Executive summary
In a recent Tech Talk, our team met with a global managed services and security provider to talk through AI, cybersecurity, and compliance as-a-service. The conversation covered where clients are getting stuck (“we need AI, but we don’t know what that means”), when it makes sense to shift responsibility to a partner, and how assessments and managed services can work together for growing organizations.
Key takeaways
- Most leaders say, “We need AI,” but still need help defining specific use cases.
- A strong managed services partner uses AI both internally and inside client environments.
- Security and compliance demand more than point tools — they require ongoing management.
- The provider’s sweet spot is sophisticated small and midsized businesses, plus midmarket firms that are growing or facing regulatory pressure.
- Compliance-as-a-service and GRC support can open doors with larger, multi-site and regulated clients.
- Advisors play a key role in qualifying opportunities and matching clients with the right level of support.
Why this Tech Talk topic matters now
Across our client base, conversations about AI, cybersecurity, and compliance are blending together.
Leaders are asking questions like:
- “Where do we start with AI?”
- “How do we secure employees who are using public AI tools?”
- “Do we have the right controls in place for our auditors?”
- “Should we keep managing all of this in-house?”
At the same time, internal IT and security teams are stretched thin. Some organizations are losing key staff and are left without documentation, clear ownership, or a roadmap.
That’s where a managed services partner can help — but only if you understand what they actually deliver, who they serve best, and where the handoff lines sit.
This Tech Talk gave our team an updated view so we can guide clients with more confidence.
Two paths to AI: How the partner approaches artificial intelligence
Our partner described AI as a two-pronged effort: how they use it to deliver services, and how they enable AI safely inside client environments.
- Using AI internally to deliver better managed services
First, they looked at the tools they already use for managed services — especially security tools — and how AI inside those platforms feeds their service platform.
Key points from the session:
- Existing security tools already include AI and machine learning.
- Those tools feed into a central IT service platform, where AI helps engineers work faster and more accurately.
- Clients can see the same data and activity through a portal, improving transparency.
This internal use of AI isn’t flashy, but it matters. It affects ticket handling, detection speed, and the quality of day-to-day support clients receive.
- Enabling AI in client environments
The second AI prong focuses on client use cases.
The provider offers two main paths:
- AI within a familiar productivity ecosystem
- A large Microsoft engineering team helps clients decide if tools like Copilot make sense for their use cases.
- They can manage associated security tools such as Defender, Sentinel, and related services.
- Private generative AI hosted in a secure cloud
- A managed, private generative AI platform hosted in a cloud environment such as Azure.
- Can use different large language models based on the client’s needs.
- The provider helps define use cases, connect the right data, and wrap governance and security around the solution.
- Additional security controls can restrict use of public AI tools so staff prefer the secure internal option.
The emphasis: There is no single “AI product” that fixes everything. The real work is use case discovery, data strategy, and governance.
Cybersecurity and managed services: Shifting responsibility, not just buying tools
On the security side, the partner’s fastest-growing revenue stream is managed cybersecurity. While they began as a managed services provider, security is on track to overtake traditional services.
Key themes from the discussion:
- They focus on clients who want to shift management responsibility, not just purchase licenses.
- They bring a curated stack of security tools — including endpoint protection, SIEM, and monitoring — that their teams are trained on.
- Rather than trying to manage every tool on the market, they concentrate on a smaller set of platforms that support a multi-tenant, service-provider model.
A helpful analogy from the call:
If you hire someone to mow your lawn, you don’t tell them which brand of lawnmower to use — you just want the job done well. In the same way, this partner can replace a client’s current security tools with their own stack so they can manage outcomes effectively.
For infrastructure (firewalls, switches, servers), they can usually take over management, especially when the hardware is from mainstream vendors. For more specialized software, they prefer to provide and manage their own solutions rather than inheriting every one-off product.
Who they serve best: Sophisticated small and midsized businesses and growing midmarket firms
The Tech Talk made it clear that fit matters.
This partner does especially well when:
- The organization has around 50 or more users and is ready to invest in strong IT and security.
- Compliance requirements or complex networks are pushing them to mature their environment.
- They want to offload day-to-day management so internal teams can focus on strategy.
- They are outgrowing a very small, local MSP and need a provider with broader reach and deeper benches.
Some real-world examples they shared:
- A multi-site healthcare organization with about 1,400 staff across 14 states.
- A lending institution with staff in the U.S. and several hundred employees overseas, requiring local presence and global support.
They also support clients with:
- A 24×7 security operations center model.
- A “pod” support structure, where a dedicated team supports each client so it still feels like a smaller MSP relationship.
- Regional presence, including staff and many existing customers in major U.S. markets.
On the flip side, very small organizations driven only by price — with limited regulatory pressure and low complexity — are usually not a good fit for this level of service.
Compliance and GRC: Compliance-as-a-service and managed assessments
Compliance came up repeatedly in the discussion.
Through an acquired U.S.-based security and compliance arm, the partner can provide:
- Managed compliance services focused on governance, risk and compliance (GRC).
- Support for frameworks like SOC 2 readiness and CMMC, among others.
- Use of multiple GRC tools, selected based on the client’s needs.
- A strong track record with legal firms and financial institutions, where audit and compliance are front and center.
These services can be:
- Delivered standalone as compliance-as-a-service.
- Combined with broader cybersecurity and managed services for a full program.
For clients in banking, wealth management, private equity, legal, and healthcare, this blend of managed security and compliance is especially attractive.
Getting started: Assessments, projects, and managed services
One practical question from our team: “Can a client start with a small engagement to test the relationship?”
The partner’s answer was thoughtful:
- They try to lead with assessments, such as:
- IT operations assessments
- Cyber risk assessments
- Due diligence projects
- These are one-time engagements that often uncover gaps and naturally lead into recurring services.
- Simple installation-only “rack and stack” work without a larger roadmap or follow-on plan is less likely to be a fit.
For organizations in transition — such as those who have lost internal IT staff — the partner can use assessments and discovery engineering to:
- Gain access to the environment
- Document systems, sites, and dependencies
- Baseline against standard frameworks
- Recommend a path into co-managed or fully managed services
What this means for leaders considering managed services, AI and compliance
If you’re weighing whether to bring in a managed services and security partner, this Tech Talk highlighted key questions to ask:
- Do you want to shift responsibility for outcomes, not just tools?
- Are you facing pressure from auditors, regulators, or your board?
- Has your environment outgrown a small local IT provider?
- Are you struggling to define specific AI use cases and secure them?
- Would an independent assessment give you clarity on gaps and next steps?
Our role as advisors is to help you answer these questions and decide whether this type of partner is right for your organization — and if so, where to start.
Next steps for business and IT leaders
If you’re exploring managed services, AI, cybersecurity, or compliance support, our team can:
- Facilitate a focused conversation with our managed services partner.
- Help you decide whether to start with an assessment or a managed offering.
- Compare options side by side and explain trade-offs clearly.
- Align the solution with your size, growth plans, and regulatory needs.
To schedule a meeting for your organization, contact our team at 877-599-3999 or sales@stratospherenetworks.com.
