Dor Eisner is the CEO & Co-Founder of Guardz, a company helping MSPs protect SMBs and build a safer digital world.
For years, small and midsize businesses (SMBs) relied on being too small to notice. That assumption is now dangerously outdated.
AI enables attackers to target thousands of organizations simultaneously, identify the weakest entry points and execute high-volume “spray and pray” campaigns. Threat data from my company illustrates the scale: We tracked over 14,000 unique spray IPs per month targeting multiple accounts simultaneously, growing 13% month over month.
More telling than the volume is the quality. AI-generated phishing campaigns are now contextually accurate and personalized using real email history from previously compromised accounts. Many of the obvious signs that once exposed phishing attempts have largely disappeared.
As attackers weaponize AI to increase speed and scale, managed service providers (MSPs) are turning to agentic AI to fight back. By combining advanced triage and analysis with autonomous response capabilities, they can deliver continuous, real-time detection and response for SMB customers at machine speed.
The question most MSP leaders ask is not whether agentic AI works but whether it can be trusted to operate safely on behalf of clients. That hesitation is legitimate, and it’s exactly what this article is designed to address: what agentic AI actually does and how MSPs can govern it responsibly.
How Agentic AI Fits The SMB Security Gap
One of the main functions of MSPs is to provide access to enterprise-grade cybersecurity tools, along with the required specialized knowledge to manage them, for SMBs who find cybersecurity and high-level AI complex, costly and confusing.
The tools most MSPs have relied on were designed for a different threat landscape. They flag anomalies, but they don’t act. Every alert still lands on a human analyst. Modern campaigns are quiet, identity-driven and built to look like normal activity, and traditional tools were never built to catch that. Agentic AI changes the equation by ensuring humans spend their time on the decisions that require them. For MSPs, this creates an opportunity to provide sophisticated protection without requiring customers to hire specialized security teams.
By combining AI’s efficiency with human expertise, MSPs can ensure defenses are both robust and intelligently managed. As Harvard Business Review notes, human judgment remains essential when it comes to interpreting complex, high-risk situations, and that is precisely where MSPs add irreplaceable value.
High-volume, well-understood attack patterns are exactly what automated response is built for. But when an incident shows signs of being targeted and patient, when an attacker has been operating silently for days, reading emails and watching financial workflows before acting, a human analyst needs to be in the chair. The distinction isn’t about severity. It’s about whether the right response is already known or whether judgment is required.
Continuous And Autonomous
Keeping humans in control doesn’t mean keeping humans in the loop for every action. The key is that MSPs define the rules of engagement upfront, and within those boundaries, agentic AI can move at a speed no analyst team can match.
Agentic AI provides MSPs with around-the-clock, real-time monitoring of their clients’ networks. In practice, this means that when a security incident occurs, such as attempted data breaches, ransomware or phishing attacks, the AI agent can independently identify the threat, isolate the compromised system and block malicious activity. With MSPs firmly controlling how and when automation is applied, agentic AI can autonomously respond to incidents, reducing human error and accelerating response times.
Importantly, these agents should operate within MSP-approved scenarios, ensuring that high-impact responses, such as locking an account, are triggered only by defined risk thresholds rather than routine events like individual phishing attempts. For example, if a user account authenticates from two geographically impossible locations within an hour, the session is suspended automatically and the MSP is alerted. If an endpoint exhibits file encryption behavior consistent with ransomware, it is isolated from the network immediately.
Trust Through Transparency
Many SMBs are cautious about adopting AI-driven security, worried it might introduce new risks rather than reduce them. The antidote is transparency.
MSPs don’t just protect clients; they also educate them. The most effective approach is to address this before onboarding begins, not buried in legal language but as a plain-language section of the service agreement describing what the AI monitors, what it can do autonomously and what will always require a human decision.
Beyond that, SMB leaders should receive a regular summary that translates AI activity into business terms: threats detected, actions taken automatically and what was escalated and why.
As SMBs adopt AI tools across their own operations, they will increasingly look to their MSP not just for protection from external threats but also for help governing the AI inside their own walls, such as shadow AI exposure and data privacy risk.
From Reactive Provider To Strategic Partner
The bigger story here isn’t the automation. It’s what the automation frees MSPs to become and what makes that possible.
Most MSPs operate reactively today. Something happens, and they respond. As agents absorb the high-volume work, capacity opens up. But capacity alone doesn’t make an MSP a strategic advisor; the context does. An MSP whose agents have watched a client for a year, learned its rhythms and remembered every incident and every resolution can walk into a quarterly review with something no incident log provides: a forecast of where this client is exposed, what’s likely to come next and what to fix before it becomes a Monday morning problem.
That’s a different relationship. SMBs stop treating those MSPs like vendors and start treating them like partners who actually understand the business. The agents make the workload survivable, and the context makes the advice worth paying for. The question is which MSPs will build that context first.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?