands AI workspace integrations and deployment partnerships: Cloudflare has announced an expanded partner ecosystem for Cloudflare OS, its enterprise AI workspace designed to help organizations build and operate AI-driven workflows using existing business applications.New integrations connect the platform with applications including Asana, Box, Canva, ClickHouse, GitHub, Gong and Notion.Cloudflare OS allows users to describe tasks or automations in natural language, with the platform building workflows and connecting them to approved enterprise systems.Cloudflare says its approach emphasizes centralized security controls, limiting access to necessary data and providing visibility into AI activity. Its AI Gateway can also help organizations manage model selection and consumption costs.
The company is working with managed-services and deployment organizations including EPAM, HappyCog and Towards AI to help customers implement the technology.
Those partners can assist with identifying useful business processes, connecting enterprise applications, configuring controls and deploying AI agents.
For Canadian solution providers, the announcement illustrates a growing services opportunity around AI implementation and governance.
Rather than simply supplying AI software, partners may increasingly be responsible for integrating agents into customer workflows, controlling their access and managing their ongoing operation.
Cloudflare has not announced a new Canadian MSP program or specific partner incentives as part of this expansion.
- Rewst makes AI-native MSP automation platform globally available: Rewst has announced worldwide availability of its new automation platform, allowing managed service providers to create workflows, forms, dashboards and client-facing applications through natural-language instructions.The October 13 release builds on capabilities previewed at Rewst’s FLOW conference earlier this year.The Rewst Agent can translate a description of an operational process into an automated workflow, using integrations and permissions already configured within the MSP’s environment.Users can inspect, test and modify the resulting workflows before approving them for deployment.
Rewst says the platform maintains separation between customer environments and applies client-specific credentials and permissions to automated processes.
The company reports that more than 110 MSPs participated in early access. During one 30-day period, those organizations collectively executed more than 1.25 million workflows and 58 million tasks across 340 integrations.
Those are vendor-reported usage figures, rather than independent measures of productivity or cost savings.
The platform is also designed to help MSPs create customer-facing applications and portals, potentially extending automation beyond internal service delivery into new billable offerings.
For MSPs, the larger opportunity is to make automation accessible to employees who understand business processes but may not have specialized scripting or integration skills.
The new platform is available globally to new customers. Existing customers will receive access progressively, while Rewst Classic remains supported.
- Ottawa expands funding for Canadian AI adoption: The federal government has added C$500 million over five years to the Regional Artificial Intelligence Initiative, bringing total national funding to $700 million. The program supports eligible AI adoption and commercialization projects through regional development agencies. Applications are currently open in southern Ontario, with a January 19, 2027 final deadline and an earlier November 24 deadline for certain projects.
- Microsoft issues record October security update: Microsoft’s October 13 security updates addressed approximately 1,413 vulnerabilities across Windows, Office, SharePoint and other products. The release includes a Windows Shell security-feature bypass, CVE-2026-96951, that was already being exploited. MSPs should prioritize affected systems according to actual exposure and exploitation risk.
- Torq introduces new AI security operations partner program: Torq has launched Torq REV, a channel program for resellers, systems integrators, MSSPs and managed detection and response providers. The program includes deal protection, services-margin guarantees, technical enablement and different routes for partners to sell and deliver AI-driven security operations capabilities.
- Sabiki offers free Microsoft 365 AI-readiness assessments: Sabiki Security has introduced a free AI Readiness Scan designed to help MSPs and MSSPs identify risky Microsoft 365 configurations, excessive permissions and unmanaged non-human identities. The assessment performs more than 100 checks and includes selected automated remediation capabilities. Sabiki is positioning the free service as an entry point to its broader AIRM platform for monitoring and governing AI-agent identities.
- Canadian CISOs warn AI is accelerating security challenges: Kyndryl’s latest Canadian security-leadership discussions highlight concerns that AI is shortening the time available to identify and respond to vulnerabilities. Separately, Kyndryl’s 2026 modernization research found that only 46 percent of Canadian respondents were fully confident they understood their applications and dependencies before beginning modernization projects. The findings reinforce the importance of asset visibility and foundational security controls as organizations adopt AI.
Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Tuesday, October 20, 2026, and here’s what’s happening in the channel today.
There’s a major security incident affecting ConnectWise and its managed service provider customers, and as of about nine o’clock Monday evening, the company is still working to restore several suspended cloud services.
ConnectWise discovered unauthorized access involving application identities associated with its Cloud Backup service, formerly known as SkyKick, last Thursday.
Over the weekend, the company disabled seven application identities and suspended Cloud Backup, SaaS Security and Cloud Management.
That means scheduled backups aren’t running, customers can’t access affected backup archives or restore data, and certain security monitoring and cloud management functions remain unavailable.
The disruption affects several thousand MSP partners worldwide, according to ConnectWise’s chief technology officer, David Raissipour, who spoke with CRN on Monday.
But there’s also a more serious security concern behind the service interruption.
Researchers at Huntress have documented unauthorized authentication to customer Microsoft 365 environments using compromised credentials associated with ConnectWise Cloud Backup.
