The Buzz: Huntress uncovers deeper backup-server compromise, Devolutions expands PAM, and GTIA sees security growth

If you manage or resell Barracuda appliances, today’s top story needs your attention: the company has confirmed that attackers are exploiting two flaws in its Email Security Gateway that can be chained for root access. Meanwhile, Hatz AI has raised a $24 million Series A for its MSP AI platform, and attackers are exploiting a critical flaw in Xen Orchestra to take over XCP-ng virtualization hosts. Those are the top stories in Friday’s edition of The Buzz from ChannelBuzz.ca. The Buzz is brought to you in part by Fortinet Canada. Fortinet XPERTS26 Canada runs November 22–27, offering Canadian partners hands-on technical training in cybersecurity. Learn more and register here. Barracuda confirms attackers are exploiting Email Security Gateway flaws Barracuda has confirmed that attackers are exploiting two vulnerabilities in its Email Security Gateway, flaws that can be chained to give an attacker root control of the appliance. According to BleepingComputer, Barracuda updated its advisory Monday to say exploitation has hit a small number of organizations. The company hasn’t said who is behind the attacks. The flaws are CVE-2026-116606, an authentication weakness that lets an attacker modify the appliance’s global configuration, and CVE-2026-111560, a command injection bug in the timezone setting that runs commands as root. The command injection flaw also affects Barracuda’s Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway products. Barracuda released patches about a week before confirming the attacks, and says some customers may already have them through automatic patching. SecurityWeek covered the flaws on November 4, based on Mandiant advisories, and rated the authentication bypass 9.3 and the command injection 8.6 on the CVSS scale. At that point, neither advisory reported exploitation. The sources also differ on one detail: Barracuda says administrative interface access is required for both bugs, while Mandiant says the authentication bypass can be exploited without authentication. For MSPs that manage or resell Barracuda appliances, start with an inventory. Confirm the right patch is installed on every affected product, turn automatic patching back on if it was disabled, and restrict admin interfaces to trusted internal networks, as Barracuda recommends. Because the flaws are being exploited, check devices for signs of compromise rather than assuming a patch settles it. SecurityWeek notes ESG appliances have been targeted before, by Chinese cyberspies exploiting a 2023 flaw, so tell customers what you checked. Hatz AI raises $24M as its MSP partner network triples Hatz AI, the platform that helps managed service providers sell and govern AI for their customers, has raised a $24 million Series A as its partner network grows. Channel Insider reports the round was led by Josh Schertzer, a partner at Nadia Partners and former Blackstone CTO, with participation from Vestigo Ventures and The Private Shares Fund. Hatz says its active MSP partner count tripled year over year and revenue grew even faster. Headcount has gone from 14 to nearly 60, and the partner network spans thousands of MSPs across all 50 U.S. states, nine Canadian provinces and nine countries. Hatz positions its platform as an “AI control plane” that lets MSPs deliver branded AI services while managing security, governance, spending and access to multiple foundation models. The company says it has issued more than 15,000 AI certifications. Its Activate offering, launched in August, helps providers assess customer AI readiness and spot shadow AI risk, and Hatz Spaces, launched earlier this month, adds collaborative AI workspaces under MSP-managed controls. The new money will go toward automated model routing, benchmarking, engineering infrastructure and expanding its forward-deployed engineering, research and optimization teams. “By giving MSPs full control over governance, spend, and deployment,” CEO and co-founder Jimmy Hatzell said, small businesses can become AI native. For solution providers, the funding is one more sign that managed AI is becoming a category of its own. Channel Insider cites Informa’s 2026 MSP 501 research, in which 57 percent of MSPs expect AI to be among their largest revenue growth areas in the next year, but also Nerdio research finding only 12 percent reported measurable productivity gains from AI. If you’re weighing a platform, ask how it handles governance and who owns the customer relationship. Attackers exploit Xen Orchestra flaw to take over XCP-ng hosts Attackers are exploiting a critical authentication bypass in Xen Orchestra, the management console for XCP-ng virtualization hosts, and a second related flaw has no fix yet. BleepingComputer reports that Vates, the project’s maintainer, tracks the bug as VSA-2026-062. It has no CVE identifier or CVSS score yet. A remote attacker with network access to the management interface can send a crafted authentication cookie containing an empty JSON object and be logged in as the owner of an existing token, with no credentials. From there, Vates warns, an attacker can act with admin privileges, run code on managed pools and take over an XCP-ng node as root. The flaw was reported by Filip Magic and Christoffer Olsen of TDC NET Security. Vates has confirmed active exploitation and published indicators of compromise, including connections to a specific IP address, a virtual machine named “pivot2,” VMs set to file-based serial output, and several cron files on hosts. The Hacker News notes that VirusTotal flags the IP as a RedLine Stealer command-and-control server, that it’s unclear when the activity began, and that a related flaw, VSA-2026-063, is reportedly used alongside it. That second bug lets a privileged user upload a crafted VM image to compromise a host, and no fix was available at the time of reporting. Fixed versions are Xen Orchestra 6.9.1 and 6.10.0, or xo-server 5.211.2 and 5.213.1. For MSPs and VARs running XCP-ng, whether for their own infrastructure or for customers weighing alternatives to VMware, update now, restrict the console to a dedicated management network, and hunt for the listed indicators. Vates says exploitation leaves no trace in logs, so watch HTTP traffic for the crafted cookie, and rotate secrets if you suspect compromise. In The Channel: If you missed it, Huntress and Ingram Micro executives were on yesterday’s episode: How Huntress and Ingram Micro plan to grow the Canadian MSP security market Read Full Transcript Welcome to The Buzz for Friday, November 13, 2026. I’m Robert Dutt, and here’s what’s happening in the channel today. If you manage or resell Barracuda gear, today’s top story needs your attention. Barracuda has confirmed that attackers are exploiting two flaws in its Email Security Gateway. Plus, Hatz AI has raised twenty-four million dollars for its MSP artificial intelligence platform, and attackers are taking over virtualization hosts through a flaw in Xen Orchestra. Up first, Barracuda has confirmed attacks on two vulnerabilities in its Email Security Gateway, and together they can give an attacker root control of the appliance. BleepingComputer reports that Barracuda updated its advisory on Monday to say a small number of organizations have been hit. The company hasn’t said who is behind the attacks. One flaw is an authentication weakness that lets an attacker change the appliance’s global configuration. The other is a command injection bug in the timezone setting that runs commands as root. That second flaw also affects Barracuda’s load balancer, message archiver, web application firewall and web security gateway products. Barracuda released patches about a week before it confirmed the attacks, and says some customers may already have them through automatic patching. SecurityWeek covered the flaws on November fourth, based on advisories from Mandiant, and at that point nobody had reported exploitation. The sources also disagree on one detail. Barracuda says an attacker needs access to the administrative interface for both bugs, while Mandiant says the authentication bypass can be exploited without logging in. So what should you do? If you manage or resell Barracuda appliances, start with an inventory. Confirm the right patch is on every affected product, turn automatic patching back on if it was disabled, and limit admin interfaces to trusted internal networks, as Barracuda recommends. And because these flaws are being exploited, check the devices for signs of compromise instead of assuming the patch settles it. SecurityWeek notes these gateways have been targeted before, by Chinese cyberspies using a twenty twenty-three flaw, so tell your customers what you checked. Next, Hatz AI has raised a twenty-four million dollar Series A as its partner network grows. Channel Insider reports the round was led by Josh Schertzer, a partner at Nadia Partners and a former Blackstone CTO, with Vestigo Ventures and The Private Shares Fund also taking part. Hatz says its active MSP partner count tripled over the past year, and revenue grew even faster. The company has gone from fourteen employees to nearly sixty, and says its network spans thousands of MSPs across all fifty U.S. states, nine Canadian provinces and nine countries. Hatz describes its platform as an “AI control plane,” a way for MSPs to deliver branded AI services while managing security, governance, spending and access to multiple AI models. It says it has issued more than fifteen thousand AI certifications. The new money is earmarked for automated model routing, benchmarking, engineering infrastructure, and more forward-deployed engineers. CEO and co-founder Jimmy Hatzell said that giving MSPs full control over governance, spend and deployment makes it possible for small businesses to become, in his words, AI native. For solution providers, it’s one more sign that managed AI is becoming its own category. Channel Insider cites Informa research in which fifty-seven percent of MSPs expect AI to be among their biggest revenue growth areas in the next year. But it also cites Nerdio research finding that only twelve percent have seen measurable productivity gains from AI. If you’re weighing a platform like this, ask how it handles governance, and who owns the customer relationship. And finally, attackers are exploiting a critical authentication bypass in Xen Orchestra, the management console for XCP-ng virtualization hosts. BleepingComputer reports that Vates, the project’s maintainer, tracks the bug as VSA twenty twenty-six dash zero six two. It doesn’t have a CVE number yet. A remote attacker who can reach the management interface can send a crafted cookie and be logged in as the owner of an existing token, with no credentials. From there, Vates warns, the attacker can act as an admin, run code on managed pools, and take over an XCP-ng host as root. Vates has confirmed active exploitation and published indicators of compromise, including a virtual machine named “pivot2” and several cron files on hosts. The Hacker News adds that the attacker’s address is flagged as a RedLine Stealer command-and-control server, and that a second related flaw is reportedly used alongside it. That one has no fix yet. The fixed versions are Xen Orchestra six point nine point one and six point ten point zero. If you run XCP-ng, for yourself or for customers weighing alternatives to VMware, update now, keep the console on a dedicated management network, and hunt for those indicators. Vates says exploitation leaves nothing in the logs, so watch your web traffic for the crafted cookie, and rotate secrets if you suspect a compromise. Before you go, if you missed it, executives from Huntress and Ingram Micro were on In The Channel yesterday, talking about how they plan to grow the Canadian MSP security market. That’s how we’re seeing the headlines today. I’m Robert Dutt. Thanks for listening. Have a great weekend, and stay safe this Friday the 13th!

Kevin Hallmark, head of global distribution at Huntress Cybersecurity vendor Huntress is looking to expand its reach in the Canadian IT channel through a new distribution arrangement with Ingram Micro, bringing its managed security platform to a broader community of managed service providers and value-added resellers. The companies announced the Canadian expansion in October, extending an existing U.S. relationship that now covers Canada, Latin America, and the Caribbean. For Huntress, which has historically built its business through direct relationships with MSPs, distribution represents an opportunity to reach additional partners, including traditional VARs that may not operate managed services businesses. For Ingram Micro, the agreement adds another managed security offering to its Canadian portfolio, backed by the distributor’s technical resources, enablement capabilities, and established partner relationships. In this episode of In The Channel, Kevin Hallmark, head of global distribution at Huntress, and Alistair Edmondson, director of advanced solutions at Ingram Micro Canada, join ChannelBuzz.ca to discuss what the relationship means for Canadian partners. Hallmark explains that Huntress’s focus remains on making enterprise-grade security accessible to businesses that lack the resources to operate their own security operations centres. The company’s platform combines technology with a 24/7 security operations centre staffed by security professionals and supported by AI capabilities. While MSPs remain central to Huntress’s business, Hallmark says Ingram Micro also provides an important opportunity to reach VARs serving customers that maintain their own IT and security operations. He identifies organizations with approximately 50 to 2,500 seats as a particularly relevant target market, although Huntress also supports larger environments. Alistair Edmondson, director of advanced solutions at Ingram Micro Canada Edmondson, meanwhile, says Canadian partners are increasingly looking for ways to reduce security complexity and help customers manage the growing volume of alerts and telemetry coming from their environments. He says Ingram Micro’s role goes beyond providing another procurement option. The distributor is already quoting and transacting Huntress solutions in Canada and has resources available to support partners through onboarding, technical enablement, demonstrations, proofs of concept, and their first transactions. The opportunity extends to partners that may not yet have mature managed security practices. By drawing on Huntress’s security operations capabilities, those partners can potentially offer managed protection without the significant expense of building and staffing their own SOC. The discussion also explores where Huntress fits alongside other technologies in Ingram Micro’s portfolio, including Microsoft-focused solutions, and how the company’s expanding security platform could create additional opportunities for partners. Huntress recently announced further platform innovations, including capabilities designed to turn intelligence gathered from attacks against individual customers into broader protections across its customer base. Hallmark discusses how that approach shapes the company’s ongoing product development. In this episode: Why Huntress is expanding its Ingram Micro distribution relationship into Canada How distribution can help Huntress reach both MSPs and traditional VARs What makes a good Huntress partner, and where the company sees its sweet spot How Ingram Micro plans to support Canadian partners with training, technical resources, and business development Where Huntress fits into broader security offerings and Microsoft-focused partner practices How Huntress’s expanding platform supports the delivery of managed security services What success could look like for the two companies in the Canadian market Listen to the full conversation with Kevin Hallmark and Alistair Edmondson to learn more about the companies’ plans and the opportunities they see for Canadian IT solution providers. Read Full Transcript Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news, information, and analysis to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. Huntress has made a name for itself in the cybersecurity market by helping MSPs deliver enterprise-grade security without having to build and staff their own security operations centres. Now, the company is expanding its distribution relationship with Ingram Micro into Canada, opening up new opportunities to reach both managed service providers and traditional value-added resellers. But what does distribution add to a business that’s historically worked directly with MSPs? What kinds of Canadian partners is Huntress looking for? And how does Ingram plan to help those partners build and grow their security businesses? To explore these questions, I’m joined by Kevin Hallmark, head of global distribution at Huntress, and Alistair Edmondson, director of advanced solutions at Ingram Micro Canada. We discuss the opportunity in Canada, the different roles VARs and MSPs can play in delivering managed security, and how Huntress’s expanding portfolio fits into the picture. Let’s get right into it, my chat with Kevin Hallmark and Alistair Edmondson. Robert Dutt: Gentlemen, thanks for taking the time. I appreciate it. Kevin Hallmark: Thank you, Rob. Robert Dutt: Kevin, let’s start off with Huntress itself. For partners who aren’t particularly familiar with the company, can you give us the elevator pitch, as it were, for Huntress? What you do, where you fit into the security market, and what kind of partners you’re working with today? Kevin Hallmark: Yeah, absolutely. So Huntress has been around for 11 years. Primarily in our history, we’ve supported MSP partners directly. In the last year and a half, we’ve started expanding our reach through channel relationships, and that’s a large part of the reason that we’re here with Ingram Micro today. But we offer a 24/7 AI-centric SOC. We like to use that term because we’re definitely not an AI-only SOC. We have world-class threat researchers, we have world-class security engineers, world-class security analysts, and that kind of 24/7 SOC service is really what we’re selling, with those individuals protecting the businesses that use our service all day, every day. Robert Dutt: Now you’re expanding your distribution relationship with Ingram Micro into Canada. It seems silly to say why Canada, but why now? And what do you see as the particular opportunity here, both writ large, the Canadian market, and with the Ingram Micro relationship in particular? Kevin Hallmark: There’s a lot of reasons. I think the core response here is that distribution gives us access to more businesses. So obviously, distribution is giving us access to an enormous network of partners who service a much larger segment of the businesses that we aim to protect. Why Canada? There’s a lot of reasons, obviously. There’s a lot of business in Canada. There’s a lot of availability. I think Alistair can talk probably a little bit more to the scale there. But the service itself is really, like I said, we’re backed up and led by this group of world-class security analysts, which is primarily an English-speaking service. Canada represents an enormous market for us in that regard. Robert Dutt: Alistair, from Ingram’s perspective, what attracted you guys to Huntress? One of the great truths of the channel is there’s no shortage of security vendors in the market. What does Huntress bring to your Canadian partner community that you think is particularly compelling? Alistair Edmondson: Yeah, I think a lot of Canadian partners, we talk to them all day long, every week, and a lot of them are really talking about reducing complexity. There’s so many alerts and telemetry that come off endpoints, and they’re really looking for a provider that can help sort some of that out, on the MSP side specifically. And best-in-class technology. We’ve seen from afar what Huntress has been doing in the market, and we’re super happy to have them on board at Ingram. Robert Dutt: Kevin, Huntress has relationships with MSPs, including in Canada already. What does working with Ingram change for you? I’m curious, with new distribution deals, there’s always the balance between reaching new partners and an opportunity to support the existing base better or differently. I’m curious how you guys are approaching that and thinking about that as you launch the deal into Canada. Kevin Hallmark: Yeah, I won’t go too deep into the distribution benefits, but ultimately, distribution does, of course, give you standardization and scale. There’s all of those benefits as it relates to existing and future customers of ours, or partners of ours. The MSP aspect, I will also add that Ingram doesn’t just sell to MSPs. There’s a large reseller base out there as well that I think Ingram, I’d say from our perspective, is providing a significant inroad into that VAR space as well. Robert Dutt: Alistair, from Ingram’s point of view, what are you guys bringing to a Huntress partner beyond the obvious of distribution, another way to purchase the technology? Basically, how do you envision helping partners to build and grow their Huntress business and their security practice writ large? Alistair Edmondson: Yeah, I think for Huntress, they get access to a lot of partners in the ecosystem in Canada. We deal with the vast majority of them. I think what partners get from us is a team that has subject matter experts. We’re ready to transact today. We know how to enable partners on Huntress. We have technical resources behind it. So helping partners anywhere from onboarding, getting enabled on the technology, demos, POCs, all the way through to getting them to their first transactions as a Huntress partner. Robert Dutt: Now, this was a relationship that’s been in place for a while in the U.S. Am I correct in thinking that? Alistair Edmondson: Yeah, fairly new in the U.S., the last few months. And I’m super excited when Kevin called me and told me it was time to expand into Canada. Robert Dutt: Any learnings? What have you learned from your peers in the U.S. about ramping up the business and getting started and working with VARs and MSPs around Huntress? Alistair Edmondson: Yeah, I think we do best-practice sharing all the time. I think the model we have at Ingram with enablement for partners will be true for Huntress. And it’s the relationships, right? We have pretty deep relationships coast to coast with many resellers and MSPs. So it’s just taking some of those best practices and what they do on enablement. We love to say we don’t want to reinvent the wheel. We’ll take successes from what’s happening in the U.S., but also have the Canada spin on the things that we can offer to the table in Canada specifically. Robert Dutt: Kevin, what makes a good Huntress partner? Is there a particular type, size, business profile that hits the sweet spot for you guys? And what does a successful MSP Huntress practice look like? Kevin Hallmark: Yeah. So one of the things that we like to say is Huntress offers enterprise-grade protection for the 99%. What we mean by that is that we’re not really structured to support just the elite Fortune 100, Fortune 500 companies. We’re structured to be very accessible across all businesses. So I think that’s probably one of the big differentiators from a Huntress perspective. Robert Dutt: What does the typical MSP look like? What are some of the common threads of a successful Huntress partner? Kevin Hallmark: Yeah. So in the end, I think I’ll definitely point out it’s not just MSPs. We also absolutely have a VAR practice and a VAR model that we support. But I think what makes