SMB Community Podcast: Business Advice for Small MSP Owners

The conversation focused on emerging vulnerabilities and operational challenges tied to artificial intelligence (AI) and cybersecurity, with the Binance hack—resulting in a reported $6.4 billion loss—presented as the episode’s most consequential event. Binance leadership stated that users would not incur losses, as the company intends to recover the stolen funds from its own reserves. This incident draws attention to the scale of risk even large organizations face and underscores new attack vectors enabled by AI-powered threat actors.
A key theme that emerged was the evolving nature of attacks due to AI’s capacity to chain vulnerabilities together in innovative ways, outpacing human defenders. The discussion explored how these developments can render traditional patching strategies insufficient, especially for small and midsize businesses (SMBs) that lack the financial resilience of enterprises such as Binance. Small businesses, according to the discussion, are now viable mass targets because AI can automate exploitation processes, allowing attackers to monetize each breach efficiently.
Several points were raised, including the strategic shift by platforms like Reddit to restrict open content access in response to both search market changes and AI-driven data aggregation, as well as the first instance of an employee in the United States—citing humanism as a recognized religion—receiving a religious exemption from mandatory AI use at work. Additionally, the conversation highlighted Anthropic’s $100 million investment to train 10,000 engineers at select Fortune 100 companies, a development that may influence competitive landscapes for MSPs and IT service providers.
The discussion emphasized the need for MSPs and IT service providers to formalize budgeting and planning for 2027, invest in structured AI training for staff, and address evolving risks, particularly those introduced by custom AI tools and emerging social engineering vectors. Establishing clear policies, conducting risk assessments, and mandating continuous skills development were identified as necessary steps for organizations seeking to maintain operational resilience and reduce harm in an increasingly complex digital environment.

Preparing for 2027: AI, Security, and the MSP Landscape
Show Rundown & BanterPreparing for 2027: business planning, AI, and cybersecurity.

Question of the Week: What Should I Be Doing to Prepare for 2027?Set goals, create a budget, and start planning for the year ahead.

Topic: Reddit Goes Into Self-Preservation ModeReddit introduces login requirements and optional Incognito mode as it responds to declining search revenue and AI's use of its content. What does this mean for the open internet?

Topic: Binance Suffers a Record-Breaking BreachA reported $6.4 billion loss raises serious questions about crypto security and whether AI-powered vulnerability discovery could make future attacks more dangerous.

Topic: Religious Exemption From AI Use at Work
A University of Kentucky professor receives an exemption from workplace AI use based on Humanist beliefs and the importance of human presence and personal responsibility.
https://oeo.uky.edu/

Topic: Anthropic Invests $100 Million in AI TrainingAnthropic plans to train 10,000 engineers at Fortune 100 companies to help them identify and develop AI opportunities. How can MSPs keep up?

Tales from the Field: A Hack Attempted Through ChatGPTA malicious custom GPT displayed a fake OpenAI security warning and verification link. What happened, and how can organizations protect themselves?

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Employee departures and the risk of client solicitation by ex-staff emerged as the episode’s principal issue. Multiple instances were described where former employees attempted to take clients with them, resulting in legal disputes and operational stress for MSPs. To mitigate this risk, contractual safeguards such as non-disclosure and non-solicitation clauses in employment agreements were identified as standard practices. The discussion emphasized the limitations of these measures, especially in right-to-work states like California and Michigan, where prohibiting employees from earning a living is not permitted, but protecting trade secrets and customer relationships remains crucial.
Further supporting commentary outlined approaches to both prevention and response. Hiring staff aligned with core business values was highlighted as a first line of defense, acknowledging that even well-selected employees may at times violate trust. Emphasis was also placed on maintaining strong client relationships, as clients themselves may resist overtures from ex-employees and alert the business to solicitation attempts. The balance between proactive oversight and acceptance of limited risk was positioned as a key operational consideration, with practical actions centered on the clarity of employment agreements and ongoing relationship management.
Additional segments addressed opportunities for increasing monthly recurring revenue (MRR) and the growing prominence of AI and related security and governance issues. Strategies for broadening MRR included packaging not only core IT support but also ancillary services such as printer management, mobile device support, and surveillance system maintenance. The conversation also covered the rising importance of including AI usage clauses in NDAs, particularly for M&A transactions where confidential business data might be shared with AI platforms. Concerns were raised about the exposure of proprietary information if uploaded to external AI providers and the need for specific contractual language to address this risk.
For MSPs, the key takeaways center on operational risk containment, the necessity for disciplined employment and client contracts, and governance practices attuned to both human resource management and technology adoption. Service providers are urged to strengthen their policies and agreements to protect confidential information and client relationships, remain vigilant regarding the transfer or misuse of business data—especially in digital and AI-driven environments—and consider the broader implications of their vendor and partnership decisions during organizational transitions or M&A activity.

