Browser Security and the AI Blind Spot MSPs Are Missing in 2025

Speaker A: We all react so quickly when we hear someone say something, when we see someone do something. Sometimes it's productive to take a moment and look a little more carefully and say, why did this person say this thing? What do I not understand about this situation? What am I not familiar with? Before rushing to judgment, The MSP has the ability to go to the end customer and say, hey, do you really know what your users are doing right now? If you think about the concept behind shadow AI, shadow AI isn't nefarious. It's not that the user is trying to call, the end user is trying to cause harm. They're not trying to cause harm. They're trying to do their. They're trying to do their job as efficient as possible. But that doesn't mean that's what's actually happening. The MSP has the ability to say to the customer, hey, you. You think your users are engaging in completely benign activity. And many of them are, but some of them are not. And they're engaging in dangerous activity as a means of getting their work done, but it's still dangerous activity.

Speaker B: What's the most important leadership lesson you have learned about keeping your team aligned during times of massive change?

Speaker A: Tell them what's going on and be very direct. They need to know what you're doing, why you're doing it, why it makes sense. If you don't have a vision that you can articulate, and if you can't convince your own team, you have to ask yourself, why is this the vision? If you can't pitch the idea successfully to your own team, you can't explain what you're doing, why you're doing it to your own team. You've got a lot of problem. A lot of problems.

Speaker B: Daniel, welcome to the show.

Speaker A: Thank you, Sunny. Nice to be here.

Speaker B: I appreciate you joining my podcast, Sunny. Silver linings. And we are here to talk about entrepreneurship, leadership, cybersecurity leadership, especially because that's the area that you have done, uh, amazing work. Uh, can we start with your entrepreneurial journey? Um, how did you get into this business?

Speaker A: Well, for me, it was a bit of a circuitous path. I studied engineering, um, and then did some work in finance for a little while, and then, um, discovered the bitcoin and crypto world and got interested in that and fascinated by that, and from that discovered the cryptography, the general cryptography world. And from that became interested in the cyber security world. Uh, so I would say a long journey. Um, but then I really realized what I like the most. And in that niche, our, uh, Company started as a company that makes encryption software for enterprise and over time transformed into a company that makes browser security for MSPs. And that's really where we found our true calling, our true home. So, uh, it took a long time. You know, I think that's a common story for entrepreneurs is that you, you start one place, you kind of move around from this place to that, you learn a lot of stuff along the way, and then you end up someplace else. And that's where you end up meeting with real success is after you've gone through a bunch of things that aren't exactly the right fit for you, for the person, the entrepreneur. Right. Uh, and aren't necessarily the right fit for the market. And then eventually you get there and you're like, oh, this is what I, this is what I belong doing. This is what we belong building.

Speaker B: Yeah. And you guys have done an amazing job because, um, when it comes to the browser security platform, you're well known in the industry. But I want to ask a little bit about the name, uh, Atacama, where that name comes from. Did I pronounce it correctly?

Speaker A: Yes.

Speaker B: So what, where did you get this? Uh, the inspiration for the name.

Speaker A: So the name is actually the name of a desert in South America in, uh, mostly in Northern Chile. And the desert is spelled with a C. The desert is spelled a T, a C, a M, A. And my wife and I were vacationing down there. Um, and this is actually the name. We figured out the name back when we were working on an encryption product. And the idea was it was supposed to be the data desert. And it was actually a really fitting name. And I discussed the idea of naming the company Atacama with my business partner, my, uh, co founder, Dmitry, who was our coo, and he liked the idea, but he suggested that instead of using a C in the middle, we use a K, which ended up being a great idea because it gives you some differentiation online. And also that domain name was available. So that's how we ended up with the name. And even though we now make a completely different product, we love the company name and we kept it. And it is often mispronounced and we don't mind. In fact, to us, it's a good laugh.

Speaker B: Yes. Yeah, it brings attention. It brings a, uh, lot more curiosity, uh, there. And I know traditional endpoint security stack. Right. So I've been in the MSP space. I started my MSP in New York City. You're raised in New York City as well. And. Yeah. So I started my MSP in 2003. You know, the security space, uh, evolved a lot in the last, especially 10, 15 years. But the traditional endpoint security still have a lot of challenges right there. There was a blind spot. And you, your solution is addressing that blind spot. Can you talk to us a little bit more about the challenges that you have seen in the security space? And what problem are you solving with your solution?