a successful partner is that they’re able to service what we might refer to as the SMB, or small and mid-range businesses. We absolutely can scale up, but our core target partner has access to that SMB space. I will put some numbers on it and say maybe 50 to 2,500 seats is probably our target base. Robert Dutt: And with those two models, how do you view, interact with, relate, engage, enable VARs and MSPs differently, acknowledging the different lanes that they operate in? Kevin Hallmark: Yeah, it really comes down to how they intend to support their customer. And I think maybe the way I normally would point to it from a customer’s perspective is, who are you going to call? Are you calling the partner that sold this to you and expecting them to deal with it? Or are you looking to have interaction directly with the vendor? And if you are, that’s really more of a VAR model, where you’re basically buying this service, you’re buying access into this service, and you have an IT staff or a security staff that’s able to operate and respond to it. Versus, I’m going to outsource that to an MSP, where the MSP is going to handle all of that for me. And then in those scenarios, we’re really supporting the MSP, who is then supporting their customers. Robert Dutt: Alistair, one of the advantages of working with a broadline distributor is the wider portfolio. How do you see Huntress fitting alongside the other technologies in Ingram’s portfolio? Are there particular vendors, solution categories, types of partners that you see natural opportunities to bring Huntress into a broader offering? Alistair Edmondson: Yeah, I think Huntress fits in a lot of different areas. There’s partners that have established MSP practices with specific vendors. So yeah, I think it fits nicely in our stack. I think there’s a lot of talk around Microsoft and specific partners, and Huntress fits nicely in with that base of MSPs as well. Robert Dutt: So the relationship is announced, it’s out there. You guys are transacting at this point, yes? Alistair Edmondson: Yeah, we’re doing quotes and transactions today. We’re ready to go. Robert Dutt: What’s the early-days game plan to both get the word out and start building that Huntress muscle in the base of partners who are working with Ingram on a day-to-day basis? Alistair Edmondson: I think it’s face-to-face, partner-to-partner. I think we can certainly do some communications en masse to our partners, but obviously it’s relationships and having those conversations with partners and really understanding their business and how Huntress can fit. And just looking through the data on who we think are high-propensity partners that can do really well with Huntress, and start the outreach. Like I said, we have people dedicated on Huntress ready to go. Robert Dutt: Kevin, Huntress has been expanding its portfolio of capabilities over time. In fact, as we record this, just this week you guys have added more to it. I guess that’s the way it is in security and in software in general. As you look at the next stage of growth, how do you see the company’s role in an MSP or VAR security stack evolving? Kevin Hallmark: I think it’s certainly expanding. The recent announcements that you’re talking about are aimed at posture management, so just what a business’s security posture is. Today, if you look at the Huntress portfolio, I mentioned the enterprise-grade concept. So it’s that enterprise-grade capability available to everybody, 24/7 SOC. So you’re not getting a bunch of alerts. You’re not getting an application that’s just going to feed you alerts. You’re getting an application that runs in your environment, on endpoints, on identities within the environment, to alert our SOC. And our SOC is there with all of the AI capabilities that we have, along with these world-class security experts, to respond. So you’re not really purchasing the product that’s providing the alerts and telling you what’s happening, or even responding to what’s happening. You’re purchasing this service and this access to these world-class experts. And then additionally, when I talk about posture management and our recent announcements, really we’re talking about taking what we learn from an attack and creating this continuously evolving security posture for an entire base. So if we learn about something in the wild, we identify an attack that has happened in one of our customers’ environments, we’re able to address that, isolate it, respond to it for that customer. But we’re also able to take those learnings and apply it to our platform so that it is, within minutes, protecting all of our customers and everybody that uses the platform. Robert Dutt: Sounds like a valuable skill to have in the post-Mythos world and the continuing acceleration of exploits and breaches out there. Not asking you to pre-announce anything, obviously, but directionally, where does the business go over time? What do you see as the guiding lanes for where Huntress will add capabilities and bolster what it’s doing with VARs and MSPs? Kevin Hallmark: Yeah, I think we will follow the adversaries. We’ll follow the attackers and how they’re evolving. Obviously, a lot of that today is driven by the adversaries using AI to accelerate how they’re attacking and how quickly they’re able to compromise environments and vulnerabilities. So because of that, we certainly are increasing our ability to respond at machine speed, but we’ll always respond to the attacks that we see. So we have this SOC that is the centre of what we do. And as we see different types of exploits and different types of attacks being leveraged, we’ll move our product line to support those new or evolving threat vectors. Robert Dutt: Is it a set update cadence, or does it evolve at the rate it needs to evolve and can evolve? Kevin Hallmark: Yeah, it’s not set. It’s a constantly, always evolving thing. And that’s where that continuous evolution and, I don’t know, continuous immunity for our platform really comes into play. And that’s a lot of what we’ve recently announced. Not that this isn’t something that we’ve always done. We evolve and respond to the needs of our customers through our platform, and that platform is literally daily evolving to offer new protections and new ways of protecting our customers. But that herd immunity is really a major factor, taking what we learned from a very specific attack and rewriting our platform or reconfiguring our platform to respond to that specific attack, and then making that available across the platform. Robert Dutt: Alistair, when you look at the partner community today, how has the average VAR’s or MSP’s approach to building a security practice changed? Are you seeing partners adding more sophistication about delivering managed security and how they think about security as part of their stack? Or is there still a significant opportunity to help folks take the first steps down that road? Alistair Edmondson: Yeah, for sure there is. I mean, we have everything from very mature partners and MSSPs to SMB. Kevin mentioned the 99%. Canada has a lot of SMB into midmarket, and that gives a lot of opportunities for partners, established and new partners. The nice thing is, with the solution from Huntress, the talent and all the technology behind it is provided by Huntress. So partners, even with a smaller security practice, can leverage them to build a managed service practice out. Obviously, we know building out SOCs at client sites, or even within a partner, is expensive, and talent is hard to find. So I think Huntress is a natural fit for established partners and partners getting started into security. Robert Dutt: To both of you, if you look ahead six months or a year, what does success look like for this relationship in Canada? Kevin, what are you hoping to accomplish here in the Canadian market? And Alistair, what would you like to see happening in the Canadian partner market? Kevin Hallmark: I’ll go first, Alistair. Alistair Edmondson: Go for it. Kevin Hallmark: It’s pretty brief from my perspective. As I mentioned earlier, I think distribution, and Ingram Micro specifically, with the scale offered, really gives us the ability to address more customers, a significant amount of additional customers. All of the innovation that we do only matters, it only applies, if the businesses have access to it. From that perspective, expanding access for customers and businesses to our platform is what we’re measuring. Alistair Edmondson: Yeah, to tack on, for me, it’s engagement, right? Engagement with partners, engagement with the Huntress team. And oftentimes, it’s connecting those dots and finding the right partners with the right skill sets to drive success. So from day one, we’ll be out talking to partners, and in conjunction with the folks from Huntress, start connecting the dots. And I think success will come from those good conversations. Robert Dutt: All right, gentlemen, once again, I appreciate you taking the time. Congrats on the launch, and good luck getting it out there and building it into the VAR and MSP community. Kevin Hallmark: Thanks, Rob. Thanks, Alistair. Alistair Edmondson: Thanks, Rob. Thanks, Kevin. Have a great day. Robert Dutt: There you have it, Kevin Hallmark of Huntress and Alistair Edmondson of Ingram Micro Canada on their plans to grow the Huntress business in Canada. I’d like to thank Kevin and Alistair for joining us, and thank you for listening. Thanks also to Ingram Micro Canada for their continuing support of the site. A couple of things that stood out for me from that conversation. First, this isn’t simply about Huntress reaching out to more MSPs through distribution. There’s also a significant opportunity to introduce its managed security capabilities into Ingram’s broader VAR community, including partners whose customers want access to security expertise but may prefer to manage their own environments. And second, there’s the enablement piece. As Alistair explained, Ingram brings technical resources, training, demonstrations, proofs of concept, and established partner relationships to the table. That’s potentially valuable for partners looking to build out managed security practices without taking on the expense and complexity of running their own security operations centres. As Huntress continues expanding its platform, it’ll be interesting to see how that combination of technology, services, and distribution plays out in the Canadian channel. If you’re enjoying the show, please do follow or subscribe in your podcast app of choice. You can find us on Apple Podcasts, Spotify, YouTube, all the usual suspects. And should you feel so inclined, ratings and reviews are greatly appreciated. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

If you run N-central, today’s top story needs your attention: N-able has released an emergency hotfix after a researcher published working exploit code for dozens of flaws, and took its hosted service offline to respond. Meanwhile, Huntress is offering breached businesses 60 days of free protection through incident response firms, and Microsoft has named the winners and finalists of its 2026 Partner of the Year Awards. Those are the top stories in Thursday’s edition of The Buzz from ChannelBuzz.ca. The Buzz is brought to you in part by Fortinet Canada. Fortinet XPERTS26 Canada runs November 22–27, offering Canadian partners hands-on technical training in cybersecurity. Learn more and register here. N-able patches N-central after researcher publishes exploit code for 33 flaws N-able has released an emergency hotfix for its N-central remote monitoring platform after an independent security researcher published proof-of-concept exploit code for 33 alleged vulnerabilities, forcing the company to take its hosted service offline. The researcher, Sean Bales, posted the code to GitHub late Sunday under the name Able2Shell. Huntress says the flaws can be combined into at least four exploit chains leading to remote code execution or privilege escalation, and BleepingComputer reports one demonstrated chain can create an administrator account with attacker-controlled credentials. N-able took its hosted N-central environments offline Monday and advised on-premises customers to do the same. On Tuesday it released N-central 2026.4 HF2 (build 2026.4.1.26), which Tenable notes fixes seven CVEs rated 8.3 to 9.3 under CVSS 4.0. N-able says hosted environments are upgraded and back online, and on-premises customers should apply the hotfix before restoring internet access. A follow-up hotfix is expected. N-able told Cybersecurity Dive it hasn’t seen active exploitation, though it is aware of scanning activity tied to the published code. The Hacker News reports watchTowr saw exploitation attempts against its honeypots. The disclosure is contested. Bales told BleepingComputer he skipped notifying N-able because, he says, the company never fixed bugs he reported in another product months ago. N-able says the claim it ignored responsible disclosure is inaccurate and that these flaws weren’t reported through its channels. CEO John Pagliuca said publishing exploit code before customers can act “hands attackers a head start.” For MSPs: confirm on-premises servers are on HF2 before they return to the internet, review login and authentication activity since November 8 as Huntress recommends, and check for administrator accounts you didn’t create. It also follows exploited N-central flaws fixed in August and September, so it’s a fair moment to ask how exposed your management tools are. Huntress offers breached businesses 60 days of free protection through IR firms Huntress has launched an Incident Response Engagement Program that lets participating incident response firms deploy its platform for clients at no cost for 60 days, during and after a cyberattack. The aim is to close the gap between containing a breach and being protected against a repeat. Attackers often return through lingering identity weaknesses, stolen credentials and misconfigurations, Huntress says, and the surge in AI-driven attacks is overwhelming IR firms with cases. The initial program focuses on business email compromise and identity-based attacks. Responders can use Huntress’s managed identity threat detection and response, which monitors around the clock for suspicious logins, compromised sessions, credential theft and OAuth abuse. Identity security posture management flags misconfigurations, excessive privileges and weak authentication policies, and verifies fixes before an engagement closes. A lookback feature examines up to six months of identity activity for earlier compromises, and Huntress’s SOC keeps dedicated Slack channels open with IR partners during incidents. “Recovery and protection must go hand in hand,” said Tuan Nguyen, Huntress’s VP of channels and alliances. The program builds on Huntress’s cyber insurance offering with Acrisure, available to eligible US customers and partners. The program targets incident response firms rather than MSPs directly, but the end-of-engagement handoff is where MSPs come in. Huntress says businesses can move from remediation to continuous managed protection once an incident is contained. If you run Huntress, or serve a client just through a breach, ask how that transition works and who owns monitoring once responders leave. Microsoft announces 2026 Partner of the Year winners and finalists Microsoft has announced the winners and finalists of its 2026 Partner of the Year Awards, ahead of next week’s Microsoft Ignite conference. The awards span seven global categories: Cloud and AI Platforms, Security, AI Business Solutions, Industry, Partner Innovation, Business Transformation and Social Impact. Microsoft says this year’s honourees show what it calls Frontier Transformation in practice, pairing Microsoft Cloud and AI with industry expertise and customer relationships. Partner announcements say the winners and finalists were chosen from more than 4,500 nominations worldwide. Several honourees have Canadian ties. Insight Canada took the Canada country award, and Insight Enterprises won the global Scale Solutions award and the Americas Channel award. Toronto-based Softchoice was a Scale Solutions finalist. In distribution, Arrow won the global Distributor award, and TD SYNNEX was a Distributor finalist and is listed in the Commercial Device Channel category. Honourees will be celebrated at Ignite, November 17 to 20, including during the Frontier Transformation Partner keynote on Wednesday, November 18, from 9:00 to 10:30 a.m. PT. The full list is on Microsoft’s winners page. Microsoft’s structure also includes country-level recognition, and this year added a regional tier covering the Americas, EMEA and Asia. When it opened nominations, Microsoft said winners and finalists receive customized logos, PR templates and recognition collateral, plus visibility around Ignite. That makes the next few days a good window to put the recognition in front of customers. With Ignite days away, expect more Microsoft partner news to follow. Read Full Transcript Welcome to The Buzz for Thursday, November 12, 2026. I’m Robert Dutt, and here’s what’s happening in the channel today. If you run N-central, you’ll want to hear today’s top story. N-able has released an emergency hotfix after a researcher published working exploit code for more than thirty flaws, and the company took its hosted service offline to deal with it. Plus, Huntress is offering breached businesses sixty days of free protection through incident response firms, and Microsoft has named the winners and finalists of its twenty twenty-six Partner of the Year awards. Up first, and if you use N-central, this one needs your attention today. N-able has released an emergency hotfix for N-central after an independent security researcher published proof-of-concept exploit code for thirty-three alleged vulnerabilities in the remote monitoring platform. The researcher, Sean Bales, put the code on GitHub late Sunday night, under the name Able2Shell. According to security firm Huntress, the flaws can be chained together into at least four different attacks that lead to remote code execution or privilege escalation on an N-central server. And BleepingComputer reports that one of the demonstrated attacks can create a brand new administrator account, with credentials the attacker controls. The response was immediate. On Monday, N-able took its hosted N-central environments offline, and advised customers running N-central on their own servers to take those offline as well. On Tuesday, it released N-central twenty twenty-six point four, hotfix two. N-able says hosted environments have been upgraded and are back online, and on-premises customers are being told to apply the hotfix before they put those servers back on the internet. Now, this isn’t necessarily over. N-able says it hasn’t seen active exploitation, but it is aware of scanning activity tied to the published code, and the security firm watchTowr says it saw exploitation attempts against its honeypots. Hotfix two fixes seven of the vulnerabilities, and a follow-up hotfix is expected with further security updates. There’s also a public argument over how all this came out. Bales told BleepingComputer he didn’t notify N-able first because, he says, the company never fixed bugs he reported in a different product months ago. N-able says the claim that it ignored responsible disclosure is inaccurate, and that these new vulnerabilities weren’t reported through its established channels. CEO John Pagliuca put it bluntly: publishing exploit code before customers can act, he said, hands attackers a head start. So what does this mean for you? If you run N-central on premises, confirm that server is on hotfix two before it goes anywhere near the internet again, and be ready to patch again when the follow-up lands. Huntress recommends reviewing login and authentication activity going back to November eighth, and since one of the demonstrated attacks creates a rogue admin, check for administrator accounts you don’t recognize. If you’re on the hosted service, keep an eye on N-able’s status page, and consider telling your customers what you’ve checked. And it’s worth remembering that your RMM platform touches every customer you manage. This follows exploited N-central flaws that were fixed in August and September, so it’s a fair moment to ask how exposed your management tools really are. Next, Huntress is going after the moments right after a breach. The company has launched an Incident Response Engagement Program, which lets participating incident response firms deploy Huntress for their clients free of charge for sixty days, during and after an attack. The idea is to close a gap. Once a breach is contained, attackers can often get back in through weak identity controls or stolen credentials. Huntress says the surge in AI-driven attacks is also overwhelming incident response firms, so getting protection in place quickly matters. The program starts with business email compromise and identity-based attacks. Responders get Huntress’s managed identity threat detection, which watches around the clock for suspicious logins, credential theft and OAuth abuse. They also get tools to find the misconfigurations that let the attacker in, and a lookback feature that can examine up to six months of identity activity to find earlier compromises that were missed. For MSPs, the program is aimed at incident response firms rather than at you directly. But the handoff at the end of an engagement is where managed service providers come in, because someone has to own the monitoring once the responders leave. If you already run Huntress, or you’re the MSP for a business that’s just been through a breach, it’s worth asking how that transition is supposed to work. And finally, Microsoft has announced the winners and finalists for its twenty twenty-six Partner of the Year awards. The awards cover seven global categories: Cloud and AI platforms, Security, AI business solutions, Industry, Partner innovation, Business transformation, and Social impact. Microsoft says this year’s honourees show what it calls Frontier Transformation in practice, pairing Microsoft’s cloud and AI with industry expertise and customer relationships. For Canadian solution providers, Insight Canada took the Canada country award. Insight Enterprises also won the global Scale Solutions award and the Americas Channel award, and Toronto-based Softchoice was a Scale Solutions finalist. Among distributors, Arrow won the global Distributor award, while TD SYNNEX was a Distributor finalist and is listed in the Commercial Device Channel category. They’ll be celebrated at Microsoft Ignite, which runs November seventeenth to twentieth, including a Frontier Transformation Partner keynote on Wednesday, November eighteenth. If your company is on the list, Microsoft has said winners and finalists get customized logos, PR templates and other recognition materials, so it’s worth putting them in front of your customers. And with Ignite just days away, expect more Microsoft partner news to follow. Later today on In The Channel, we’ve got more on Huntress, as we’ll talk to head of global distribution Kevin Hallmark and Ingram Micro Canada advanced solutions leader Alistair Edmonson on their new-to-Canada distribution deal and the opportunity for Huntress in the Canadian channel. And if you haven’t heard yesterday’s episode yet, check it out. Ahead of the Canadian edition of Fortinet’s Xperts channel training event, I sat down with executive vice president of product management Robert May on how partners are approaching training and enablement in an era of security platformization. That’s how we’re seeing the headlines today. I’m Robert Dutt. Thanks for listening. Have a great day.

