New AI Governance Tools Are Table Stakes—Positioning, Not Stack, Drives MSP Growth

[00:00:00] Host unforgettable backyard barbecues with savings from Whole Foods Market. Get the good times going with made-in-house chicken or pork sausages and ready-to-cook kebabs for hassle-free flavor. Grab tasty flatbreads and their new balsamic chicken salad in the prepared foods department. Keep things fresh with organic red cherries, strawberries, and peaches at their peak. And stock up on bug sprays and sun care must-haves. Make your summer sizzle at Whole Foods Market.

[00:00:30] Vendors, squeezed by their own AI economics, are manufacturing new buy categories faster than MSPs can evaluate them. But the stack has never been what separates the firms that win. The differentiator is what you do with it. So the operator's job is to own the judgment layer and charge for it or underwrite the vendor's cost prices for free. This is the Business of Tech. I'm Dave Sobel

[00:00:56] Two things we're moving across the channel this week. And at first, they look like they belong to different conversations. Start with Atomic Work. The company launched what it's calling a governed AI workforce, a platform that lets a business deploy AI agents, which it brands as AI co-workers, each one given a defined role, a spending budget, scoped permissions, and an audit trail for every action it takes.

[00:01:19] Atomic Work built it on Microsoft's Azure AI Foundry, raised just over $40 million to get here, and is calling it the first governed AI workforce. Though that word first is a marketing line, not a verified fact. Silverfort announced something adjacent. It's pushing its identity security product directly into Microsoft Co-Pilot Studio, so that every time one of those AI agents tries to act, the request gets checked in real-time, before it executes,

[00:01:49] to keep the agent from reaching something it shouldn't. And Guards, a security platform built specifically for MSPs, rolled out what it calls agentic reporting, an AI tool that produces conversational, real-time security reports across identity, endpoint, email, and cloud, live now, across every tier. Three vendors one week, all selling away to govern AI agents.

[00:02:12] Now the second bucket. CISA, the federal cybersecurity agency, issued a binding directive ordering civilian agencies to patch their highest risk vulnerabilities within 72 hours. Three days. The pressure behind that clock isn't theoretical. CrowdStrike reported that one North Korean group accounted for roughly 47% of all state-backed, hands-on keyboard intrusions against the tech sector over the past year,

[00:02:40] nearly half of all nation-state activity, frequently by posing as remote IT workers behind AI-generated personas. And right on schedule, ConnectSecure launched Patch360, a patch management platform built for MSPs, with pilot testing, risk-based prioritization, and one-click rollback. The mandate's at the pace. The vendor is already selling with speed. If you're listening to this and you haven't hit follow yet, on Apple Podcasts search,

[00:03:09] Business of Tech takes five seconds and you'll get the next episode automatically. I want to make sure you know about something that's coming up this June. The SMB online conference is back June 23rd, 24th, and 25th. And this one is built for operators like you. The theme is, Profitable is Enough, which runs counter to a lot of what you hear in this industry.

[00:03:34] This isn't about hyper-growth or exit multiples. It's about running a business that works on your terms. 3 days, online, noon to 3.30 Eastern. 12 sessions across pricing, service delivery, AI, M&A, private equity, people, and culture. All practitioner speakers. No vendor keynotes. It closes with a session unlike anything you've seen at a conference. I'm going to read anonymous submissions from attendees.

[00:04:04] What keeps you up at night about your business? And respond live. No script. Real answers. Small Biz Thoughts community members get in free. Go claim your ticket. Everyone else, registration is $399. SMB online conference dot com. That's SMB online conference dot com. Underneath all of it is one fact. The economics of AI broke for the company selling it.

[00:04:34] Start with the admission. Gizmodo laid it out plainly in a piece, arguing that big tech is quietly conceding, AI has to be cheap. The biggest names in the business are backing away from the premium they assumed they could charge. Microsoft and Google are pushing lower-cost edge models that run on the device instead of the data center. Amazon told its own employees to stop using AI just for the sake of it and shut down an internal token use leaderboard.

[00:05:00] And Uber capped what its people can spend on tokens at $1,500 a month after it burned through its entire annual AI budget earlier this year. That is not the behavior of an industry confident it can charge whatever it wants. It's the behavior of an industry discovering that it can't. And the reason it can't comes down to a single stubborn fact. Business Insider looks at what

[00:05:24] AI is actually delivering inside companies and the finding is uncomfortable. Individual engineers really are faster. More code, more output, real gains at the desk. But at the level of the whole business, the payoff isn't showing up. Productivity, revenue, profit, the numbers that would justify a premium price haven't moved the way the pitch promised. So there's enormous cost on one side and an

