ChannelBuzz.ca

ChannelBuzz.ca
  • 0.0(0개의 평가)
  • IT 뉴스
  • 매일

Cutting through the noise for Canadian VARs and MSPs

  1. 14시간 전

    The Buzz: Barracuda confirms attacks on email gateway flaws, Hatz AI raises $24M, and Xen Orchestra flaw is exploited

    If you manage or resell Barracuda appliances, today’s top story needs your attention: the company has confirmed that attackers are exploiting two flaws in its Email Security Gateway that can be chained for root access. Meanwhile, Hatz AI has raised a $24 million Series A for its MSP AI platform, and attackers are exploiting a critical flaw in Xen Orchestra to take over XCP-ng virtualization hosts. Those are the top stories in Friday’s edition of The Buzz from ChannelBuzz.ca. The Buzz is brought to you in part by Fortinet Canada. Fortinet XPERTS26 Canada runs November 22–27, offering Canadian partners hands-on technical training in cybersecurity. Learn more and register here. Barracuda confirms attackers are exploiting Email Security Gateway flaws Barracuda has confirmed that attackers are exploiting two vulnerabilities in its Email Security Gateway, flaws that can be chained to give an attacker root control of the appliance. According to BleepingComputer, Barracuda updated its advisory Monday to say exploitation has hit a small number of organizations. The company hasn’t said who is behind the attacks. The flaws are CVE-2026-116606, an authentication weakness that lets an attacker modify the appliance’s global configuration, and CVE-2026-111560, a command injection bug in the timezone setting that runs commands as root. The command injection flaw also affects Barracuda’s Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway products. Barracuda released patches about a week before confirming the attacks, and says some customers may already have them through automatic patching. SecurityWeek covered the flaws on November 4, based on Mandiant advisories, and rated the authentication bypass 9.3 and the command injection 8.6 on the CVSS scale. At that point, neither advisory reported exploitation. The sources also differ on one detail: Barracuda says administrative interface access is required for both bugs, while Mandiant says the authentication bypass can be exploited without authentication. For MSPs that manage or resell Barracuda appliances, start with an inventory. Confirm the right patch is installed on every affected product, turn automatic patching back on if it was disabled, and restrict admin interfaces to trusted internal networks, as Barracuda recommends. Because the flaws are being exploited, check devices for signs of compromise rather than assuming a patch settles it. SecurityWeek notes ESG appliances have been targeted before, by Chinese cyberspies exploiting a 2023 flaw, so tell customers what you checked. Hatz AI raises $24M as its MSP partner network triples Hatz AI, the platform that helps managed service providers sell and govern AI for their customers, has raised a $24 million Series A as its partner network grows. Channel Insider reports the round was led by Josh Schertzer, a partner at Nadia Partners and former Blackstone CTO, with participation from Vestigo Ventures and The Private Shares Fund. Hatz says its active MSP partner count tripled year over year and revenue grew even faster. Headcount has gone from 14 to nearly 60, and the partner network spans thousands of MSPs across all 50 U.S. states, nine Canadian provinces and nine countries. Hatz positions its platform as an “AI control plane” that lets MSPs deliver branded AI services while managing security, governance, spending and access to multiple foundation models. The company says it has issued more than 15,000 AI certifications. Its Activate offering, launched in August, helps providers assess customer AI readiness and spot shadow AI risk, and Hatz Spaces, launched earlier this month, adds collaborative AI workspaces under MSP-managed controls. The new money will go toward automated model routing, benchmarking, engineering infrastructure and expanding its forward-deployed engineering, research and optimization teams. “By giving MSPs full control over governance, spend, and deployment,” CEO and co-founder Jimmy Hatzell said, small businesses can become AI native. For solution providers, the funding is one more sign that managed AI is becoming a category of its own. Channel Insider cites Informa’s 2026 MSP 501 research, in which 57 percent of MSPs expect AI to be among their largest revenue growth areas in the next year, but also Nerdio research finding only 12 percent reported measurable productivity gains from AI. If you’re weighing a platform, ask how it handles governance and who owns the customer relationship. Attackers exploit Xen Orchestra flaw to take over XCP-ng hosts Attackers are exploiting a critical authentication bypass in Xen Orchestra, the management console for XCP-ng virtualization hosts, and a second related flaw has no fix yet. BleepingComputer reports that Vates, the project’s maintainer, tracks the bug as VSA-2026-062. It