SMB Community Podcast: Business Advice for Small MSP Owners

Employee departures and the risk of client solicitation by ex-staff emerged as the episode’s principal issue. Multiple instances were described where former employees attempted to take clients with them, resulting in legal disputes and operational stress for MSPs. To mitigate this risk, contractual safeguards such as non-disclosure and non-solicitation clauses in employment agreements were identified as standard practices. The discussion emphasized the limitations of these measures, especially in right-to-work states like California and Michigan, where prohibiting employees from earning a living is not permitted, but protecting trade secrets and customer relationships remains crucial.
Further supporting commentary outlined approaches to both prevention and response. Hiring staff aligned with core business values was highlighted as a first line of defense, acknowledging that even well-selected employees may at times violate trust. Emphasis was also placed on maintaining strong client relationships, as clients themselves may resist overtures from ex-employees and alert the business to solicitation attempts. The balance between proactive oversight and acceptance of limited risk was positioned as a key operational consideration, with practical actions centered on the clarity of employment agreements and ongoing relationship management.
Additional segments addressed opportunities for increasing monthly recurring revenue (MRR) and the growing prominence of AI and related security and governance issues. Strategies for broadening MRR included packaging not only core IT support but also ancillary services such as printer management, mobile device support, and surveillance system maintenance. The conversation also covered the rising importance of including AI usage clauses in NDAs, particularly for M&A transactions where confidential business data might be shared with AI platforms. Concerns were raised about the exposure of proprietary information if uploaded to external AI providers and the need for specific contractual language to address this risk.
For MSPs, the key takeaways center on operational risk containment, the necessity for disciplined employment and client contracts, and governance practices attuned to both human resource management and technology adoption. Service providers are urged to strengthen their policies and agreements to protect confidential information and client relationships, remain vigilant regarding the transfer or misuse of business data—especially in digital and AI-driven environments—and consider the broader implications of their vendor and partnership decisions during organizational transitions or M&A activity.

Protecting Your MSP from Ex-Employees and Growing MRR
Show Rundown & Banter: Protecting clients and employees from poaching, growing MRR, AI security concerns, and AI in M&A.
Question of the Week: Have Ex-Employees Ever Stolen Clients or Staff?Use non-solicitation agreements, employee contracts, and signed handbook acknowledgments to protect your business.

Topic: Growing MRR Beyond Core ServicesExplore VOICE, CYBER, MDM, and BACKUP. Reinvent Telecom is one voice partner to consider.

Something New: Mac Introduces TouchscreenApple explores touchscreen functionality. Is it useful, or is it a feature other platforms have had for years?

Topic: AI Security and ConsciousnessDiscuss concerns around Claude, AI consciousness, and Anthropic’s conversations with religious leaders.
https://youtu.be/TBLHdXABwAg?si=upyYBVLm7Set5YXe

Topic: AI Clauses in M&A NDAsA seller’s NDA prohibits uploading confidential financial documents to free AI chatbots that may train on user inputs.

Tales from the Field: Selling Your MSP to an Inexperienced VC GroupWhat can go wrong when selling to investors without MSP experience?

Wrap & Upcoming EventsMastermind LIVE Tampa, December 3–4, 2026.
https://kernanconsulting-mastermind.mykajabi.com/mastermind-event

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

A significant development highlighted is the recent compromise involving ConnectWise Backup, which originated from ConnectWise’s acquisition of SkyKick. The breach stemmed from the compromise of OAuth app credentials within Microsoft 365 tenants, enabling attackers to access and elevate permissions, primarily targeting MSP tenants. The full method of credential compromise has not been disclosed. However, the presence of lingering OAuth permissions is posited as an ongoing risk vector.
Further details presented by Amy Babinchak specify that attackers targeted a few hundred MSP tenants, seeking to elevate Exchange permissions and control additional ConnectWise-related OAuth apps. It is emphasized that deactivating an unused app is insufficient, as historic use of SkyKick over the past decade could still leave MSPs exposed. A recommended response is a comprehensive review of OAuth permissions, referencing guidance from Guardz, which outlines multiple mitigation steps for MSPs to follow, regardless of current product usage.
Other topics addressed include evolving responsibilities when artificial intelligence (AI) tools direct users to malicious destinations. MSPs were advised to maintain protective controls and thorough documentation, as operational accountability typically resides with the MSP, especially when security layers like EDR effectively prevent incidents. Additional coverage centers on Anthropic’s creation of a public benefit corporation, MapQuest’s feature updates including surveillance detection, and Pax8’s announcement of AI agent solutions that MSPs may resell to clients.
The practical implications for MSPs and IT decision-makers center on maintaining vigilance over third-party integrations and long-lived permissions, enforcing clear lines of communication with clients and vendors, and proactively documenting risk mitigation efforts. Vendor management and operational transparency, especially regarding software vendor issues or AI-related incidents, are underscored as essential practices for reducing harm and preserving client trust.
Whose Responsibility Is It When AI Sends a User to a Malware Site?
Show Rundown & Banter: AI security, the ConnectWise incident, MapQuest, Anthropic, and Pax8.
Something Fun: Michelangelus FontMicrosoft’s project preserving Michelangelo’s work inspired a new font for Word.
https://www.microsoft.com/en-us/download/details.aspx?id=108856

Question of the Week: Who’s Responsible When AI Directs Users to Malware?A user followed ChatGPT’s instructions to a fake verification site. EDR caught the threat. Where does the MSP’s responsibility begin and end?