Protecting Your MSP from Ex-Employees and Growing MRR
Show Rundown & Banter: Protecting clients and employees from poaching, growing MRR, AI security concerns, and AI in M&A.
Question of the Week: Have Ex-Employees Ever Stolen Clients or Staff?Use non-solicitation agreements, employee contracts, and signed handbook acknowledgments to protect your business.

Topic: Growing MRR Beyond Core ServicesExplore VOICE, CYBER, MDM, and BACKUP. Reinvent Telecom is one voice partner to consider.

Something New: Mac Introduces TouchscreenApple explores touchscreen functionality. Is it useful, or is it a feature other platforms have had for years?

Topic: AI Security and ConsciousnessDiscuss concerns around Claude, AI consciousness, and Anthropic’s conversations with religious leaders.
https://youtu.be/TBLHdXABwAg?si=upyYBVLm7Set5YXe

Topic: AI Clauses in M&A NDAsA seller’s NDA prohibits uploading confidential financial documents to free AI chatbots that may train on user inputs.

Tales from the Field: Selling Your MSP to an Inexperienced VC GroupWhat can go wrong when selling to investors without MSP experience?

Wrap & Upcoming EventsMastermind LIVE Tampa, December 3–4, 2026.
https://kernanconsulting-mastermind.mykajabi.com/mastermind-event

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

A significant development highlighted is the recent compromise involving ConnectWise Backup, which originated from ConnectWise’s acquisition of SkyKick. The breach stemmed from the compromise of OAuth app credentials within Microsoft 365 tenants, enabling attackers to access and elevate permissions, primarily targeting MSP tenants. The full method of credential compromise has not been disclosed. However, the presence of lingering OAuth permissions is posited as an ongoing risk vector.
Further details presented by Amy Babinchak specify that attackers targeted a few hundred MSP tenants, seeking to elevate Exchange permissions and control additional ConnectWise-related OAuth apps. It is emphasized that deactivating an unused app is insufficient, as historic use of SkyKick over the past decade could still leave MSPs exposed. A recommended response is a comprehensive review of OAuth permissions, referencing guidance from Guardz, which outlines multiple mitigation steps for MSPs to follow, regardless of current product usage.
Other topics addressed include evolving responsibilities when artificial intelligence (AI) tools direct users to malicious destinations. MSPs were advised to maintain protective controls and thorough documentation, as operational accountability typically resides with the MSP, especially when security layers like EDR effectively prevent incidents. Additional coverage centers on Anthropic’s creation of a public benefit corporation, MapQuest’s feature updates including surveillance detection, and Pax8’s announcement of AI agent solutions that MSPs may resell to clients.
The practical implications for MSPs and IT decision-makers center on maintaining vigilance over third-party integrations and long-lived permissions, enforcing clear lines of communication with clients and vendors, and proactively documenting risk mitigation efforts. Vendor management and operational transparency, especially regarding software vendor issues or AI-related incidents, are underscored as essential practices for reducing harm and preserving client trust.
Whose Responsibility Is It When AI Sends a User to a Malware Site?
Show Rundown & Banter: AI security, the ConnectWise incident, MapQuest, Anthropic, and Pax8.
Something Fun: Michelangelus FontMicrosoft’s project preserving Michelangelo’s work inspired a new font for Word.
https://www.microsoft.com/en-us/download/details.aspx?id=108856

Question of the Week: Who’s Responsible When AI Directs Users to Malware?A user followed ChatGPT’s instructions to a fake verification site. EDR caught the threat. Where does the MSP’s responsibility begin and end?

ConnectWise Backup IncidentAttackers exploited application credentials and excessive permissions, affecting a targeted group of MSPs.
https://app.notion.com/p/Connectwise-Backup-Incident-3f98e07a4534804c9181e7c8c603dde3?pvs=21

MapQuest’s ComebackMapQuest adds surveillance-camera alerts to its maps.
https://app.notion.com/p/MapQuest-surveillance-notices-3e88e07a453480f38df1d2fb15eeb486?pvs=21

Anthropic’s Public Benefit CorporationA new structure aims to direct company equity toward a public-benefit mission.
https://app.notion.com/p/Anthropic-public-benefit-LLC-3fe8e07a453480f0834fd414d8e470f9?pvs=21

Pax8’s AI Revenue OpportunityMSPs can manage AI agents, control usage, and set their own pricing.
https://app.notion.com/p/PAX-8-AI-money-making-opportunity-3fe8e07a45348022b281d63cd11355df?pvs=21