has no CVE identifier or CVSS score yet. A remote attacker with network access to the management interface can send a crafted authentication cookie containing an empty JSON object and be logged in as the owner of an existing token, with no credentials. From there, Vates warns, an attacker can act with admin privileges, run code on managed pools and take over an XCP-ng node as root. The flaw was reported by Filip Magic and Christoffer Olsen of TDC NET Security. Vates has confirmed active exploitation and published indicators of compromise, including connections to a specific IP address, a virtual machine named “pivot2,” VMs set to file-based serial output, and several cron files on hosts. The Hacker News notes that VirusTotal flags the IP as a RedLine Stealer command-and-control server, that it’s unclear when the activity began, and that a related flaw, VSA-2026-063, is reportedly used alongside it. That second bug lets a privileged user upload a crafted VM image to compromise a host, and no fix was available at the time of reporting. Fixed versions are Xen Orchestra 6.9.1 and 6.10.0, or xo-server 5.211.2 and 5.213.1. For MSPs and VARs running XCP-ng, whether for their own infrastructure or for customers weighing alternatives to VMware, update now, restrict the console to a dedicated management network, and hunt for the listed indicators. Vates says exploitation leaves no trace in logs, so watch HTTP traffic for the crafted cookie, and rotate secrets if you suspect compromise. In The Channel: If you missed it, Huntress and Ingram Micro executives were on yesterday’s episode: How Huntress and Ingram Micro plan to grow the Canadian MSP security market Read Full Transcript Welcome to The Buzz for Friday, November 13, 2026. I’m Robert Dutt, and here’s what’s happening in the channel today. If you manage or resell Barracuda gear, today’s top story needs your attention. Barracuda has confirmed that attackers are exploiting two flaws in its Email Security Gateway. Plus, Hatz AI has raised twenty-four million dollars for its MSP artificial intelligence platform, and attackers are taking over virtualization hosts through a flaw in Xen Orchestra. Up first, Barracuda has confirmed attacks on two vulnerabilities in its Email Security Gateway, and together they can give an attacker root control of the appliance. BleepingComputer reports that Barracuda updated its advisory on Monday to say a small number of organizations have been hit. The company hasn’t said who is behind the attacks. One flaw is an authentication weakness that lets an attacker change the appliance’s global configuration. The other is a command injection bug in the timezone setting that runs commands as root. That second flaw also affects Barracuda’s load balancer, message archiver, web application firewall and web security gateway products. Barracuda released patches about a week before it confirmed the attacks, and says some customers may already have them through automatic patching. SecurityWeek covered the flaws on November fourth, based on advisories from Mandiant, and at that point nobody had reported exploitation. The sources also disagree on one detail. Barracuda says an attacker needs access to the administrative interface for both bugs, while Mandiant says the authentication bypass can be exploited without logging in. So what should you do? If you manage or resell Barracuda appliances, start with an inventory. Confirm the right patch is on every affected product, turn automatic patching back on if it was disabled, and limit admin interfaces to trusted internal networks, as Barracuda recommends. And because these flaws are being exploited, check the devices for signs of compromise instead of assuming the patch settles it. SecurityWeek notes these gateways have been targeted before, by Chinese cyberspies using a twenty twenty-three flaw, so tell your customers what you checked. Next, Hatz AI has raised a twenty-four million dollar Series A as its partner network grows. Channel Insider reports the round was led by Josh Schertzer, a partner at Nadia Partners and a former Blackstone CTO, with Vestigo Ventures and The Private Shares Fund also taking part. Hatz says its active MSP partner count tripled over the past year, and revenue grew even faster. The company has gone from fourteen employees to nearly sixty, and says its network spans thousands of MSPs across all fifty U.S. states, nine Canadian provinces and nine countries. Hatz describes its platform as an “AI control plane,” a way for MSPs to deliver branded AI services while managing security, governance, spending and access to multiple AI models. It says it has issued more than fifteen thousand AI certifications. The new money is earmarked for automated model routing, benchmarking, engineering infrastructure, and more forward-deployed engineers. CEO and co-founder Jimmy Hatzell said that giving MSPs full control over governance, spend and deployment makes it possible for small businesses to become, in his words, AI native. For solution provider