ConnectWise Backup IncidentAttackers exploited application credentials and excessive permissions, affecting a targeted group of MSPs.
https://app.notion.com/p/Connectwise-Backup-Incident-3f98e07a4534804c9181e7c8c603dde3?pvs=21

MapQuest’s ComebackMapQuest adds surveillance-camera alerts to its maps.
https://app.notion.com/p/MapQuest-surveillance-notices-3e88e07a453480f38df1d2fb15eeb486?pvs=21

Anthropic’s Public Benefit CorporationA new structure aims to direct company equity toward a public-benefit mission.
https://app.notion.com/p/Anthropic-public-benefit-LLC-3fe8e07a453480f0834fd414d8e470f9?pvs=21

Pax8’s AI Revenue OpportunityMSPs can manage AI agents, control usage, and set their own pricing.
https://app.notion.com/p/PAX-8-AI-money-making-opportunity-3fe8e07a45348022b281d63cd11355df?pvs=21

Tales from the Field: The Ungrateful Client?An MSP worked nights and weekends to recover from a software update failure, only to be fired by the client.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The discussion centers on the tradeoffs and risks associated with self-managing the sale of a Managed Service Provider (MSP) business, highlighting a real case in which the absence of professional M&A, legal, and tax advisory led to contract errors, unfavorable terms, and substantial financial exposure. Both James Kernan and Amy Babinchak, drawing from direct advisory experience, argue that while selling an MSP independently is technically possible, the lack of specialist counsel introduces significant pitfalls. The synopsis emphasizes concrete instances where negotiation leverage, contract accuracy, and legal safeguards were either secured or compromised depending on professional involvement.
Supporting details include a specific example involving a failed contract provision: a business sale transacted without an M&A attorney resulted in an omitted clawback clause. Subsequently, more than half of the recurring revenue was lost after the sale, and the seller remained liable for the note without protection. Remediation only became possible after legal intervention, which reduced the seller’s exposure, though such outcomes are considered rare. Both speakers recommend establishing an advisory team comprised of an experienced M&A advisor or broker, a specialized tax expert, and a dedicated M&A attorney, underscoring that operational familiarity with contracts is insufficient for high-stakes divestments.
Secondary topics addressed include risk management in cyber insurance procurement and leveraging Cybersecurity Awareness Month for internal team development and customer marketing initiatives. Amy Babinchak distinguishes between basic, low-cost cyber insurance add-ons and comprehensive policies, noting the latter’s higher cost is justified by enhanced coverage, embedded compliance services, and access to consultative support. The segment also briefly references the importance of leadership mindset, noting that focusing on team strengths as a management approach can drive better organizational outcomes.
For MSPs and IT leaders, the episode’s discussions reinforce the operational risks of do-it-yourself approaches in high-value transactions and regulated domains like cyber insurance. Key takeaways include prioritizing qualified external counsel for significant business events, maintaining adequate and tailored insurance coverage, and adopting intentional leadership and governance strategies. These measures serve to reduce organizational risk, safeguard asset value, and enhance decision quality in complex or regulated IT services environments.
Can I Sell My Own MSP?
Show Rundown & Banter: Why selling your MSP alone can be risky, the importance of cybersecurity insurance, Cybersecurity Awareness Month, leadership mindset, and more stories from the field.
Question of the Week: What if My Clients Resist Change?Can I sell my own MSP? Yes, but should you? No — get professional help.

Topic: Cybersecurity InsuranceUnderstand different insurance options and scenarios. James recommends working with an insurance professional to find the right coverage for you and your business.

Topic: Cybersecurity Awareness MonthHighlight the importance of cybersecurity awareness and staying proactive about protecting your business and clients.

Topic: Leadership MindsetInstead of asking, “What’s wrong, and how do I fix it?” ask, “What’s right, and how do I grow it?”