Robert May, executive vice president of technology and product management at Fortinet Cybersecurity partners face a growing challenge: Customers increasingly need integrated solutions that bring networking, cloud, security operations, and other technologies together, but building the expertise to deliver those solutions takes time, resources, and careful choices about where to invest. For Robert May, executive vice president of technology and product management at Fortinet, the biggest skills gap isn’t necessarily expertise in individual security products. It’s understanding how those products work together to solve customers’ broader operational and business challenges. In this sponsored episode of In The Channel, May joins ChannelBuzz.ca to discuss how the technical demands on cybersecurity partners are evolving, where partners should focus their investments in skills, and how developing deeper expertise can open new business opportunities. A central theme of the conversation is the importance of building outward from existing strengths. Rather than attempting to become experts in every emerging technology, May suggests partners look first at their current customers, established capabilities, and the adjacent areas where they can deliver additional value. Fortinet’s Engage Partner Program provides a framework for developing those specializations. The discussion also explores the growing role of managed security services. As organizations struggle to find and retain specialized security talent, partners have opportunities to deliver more sophisticated capabilities, including by building services around security operations resources provided by vendors like Fortinet. May also offers a preview of XPERTS26 Canada, taking place in Montreal November 22–27. The event brings Fortinet’s technical partner community together for hands-on workshops covering secure networking, security operations, cloud, operational technology, and AI security. He explains how the event draws on real-world engineering experience, why its practical labs are designed for experienced technical professionals, and how activities such as the Ultimate Fabric Challenge help foster a community of learning among partners. The conversation closes with advice for Canadian VARs and MSPs planning their next investments in technical expertise, and a look at the flexibility partners will need as AI continues to reshape the cybersecurity landscape. Partners interested in developing their capabilities can learn more through the Fortinet Training Institute and explore the agenda and participation requirements for XPERTS26 Canada. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news, information, and analysis to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show. Cybersecurity is getting more complicated, and so is the job of being a cybersecurity partner. It’s no longer enough to be an expert in one particular technology or product. Increasingly, customers are looking to partners to understand how different technologies work together, how to integrate them into a broader security strategy, and how to turn all of that into meaningful business outcomes. But for partners, particularly smaller VARs and MSPs, there’s a challenge there. How do you build the technical expertise customers need without spreading your resources too thinly? Where should you specialize? And how do you turn those investments in skills into opportunities for growth? Those are some of the questions we’re exploring today with Robert May, executive vice president of technology and product management at Fortinet. In this sponsored edition of In The Channel, we’ll discuss the changing demands on cybersecurity partners, the growing role of managed services, and how partners can make smart decisions about developing their technical capabilities. We’ll also take a look at Fortinet’s XPERTS 26 Canada event, taking place in Montreal later this month, and how its hands-on training approach fits into the company’s broader partner enablement strategy. Let’s get right into it. My chat with Robert May. Robert Dutt: Robert, thanks for taking the time. I appreciate it. Robert May: Thanks so much for having me. Robert Dutt: I want to take this opportunity to talk a little bit about technology, technology enablement, and building up the skills that partners need. The Fortinet portfolio has expanded a lot. No surprise, because the cybersecurity attack surface has expanded a lot as well. How has that changed what’s expected of a partner by customers today? What do partners need to be good at today that perhaps wasn’t so important just a few years ago? Robert May: As you mentioned, the technology has expanded significantly. Partners now need to understand how the different pieces fit together so they can become a trusted advisor for the customer. End customers are also struggling with a lack of skills and resources, so they need to rely on partners as an extension of their team. For the partner, they need to know a lot more different components than they did in the past. If I’ve got 10 or 20 different products in my security operations, I need to string these together into an operation or workflow. That’s the level where partners can really help customers build those integrations, do things efficiently, add automation, and so forth. It’s really understanding that end-to-end picture. Robert Dutt: How do you find partners are doing? Acknowledging there are going to be some who are probably ahead of the game and some who are lagging behind, as a collective group, how would you say partners are doing on getting that platform message and being able to communicate and integrate that whole story for customers? Robert May: It’s an evolution. People don’t usually like to pitch or present stuff they’re not comfortable with, but they start to see the need to do that because the things they’re selling, or that they’re more traditionally comfortable with, connect to a lot of other technologies that they need to talk about together as one solution. I think customers today are asking for solution-based projects, not individual components. The partners are moving that way, but it takes time, of course. Robert Dutt: Selling on outcomes is something that’s gone across the channel. Does that speak to the solutions focus you’re talking about? Robert May: When you talk about outcomes, you usually go into business outcomes. Conveying the need for a new tehnology or solution to the management level. So that you’re putting in terms they understand, whether that’s how to make more profit, how to reduce operating costs and so forth. Certainly, it’s a matter of helping to translate from the technical to the non-technical, so to speak. Robert Dutt: I have to imagine that’s increasingly important because we’re seeing, with all the attention security is getting of late, a lot more attention from folks who aren’t necessarily directly, technically responsible for security, but ultimately, the C-suite who are responsible for the company-wide vision. Robert May: Certainly. You saw this inflection point during the pandemic, where suddenly there was a lot more attention and visibility at the board level and the C-level on, “What are we doing?” You saw a ramp-up in the hiring of chief information security officers across all types of industries. This brings a renewed focus from that top level, from people who are traditionally not technical. They want to understand, “What are we doing? How are we taking care of this thing I heard in the news?” And understand what the lower levels are doing about it. Robert Dutt: As partners are required to look at more areas of expertise, and as you’re expanding the areas you’re serving as the attack surface widens, I’m curious if there are any areas where you see a particular gap. Are there areas where partners haven’t gone as deep as a whole, and there might be a big opportunity to build expertise to round out that integration story they’re selling? Robert May: Historically, different partners come from different directions. They might come from the networking side, from the cloud, or from security operations. But these are all converging to a point where you need to at least have some knowledge in those other domains. If I’m a specialist in SD-WAN, I need to know how that’s going to impact security operations, what type of data they’re going to need to access, and how that feeds into my SIEM and other tools downstream. The knowledge has been highly concentrated in certain areas, and now they need to have that broader view. This is probably an area to focus on. Robert Dutt: What do you think are the best approaches for deciding the next area to work on or specialize in? Partners can’t necessarily become experts in everything. How do you make those decisions about where to specialize? How much should be based on customer feedback versus emerging market opportunities with new customers, versus building on adjacencies to their home base—the technologies with which they’re most familiar and comfortable? Robert May: In general, it’s going to start from that core knowledge. What’s the current customer base, and what are they telling you they’re missing or the next areas they’re evolving to? That’s a starting point you already have well established, and then it’s expanding out from there. For example, if it’s a customer focused on SD-WAN, you would want to start expanding into the SOC or into the cloud for areas connected to those SD-WAN deployments. Your customers will be telling you, “This is what we’re doing next,” and you can grow from that perspective. It covers all the different technologies we provide, of course, but again, it’s more about that starting point for the customer. Robert Dutt: As partners expand their areas of expertise, do you see a danger or risk in trying to spread technical resources too thinly? What do you see the best-in-class partners doing to mitigate that as they look to expand their portfolio? Robert May: If you try to go too quickly into areas you’re not familiar with, you end up with shallow knowledge and aren’t able to help the customer at that deep technical level. It’s more of a natural expansion of the products and services they’re offering today, so they have that depth of experience. The successful ones tend to have more services and other integration with customers. They get a real-time feedback loop established so they know, “This is the next area where I need to invest more skills and knowledge because I’m starting to see this.” Having that connection with the customer and a service offering is one way to do that. Robert Dutt: How does expanding the scope of specialization—those technical skills and market skills—help a partner grow, connecting to the business opportunity? What changes for a partner when they start to develop deeper skills in more areas? How does that translate into differentiation, stronger customer relationships, new revenue opportunities, and those sorts of things? Robert May: From the point of view of having more things in your portfolio, you can go after new markets. That’s an obvious one. But if you look at partners that are invested with large enterprise organizations, initially they might be selling to one particular team in that organization. Expanding into other skill sets and areas opens up more projects within that organization as well. They might be focused initially on the network part, but then they can expand to security operations, operational technology, or whatever other elements that company has. Robert Dutt: That sounds like you’re seeing partners moving into more sophisticated services over time as a result of building out those capabilities. Robert May: Certainly. What we’ve seen in the industry is that, to become that trusted advisor, a lot of partners have had to develop managed services as part of their portfolio. That way, they have that business-to-business connection with the operations team, and they move at the pace the customer is moving. They have that connectivity. Robert Dutt: For so long in the transition towards managed services, managed security services stayed a pretty—I don’t want to say shallow, but a pretty basic—set of offerings. True managed security services remained a specialist MSSP play. That’s something I’ve seen changing in the last three or four, maybe five years, towards more managed security among more players. Does that map with what you’re seeing, and how do you see that trend evolving? Robert May: Definitely. It’s an area where most enterprises have tried to build a lot of this in-house, and then they’ve hit roadblocks where they’re competing for the resources or skills that are out there. There’s a limited set of skills globally for doing, say, a security operations centre. Being able to outsource that is very attractive for them. Historically, more than 10 years ago, there were only a few providers providing that. Now you see more and more partners, even smaller ones, providing these types of security operations as a service. It provides economies of scale, leveraging the people underneath to provide that as a service. Robert Dutt: Is it safe to say that available skill sets are still the biggest limiting reagent in that growth and expansion? In talking to partners over the years, it’s been a problem. Even talking with yourself and your peers in the vendor space, it’s hard to find and retain the right people with the right skill sets. For partners, especially small partners, that has historically been a massive challenge as well. Robert May: That’s been a recurring theme for more than 10 years. What we’ve seen from our side as a vendor is that we’ve started providing some of these services to partners. They can leverage us on the back end, provide the connection to the customer, and add value on top of the service. For example, we provide security operations as a back-end service to the partner, who can resell that and add their own expertise on top. It’s a way to leverage that without rebuilding an entire operation from scratch, which takes a long time. That’s one approach we’ve seen that’s helping. Of course, there’s all the discussion around AI, but a lot of that is automating pieces that are time-consuming to build and maintain, providing some help there. Robert Dutt: The nice theory is that, for so long, the mantra of managed services has been, “Automate all the things you can.” Hopefully, that opens up space for your existing people to take on new, more interesting ideas, develop new skill sets, and those sorts of things. Robert May: Indeed. It’s been the way we’ve grown our own security operations. But once you do that, there’s the next wave of things to follow. It’s a never-ending uphill battle. Robert Dutt: There’s never a dull moment in the security space, that’s for sure. Bringing it around to XPERTS Canada, which is taking place in Montreal later this month, it’s a place where you bring together partners to expand their technical skills, understand what’s in the market, what’s coming, and what they need to worry about next for that next round of threats. For partners who aren’t familiar with the event, can you explain what XPERTS is, who it’s designed for, and what makes it different from other training opportunities you or your peers may offer? Robert May: Sure. This is something we started more than 10 years ago, and we run it globally and inside each region. This year, the Canadian event is in Montreal in a couple of weeks. You can think of it as a week-long boot camp. It’s hands-on workshops for technical engineers—a way to get immersed in new technology or things they haven’t seen before. It’s also run by our consulting systems engineering team. This is the team involved in large-scale projects globally. When there’s a new project for something customized and deeply technical, that information is used to build these workshops. It’s coming from real-world experience, delivered by strong technical people from the field. It’s something special on top of training. There’s a requirement in terms of baseline knowledge: you have to be NSE 4 to attend. It’s hands-on workshops, so you have to have that familiarity to follow the workshop. It gives a week of immersive, hands-on experience across a variety of subjects, from secure networking to security operations, cloud, and operational technology. AI will be sprinkled across everything. It’s embedded inside each of those areas. There’s a lot of new stuff for them to see. Robert Dutt: You touched on some of the areas of focus. Are there major technical areas that are particularly in focus this year? What should partners expect to take away that they can put to work once they’re back in front of customers the week after? Robert May: To some extent, it’s getting more hands-on with the security operations portfolio that people may be less familiar with if they’re coming from a networking background. That’s one element. Certainly, the discussion around AI continues to come up in every conversation. Having practical examples and solutions for customers is something they can take away and say, “Now I understand how I would embed this protection.” Whether it’s different AI tools customers are using or they’re building their own, how do you secure this infrastructure? It’s bringing it to a practical level so they can have that conversation with the customer as well. Robert Dutt: I had the chance to attend the Americas International, or CALA, XPERTS a couple of years ago. One thing that struck me was the culture of it, the community feel, because everyone there has that background and those common goals. Can you touch on the culture or feel you’re looking to encourage with XPERTS? Robert May: Definitely. These are engineers from different companies. In a way, some are competitors, but it’s more about community learning and the information they share among themselves that doesn’t even come from us. To sum up the culture, you could look at the Ultimate Fabric Challenge as one example. This is something my team created. It’s a gamification workshop that allows them to compete head-to-head. A lot of those top engineers get really into it. They’re competing with each other online, flaming each other and things like that. When we have the global championship, people from different countries and regions come together and form their own community. It’s people learning from each other. That’s something we’ve promoted all these years. Robert Dutt: Any new wrinkles in the Ultimate Fabric Challenge this year? What are you doing to keep partners on their toes? Robert May: We’ve put some AI security breach-related things in there. The thing with the Fabric Challenge is that it’s always the latest, greatest version as well. It might even be pre-release stuff they haven’t played with yet. They have to have that previous knowledge to figure out and solve the problems. There’s a lot of focus on AI this year. Robert Dutt: Throughout the time I was there, there were a couple of general keynote sessions, but the focus seemed to be so much on the hands-on component: the lab time, the challenge, the time in front of a computer and talking to people. What’s the importance of those hands-on events as opposed to simply learning about a new technology or product through slideware? Robert May: At this event, we try to minimize even the amount of plenary sessions and presentations because they’re there to learn and do the hands-on work. That’s why we keep the event focused on those deeply technical people. It follows that theme all the way through, and that’s what they’re interested in. That’s what we try to emphasize. Robert Dutt: You described XPERTS as a one-week boot camp, an intensive opportunity for partners to build out their skills. But, to your point about things changing so quickly in the threat landscape partners and customers are facing, training can’t be a once-a-year thing. How does the event fit into Fortinet’s broader picture of partner education, certification, ongoing technical development, and career and skill building? Robert May: That’s something we promote and push year-round: maintaining that level of technical skills and specializations across the partner landscape. It’s an ongoing activity partners need to keep up with throughout the year. XPERTS is a once-a-year special thing. They can see the latest stuff that’s maybe not in the training materials yet, with real-world projects embedded in it. It’s a combination of the two that helps partners move fast. Robert Dutt: If I’m a partner who’s unable to make it to XPERTS this year, what opportunities are there? You mentioned some of this is pre-release and a preview in many cases. How much can I get access to elsewhere? Robert May: The XPERTS event is picking up the latest stuff and doing an in-person boot camp. That same content then feeds back into the overall training and certification program. One part is into the NSE community. That will percolate into the labs and workshops provided through the NSE Institute. We also have other tools we provide to partners for demos, presales, and other aspects. If they’re at a certain level of certification, they get access to more tools and earlier access to those things. It’s a continuous, closed loop. This is usually the starting point for the latest stuff, and then it waterfalls down to those other areas. Robert Dutt: Let’s bring this back to the partner who’s listening. If I’m a Canadian Fortinet partner and want to take a more deliberate approach to developing my team’s expertise over the next year, what are the first two or three things you’d recommend I do, whether that’s a technology area or things to think about in terms of direction or focus? Robert May: I would look at the current customer base and upcoming projects. Where’s my current focus? Where’s my concentration of skills? What are some additional areas that can build on top of that? Whether it’s security operations or going deeper into switching and wireless, it depends on the starting point. That will guide you towards, “These are the areas where I should have more engineers, and I should have more training for them focused on these things.” Then the partner can start to develop more solutions that are pre-packaged and templated. It’s a way to build out the core knowledge they already have. Robert Dutt: Do you find it’s usually best to go with something immediately adjacent to what you’re doing, or is it better to create a separate island of expertise or skills and bring the two together over time? Robert May: It depends on the people more than anything. Personally, I would leverage my current knowledge and build out from there. But there’s an angle to say, from a top-level business perspective, “I can build out an island of something else, and eventually they join together.” Both can be successful. It depends on the management objectives. Robert Dutt: What are you hearing most from customers about where they need help? That may help many partners figure out where to go next. Robert May: A lot of it is on operations and connecting multiple technologies together. Back to the discussion on platforms and platformization, this is one solution to that problem. Instead of buying 10 products from 10 vendors, I might want to buy 10 solutions from two vendors. If my team gets trained on one, they probably already know 70 per cent of the second one, 70 per cent of the third one, and so forth. That’s one strategy the customer can employ. Partners can offer services around a solution or platform. They can start with one part of the project and turn on more capabilities as features, instead of selling a new thing and having separate training and operations around each new technology that gets deployed. Robert Dutt: Last one for me: as we look ahead to next year and potentially beyond—although you don’t want to get too far out over your skis in this industry with the way things evolve—what will distinguish the partners best positioned to capitalize on the next wave of opportunity? Is it the ability to communicate and effectively execute on that platformization and integration strategy? What should partners be preparing for today that maybe they’re not thinking about? Robert May: The last year showed us the rapid transformations from AI itself. Every two months, it’s almost something brand new. Being flexible, able to change quickly, and adapt to the environment is the most critical thing. You can use AI as a tool to speed up some work, but when the whole landscape is changing, you need to adapt very quickly. Having a focus across the platform—exposure and visibility into all these different aspects of technology—allows you to adapt and tackle something you’re not doing today, but you have that reach. Having that platform view gives you more options and keeps that flexibility open. Robert Dutt: Sage advice. Once again, I’d like to thank you for taking the time. Robert May: Awesome. Thanks so much. Robert Dutt: There you have it. Fortinet’s Robert May on the changing technical demands facing cybersecurity partners and the importance of building expertise that goes beyond individual products. I’d like to thank Robert for joining us, and thank you for listening. One thing that stood out to me from this conversation is the balance partners need to strike between depth and breadth. Customers increasingly want integrated solutions rather than collections of individual technologies, but that doesn’t mean every partner needs to be an expert in everything. As Robert suggests, there’s a lot to be said for starting with the customers and capabilities you already know, then building outwards into adjacent areas where you can deliver additional value. There’s also an interesting opportunity in managed services, particularly as vendors like Fortinet make more sophisticated security operations capabilities available to partners who might not have the resources to build those capabilities entirely on their own. Of course, developing those skills takes ongoing investment, and that’s where events like XPERTS 26 Canada come into the picture. The event takes place in Montreal from November 22 to 27, bringing together Fortinet’s technical partner community for hands-on training, workshops, and the Ultimate Fabric Challenge. You’ll find more information about the event and Fortinet’s partner training resources in the accompanying post at ChannelBuzz.ca.