    The Buzz: Barracuda confirms attacks on email gateway flaws, Hatz AI raises $24M, and Xen Orchestra flaw is exploited

  2. 1일 전

    How Huntress and Ingram Micro plan to grow the Canadian MSP security market

    Kevin Hallmark, head of global distribution at Huntress Cybersecurity vendor Huntress is looking to expand its reach in the Canadian IT channel through a new distribution arrangement with Ingram Micro, bringing its managed security platform to a broader community of managed service providers and value-added resellers. The companies announced the Canadian expansion in October, extending an existing U.S. relationship that now covers Canada, Latin America, and the Caribbean. For Huntress, which has historically built its business through direct relationships with MSPs, distribution represents an opportunity to reach additional partners, including traditional VARs that may not operate managed services businesses. For Ingram Micro, the agreement adds another managed security offering to its Canadian portfolio, backed by the distributor’s technical resources, enablement capabilities, and established partner relationships. In this episode of In The Channel, Kevin Hallmark, head of global distribution at Huntress, and Alistair Edmondson, director of advanced solutions at Ingram Micro Canada, join ChannelBuzz.ca to discuss what the relationship means for Canadian partners. Hallmark explains that Huntress’s focus remains on making enterprise-grade security accessible to businesses that lack the resources to operate their own security operations centres. The company’s platform combines technology with a 24/7 security operations centre staffed by security professionals and supported by AI capabilities. While MSPs remain central to Huntress’s business, Hallmark says Ingram Micro also provides an important opportunity to reach VARs serving customers that maintain their own IT and security operations. He identifies organizations with approximately 50 to 2,500 seats as a particularly relevant target market, although Huntress also supports larger environments. Alistair Edmondson, director of advanced solutions at Ingram Micro Canada Edmondson, meanwhile, says Canadian partners are increasingly looking for ways to reduce security complexity and help customers manage the growing volume of alerts and telemetry coming from their environments. He says Ingram Micro’s role goes beyond providing another procurement option. The distributor is already quoting and transacting Huntress solutions in Canada and has resources available to support partners through onboarding, technical enablement, demonstrations, proofs of concept, and their first transactions. The opportunity extends to partners that may not yet have mature managed security practices. By drawing on Huntress’s security operations capabilities, those partners can potentially offer managed protection without the significant expense of building and staffing their own SOC. The discussion also explores where Huntress fits alongside other technologies in Ingram Micro’s portfolio, including Microsoft-focused solutions, and how the company’s expanding security platform could create additional opportunities for partners. Huntress recently announced further platform innovations, including capabilities designed to turn intelligence gathered from attacks against individual customers into broader protections across its customer base. Hallmark discusses how that approach shapes the company’s ongoing product development. In this episode: Why Huntress is expanding its Ingram Micro distribution relationship into Canada How distribution can help Huntress reach both MSPs and traditional VARs What makes a good Huntress partner, and where the company sees its sweet spot How Ingram Micro plans to support Canadian partners with training, technical resources, and business development Where Huntress fits into broader security offerings and Microsoft-focused partner practices How Huntress’s expanding platform supports the delivery of managed security services What success could look like for the two companies in the Canadian market Listen to the full conversation with Kevin Hallmark and Alistair Edmondson to learn more about the companies’ plans and the opportunities they see for Canadian IT solution providers. Read Full Transcript Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news, information, and analysis to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. Huntress has made a name for itself in the cybersecurity market by helping MSPs deliver enterprise-grade security without having to build and staff their own security operations centres. Now, the company is expanding its distribution relationship with Ingram Micro into Canada, opening up new opportunities to reach both managed service providers and traditional value-added resellers. But what does distribution add to a business that’s historically worked directly with MSPs? What kinds of Canadian partners is Huntress looking for? And how does Ingram plan to help those partners build and grow their security businesses? To explore these questions, I’m joined by Kevin Hallmark, head of global distribution at Huntress, and Alistair Edmondson, director of advanced solutions at Ingram Micro Canada. We discuss the opportunity in Canada, the different roles VARs and MSPs can play in delivering managed security, and how Huntress’s expanding portfolio fits into the picture. Let’s get right into it, my chat with Kevin Hallmark and Alistair Edmondson. Robert Dutt: Gentlemen, thanks for taking the time. I appreciate it. Kevin Hallmark: Thank you, Rob. Robert Dutt: Kevin, let’s start off with Huntress itself. For partners who aren’t particularly familiar with the company, can you give us the elevator pitch, as it were, for Huntress? What you do, where you fit into the security market, and what kind of partners you’re working with today? Kevin Hallmark: Yeah, absolutely. So Huntress has been around for 11 years. Primarily in our history, we’ve supported MSP partners directly. In the last year and a half, we’ve started expanding our reach through channel relationships, and that’s a large part of the reason that we’re here with Ingram Micro today. But we offer a 24/7 AI-centric SOC. We like to use that term because we’re definitely not an AI-only SOC. We have world-class threat researchers, we have world-class security engineers, world-class security analysts, and that kind of 24/7 SOC service is really what we’re selling, with those individuals protecting the businesses that use our service all day, every day. Robert Dutt: Now you’re expanding your distribution relationship with Ingram Micro into Canada. It seems silly to say why Canada, but why now? And what do you see as the particular opportunity here, both writ large, the Canadian market, and with the Ingram Micro relationship in particular? Kevin Hallmark: There’s a lot of reasons. I think the core response here is that distribution gives us access to more businesses. So obviously, distribution is giving us access to an enormous network of partners who service a much larger segment of the businesses that we aim to protect. Why Canada? There’s a lot of reasons, obviously. There’s a lot of business in Canada. There’s a lot of availability. I think Alistair can talk probably a little bit more to the scale there. But the service itself is really, like I said, we’re backed up and led by this group of world-class security analysts, which is primarily an English-speaking service. Canada represents an enormous market for us in that regard. Robert Dutt: Alistair, from Ingram’s perspective, what attracted you guys to Huntress? One of the great truths of the channel is there’s no shortage of security vendors in the market. What does Huntress bring to your Canadian partner community that you think is particularly compelling? Alistair Edmondson: Yeah, I think a lot of Canadian partners, we talk to them all day long, every week, and a lot of them are really talking about reducing complexity. There’s so many alerts and telemetry that come off endpoints, and they’re really looking for a provider that can help sort some of that out, on the MSP side specifically. And best-in-class technology. We’ve seen from afar what Huntress has been doing in the market, and we’re super happy to have them on board at Ingram. Robert Dutt: Kevin, Huntress has relationships with MSPs, including in Canada already. What does working with Ingram change for you? I’m curious, with new distribution deals, there’s always the balance between reaching new partners and an opportunity to support the existing base better or differently. I’m curious how you guys are approaching that and thinking about that as you launch the deal into Canada. Kevin Hallmark: Yeah, I won’t go too deep into the distribution benefits, but ultimately, distribution does, of course, give you standardization and scale. There’s all of those benefits as it relates to existing and future customers of ours, or partners of ours. The MSP aspect, I will also add that Ingram doesn’t just sell to MSPs. There’s a large reseller base out there as well that I think Ingram, I’d say from our perspective, is providing a significant inroad into that VAR space as well. Robert Dutt: Alistair, from Ingram’s point of view, what are you guys bringing to a Huntress partner beyond the obvious of distribution, another way to purchase the technology? Basically, how do you envision helping partners to build and grow their Huntress business and their security practice writ large? Alistair Edmondson: Yeah, I think for Huntress, they get access to a lot of partners in the ecosystem in Canada. We deal with the vast majority of them. I think what partners get from us is a team that has subject matter experts. We’re ready to transact today. We know how to enable partners on Huntress. We have technical resources behind it. So helping partners anywhere from onbo