Tales from the Field: The Importance of Using AttorneysBe careful with DIY contracts, agreements, and business deals. AI is not a substitute for legal advice. The NORCAL deal involved a seemingly favorable LOI, but handling the agreement himself led to a key detail being missed. Good agreements matter.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode addresses the push for mandatory adoption of artificial intelligence (AI) tools among employees in MSP and IT service environments, citing cases where use of products like Microsoft Copilot is being enforced under threat of termination. Contributors emphasize that while AI proficiency is becoming a key factor for employability in the technology sector, mandating use through ultimatums is likely to provoke resistance and undermine change efforts. The consensus is that sustainable progress depends on providing structured training and fostering a collaborative culture rather than imposing requirements.
Supporting discussion points include the importance of intentional staff development and recognizing parallels to previous technology shifts, like the migration to cloud services. Resistance to learning new tools can result in employee attrition, reinforcing the need for ongoing education and active change management. Companies are advised to educate and incentivize employees, creating an environment where continuous upskilling is the norm.
Secondary topics include recent Microsoft incentive program adjustments. Panelists note reductions in partner margins for lower-tier licenses, while incentives remain for Business Premium and enterprise plans. New AI-related incentives, such as Copilot bonuses, now require a minimum of 50 users, which may prevent smaller MSPs from participating. The conversation also explores the spread of AI-generated language into everyday business communication and shares practical security incidents observed in the field.
MSPs and IT leaders are advised to manage AI adoption through robust training, transparent communication, and regular review of changing vendor incentive structures. Shifts in vendor programs and rapid technological change require proactive workforce planning, risk mitigation, and careful attention to evolving operational and compliance demands.
Should I force my employees to start using AI?
Show Rundown & Banter: Amy is back from ChannelCon.
Question of the Week: Should I force employees to use AI? Discuss technology laggards, employee adoption, and whether forced AI use is really the right approach.
In the Economy: 29,000 jobs and 2.2% growth — what does the economy mean for MSPs?
Microsoft Incentive Changes: Microsoft is reducing incentives on many cloud programs while rewarding usage growth and partner skills. What does this mean for MSP margins?
Are AI Chatbots Changing the Way We Speak? “LLMisms” like “It’s worth noting,” “Here’s the thing,” and “This is the key takeaway” are showing up more in workplace communication.
https://www.wsj.com/tech/ai/claude-chatgpt-ai-speak-chatbot-cb804933
Tales from the Field: Another Tale of Espionage — a former employee continued accessing company systems and transferring client data to a new employer.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The episode scrutinized the operational impact of accelerated patch velocity, largely attributed to AI-driven vulnerability discovery. Microsoft’s patch release cadence has intensified, as evidenced by the increase from 200 patches in June to 900 patches in September. Despite this uptick, panelists noted that patch delivery is now consolidated—vulnerabilities are addressed through a single cumulative update per cycle rather than via hundreds of discrete patches. This structural change reduces exposure to widespread outages, but risk must still be evaluated based on deployment timing and organizational context.
Delaying patch deployment by at least one week post-release was advocated as a harm-reduction strategy. The rationale is that “dead body Wednesday”—the day following Patch Tuesday—commonly reveals unforeseen operational disruptions. Forum monitoring and the identification of industry-specific tolerances are recommended, supported by the observation that most incidents arise from edge cases or latent infrastructure flaws exposed by reboot cycles rather than patch malfunction itself. The role of Microsoft in acknowledging and remediating issues was discussed, with a particular emphasis on the lag between incident emergence and vendor acknowledgment.
A secondary focus addressed the expanded risk surface beyond Windows, emphasizing IoT, networking, and edge devices. The lack of standardized, automated patching for non-Windows assets, such as security cameras, printers, and other IoT endpoints, multiplies the challenge for practitioners. Neither firmware nor update methodologies are unified, necessitating manual intervention and physical connectivity in many cases. The episode further touched on IT governance concerns, particularly around excessive permissioning, data management, and the tendency for access requests to escalate rather than contract over time, exacerbating organizational risk.
For MSPs and IT service providers, key implications center on risk-managed operations. Patch deployment processes should be routinely assessed and customized based on client risk profiles, infrastructure complexity, and historic pain points. Increased vulnerability discovery via AI necessitates enhanced organizational discipline around both patch timing and post-patch monitoring. Security governance—especially regarding permissions scopes, data segmentation, and the extensibility of third-party integrations—was underscored as an operational priority. Comprehensive asset management and organizational awareness of fragmented patch ecosystems, especially in IoT and edge contexts, will be essential for maintaining resilience and accountability.
What should I do differently now that AI is throwing us so many patches?
Show Rundown & Banter: Amy is joined by longtime Microsoft MVP Susan Bradley, the “Patchaholic,” to discuss Microsoft updates, patching, and what IT professionals need to watch.
Question of the Week: How should MSPs change their patching strategy in the age of AI? Microsoft’s updated guidance calls for short quality-update deferrals and faster installation deadlines.
https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/references/policies-quality-updates
Tales from the Field: When reimaged machines started failing — Susan shares a story involving Dell machines and unexpected failures.

Links mentioned in this episode:
Question of the Week
- Microsoft: Windows Autopatch quality update policies (deferral and deadline guidance)
https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/references/policies-quality-updates
- Microsoft Mechanics: Deploy Windows updates to counter AI-discovered threats
https://techcommunity.microsoft.com/blog/microsoftmechanicsblog/deploy-windows-updates-to-counter-ai-discovered-threats/4534505
Resources
- AskWoody, Susan Bradley's newsletter
https://www.askwoody.com/
- Third Tier, Amy Babinchak's patching series
https://www.thirdtier.net/?s=patch ← swap in Amy's exact link

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.
SMB Community Podcast is supported by our partners:
Oveka
Supporting the IT services community through insights, analysis, and transparency.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.