Shadow AI Is Now Your Problem: Why Doubling Sensitive Data Uploads Should Keep MSPs Up at Night
There has been a 93% year-over-year increase in employees transferring enterprise data to AI tools. — Zscaler 2026 AI Threat Report Managed service providers are quietly inheriting a new kind of data‑loss problem: clients’ employees are shoveling sensitive data into AI tools at a rate that has doubled in the last year, with the average […]
MSPs Are Under Direct Attack: Hardening RMM, IAM, and Your Own House First
For attackers, compromising a managed service provider is one of the highest-leverage plays in cybersecurity. NSA and CISA warn that malicious actors are known to target MSPs because MSPs often hold privileged access into customer environments, giving an attacker a trusted path to pivot into multiple downstream tenants and making those actions harder to detect […]
Vendor Risk, Fake Automation, and the Green Check Trap
A vendor questionnaire is not vendor risk management. It’s a starting point. Sometimes a useful one. But if your process ends with a filled-out form and a SOC report in a folder, you’re not managing risk — you’re documenting optimism. In this Get NIST-y, Jared and Mike use the Mythos supply chain mess to highlight […]
Incident Reporting Is Changing Faster Than Your Playbooks
For MSPs and internal IT teams, incident response used to revolve around containment, eradication, recovery, and a long argument over whether anyone outside the company really needed to know. That era is over. In the last two years, cyber incident reporting has shifted from a loosely coordinated mix of breach notice laws and sector rules […]
From Checkbox To Consequences: Why “Paper” Compliance Programs Are Now A Real Liability
MSPs and internal IT teams have spent years treating compliance as a documentation exercise: policies in SharePoint, audit binders on demand, screenshots gathered the night before a review, and a lot of confidence that “good enough” paperwork would carry the day. That model is breaking down. In 2026, regulators are signaling that they expect organizations […]
Unauthenticated and Unforgiving: Why 2026’s RCE Wave Is Different
If 2025 was the year of record CVE volume — 48,185 published, up 20% from 2024 — then 2026 is the year attackers stopped waiting for credentials. The latest MetInfo CMS exploitation proves it: CVE-2026-29014, a pre-auth PHP injection flaw (CVSS 9.8) in versions 7.9–8.1, went from disclosure to active attacks by April 25, surging […]
Agentic AI Is Already Expanding Your Attack Surface in 2026
The biggest risk with agentic AI isn’t what’s coming next. It’s what’s already here. Across organizations, AI agents are quietly moving from passive assistants to active participants. They’re writing code, querying internal systems, sending messages, and triggering workflows. Not in a lab. Not in a pilot. In production. Right now. And in many cases, security […]
From Break‑Fix to MDR‑First: What 2026 Threats Really Demand From MSP Stacks
If you’re still leading with “unlimited support, AV, and backups” in 2026, you’re selling yesterday’s MSP. The threat landscape has shifted to identity abuse, remote‑access hijacking, and fast‑moving ransomware campaigns that treat your tools and your staff as the most efficient route into every client you touch. Security is no longer a bolt‑on SKU; it’s […]
When Intruders Hop, Roll, and Fly: What Hybrid Robots Mean for Physical Security
A decade ago, the idea of a robot that could both bounce like an insect and fly like a drone belonged squarely in science fiction. Today, it’s a working prototype — and a preview of the next problem your physical security program is not ready for. City University of Hong Kong’s “Hopcopter” research project fused […]
Trust as an Attack Surface: CI/CD Compromise Explained
Weaponizing CI/CD trust is what happens when an attacker stops trying to slip past your defenses and instead learns to speak in your own systems’ voice. Instead of fighting per‑service, they compromise the machinery that builds, signs, and ships everything you run. CI/CD stands for Continuous Integration and Continuous Delivery (or Continuous Deployment). Continuous Integration […]