    How Huntress and Ingram Micro plan to grow the Canadian MSP security market

  3. 1일 전

    The Buzz: N-able patches N-central zero-days, Huntress backs incident responders, and Microsoft names partner award winners

    If you run N-central, today’s top story needs your attention: N-able has released an emergency hotfix after a researcher published working exploit code for dozens of flaws, and took its hosted service offline to respond. Meanwhile, Huntress is offering breached businesses 60 days of free protection through incident response firms, and Microsoft has named the winners and finalists of its 2026 Partner of the Year Awards. Those are the top stories in Thursday’s edition of The Buzz from ChannelBuzz.ca. The Buzz is brought to you in part by Fortinet Canada. Fortinet XPERTS26 Canada runs November 22–27, offering Canadian partners hands-on technical training in cybersecurity. Learn more and register here. N-able patches N-central after researcher publishes exploit code for 33 flaws N-able has released an emergency hotfix for its N-central remote monitoring platform after an independent security researcher published proof-of-concept exploit code for 33 alleged vulnerabilities, forcing the company to take its hosted service offline. The researcher, Sean Bales, posted the code to GitHub late Sunday under the name Able2Shell. Huntress says the flaws can be combined into at least four exploit chains leading to remote code execution or privilege escalation, and BleepingComputer reports one demonstrated chain can create an administrator account with attacker-controlled credentials. N-able took its hosted N-central environments offline Monday and advised on-premises customers to do the same. On Tuesday it released N-central 2026.4 HF2 (build 2026.4.1.26), which Tenable notes fixes seven CVEs rated 8.3 to 9.3 under CVSS 4.0. N-able says hosted environments are upgraded and back online, and on-premises customers should apply the hotfix before restoring internet access. A follow-up hotfix is expected. N-able told Cybersecurity Dive it hasn’t seen active exploitation, though it is aware of scanning activity tied to the published code. The Hacker News reports watchTowr saw exploitation attempts against its honeypots. The disclosure is contested. Bales told BleepingComputer he skipped notifying N-able because, he says, the company never fixed bugs he reported in another product months ago. N-able says the claim it ignored responsible disclosure is inaccurate and that these flaws weren’t reported through its channels. CEO John Pagliuca said publishing exploit code before customers can act “hands attackers a head start.” For MSPs: confirm on-premises servers are on HF2 before they return to the internet, review login and authentication activity since November 8 as Huntress recommends, and check for administrator accounts you didn’t create. It also follows exploited N-central flaws fixed in August and September, so it’s a fair moment to ask how exposed your management tools are. Huntress offers breached businesses 60 days of free protection through IR firms Huntress has launched an Incident Response Engagement Program that lets participating incident response firms deploy its platform for clients at no cost for 60 days, during and after a cyberattack. The aim is to close the gap between containing a breach and being protected against a repeat. Attackers often return through lingering identity weaknesses, stolen credentials and misconfigurations, Huntress says, and the surge in AI-driven attacks is overwhelming IR firms with cases. The initial program focuses on business email compromise and identity-based attacks. Responders can use Huntress’s managed identity threat detection and response, which monitors around the clock for suspicious logins, compromised sessions, credential theft and OAuth abuse. Identity security posture management flags misconfigurations, excessive privileges and weak authentication policies, and verifies fixes before an engagement closes. A lookback feature examines up to six months of identity activity for earlier compromises, and Huntress’s SOC keeps dedicated Slack channels open with IR partners during incidents. “Recovery and protection must go hand in hand,” said Tuan Nguyen, Huntress’s VP of channels and alliances. The program builds on Huntress’s cyber insurance offering with Acrisure, available to eligible US customers and partners. The program targets incident response firms rather than MSPs directly, but the end-of-engagement handoff is where MSPs come in. Huntress says businesses can move from remediation to continuous managed protection once an incident is contained. If you run Huntress, or serve a client just through a breach, ask how that transition works and who owns monitoring once responders leave. Microsoft announces 2026 Partner of the Year winners and finalists Microsoft has announced the winners and finalists of its 2026 Partner of the Year Awards, ahead of next week’s Microsoft Ignite conference. The awards span seven global categories: Cloud and AI Platforms, Security, AI Business Solutions, Industry, Partner Innovation, Business Transformation and Social Impact. Microsoft says this year’s honourees show what it calls Frontier Transformation in practice, pairing Microsoft Cloud and AI with industry expertise and customer relationships. Partner announcements say the winners and finalists were chosen from more than 4,500 nominations worldwide. Several honourees have Canadian ties. Insight Canada took the Canada country award, and Insight Enterprises won the global Scale Solutions award and the Americas Channel award. Toronto-based Softchoice was a Scale Solutions finalist. In distribution, Arrow won the global Distributor award, and TD SYNNEX was a Distributor finalist and is listed in the Commercial Device Channel category. Honourees will be celebrated at Ignite, November 17 to 20, including during the Frontier Transformation Partner keynote on Wednesday, November 18, from 9:00 to 10:30 a.m. PT. The full list is on Microsoft’s winners page. Microsoft’s structure also includes country-level recognition, and this year added a regional tier covering the Americas, EMEA and Asia. When it opened nominations, Microsoft said winners and finalists receive customized logos, PR templates and recognition collateral, plus visibility around Ignite. That makes the next few days a good window to put the recognition in front of customers. With Ignite days away, expect more Microsoft partner news to follow. Read Full Transcript Welcome to The Buzz for Thursday, November 12, 2026. I’m Robert Dutt, and here’s what’s happening in the channel today. If you run N-central, you’ll want to hear today’s top story. N-able has released an emergency hotfix after a researcher published working exploit code for more than thirty flaws, and the company took its hosted service offline to deal with it. Plus, Huntress is offering breached businesses sixty days of free protection through incident response firms, and Microsoft has named the winners and finalists of its twenty twenty-six Partner of the Year awards. Up first, and if you use N-central, this one needs your attention today. N-able has released an emergency hotfix for N-central after an independent security researcher published proof-of-concept exploit code for thirty-three alleged vulnerabilities in the remote monitoring platform. The researcher, Sean Bales, put the code on GitHub late Sunday night, under the name Able2Shell. According to security firm Huntress, the flaws can be chained together into at least four different attacks that lead to remote code execution or privilege escalation on an N-central server. And BleepingComputer reports that one of the demonstrated attacks can create a brand new administrator account, with credentials the attacker controls. The response was immediate. On Monday, N-able took its hosted N-central environments offline, and advised customers running N-central on their own servers to take those offline as well. On Tuesday, it released N-central twenty twenty-six point four, hotfix two. N-able says hosted environments have been upgraded and are back online, and on-premises customers are being told to apply the hotfix before they put those servers back on the internet. Now, this isn’t necessarily over. N-able says it hasn’t seen active exploitation, but it is aware of scanning activity tied to the published code, and the security firm watchTowr says it saw exploitation attempts against its honeypots. Hotfix two fixes seven of the vulnerabilities, and a follow-up hotfix is expected with further security updates. There’s also a public argument over how all this came out. Bales told BleepingComputer he didn’t notify N-able first because, he says, the company never fixed bugs he reported in a different product months ago. N-able says the claim that it ignored responsible disclosure is inaccurate, and that these new vulnerabilities weren’t reported through its established channels. CEO John Pagliuca put it bluntly: publishing exploit code before customers can act, he said, hands attackers a head start. So what does this mean for you? If you run N-central on premises, confirm that server is on hotfix two before it goes anywhere near the internet again, and be ready to patch again when the follow-up lands. Huntress recommends reviewing login and authentication activity going back to November eighth, and since one of the demonstrated attacks creates a rogue admin, check for administrator accounts you don’t recognize. If you’re on the hosted service, keep an eye on N-able’s status page, and consider telling your customers what you’ve checked. And it’s worth remembering that your RMM platform touches every customer you manage. This follows exploited N-central flaws that were fixed in August and September, so it’s a fair moment to ask how exposed your management tools really are. Next, Huntress is going after the moments right after a breach. The company has launched an Incident Response Engagement Program, which lets participating inciden

    The Buzz: N-able patches N-central zero-days, Huntress backs incident responders, and Microsoft names partner award winners

  4. 2일 전

    Fortinet’s Robert May: Why cybersecurity partners need to think beyond individual technologies