They’ve identified unauthorized sign-ins across more than 160 customer tenants.
And in one environment, researchers found that a separate ConnectWise application had assigned itself Global Administrator privileges and added new credentials to other trusted applications.
That matters because simply disabling the original affected application may not remove additional access established during the attack.
ConnectWise says the affected shared credentials have been invalidated, and that it has not observed successful threat activity in the environments it monitors since early Saturday morning.
The company also says its existing backup archives remain encrypted and isolated, with no evidence they’ve been accessed.
And there are some encouraging signs on the recovery front.
Raissipour told CRN on Monday that the company has made significant progress in its investigation and remediation, although there’s still no confirmed restoration timetable.
For MSPs, the immediate priority is to review their own Microsoft 365 environments and every customer tenant they manage.
That includes checking application identities, authentication logs, permissions, administrator roles and any credentials that may have been added to other applications.
ConnectWise has published detailed instructions through its Trust Center, and is advising partners to keep affected applications disabled until formal restoration guidance is available.
The bigger lesson here is about the power, and potential risk, of trusted third-party integrations.
A backup platform needs extensive access to customer data to do its job.
But when the credentials associated with that access fall into the wrong hands, one compromised connection can potentially expose multiple customer environments.
This remains a developing incident, and listeners should check the ConnectWise Trust Center for updates after our Monday evening recording cutoff.
Cloudflare, meanwhile, is expanding the ecosystem around its enterprise AI workspace, Cloudflare OS.
The company announced Monday that it’s adding integrations with a range of widely used business applications.
Those include Asana, Box, Canva, ClickHouse, GitHub, Gong and Notion.
Cloudflare OS is designed to let employees describe tasks or workflows in ordinary language and have the platform build the necessary AI-powered automation.
The system can then connect that automation to the enterprise applications and information it needs.
Cloudflare says the objective is to make those connections useful without giving AI agents unnecessarily broad access to business data.
The platform runs within Cloudflare’s infrastructure and includes centralized controls for security, visibility and AI-model consumption.
But there’s also a significant services component to the announcement.
Cloudflare is working with organizations including EPAM, HappyCog and Towards AI to help customers deploy the technology.
Those partners can help identify business processes worth automating, connect existing applications, configure security controls and build AI agents around customer requirements.
And that’s an increasingly interesting opportunity for the channel.
Businesses may be able to buy access to an AI platform relatively easily.
But figuring out which processes should be automated, how the different systems should connect, and how to keep everything secure is a different challenge.
Those are areas where solution providers can bring considerable value.
Cloudflare hasn’t announced a new Canadian MSP program as part of this expansion.
But the broader direction is clear.
As AI moves from individual productivity tools into business workflows, integration, governance and ongoing management become increasingly important services.
And Rewst is bringing its next generation of MSP automation to market worldwide.
The company announced last week that its new AI-native automation platform is now available globally to new customers.
The idea is to make it easier for MSP employees to automate work without requiring everyone to become an expert in scripting or complex workflow design.
A technician or service manager can describe the process they want to automate in plain English.
The Rewst Agent then constructs the workflow using the integrations and permissions available in the MSP’s environment.
That could involve onboarding a new employee, reconciling software licenses, handling a routine service request or producing a customer report.
And the platform goes beyond traditional workflows.
It can also create forms, dashboards and client-facing applications.
Importantly, the resulting automation isn’t simply deployed without review.
Users can inspect and modify it before deciding whether it should go live.
Rewst says more than a hundred and ten MSPs participated in early access.
During one thirty-day period, those organizations collectively ran more than one-point-two-five million workflows.
Those are company-reported figures, but they illustrate the scale at which automation is already being used.
The more interesting question is what happens when building an automation becomes something that employees throughout an MSP can participate in.
That could reduce the amount of repetitive work handled by technicians.
It could also make it easier for MSPs to create new customer-facing services and applications using the systems they already manage.
The new platform is available worldwide for new customers, with existing customers moving over progressively.
In Brief – Ottawa has added another five hundred million Canadian dollars to its Regional Artificial Intelligence Initiative, expanding funding for eligible businesses adopting AI and Canadian companies commercializing AI technologies.
Microsoft’s October security update addressed approximately fourteen hundred vulnerabilities, including a Windows Shell security flaw that was already being exploited.
Torq has introduced a new partner program for AI-driven security operations, with protected opportunities, services-margin guarantees and support for resellers and managed security providers.
Sabiki Security has launched a free Microsoft 365 AI-readiness assessment to help MSPs identify risky configurations, excessive permissions and unmanaged AI-related identities.
And Kyndryl says Canadian security leaders are increasingly concerned about AI accelerating vulnerability exploitation while many organizations still lack a complete understanding of their application environments.
Full details and links in the show notes or the blog post.
Later today on In The Channel, Dave Baggett from Kaseya joins us to discuss why simpler security could actually mean stronger security for MSPs.
We look at findings from Kaseya’s latest cybersecurity research, the challenges created by managing too many security tools, and how MSPs can improve their operations while making better use of AI.
That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.
