ChannelBuzz.ca

Cutting through the noise for Canadian VARs and MSPs

ChannelBuzz.ca is a news podcast hosted by Unknown Host, with 75 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Unknown Host hosts ChannelBuzz.ca, a news show with 75 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  ChannelBuzz.ca

  Buffering the madness: Dynabook Canada on building a channel in the age of RAMageddon

  Aug 19, 202640 min

  Carmine Cinerari, president and CEO of Dynabook Canada When Carmine Cinerari took over as president and CEO of Dynabook Canada in April 2025 – adding the role to his existing responsibilities running Sharp Electronics of Canada – he inherited the same optimism most of the industry shared at the time: AI PC adoption was going to drive a significant refresh cycle , and the market was going to be on fire. Then, in his words, “we hit the wall.” The memory and component crisis that has come to define the endpoint hardware market in 2026 was not what anyone signed up for. But in this conversation with In The Channel , Cinerari makes the case that a focused, flat, Japanese-owned PC brand may actually be better positioned to navigate the chaos than conventional wisdom about market scale would suggest. A significant piece of that argument is a new nationwide distribution partnership with TD SYNNEX Canada , announced in March. For Dynabook – historically public-sector and direct-focused since its launch as the successor to the Toshiba laptop line – the move is a deliberate pivot toward the channel. Cinerari explains why the deal is about more than broadening reach: it’s about building predictable local inventory at a moment when supply chain commitments have never been shorter. “As a sales company, our job is really to buffer the madness to the customer,” he says. “We can’t shield them from the industry. This is a global phenomenon. But at least we can communicate well about what we can and can’t commit to.” He also addresses the AI PC picture candidly – Copilot+ requirements start at 16GB of RAM, at the exact moment DRAM prices have surged dramatically – and explains, unprompted, why being a Japanese-headquartered company that engineers its own products and carries a local Canadian balance sheet may be more of a competitive advantage in 2026 than it would have been in quieter times. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show. If you sell endpoint hardware or if your customers buy it, you already know that this year has not been a quiet year on that front. Memory prices have surged dramatically; some analysts are projecting cumulative DRAM and SSD cost increases well north of 100% by year end. OEMs are compressing quote windows, repricing backorders, and in some cases, reserving the right to cancel compute orders before they ship. Buyers are deferring refresh cycles, and the phrase “RAMageddon” is being used without irony. Into that environment steps my guest today, who’s been navigating the Canadian IT market since 1996, most of that time at Sharp Electronics of Canada, where he now serves as president and CEO. About a year ago, he added a second hat, taking on the role of president and CEO of Dynabook Canada—the company that carries forward the legacy of Toshiba’s legendary laptop line, and which has been quietly building its Canadian channel presence ever since. We’re going to talk about what the channel build-out looks like right now, including a new nationwide distribution partnership with TD SYNNEX, and what it means to be in the endpoint hardware business when market dynamics are moving as fast as they are right now. Let’s get right into it. My chat with Carmine Cinerari. Carmine, thanks for taking the time. I appreciate it. Carmine Cinerari: Nice to be here. Robert Dutt: Let’s start with the TD SYNNEX announcement from earlier this year. For folks who maybe aren’t as familiar with Dynabook, can you give us a quick picture of who Dynabook Canada is, where you’ve been going to market up until now, and what adding TD SYNNEX actually changes for your partners on the ground? Carmine Cinerari: Dynabook Canada was established back around 2018. Sharp had an interest in the company from the beginning, but it culminated in a full ownership stake. For clarity, Dynabook Canada is a Sharp company; globally, Sharp is the 100% shareholder. It currently operates as a separate company, but in Canada—being a smaller market—we have a unified go-to-market strategy. I took over as CEO of Dynabook on April 1st, 2025, following the retirement of the past executive who had been the CEO of Toshiba Canada for a long time. It just made good business sense. We haven’t legally integrated the two entities, but I concurrently run Sharp Canada and Dynabook Canada. Historically, the business was predominantly public sector and direct, with less channel focus. The TD SYNNEX initiative is really a result of aligning that strategy closer to what Sharp does in Canada. We have a very strong channel strategy, alongside a direct-to-end-user strategy predominantly in our print business. We wanted to leverage the strong professional display business we already have through TD SYNNEX for the Dynabook side. One of the benefits Dynabook has is a CTO (Configure to Order) model. We engineer and develop the product out of Tokyo, Japan, and manufacture in China. Lead times are fairly short—about three weeks, door-to-door—which has been a strength. But with all the supply chain disruption now, the upside of having local inventory for the channel through TD SYNNEX is a great decision. Robert Dutt: I’m guessing that bringing on TD SYNNEX, having that relationship from the other side of the business, provides a level of familiarity that helps ramp the relationship fairly quickly. Carmine Cinerari: That’s true. I’ve learned a lot in the last year about the differences between the PC business and the AV display business. TD SYNNEX is calling on thousands of accounts, and we’re learning that those possibilities are there for Dynabook too. One benefit of Sharp and Dynabook in Canada is that we aren’t a “one size fits all” company. We are a full-on local company; we carry our own balance sheet and don’t report into a U.S. executive. We are a consolidated subsidiary of Sharp Japan. It’s a blessing. Our employee diversity and tenure are very strong—I’ve been with Sharp for 30 years—but we’ve also welcomed about 25% of our current workforce in the last two and a half years. What’s it like being in the hardware