    Robert May, executive vice president of technology and product management at Fortinet Cybersecurity partners face a growing challenge: Customers increasingly need integrated solutions that bring networking, cloud, security operations, and other technologies together, but building the expertise to deliver those solutions takes time, resources, and careful choices about where to invest. For Robert May, executive vice president of technology and product management at Fortinet, the biggest skills gap isn’t necessarily expertise in individual security products. It’s understanding how those products work together to solve customers’ broader operational and business challenges. In this sponsored episode of In The Channel, May joins ChannelBuzz.ca to discuss how the technical demands on cybersecurity partners are evolving, where partners should focus their investments in skills, and how developing deeper expertise can open new business opportunities. A central theme of the conversation is the importance of building outward from existing strengths. Rather than attempting to become experts in every emerging technology, May suggests partners look first at their current customers, established capabilities, and the adjacent areas where they can deliver additional value. Fortinet’s Engage Partner Program provides a framework for developing those specializations. The discussion also explores the growing role of managed security services. As organizations struggle to find and retain specialized security talent, partners have opportunities to deliver more sophisticated capabilities, including by building services around security operations resources provided by vendors like Fortinet. May also offers a preview of XPERTS26 Canada, taking place in Montreal November 22–27. The event brings Fortinet’s technical partner community together for hands-on workshops covering secure networking, security operations, cloud, operational technology, and AI security. He explains how the event draws on real-world engineering experience, why its practical labs are designed for experienced technical professionals, and how activities such as the Ultimate Fabric Challenge help foster a community of learning among partners. The conversation closes with advice for Canadian VARs and MSPs planning their next investments in technical expertise, and a look at the flexibility partners will need as AI continues to reshape the cybersecurity landscape. Partners interested in developing their capabilities can learn more through the Fortinet Training Institute and explore the agenda and participation requirements for XPERTS26 Canada. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news, information, and analysis to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show. Cybersecurity is getting more complicated, and so is the job of being a cybersecurity partner. It’s no longer enough to be an expert in one particular technology or product. Increasingly, customers are looking to partners to understand how different technologies work together, how to integrate them into a broader security strategy, and how to turn all of that into meaningful business outcomes. But for partners, particularly smaller VARs and MSPs, there’s a challenge there. How do you build the technical expertise customers need without spreading your resources too thinly? Where should you specialize? And how do you turn those investments in skills into opportunities for growth? Those are some of the questions we’re exploring today with Robert May, executive vice president of technology and product management at Fortinet. In this sponsored edition of In The Channel, we’ll discuss the changing demands on cybersecurity partners, the growing role of managed services, and how partners can make smart decisions about developing their technical capabilities. We’ll also take a look at Fortinet’s XPERTS 26 Canada event, taking place in Montreal later this month, and how its hands-on training approach fits into the company’s broader partner enablement strategy. Let’s get right into it. My chat with Robert May. Robert Dutt: Robert, thanks for taking the time. I appreciate it. Robert May: Thanks so much for having me. Robert Dutt: I want to take this opportunity to talk a little bit about technology, technology enablement, and building up the skills that partners need. The Fortinet portfolio has expanded a lot. No surprise, because the cybersecurity attack surface has expanded a lot as well. How has that changed what’s expected of a partner by customers today? What do partners need to be good at today that perhaps wasn’t so important just a few years ago? Robert May: As you mentioned, the technology has expanded significantly. Partners now need to understand how the different pieces fit together so they can become a trusted advisor for the customer. End customers are also struggling with a lack of skills and resources, so they need to rely on partners as an extension of their team. For the partner, they need to know a lot more different components than they did in the past. If I’ve got 10 or 20 different products in my security operations, I need to string these together into an operation or workflow. That’s the level where partners can really help customers build those integrations, do things efficiently, add automation, and so forth. It’s really understanding that end-to-end picture. Robert Dutt: How do you find partners are doing? Acknowledging there are going to be some who are probably ahead of the game and some who are lagging behind, as a collective group, how would you say partners are doing on getting that platform message and being able to communicate and integrate that whole story for customers? Robert May: It’s an evolution. People don’t usually like to pitch or present stuff they’re not comfortable with, but they start to see the need to do that because the things they’re selling, or that they’re more traditionally comfortable with, connect to a lot of other technologies that they need to talk about together as one solution. I think customers today are asking for solution-based projects, not individual components. The partners are moving that way, but it takes time, of course. Robert Dutt: Selling on outcomes is something that’s gone across the channel. Does that speak to the solutions focus you’re talking about? Robert May: When you talk about outcomes, you usually go into business outcomes. Conveying the need for a new tehnology or solution to the management level. So that you’re putting in terms they understand, whether that’s how to make more profit, how to reduce operating costs and so forth. Certainly, it’s a matter of helping to translate from the technical to the non-technical, so to speak. Robert Dutt: I have to imagine that’s increasingly important because we’re seeing, with all the attention security is getting of late, a lot more attention from folks who aren’t necessarily directly, technically responsible for security, but ultimately, the C-suite who are responsible for the company-wide vision. Robert May: Certainly. You saw this inflection point during the pandemic, where suddenly there was a lot more attention and visibility at the board level and the C-level on, “What are we doing?” You saw a ramp-up in the hiring of chief information security officers across all types of industries. This brings a renewed focus from that top level, from people who are traditionally not technical. They want to understand, “What are we doing? How are we taking care of this thing I heard in the news?” And understand what the lower levels are doing about it. Robert Dutt: As partners are required to look at more areas of expertise, and as you’re expanding the areas you’re serving as the attack surface widens, I’m curious if there are any areas where you see a particular gap. Are there areas where partners haven’t gone as deep as a whole, and there might be a big opportunity to build expertise to round out that integration story they’re selling? Robert May: Historically, different partners come from different directions. They might come from the networking side, from the cloud, or from security operations. But these are all converging to a point where you need to at least have some knowledge in those other domains. If I’m a specialist in SD-WAN, I need to know how that’s going to impact security operations, what type of data they’re going to need to access, and how that feeds into my SIEM and other tools downstream. The knowledge has been highly concentrated in certain areas, and now they need to have that broader view. This is probably an area to focus on. Robert Dutt: What do you think are the best approaches for deciding the next area to work on or specialize in? Partners can’t necessarily become experts in everything. How do you make those decisions about where to specialize? How much should be based on customer feedback versus emerging market opportunities with new customers, versus building on adjacencies to their home base—the technologies with which they’re most familiar and comfortable? Robert May: In general, it’s going to start from that core knowledge. What’s the current customer base, and what are they telling you they’re missing or the next areas they’re evolving to? That’s a starting point you already have well established, and then it’s expanding out from there. For example, if it’s a customer focused on SD-WAN, you would want to start expanding into the SOC or into the cloud for areas connected to those SD-WAN deployments. Your customers will be telling you, “This is what we’re doing next,” and you can grow from that perspective. It covers all the different technologies we provide, of course, but again,

    Fortinet’s Robert May: Why cybersecurity partners need to think beyond individual technologies

  5. 2일 전

    The Buzz: Canadian cyber readiness declines, Netskope names channel chief, and Flashpoint launches agentic AI

