Jon Alba spoke with Paul Spencer, channel chief for T-Mobile, and Howard Holton, COO of GigaOm, about how connected laptops are emerging as a major solution for these cybersecurity threats. They also dive into how T-Mobile's T-SIMsecure SASE solution is separating itself from others in a crowded market.

You can find out more about partnering with T-Mobile here.

CRNtv host Sydney Neely speaks with Chester Wisniewski from Sophos about how AI is evolving and what it means for businesses and partners today.

The Evolution of AI in Cybersecurity: Sophos’ Leadership in AI

Sydney: Compared to competitors just now jumping on the AI bandwagon, how does Sophos’ long history with AI give security teams an advantage?

Chester: Sophos benefits from an integrated approach, combining data scientists, engineering teams, and managed detection and response (MDR) services. This allows us to quickly test and implement AI-driven solutions without experimenting on customers. Our AI teams work closely with product teams and analysts, giving us the ability to adapt and improve faster. This integrated structure allows us to identify issues, test fixes internally, and deliver proven solutions to customers more efficiently.

AI-Powered Incident Response: The Next Evolution

Sydney: For MSPs and partners, automation is a huge advantage. How does AI help them scale security without needing massive resources?

Chester: AI allows us to automate routine tasks and identify outliers in large data sets faster. For example, Sophos processes 3 million malware samples daily. AI helps analysts quickly identify new threats by filtering out known issues, enabling faster response. MSPs can use AI to automate repetitive tasks, improve threat detection, and reduce response times—critical advantages when time is the enemy during an attack. AI-driven automation enhances efficiency and gives security teams the speed they need to protect customer environments.

The Reality of AI-Generated Threats: What’s Hype vs. What’s Real?

Sydney: How is Sophos ensuring that security teams stay ahead of potential AI-generated threats?

Chester: Sophos’ deep expertise in AI and cybersecurity gives us an edge in identifying and responding to emerging threats. Not every company can maintain a dedicated data science team, but Sophos provides that expertise at scale. We also help customers separate hype from reality by focusing on real-world risks. Peer networks and reliable partners are critical—staying connected with other security leaders helps businesses adapt and strengthen their defenses more effectively.

For more information about how Sophos is leveraging AI to power cybersecurity solutions, visit Sophos.com.

To break down these challenges and provide actionable insights, Andrew Mundell, senior product marketing manager at Sophos, joins CRNtv’s Sydney Neely to discuss the biggest cyber threats MSPs face and how they can improve their security posture.

Why Are MSPs Prime Targets for Cyberattacks?

Sydney: We know that MSPs are seen as one of the biggest cyber risks—not just for their clients but for themselves. In your view, what’s making MSPs such big targets for cybercriminals?

Andrew: Unfortunately, attackers love MSPs. Many people are familiar with supply chain attacks, where attackers compromise a third-party provider to access its customers. MSPs are an ideal target for these attacks because they often have high-level administrative privileges across multiple organizations.

If an attacker breaches an MSP, they don’t just gain access to one organization—they gain a master key that allows them to infiltrate multiple businesses at once. And unfortunately, we’ve seen a significant increase in these complex, targeted attacks against MSPs. Our most recent threat report showed that MSPs are now a primary focus for attackers, making it even more critical for them to strengthen their defenses.

The Growing Cybersecurity Skills Gap

Sydney: The shortage of cybersecurity expertise has been a major issue. Why is this such a big challenge for MSPs?

Andrew: We’re seeing this across the board. Over 70 percent of organizations report that they can’t find the right security staff. MSPs, in particular, like to run lean, which makes hiring, training and retaining a full-scale 24/7 security team an expensive and time-consuming challenge.

A lot of MSPs have a great mix of business and technical expertise, but cybersecurity is highly specialized. Without the right personnel in place, they can really struggle to keep up with emerging threats, and that puts both them and their customers at risk.

How Attackers Are Stealing Credentials

Sydney: Stolen credentials are a major issue. How are attackers getting their hands on this data, and why is it so effective?

Andrew: I hate to sound like a broken record, Sydney, but it all comes back to phishing. Attackers are constantly trying to socially engineer users into giving up their credentials. And with generative AI tools, the days of poorly written phishing emails are fading fast.

We’re now seeing AI-generated phishing attacks that are incredibly convincing and highly effective. Attackers also brute-force weak passwords or exploit known vulnerabilities in software to steal credentials. Many of these credentials end up for sale on the dark web, where initial access brokers make a business out of selling login information to other cybercriminals.

So, like you said in the opener, that means attackers aren’t breaking in—they’re logging in as if they belong.

How MSPs Can Strengthen Their Cyber Defenses

Sydney: MSPs face unique security risks. What are some of the biggest vulnerabilities they share with their clients?

Andrew: The number one concern is ransomware. More than 60 percent of organizations consider ransomware their biggest cyber threat, and for good reason. What’s even more alarming is that less than half of the data is successfully recovered when organizations pay the ransom. That means even those who choose to pay often struggle to fully restore their systems.

Another growing concern for MSPs is insider threats—whether accidental or intentional. Misconfigurations are a major issue, and one small mistake at the MSP level can expose every single client. We’ve also seen cases where attackers infiltrate organizations by gaining the confidence of employees, turning them into unwitting threats.

For more information on how Sophos can help MSPs strengthen their defenses, visit Sophos.com.

