During a Sunday keynote at the XChange NexGen 2026 conference in Orlando, Florida—hosted by CRN parent company The Channel Company—Lisa Person, GTIA's director of cybersecurity engagement programs, laid out a pragmatic strategy for the IT channel. As reported by CRN, Person argued that MSPs can overcome longstanding client resistance to foundational security measures by framing the conversation around the risks of AI, whether those tools are being deployed internally by employees or weaponized externally by threat actors.
The Baseline Security Deficit in North America
Despite years of high-profile ransomware incidents and relentless cybersecurity advisories, a surprising number of small and midsize businesses still leave their digital front doors unlocked. To illustrate the scale of the problem, Person shared findings from a third-quarter 2026 GTIA security survey of more than 300 North American MSPs.
According to the MSPs surveyed by GTIA, customer adoption of critical defensive layers remains stubbornly low across several key categories:
| Security Control | Reported Client Adoption Rate | Primary Defensive Role |
|---|---|---|
| DNS Filtering | 46% | Blocking access to malicious domains and command-and-control servers |
| MFA on Critical Systems | 42% | Preventing unauthorized access when passwords are compromised |
| Managed Detection and Response (MDR) | 37% | Active threat monitoring, hunting, and incident response |
| Immutable Backups | 35% | Ensuring recovery data cannot be altered or encrypted by ransomware |
While CRN's reporting on the survey does not specify the exact sample design or how individual providers defined full deployment across their client bases, the overarching trend is unmistakable: well over half of the client environments represented in the survey lack fundamental protections like MFA on critical systems and tamper-proof backups.
Yet the survey also uncovered a striking paradox. Even though adoption of these specific controls lags below 50 percent, MSP respondents reported that 75 percent of their clients are actually willing to pay more for cybersecurity services amid rising operational costs. The budget isn't necessarily missing; rather, the traditional sales pitch has lost its urgency.
Section Summary: GTIA's Q3 2026 survey of over 300 North American MSPs reveals that fewer than half of their clients have deployed DNS filtering, MFA on critical systems, MDR, or immutable backups—even though 75 percent of clients are reportedly willing to increase their cybersecurity spending.
Using AI Anxiety to Fix Foundational Hygiene
Why would a business owner who balked at paying for MFA last year suddenly open their wallet today? In short, headline fatigue over traditional cyber threats has been replaced by acute anxiety over artificial intelligence.
During her presentation, Person cited insights from Corey Kirkendoll, CEO of Allen, Texas-based 5K Technical Services and vice chair of GTIA's AI Advisory Council. Kirkendoll observed that while clients had grown weary of standard cybersecurity pitches, bringing up the prospect of AI tools and autonomous agents operating loosely inside their corporate networks immediately changes the tone of the room. When clients ask how to control and govern those AI systems, IT providers can pivot directly back to foundational access and network controls.
"MSPs are saying that their clients know AI is creating awareness," Person noted during the keynote, as quoted by CRN. "They know it's out there. They're hearing it in the news all the time. So now is the opportunity to do it".
From a practical architecture standpoint—synthesizing general industry knowledge with these channel trends—this pivot makes complete technical sense. Whether an organization is rolling out Microsoft 365 Copilot, connecting third-party AI assistants to corporate data repositories, or defending against AI-generated spear-phishing campaigns, an AI tool is only as secure as the identity and permission framework underneath it. You cannot govern what an AI agent accesses on a Windows network if you cannot verify the human identity logging into the tenant in the first place.
To capitalize on this renewed attention, MSPs are also rethinking how they package their defenses. Jeremy Hall, a business account manager at Dallas-based Qnet Managed Services, told CRN that the keynote reinforced the value of bundling security products into unified offerings rather than pitching point solutions piecemeal. Instead of approaching a client multiple times for separate add-ons, Hall explained that providers can present a single, cohesive package upfront that clearly delineates what protects the corporate network and what secures the company's laptops.
Section Summary: By shifting discussions from generic cyber threats to the governance of AI tools and agents, MSPs can break through client apathy and bundle essential network and endpoint protections into a unified package.
Translating the Pitch Into Practice: CISA's MFA Priorities
Getting a client to say "yes" to basic security during an AI readiness review is only half the battle; the actual implementation has to hold up against modern attack techniques. Simply checking a box labeled "MFA enabled" is no longer enough if the underlying method is easily bypassed.
Guidance from the Cybersecurity and Infrastructure Security Agency (CISA) for small and medium-sized businesses provides a clear roadmap for turning GTIA's channel strategy into concrete administrative action. CISA emphasizes that while any multifactor authentication is better than relying on passwords alone, not all MFA methods offer equal protection.
When MSPs and Windows administrators step in to close the 42 percent critical-system MFA gap identified in GTIA's survey, CISA recommends prioritizing deployment and authentication strength in the following order:
- Secure High-Value Targets First: Begin by enforcing MFA across email, file storage, and all remote access pathways. CISA explicitly advises starting with administrative and privileged accounts, as well as employees who handle sensitive data.
- Aim for Phishing-Resistant MFA (Strongest): Physical security keys (such as FIDO2/WebAuthn hardware tokens) provide the highest tier of protection against modern adversary-in-the-middle phishing kits.
- Authenticator Apps with Number Matching: If hardware keys aren't immediately feasible, requiring users to enter a specific number displayed on their login screen into a mobile authenticator app prevents accidental "push fatigue" approvals.
- Standard Time-Based Codes and Biometrics: Apps generating 30-second one-time codes or device-specific biometric checks (like Windows Hello) offer solid mid-tier protection, particularly when combined with other controls.
- Retire SMS and Email Codes Where Possible (Weakest): One-time codes sent via text message or email remain the most familiar to end users, but CISA ranks them as the weakest option, advising that they be used only as a fallback when stronger methods are unavailable.
Section Summary: To maximize the security impact of client buy-in, IT administrators should follow CISA guidance by enforcing MFA on administrative accounts and remote access first, while favoring phishing-resistant hardware keys or number-matching apps over vulnerable SMS codes.
The Takeaway for IT Pros
There is a certain irony in the fact that it takes the futuristic specter of artificial intelligence to convince businesses to adopt security fundamentals that have been best practices for over a decade. However, veteran systems administrators and MSPs rarely complain about why a client finally agrees to lock down their environment, so long as the controls get deployed. By using AI governance as the conversational wedge and backing it up with simplified service bundles and phishing-resistant authentication standards, IT providers can turn executive buzzword anxiety into measurable, foundational resilience.