    Only one in five Canadian organizations considers itself completely ready to manage a cyberattack, according to new research from Kyndryl. Meanwhile, Netskope has appointed an experienced global channel leader as it expands its partner ecosystem, and Flashpoint is introducing specialized AI agents to automate threat-intelligence workflows. Those are the top stories in Wednesday’s edition of The Buzz from ChannelBuzz.ca. Kyndryl finds Canadian cyber readiness falling despite growing AI adoption New Canadian findings from Kyndryl’s 2026 Readiness Report reveal a widening gap between organizations’ ability to detect cyber threats and their confidence in managing an attack. According to the research, only 20% of Canadian respondents say their organizations are completely ready to manage cyberattacks, down from 36% in 2025. At the same time, 79% say AI helps their organizations identify threats faster than traditional approaches, and 78% consider AI essential to effective cybersecurity operations. The research also finds that 65% believe AI is increasing the sophistication and scale of cyber threats, while 52% say cybersecurity risks are growing faster than their ability to address them. Kyndryl reports that 80% of Canadian organizations are deploying AI beyond pilot projects, although nearly half say their current AI strategy emerged without deliberate planning. The findings highlight an important distinction between identifying an attack and being prepared to contain it, maintain critical operations and recover afterward. For Canadian solution providers and MSPs, the results point toward opportunities in cyber resilience, recovery planning, operational continuity and AI governance, alongside traditional detection and prevention services. Netskope appoints Carrie Francey to lead global channel sales Netskope has appointed Carrie Francey senior vice president of global channel sales, placing an experienced technology channel executive in charge of its worldwide partner organization. Francey brings leadership experience from Microsoft, HPE, ServiceNow and Zendesk, and is also a co-founder of Women in Cloud. Her responsibilities at Netskope will span resellers, managed service providers, managed security service providers, cloud marketplaces and global systems integrators. The appointment comes as Netskope continues investing in its channel-led strategy around secure cloud and AI adoption. Earlier this year, the company introduced its Catalyst MSP/SP Program and Partner Orchestrator, designed to simplify service provisioning and provide more flexible commercial models for managed service providers. Francey’s appointment signals a continued focus on helping partners develop services and practices around Netskope’s security platform, rather than concentrating exclusively on technology resale. For MSPs and MSSPs, the potential opportunity lies in implementing, operating and managing security controls as organizations expand their use of cloud applications and AI. Flashpoint introduces agentic AI for threat intelligence Flashpoint has introduced Flashpoint Agentic AI, adding specialized AI agents to its threat-intelligence platforms. The new offering includes Agentic Hub within Flashpoint Ignite, combining natural-language investigations with purpose-built agents for intelligence briefings, alert setup, alert triage and priority intelligence requirements. Rather than simply summarizing information, the agents are designed to carry out defined multistep workflows. For example, an analyst can ask a question about an emerging threat and have the system investigate related vulnerabilities, exposed credentials, fraud activity and threat actors. Other agents can generate scheduled intelligence reports, translate monitoring requests into alert rules and help filter low-value alerts. Flashpoint emphasizes that findings remain linked to underlying intelligence sources, allowing analysts to review and validate the results. The company cites research finding that 65% of surveyed organizations identify alert noise and false positives as a challenge, while 55% report insufficient analyst bandwidth. For security providers and threat-intelligence teams, the announcement illustrates another application of agentic AI: automating recurring analytical work while keeping human experts responsible for interpreting findings and making decisions. In The Channel: Fortinet and Cisco Canada Later today on In The Channel, Fortinet’s Robert May discusses why cybersecurity partners need to think beyond individual technologies and consider how different security capabilities work together to protect customers. And if you haven‘t heard it yet, Tuesday’s episode featured Cisco Canada’s chief technology officer discussing why the biggest cybersecurity challenge may not be a lack of available technology, but how organizations use the tools they already have. Listen to the Cisco Canada CTO interview. Read Full Transcript Hello and welcome to The Buzz from ChannelBuzz.ca. I’m Robert Dutt, today is Wednesday, November 11, 2026. Today is Remembrance Day. Lest we forget. And here’s what’s happening in the channel today. And here’s what’s happening in the channel today. Today, new research finds Canadian organizations are becoming less confident in their ability to manage cyberattacks, even as AI improves threat detection. Netskope names a new global channel chief. And Flashpoint introduces agentic AI to automate threat-intelligence workflows. First up, Canadian organizations may be getting better at detecting cyber threats, but that doesn’t necessarily mean they’re getting better at surviving them. That’s one of the key findings from new Canadian data in Kyndryl’s 2026 Readiness Report. According to the research, only 20 per cent of Canadian respondents say their organizations are completely ready to manage cyberattacks. That’s down from 36 per cent in last year’s report. And the decline comes despite growing confidence in artificial intelligence as a cybersecurity tool. Seventy-nine per cent of Canadian leaders say AI helps their organizations identify threats faster than traditional approaches, while 78 per cent consider AI essential to effective cybersecurity operations. But there’s another side to that equation. Sixty-five per cent say AI is increasing the sophistication and scale of cyber threats, and 52 per cent believe cybersecurity risks are growing faster than their organizations’ ability to address them. So AI is simultaneously helping security teams identify problems and making the threats they’re dealing with more difficult. The research also found that 80 per cent of Canadian organizations are deploying AI beyond pilot projects. But nearly half of respondents say their current AI strategy developed without deliberate planning. That raises questions about whether organizations are moving quickly enough on governance, resilience and recovery as AI becomes more deeply integrated into their operations. Kyndryl’s argument is that identifying a cyberattack sooner isn’t the same thing as being prepared to manage it. Organizations still need to contain an incident, maintain critical operations, and recover when something goes wrong. And that’s an important distinction for the channel. For Canadian MSPs and solution providers, the opportunity isn’t limited to selling more detection technology. It’s also about helping customers understand their risks, establish recovery plans, strengthen operational resilience, and make sure they can keep running when preventive controls aren’t enough. Next, Netskope has named Carrie Francey its new senior vice president of global channel sales, bringing an experienced channel executive into the cybersecurity company’s worldwide partner organization. Francey has previously held leadership roles at Microsoft, Hewlett Packard Enterprise, ServiceNow and Zendesk. She’s also a co-founder of Women in Cloud, an organization focused on supporting women entrepreneurs and technology businesses. At Netskope, she’ll oversee global channel sales and work with a broad range of partners, including resellers, MSPs, MSSPs, cloud marketplaces and global systems integrators. The appointment comes as Netskope continues expanding its channel strategy around cloud security and secure AI adoption. Earlier this year, the company introduced its Catalyst MSP and service provider program, along with Partner Orchestrator, a tool designed to simplify provisioning and management for service providers. The program also introduced more flexible pricing and go-to-market options intended to make it easier for partners to build managed services around Netskope’s platform. Francey’s arrival gives Netskope a new leader to build on those investments. And it’s an interesting time to take over a security channel organization. As customers adopt more cloud applications and AI tools, their security requirements are changing, and many need help implementing and managing protections across increasingly complex environments. That creates opportunities for partners beyond the initial technology sale, including consulting, implementation, policy management and ongoing managed security services. Netskope is positioning its partner ecosystem as central to that strategy, and Francey will be responsible for helping turn those opportunities into sustainable channel businesses. And finally today, Flashpoint is introducing specialized AI agents to help cybersecurity teams manage the growing workload involved in threat intelligence. The company has announced Flashpoint Agentic AI, a new offering that embeds automated intelligence workflows directly into its existing platforms. The centerpiece is Agentic Hub, a new environment within Flashpoint Ignite that combines conversational AI with purpose-built agents. Rather than simply asking an AI

    The Buzz: Canadian cyber readiness declines, Netskope names channel chief, and Flashpoint launches agentic AI