[00:05:50] unproven return on the other. That's the squeeze. A model that's expensive to run and hard to prove is a model you can't sell at a premium for long. Here's where it turns. A company caught in that squeeze, burning cash to run the model, unable to charge what it hoped, several of them now answering to investors who need a revenue story does not absorb that pain quietly. It goes looking for revenue

[00:06:16] somewhere the meter still runs. And the fastest place to find it is the channel. New categories, new programs, new things to sell. The governed AI workforce, the agent identity layer, the patch velocity problem, those aren't separate bets. They're one cost problem rolling downhill looking for somewhere to land. And it lands on the MSP's desk. So here's the part that should stop you. Every one

[00:06:43] of these new categories, when you strip the labels off, is the same thing. More stack to buy. And the best data we have says the stack was never what separated the MSPs who win. Look at the numbers someone actually ran. A study posted by Fox & Crow analyzed more than 13,000 US managed service providers, 13,107 to be exact, and asked one question. What really distinguishes the firms above a million dollars

[00:07:10] in revenue from the ones below it? The answer was not service breadth. It was not the security tooling they bought. The real separators were visibility, the age of the business, the depth of their web presence, and the maturity of their go-to-market. The bigger firms carried on average something like nine times the LinkedIn following. In plain terms, the winners didn't out-buy anybody, they out-positioned

[00:07:35] them. The stack was roughly the same on both sides of that line. Now hold that against a second signal. Over in Microscope, the CEO of RoboShadow, Terry Lewis, described what he's calling an MSP coding renaissance. Providers who stopped waiting for a vendor to ship the right tool and started building their own, writing software to close the gap their clients already have. Notice what those two stories

[00:07:59] share. Neither is about which vendor's platform you licensed. Both are about what you did with it. The judgment, the positioning, the authorship that no vendor sells in a box. So the choice is clean. You can be the MSP who owns that layer, who decides what AI does inside the client environment, governs how it runs, and prices that judgment as the service. Or you can keep buying the categories the

[00:08:24] vendors or manufacturing, deliver someone else's framework, and absorb the complexity without ever being paid for it. The tools are the same on both sides. What you do with them is the entire business. Delivering multi-tenant Microsoft cloud services can be operationally heavy. Nerdio builds software that helps manage service providers automate and manage environments like Azure Virtual Desktop,

[00:08:49] Microsoft 365, and Intune. Simplifying deployment, policy management, and cost control. If Microsoft Cloud is part of your services strategy, Nerdio is worth exploring. Learn more at GetNerdio.com. Why do we care? Because over the next year, MSPs are going to split into two groups that look identical on paper. Same agent governance tools, same patch platforms. Because the vendors are manufacturing that

[00:09:17] stack for everyone at once, and look nothing alike in the market. The separation won't come from the toolset. It'll come from the firm that can tell a client exactly what AI does in their environment, how it's governed, and what that judgment costs, while the shop down the road is still reselling the same boxes and calling it a managed service. The MSP that owns the judgment layer doesn't have a better stack than its competitors.

[00:09:42] It has a position they can't buy their way into. So what to consider? Treat every new vendor buy category as table stakes, not a differentiator. When Atomic Work, Silver Fort, Guards, and ConnectScore all ship the same class of capability in a single week, owning it puts you at parity, not ahead. Budget for that stack as the cost of staying in the game, and spend your actual separation efforts somewhere a competitor can't

[00:10:09] match by signing the same contract. Use the MSP study as a competitive scoreboard, not a headline. The data says the firms above a million dollars pull ahead on visibility, web depth, and go-to-market maturity. Measurable axes where you can rank yourself against the larger shops in your market today. Find the specific gap between you and the competitor one tier up,

[00:10:33] and close it as a positioning investment, because that's the line the study says actually moves firms across. Make the judgment layer something a prospect can see and a rival can't copy. Your defensible position is what AI does inside a client environment, how you govern it, and what you'll put your name to, none of which transfers when a competitor buys the identical platform. Document that as your own assessment method, governance standard, and

[00:11:03] client conversation. So when a buyer compares you to the firm reselling the same boxes, the difference is visible, owned, and priced. If this trend continues, within the next 12 to 18 months, the agent governance and patch velocity stack will be standard issue across the entire channel. And the MSPs pulling ahead will be the ones who stopped reselling the tools and started charging for the judgment behind them. The firms

[00:11:29] whose clients can finally name what they're paying for and why no one else can deliver it. This is the Business of Tech. Want more from the Business of Tech? Join Business of Tech Plus for ad-free episodes, early interviews, extended cuts, subscriber-only shows, and exclusive member perks and analysis. Sign up at

[00:11:51] businessof.tech.com. And follow this show on your podcast app, and if you're on YouTube, hit subscribe and the bell so you never miss a story. Reviews and comments help spread the word too. Interested in advertising? Head to mspradio.com. The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode.

[00:12:24] Part of the MSP Radio Network.