Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

MSPs are used to blocking malicious domains, detecting suspicious IP addresses, and continuously updating their defenses against emerging threats. However, what happens when attackers can shift their infrastructure in near real-time without interrupting the campaign? The ErrTraffic campaign, analyzed by the WatchGuard Threat Lab, provides an example of how malware distribution techniques are evolving.

Security teams are managing more endpoints, identities, networks, and security events than ever. Each control adds valuable protection, but the work of connecting its signals, explaining incidents, and deciding what needs attention often falls to analysts. That is why the next evolution of WatchGuard ThreatSync and Rai Analyst matters. ThreatSync provides the foundation for cross-product detection, correlation, incident management, and coordinated response.

The rise of AI tools in the workplace has put Shadow AI firmly on the cybersecurity agenda. Employees are increasingly adopting AI services without IT or security approval, potentially creating security, privacy, and compliance risks. But focusing on Shadow AI alone misses the bigger issue. The real question is not just which AI tools employees use, but whether organizations understand what is happening across their entire SaaS environment.

Every MSP has heard the question in some form: how do you know this actually works? For most security products, the honest answer is a mix of vendor documentation, analyst reports, and your own experience. All useful, but none of it is a verdict from someone with no stake in the result. Spain’s public sector works differently. When government agencies there buy security products, they look to CPSTIC, a catalog run by Spain’s National Cryptologic Centre (CCN).

When MSPs evaluate MDR services, the conversation usually starts in the same place: Tell me about your SOC and how quickly you respond. Those are good to know, but they don't tell you one thing that determines whether the service works: how much of your clients' environments the provider can see and act on. A SOC that's available 24/7 but only watching half the environment isn't protecting your clients. It's giving your clients a false sense of security.

If you're an MSP or MSSP, you've probably had some version of this conversation with a customer: “We just found out we need to comply with NIS2, DORA , HIPAA, PCI DSS... What do we need to buy?” It's a fair question. It's also usually the wrong first question — and answering it well is where you create real value for your customers.

For years, companies treated shadow IT primarily as a policy and control problem. Employees have always found and used technology outside the approved IT stack, from unauthorized endpoint applications and browser extensions to personal cloud services. It left a trail: an install, a device on the network, something a scan or an agent could eventually catch. From there, an analyst had to investigate the finding and assess the risk before deciding how to respond.

Security is built on the small decisions we make each day. That’s why Cybersecurity Awareness Month 2026 focuses on the habits that make life harder for attackers—such as using strong passwords, enabling multi-factor authentication (MFA), recognizing and reporting scams, and keeping software updated. However, security awareness must also address the risks that arise when employees introduce new applications and services into their work.

At IMPACT North America, WatchGuard showcased a simple idea with significant implications for managed security: the next phase of cybersecurity AI is not only about helping people work faster. It is about expanding what the security operation itself can do. Today, that next evolution of Rai is generally available. Rai is WatchGuard’s agentic AI Digital Workforce, built specifically for MSPs and embedded in WatchGuard Cloud.