  6. 3일 전

    Cisco Canada CTO: Cybersecurity’s biggest problem isn’t a lack of technology

    Cherif Gress, vice president and chief technology officer for Cisco Canada Canadian businesses aren’t necessarily suffering from a shortage of cybersecurity technology. They may be suffering from an inability to use that technology effectively. That’s one of the central findings of Cisco’s Relentless Defense report, and a key theme of this episode of In The Channel, featuring Cherif Gress, vice president and chief technology officer for Cisco Canada. The research found that 92 per cent of Canadian organizations experienced a material, business-disrupting cybersecurity incident in the past year. Yet only 13 per cent can update security controls in real time or near real time when new risks emerge, while 56 per cent take longer than a day. And despite increased investment, many organizations aren’t seeing better outcomes. Nearly half of Canadian respondents reported increasing cybersecurity spending over the past two years without seeing a corresponding reduction in incidents. For Gress, the challenge is often organizational rather than technological. Security tools need to be supported by clear governance, coordinated teams and established response procedures that allow organizations to act quickly when threats emerge. That’s particularly relevant for managed service providers. Gress argues that MSPs’ close relationships with their customers position them to address these challenges, helping businesses understand security risks in operational and financial terms rather than simply selling and managing technology. The conversation explores how MSPs and customers should establish responsibilities and preauthorize incident-response actions, why buying managed security services doesn’t eliminate a customer’s own obligations, and how providers can demonstrate value beyond deploying additional products. It also examines the growing role of AI and automation, including the risk that organizations could accelerate threat detection while leaving response processes stuck behind manual approvals. As Gress explains, the goal isn’t simply to make cybersecurity technology more capable. It’s to ensure organizations can actually take advantage of those capabilities when they need them most. Read Full Transcript Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. Canadian businesses are spending more money on cybersecurity. They’re investing in new tools, new capabilities, and increasingly, new technologies powered by artificial intelligence. But are they actually getting any better at defending themselves? New research from Cisco suggests the answer is complicated. The company’s Relentless Defense report found that 92 per cent of Canadian organizations experienced a business-disrupting cybersecurity event over the past year. Just 13 per cent say they’re able to update their security controls in real time or near real time as new threats emerge, and nearly half say they’ve increased their cybersecurity spending over the last two years, only to see the number of incidents remain the same. But perhaps the most interesting finding is that the biggest obstacle to better cybersecurity may not be technology at all. It may just be the organizations themselves. Cherif Gress, vice president and chief technology officer for Cisco Canada, joins us to discuss why organizational friction is preventing companies from getting the most out of their cybersecurity investments, and why simply buying more technology isn’t necessarily the answer. We also explore what this means for managed service providers, from helping customers understand cybersecurity in business terms to establishing clear responsibilities and response procedures before an incident occurs. And we look at how AI and automation are changing the equation, potentially accelerating security operations while introducing entirely new questions about governance and control. Let’s get right into it, my chat with Cherif Gress. Robert Dutt: Cherif, thanks for taking the time. I appreciate it. Cherif Gress: My pleasure, Robert. Thank you for having me. Robert Dutt: The Relentless Defense report paints a fairly concerning picture of cybersecurity preparedness, especially at this point in the game, including here in Canada. Before we get into the individual findings of the report, what was Cisco trying to understand with this research, and what surprised you most about the Canadian results? Cherif Gress: Excellent question. Thanks, Rob. I think fundamentally the research was trying to assess our security posture. It’s an international research study to assess 3,000 professionals. So we’re trying to get a feel for what security represents for them and how they’re positioned toward security, especially in the post-LLM era that we talk about, with these frontier LLMs. And the findings are quite interesting. I think what stands out in terms of the pertinence to the Canadian market itself is the fact that it’s not a lack of technology that’s causing the slowdown. The friction comes from internal structure, organizationally, in terms of the groups not working as a single unit to face these frontier attacks. So I think that’s the main resonating point that comes out of the study at this point. Robert Dutt: One of the more striking Canadian findings was that nine in ten, 92 per cent, I think it was, of organizations experienced a business-disrupting cyber event in the past year. That’s huge. That’s massive. What does that tell you about the state of cybersecurity in the Canadian business scene? Cherif Gress: I think what that tells us is attacks are moving fast, and faster than before. So the need to defend has to match that ability. And then we see it, and the Relentless Defenders are the ones that come out on top. Basically, they’re the organizations that have the ability to see all their assets, first of all, because it starts with visibility. The ability to see all your assets in one single pane of glass, and then having the structure and the governance in place to be able to operate as one unit when you’re facing these attacks. There are multiple different things that can be done from a security standpoint to be able to isolate, segment, and make sure your network does not completely fall out of shape in case of an intrusion. And this is the type of work that we do a lot with our customers. Robert Dutt: Something that caught my attention was the finding that just 13 per cent of Canadian organizations can update security controls in real time, or close enough to real time to make it count, when a new risk emerges. More than half take longer than a day. What’s slowing organizations down at this point? Cherif Gress: I think it’s the integration of tools. Buying all the different elements of security does not give you the speed required. It gives you tools. However, stitching them into a strategy, into a playbook, is important. Playbooks are huge when it comes to security, because when things go sideways, this is not the time to try to figure out a plan of how do we address this. This has to be already a page in your book that you execute. And I think that’s the major element. This is no longer if it happens, it’s when it happens and how you’re going to react to it. Organizations that are well-oiled from a structural perspective and can operate as one team, where the governance is preset and every team knows exactly what they need to do and when to do it in case an incident occurs, I think that’s what makes a difference. And this is where we see the numbers go down in terms of preparedness, because we’re stuck on the friction element and we’re trying to solve it with technology, when really additional technology is not going to help you there. And you’ve seen it, right? Some companies report that despite spending more on technology, the number of attacks and threats has not reduced. And it’s because they haven’t addressed the elements from an organizational standpoint as well. So they go hand in hand. Robert Dutt: Are we at a point where simply spending more money on cybersecurity, especially to your last point there, isn’t necessarily making organizations more secure? Cherif Gress: Absolutely. I think that’s one of the findings in the study. It’s organizing your existing assets in terms of security. What do your defences look like? What does the architecture look like? And not saying that you might not need additional things, but at least doing that already and aligning the organization behind these tools for those almost near-real-time changes, I think that’s the first step. And then you start building on top of that. If you do need additional controls and governance, you build up on that. But I think the alignment of the organization alongside the investment from a security standpoint, those are the fundamental elements that the study seems to indicate. Robert Dutt: That’s been something that a lot of channel partners, be they resellers or MSPs, especially in the MSP space, have been focused on for a long time, integrating those tools and creating a solution out of that which hopefully addresses problems. But I think you bring up a good point on the culture side of things, and making sure the customer is fully bought in, is fully invested, and is on board with the direction that you’re going. Cherif Gress: And I think this is where the MSPs can play an outstanding role, in the sense that they have the customer intimacy. So they need to allow themselves the permission to ask the right questions beyond the technology that they’re selling. How is that going to be operated? How is the playbook? Can they be an assistant? Some of these MSPs have extremely mature c

    Cisco Canada CTO: Cybersecurity’s biggest problem isn’t a lack of technology

  7. 3일 전

    The Buzz: Huntress uncovers deeper backup-server compromise, Devolutions expands PAM, and GTIA sees security growth