Tales from the Field: The Ungrateful Client?An MSP worked nights and weekends to recover from a software update failure, only to be fired by the client.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The discussion centers on the tradeoffs and risks associated with self-managing the sale of a Managed Service Provider (MSP) business, highlighting a real case in which the absence of professional M&A, legal, and tax advisory led to contract errors, unfavorable terms, and substantial financial exposure. Both James Kernan and Amy Babinchak, drawing from direct advisory experience, argue that while selling an MSP independently is technically possible, the lack of specialist counsel introduces significant pitfalls. The synopsis emphasizes concrete instances where negotiation leverage, contract accuracy, and legal safeguards were either secured or compromised depending on professional involvement.
Supporting details include a specific example involving a failed contract provision: a business sale transacted without an M&A attorney resulted in an omitted clawback clause. Subsequently, more than half of the recurring revenue was lost after the sale, and the seller remained liable for the note without protection. Remediation only became possible after legal intervention, which reduced the seller’s exposure, though such outcomes are considered rare. Both speakers recommend establishing an advisory team comprised of an experienced M&A advisor or broker, a specialized tax expert, and a dedicated M&A attorney, underscoring that operational familiarity with contracts is insufficient for high-stakes divestments.
Secondary topics addressed include risk management in cyber insurance procurement and leveraging Cybersecurity Awareness Month for internal team development and customer marketing initiatives. Amy Babinchak distinguishes between basic, low-cost cyber insurance add-ons and comprehensive policies, noting the latter’s higher cost is justified by enhanced coverage, embedded compliance services, and access to consultative support. The segment also briefly references the importance of leadership mindset, noting that focusing on team strengths as a management approach can drive better organizational outcomes.
For MSPs and IT leaders, the episode’s discussions reinforce the operational risks of do-it-yourself approaches in high-value transactions and regulated domains like cyber insurance. Key takeaways include prioritizing qualified external counsel for significant business events, maintaining adequate and tailored insurance coverage, and adopting intentional leadership and governance strategies. These measures serve to reduce organizational risk, safeguard asset value, and enhance decision quality in complex or regulated IT services environments.
Can I Sell My Own MSP?
Show Rundown & Banter: Why selling your MSP alone can be risky, the importance of cybersecurity insurance, Cybersecurity Awareness Month, leadership mindset, and more stories from the field.
Question of the Week: What if My Clients Resist Change?Can I sell my own MSP? Yes, but should you? No — get professional help.

Topic: Cybersecurity InsuranceUnderstand different insurance options and scenarios. James recommends working with an insurance professional to find the right coverage for you and your business.

Topic: Cybersecurity Awareness MonthHighlight the importance of cybersecurity awareness and staying proactive about protecting your business and clients.

Topic: Leadership MindsetInstead of asking, “What’s wrong, and how do I fix it?” ask, “What’s right, and how do I grow it?”

Tales from the Field: The Importance of Using AttorneysBe careful with DIY contracts, agreements, and business deals. AI is not a substitute for legal advice. The NORCAL deal involved a seemingly favorable LOI, but handling the agreement himself led to a key detail being missed. Good agreements matter.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode addresses the push for mandatory adoption of artificial intelligence (AI) tools among employees in MSP and IT service environments, citing cases where use of products like Microsoft Copilot is being enforced under threat of termination. Contributors emphasize that while AI proficiency is becoming a key factor for employability in the technology sector, mandating use through ultimatums is likely to provoke resistance and undermine change efforts. The consensus is that sustainable progress depends on providing structured training and fostering a collaborative culture rather than imposing requirements.
Supporting discussion points include the importance of intentional staff development and recognizing parallels to previous technology shifts, like the migration to cloud services. Resistance to learning new tools can result in employee attrition, reinforcing the need for ongoing education and active change management. Companies are advised to educate and incentivize employees, creating an environment where continuous upskilling is the norm.
Secondary topics include recent Microsoft incentive program adjustments. Panelists note reductions in partner margins for lower-tier licenses, while incentives remain for Business Premium and enterprise plans. New AI-related incentives, such as Copilot bonuses, now require a minimum of 50 users, which may prevent smaller MSPs from participating. The conversation also explores the spread of AI-generated language into everyday business communication and shares practical security incidents observed in the field.
MSPs and IT leaders are advised to manage AI adoption through robust training, transparent communication, and regular review of changing vendor incentive structures. Shifts in vendor programs and rapid technological change require proactive workforce planning, risk mitigation, and careful attention to evolving operational and compliance demands.
Should I force my employees to start using AI?
Show Rundown & Banter: Amy is back from ChannelCon.
Question of the Week: Should I force employees to use AI? Discuss technology laggards, employee adoption, and whether forced AI use is really the right approach.
In the Economy: 29,000 jobs and 2.2% growth — what does the economy mean for MSPs?
Microsoft Incentive Changes: Microsoft is reducing incentives on many cloud programs while rewarding usage growth and partner skills. What does this mean for MSP margins?
Are AI Chatbots Changing the Way We Speak? “LLMisms” like “It’s worth noting,” “Here’s the thing,” and “This is the key takeaway” are showing up more in workplace communication.
https://www.wsj.com/tech/ai/claude-chatgpt-ai-speak-chatbot-cb804933
Tales from the Field: Another Tale of Espionage — a former employee continued accessing company systems and transferring client data to a new employer.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.