Your Biggest Cybersecurity Risk May Be Accounting

Imagine calling your bank and genuinely not knowing if you're speaking to a human or a machine. That unsettling moment captures exactly why this conversation about three decades of technology evolution is worth your time.Noah Landow from Macktez(a company that spent years resisting the "MSP" label) joins Chris Johnson to unpack how fundamentally the tech landscape has shifted since the 1990s. Broadly speaking, the conversation covers a lot of ground, moving from Norton Utilities defragging sessions to cloud synchronization and zero-trust identity frameworks. The journey covers decades of change, decades of watching complexity get quietly abstracted away from everyday users.What does it actually mean to treat your employees as security partners rather than security risks? Noah and Chris dig into that question thoughtfully, pointing out that most serious breaches they've seen came from simple phishing, not elaborate hacks.They also touch on Noah's book, "Tame the Tech Beast," and AI agents being assigned credentials like freelancers (with minimal access by design).

Surprisingly, most organizations are trying to govern AI agents before they even know what they have. In a conversation between Chris Johnson and Ed Baker from Netwrix, this critical blind spot takes center stage. As conference presenter Minty pointed out, visibility, ownership, and monitoring must come before governance, not after.What does it really mean to understand how your clients use AI? The answer might involve interviewing nurses, vets, and paralegals to uncover real-world usage patterns, because the gap between assumed and actual AI behavior is where risk lives.Ninety percent of MSPs now use AI, yet most focus narrowly on internal efficiency rather than comprehensive security. Ed warns about the "confused deputy" problem, where employees unknowingly spread incorrect AI-generated information and create organizational chaos. That chaos, that organizational confusion, can spiral quickly without proper guardrails.Ultimately, adding layers of tools without understanding their configurations can paradoxically worsen your security posture. If you work in managed services or security, this episode offers genuinely practical thinking you can act on.

Imagine your organization deploying thousands of digital workers that can cross every boundary your security team built, all at once, without any malicious intent. That is the reality Neelima Rustagi from Metano.ai describes in this conversation with host Chris Johnson on MSP 1337.Neelima brings twenty years of endpoint engineering experience to a genuinely unsettling argument: AI agents act like digital humans, crossing identity, endpoint, and network stacks simultaneously in a single action. Traditional security tools were built in silos, designed to work separately rather than together, and they simply cannot keep up. The "double whammy" she describes is striking because organizations now face external attacks and internal agent manipulation at the same time.(And yes, she actually compares agent-based prompt attacks to internal DDoS scenarios, which is worth sitting with for a moment.)Historically, monitoring human activity was already hard enough. Now consider managing hundreds or thousands of AI agents instead of traditional service accounts. How do you maintain visibility when legacy safeguards were never designed for this?Neelima and Chris make a compelling case for platform-based security that consolidates fifteen separate product integrations into a unified approach. Tune in to hear why proactive identity management for AI cannot wait.

AI agents are quickly becoming part of everyday business operations, but many organizations are deploying them without the governance controls they need for human employees. In this episode, Brian Kelly, Founder of Automated Edge, explores the risks of giving AI broad access to business systems, data, and credentials without adequate oversight.With more than two decades in the MSP space, Brian explains why unrestricted AI access creates security, privacy, and accountability challenges most organizations still haven't addressed. The conversation examines practical approaches to AI governance, including private AI environments, orchestration layers, permission boundaries, and skills-based access controls that keep business intelligence under organizational control.If you're helping businesses adopt AI, this discussion offers a timely look at how to balance innovation with governance, security, and trust.Brian built a free, no-strings-attached resource. It's a go-to-market playbook generator for MSPs. You answer a few questions about your business, it does some research, and it hands you a ready-made plan you can drop into an AI assistant to start finding clients: who to target, what to say, and a daily routine to keep it going. No catch, no paywall.Where to find Brian Kelly:Automated Edge: https://automatededge.aiAutomated Edge on LinkedIn: https://www.linkedin.com/company/automatededgeMe on LinkedIn: https://www.linkedin.com/in/bkellyit/

In this episode, Chris Johnson and Baxter Lanius of Alternative Payments explore the overlooked connection between payment security, PCI compliance, and financial resilience. Many ITSPs unknowingly increase their risk by storing payment information internally, creating compliance challenges and expanding their attack surface.The discussion highlights how modern payment platforms can reduce risk, why billing discipline directly impacts profitability, and which financial controls can help protect business operations when accounts or credentials are compromised. Topics include ACH debit blockers, account segmentation, approval workflows, and other safeguards designed to protect both cash flow and client trust.Whether you're focused on compliance, operations, or business growth, this episode offers practical guidance on securing one of your organization's most important assets: how you get paid.