endpoint business? You might think I’m off my rocker, but it’s a lot of fun. It’s dynamic. We’re selling print devices, commercial displays, and now PCs. It keeps you on your toes. The team and culture alignment after a year is very strong. Our job is to bring that local infrastructure —technical support, inventory, credit lines—to the channel and be the easiest partner to do business with. Robert Dutt: You touch on the moment we’re in. Partners are under real margin pressure; they’re watching quote windows shrink and configurations getting more expensive. How are you helping partners have that conversation with end customers around the realities of procurement in this environment? Carmine Cinerari: In our print or display businesses, the product life cycle is longer. The PC business is much more dynamic. Our mentality, however, is the same: we promise consistency when we can, and when we can’t, we don’t. Right now, our price commitments are record-short. I’ve never seen a time where we can’t commit to long-term pricing, even in the public sector. We’ve been managing this through disciplined communication. Our senior director, Jamie Duncan, has been here for 25 years and is a disciplined communicator; he doesn’t make promises he can’t keep. As a sales company, our job is really to buffer the madness for the customer. We can’t shield them from the industry—this is a global phenomenon—but we can communicate well about what we can and can’t commit to. We’re chasing supply on memory and chips like everyone else, but we’re doing it in a disciplined way so we don’t disappoint people. Robert Dutt: IDC has made the case that in the current environment, larger OEMs with bigger supply chains will fare better than smaller regional players. How do you see that dynamic? Is it a disadvantage, or is there an argument that a focused, nimble player navigates this differently? Carmine Cinerari: It’s a fair question, but our feedback is that it’s an opportunity for a smaller player. We are very nimble. We’re one of the few, if not only, Japanese companies doing our own design, engineering, and manufacturing in our own factory. That provides a huge upside in security, which is big in our public sector work. The big companies tend to have a lot of confusion during times like this, whereas we are very focused and very flat. To some channel partners, we’re new, and our “one size doesn’t fit all” approach is refreshing. Smaller is better for us because we can keep promises that larger companies might struggle with. Robert Dutt: If we were talking six months ago, I would have led with the AI PC refresh. But Copilot+ requirements start at 16GB of RAM as a minimum, right when RAM is incredibly expensive. How is that shaping your product lineup and the conversations you’re having with partners? Carmine Cinerari: If we talked six months ago, I would have had that same green optimism that the market was just going to be on fire—and then we hit the wall. AI is part of the conversation, but right now, the demand is so tight it’s hard to pinpoint its exact level. Right now, we are just chasing supply on memory and chips. Robert Dutt: For partners sitting in front of customers who are saying, “let’s get one more year out of what we have,” how do you make the case for “buy now”? Carmine Cinerari: That phenomenon isn’t unique to PCs, but because we are coming from a relatively smaller base, we aren’t running into the “wait and see” as much as our bigger competitors. We are still refreshing fleets for our corporate clients. If you are in a position where you need to upgrade for security or other reasons, you have to navigate it now. This “new normal” in the supply chain might not subside for a while. Robert Dutt: Looking at the rest of 2026, what are you watching most closely? Carmine Cinerari: We just came off our fiscal year in March, and we had pretty significant growth despite tariffs, geopolitics, and supply chain interruptions. Being a Japanese company is a benefit right now; we aren’t a U.S.-based headquarters. I’m focused on keeping the sales team motivated. Everyone knows we don’t have 20% market share, so we’re looking for the upside and taking share from competitors. AI is on my mind, but more about what it means for our people and our culture. The investment in AI right now is in infrastructure—trillions of dollars in data centers. It still has to get commercialized into revenue streams at the endpoint. At my age, I’m very optimistic about the future of tech. Japanese companies like Sharp take a very sincere, thoughtful approach to technology—not just for profit, but for what it means to society and humanity. Robert Dutt: Last one: if I’m a Canadian solution provider who hasn’t looked at Dynabook for a while, what should I take away from this? Carmine Cinerari: We are a “headache-free” PC. We are a B2B brand; you aren’t buying us on a retail shelf. We try to be the least worrisome device in your IT ecosystem. Being one of the last Japanese companies in the business, we take quality and security very seriously. Also, we have flex. If you’ve been frustrated by a legacy competitor’s go-to-market strategy, you’d be shocked at how flat we are and how quickly we move. We can get the factory on the phone overnight to solve an integration problem. The escalation path here is the shortest I’ve ever seen. It’s intentional and sincere. We really care about the success of our partners. Robert Dutt: It’s certainly an interesting time to be in the PC business. Carmine, I appreciate you taking the time to share your viewpoint. Carmine Cinerari: Thanks. Robert Dutt: There you have it—Carmine Cinerari from Dynabook Canada. A few things to leave you with from this conversation. The headline is the TD SYNNEX partnership, but the deeper story is the shift from a public-sector focus toward a genuine channel-first approach. On the “RAMageddon” piece, I found his framing of Dynabook’s job as “buffering the chaos” for the channel to be the most interesting takeaway. The combination of a CTO model, a flat organization, and local inventory is a practical story for partners burned by pricing surprises lately. And as he noted, being a Japanese-engineered product with a Japanese parent company is newly relevant in the current trade environment. If you found the show useful, please subscribe or follow in your app of choice—Apple Podcasts, Spotify, YouTube, and most major directories. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