Speaker A: Well, I think you've actually identified it perfectly within the wording of your question. You use the word blind spot. Um, so you've asked exactly the right question. One of the main issues that not only MSPs, but any cybersecurity professional faces is the lack of visibility into what users are doing. And I want to be careful when I say that you're not looking for visibility in a way such that you're a big brother, right? You're not trying to spy on your users, but you don't want to. Who has the time for all of that? Right? What you want to know, uh, are, uh, the crucial factors that you want to know, the crucial factors in terms of activities that your users are in engaging in that could create risk. And you want to be able to go to your users and say, hey, please do not engage in that activity. And either you want to do that conversationally or you want to do that mechanistically, right? Um, that's what you want to be able to do. And if you're not aware of those factors, if you're not aware of those activities, you can't stop the users from stepping on their own toes. And the users don't want to create problems. They're not trying to create cybersecurity risks. They want to get their jobs done. They want to be able to work efficiently, and they want to be able to work efficiently and effectively and with as little impediment as possible. Right? So the idea, the biggest piece of our product is facilitating the MSP to get around those blind spots.

Speaker B: How is your product evolving in the AI era now? Uh, AI is everywhere and environments are changing with a lot of AI adoption within every company, including MSPs and their end customers. People are using ChatGPT, Cloud and all other LLMs. Uh, how are you seeing a different problem right now with this, uh, additional dimension of AI? And what are you doing at, uh, Atacama to address the new problem that is coming because of the AI visibility and, uh, requirements in terms of additional controls?

Speaker A: One of the issues in that context is that the usage of AI and the problems that it creates are quite broad. Right? So on the one hand, you have attackers using AI to make their attacks more powerful.

Speaker B: Right?

Speaker A: You have, everyone knows about this. You have a classic, uh, you have, you know, classic spear phishing campaigns that if you look back a few years ago, you could identify more readily that they were spear phishing because the, the email itself would be misworded. Right. Or be written, you know, clearly in a language originally that isn't English and mistranslated. Right? Now, all of those problems for the attackers, who may not necessarily speak English as a first language, all of those problems are gone. Because they could put that stuff into ChatGPT. But that's, that's just the basic stuff, right? That's just the basic stuff. There are a panoply of other concerns, you know, ranging from, you know, what are users putting into AI? Uh, right. Uh, because I think we're still in the Wild west days of where, you know, where does that information actually go?

Speaker B: Right.

Speaker A: Uh, and how much are we trusting these companies with our information? And should we be trusting these companies with our information? Uh, how much of the information that we are sending them happens to be, you know, PII or Phi or other sensitive information. Right. So you have not only problems related to attackers using AI for nefarious purposes, but also problems related to users inadvertently sending information up to AI, Right? Sending information to these, you know, to these AI companies that ought not be sent.

Speaker B: Right.

Speaker A: Or there's, you know, there's risk there. And that's just, that's just the beginning. Right? So, um, we're addressing both of those things with our product, and we're addressing them in a variety of ways. So a little bit to get into the details, it's probably a little bit out of scope for the duration of this podcast, but, um, our vision here is to make sure that we're addressing everything.

Speaker B: Daniel. I host a weekly AI call with MSP leaders. Normally about 50 people join. We do quarterly AI accelerator trainings to help them see, uh, the governance, uh, side of things as they are evolving and the go to market, how to monetize the new capabilities that are available in the marketplace today. But one common question that I keep hearing every week from MSPS during my MSP connection call, where a lot of innovator, innovative, uh, CEOs, MSP CEOs are joining. A common theme is shadow AI, that, hey, Sunny, my customers are using ChatGPT or Claude, without even talking to me. They just kind of created their accounts and they don't even know what their employees are putting in that LLM and My concern is as a trusted technology solution provider to my SMBs, this is my responsibility, this is my accountability and I'm at risk. How do I think through this where when information is added to LLM is gone, it's like out there, right? It could be a CFO using uh, these LLMs to do some P and L analysis. It could be there marketing team cleaning up their marketing, their client list, their prospects list to other IP that they have internally and they are just using LLMs without even knowing that once it's gone, it's gone. Shadow AI is keep coming up as a topic every week when we have these peer to peer conversations. I'm just curious how you are thinking about shadow AI and what do you have on your roadmap to help MSPs and their clients with shadow AI topic?