Only one in five Canadian organizations considers itself completely ready to manage a cyberattack, according to new research from Kyndryl. Meanwhile, Netskope has appointed an experienced global channel leader as it expands its partner ecosystem, and Flashpoint is introducing specialized AI agents to automate threat-intelligence workflows. Those are the top stories in Wednesday’s edition of The Buzz from ChannelBuzz.ca. Kyndryl finds Canadian cyber readiness falling despite growing AI adoption New Canadian findings from Kyndryl’s 2026 Readiness Report reveal a widening gap between organizations’ ability to detect cyber threats and their confidence in managing an attack. According to the research, only 20% of Canadian respondents say their organizations are completely ready to manage cyberattacks, down from 36% in 2025. At the same time, 79% say AI helps their organizations identify threats faster than traditional approaches, and 78% consider AI essential to effective cybersecurity operations. The research also finds that 65% believe AI is increasing the sophistication and scale of cyber threats, while 52% say cybersecurity risks are growing faster than their ability to address them. Kyndryl reports that 80% of Canadian organizations are deploying AI beyond pilot projects, although nearly half say their current AI strategy emerged without deliberate planning. The findings highlight an important distinction between identifying an attack and being prepared to contain it, maintain critical operations and recover afterward. For Canadian solution providers and MSPs, the results point toward opportunities in cyber resilience, recovery planning, operational continuity and AI governance, alongside traditional detection and prevention services. Netskope appoints Carrie Francey to lead global channel sales Netskope has appointed Carrie Francey senior vice president of global channel sales, placing an experienced technology channel executive in charge of its worldwide partner organization. Francey brings leadership experience from Microsoft, HPE, ServiceNow and Zendesk, and is also a co-founder of Women in Cloud. Her responsibilities at Netskope will span resellers, managed service providers, managed security service providers, cloud marketplaces and global systems integrators. The appointment comes as Netskope continues investing in its channel-led strategy around secure cloud and AI adoption. Earlier this year, the company introduced its Catalyst MSP/SP Program and Partner Orchestrator, designed to simplify service provisioning and provide more flexible commercial models for managed service providers. Francey’s appointment signals a continued focus on helping partners develop services and practices around Netskope’s security platform, rather than concentrating exclusively on technology resale. For MSPs and MSSPs, the potential opportunity lies in implementing, operating and managing security controls as organizations expand their use of cloud applications and AI. Flashpoint introduces agentic AI for threat intelligence Flashpoint has introduced Flashpoint Agentic AI, adding specialized AI agents to its threat-intelligence platforms. The new offering includes Agentic Hub within Flashpoint Ignite, combining natural-language investigations with purpose-built agents for intelligence briefings, alert setup, alert triage and priority intelligence requirements. Rather than simply summarizing information, the agents are designed to carry out defined multistep workflows. For example, an analyst can ask a question about an emerging threat and have the system investigate related vulnerabilities, exposed credentials, fraud activity and threat actors. Other agents can generate scheduled intelligence reports, translate monitoring requests into alert rules and help filter low-value alerts. Flashpoint emphasizes that findings remain linked to underlying intelligence sources, allowing analysts to review and validate the results. The company cites research finding that 65% of surveyed organizations identify alert noise and false positives as a challenge, while 55% report insufficient analyst bandwidth. For security providers and threat-intelligence teams, the announcement illustrates another application of agentic AI: automating recurring analytical work while keeping human experts responsible for interpreting findings and making decisions. In The Channel: Fortinet and Cisco Canada Later today on In The Channel, Fortinet’s Robert May discusses why cybersecurity partners need to think beyond individual technologies and consider how different security capabilities work together to protect customers. And if you haven’t heard it yet, Tuesday’s episode featured Cisco Canada’s chief technology officer discussing why the biggest cybersecurity challenge may not be a lack of available technology, but how organizations use the tools they already have. Listen to the Cisco Canada CTO interview. Read Full Transcript Hello and welcome to The Buzz from ChannelBuzz.ca. I’m Robert Dutt, today is Wednesday, November 11, 2026. Today is Remembrance Day. Lest we forget. And here’s what’s happening in the channel today. And here’s what’s happening in the channel today. Today, new research finds Canadian organizations are becoming less confident in their ability to manage cyberattacks, even as AI improves threat detection. Netskope names a new global channel chief. And Flashpoint introduces agentic AI to automate threat-intelligence workflows. First up, Canadian organizations may be getting better at detecting cyber threats, but that doesn’t necessarily mean they’re getting better at surviving them. That’s one of the key findings from new Canadian data in Kyndryl’s 2026 Readiness Report. According to the research, only 20 per cent of Canadian respondents say their organizations are completely ready to manage cyberattacks. That’s down from 36 per cent in last year’s report. And the decline comes despite growing confidence in artificial intelligence as a cybersecurity tool. Seventy-nine per cent of Canadian leaders say AI helps their organizations identify threats faster than traditional approaches, while 78 per cent consider AI essential to effective cybersecurity operations. But there’s another side to that equation. Sixty-five per cent say AI is increasing the sophistication and scale of cyber threats, and 52 per cent believe cybersecurity risks are growing faster than their organizations’ ability to address them. So AI is simultaneously helping security teams identify problems and making the threats they’re dealing with more difficult. The research also found that 80 per cent of Canadian organizations are deploying AI beyond pilot projects. But nearly half of respondents say their current AI strategy developed without deliberate planning. That raises questions about whether organizations are moving quickly enough on governance, resilience and recovery as AI becomes more deeply integrated into their operations. Kyndryl’s argument is that identifying a cyberattack sooner isn’t the same thing as being prepared to manage it. Organizations still need to contain an incident, maintain critical operations, and recover when something goes wrong. And that’s an important distinction for the channel. For Canadian MSPs and solution providers, the opportunity isn’t limited to selling more detection technology. It’s also about helping customers understand their risks, establish recovery plans, strengthen operational resilience, and make sure they can keep running when preventive controls aren’t enough. Next, Netskope has named Carrie Francey its new senior vice president of global channel sales, bringing an experienced channel executive into the cybersecurity company’s worldwide partner organization. Francey has previously held leadership roles at Microsoft, Hewlett Packard Enterprise, ServiceNow and Zendesk. She’s also a co-founder of Women in Cloud, an organization focused on supporting women entrepreneurs and technology businesses. At Netskope, she’ll oversee global channel sales and work with a broad range of partners, including resellers, MSPs, MSSPs, cloud marketplaces and global systems integrators. The appointment comes as Netskope continues expanding its channel strategy around cloud security and secure AI adoption. Earlier this year, the company introduced its Catalyst MSP and service provider program, along with Partner Orchestrator, a tool designed to simplify provisioning and management for service providers. The program also introduced more flexible pricing and go-to-market options intended to make it easier for partners to build managed services around Netskope’s platform. Francey’s arrival gives Netskope a new leader to build on those investments. And it’s an interesting time to take over a security channel organization. As customers adopt more cloud applications and AI tools, their security requirements are changing, and many need help implementing and managing protections across increasingly complex environments. That creates opportunities for partners beyond the initial technology sale, including consulting, implementation, policy management and ongoing managed security services. Netskope is positioning its partner ecosystem as central to that strategy, and Francey will be responsible for helping turn those opportunities into sustainable channel businesses. And finally today, Flashpoint is introducing specialized AI agents to help cybersecurity teams manage the growing workload involved in threat intelligence. The company has announced Flashpoint Agentic AI, a new offering that embeds automated intelligence workflows directly into its existing platforms. The centerpiece is Agentic Hub, a new environment within Flashpoint Ignite that combines conversational AI with purpose-built agents. Rather than simply asking an AI assistant to summarize a report, security analysts can delegate more complex, multistep tasks. For example, an analyst could ask about an emerging threat, and the system could investigate related vulnerabilities, exposed credentials, fraud activity and threat actors. Other agents are designed to produce scheduled intelligence briefings, configure monitoring alerts, triage incoming intelligence and help organizations define their priority intelligence requirements. That’s a formal way of describing the questions an organization needs its threat-intelligence program to answer. One important element is that Flashpoint says the findings remain linked to the underlying intelligence sources. That allows analysts to review the evidence and validate what the automated systems have found, rather than simply accepting an AI-generated conclusion. And there’s a clear operational problem behind the announcement. Flashpoint cites research finding that 65 per cent of surveyed organizations struggle with alert noise and false positives, while 55 per cent report insufficient analyst capacity. The company’s approach is to use AI agents to handle recurring work, giving security professionals more time to investigate complex threats and make decisions. For security providers and organizations operating threat-intelligence teams, it’s another example of AI moving beyond assistance with individual tasks toward automating more complete workflows. Of course, the effectiveness of those workflows will depend on the quality of the intelligence and how reliably the agents operate. But the goal is straightforward: help security teams get more useful work done without requiring a proportional increase in staffing. You’ll find more details on all three stories at ChannelBuzz.ca. And before we wrap up, a quick note on In The Channel. Later today on In The Channel, we’ll have my conversation with Fortinet’s Robert May, discussing why cybersecurity partners need to think beyond individual technologies. We talk about how different security capabilities need to work together, and what that means for partners building more complete solutions for their customers. And if you haven’t heard it yet, yesterday’s episode featured my conversation with Cisco Canada’s chief technology officer. We discussed why one of the biggest challenges in cybersecurity isn’t necessarily a shortage of technology, but how effectively organizations are putting the tools they already have to work. Both episodes are available at ChannelBuzz.ca and wherever you get your podcasts. That’s The Buzz for Wednesday, November 11. I’m Robert Dutt. Thanks for listening, and have a great day.