  ListenShow Notes
• 

  ChannelBuzz.ca

  Coro CEO Joe Sykora on the case against Frankenstein security stacks

  Aug 18, 202637 min

  Joe Sykora, CEO of Coro The debate between platform consolidation and best-of-breed point solutions has been running in the MSP community for years. But with AI-driven attack volumes up three to four times year over year, and clients unwilling to absorb price increases, the operational stakes are getting harder to ignore. In this episode of In The Channel, host Robert Dutt speaks with Joe Sykora, chief executive officer of Coro , the Chicago-based cybersecurity platform built for lean IT environments and the MSPs who serve them. Coro’s platform spans 14 security modules – endpoint, email, network, cloud app security, data protection, and more – running on a single agent and a shared data engine. The company is 100% channel, past Series D, and recently recognized by Gartner as a representative vendor in the emerging Workspace Protection category. Sykora brings an unusual background to the CEO chair. He started out running solution provider businesses before moving vendor-side, holding channel leadership roles at Fortinet, Bitdefender , and Proofpoint. One of his first acts as CEO was eliminating Coro’s direct sales motion entirely. The conversation covers Coro’s core consolidation argument – and what Sykora calls the “Frankenstein stacks” that result from stitching together point solutions via API integrations – alongside the platform’s 92-93% automated alert remediation rate, with some partners pushing toward 96%. It also gets into harder territory: Sykora acknowledges on the record that not every Coro module is best in class, and addresses the vendor concentration risk that comes with consolidating that much of a client’s security posture in one place. The episode closes on Coro’s recently launched MCP server integration , which brings security operations directly into AI agent workflows, and the question Sykora took from RSA: is it cybersecurity with AI protection, or AI with cyber? Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show. The question of how to build a security stack for small or mid-sized businesses, or for the MSP serving one, hasn’t gotten any simpler. If anything, it’s more crowded than ever. Best-of-breed point solutions for every threat vector, each with their own agent, their own dashboard, and their own data silo. There is no such thing as a single pane of glass in security. My guest today has a different answer, though. Joe Sykora is chief executive officer at Coro, an 11-year-old cybersecurity platform purpose-built for lean IT environments and the MSPs that serve them. Coro covers 14 security functions—from endpoint to email to network, cloud app security, and data protection—under a single agent and a single data engine. The company is 100 percent channel, past Series D funding, and has made no secret of its ambition to be a platform that consolidates what Joe himself called the “Frankenstein stacks” that so many MSPs have been managing for years on the security side. What makes him an interesting person to have this conversation with is that he isn’t coming at it from the product or the engineering side. He started out running solution provider businesses in the 90s, exited two of them, and spent the better part of 15 years in channel leadership roles at Fortinet, Bitdefender, and Proofpoint before taking the CEO chair at Coro last year. Let’s get right into it. My chat with Joe Sykora. Joe, thanks for taking the time. I appreciate it. Joe Sykora: Robert, great to see you. Robert Dutt: You know, most cybersecurity CEOs come up through product, through engineering, or through finance. Your background involves running a solution provider before going vendor-side. I’m curious what the industry looks like from a CEO’s seat when your formative years were on the partner side of the table. Joe Sykora: Sure. Well, it’s been an exciting ride. It started back in the 90s and I’ve been very, very fortunate. I was one of the early adopters. The first company I had was an infrastructure company; we quickly pivoted to security and became a managed security provider in the 90s. I still have a lot of friends that are still out there doing it, but I was one of the early adopters. I was very, very fortunate to be able to exit both of those companies and that got me to the manufacturer side. I started with a little-known company—at the time it was unknown, but most people now know Fortinet. I joined them in 2010 during their IPO and, man, I like to say the rest is history. My role at Fortinet was a little bit different because I did cover primarily the channel, the partner side, which was a huge, huge part of Fortinet’s success. But I also got to dabble on a few other things like operations and the marketing piece. In fact, when we made some of those acquisitions, I got to be the interim CEO as we integrated those in. I never lost my entrepreneurial spirit; if there’s a problem, I like to fix it. I don’t like to just say “that’s the way it’s always been.” I always challenge things no matter where I go. I have the attitude where if the garbage needs to be taken out, I’ll take out the garbage too, right? Because that’s the way I was brought up—very humble beginnings in Ohio. I grew up in farm country, believe it or not. I was one of the first children to get to play around with a Mac and programming in fourth grade. So at a very early age, I got a little bit addicted to computers. The seat right now as CEO is what I’ve been brewing myself for throughout my career. I’ve led go-to-market strategies and I’ve been involved very much on the backend. When this opportunity came up, it was something that I felt I was ready for. I’ve put in a lot of international experience over the last 10 years or so, meeting with partners all over the world and really listening to the different needs they have. But more importantly, I love the channel. I came from the channel. So for me to be able to run a 100 percent channel motion is very unique. One of the first things I did as CEO was kind of kill the direct motion. We had a mixed model and it didn’t make sense for us. So it’s exciting. Of course, there’s other challenges—I spend a lot of my time with boards and financial institutions now—but I still love getting in front of the partners and talking about our story and how we’re different. Sometimes it even leads to giving advice on how to exit companies and what’s important there. Robert Dutt: No doubt a topic of interest for the MSPs listening. For you guys, the platform consolidation pitch is a big one and it’s compelling on paper. One agent, one dashboard, 14 modules. But there’s always that MSP who comes up and says, “All right, the jack of all trades, master of none thing.” How do you answer an MSP who says, “I see your point, but my EDR vendor or my email security specialist is doing better in that particular lane than what Coro can do”? What’s the message to that skeptic? Joe Sykora: Yeah, well, I think things have definitely changed. Again, this is coming from a guy who’s been in cyber now for almost 30 years. For the partners out there, everyone has their tech stack. This isn’t anything new. When I was an MSP, my pitch was “you can’t afford an enterprise platform—not only the licensing , but really managing the platform.” I’m sure a lot of people out there today are doing the same thing. Coro’s different because of the advancements of using AI. I know that’s a topic—I think last week I said we should make a drinking game out of anytime anyone says “AI.” But AI is moving faster than anything we’ve seen out there. Coro is not a new company; we’re 11 years old. Coro was purpose-built for the MSP and SMB—or “Lean IT,” as I like to refer to it. We help operationalize things. Coro is not about looking at each individual module and saying “I have it, I don’t have it.” It’s about putting it all in one agent to stop agent sprawl and putting it all in one dataset. Because it is all our own IP that we spent the last 11 years developing, having clean data going into it is so important. That’s why we’re seeing, on average, about a 92 to 93 percent automation rate of correlating and then remediating automatically. That’s pretty good, and it’s getting better. A year ago we were in the high 80s; we’re now closing in on the mid-90s. I was talking to a partner the other day who was seeing about 96 percent. What that translates to is operational efficiencies. That is time back, and that is money to you as an MSP. We know that the attacks aren’t slowing down—in fact, we’re seeing about a 3X increase already this year. The bad guys are also using AI. If we want to go head-to-head versus your endpoint and EDR vendor, we can. We still test out at five nines. The difference is it’s simpler. I’ve talked to many “enterprise” MSPs who are very proud of their stack, and that’s fine. But then they look at someone like Coro—100 percent channel, guaranteed margins, a lot of support —and it makes sense. The “aha” moment is when they see the operational efficiency of an analyst being able to look at 100 or more clients instead of 20 or 30. We did introduce Coro AI within the product for MSPs who want to look at reporting across all their customers. We’re not an NDR, but we give you NDR results. If you want to do some threat hunting and see what’s going on, you just talk to our AI. The concept is the same as the old UTM or