Speaker A: We're already doing that right now and that's a major issue across the entire, the entire security landscape. So a couple of things, right? And let's talk about where AI sits because it sits not only in the browser but also outside of the browser. Uh, if you look at something like Claude Cowork, that's outside of the browser and we extend our tentacles outside of the browser in those contexts. So let me be more specific. First of all, we will report to the MSP on um, which AI. We will report shadow AI to the msp. So to the extent that a user has signed up for some new AI service, right? We will report back to the MSP and say, hey, your users are using A and B and C and D. So that's the first step. That's the first step. But the second step to your point is what content is being sent to that AI. Uh, right, and we deal with that as well. We deal with that in a number of different ways, right? So we can block it all together, right? Let's say someone is dragging a file PDF file into chatgpt. M. Um, I click on chatgpt for no reason. But let's say, you know, a user has dragged a file on the ChatGPT, we can block that from happening altogether, right? Uh, we can, we can also deal with copy and paste. Let's say a user is pasting data into chat GPT that they ought not to be pasting, right? So we can block it, but blocking it isn't necessarily the right way to do it. We also offer the ability to warn a user, right? Say, hey, we see that you're doing this thing. Are you sure you want to be doing it? Did you think carefully before you did it? And then of course we're going to report on it back to the MSP and say, regardless of whether we're blocking or warning or allowing, we're going to say, hey, here is what the user did. And in particular, if there is some sort of PII in that blob of data that was uploaded, we're going to be able to say to the msp, msp, hey, here's what happened, right? Sonny uploaded a PDF, uh, I'm picking on you now. Sunny uploaded a PDF, uh, with uh, a bunch of sensitive information to, you know, XYZ AI and you know, we warned him about it, he decided to do it anyway. And maybe that's okay, maybe the company sanctions that, right? But you can't make the decision unless you know about it one way or the other.

Speaker B: When we think about the growth that, the opportunity that we have, right? Ah, as entrepreneurs, uh, it could be MSPs, it could be businesses out there. There is a huge uh, threat with this new technology and then there is an opportunity as well. M and things are changing so fast. One day one model releases a new model and then the other day US directive will stop them from making it available to the world. And the pace of change, the pace of change is a challenge. All dangers, all obstacles bring an opportunity as well. But the question that I have for you is growth versus scale. And this is an opportunity for MSPs to scale as well. With this new opportunity, the new marketplace, how can your product help MSPS scale in this new world? What are the actionable insights that you can share with MSP entrepreneurs where they're listening to us, how they can leverage this AI opportunity where the AI powered cybersecurity is key. What can they do today to make sure that they are able to bring in more leads, convert those leads at a better percentage or better scale to grow their msp?

Speaker A: That's a perfect question and in a certain sense hits on the heart of one of the best characteristics of our product. So I think we are the most intellectually accessible security product on the market. Insofar as the end customer, the MSP's customer, doesn't really understand what a firewall is or what it does, doesn't necessarily understand what EDR is or I mean they know, they know these things. They know the letters, right? They know you have to have edr, right? Like they get, they get that, but there's no, it's like too abstract for them. With us, as part of a, you know, periodic client health report, we give all of this information that is so incredibly easy to digest for the end customer. We're going to be able to say, we can say, we're not going to be, we can say, hey, look, your users are doing A and B and C and D. They have signed up for these AI services that you didn't even know about. Uh, they have, uh, all of these dangerous extensions installed in their browsers. They are, um, spending such and such amount of time on websites where they probably shouldn't be browsing. You know, they are, they have uh, uh, this user has terrific password hygiene, this user has horrific password hygiene. Right. And all of that stuff, uh, is intuitively understandable to the end customer. Right? So the msp, you know, goes to the head of the, of the business, the head of the customer. They serve. They serve. And they show that customer a printout from Atacama. They say, hey, look, here's what your users are doing and here are the items that we're protecting you against. And that makes it m. Much easier, much easier for an MSP to justify raising prices a little bit. Right? It makes it much easier for the MSP to say, hey, you know, why don't you refer us to one of your buddies? And look, going even further, it enables the MSP to say, hey, uh, to a prospect, a prospective customer. Try us out for a few weeks and let us install this Atacama thing. And then we're going to a truckload of data, uh, about what's going on and that clinches the sale. So I think in terms of being a sales tool, in terms of being a tool for growth, I think we're one of the strongest tools in the MSP's toolbox.

Speaker B: Yeah. So what I'm hearing you say is that if I'm MSP listening to this, um, I can start that conversation, uh, about browser security with my customers with the question that, hey, let me install it so that you can experience it. Uh, let me give you the solution to experience and where you can see that with the tool in place and without tool being in place, what is the delta, how it can help your business be more secure. Yeah, I'm just thinking of a real life example that if I'm MSP just kind of really listening to you, that I'm kind of looking for one or two questions to start that conversation. So I know you mentioned something as a question and I was trying to get, simplify it and clarify that for myself that if I'm msp, I'm, um, having this first call with SMB M Customer, uh, what questions I can keep in my toolkit to start that conversation and provoke that thinking to use this solution for more security and more scale.

