In the wake of several high-profile cybersecurity breaches involving artificial intelligence (AI) agents, many managed services providers (MSPs) may need to rethink their approach to cybersecurity.
Some, such as Managed IT Services Santa Clarita (MITSSC), are going even further. The MSP now requires cybersecurity services for clients that use any of its IT services.
AI raises the stakes for MSP security
The number of MSPs offering security services has increased substantially in recent years, but clients can typically choose whether to use them.
However, AI agents may try to access IT environments containing data that can help them complete a task. This behavior can increase the risk of a cybersecurity breach.
When a breach occurs, the MSP often ends up handling much of the cleanup. As a result, MSPs have good reason to require stronger cybersecurity protections from the start.
Making cybersecurity part of the core offering
MITSSC requires a review of each client’s devices, user accounts, network access, and backups. The MSP also adds multi-factor authentication to critical systems and endpoint detection and response to managed devices. Other protections include email filtering, regular patching, and verified backups.
Fully managed clients also receive around-the-clock security operations center (SOC) monitoring, vulnerability scanning, dark web monitoring, and ongoing security awareness training with simulated phishing tests.
Each MSP must decide whether more advanced AI models require a different approach to cybersecurity. However, MSPs often face some of the blame when clients experience a breach.
Adding cybersecurity services to the core offering could help reduce the overall number of incidents. The challenge is covering the additional costs. Those costs can be difficult to pass on when competing MSPs offer lower-priced IT services without meaningful security protections.
Traditional defenses face new pressure
It remains unclear how effectively these added capabilities will protect MSPs and their clients.
OpenAI CEO Sam Altman has claimed that the rapid acceleration of AI has rendered traditional cybersecurity defenses obsolete.
How much hyperbole that statement contains remains to be seen. Still, cybercriminals are becoming more capable of launching attacks at machine speed. Existing defenses will face increasingly demanding tests as attackers adopt these capabilities.
MSPs remain an attractive target
In the meantime, MSPs should assume they will remain a primary target for cyberattacks. A breach of an MSP’s services can create opportunities for attackers to distribute malware downstream to clients. The question is how MSPs should distribute cybersecurity costs across clients. Those clients share an interest in ensuring the managed services they use remain as secure as possible.
Photo: Nor Gal/ Shutterstock