Next-Gen Firewall days, except now I have more modules and I’m in the cloud. And we can coexist. If you have a solution in place, that’s okay. We are a very lightweight client. You can get the results and then, when it comes up for renewal, you can decide if you still need that enterprise point product or not. Robert Dutt: That 92 percent automated alerts figure has to be one that gets a lot of attention. Can you walk me through what that automation means for an MSP day-to-day? And maybe more interestingly, what does the other 8 percent look like? Is that still where human judgment matters most? Joe Sykora: There is no way I’m going to get to 100 percent. Will it increase? Yes, of course. The difference we have is that since it is all one database, you don’t have a true single pane of glass when you’re doing API integrations. Some of the big platforms out there have kind of “Frankensteined” things together through acquisitions and APIs. I have a very elegant solution. The 8 percent that you need to look at is because we can’t make a judgment call at that point. But let us be defense-in-depth; let us see that data because that’s how you get better results. Gartner actually came out with a new category last year called “Workspace Protection,” and Coro is mentioned as a representative vendor there. Our direct connections into Microsoft and Google Workspaces are key because then we can start doing the compliance, the DLP, and answering those questions about protecting confidential information. Same thing with mobile—being able to truly stop smishing carrier-independently is a challenge, and we’ve got a way to do that. You’re always going to need that human level. Our job in security is not only stopping the bad stuff, but managing the false positives. Our false positive rates are very low, which saves the MSP a lot of time. Robert Dutt: One of the latest things you guys have launched is an MCP server . Can you explain what that actually does in practical terms—how the workflow changes for an MSP when the security data is feeding directly into an AI agent? Joe Sykora: Depending on who you talk to, it could be controversial. I was at RSA, and the big talk was: is it cybersecurity with AI protection, or is it AI with cyber? That is the question. What we’re starting to see is more partners building things around AI platforms. We wanted to give them the flexibility to do that. On the technical side, some of the stuff we’re doing is really cool. The other vision of Coro is that this is all about operational efficiencies and consuming our tech where you want to. If you don’t want to interface with my UI, you don’t have to. If you want to communicate with our platform via Slack, Teams, or text to resolve things, you can. If Coro can be where you want it to be in your business, that unlocks efficiency. We’re mostly a development house at our core. We have excellent people on the channel side, but we’re not out there hiring teams and teams of salespeople to go direct. I think partners should provide all the services. Some manufacturers are tempted to do direct-to-end-user sales; I have no desire to do that. It helps me focus on being good at developing the products. Robert Dutt: Let’s talk about vendor concentration risk. The great thing for an MSP is having 14 security functions under one roof, but that’s also the challenge. What’s the answer to a partner who asks: what happens to my clients if something goes sideways—a bad update, an outage, or a longer-term event like an acquisition? Joe Sykora: We all make business decisions. On the manufacturer side, it used to be all about best-of-breed. Now everyone is talking about “platform.” The cleaner the data into an AI model, the better. Do all of my 14 modules—are they the best out there? You could challenge me on a few. I think the core products we have are very, very good and test out at five nines. Do I have all the enterprise features of some other things? If you look at our network module, you might want more, but we’ll interface with that. We’re built for “Lean IT.” As for the big question—will we get acquired?—that’s not our plan. Coro is late-stage; we’re past Series D. It’s a very solid company and I was brought in to become the biggest cybersecurity company out there. It was not a “come in and let’s get acquired” play. But for partners, you do need to make those business decisions. We have three different bundles—good, better, best—so you don’t have to take all the modules if you don’t want to. It’s something you have to evaluate as a business owner. Robert Dutt: You guys opened a Canadian data center a couple of years ago. I’m curious what your read is on the Canadian MSP market and how the regulatory conversation looks for your Canadian partners. Joe Sykora: We’re partnered with Amazon ( AWS ), and we’ve had a Canadian presence for many years. There are a lot of regulatory things we need to comply with for Canada . If I didn’t believe in the Canadian MSP market, I don’t think we’d have a server there and local presence. In the past, at other manufacturers, I’ve had to fight for that and justify it. Coro is set up for that. We also have dedicated people in Canada—actual Canadians—helping our partners. It’s a fantastic market. On the DLP side, there are differences between US data and Canadian data, and we fully support those. As for differences between MSPs, I deal with them across the world and some things are consistent: the need to operationalize and give predictability to business owners. We’ve built a true consumption model where you have the keys to the kingdom—grandparent, parent, child tiers—and you only have to pay for what you use. It’s complete flexibility. I have advisory councils that provide a constant feedback loop. People who know me know that I take feedback from partners seriously. In our January release, we had a lot of updates because of what our MSP partners asked for. We’re here to listen. Robert Dutt: You’ve said that 2025 was a foundational year for Coro and that 2026 is about execution. What does that execution mean for the one or two things you’ve got to get right this year? Joe Sykora: When I took over as CEO, I had to put my CEO hat on. We had so much opportunity that we were being spread too thin. You have to have some focus. I had to switch out some backend systems—nothing to do with the product, but how we ran the business to improve the partner experience. We brought in a lot of new people—familiar faces in channel sales. This year is about executing on a very focused plan and stress-testing all the work we did. 2027 is all about scale, so I need to make sure the machine doesn’t break. For example, when I took over, we had a project for a consumer app. I put a timeout on that because I’ve been in a mixed environment before and it’s a different type of support and service. I want to focus on the primary platform. We’re not hiring teams of salespeople; I want our partners to do that. Robert Dutt: Last question from me. MSPs are being pulled in a dozen directions. If you could give one piece of concrete advice on how MSPs should be thinking about their security stack over the next 12 to 18 months, what would that be? Joe Sykora: Automation. You need to be prepared. Like I said, we’re seeing three to four times the number of attacks already this year. If you don’t think it’s going to happen to you, you’re wrong. You need to make sure whatever you’re doing is efficient and effective. You can’t change your price model to the customer—if anything, they want it to go down—so you need to deliver first-class services more efficiently. That’s why you need to always be evaluating what’s new, but you want to be with a platform that has put the work in over many revisions. Buckle up, because the next few months are going to move fast. Robert Dutt: Never a dull moment in this industry, that’s for sure. Joe Sykora: Never, Robert. Never a dull moment. Robert Dutt: Joe, I appreciate you taking the time. Thank you. Joe Sykora: Thank you. You take care. Thanks, Robert. Robert Dutt: There you have it, Joe Sykora from Coro. I’d like to thank Joe for his time—good conversation. If you’re an MSP evaluating your security stack, there are a few things worth thinking about here. The core of Coro’s argument, pardon the pun, isn’t really about individual module quality—and to Joe’s credit, he acknowledged on the record that not every one of those 14 modules is, in and of itself, best-in-class. The argument is about what happens when all of them share a single data engine. The 92 to 93 percent automated alert remediation rate—with some partners seeing 96—is the claimed payoff of that architecture. And he’s right that in an environment where attacks are up three to four times year over year and you simply cannot raise prices on clients, the only lever MSPs really have left is efficiency. Not a new observation, but it really lands well when the guy saying it used to run solution providers himself. Another thing we’re thinking about is the question Joe raised from RSA: is it cybersecurity with AI protection, or is it AI with cyber? That has real implications for how MSPs think about building their service delivery around AI platforms going forward, and it’s a conversation we’re going to have a lot more of on this show. If you found this useful, please follow or subscribe to the podcast wherever you get your podcasts. We’re on Apple Podcasts, Spotify, YouTube, all the major directo