Speaker A: So I think that the MSP has the ability to go to the end customer and say, hey, do you really know what your users are doing right now?

Speaker B: Yeah, that's a good question.

Speaker A: Yeah, but obvious, obvious question. Right. And, you know, I think a lot of, a lot of customers are going to say, of course I do. They're doing their work. Right. They're not going to do anything irresponsible. Right. And that's because people aren't trying to be irresponsible. There's nothing nefarious going on here. If you think about the concept behind shadow AI, shadow AI isn't nefarious. Right. It's not that people, it's not that the user is trying to call end users trying to cause harm. They're not trying to cause harm. They're trying to do their. They're trying to do their job as efficiently as possible, but that doesn't mean that's what's actually happening.

Speaker B: Right.

Speaker A: So you end up in a situation where the MSP has the ability to say to the customer, hey, you think your users are engaging in completely benign activity. And many of them are, but some of them are not, and they're engaging in dangerous activity as a means of getting their work done. Um, but it's still dangerous activity.

Speaker B: Yeah, the intent is right, but the impact can be negative. Uh, just because they don't know what they don't know and they are not given the tools to use what they need to use with, uh, AI, with Security First AI mindset, rather than just being AI first Professional, how can we give them tools and education and enablement where they are Security First AI professionals. So they're adopting AI with lot more security in mind. So one more question, uh, Daniel, uh, you as a, as a leader, uh, you navigated a major product pivot raised, uh, significant capital. What's the most important leadership lesson you have learned about keeping your team aligned during times of massive change?

Speaker A: Tell them what's going on and be very direct with them. They need to know. They need to know what you're doing, why they're doing it, why it makes sense. If you don't have a vision that you can articulate and if you can't convince your own team, you have to ask yourself, why is this division convincing your own team is in many respects the acid test. Not the only one, but in many respects. Right. If you, it's if you can't pitch the idea successfully to your own team, if you can't explain what you're doing and why you're doing it to your own team, you've got a lot of problems and a lot of problems. A pitch should work because it naturally makes sense to the listener. Otherwise, do you belong? Does that pitch actually, should that pitch actually be successful? Right. Uh, because if you, if the listener hears the pitch and says, what are you talking about? Right, Then you've got a problem. So be very direct with your team. Tell your team exactly what's going on. Tell your team why you're doing it. That's what we did, and that worked out pretty well for us. But it's not.

Speaker B: They didn't.

Speaker A: They asked questions. Of course they did. What about this? What about that? And I answered some and some, by the way, I don't know if I had the best answers to, because there are a lot of unknown. Unknown. Yep. Right. But you have to be overt and honest about that too. There's risk in everything that we do and you need to be as, uh, forthright as possible about all of the risks. And when I say as possible and identify as much as you can, you can't identify everything. But tell me.

Speaker B: No, well said. What I hear you say is having clarity, yourself, uh, as a leader, and then being able to clarify to your team what's your why, where you are, where you're going. So having your vision, clarity, having your why, clarity, and being able to articulate to the team where they get it. Like they have clarity and clarity creates speed. So it's really the word. And communication.

Speaker A: Probably. Yeah. By the way, Sonny, the way you said it, you know the why, right? That was that book by, uh, Sinek.

Speaker B: Yeah, Simon Sinek.

Speaker A: Yeah, yeah, Sinek. Sorry, um, forgive me if he's, uh, uh, Mr. Sinek, please forgive me if you're listening to this podcast for mispronouncing your name. Uh, right, it's just, you know, start with why, right? Explain, explain the reasoning. What is the purpose of this? Why you can't do that. You get a problem.

Speaker B: And so far you had a great journey and you have made a huge impact in the MSP channel. Uh, and I was at, um, one of the major conference last week in the west coast and I met your team, uh, like you're a well known brand now in our channel. And what I'm curious to know, Daniel, from you is, uh, looking ahead to the next two to three years. Where do you see the MSP Cybersecurity stack heading. What should our listeners be preparing for today?

Speaker A: Look, I mean obviously I'm going to say that uh, browser security is an essential component of the MSP security stack and that is becoming increasingly important. We are also offering AI visibility and AI controls. Others are offering that as well and others are offering browser security. But I think that those two things will be absolutely essential in the coming years. There's no doubt about that. By the way, that uh, doesn't diminish the importance of pre existing classic tools like edr. Nobody's saying that that's going away. All these things are becoming more important, um, in terms of other tools that are out there that are becoming important. I'm um, not necessarily seeing new tools per se. I think it's an emphasis on the importance of pre existing tools and operating those tools in the context of the, the emergence of AI. Right. So email security.