Joe: I've been with Sophos for quite some time. This coming February is going to be my 10-year anniversary with the company. I've been in the cybersecurity industry for longer than we've been calling it the cybersecurity industry for over 30 years. My focus in my new role at Sophos is to crystallize and clarify our mission. And that is just unambiguously stating and demonstrating our loyalty to the channel and doubling down on our focus on what I think is the most important segment of the market when it comes to cybersecurity service. That is the mid-market and the small to medium business space.

The reason why I think this is so important is because if you look at the composition of the very crowded and very competitive cybersecurity industry, the vast majority of vendors that are out there today are going after the enterprise and they're effectively leaving this segment of the market, which has a massive surface area relatively unaddressed. 

What are the biggest challenges your partners face and how are you addressing them? 

Joe: I think as an industry, one of the biggest set of challenges that we face today is the competition for talent. I often describe this as the cybersecurity skills gap and it manifests itself in a variety of ways. It’s competition for talent and market, which is always driving up prices for talent. And unfortunately, we're not addressing the scarcity as quickly as we need to. It's just not happening fast enough. We need to come up with better solutions to this scarcity problem that we have.

One of the ways that we can do this is through the hybridization of products and services. And this was one of the philosophical drivers behind our decision to get into the services business about five or six years ago. It was the recognition that the trend or the mode within the industry of just creating these good technologies and then hoping that our customers are going to be able to produce good outcomes with those technologies wasn't serving us sufficiently because of the skills gap. 

We have one of the most robust channels in the cybersecurity space. I think it's kind of our killer app or one of our main differentiators as a cybersecurity vendor. Many of our partners are doing this on their own today and they continue to do it very successfully with our technology. What we've done is we've unlocked the ability for our MSPs in particular to build these kinds of service-oriented relationships with customers because now they have the ability to combine the offering of the service on their own, which they could scale only to a certain level because of the constraints of staffing. Then, they can augment that by also selling our service. I think it's a really good combination. And I think it unlocks a lot of opportunity for our MSPs and ultimately it allows us to better service our customers. 

How can MSPs have a productive role in closing the gap between the under protected and the protected?

Joe: I think that the MSP population within the broader channel that serves IT and cybersecurity was probably the first to get this and the first to begin to embed this into their business models and their business practices. We need an ability to scale the reach that we have as an industry.

If you just think about the surface area in the United States, if you go to the small business administration side, they share some statistics. Over 99 percent of the businesses in the United States are categorically small business, meaning that they have fewer than 500 employees. There's over 33 million of them in the U.S. alone. And then, globally, if you look at it, it's a number that is probably approaching the hundreds of millions if you get the complete count of small organizations that are out there.

There is no way that a vendor by themselves, even a collection of all of the vendors in the cybersecurity space and their estimations of somewhere between 6,000 and 7,000 cybersecurity vendors today, they're never going to have the capacity, they're never going to have the reach to be able to address the needs of 30, 50 million small businesses and organizations that are out there today. The only way that we can successfully scale is through relationships with a global MSP network. And what we need to do as a vendor is we need to ensure that we're equipping MSPs to be as successful, as efficient, and as profitable in their ability to reach all of these customers. This is exactly what we're focusing on doing. 

For more information, go to Sophos.com.

Chris: The biggest challenges faced were shifting client conversations from price-based to value and solution-based discussions. Clients often focus on costs, but selling a security-first approach requires emphasizing the value MSPs provide. Partnering with Sophos benefited the business significantly, especially through their partner program, which offered tremendous support and valuable marketing materials. These resources helped educate clients and align goals between the MSP and Sophos. Sophos' synchronized security was a major factor in choosing their solutions. SyncSec allowed for a holistic view of clients' networks by integrating various products seamlessly, reducing work and eliminating blind spots.

Implementing Sophos MDR services was crucial for the MSP's security-first approach. It allowed the MSP to outsource their security team to Sophos, ensuring 24/7 coverage and enabling the MSP to focus on core business activities.

What impact did implementing Sophos MDR services have on your business?

Chris: Sophos’ MDR services became the core of my MSP security offering, allowing me to access telemetry from firewalls and endpoints. This enabled us to focus on our core business activities while Sophos handled the technology. Outsourcing my security team to Sophos provided 24/7 coverage, reducing costs and pressure. This partnership allowed me to grow successfully, with Sophos’ expertise ensuring comprehensive security and peace of mind.

How does Sophos MDR help MSPs easily hunt down threats? 

Scott: Sophos MDR helps MSPs hunt down threats by leveraging Sophos XOps, which combines expertise from various groups within the company, including Sophos Labs, managed threat response and AI-driven deep learning. This integration provides unparalleled insight into threats and enables a 24/7 active threat hunting team to monitor and respond to alerts in real time.

Sophos XOps can also integrate telemetry data from non-Sophos systems, expanding the view of the threat landscape. The Sophos product portfolio includes endpoint protection, XDR, MDR, NDR for IoT devices, ZTNA, the Sophos XGS firewall, switches, wireless access points and email security. This comprehensive suite ensures robust defense and better outcomes for customers.

Why is Sophos MDR the ideal solution for MSPs looking to enhance their security offerings? 

Scott: MSPs should focus on growing their business and increasing profitability, recognizing that security is a zero-sum game where hackers only need to succeed once, but MSPs must be vigilant constantly. They must deploy and implement protective products and services, even if clients resist due to cost. MSPs face tough decisions and potential liability if clients refuse necessary security measures. Working with vendors like Sophos, which offers breach warranty protection and is dedicated to MSP success, is crucial for a win-win outcome.

Discover how Sophos can enhance your security offering at Sophos.com/msp

Watch the episode on YouTube

Watch more CRNtv

Read the latest at CRN