Cherif Gress, vice president and chief technology officer for Cisco Canada Canadian businesses aren’t necessarily suffering from a shortage of cybersecurity technology. They may be suffering from an inability to use that technology effectively. That’s one of the central findings of Cisco’s Relentless Defense report, and a key theme of this episode of In The Channel, featuring Cherif Gress, vice president and chief technology officer for Cisco Canada. The research found that 92 per cent of Canadian organizations experienced a material, business-disrupting cybersecurity incident in the past year. Yet only 13 per cent can update security controls in real time or near real time when new risks emerge, while 56 per cent take longer than a day. And despite increased investment, many organizations aren’t seeing better outcomes. Nearly half of Canadian respondents reported increasing cybersecurity spending over the past two years without seeing a corresponding reduction in incidents. For Gress, the challenge is often organizational rather than technological. Security tools need to be supported by clear governance, coordinated teams and established response procedures that allow organizations to act quickly when threats emerge. That’s particularly relevant for managed service providers. Gress argues that MSPs’ close relationships with their customers position them to address these challenges, helping businesses understand security risks in operational and financial terms rather than simply selling and managing technology. The conversation explores how MSPs and customers should establish responsibilities and preauthorize incident-response actions, why buying managed security services doesn’t eliminate a customer’s own obligations, and how providers can demonstrate value beyond deploying additional products. It also examines the growing role of AI and automation, including the risk that organizations could accelerate threat detection while leaving response processes stuck behind manual approvals. As Gress explains, the goal isn’t simply to make cybersecurity technology more capable. It’s to ensure organizations can actually take advantage of those capabilities when they need them most. Read Full Transcript Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. Canadian businesses are spending more money on cybersecurity. They’re investing in new tools, new capabilities, and increasingly, new technologies powered by artificial intelligence. But are they actually getting any better at defending themselves? New research from Cisco suggests the answer is complicated. The company’s Relentless Defense report found that 92 per cent of Canadian organizations experienced a business-disrupting cybersecurity event over the past year. Just 13 per cent say they’re able to update their security controls in real time or near real time as new threats emerge, and nearly half say they’ve increased their cybersecurity spending over the last two years, only to see the number of incidents remain the same. But perhaps the most interesting finding is that the biggest obstacle to better cybersecurity may not be technology at all. It may just be the organizations themselves. Cherif Gress, vice president and chief technology officer for Cisco Canada, joins us to discuss why organizational friction is preventing companies from getting the most out of their cybersecurity investments, and why simply buying more technology isn’t necessarily the answer. We also explore what this means for managed service providers, from helping customers understand cybersecurity in business terms to establishing clear responsibilities and response procedures before an incident occurs. And we look at how AI and automation are changing the equation, potentially accelerating security operations while introducing entirely new questions about governance and control. Let’s get right into it, my chat with Cherif Gress. Robert Dutt: Cherif, thanks for taking the time. I appreciate it. Cherif Gress: My pleasure, Robert. Thank you for having me. Robert Dutt: The Relentless Defense report paints a fairly concerning picture of cybersecurity preparedness, especially at this point in the game, including here in Canada. Before we get into the individual findings of the report, what was Cisco trying to understand with this research, and what surprised you most about the Canadian results? Cherif Gress: Excellent question. Thanks, Rob. I think fundamentally the research was trying to assess our security posture. It’s an international research study to assess 3,000 professionals. So we’re trying to get a feel for what security represents for them and how they’re positioned toward security, especially in the post-LLM era that we talk about, with these frontier LLMs. And the findings are quite interesting. I think what stands out in terms of the pertinence to the Canadian market itself is the fact that it’s not a lack of technology that’s causing the slowdown. The friction comes from internal structure, organizationally, in terms of the groups not working as a single unit to face these frontier attacks. So I think that’s the main resonating point that comes out of the study at this point. Robert Dutt: One of the more striking Canadian findings was that nine in ten, 92 per cent, I think it was, of organizations experienced a business-disrupting cyber event in the past year. That’s huge. That’s massive. What does that tell you about the state of cybersecurity in the Canadian business scene? Cherif Gress: I think what that tells us is attacks are moving fast, and faster than before. So the need to defend has to match that ability. And then we see it, and the Relentless Defenders are the ones that come out on top. Basically, they’re the organizations that have the ability to see all their assets, first of all, because it starts with visibility. The ability to see all your assets in one single pane of glass, and then having the structure and the governance in place to be able to operate as one unit when you’re facing these attacks. There are multiple different things that can be done from a security standpoint to be able to isolate, segment, and make sure your network does not completely fall out of shape in case of an intrusion. And this is the type of work that we do a lot with our customers. Robert Dutt: Something that caught my attention was the finding that just 13 per cent of Canadian organizations can update security controls in real time, or close enough to real time to make it count, when a new risk emerges. More than half take longer than a day. What’s slowing organizations down at this point? Cherif Gress: I think it’s the integration of tools. Buying all the different elements of security does not give you the speed required. It gives you tools. However, stitching them into a strategy, into a playbook, is important. Playbooks are huge when it comes to security, because when things go sideways, this is not the time to try to figure out a plan of how do we address this. This has to be already a page in your book that you execute. And I think that’s the major element. This is no longer if it happens, it’s when it happens and how you’re going to react to it. Organizations that are well-oiled from a structural perspective and can operate as one team, where the governance is preset and every team knows exactly what they need to do and when to do it in case an incident occurs, I think that’s what makes a difference. And this is where we see the numbers go down in terms of preparedness, because we’re stuck on the friction element and we’re trying to solve it with technology, when really additional technology is not going to help you there. And you’ve seen it, right? Some companies report that despite spending more on technology, the number of attacks and threats has not reduced. And it’s because they haven’t addressed the elements from an organizational standpoint as well. So they go hand in hand. Robert Dutt: Are we at a point where simply spending more money on cybersecurity, especially to your last point there, isn’t necessarily making organizations more secure? Cherif Gress: Absolutely. I think that’s one of the findings in the study. It’s organizing your existing assets in terms of security. What do your defences look like? What does the architecture look like? And not saying that you might not need additional things, but at least doing that already and aligning the organization behind these tools for those almost near-real-time changes, I think that’s the first step. And then you start building on top of that. If you do need additional controls and governance, you build up on that. But I think the alignment of the organization alongside the investment from a security standpoint, those are the fundamental elements that the study seems to indicate. Robert Dutt: That’s been something that a lot of channel partners, be they resellers or MSPs, especially in the MSP space, have been focused on for a long time, integrating those tools and creating a solution out of that which hopefully addresses problems. But I think you bring up a good point on the culture side of things, and making sure the customer is fully bought in, is fully invested, and is on board with the direction that you’re going. Cherif Gress: And I think this is where the MSPs can play an outstanding role, in the sense that they have the customer intimacy. So they need to allow themselves the permission to ask the right questions beyond the technology that they’re selling. How is that going to be operated? How is the playbook? Can they be an assistant? Some of these MSPs have extremely mature cybersecurity practices, where they can do best-practice sharing. But also, from a CX perspective at Cisco, this is some of the services we offer in terms of aligning organizational elements to the security platform that’s put in place. Robert Dutt: To that cultural point, with only about 35 per cent of Canadian respondents saying that security, IT and business teams are all on the same page, rowing in the same direction around security, first of all, what does an organization that gets this right actually look like? And secondly, what can I, as an MSP or partner on the outside looking in, trying to help my customers, do to help them get to that state? Cherif Gress: One of the things that I read in the report that struck me is the fact that some of these technical teams, security teams, are not able to verbalize or summarize the impact of what a security incident could mean to the business. So how does that translate into business value? There’s a disconnect between the business leaders and those teams. So I think some work needs to be done to be able to translate each one of those downtime minutes, what it means to the business, in a clear way. And downtime could mean partial downtime or complete downtime, depending on how major the incident is. But I think it starts there. And I think from a channel perspective or MSP perspective, the ability to work with the security teams to help them distill the value of what they’ve invested in, if properly operated, and what does that mean? And if it’s not, what does that mean as well in terms of impact and value to the business? So I think this is the additional piece where there has to be some hand-holding. It’s not just buying a firewall and operating it. It’s like, what else are you going to do with this? And then getting into the nitty-gritty, uncomfortable conversations as well, where basically you have an intruder. Now, how do we isolate them? How do we make sure that they don’t move east-west in your network and start compromising more systems? This is all part of the playbook that I referred to earlier, because all these things have to take place before the incident happens, so the teams are well positioned to do that. And again, I don’t think there’s a lack of investment, but I think there has to be more communication around the potential threats in more business language. We love geek language when it comes to security. I think it needs to go back to more of a business conversation than just the threat itself. Robert Dutt: So you’ve got the problem with the different languages being spoken between business and IT, and heaven knows we see enough of that. Cherif Gress: I mean, you’ve been in the industry, right? This is age-old. It’s not unique to security. Robert Dutt: Absolutely. And at the same time, maybe there’s the challenge of business leaders not understanding the security side of things deeply enough that the thought is, okay, I’ve thrown money at this, ergo problem solved. Woo-hoo. Cherif Gress: Yeah, absolutely. And I think this is the other element. I’m trying to share this study with as many of my customers as I can because it raises the element of there’s an additional layer beyond the technology itself, in terms of how you operate and how you work with the technology across the organization, and not just the team that’s responsible for that technology. Robert Dutt: So if I’m an MSP working with the CEO or business owner of a customer, what should I be telling them about how to think differently to make their organization more resilient at large? Cherif Gress: This is a very, very good question because it goes to the core of the topic itself. And I think, yes, there’s a lot of fearmongering going on right now. It’s like, the agents are going to go rogue, we’re going to lose everything. There’s so much language going on in terms of fearmongering. But the reality is, I think instead of using those sensational headlines, if we can bring it down to real metrics in terms of what an incident could represent to the business, this is where you’ll get the attention of a CEO. It’s almost like the headlines are so persistent and so unanimous that we’ve become a little bit immune to these massive, large, bold headlines. We need this to be applicable to our own scenario to be able to absorb the real impact of this. And I think this is where the MSP, sitting with the CEO, can verbalize this in a more intimate setting, understanding what the amplitude of this could mean to their business. Robert Dutt: Is the impetus on IT, and I’m broadly including partners more on the IT side than the business side for the purpose of this conversation, since solution providers tend to come at things from a technical lens, even if they do have a business focus. But is the impetus more on the IT side to bring the conversation to the business level, to bring the C-suite level of knowledge up, or is there an opportunity to meet in the middle somewhere? Cherif Gress: I think it’s meeting in the middle, and I think it’s beyond IT. I think it’s security folks as well. I think the MSP has to be involved in that conversation as well. The OEM, to a certain point, can also be pulled into that conversation. But I think it is a roundtable conversation because this is where the impact can be communicated and translated in a way that many of the participants can understand. And instead of trying to elevate one group or dumb the message down and lose something in the translation, I think everybody needs to be able to sit around the table and have that unique conversation in terms of the impact. Robert Dutt: Many Canadian SMBs that MSPs are serving don’t have dedicated security teams, much less a CISO or a SOC or any of that fancy stuff. They’re depending on MSPs to provide all of those capabilities. How does that figure into the organizational friction that you’ve identified here? Is it a solution to it, or does it sometimes create another layer of complexity, in that now you’ve got to take the IT culture, the business culture internally, and match it up with the solution provider’s own processes, culture, et cetera? Cherif Gress: I think a lot of what you’ve just said has to be in place, but I think it’s also about asking the right questions to your MSP. What does the current service render for me? Where are the potential risks? Because there has to be some risk analysis ahead of it as you engage in any service, and understanding where their responsibilities stop and where yours come in as well. So in terms of an SMB organization, just because you’re buying a turnkey service doesn’t mean you’re completely exonerated from any responsibility. You have to understand where you might have to have certain people double up as security ambassadors within your organization to make sure that there’s a consistent adoption across the service. So not just relying on the MSP service, but also having some secondary mechanisms within the SMB to react. It cannot be ignored. And I understand the conundrum when it comes to affordability, but this is something that needs to be absolutely looked at. Robert Dutt: Along those lines of division of responsibility, if I’m an MSP and I detect an active threat against a customer’s environment, there’s a tension between the need to act immediately on that and the customer’s expectation that they get to sign off on what I’m about to do to their systems. How should an MSP and their customers be thinking about that division of responsibility, especially as they’re, as you say, hopefully thinking about these things before they’re in the trenches with incoming fire? Cherif Gress: In my opinion, whether the security element sits within the organization or is outsourced to an MSP, I think the composition remains the same. That playbook discussion has to be in place before, and scenarios must be understood. So we’re not having to seek approval during the attack, but the playbook indicates that in case of this event, these are the mechanisms we will use ahead of time. So the preapproval is already obtained. There’s an alignment in terms of trying to remove the friction as much as possible. When the attack does happen or the systems are compromised, then it’s just execution of the plan rather than figuring out what are we going to do and getting approval. Not saying that you’re going to be able to cover all scenarios in all cases, but I think a large number of those scenarios can be addressed ahead of time, meaning that you leave the outlier cases for maybe some quick approval-seeking if it’s needed. Robert Dutt: Yeah. And I know this is a 101-level concept, but make sure that is tested with the customer so you know where the pain points are. Maybe you don’t discover all of those outlier situations, but you’re going to find some. Cherif Gress: Yeah, absolutely. And also, having this conversation ahead of time, the MSP can get a better sense of the customer’s level of education in terms of, are all systems equal in terms of the impact? And so adding some gradation in terms of the remediation solutions can also be added there as well, depending on the understanding of the customer’s assets. Robert Dutt: It feels to me like there’s a business opportunity here for MSPs. If the problem isn’t just that there’s insufficient security technology, if the technology is plentiful, but the inability to coordinate and respond effectively is the challenge, it suggests that maybe MSPs should position themselves less as the provider of product, transactionally, and more outcome-based, delivering cyber resilience, hopefully in a measurable way. Cherif Gress: Absolutely. And we’ve seen this in other types of technologies where there’s a collapse of responsibilities, where you join two groups. Let’s talk about routed optical networks, right? Typically in any organization, optical networks are operated by a team, IP networks are another team. Routed optical requires that merge of these two groups together. And the best adoption of these technologies is when the companies have acknowledged that organizationally they need to make changes to be able to align these teams together to get better adoption of technology. Same thing when it comes to security. I think there has to be that melding of the different groups together to be able to have that common language across. And MSPs, again, because of their intimacy and because of their ability to access these customers, need to be able to have this conversation and drive these conversations beyond technology, but more about the adoption and the use of the technology. Robert Dutt: Any thoughts on how an MSP can best demonstrate that value to a customer? What metrics should they be measuring and reporting, especially early in the relationship when they can’t say definitively? It’s hard to sell, or it’s hard to show what you’ve protected someone from if they haven’t seen that attack. Cherif Gress: Yeah, it’s an interesting one. Fundamentally, I think it goes down to a different type of conversation. And I know it’s been mentioned many times, it’s the consultative approach rather than pushing products and pushing solutions. I think you need to have that holistic conversation in terms of understanding what’s motivating that investment ahead of time. And my best sales experiences on a personal level are when I’ve met salespeople who ask me questions before they even propose any kind of solution. So qualify the environment, ask the tough questions ahead of the conversation to make sure that you’re positioning not only the solution itself, but also how it needs to be operated and how it needs to live within the organization. And then have the practice that will be able to hold the customer’s hand as they move through the stages of the lifecycle of the solution, from day zero all the way to day two. Robert Dutt: AI is clearly, as this report shows, changing a lot of cybersecurity, period, on both sides. The pace at which it goes, the sophistication of the attacks, et cetera. How much of the gap between speed of attack and speed of response can realistically be closed through automation, through better AI on the defence side, especially when the attack side is obviously going to still be ramping and pushing boundaries too? Cherif Gress: Yeah, so it’s a must. And this is something Cisco is leaning into tremendously. We’ve actually upped our ability to churn out patches and address CVEs, so the ability to have patches available on a more regular basis, twice a month. But we’re also providing in-between solutions, solutions like Live Protect, which are essentially workarounds in the configuration that will address specific threats that are out in the wild, to be able to give the customer time to react and update whenever they can. Because updating systems is something else that we rarely talk about. Operationally, what used to take months now has to be done in days. And the last figure I’ve seen in one of the reports, from the time of a declared exploit to the reaction that needs to happen, it’s about eight hours. So we’re not talking in days anymore. We’re talking eight hours. Things like Live Protect will provide some buffer for customers so they can get their systems updated accordingly. But it’s no longer what it used to be. The world has changed now. These updates need to move a lot faster, and customers will need to adapt to that new speed because they have no choice. Robert Dutt: Is there a danger that we might automate the detection of these attacks but still leave the response phase stuck behind organizational approval and more legacy mindsets and approaches? Cherif Gress: That’s a very, very good point and absolutely relevant. And I think this is where the real threat comes in. The front end has been updated, but the back end still operates manually. Today, I was just having a conversation with one of our development teams internally where, yes, AI is helping us churn a lot more code than we used to, but the human in the middle who has to validate these elements still has the same workload. And we have to make sure that these human-in-the-loop elements are not becoming a detriment to the speed, but rather an enhancement of the quality that’s provided by AI. Robert Dutt: And the next wrinkle that’s certainly arriving this year, that we’ve been talking about for a couple of years but now certainly arriving at scale this year, is the agentic side of things. As AI agents are more capable of taking action rather than just identifying threats, how do you manage that? And how do you think about that when you’ve got business or customer culture, process and organization, MSP process and organization, customers’ AI agents, MSPs’ AI agents? Somehow you have to make a coherent strategy, approach and defence out of that. Basically, how should organizations and their MSP partners decide what they’re comfortable with letting these systems do on their own, with minimal interaction, to try to be ahead of the game as much as they can? Cherif Gress: It feels like we just finished the initiative of role-based access and getting people authorized