Why Threat Actors might love your security stack... Surprisingly, the most dangerous thing in your organization might be the security tools you're paying for but never configured. Chris Johnson and Zach Kromkowski revealed at CornCon26 that one organization purchased a tool and left it completely unimplemented for two years, creating a false sense of security while attackers exploited the gaps.The core insight here is uncomfortable but important: most cybersecurity breaches stem from foundational failures that have existed for decades, not from sophisticated new attacks. Organizations keep chasing shiny new tools instead of mastering what they already own, spending money without solving actual problems. (It turns out "shiny object syndrome" is a real and costly habit in security teams.)Buying tools without clear objectives doesn't just waste money; it actively expands your attack surface. Chris and Zach point out that even integrating platforms introduces new risks, especially when teams disable security rules to keep things running smoothly.What does good governance actually look like under real pressure?From realistic incident response tabletop exercises to weekly documentation reviews with a team of 15, Zach and Chris lay out a practical roadmap to move from reactive breach response to genuine operational maturity.

AI adoption is moving fast, but governance is struggling to keep up. In this episode, Chris sits down with Ignacio Lopez, founder of Work-Smart.AI and Fractional Head of AI, to discuss how MSPs can help clients move from AI experimentation to secure, scalable adoption.Drawing on his experience in auditing, risk management, and enterprise technology, Ignacio explains why governance must come before tools. They explore AI policies, connector risks, access controls, model governance, data foundations, token economics, and the growing threat of shadow AI.Ignacio shares a practical roadmap for MSPs to evolve from tool resellers to trusted AI advisors by leading assessments, enforcing guardrails, managing deployments, controlling costs, and building governance programs that withstand security, compliance, and business scrutiny.If you're looking to help clients adopt AI safely and effectively, this episode offers a clear blueprint for turning AI from a shiny tool into a business capability.

Special Host: Adam Anderson from Threat Captain. What does success look like in an industry where technology changes faster than anyone can predict? In this episode of MSP1337, Chris Johnson (GTIA) and Charles Love (Showtech Solutions) join Adam Anderson from Threat Captain for a wide-ranging conversation on cybersecurity maturity, business growth, client communication, and preparing for an AI-driven future.The discussion challenges the idea that MSPs need to be perfect before making progress. Instead, the panel explores why cybersecurity maturity is a journey, how trust is built through clear communication rather than technical jargon, and why the most successful IT professionals learn to speak both technology and business.Along the way, they dive into behavioral economics, the psychology of decision-making, the realities of technology sales, and the traits that separate great MSP professionals from great technicians. The conversation concludes with practical career advice for students, recent graduates, and anyone navigating a rapidly changing job market shaped by AI and automation.Whether you're an MSP owner, cybersecurity leader, technician, or someone planning the next stage of your career, this episode offers valuable insights on balancing ambition with adaptability, embracing continuous improvement, and building a future that isn't dependent on today's technology trends.Key Takeaway: Cybersecurity, business, and careers all follow the same principle: maturity matters more than perfection.

In this episode of MSP 1337, Chris sits down with Dr. Stephen Wright of Macadamia Solutions, a rare expert whose career spans technology, law, and business. Together they explore why governance has become the defining challenge of the AI era and why many organizations remain dangerously unprepared.The conversation examines how regulatory requirements, cybersecurity obligations, and emerging AI risks are reshaping boardroom accountability. Dr. Wright breaks down the growing threat of deepfakes, data poisoning, and data suppression, explaining how attackers increasingly target data integrity and the people who make decisions based on it, rather than traditional IT systems alone. The discussion also explores the unintended consequences of technology legislation, regulatory capture, supply chain risk, remote work security, and the persistent governance challenges that prevent organizations from achieving true cybersecurity maturity.For MSPs, IT leaders, and business executives, this episode provides a practical look at the intersection of governance, risk, security, and compliance, and why effective governance may be the single most important capability organizations need to navigate the future of AI.

Every vendor has an AI roadmap. Every client has employees experimenting with AI. And increasingly, MSPs are building their own AI solutions. The challenge is that few organizations fully understand the risks that accompany this rapid adoption.In this episode of MSP 1337, Chris Johnson and Jim Harryman discuss what responsible AI deployment actually looks like. They explore AI governance, vendor accountability, security testing, client readiness, and the dangers of allowing AI unrestricted access to sensitive information. Rather than treating AI as a shortcut, they argue for a disciplined approach that prioritizes transparency, validation, and human oversight.For MSPs trying to separate opportunity from hype, this conversation offers practical insights on asking better questions, managing emerging risks, and building a foundation for sustainable AI adoption."The biggest AI risk isn't the technology. It's deploying it before governance catches up."