Cybersecurity and artificial intelligence are quickly becoming two sides of the same business conversation. For SMBs, the questions are no longer limited to firewalls, software, or whether employees should be allowed to use AI. Leaders want to understand risk, productivity, governance, and what these technologies actually mean for the future of their businesses.
We sat down with Ann Westerheim and Chris Gross to discuss how cybersecurity has evolved from an IT issue into a business priority, why employee AI use is moving faster than many leaders realize, and where MSPs have an opportunity to guide clients through the next stage of AI adoption.
Interviewer: Cybersecurity has become a business conversation, not just an IT conversation. How has that changed over the past few years?
Ann Westerheim: One of the biggest changes has been the shift from talking about cybersecurity as a technology problem to discussing it in terms of business impact.
Business owners may not need to understand every technical detail of an attack, but they absolutely need to understand the consequences. What happens if systems are unavailable for several days? Could a business lose an important customer because it cannot satisfy security requirements? How much revenue or reputation is at risk?
As Ann explains, that shift has also changed the role of the MSP. The conversation is increasingly about understanding the business itself and determining how technology can support its goals while protecting what it has built.
She sees AI following the same trajectory.
“It may start as a technology conversation about tools and licenses, but very quickly it becomes a business conversation.”
Chris Gross: Chris points to an even simpler sign of the change: who is attending the meeting.
“The clearest sign of the shift is who’s in the room.”
Cybersecurity conversations that once involved primarily IT personnel now include owners, CFOs, and business leaders responsible for major customer relationships. Ransomware made downtime financially tangible, insurance carriers began asking detailed questions about controls such as MFA and employee training, and customers increasingly began evaluating the cybersecurity posture of their vendors.
The questions consequently changed too. Instead of simply asking whether systems are patched, leaders are asking about exposure, business continuity, and whether they can confidently answer customer security questionnaires.
That has elevated the MSP from technology vendor to business advisor.
Interviewer: AI has everyone talking right now. What questions are SMBs asking?
Ann: One question comes up again and again: “What is everybody else doing?”
SMB leaders know AI is moving quickly. They do not want to fall behind, but they also do not want to spend money simply because a technology is generating attention.
The questions quickly become practical. Where should we start? What are companies like ours doing with AI? What policies do we need? Are employees using it safely? How do we know whether it is actually improving productivity?
That creates a natural role for MSPs. Because MSPs work across multiple businesses, they can bring perspective that an individual SMB may not have and help separate genuine business value from hype.
Chris: Chris has seen the conversation evolve considerably.
“It used to be ‘should we even be using this?’ Now it’s ‘my people are already using it, so what do I do?’”
That distinction matters. Employees are not necessarily waiting for leadership to establish an official AI program. They are finding tools that help them get work done faster, sometimes using personal accounts or applications leadership does not know about.
Chris says the most common concerns now involve what employees are entering into AI tools, whether free versions are appropriate for business use, and what responsible adoption will ultimately cost.
In many organizations, the perceived AI footprint is much smaller than the reality. What looks like a handful of ChatGPT users may actually be employees experimenting with numerous tools across personal accounts.
The intent usually is not malicious. “They were just trying to get their work done faster.”
Interviewer: Where do you see cybersecurity and AI intersecting?
Ann: AI is changing both the quality and speed of cyberattacks.
Employees have traditionally been taught to recognize obvious phishing warning signs such as poor grammar, unusual greetings, or awkward language. Generative AI is reducing many of those clues.
Attackers can create messages based on publicly available information and contextual details about a company, employee, or business situation.
“AI is making cyber threats more convincing, more personalized, and much faster to execute.”
That makes continuous cybersecurity awareness even more important. Technical protections remain essential, but employee education must evolve alongside the threats employees are being asked to recognize.
Chris: Chris sees another major intersection: the information employees themselves provide to AI.
“Right where cybersecurity has always lived, which is employee behavior.”
An employee might place client information, pricing, HR files, source code, or other sensitive information into a tool that has never been evaluated by the organization.
That makes AI governance a human behavior problem as much as a technology problem.
An acceptable-use policy should establish which tools are approved and what information should never be entered into them. But Chris argues that policy alone is not enough.
“There’s a big difference between telling someone ‘don’t put client data in AI’ and showing them how to get the same result without it.”
One creates a restriction employees may try to work around. The other gives them a skill they can continue using.
Learn About How to Deal with AI Risks
Interviewer: What advice would you give an SMB that is excited about AI but doesn’t know where to start?
Ann: Start with the business problem.
“Start with WHY. What do you actually want AI to do for your business?”
“We need AI” is not a business objective.
Saving employee time is. Improving customer service is. Responding to customers faster is. Reducing repetitive administrative work is.
Ann recommends identifying the outcome first, then evaluating the processes standing in the way. From there, organizations can choose a focused use case, establish appropriate training and guardrails, and measure whether AI actually made a difference.
Chris: Chris would move one step earlier.
“Start with training. Before the tools, before the licenses, before the pilot.”
Leadership needs enough AI education to understand the risks before it can create meaningful policies. Then employees across the organization need training, not only those selected for an official AI pilot.
Why?
Because the greatest Shadow AI risk may come from the person who was never invited to the pilot and decided to experiment independently.
With training in place, policies become guidance employees understand rather than rules they look for ways around. From there, organizations can identify a workflow, test AI against it, and measure the results.
As Chris puts it: “The companies that get burned aren’t the ones moving fast. They’re the ones moving fast in the wrong order.”
Interviewer: Looking ahead, what conversations do you think MSPs will be having a year from now?
Ann: Accountability will become increasingly important.
Simply saying an organization uses AI will not be enough. Leaders will want to know who is responsible for it, what it costs, how it is governed, and whether it is producing measurable business value.
External forces may accelerate that shift as insurance and compliance requirements evolve. And as the initial excitement around AI settles, ROI will become a bigger part of the discussion.
Are employees actually saving time? Is customer service improving? Are new capabilities being created?
That gives MSPs an opportunity to move the conversation beyond licenses and toward governance, measurement, and business outcomes.
Chris: Chris expects the question to evolve from whether a business has an AI policy to whether it can demonstrate that its approach actually works.
“The question is going to move from ‘do you have an AI policy?’ to ‘can you prove it’s working?’”
Clients will increasingly need documented policies, employee training records, and confidence that the AI tools being used have been properly vetted.
But there is an upside.
Once businesses establish the right guardrails, the conversation can move beyond risk.
Instead of asking, “Is AI safe?” clients can begin asking, “Where else can we use it?”
That is exactly where MSPs should want the conversation to go.
The opportunity is not simply to help clients purchase another technology. It is to guide them from uncertainty and unmanaged risk toward responsible adoption, stronger employee capability, and measurable business outcomes.
And the MSPs that lead that conversation now will be in a much stronger position when clients begin asking who should have helped them get there first.
- No Credit Card Required
Start Your 30-Day Free Trial
No credit card. No contracts. Just a straightforward way to experience how Breach Secure Now helps MSPs educate, protect, and support the businesses they serve.
