Last week, OpenAI published an open letter and over a hundred companies signed on. CrowdStrike, Microsoft, Google, Cisco, AWS, Anthropic, basically every major name in cybersecurity and enterprise tech. The letter warns that AI-enabled cyberattacks are about to get faster and more sophisticated, and it specifically calls out hospitals, water treatment plants, and critical infrastructure as the places most at risk.

It lays out a plan: every organization needs to raise its security standards, cybersecurity companies need to build AI-powered defenses, governments need to fund the utilities that can't fund themselves, and frontier AI labs — the OpenAIs, the Anthropics — need to hand tools and support directly to the defenders who need it most.

I went through every name on that signatory list. Not one of them is an MSP. Not one of them is the company that actually shows up when a small-town water authority's systems go down at 2am.

So today on CyberCall, I've got Alan McDonald with me, as he runs an MSP that services a number of municipal water districts. And I want to find out: when the biggest names in cybersecurity write a letter about protecting critical infrastructure, where does someone like Alan actually fit in?

For years, security awareness training has focused almost entirely on email phishing: spot the bad link, question the urgent request, verify the sender. But Unit 42 just published research showing attackers have found a different door, and most teams aren't watching it. Collaboration platforms like Slack and Teams have become part of the identity attack surface. Unit 42 tracked a fourfold increase in malicious activity tied to these platforms over the past year, and 99% of it started as chat-based phishing.

Here's what makes this especially relevant for MSPs: most organizations use Teams to collaborate with outside companies, including their IT provider. Attackers know that. They pose as the MSP itself, or as IT support, because that relationship already carries a zone of trust. When "your IT provider" messages you on Teams asking you to approve an MFA prompt, most people don't question it, they just comply.

That's why we wanted Wil Klusovsky on the show. Wil's known for translating technical risk into something executives can actually understand and act on, and this topic needs exactly that.

Palo Alto's Unit42 Research:

https://unit42.paloaltonetworks.com/communication-channel-identity-risks/

https://unit42.paloaltonetworks.com/microsoft-teams-phishing/

This week's conversation is one we believe every MSP needs to hear.

AI-generated vulnerability patches have become the obvious next move for software developers drowning in a tsunami of CVEs. It sounds like a great answer, until you look at the actual data.

That's exactly why we wanted Keith Hoodlet on the show. Keith just published the inaugural research from 1Password's new security research team, Off-by-1 Labs, and the findings are fascinating: when frontier AI models were tasked with patching six real, recently-disclosed vulnerabilities, they got it fully right without breaking anything else, just 26% of the time. More than half the time, the patch either didn't fix the vulnerability, introduced a new one, or both.

Keith's research can be found here.