Written by Dan Candee, CEO of Cork Cyber
A few weeks ago I moderated a panel at the Canadian Risk Summit in Toronto. Before we started, I made one rule: anybody who said “AI” was getting fired off the panel.
I was joking. Mostly.
I wanted to hear what business owners would talk about once the buzzword was off the table. It turned into the best conversation of the trip. One panelist runs a demolition company. She blows up buildings for a living, and she told the room she feels more in control setting off explosives than she does about her own company’s security right now.
Email breaches. Phishing. Software everywhere. Employees who need to feel safe coming to work every day. That’s the weight our MSP partners carry for every client they serve.
The break-in point moved
Verizon has published its Data Breach Investigations Report for 19 years. This year, for the first time, exploited software vulnerabilities took the top spot as the way attackers get in: 31% of breaches, ahead of stolen credentials and phishing.
The fixes are getting slower, too. The median time to fully fix a known exploited vulnerability went from 32 days to 43.
Here’s how I think about it. Picture every client as a house. The RMM locks the front door, and MSPs do that well. So the bad guys stopped kicking in the front door to steal the family jewels. They come in through the dryer vent, the doggy door and the exhaust pipe on the roof.
That’s the software sitting on top of the operating system. The browser and its plugins. The PDF reader on the front desk PC. The remote access client nobody has touched in two years. The video game somebody installed on a company laptop. Attackers are using AI to find those gaps faster than any MSP can staff against them.
Two jobs wearing one name
We call all of this “patching,” and the word is doing too much work.
Job one is the operating system. The RMM owns it, updates arrive through one channel, and there’s a report you can put in front of a client.
Job two is everything on top. Dozens of vendors, dozens of update paths, no inventory and no report. A fleet can sit at 98% OS compliance and still be full of software attackers already know how to use.
Eleven months ago we decided Cork had to stop reporting on that second job and start doing it. In September we launched automated software vulnerability remediation. Cork finds the vulnerable software across every client, puts what’s actively being exploited first, and fixes it through the RMM the MSP already runs. No new agent. No second console. Nothing to rip out.
What partners did with it
Here’s what happened when we handed partners the keys. Since September 2:
50,000+ remediation runs across 200,000 devices
Most of it on autopilot, through schedules nobody has to babysit
97% of those schedules fix every vulnerability Cork can fix, not just the criticals
Partners scope it per client, to their financially protected clients, or across the whole fleet
That 97% is the number I love most. Partners skipped the one-app-at-a-time approach and pointed it at everything. Give MSPs clear controls and they will happily hand the routine work to the machine.
And the results:
A critical vulnerability at the average MSP stays open 1.5 to 2 months. On a Cork schedule it’s a couple of hours, under 1% of the old exposure window.
About 5,100 tech hours saved, roughly $250,000 of labor redeployed to other work. That’s at $48 an hour, so we kept it low.
We estimate about $1.5 million in potential ransomware losses avoided, modeled on published industry loss averages.
The hours are nice. They’re the by-product. The real win is the MSP owner who sleeps at night and gets the holiday weekend back.
What I’d tell an MSP planning 2027
There’s no cliff coming. Nobody needs a dramatic reinvention next year.
Partners don’t need to be building highways for their clients right now. They need to repaint the stripes on the roads, adjust the lines, and let people know where the passing lane is. Get the basics 3% better month over month: security awareness training, guardrails around AI use, and plain-language updates to clients about what you’re doing for them.
And don’t try to monetize something you don’t fully understand. Just go be of service.
We hold ourselves to the same standard. Nobody at Cork uses an unpaid, unmonitored AI tool. The guardrails are set, and we meet regularly to talk governance and trade what we’re learning. Security is job zero. AI and automation sit on top of it.
Lock the windows
Cork started because we wanted to fix financial protection and be of service to the channel. The mission hasn’t changed: keep money in people’s bank accounts where it belongs and not in the bad guy’s pockets.
So here’s my question for the MSPs reading this: what’s the one window in your clients’ houses you already know is open?