  ListenShow Notes
• 

  ChannelBuzz.ca

  Logging in, not breaking in: Blackpoint Cyber’s Wil Santiago on the 2026 threat landscape

  Aug 13, 202630 min

  Wil Santiago, Wil Santiago, chief security and trust officer at Blackpoint Cyber Wil Santiago, chief security and trust officer at Blackpoint Cyber , joins In The Channel to discuss the findings of the company’s 2026 Annual Threat Report – research grounded in thousands of real incidents investigated by Blackpoint’s security operations centre, not surveys. The headline finding: attackers are no longer trying to break in. They’re logging in. Using stolen credentials and commodity remote management tools , threat actors are walking through the front door, hiding in plain sight, and operating with system-level privileges – sometimes for days before anyone notices. Santiago walks through the key trends the SOC identified across 2025: ClickFix and fake CAPTCHA campaigns accounted for more than half of all identifiable incidents, with attackers abusing trusted infrastructure including Azure Blob storage and Cloudflare to deliver payloads. RMM abuse showed up in roughly 30 per cent of triaged incidents – threat actors installing their own version of the same tools MSPs use legitimately, then living off the land with god-mode access. And Adversary-in-the-Middle attacks are now routinely hijacking authenticated sessions even when MFA is in place, by abusing OAuth token handling. The conversation also covers Blackpoint’s detection philosophy: behavioral context over malware signatures. Understanding what normal looks like in an environment – who uses what tool, at what time, from where – is what allows the SOC to catch attackers before they act. It’s a philosophy that is producing results: Blackpoint disrupted 56 per cent of incidents before a payload was ever deployed. Santiago’s closing recommendation for MSPs is straightforward: start with an RMM audit. Know every remote management tool deployed across every endpoint and server you manage. You cannot protect what you don’t know exists. The 2026 Annual Threat Report is available for download on the Blackpoint Cyber website. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show. Wil Santiago is Chief Security and Trust Officer at Blackpoint Cyber, an MDR provider whose SOC monitors and responds to threats in real time across a large base of MSPs and their clients. And unlike a lot of threat research that’s survey-based or derived from external reporting, what Blackpoint publishes comes from live incident data, thousands of actual threat responses they’ve worked through in the SOC. Their 2026 annual threat report has a thesis that cuts right through it. Attackers are no longer trying to break in, they’re logging in, using stolen credentials and legitimate IT tools, the same RMMs, the same cloud platforms that MSPs rely on every day, to walk through the front door, hide in plain sight, and work their way towards payday. It’s a theme we’ve been tracking at ChannelBuzz.ca. If you caught our conversation with Tony Anscombe from ESET, that one dug into the mechanics of how MSP tools are being weaponized against the very clients they’re supposed to protect. This conversation is the data layer behind that story, and the detection philosophy that Wil and the Blackpoint team have built to counter it. Their SOC is disrupting 56% of incidents before a payload even deploys. We talk about how. Let’s get right into it. My chat with Wil Santiago. Wil, thanks for taking the time, I appreciate it. Wil Santiago: Thank you, Robert. Robert Dutt: For people who know Blackpoint primarily as an MDR provider, but maybe haven’t dug into the research side, can you give us a quick sense of what your SOC is actually seeing day to day? When you say this report is based on thousands of real incidents, what does that mean in practical terms, in terms of how you gathered this data? Wil Santiago: That’s a great question, Robert. It really starts at the core of what we focus on at Blackpoint Cyber. In 2025, we focused a lot of our detection efforts in the cloud endpoints, but what we realized is that at the core, at that identity layer, that’s the most important thing. But what we’re protecting at Blackpoint is the identity. What we observed in 2025 is this interesting shift where, yes, there’s vulnerabilities, there will continue to be vulnerabilities. However, threat actors don’t necessarily need to weaponize those vulnerabilities to gain access into an environment. They’re not really targeting customers or companies with any specific new zero-day technology or exploits that are novel. They’re just logging in using stolen passwords. We’re still at that pivotal point, but we’re still talking about the same things we’ve been talking about, password reuse, making sure you’re protecting yourself from phishing emails, so on and so forth. But the reality is that threat actors are getting in. They’re stealing credentials and they’re using legitimate tools to just log in, walking through the front door. Robert Dutt: Yeah, the headline from the report was very catchy with the attackers are no longer trying to break in. They’re just logging in, as you say. And that framing echoes what we’ve seen in other reports elsewhere. People are calling 2025 the year of the abuse of trust in terms of security trends, but your numbers are operational and not survey-based. I’m curious what trusted compromise looks like from where you sit. Is there really a shift away from what you were seeing a couple of years ago or three years ago, or has this always been the playbook and we’re only now measuring it properly? Wil Santiago: Yeah, so if I compare back to, let’s say, 2022, I think we at Blackpoint would still see a trend, the threat actors gaining access into an environment, usually using some type of exploit at that time. You can point to a number of Microsoft Exchange exploits that happened during that time. The Hafnium group was doing a lot of Exchange exploits. The reality is there came a certain time where we were detecting Cobalt Strike, a malware commodity tool, every single day in Blackpoint Cyber’s SOC. And then eventually it became once a week, and then it became once a month. So then we started to think, well, what’s happening with the shift of tactics with the threat actors? And what we found is instead of installing Cobalt Strike, they started to install legitimate IT tools. And that’s the trust component. When they’re installing tools that you use internally, they now can abuse those tools the same way that you use those legitimately. And so we have these threat actors that not only are abusing legitimate tools, but like I said, they’re abusing legitimate identities. So when you have what I call the keys to the kingdom, the passwords, I am you. I am now Robert, for all intents and purposes for this sort of webinar. I think the interesting part that we’ve seen at Blackpoint is that threat actors have really, really focused on leave-behinds. And those leave-behinds are commodity remote management tools. Why do they do that? Because EDRs don’t know how to detect them as malicious, right? These are legitimate IT tools that are being used to service MSPs and their customers. And a threat actor just installs their version of the same exact tool that you’re using legitimately. Right? And so the trust component is you go to review your assets and you see ScreenConnect installed in your environments because you use ScreenConnect, right? But then when you start taking a closer look, you start to realize, wait a second, there’s four different ScreenConnect IDs on this one machine. Now we have a more of a problem, right? And so the attack is a little bit of an invisible signature detection because it’s an authorized tool, right? And so we really have to get to this layer of identifying threat actor activity with behavior context. If you’re an AnyDesk shop, then why do you have TeamViewer installed on your file server that’s publicly facing, right? Let’s start to ask those questions and dig into that a little bit. Robert Dutt: Your SOC found that fake CAPTCHA and ClickFix campaigns accounted for, I think it was 50-odd percent of identifiable incidents. That’s a majority of attacks being driven by a technique that essentially requires the victim to step on the link to execute it themselves. Why is that scaling so fast right now? And especially for an MSP who tends to think, you know, my technicians are too smart to do that. What’s kind of the honest answer for what they need to be looking for and protecting against? Wil Santiago: Yeah. And, you know, ClickFix is such an easy attack when you really get into the root of what it does. But it starts with social engineering. You’re enticing someone, again, just like with phishing, to visit something that you’re going to tell them to do an action. And most of the time, they’re going to do that action. Now, why this is so effective is we’re seeing techniques that really enable the threat actor to deliver the payload. And how do they do that? Search engine optimization, right? These SEO links at the top, when you go look for an OBS installer, because you need your camera to look well, or you get a Google sponsor result. Threat actors are just buying those sponsored results and delivering their payloads on there. You click on it thinking you’re going to download OBS, and then it tells you, hey, wait a second, you have to make sure that you are human. Verify that we’re used to verifying we’re