Speaker B: Right.

Speaker A: Uh, tools related to email security, they, they have existed for a long time, they will continue to exist. They need to be tuned properly to address threats that have emerged in the age of AI. So while it's not a different tool, it's a retuning or a continuous tuning of pre existing tools to deal with new threats. Got it.

Speaker B: And one more question and then we're going to close. Um, I run a program called Light by Design. I appreciate you sharing your leadership lesson because you have um, a lot of uh, life experience. Uh, you have gone, you have kind of, you know, your education is from the top, top schools, uh, including Columbia and, but life is the best university like after all. So my question to you is, what is the greatest life lesson you have learned? So this is, you know, forget about business, forget about our, like what are we, the problem that we're solving. It's more, more from the, at the human level. I want people to learn from Daniel's life experiences as a human being. What is the greatest life lesson you have learned so far?

Speaker A: Here's what pops into my head as you ask that question. I'm not sure it's the most important, but maybe it's the one that's the most on my mind recently. How about that? We all, we all react quick, so quickly when we hear someone say something, when we hear someone, we see someone do something. Sometimes it's productive to take a moment

Speaker B: and

Speaker A: look a little more carefully and say, why did this person say this thing? What do I not understand about this situation? What am I not familiar with before rushing to judgment and saying here's how I should react? What if we take an extra minute or two and say, all right, what information might I not have that if I were to have it would impact my reaction? Um, or alternatively, I am hearing this piece of information, I'm seeing this piece of information. I'm finding out about this thing. What is my own internal emotional reaction, and is that actually, uh, if I transform that internal emotional reaction into what I say or what I do in this moment, is that truly optimized? Or is it better if I take a minute, take a break, absorb the information, understand that my emotional reaction is X, and then say, okay, I'm not sure I want to articulate myself with all of that emotion. And instead maybe I want to think carefully about my response and say, in spite of the fact that this makes me angry, or in spite of the fact that this makes me upset, or in spite of the fact that this does not operate to my taste, how ought I react? Take an extra minute, do the extra thinking, take a deep breath, and don't react immediately. By the way, I'm not saying I'm good at that. I think I have realized how important it is and I strive to get better at it. But, uh, it's something that's been on my mind recently. Take an extra second. Um, so that, that's my, uh, my lesson. Not just to others, but to reiterate to myself on this Monday morning.

Speaker B: Thank you for sharing that. I'm going to take, uh, this clip and share with my boys, my kids, uh, that are in college, because they think they are more right now, know it all rather than learn it all, or they're more very quick in, uh, reacting, uh, to a conversation rather than responding. I'm going to just take this piece, a very valuable, uh, life lesson. Daniel, uh, I appreciate you sharing that. So what I heard you say is, when you are in that listening moment or someone is saying something to you, don't react immediately. Just take a pause, think a little bit more, think deeper, and then ask some curiosity questions to make sure that you hear what that person is saying. And don't basically react right away. Just take a pause, absorb the information, get more clarity by asking clarity questions, and then you respond by adding some additional dimension to that first word that comes to your mind in terms of your response. So, uh, listen generously, take a pause, ask, uh, questions if you need to. Don't react, but respond.

Speaker A: Sonny. That's exactly right. Yeah, that's exactly. And if we. If we all were to do that, and we all were to do that consistently, and by the way. It's hard. I think we have far less conflict in this world and we have more efficiency and more understanding amongst us. Tough to do, you know, I think it's important to strive towards it.

Speaker B: That's so good. Uh, we can. I mean, normally conflicts come from the person, uh, who we are having conflict is having that unmet need in terms of what they want and what they want you to hear versus what you're hearing. So there is misalignment. And I think what you just shared, that skill, the life skill, can also take a lot of conflicts to cohesiveness because you are showing up with your curiosity muscle rather than reacting or judgment muscle. So that can basically take care of lot of conflicts. Uh, and it can kind of turn a conflict into probably a fuel for cohesiveness and more breakthroughs because you are listening and focused on responding rather than reacting. Thank you so much, Daniel, for taking the time to join my show. I truly appreciate you as a collaborator and I look forward to seeing you in New York City at Build It Sunny.

Speaker A: Thank you so much. I look forward to seeing you as well. And it's been a pleasure speaking with you.

Speaker B: Likewise. Thank you for watching Sunny's Silver Linings. Don't forget to, like, share and subscribe. See you next time.