MSP Business School

A handful of useful observations surface - AI compressing exploit timelines below zero-day, shadow AI as the next shadow IT, the MSP-to-MIP framing - but they are buried under filler, mutual affirmation, and vague hand-waving. The episode rarely moves past acknowledging a problem to explaining how to act on it.

“there used to be a sort of zero day or infiltration plus 10 before something might happen. Well, now things are kind of happening before they even get on site. So there's less than a zero day impact.”

“the shadow AI is, I think you'd probably, God, if I was a business owner today, that would, I mean, you know, I would be that much more concerned”

The shadow-AI-as-shadow-IT parallel and the MIP reframe have some freshness, but neither is developed with first-principles rigour; both are borrowed from community conversations (GTIA). The rest is standard AI-changes-everything commentary with no contrarian or counterintuitive arguments.

“the managed service providers becoming really almost a managed information provider”

“tokens become the new oil, if you will”

Frank has genuine channel and vendor experience spanning Intel, Apple, and TD Synnex, plus current operational responsibility at a real vulnerability management company - so he is a relevant practitioner. However, his role is alliances and BD rather than hands-on technical security, which caps the depth of insight he can deliver.

“I manage our alliances and partnerships and sort of large accounts for NodeWare”

“long history around big companies like Intel and Apple Computer and Cynics. Before it was TD Cynics. So I've been around partnerships and alliances”

The only concrete example is a brief anecdote about a CISO planning to feed CMMC requirements into Claude - useful but undeveloped and data-free. No metrics, no named breaches, no remediation timelines, no customer outcomes, no pricing or ROI figures are offered anywhere in the episode.

“we had a customer discussion last week that we were approaching regarding the CMMC sort of surface, right? It's a big company, you know, and one of their CISOs actually just said it... Basically, we'll throw the compliance, the regulations into Claude and have that compare it to what we have internally”

“uploading, you know, customer lists, which may only consist of, you know, individual name and email address, but it's still contextual information in Massachusetts. That would be enough to be in violation”

The host frames the conversation as deliberately low-stakes from the outset and never challenges a claim, asks for evidence, or probes a mechanism. Questions are broad and leading, and the guest's product plugs go completely unchallenged. The dynamic is two friendly acquaintances agreeing with each other for 23 minutes.

“I don't think we're going to go so hardcore on, you know, things that we typically talk about, right?”

“I always learn a little something too, when you join me”