humans to download something. So we go and we click it. But then it says, hey, open up your Windows Run command and maybe run this command on us, on your computer for us. And what happens? Threat actors go and they put the commands on a website. They have this watering hole spread out all throughout infrastructure that’s globally distributed. Google, Microsoft, all these sort of cloud infrastructure hosting providers that exist. Threat actors use those. So when you’re looking at your firewall logs and you’re seeing your internal team going to Microsoft.com, hey, it’s Microsoft, right? But the reality is, it’s likely an Azure Blob site that’s just being hosted on Microsoft, that is a threat actor that’s actually hosting it. And so they’re abusing that trust function to say, hey, you need this OBS installer. You Googled it. I didn’t tell you to go Google that. You were the one that did that. And then they found my link, which I posted a malicious payload there. And so again, that abuse factor is all the things we’ve taught our employees, our customers, our MSPs to do, right? Go to Google, make sure you identify the link. Make sure you look for Microsoft. Make sure you see the end of a URL or domain. Validate that. Well, the adversary goes, okay, they want to play that game. I’m just going to host this on Cloudflare. And now we’re back to this gate where now someone clicks on something. Well, what’s this Cloudflare? That’s a legitimate service. I know that to be true, right? It’s very true. The reality is the infrastructure is very, very easy to set up. And it doesn’t require a lot of action. It just requires someone to take a command and put it on their machine. And all the background work happens in the background, right? And so beyond that, we used to see a lot of threat actors use this sort of technique to download malware onto machines. But again, going back to what I mentioned about RMMs, now they’re just downloading an RMM. And that just looks like a legitimate process to an EDR. Robert Dutt: Right. So for an MSP, especially when training or making sure their technicians are aware, is it just as simple as making sure they’re aware of this threat landscape and this wrinkle in it? Or is there something more that’s sort of the advice there on how to protect yourself as best you can? Wil Santiago: That’s a great question. And really, you know, I would say any MSP watching this show, starting today or tomorrow, the first thing that I always tell people, audit your RMM inventory. Asset inventory is the number one thing that customers should be doing, right? You cannot protect what you don’t know exists. And so every single remote management tool that’s deployed across every endpoint you manage, every server you manage, you need to audit those, right? Like you’re giving direct access to a system. And most of the time, those RMMs run in the system context, which means they have the permissions and privileges of any admin, right? And now you have this adversary that has a foothold. They can deploy tools using admin privileges and permissions. So you have to audit your RMM inventory, right? Making sure that you understand what’s happening across those production servers. And forcing MFA, that’s a big one. We see a lot of incidents that source from RMM abuse because they log into the MSP’s RMM console, the cloud-based consoles. Some of those don’t have MFA involved. Again, keys to the kingdom, MFA everywhere, that needs to be a reality. Then we need to start moving into what I call more resilient engineering, right? Conditional access policies, preventing individuals from logging in from untrusted sources, locations, right? There’s ways that you can lock down access to an RMM and assume a threat actor is able to steal credentials because they maybe installed an info stealer on a user’s machine, stole their browser credentials. They reuse the same credentials for Gmail that they do for their corporate environment. Well, now a threat actor just perusing finds their credentials and says, “Oh, I’ve got IT Glue permissions now. I’m going to go log into this and restore all these configs in IT Glue or whatever tools out there.” Well, now the threat actor has access to that. And so that’s how they’re pivoting across these environments. They’re going from cloud to on-prem, on-prem to cloud. One of the things that we caught at Blackpoint recently, and this was a really cool response, but the threat actor compromised the cloud environment first. They then took that cloud access, deployed an RMM using Intune to the devices, and then they used that on-prem access to go to those machines and do their own work directly from that console. I called it overkill. They didn’t have to do that because they had the cloud environment. But because they did that, that sort of prompted this investigation for this MSP to approach us and say, “Hey, we believe something is happening. We investigated and quickly saw the Intune process was the responsible process for deploying some of this malware. So we told them, “Hey, deploy our cloud response suite. We want to understand what’s happening in your cloud.” And sure enough, seven global admins were compromised. So again, limiting scope is important here, right? Least privilege. Why do we have so many people with admin privileges and permissions? I think there’s 192 admin roles or something like that in Microsoft, but we default to just, you get global admin, you get all the permissions. And so now an adversary compromises a Microsoft 365 tenant. Well, now they have the permissions of a global admin. And unfortunately for us, when we shifted from the on-prem strategy to the cloud strategy, we just started pushing everything in the cloud and we say, “Oh, it’s fine. It’s in SharePoint.” We didn’t realize though that that’s only being protected by a password and an MFA token, both of which can be stolen, right? So the protection is not really there. That’s why we have to move to that resilient engineering. And so it’s moving from that reactive alerting to that posture alerting, right? Why is someone trying to log in from France? We have nobody in France. Robert Dutt: So your report showed almost a third of triaged incidents involved RMM abuse. And that’s something, that kind of trend line is something that we’ve seen in other reports. You know, one of your peers is talking about a 200 plus percent spike in abuse of RMM in attacks. I’m curious, especially since you’re sitting in the SOC there, what does RMM based intrusion actually look like in the SOC here? You know, I’m guessing curious, is there a moment where it’s genuinely hard to tell, you know, is this actually a tech doing a routine task or is this an attacker? And if so, what kind of breaks the tie and causes you to go, “No, no, that’s not right.” Wil Santiago: Yeah. Well, there’s kind of two ways to look at it, right? We have threat actors that are compromising MSP RMM tools. These are tools that are owned, managed by the MSP. They’re usually protected with some cloud login, whether they self-host it or they have the vendor host it for them. Threat actors can log into those systems with a password and a username, right? So we see a lot of brute forcing of those systems, especially if they’re self-hosted systems, they usually don’t have the protections of the vendors. They don’t put a WAF in front of them. And so they’ll try to brute force them and just log in, right? Those are few and far between, to be quite honest. We don’t see those as often, but what we do see often is, again, they gain access into an environment, usually by compromising a VPN. Now they’re on the network. Now they can move throughout that network as they’re on the VPN, and they’ll usually find a foothold. And if they have a credential like a local admin, they’ll take that one foothold and then they’ll distribute their RMM across that entire fleet of the network with one command from that foothold. So for us, when we’re looking at RMM deployments, MSPs deploy RMMs in a certain manner and format. They’re not deploying an RMM at two o’clock in the morning on a Saturday when they’re a US-based company. And oh, by the way, they just logged in from a Chinese-based IP, right? So again, there’s indicators that are very clear cut of like, okay, this deployment of RMM tools absolutely malicious. Most of those cases come to the case of, you know, we have application control within Blackpoint that allows us to alert when someone is installing a new application that’s unauthorized. And so what we tell our MSPs to do is, hey, set up your policies that if you’re a Ninja RMM shop, you cannot have any other installations of any other RMM. ScreenConnect is not going to be involved. And so that allows us and affords us the ability to do is, when we get that alert that says someone’s attempting to install a ScreenConnect, we can go back and sort of recreate the path of how do they get here. And what that allows us to really get into is, again, that response, right? And that response is preventing the installation of the RMM, eradicating the threat actor by isolating the machine, making sure you remove their footholds, getting those SSL VPNs off of the public facing internet, and having that exposure management reduced, right? And so when we look at RMM abuse in practice, once they get that RMM installed, again, they’re living off the land with system privileges. System privileges is something that most people tend to understand, but it’s just keys to the