from a human perspective, and then zero trust. Now we have to play it again and add the agents to the unit, right? Agents have to be treated the same way, where they need to be trusted and authenticated, and that has to be part of the governance that comes into play. Agents must be subjected to the same kind of rigor that we’ve implemented on humans, because they also can cause some damage if left unmanaged or unmonitored. So from a Cisco perspective, we’re deploying a lot of effort in agent identity, the validation to make sure that the agents can perform their tasks as prescribed, but also to detect early when agents start behaving in an erratic or unpredictable way, so we can catch them before the damage is too large or even happens. So that’s the idea: trust and authentication. Robert Dutt: Let’s bring this back to the average Canadian MSP and its customers. If an MSP recognizes these problems in its customer base, and I suspect a lot do, what are two or three practical first steps that they should be doing differently today to improve those customers’ ability to respond to an attack in the current environment? Cherif Gress: I think governance. Understand the governance in place. I think this is fundamental. If there’s one thing that we confirm, it’s that there is no lack of technology. The technology is there, but it’s operating the technology, understanding the governance model that ties it together, and making sure that the teams that sit within that governance framework understand how they need to react and when to react. I think these are the fundamental pieces that we’re asking people to get educated on. And this is less about configurations. Yes, network security architecture matters, absolutely. I’m not going to downplay this. But from what we’re seeing right here, this is not the weakness. I think the weakness is organizational, and it starts with governance. Governance is not something that you set and forget. It’s something that you continuously go back and revisit, measure, monitor and report on. And that has to be exposed to the business as well, because they need to feel comfortable that whatever is in place is working as prescribed. Robert Dutt: And finally for me, if we’re having this conversation a year from now, I don’t actually know the cadence of this research or if it’s going to be something that’s repeated, but let’s say it is and we’re looking back at the state of Canadian organizations’ approach to cybersecurity a year from now. What would you hope will have changed between October 2026 and October 2027? Cherif Gress: I’d love to see less friction internally. I think this is the biggest point. I hate to see technology lose its luster because of an inefficiency from an organizational standpoint. There’s a lot of R&D being done to make sure that all the technology that we’re putting out there is working to the best of its abilities, but ensuring that the friction is eliminated allows this technology to really function the way it’s designed. I think fundamentally this is what I’d love to see for our next year’s report. Robert Dutt: All right, brilliant. Some good insight into the numbers and some good advice. Cherif, again, I appreciate you taking the time on this. Cherif Gress: Thank you, Robert. It’s a pleasure to meet you. Thank you so much. Robert Dutt: Thanks again to Cherif Gress, vice president and CTO of Cisco Canada, for joining us, and thank you for listening. There are a few things for me that stood out from this conversation. First, cybersecurity effectiveness isn’t necessarily a function of how much technology an organization has purchased. As Cherif points out, many Canadian businesses have made significant investments in security tools, but they’re still struggling to respond quickly and effectively when incidents occur. The missing piece is often organizational, making sure the right people, processes and technologies are working together with clear responsibilities and a plan that everyone understands. Second, there’s a significant opportunity here for managed service providers. MSPs have relationships with their customers that put them in a position to help bridge the gap between technology and business operations. But that means going beyond simply deploying and managing security products. It means understanding the customer’s business, helping them assess risk, and having potentially uncomfortable conversations about who’s responsible for what when something goes wrong. And importantly, those conversations need to happen before an incident, not while an attack is underway. Finally, AI and automation aren’t going to make those organizational challenges disappear. In fact, as we increasingly rely on AI agents to identify threats and potentially take action against them, questions about authorization, identity and governance become even more important. The technology may be moving faster than ever, but organizations and their service providers still need to figure out how to keep up. If you’re enjoying the podcast, please do subscribe or follow the show wherever you get your podcasts: Apple Podcasts, YouTube, Spotify, and most of the major directories. And if you have a moment, a rating or review helps other listeners discover us. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Today’s headlines for Canadian IT solutions providers. Huntress finds deeper compromise of AhsayCBS backup servers Huntress has published new findings from its investigation into attacks against AhsayCBS backup management servers, revealing additional malware, persistence mechanisms and tools that could have enabled attackers to access sensitive backup infrastructure. The investigation builds on Huntress’s October reporting into exploitation of two AhsayCBS vulnerabilities, CVE-2026-105133 and CVE-2026-105134, which attackers chained together to bypass authentication and execute commands with SYSTEM privileges. The new research examines three compromised servers within a single organization, breached between October 8 and October 11. Investigators found five families of malicious webshells, including one capable of extracting encrypted code hidden within PNG image files and running it in memory. They also identified a second cryptocurrency miner, a Python-based implant designed to communicate with a command-and-control server, and various tunneling and remote-access tools. Perhaps most concerning for MSPs, Huntress also observed activity consistent with an attempt to retrieve credentials from a related Veeam backup environment. The company has not established that backup data was stolen, and the research should not be interpreted as confirmation of successful exfiltration. Ahsay has released hotfixes addressing the exploited entry point, including version 10.3.4.45 for version 10 installations and 9.15.2.70 for versions 7 through 9. However, Huntress warns that patching does not remove malicious software already installed on compromised servers. Organizations with potentially affected systems should investigate for indicators of compromise and consider rebuilding compromised hosts from trusted sources. The broader lesson for MSPs is that backup infrastructure itself can become a high-value attack target, particularly when it contains privileged access to other systems. Devolutions expands PAM into endpoint software management Montreal-based Devolutions has announced an expansion of its privileged access management platform, adding device enrollment and centralized software management capabilities intended to reduce the need for permanent local administrator privileges. The new functionality will allow IT teams to enroll devices from existing mobile device management environments and centrally approve, install and update software. Designed to complement tools such as Microsoft Intune, the capabilities will use Devolutions’ UniGetUI technology to manage software across multiple package-management systems. The announcement represents the first phase of the company’s endpoint privilege management roadmap. Devolutions has also been expanding its existing PAM functionality, including more granular administrative roles, dedicated auditing permissions, credential management integrated with remote connections, and time-limited privileged access approvals. For MSPs, the objective is to combine access controls with routine endpoint administration, reducing the number of tools and manual processes required to manage customer environments. The new device enrollment and software management features are expected to become generally available in December 2026. Existing Devolutions PAM capabilities are available now. GTIA research points to expanding cybersecurity opportunity New research previewed by the Global Technology Industry Association at ChannelCon EMEA suggests IT service providers are planning to expand their cybersecurity businesses as customer demand and AI-related security requirements grow. According to the North American findings from GTIA’s Channel Trends in Cybersecurity research, 76% of respondents plan to add new cybersecurity solutions over the next 12 months, compared with 65% in 2025. Nearly 60% plan to introduce AI-related cybersecurity solutions, with opportunities extending beyond traditional security products into AI governance, model and data protection, and acceptable-use policies. Half of respondents also reported revenue growth directly attributable to cybersecurity this year, with notable activity in identity, security management, cloud and data solutions. The findings suggest AI is becoming both a source of additional security risk and an opportunity for providers to build new services. GTIA also released its separate third-quarter cybersecurity tracker, identifying AI-generated attacks as a leading customer concern and continued gaps in the deployment of established security controls. For MSPs, the opportunity may be as much about helping customers establish practical security policies and governance as it is about selling additional technology. Read Full Transcript Hello and welcome to The Buzz from ChannelBuzz.ca. I’m Robert Dutt, today is Tuesday, November 10, 2026, and here’s what’s happening in the channel today. Today, Huntress uncovers new evidence of a much deeper intrusion into compromised backup servers. Canadian security vendor Devolutions is expanding its privileged access management platform. And new GTIA research points to growing cybersecurity opportunities for IT service providers. First up, Huntress has published new findings from its investigation into attacks against AhsayCBS backup management servers, and the activity appears to have gone considerably further than the cryptocurrency mining initially reported last month. Back in October, Huntress identified attackers exploiting two vulnerabilities in AhsayCBS, a platform used by MSPs and other service providers to manage customer backup operations. Those vulnerabilities allowed attackers to bypass authentication and execute commands with system-level privileges on vulnerable servers. The initial investigation uncovered malicious webshells and cryptocurrency miners. But Huntress has now examined three compromised servers in one environment, and found a much more extensive collection of malicious tools. These include five different families of webshells, a second cryptocurrency miner, and a Python-based implant designed to communicate with an external command-and-control server. One particularly unusual webshell was designed to hide encrypted malicious code inside PNG image files, then extract and execute that code in memory. That could allow malicious activity to resemble ordinary image traffic, making it harder to identify through conventional monitoring. Huntress also found tunneling tools, remote access software, and broad exclusions configured in Microsoft Defender. And perhaps most concerning for service providers, investigators observed activity consistent with an attempt to retrieve stored credentials from a related Veeam backup environment. Huntress hasn’t established that backup data was stolen, but the findings suggest the attackers may have been interested in more than simply using compromised servers to mine cryptocurrency. And that’s especially concerning when the compromised systems are responsible for managing backups and potentially have privileged access to other infrastructure. Ahsay has released hotfixes for the exploited vulnerabilities, and Huntress has verified that the version ten hotfix blocks the entry point it observed. But the company is emphasizing that applying a patch doesn’t necessarily remove malicious tools that attackers have already installed. For MSPs running AhsayCBS, the recommendation is to investigate potentially exposed systems for evidence of compromise, not simply assume that installing the update resolves everything. The broader lesson is that backup infrastructure needs to be protected and monitored as carefully as the production systems it’s intended to recover. Next, Montreal-based Devolutions is expanding its privileged access management platform to bring more everyday endpoint administration under the same security controls. The company has announced new device enrollment and centralized software management capabilities, marking the first phase of its endpoint privilege management roadmap. The idea is to address a familiar challenge for IT teams and MSPs. Organizations want to eliminate unnecessary local administrator privileges, but employees still need legitimate software installed, updated, and maintained. And that often creates friction between security requirements and the routine work of keeping systems running. Devolutions wants to bring those processes together. The upcoming capabilities will allow administrators to enroll devices from existing management environments, including systems such as Microsoft Intune, and centrally approve and manage software installations. The software management component uses UniGetUI technology, which brings together multiple software package managers through a common interface. That means IT teams could manage approved software without having to give users permanent local administrator rights simply to install or update applications. The new features build on Devolutions’ existing privileged access management capabilities, which include time-limited access approvals, credential management, session recording, and auditing. The company has also introduced more granular administrator roles, allowing MSPs and internal IT teams to separate responsibilities without giving every administrator access to sensitive credentials. For MSPs, the broader objective is to make privileged access management practical for smaller IT teams that don’t necessarily have the resources to operate complex enterprise security platforms. Now, the new endpoint enrollment and centralized software management features aren’t generally available just yet. Devolutions expects them to become available in December, while its existing PAM platform is available now. But it’s an interesting expansion of the privileged access management category, bringing the question of who can access systems closer to the question of what they’re allowed to do on those systems. And finally today, new research from the Global Technology Industry Association suggests cybersecurity remains a significant growth opportunity for IT service providers, with artificial intelligence creating additional demand for new services. GTIA previewed findings from its latest Channel Trends in Cybersecurity research at its ChannelCon EMEA event in London. According to the North American findings, 76 per cent of respondents plan to add new cybersecurity solutions over the next twelve months. That’s up from 65 per cent in last year’s research. And nearly 60 per cent say they plan to add AI-related cybersecurity solutions. But the opportunity isn’t limited to selling additional security products. GTIA identifies areas including AI governance, model and data security, and acceptable-use policies as potential new services for solution providers. In other words, as customers adopt AI tools, they increasingly need help understanding how to use them safely, protect sensitive information, and establish practical rules around their use. The research also found that half of respondents reported revenue increases directly related to cybersecurity this year, particularly in identity, security management, cloud, and data solutions. And in a separate quarterly cybersecurity tracker, GTIA identifies AI-generated attacks as a leading concern among customers, while also highlighting gaps in the deployment of more established security protections. That creates an interesting combination for MSPs. Customers are worried about emerging AI threats, but many still need help implementing fundamental security controls. So the opportunity may involve both new AI-specific services and continued work strengthening the security foundations customers already depend on. You’ll find more details on all three stories at ChannelBuzz.ca. And before we go, a quick note on In The Channel. Later today on In The Channel, we’ll have a conversation with Cisco Canada‘s chief technology officer about the challenges facing cybersecurity, and why the biggest problem may not be a lack of security technology, but how effectively organizations are using what they already have. And if you haven’t heard it yet, yesterday’s episode featured my conversation with Peter DiMarco and Rob Brown of D&H Canada. We discussed the distributor’s strong Canadian growth, its expanding advanced solutions business, and how it’s helping partners pursue bigger opportunities around the products they sell. Both episodes are available at ChannelBuzz.ca and wherever you get your podcasts. That’s how we’re seeing the headlines today. I’m Robert Dutt. Thanks for listening, and have a great day.

Peter DiMarco, general manager, D&H Canada D&H Canada is seeing double-digit growth in 2026, driven in part by significant momentum in advanced solutions, as the distributor continues to invest in the people and capabilities needed to support an expanding Canadian partner base. Speaking with ChannelBuzz.ca at the company’s THREAD conference in Toronto, Peter DiMarco, general manager of D&H Canada, said the company’s performance has exceeded expectations, with growth in some advanced solutions categories running between 40 and 60 per cent. The results follow a year of investment and expansion. When we spoke with DiMarco earlier this year, he argued that companies willing to invest through uncertain market conditions would emerge in a stronger position. The distributor has also seen strong uptake from solution providers looking to expand the scope of their business with D&H. DiMarco said 262 partners have begun purchasing advanced solutions through the distributor this year, making partner acquisition one of the company’s biggest areas of progress. But growth isn’t the only issue on partners’ minds. Rob Brown, vice president of sales, D&H Canada Rob Brown, vice president of sales at D&H, said rising technology prices and supply chain pressures have become dominant concerns for Canadian resellers, many of whose customers are trying to stretch budgets that haven’t increased alongside hardware costs. For D&H, that has created opportunities to provide additional support, including inventory reservation programs that allow partners to purchase and hold products at current prices for future deployment. At the same time, D&H is expanding its focus on helping smaller solution providers pursue more sophisticated opportunities in infrastructure, cloud and AI, without requiring them to build all of those capabilities internally from the outset. DiMarco said the company has invested in additional sales resources and greater partner segmentation to maintain its high-touch approach as the business grows. Brown highlighted D&H’s Go Big AI initiative, which is designed to help smaller partners develop the skills and market knowledge needed to participate in emerging AI opportunities. The distributor is also expanding its Canadian Partnerfi community, which DiMarco said has grown from nine members to 50, with an emphasis on peer-to-peer collaboration, education and business development. In this episode of In The Channel, DiMarco and Brown discuss: What’s driving D&H Canada’s growth and where it’s finding new partner opportunities; How rising hardware prices are changing reseller conversations with customers; The distributor’s strategy for helping traditional SMB partners move into advanced solutions; How D&H is expanding its Partnerfi community while preserving its peer-to-peer focus; The role of AI in D&H’s own operations and its partners’ businesses; and What the company wants Canadian solution providers to focus on as they plan for 2027. Listen to the full conversation below. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news, information and analysis to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. D&H Canada is having a strong year, with double-digit growth overall and even faster growth in advanced solutions. But as the distributor expands into more sophisticated technologies and works with a broader range of solution providers, it’s also trying to preserve the high-touch approach that has traditionally distinguished it in the SMB channel. At D&H’s THREAD conference in Toronto, I caught up with Peter DiMarco, general manager of D&H Canada, and Rob Brown, vice president of sales, to talk about how the business has evolved in 2026, what they’re hearing from Canadian partners, and where they see the opportunities ahead. We discuss the impact of rising technology prices on reseller and customer budgets, how D&H is helping partners move into advanced solutions and AI, and the growing role of its Partnerfi community. Let’s get right into it, my chat with Peter DiMarco and Rob Brown. Robert Dutt: Gentlemen, thank you for taking the time. Peter DiMarco: Pleasure to be here. Robert Dutt: Pete, when we talked back in February about the investments and ambition for the year, we talked about the idea that the companies willing to invest through uncertain times would come out ahead. We’re getting towards the end of the year. How’s that played out? What’s changed most significantly in the Canadian business since last we spoke, which was much nearer the top of the year than the end? Peter DiMarco: Yeah, so to answer your first question, it’s played out really well for us. We continue to grow at a double-digit pace. If you look at our advanced solutions space, that’s actually growing 40%, 50%, 60%, depending upon what category. That actually includes cloud as well. So everything has turned out, honestly, better than expected. We hired a bunch of resources. We had to put them in place and get them trained, and the onboarding and acceleration of those resources have helped fuel our growth for this year. The results honestly came out better than expected. Robert Dutt: Where are those hires, where are those resources centred right now? Peter DiMarco: Mostly, 100% in customer-facing and market-facing roles. So support teams, sales teams, team leads, operations managers, pre-sales engineers, and then a couple of field roles as well. Robert Dutt: All right. Rob, you’re now a year or so into the role of leading sales. I’m curious what you’re hearing from Canadian solution providers. Where are they finding opportunities, and what are they asking D&H to help them do that wasn’t maybe on the radar a year or two ago? Rob Brown: Sure. Well, the obvious answer is the supply chain challenges we have and some of the price increases that have plagued the entire channel and put pressure on customer budgets. It’s kind of shifted everything. And you’re right, a year ago, we really weren’t having this conversation. I’d like to say there’s never a good challenge I like to waste, because it’s an excellent time to offer value, right? So I think our general role in distribution, as a channel community as a whole, is to supply as much transparent information as we possibly can so that customers can make new decisions. They started their year with a budget. Their budget’s probably not going up, yet the prices went up by 10%, 15%, and sometimes even more than that. You might have a customer that needed 100 laptops, and now he can only afford to buy 80 with his budget. He still needs the other 20. What do you do? There’s a lot of value distribution and the ecosystem can supply in that type of environment to offset some of these challenges, add value, and give customers good answers from which to make solid business decisions. So I would say, in general, to