Cybersecurity has gone through multiple transformations over the last decade, but as AI reshapes the threat landscape, solution providers are being asked to evolve once again.
In this episode of The Channel Angle, Cass Cooper sits down with Subramani Rao of Acronis about what cyber resilience really means and how MSPs can position themselves for the next wave of change.
Here’s a transcript of the conversation with Rao:
How has cybersecurity evolved from a purely technical function to a business strategy?
If you look at IT and cybersecurity, it moves in waves every three to five years. We started with big, powerful servers. Then came virtualization, followed by cloud migration. After that, we saw SD-WAN, SASE, and zero trust, especially during COVID when remote work exploded.
Each wave changed not just technology, but the relationship between humans and systems. Today, cybersecurity is no longer about how strong your firewall is. It’s about trust, reputation, uptime, and long-term business viability. That’s where cyber resilience comes in.
What does cyber resilience mean beyond traditional cybersecurity?
Cybersecurity focuses on protection. Cyber resilience focuses on survival and recovery. It asks: What happens when something goes wrong? How quickly can the business recover?
At the core is the CIA triad: confidentiality, integrity, and availability. The opposite risks are disclosure, alteration, and disruption. You can prevent attacks all day long, but if you can’t recover from disruption, your business still fails.
How is AI changing cybersecurity for MSPs today?
AI has already transformed security across three layers.
First is user security. We moved from simple antivirus to AI-driven EDR and XDR that look at behavior and patterns, not just signatures.
Second is device security, where tools like NAC, WAFs, and secure web gateways have evolved into AI-based threat engines.
Third is network security, which shifted from static firewalls to SASE and SD-WAN that dynamically choose the safest path to resources.
AI allows faster detection and response, but it still needs human-defined logic and oversight.
What’s the difference between AI and agentic AI?
Traditional AI is predictive and generative, but it still requires human input, playbooks, and rules. Agentic AI is outcome-driven. You tell it the goal, and it figures out how to get there using the tools it has.
I like to compare it to salespeople. One follows every process step by step. The other is told, “Close the deal,” and just does it. That’s agentic AI.
For MSPs, this means agents can monitor logs, quarantine users, and alert admins automatically. In some cases, they can replace parts of a SOC function. We’re also seeing marketplaces emerge where MSPs can rent pre-built agents instead of developing them from scratch.
How can MSPs prepare for agentic AI without massive investment?
Preparation doesn’t start with tools. It starts with understanding the business.
Step one is learning what’s critical and where the exits are, just like a fire drill. MSPs can offer asset classification, data labeling, and gap analysis services without deploying any AI at all.
They can assess compliance readiness, likelihood of incidents, and business impact using metrics like annual rate of occurrence and single loss expectancy. This consultative work is valuable and billable, and it sets the foundation for future AI adoption.
Why does the human factor still matter so much in cybersecurity?
Attackers don’t start with firewalls. They start with people. Humans are often the first point of compromise in the MITRE kill chain.
That’s why security awareness training must be mandatory at every level. Every employee is a security person, whether they like it or not. Technology, processes, and culture must align. If one pillar fails, the organization fails.
What’s the biggest takeaway for MSPs heading into 2026?
Cyber resilience is not a product. It’s a mindset. MSPs who can combine technology, advisory services, and human-centered security practices will be the ones who stand out. The future belongs to providers who help customers stay operational, not just protected.