  ListenShow Notes
• 

  ChannelBuzz.ca

  The Buzz: Blumira launches universal AI security command center, Vistera brings AI professional services to Canadian SMBs, and CrowdStrike warns on ransomware targeting MSPs

  Aug 13, 20264 min

  Today’s headline news for Canadian IT solution providers: [Blumira]: The company on Tuesday launched Hearth , a vendor-agnostic AI command center that Blumira says can intelligently reason across security tools and services an organization already uses. The platform is available in the Pax8 Marketplace, giving MSPs a unified interface to monitor and respond across multi-vendor environments. Read the announcement on Business Wire [ Vistera ]: The Vancouver-based company on Tuesday unveiled a professional services platform powered by Vero, a multi-agent orchestration layer that Vistera says brings legal, HR, and finance expertise to Canadian SMBs in British Columbia, Alberta, and Ontario. Every output is reviewed by a senior Canadian-qualified professional before delivery, with outcomes priced at $700 each or through monthly plans. Learn more on Vistera [CrowdStrike]: Justin Bradley, senior alliances manager for MSSP aggregators at CrowdStrike, warned attendees at XChange August this week that the group behind Akira ransomware — referred to as Punk Spider — has increased attacks by 134 percent over the past year, specifically targeting SMBs through MSPs. The group buys VPN credentials on the dark web, uses MFA fatigue to gain access, and dumps Entra IDs before deploying ransomware. Read more on CRN [ConnectSecure]: The company on Tuesday added M365 Auto Remediation, AI-powered training assessments, and Patch 360 to its MSP platform, allowing providers to automatically remediate supported Microsoft 365 security findings across multiple tenants. Read more on Channel Dive [GTIA]: The Global Technology Industry Association warned at ChannelCon last week that customers are deploying AI faster than MSPs can deliver security and governance, and announced a new Managed Intelligence Alliance to develop standards and accreditations for AI services. Read more on Channel Dive [NetRise]: The company on August 3 launched its Discovery Partner Program to expand software supply chain security through MSSPs, VARs, and distributors. Read the announcement on PR Newswire [ Verizon ]: Channel chief and vice president of indirect partner sales Mark Tina is leaving the telecommunications company after 23 years to become vice president of national partner sales and distribution at health insurer Humana. Read more on Channel Dive Read Full Transcript Welcome to The Buzz from ChannelBuzz.ca, I’m Robert Dutt, today is Thursday, August 13, and here’s what’s happening in the channel today. Blumira on Tuesday launched Hearth, a vendor-agnostic AI command center that the company says can intelligently reason across security tools and services an organization already uses. According to Blumira, the platform is designed to unify visibility and response across the workspace without requiring a rip-and-replace approach, giving lean IT teams a single interface to monitor disparate tools. Hearth is available in the Pax8 Marketplace, positioning it for MSPs that provision through that platform. Blumira is pitching the offering as a way to reduce tool sprawl and alert fatigue for teams that lack enterprise -scale resources. A unified reasoning layer across multi-vendor stacks could cut down on the context-switching that slows incident response for Canadian MSPs, though the value will depend on integration depth and the accuracy of the AI-driven reasoning. Vistera on Tuesday unveiled a Canadian-built professional services platform powered by Vero, a multi-agent orchestration layer that the company says brings legal, HR, and finance expertise to small and medium-sized businesses at a predictable cost. The Vancouver-based company is targeting Canadian SMBs in British Columbia, Alberta, and Ontario with outcomes priced at $700 each or through monthly plans, a fraction of the typical hourly rates at large firms. According to Vistera, every output is reviewed and signed off by a senior Canadian-qualified professional before it reaches the client, with credential verification and regulatory standing checks built into the workflow. The platform handles intake, research, and preparation through AI agents while preserving human oversight for final judgment. Canadian MSPs should watch how this model lands, as it could create new partnership opportunities around SMB advisory services or introduce competitive pressure in the professional services space. CrowdStrike this week warned attendees at XChange August that prolific ransomware groups are specifically targeting MSPs and their SMB customers. According to Justin Bradley, senior alliances manager for MSSP aggregators at CrowdStrike, the group behind Akira ransomware — referred to as Punk Spider — has increased its attacks by 134 percent over the past year with an emphasis on SMBs. Bradley said the group’s typical strategy involves buying VPN credentials on the dark web, then using MFA fatigue to gain initial access, escalating privileges, and dumping Entra IDs before deploying