answer your question, it’s the price changes. It’s dominating the conversation. They need technology. The legacy technology they have is not the technology they need to move forward. They need to be able to invest in some of these emerging, largely AI-based technologies, but there are budget constraints around pricing. Robert Dutt: How’s that conversation evolved over the course of the year? We had the initial RAMageddon shock. I’m just curious how you’ve seen resellers react to that and how the conversation has evolved. Rob Brown: It went from shock and awe to, “I’ve got to manage this process. I have no choice.” It’s funny how quickly you can adapt. The smart ones are adding value and telling customers, “The best price I can guarantee you is today, because I don’t know what tomorrow’s going to look like. I don’t know what supply’s going to look like tomorrow.” We’re likely going to be here for a while. I don’t think this is going to resolve itself by the new year. So you need to think about this thing long term. You need to talk to your finance teams about your budget long term, and you need to work with partners like D&H to help you overcome some of these challenges. We have a reserve warehouse. We’re more than happy and willing to put your inventory in it. We can buy and hold it at a current price and hold it for later, and we’ll project-roll that out for you. And one thing I can guarantee you is the price that we charge to buy and hold your product is a lot smaller than the price increase you’re about to incur. So there are answers out there. You just have to explore. And I think that once the resellers and the solution providers themselves realized the situation they were in, and once the shock wore off, it was into solution mode. Robert Dutt: You must have seen a lot of pickup on that offer, especially in the part of the year where quote validity was shrinking to hours, sometimes it felt like. Rob Brown: Yeah. Our reserve warehouse, if you walked through there, it’s a nice big warehouse, lots of space for us to grow. And our reserve inventory shelves were largely empty prior to this challenge. Now they’re stocked full. Robert Dutt: Peter, you touched on some of the growth areas a bit earlier, but can you elaborate a bit on where the growth is coming from today? Is it primarily more business with existing partners, bringing new partners into the fold, expanding the technology categories? Where’s the growth? Peter DiMarco: Great question, and it’s something that we look at often. I’d say it’s all of the above. Many new partner relationships. If I have to look at where we are more successful, or where we have faster success than I expected, it’s partner acquisition. So, for example, in the advanced solutions space, this year we’ve done business with 262 new advanced solutions partners. They hadn’t bought those products from us in the past. Now they’re buying products from us. And a lot of it is around ease of doing business, around response time, being able to help them put together bills of materials. To Rob’s point, a ton of transparency around not only price increases, but also helping them around things like product roadmaps, features and benefits, and what the options are around certain price points along the way. We’ve also done some creative financing, offered extended terms to partners as well to help extend out their business, knowing that budgets have gone up. Now, within that, when I look at the overall segment, the majority of the growth has come from the higher end of the SMB and the mid-market partners. So existing partners continue to invest in their sales force, and as they bring on new customers or new end customers, they’re coming to us for product, for training, for events and boot camps. And so that’s really helped as well. Robert Dutt: You mentioned advanced solutions, and I know that’s been a huge focus area for the last little while. The history of D&H is kind of focused on that smaller VAR, the SMB-focused partner. How do you pursue those opportunities without losing the high-touch accessibility that made D&H so successful with smaller partners in the first place? Peter DiMarco: Yeah, it’s a great question. So the investments we made in sales resources have allowed us to do that. Our customer bases are smaller versus where they’ve been in the past, so our sales reps have more time to spend with partners. The second lever that we pulled is doing even more segmentation in our sales force for partners that focus on mid-market and the higher end of the SMB, separating those from those that focus on the S in the SMB. And the good news for that is every single customer gets a personal sales rep. So just because you’re smaller doesn’t mean you’re going to see a degradation in service. If anything, you’ll see even better service, because smaller partners tend to have the same issues. And you can aggregate them together and come up with a solution to help not just one, but many partners. For example, things like extended financing programs that we think would be really good for many SMB partners. So a lot of focus on segmentation, as well as we’ve added some layers to our sales organization, team leads and other roles that give us greater eyes on how we’re supporting those customers every day. Robert Dutt: Within the sales organization, it sounds like there are sort of separate teams serving the two sides of the house there. How do you think about the opportunity to bring along folks who have been historic D&H partners but are looking upmarket or seeing more opportunities around more sophisticated solutions, that sort of thing? Peter DiMarco: We absolutely love it. And when we look back on what are the things we’re most proud of, it’s helping partners move upmarket. And so by having lots of focus on customers, spending a ton of time with them — you’ve probably heard our Show Up Big initiative, spending a lot more time with partners — we’re really able to dive in with those partners that want to grow. And while every partner will say that they want to grow, us doing the scanning of the partner base, spending a lot of time with them, we’re able to find out those partners that are committed. And committed to us, number one, is the owner committed to investing in advanced technologies? Number two, do they have sales resources and the sales motions to sell into these technologies or acquire new customers? And then number three, do they have the pre-sales and post-sales engineering bench to be able to execute? And so we do a lot of work through our field team, our inside team, our business units, to look at a thousand partners as an example, and then come away with, “Boy, here are the 150 that we think really get it. We have their commitment.” Rob Brown: Yeah, I would layer on that by saying not every SMB reseller has the AI skill set on their bench. They just don’t. I mean, they’re a smaller organization. When you talk about the larger enterprise partners across the country, they have the investment capability to hire talent, or they already have talent on their bench, and they can have those people build their AI practices on their behalf. But in that smaller community, they just don’t have it. That doesn’t mean the answers are not there for them. We’ve created a program called Go Big AI at D&H, and it’s designed to do just that: enable partners who don’t have the AI skill set on their bench, provide them with vendor training, provide them with sales training, provide them with technology training. That’s just what we have in-house. And we also partner with various vendors, all the players in the AI space. They also have their own unique training, their own play cards and their own go-to-market strategies around AI that we can filter through this program and disseminate to the SMB community. So just because you’re an SMB customer doesn’t mean you’re not going to use AI. It’s not exclusive to the enterprise-class reseller or customer. AI is pervasive. It’s going to explode across all segments of the country and customers that use it. So SMB is a big opportunity for us. We grew up in that space, and we’re taking the skills and what we know how to do best, taking a hands-on approach to dealing with some of those smaller partners that just don’t have the skill set themselves. Robert Dutt: We’re here at THREAD, and I’ve had the opportunity, the fortune, of being at this event a few times over the years, back since well before it was known as THREAD. What’s the big message you’re bringing to Canadian partners this year? What should they be paying attention to, whether it’s a technology opportunity, a change in the market, something new from you guys that you’re focused on here today? Rob Brown: This might be a unique perspective, and it might even surprise a few people, but as the world shifts to AI, digital automation is really controlling a lot of your go-to-market strategy. It really controls your sales strategy, how you deal with customers, how you engage with customers. And we have our own digital automation journey that we’re on. We believe in the full utilization of our data and as much automation as we can possibly bring to market. But we strongly believe that platforms transact and people sell. We invest heavily in our people. We’re a people-first organization. Platforms should augment the selling experience, not replace it. So as an industry pivots towards digital automation and utilizing AI to drive workloads and policy and process, we’re on that path as well. Having said that, we’re also doubling down on the human approach to selling AI, and I think that’s a unique differentiator for D&H. Robert Dutt: Has THREAD itself evolved as the D&H business has changed? I can remember in the early days, the message from Greg Tobin, who was leading the business at the time, was that this is an old-fashioned selling show. And I think it’s gotten a little bit added onto that, if anything. How are you thinking about THREAD today, especially as you’ve built the business out and added new things? Peter DiMarco: Yeah, so as a former sales guy, I’d always love to sell more, but I would tell you the event has really transformed from a selling show to enablement, education and opportunity management. So our partners are here today to do a couple of things. Number one, get educated and potentially enabled on solution sets. Number two, advance their overall business by meeting with D&H experts, be it credit, be it marketing, be it our sales team, to help them drive their business to greater levels. And the third thing is to meet with other partners. So through our Partnerfi community, we’ve expanded it from nine members to 50 members over the last year. Many of those Partnerfi members will be here today. And they love the fact that they can engage at events like this and just talk shop, whether it’s solutions around AI or how do I compensate my engineers? How do I fill my bench with capacity? So the event itself has transformed, to your point, from a show to a conference or a summit that’s all about relationships, education and enablement. Robert Dutt: Refresh my memory. How long has Partnerfi been active in the Canadian market? Peter DiMarco: It has been active for four years. Robert Dutt: How have you seen that community evolve, both in terms of scale and the role it plays in the overall Canadian business? Peter DiMarco: Yeah, so I’ll go first, and I’m sure Rob’s got a lot of great input on Partnerfi, as he’s been a key leader in expanding it. So when we initially started out, it was initially just that, just starting out. Let’s get partners on board that like us, number one. And number two, we did a very good job of picking partners that wanted to go on this evolution and help build the next wave of Partnerfi with us. So that was considered wave one. The next wave was working with our board and identifying partners in each province to determine who are the target partners that are growing in their market, that have really great skills, that would be willing to share and interact and network, which is the most important thing as it relates to a community. And then they’re willing to make the time to do that. So through a dedicated recruiting effort, we went on a mission over the last 12 months to come up with a great set of partners. And that’s how we got from nine to 50. Rob Brown: I would add on that we’re not just out there recruiting any partner into the community. We think there’s a formula there. There needs to be balance, geographic balance, representation from Atlantic Canada, Quebec, Ontario, Central Region, West, solution providers, resellers, cloud practice partners, CSP partners and things like that. So a diverse mix of customers is really, really important to us. And we grew, in my tenure here a year later, we’re four times the size of the community. We have aspirations to grow from where we’re at today by adding another 20 by our next summit in the spring. And what I hear from partners is that because we’ve only been four years old, we’re an emerging community and we’re building out our practice, we’re really hyper-focused on the peer-to-peer side of the business, really diving into the collaboration. Some of the other communities in the marketplace are a little bit more mature, have a couple hundred partners in their community, and ours retains its intimacy, strong connections with each other, strong learnings from each other. And we’re going to work hard over the years to hold on to that part of the community. The most value we get, I believe our vendors get, and I can tell you for sure our resellers get from the community, is their ability to sit down with each other, express common challenges, learn from each other, express common opportunities. “I don’t know how to do that. How did you do it?” “Okay, that’s helpful for me. Thank you.” Communities were built on that spirit. And if we let it go, the whole thing kind of dies and fizzles off with it. So in Partnerfi, we’re going to double down on that peer-to-peer connection, and we’re going to make sure our program doesn’t grow so big to the point where it becomes a little bit more cold and vendor-driven. It’s supposed to be a peer-to-peer community, and we’re going to hold onto that. Robert Dutt: You touched a little bit earlier on the way AI is, or the way you’re thinking about AI in terms of the sales effort and that sort of thing. I’m curious how you guys are thinking about AI internally at D&H in terms of how you’re using it, how you see it changing the partner experience with D&H over time. Rob Brown: Yeah, so I mean, I’m a salesperson. I’m the sales guy, right? So I look at everything from a sales lens. This is a tremendous opportunity for technology refresh. If you look at the installed base that most of our vendors have sold through, that technology cannot handle the AI workloads of the future. It just can’t. You’re driving a Honda Civic around a Formula One track. It just doesn’t work. You need to upgrade the car, which means that’s a tremendous opportunity for us to go after. And our role is to help our vendor partners dive into that installed base and help the resellers that service those customers refresh that technology. Anything that is a generation too old, that’s off warranty, and that customer is on an AI journey, it’s our job to help enable the technology refresh inside of that organization. So that’s what I see. I see dollar signs when I look at that. It’s a tremendous opportunity because what I don’t know, I’d love to ask somebody the statistic, but I would imagine the stat would come back: what percentage of customers actually have the technology to support the AI workloads that they’re building? I would imagine 90%-plus can say, “I don’t have that.” So it is an absolute tremendous opportunity. We play a role in the ecosystem to educate many of these SMB partners on how to do that through the vendors that we serve. And that’s one of the roles that we have at D&H. And like I said before, we created a program called Go Big AI to serve just that purpose. Robert Dutt: And Peter, maybe the same question, but from a more operational viewpoint internally at D&H, in terms of how you operate the business, how you interface with partners going forward. How do you see AI shaping that? Peter DiMarco: Yeah, so we’re just beginning on the journey right now. As Rob mentioned, we’re going through a digital transformation initiative here at D&H, which has been a few years in the making. So I think that’s helped. If I look at every core department that supports our customers today, AI is embedded in how we support those customers today. Whether it’s transactionally and making faster decisions, whether it’s in areas like customer support, whether it’s our market-facing resources leveraging Copilot, we’re leveraging it across our warehouse to be more supply chain-efficient. We’re using AI to some extent to provide a better customer experience. And that’s evolving. As I sit here today and I look to the future, I think six months from now we’ll have additional ways of using AI, and then 18 months from now. It’s very much a journey. And for us, what we hear is the best organizations today as it relates to AI are certainly on a journey, taking all the departments through this, versus kind of a big-bang approach. For us, it’s absolutely not a big-bang approach. Robert Dutt: Sort of building on that from both of you, looking ahead into 2027, what should partners expect to see next from your organization? And maybe more importantly than that, what would you like them to be doing a little bit differently with D&H a year from now? Peter DiMarco: So a year from now, we would love for them to come to us ahead of time with their business plans or visions as to where and how they want to grow their business, sharing these plans with us and allowing us to participate where we can to help them support their business. If they don’t necessarily have a planning process like a multibillion-dollar company, we’d love to help them do that, because we do that well as a company. We’ve got plans and KPIs. We’ve got a pretty rigorous process that we use. We would love to teach them and coach them on how to do that. But initially, we’d like a seat at the table to help them grow. That’d be number one. Number two, don’t feel like you have to do it all yourself. Leverage our pre-sales resources, our deployment resources out in the field, our product specialists to help get to the best price, best specification. Use more of us so that you can free up your cycles to focus on your customers. Rob Brown: One piece of advice I’d give the community: if they can afford it, if it’s in their budgets, invest in AI talent. You need to put the skills on your bench to be able to build out your practice and provide that value to your customer base. But in those places, to Peter’s point, with those solution providers that don’t have the capacity to go out and invest heavily in AI talent, and I think we all understand AI talent is not cheap. It’s an expensive resource. Robert Dutt: Neither cheap nor readily accessible. Rob Brown: Both, all of the above, which is why they’re in high demand. And that’s probably why there’s a lot of 20-year-olds out there with six-figure salaries right now, because it is a unique skill set. If you’re one of those partners who do not have that talent on your bench, and if you’re not in a position to invest in it, that’s where we can come in. We can combine the best efforts of D&H and the vendors that we serve and bring the AI practices and play cards that we’ve developed to those partners and through those partners. So that would be number one. Number two, I’m a big advocate of utilizing data. AI is just utilizing data for an outcome, when you think about it. And I think our community can learn that same lesson. The resellers that we serve have a tremendous amount of data on their customers. The vendors have a tremendous amount of data on their customers and the technologies that serve them. And we know which solution providers sell those types of solutions to customers. What we don’t do well, in my opinion, is combine all that data into one go-to-market strategy. So we’re working heavily on that today, and I think you’ll find D&H will take a very data-driven, targeted approach to targeting technologies to solution providers that have the skill set, towards customers that have the need. Robert Dutt: All right. It’s always interesting times, I think, in distribution. And thanks for taking the time to walk me through where you guys are seeing the business and where it’s heading. Peter DiMarco: My pleasure. Thank you. Rob Brown: Appreciate it. Thank you so much. Robert Dutt: There you have it, Peter DiMarco and Rob Brown of D&H Canada on the distributor’s growth, the challenges facing Canadian solution providers and the opportunities ahead. I’d like to thank Peter and Rob for joining us, and thank you for listening. One of the interesting threads, pardon the pun, running through that conversation is how D&H is trying to balance two priorities: expanding into more sophisticated technology opportunities while continuing to offer smaller resellers the kind of personal attention and support that can help them grow their businesses. As Rob pointed out, even challenges like rising prices and uncertain supply can create opportunities for partners that are prepared to help customers find a way forward. If you’re enjoying the podcast, be sure to subscribe wherever you get your podcasts, and please consider leaving a rating or review. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Today’s headlines for Canadian IT solution providers. The Buzz: Auvik automates network operations, Kyndryl expands AWS modernization, and Fortinet secures distributed AI Auvik is extending its network management platform with new automation and vulnerability-monitoring capabilities. Meanwhile, Kyndryl is expanding its modernization work with AWS using agentic AI, and Fortinet and Equinix have validated a new approach to securing distributed enterprise AI environments. Those are the top stories in Monday’s edition of The Buzz from ChannelBuzz.ca. Auvik brings automation and vulnerability monitoring to network operations Waterloo, Ontario-based Auvik has announced the general availability of its Automation Framework and CVE Monitoring Agent, extending its network management capabilities from identifying and troubleshooting problems toward helping IT teams take action. The Automation Framework enables technicians to define and execute jobs across groups of network devices. Administrators can select devices, specify commands and run jobs immediately or on a schedule, reducing the need to make repetitive configuration changes individually. The CVE Monitoring Agent addresses a different operational challenge: determining which network devices may be affected by published vulnerabilities. It automatically matches vulnerability information from sources including the National Vulnerability Database and vendor advisories against devices discovered in customer environments. Both capabilities became generally available November 1. The announcement builds on Auvik’s earlier AI agents for troubleshooting, alert management and command assistance. The company describes the additions as part of its longer-term vision for autonomous IT, with technicians retaining control over automated operations. For MSPs managing large numbers of customer devices, the potential benefit is reduced manual work, more consistent network operations and faster identification of security exposure. Source: Auvik announcement. Kyndryl and AWS bring agentic AI to enterprise modernization Kyndryl has announced an integrated modernization solution combining its Agentic Modernization services-as-software offering with AWS Transform. The companies say the solution is designed to help enterprises assess, plan and execute modernization initiatives involving applications, infrastructure and core technology systems. Kyndryl brings engineering expertise, AI-enabled workflows and reusable automation capabilities, while AWS Transform provides AI-assisted modernization technology. The approach is intended to make modernization a more continuous, repeatable process rather than a succession of individual transformation projects. Kyndryl is positioning services-as-software as a way to automate parts of complex engineering and consulting work, potentially reducing the effort and specialized resources required to modernize legacy environments. The announcement builds on an existing Kyndryl–AWS strategic relationship, including an expanded collaboration announced in June. For enterprise solution providers, the development highlights an emerging shift in the services market: AI is not only creating new customer projects, but increasingly changing how providers deliver existing services. Source: Kyndryl announcement. Fortinet and Equinix validate distributed AI security architecture Fortinet has announced the availability of FortiAIGate within the Equinix Distributed AI Hub, introducing a validated reference architecture for securing AI applications and workloads distributed across multiple environments. As enterprises move AI applications into production, models, agents, data and compute resources may operate across clouds, data centres and edge infrastructure. The Fortinet–Equinix architecture is intended to provide consistent security and governance across those interactions. FortiAIGate can inspect prompts and responses, enforce policies for approved large language model and Model Context Protocol traffic, and help protect sensitive information. The architecture also includes AI consumption monitoring, including token costs, spending limits and alerts, alongside controls designed to support data residency and sovereignty requirements. Fortinet says GPU acceleration can help support security inspection without significantly affecting AI workload performance. The announcement extends the companies’ existing relationship rather than introducing an entirely new Fortinet product. For partners building enterprise AI solutions, it illustrates the growing importance of securing the interactions among models, applications, agents and data sources, in addition to protecting the infrastructure hosting them. Source: Fortinet announcement. In The Channel: D&H Canada’s growth and advanced solutions strategy Later today on In The Channel, D&H Canada general manager Peter DiMarco and vice president of sales Rob Brown discuss the distributor‘s Canadian momentum, the expansion of its advanced solutions business, and how it is helping partners pursue broader opportunities. The conversation was recorded at D&H THREAD in the Toronto area and explores the company’s evolving business, partner investments and growth priorities. Look for the episode at ChannelBuzz.ca and wherever you get your podcasts. Read Full Transcript Hello and welcome to The Buzz from ChannelBuzz.ca. I’m Robert Dutt, and today is Monday, November 9, 2026. Here’s what’s happening in the channel today. Today, Auvik introduces new tools to automate network operations and identify vulnerable devices. Kyndryl and AWS are putting agentic AI to work on enterprise modernization. And Fortinet and Equinix are bringing new security controls to distributed AI environments. Let’s get into it. First up, Waterloo, Ontario-based Auvik is taking another step toward automated network management, with two new capabilities designed to reduce the amount of repetitive work performed by IT teams and managed service providers. The company has made its Automation Framework and CVE Monitoring Agent generally available, building on the AI-powered network management capabilities it introduced earlier this year. Let’s start with the Automation Framework. It allows technicians to create and execute jobs across groups of network devices, rather than making the same changes individually on every switch, router, or other piece of network equipment. An administrator can define the commands to be executed, select the devices involved, and run the job immediately or schedule it for later. For an MSP managing networks across multiple customers, that’s potentially a meaningful reduction in routine manual work, while also helping make configuration changes more consistent. The second new capability is the CVE Monitoring Agent. It automatically checks published vulnerability information against devices in a customer’s network, using sources including the National Vulnerability Database and vendor security advisories. That’s a task that can require a lot of manual effort, particularly when an MSP is managing devices from multiple manufacturers across dozens or hundreds of customer environments. The agent is intended to help technicians identify which devices may be exposed to newly published vulnerabilities and prioritize what needs attention. Both capabilities became generally available November first. And the broader story here is Auvik’s movement toward what it describes as autonomous IT. Earlier this year, the company introduced AI agents that help technicians investigate network problems, interpret alerts, and determine what to do next. Now it’s adding more tools to help carry out network operations, while keeping technicians in control of the process. For MSPs, that distinction matters. Better visibility and faster troubleshooting are useful, but reducing the manual work involved in managing customer networks could have a more direct effect on service delivery costs and technician capacity. Next, Kyndryl is expanding its collaboration with Amazon Web Services to help organizations modernize applications and infrastructure using agentic AI. The companies have announced an integrated solution combining Kyndryl’s Agentic Modernization offering with AWS Transform. The idea is to use AI-powered workflows, automation, and engineering expertise to help organizations assess their existing technology, plan modernization projects, and carry out the work more consistently. And that’s a significant challenge for many enterprises. Legacy applications and infrastructure can be expensive to maintain, difficult to change, and a major obstacle to adopting new technologies. Kyndryl is positioning the new solution as a way to make modernization a more continuous process, rather than a series of large, isolated projects. One of the interesting elements is what Kyndryl calls services-as-software. Essentially, the company is using software-driven automation and reusable AI workflows to perform parts of the work that traditionally required substantial consulting and engineering effort. That doesn’t eliminate the need for specialized expertise, but it could change how that expertise is applied and how modernization projects are delivered. The announcement builds on an existing relationship between Kyndryl and AWS, including an expanded strategic collaboration announced earlier this year. And it points to an interesting development for the services business. AI isn’t just creating new technologies for solution providers to sell, implement, and manage. It’s also beginning to change how providers deliver some of their existing services, particularly complex work like application modernization, cloud migration, and infrastructure transformation. Whether those approaches deliver the efficiency gains vendors are promising will depend on how they perform in real customer environments. But the direction is certainly worth watching. And finally today, Fortinet and Equinix are working together to help enterprises secure AI environments that increasingly span multiple clouds, data centres, and other infrastructure. Fortinet has announced the availability of FortiAIGate within the Equinix Distributed AI Hub, through a new validated reference architecture. And the challenge they’re addressing is becoming more complicated as organizations move beyond isolated AI experiments. An enterprise AI application might involve a model running in one environment, business data stored somewhere else, and agents interacting with multiple systems across different clouds or data centres. That creates security and governance questions that go beyond traditional network protection. FortiAIGate is designed to inspect AI prompts and responses, enforce security policies for approved AI traffic, and provide visibility into how models and agents are being used. It also includes controls for monitoring AI consumption costs, including token usage, spending limits, and alerts. And the architecture is designed to support data residency and sovereignty requirements by keeping security inspection and control within customer infrastructure. Fortinet also highlights GPU acceleration as a way to maintain performance as AI security inspection scales. Now, this isn’t an entirely new Fortinet product, and Fortinet and Equinix already have an established relationship. The announcement is about validating how FortiAIGate can operate within Equinix’s distributed AI infrastructure. But for partners involved in enterprise AI projects, it illustrates an emerging opportunity. Securing AI isn’t just about protecting the servers, networks, and cloud environments where it runs. It’s increasingly about governing the interactions between models, applications, agents, and the data they use. And as enterprise AI deployments become more distributed, those security requirements are likely to become an increasingly important part of the overall solution. You’ll find more details on all three stories at ChannelBuzz.ca. And before we wrap up, a quick note on In The Channel. Later today on In The Channel, we’ll have my conversation with Peter DiMarco, general manager of D&H Canada, and Rob Brown, the distributor’s vice president of sales. Recorded at D&H THREAD in the Toronto area last week, we discussed the company’s strong growth in Canada, the increasing importance of advanced solutions to its business, and how D&H is investing to help partners pursue broader opportunities. That’s coming up later today at ChannelBuzz.ca, and wherever you get your podcasts. That’s how we’re seeing the headlines today. I’m Robert Dutt. Thanks for listening, and have a great day.

Today’s headlines for Canadian IT solution providers. D&H Canada reports 47% growth, expands advanced solutions strategy D&H Canada says its business has grown 47% over the past two years, as the distributor looks to help partners build broader solutions around the hardware they sell. Speaking at the company’s THREAD Technology Roadshow in the Toronto area Thursday, D&H Canada general manager Peter DiMarco highlighted strong performance across its Canadian business, particularly in advanced solutions. That business is up 49% in revenue year to date, including 150% growth in servers and storage and 86% growth in networking. D&H also reported adding 262 advanced solutions customers. Perhaps the most significant indication of the distributor’s evolving business is the change in its revenue mix. Advanced solutions now account for 28% of D&H’s business, compared with just 5% in 2019. D&H’s PartnerFi community has also expanded from nine members to 50, as the distributor continues investing in partner engagement, technical expertise and Canadian operations. But beyond the growth figures, the central theme of the event was the increasing complexity of technology opportunities. Colin Blair, D&H’s vice president of cybersecurity and emerging technologies, argued that AI is bringing compute, data, networking, security and infrastructure decisions closer together. As a result, partners have opportunities to deliver more complete solutions rather than focus solely on individual products. D&H is developing practices around VMware alternatives, power and cooling, data resilience and AI, providing partners with additional expertise to pursue opportunities they might not be equipped to address independently. On a vendor panel featuring HP Canada, Dell Canada and Lenovo Canada, executives also discussed continuing pricing uncertainty. HP Canada’s April Marshall advised partners to prepare for volatility through 2027 and potentially beyond, emphasizing flexible agreements and transparent customer conversations. The message from THREAD was that hardware remains central to the channel, but the opportunity increasingly lies in the services and solutions that surround it. Federal budget proposes new support for technology commercialization and business investment The federal government is proposing new incentives to help Canadian businesses commercialize innovations, attract investment and scale domestically. Finance Minister François-Philippe Champagne presented Budget 2026 Thursday, including a $930-million expansion over five years of the Scientific Research and Experimental Development tax incentive program, commonly known as SR&ED. The proposed expansion would extend eligibility to certain commercialization expenses, including regulatory approvals, certifications and intellectual-property protection. The change is intended to help address a familiar challenge for Canadian technology businesses: moving beyond research and development to bring commercial products to market. The budget also introduces the Canada Growth Incentive, which includes a proposed tax exemption on up to $15 million in capital gains from eligible investments in qualifying Canadian companies, alongside an enhanced small-business investment rollover. The measures are designed to encourage more private investment in growing Canadian businesses. There’s also a direct public-sector IT component. Budget 2026 proposes approximately $1 billion over five years for a Government Transformation Fund, intended to accelerate federal IT modernization projects and improve public service delivery. The fund is connected to Digital Transformation Canada, which is tasked with expanding the use of AI and other emerging technologies across federal government operations. While the investment could ultimately create opportunities for technology suppliers and service providers, details of procurement opportunities remain to be determined. Together, the new measures put renewed emphasis on helping Canadian businesses turn innovation into commercial success, while modernizing the federal government’s own technology infrastructure. Huntress expands agentic security platform with new automated protections Huntress has announced new capabilities across its Agentic Security Platform, extending its approach to using intelligence from real-world attacks to protect customers across its broader installed base. The company says its platform provides visibility across nearly 300,000 businesses, 17 million identities and six million endpoints. One of the most significant additions is Adversary Infrastructure, part of Huntress Managed Identity Threat Detection and Response. When Huntress confirms infrastructure associated with an identity attack, the capability can translate those findings into blocking policies across eligible, opted-in Microsoft 365 customer environments. That allows intelligence gained from one incident to help protect other organizations. Additional identity security capabilities include detection and automatic shutdown of malicious service principals and Lookback, which examines up to 180 days of historical Microsoft 365 sign-in activity when new customers are onboarded. Huntress is also introducing Brute Force Sentry for its managed SIEM offering, designed to identify brute-force attacks across systems including Windows Remote Desktop and Linux SSH. General availability is scheduled for November 18. A new remote ransomware disruption capability, scheduled for general availability November 30, is intended to stop attacks originating from unprotected systems before they spread across a network. The company is also expanding security awareness training with contextual exercises informed by attacks identified by its security operations centre. For MSPs, the broader goal is to translate threat intelligence gathered across Huntress’s customer base into faster, more automated protection, reducing the manual effort required to respond to emerging threats. Read Full Transcript Hello and welcome to The Buzz from ChannelBuzz.ca. I’m Robert Dutt, and today is Friday, November 6, 2026. Today, D&H Canada is reporting strong growth and looking to expand the opportunities available to its partners. The federal budget puts new emphasis on helping Canadian companies commercialize their innovations and attract investment. And Huntress rolls out a broad set of new capabilities across its security platform. Let’s get into it. First up, D&H Canada says its business has grown 47 per cent over the past two years, and the distributor sees a significant opportunity to help partners build more complete solutions around the products they sell. At the company’s THREAD Technology Roadshow in the Toronto area yesterday, D&H Canada general manager Peter DiMarco highlighted strong performance across a number of its business segments. Its advanced solutions business is up 49 per cent in revenue year to date, including 150 per cent growth in servers and storage, and 86 per cent in networking. The distributor also reported adding 262 advanced solutions customers. And perhaps the most interesting number is how much its business mix has changed: advanced solutions now account for 28 per cent of D&H’s business, compared with just five per cent back in 2019. DiMarco also said D&H’s PartnerFi community has expanded from nine members to 50, and outlined continued investments in partner engagement, technical resources, and its Canadian configuration operations. But the bigger story was where D&H thinks the channel opportunity is heading. Colin Blair, D&H’s vice president of cybersecurity and emerging technologies, argued that AI is changing several technology markets simultaneously, bringing compute, data, networking, security, and infrastructure decisions much closer together. His argument is that when a partner sells a server or another piece of hardware, the opportunity increasingly extends into the services, security, data management, networking, and other capabilities needed to make that technology useful. As Blair put it, the product remains essential, but the opportunity forming around it gets larger. To help partners pursue that opportunity, D&H is developing practices around areas including VMware alternatives, power and cooling, data resilience, and AI practice-building. And Blair cautioned partners against trying to become experts in everything themselves. Instead, he encouraged them to lean on distributors, vendors, and other partners for capabilities outside their existing expertise. There was also a practical warning from a vendor panel featuring HP Canada, Dell Canada, and Lenovo Canada. HP Canada’s April Marshall said partners should prepare for continued pricing volatility through 2027 and potentially beyond, and stressed the importance of flexibility in longer-term customer agreements. So there’s a bit of a balancing act here: D&H sees growing opportunities to deliver more sophisticated solutions, even as partners face pricing pressure, skills shortages, and customers who are still figuring out their AI strategies. We’ll have more from THREAD in upcoming episodes of In The Channel, including conversations recorded with D&H executives yesterday. Next, the federal government is putting new incentives for investment and commercialization at the centre of its economic agenda. Finance Minister François-Philippe Champagne presented Budget 2026 yesterday, with several measures aimed at helping Canadian businesses turn research into commercial products, attract investment, and grow. One of the headline proposals is a 930-million-dollar expansion of the Scientific Research and Experimental Development tax incentive program. Commonly known as SR and ED, the program has traditionally supported eligible research and experimental development activities. The budget proposes extending support to certain commercialization expenses, including costs associated with regulatory approvals, certifications, and protecting intellectual property. That’s potentially significant for Canadian technology companies, because developing a promising technology is only part of the challenge. Turning that technology into a product, getting it into the market, and building a sustainable business around it can be just as difficult. The government also introduced what it calls the Canada Growth Incentive, which includes a proposed tax exemption on up to 15 million dollars in eligible capital gains from investments in qualifying Canadian companies. There’s also an enhanced small-business investment rollover intended to encourage entrepreneurs and investors to reinvest in Canadian businesses. In other words, Ottawa is trying to improve the economics of building and financing growing companies in Canada. And there’s a more direct IT angle. The budget proposes approximately one billion dollars over five years for a Government Transformation Fund, designed to accelerate federal IT modernization projects and improve public services. That work is tied to Digital Transformation Canada, the government’s initiative to bring together digital expertise and expand the use of AI and other emerging technologies across federal departments. It’s too early to say how much of that spending will become opportunities for outside solution providers, but it’s certainly a development worth watching for companies serving the public sector. And while the budget also discusses Canada’s broader AI strategy and incentives for business technology purchases, some of those measures were announced previously. The key new developments here are the additional commercialization support, the investment incentives, and the proposed federal IT modernization funding. For the Canadian technology sector, the central question will be whether those measures help more companies move beyond developing innovative technology to building successful businesses around it. And finally today, Huntress has announced a series of new capabilities across its Agentic Security Platform, designed to turn intelligence gathered from real-world attacks into broader protections for customers and MSPs. The company says its platform now provides visibility across nearly 300 thousand businesses, 17 million identities, and six million endpoints. And Huntress wants to use that scale to its advantage. The underlying idea is that when its security operations centre identifies a new attacker technique or piece of malicious infrastructure targeting one customer, those findings can be used to strengthen protection for other customers before they’re attacked. One example is a new capability called Adversary Infrastructure, part of Huntress Managed Identity Threat Detection and Response. When Huntress confirms infrastructure being used in identity attacks, it can turn that intelligence into blocking policies across eligible Microsoft 365 customer environments that have opted in. Other new identity security capabilities include detection and automatic shutdown of malicious service principals, as well as Lookback, which examines up to 180 days of Microsoft 365 sign-in history when a new customer comes on board. That means Huntress can potentially uncover evidence of an existing compromise rather than only begin monitoring for new threats from the day the service is deployed. Huntress is also expanding its managed SIEM and endpoint security capabilities. Brute Force Sentry, scheduled for general availability November 18, is designed to identify brute-force activity across systems including Windows Remote Desktop and Linux SSH. And a remote ransomware disruption capability, scheduled for general availability November 30, is intended to stop attacks that originate from unprotected systems and attempt to spread across a network. There are also updates to security awareness training, including short, contextual exercises that can be triggered by actual security incidents. The broader direction is toward taking what Huntress learns from defending individual organizations and putting that intelligence to work across its entire customer base. For MSPs, the appeal is straightforward: faster detection, more automated protection, and less need to manually respond to every emerging threat across every customer environment. Of course, the new capabilities have different availability dates, and the effectiveness of the broader approach will ultimately depend on how well those automated protections perform in practice. But it represents a meaningful expansion of Huntress’s managed security offering. You’ll find more details on all three stories at ChannelBuzz.ca. And before we wrap up, a quick note on In The Channel. And if you haven’t heard it yet, yesterday’s episode featured my conversation with Christian Goffi, Nutanix’s channel chief for the Americas, on changes to its Elevate partner program. We talked about how Nutanix is evolving its approach to partners, and why the company wants them to build more profitable businesses beyond the initial infrastructure sale. That episode is available now at ChannelBuzz.ca, and wherever you get your podcasts. That’s how we’re seeing the headlines. I’m Robert Dutt. Thanks for listening, and have a great weekend.