ransomware. He also noted that CrowdStrike is tracking two break-off groups from Scattered Spider, dubbed Cordial Spider and Snarky Spider, which have been known to impersonate MSPs to trick customers into launching remote access tools. The intelligence underscores the urgency for Canadian MSPs to harden identity controls and monitor for MFA abuse, particularly as credential theft continues to fetch thousands of dollars on dark web markets. In Brief – ConnectSecure says its new M365 Auto Remediation tool lets MSPs approve and automatically apply fixes across multiple customers for supported Microsoft 365 security findings. The Global Technology Industry Association warns at ChannelCon that customers are deploying AI faster than MSPs can secure it, and says it is launching a Managed Intelligence Alliance to set standards for AI services. NetRise says its new Discovery Partner Program will expand software supply chain security through MSSPs, VARs, and distributors. Verizon confirms channel chief Mark Tina is leaving after 23 years to become vice president of national partner sales and distribution at Humana. Full details and links in the show notes or the blog post. That’s how we’re seeing the headlines today. I’m Robert Dutt for ChannelBuzz.ca, thanks for listening. Have a great day.

  ListenShow Notes
• 

  ChannelBuzz.ca

  The Buzz: Expel extends MDR to AI attack surface, Huntress warns on autonomous adversaries, and Myriad360 crosses $1 billion

  Aug 12, 20264 min

  Today’s headline news for Canadian IT solution providers: Expel MDR for AI attack surface: Expel has launched what it says is the first managed detection and response service covering the full AI attack surface, extending its SOC capabilities to threats launched with AI, employee AI misuse, and exposure inside AI systems themselves. The company announced the expansion at Black Hat 2026, adding an Anthropic Claude integration that pulls enterprise compliance signals and prompt content into Expel’s detection pipeline. Expel’s operators work the prompt content itself to surface intent, not just activity, and the company has mapped its detection library to 13 of 16 MITRE ATLAS tactics. Expel Huntress CEO on autonomous adversary: Huntress CEO Kyle Hanslovan is warning that autonomous, AI-powered attacks have moved from theoretical concern to active reality. In an interview with CRN, Hanslovan cited OpenAI’s disclosure that its AI agents compromised the Hugging Face platform during testing, as well as subsequent Anthropic disclosures about its Claude Mythos 5 model, as evidence that autonomous hacking is already happening. Huntress, which recently crossed $250 million in annual recurring revenue , has built its business around protecting smaller organizations that lack enterprise-scale security teams . CRN Myriad360 acquires F3 Technology Partners: Myriad360 has acquired the assets of F3 Technology Partners, a Connecticut-based healthcare IT solution provider, pushing the combined organization past $1 billion in estimated annual revenue. While Myriad360 is U.S.-based, the firm services the Canadian market through its global logistics and international business operations. F3 brings deep healthcare vertical expertise to Myriad360’s portfolio, reinforcing a trend of mid-market consolidation that is creating a new class of “Super-VARs” with the scale to compete for multinational enterprise business. CRN Nutanix MCP server: Nutanix has released an open-source MCP server for the Nutanix Cloud Platform, enabling AI assistants including GitHub Copilot, Claude Code, and Cursor to automate cloud operations through the Prism v4 API. The move follows Ingram Micro’s MCP server launch for its Xvantage marketplace and reflects growing channel investment in the Model Context Protocol as a standard for AI-tool integration. Nutanix Halo AI Studio and MCP push: PSA vendor Halo unveiled AI Studio and MCP integrations at XChange August, giving MSPs tools to build AI agents for service desk, sales , customer success, reporting, and quarterly business reviews. The company also launched an MCP server to act as a central interface across MSP tools. Halo partner John Douglass of Pileus Technologies said the AI Studio capabilities are “a game changer” for automating service delivery. CRN CRN Annual Report Card winners: CRN announced the winners of its 2026 Annual Report Card at XChange August, with solution providers grading vendors across 23 technology categories. Notable winners included HPE in cloud computing and servers, Nvidia in GPUs, Exabeam in AI security, and Scale Computing in hybrid cloud infrastructure. Complete scores will be published on CRN.com on October 5. CRN Liquidware CommandCTRL 1.5: Liquidware launched CommandCTRL 1.5 with AI-powered endpoint diagnostics and browser-based remote control across Windows , macOS, Linux, and thin clients. The update adds AI Insights that interpret endpoint telemetry and extends remote support capabilities to browser-based sessions without requiring a client installation. Liquidware Read Full Transcript TRANSCRIPT TO COME

  ListenShow Notes

Recent guests on ChannelBuzz.ca. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.