    Today’s headlines for Canadian IT solutions providers. Huntress finds deeper compromise of AhsayCBS backup servers Huntress has published new findings from its investigation into attacks against AhsayCBS backup management servers, revealing additional malware, persistence mechanisms and tools that could have enabled attackers to access sensitive backup infrastructure. The investigation builds on Huntress’s October reporting into exploitation of two AhsayCBS vulnerabilities, CVE-2026-105133 and CVE-2026-105134, which attackers chained together to bypass authentication and execute commands with SYSTEM privileges. The new research examines three compromised servers within a single organization, breached between October 8 and October 11. Investigators found five families of malicious webshells, including one capable of extracting encrypted code hidden within PNG image files and running it in memory. They also identified a second cryptocurrency miner, a Python-based implant designed to communicate with a command-and-control server, and various tunneling and remote-access tools. Perhaps most concerning for MSPs, Huntress also observed activity consistent with an attempt to retrieve credentials from a related Veeam backup environment. The company has not established that backup data was stolen, and the research should not be interpreted as confirmation of successful exfiltration. Ahsay has released hotfixes addressing the exploited entry point, including version 10.3.4.45 for version 10 installations and 9.15.2.70 for versions 7 through 9. However, Huntress warns that patching does not remove malicious software already installed on compromised servers. Organizations with potentially affected systems should investigate for indicators of compromise and consider rebuilding compromised hosts from trusted sources. The broader lesson for MSPs is that backup infrastructure itself can become a high-value attack target, particularly when it contains privileged access to other systems. Devolutions expands PAM into endpoint software management Montreal-based Devolutions has announced an expansion of its privileged access management platform, adding device enrollment and centralized software management capabilities intended to reduce the need for permanent local administrator privileges. The new functionality will allow IT teams to enroll devices from existing mobile device management environments and centrally approve, install and update software. Designed to complement tools such as Microsoft Intune, the capabilities will use Devolutions’ UniGetUI technology to manage software across multiple package-management systems. The announcement represents the first phase of the company’s endpoint privilege management roadmap. Devolutions has also been expanding its existing PAM functionality, including more granular administrative roles, dedicated auditing permissions, credential management integrated with remote connections, and time-limited privileged access approvals. For MSPs, the objective is to combine access controls with routine endpoint administration, reducing the number of tools and manual processes required to manage customer environments. The new device enrollment and software management features are expected to become generally available in December 2026. Existing Devolutions PAM capabilities are available now. GTIA research points to expanding cybersecurity opportunity New research previewed by the Global Technology Industry Association at ChannelCon EMEA suggests IT service providers are planning to expand their cybersecurity businesses as customer demand and AI-related security requirements grow. According to the North American findings from GTIA’s Channel Trends in Cybersecurity research, 76% of respondents plan to add new cybersecurity solutions over the next 12 months, compared with 65% in 2025. Nearly 60% plan to introduce AI-related cybersecurity solutions, with opportunities extending beyond traditional security products into AI governance, model and data protection, and acceptable-use policies. Half of respondents also reported revenue growth directly attributable to cybersecurity this year, with notable activity in identity, security management, cloud and data solutions. The findings suggest AI is becoming both a source of additional security risk and an opportunity for providers to build new services. GTIA also released its separate third-quarter cybersecurity tracker, identifying AI-generated attacks as a leading customer concern and continued gaps in the deployment of established security controls. For MSPs, the opportunity may be as much about helping customers establish practical security policies and governance as it is about selling additional technology. Read Full Transcript Hello and welcome to The Buzz from ChannelBuzz.ca. I’m Robert Dutt, today is Tuesday, November 10, 2026, and here’s what’s happening in the channel today. Today, Huntress uncovers new evidence of a much deeper intrusion into compromised backup servers. Canadian security vendor Devolutions is expanding its privileged access management platform. And new GTIA research points to growing cybersecurity opportunities for IT service providers. First up, Huntress has published new findings from its investigation into attacks against AhsayCBS backup management servers, and the activity appears to have gone considerably further than the cryptocurrency mining initially reported last month. Back in October, Huntress identified attackers exploiting two vulnerabilities in AhsayCBS, a platform used by MSPs and other service providers to manage customer backup operations. Those vulnerabilities allowed attackers to bypass authentication and execute commands with system-level privileges on vulnerable servers. The initial investigation uncovered malicious webshells and cryptocurrency miners. But Huntress has now examined three compromised servers in one environment, and found a much more extensive collection of malicious tools. These include five different families of webshells, a second cryptocurrency miner, and a Python-based implant designed to communicate with an external command-and-control server. One particularly unusual webshell was designed to hide encrypted malicious code inside PNG image files, then extract and execute that code in memory. That could allow malicious activity to resemble ordinary image traffic, making it harder to identify through conventional monitoring. Huntress also found tunneling tools, remote access software, and broad exclusions configured in Microsoft Defender. And perhaps most concerning for service providers, investigators observed activity consistent with an attempt to retrieve stored credentials from a related Veeam backup environment. Huntress hasn’t established that backup data was stolen, but the findings suggest the attackers may have been interested in more than simply using compromised servers to mine cryptocurrency. And that’s especially concerning when the compromised systems are responsible for managing backups and potentially have privileged access to other infrastructure. Ahsay has released hotfixes for the exploited vulnerabilities, and Huntress has verified that the version ten hotfix blocks the entry point it observed. But the company is emphasizing that applying a patch doesn’t necessarily remove malicious tools that attackers have already installed. For MSPs running AhsayCBS, the recommendation is to investigate potentially exposed systems for evidence of compromise, not simply assume that installing the update resolves everything. The broader lesson is that backup infrastructure needs to be protected and monitored as carefully as the production systems it’s intended to recover. Next, Montreal-based Devolutions is expanding its privileged access management platform to bring more everyday endpoint administration under the same security controls. The company has announced new device enrollment and centralized software management capabilities, marking the first phase of its endpoint privilege management roadmap. The idea is to address a familiar challenge for IT teams and MSPs. Organizations want to eliminate unnecessary local administrator privileges, but employees still need legitimate software installed, updated, and maintained. And that often creates friction between security requirements and the routine work of keeping systems running. Devolutions wants to bring those processes together. The upcoming capabilities will allow administrators to enroll devices from existing management environments, including systems such as Microsoft Intune, and centrally approve and manage software installations. The software management component uses UniGetUI technology, which brings together multiple software package managers through a common interface. That means IT teams could manage approved software without having to give users permanent local administrator rights simply to install or update applications. The new features build on Devolutions’ existing privileged access management capabilities, which include time-limited access approvals, credential management, session recording, and auditing. The company has also introduced more granular administrator roles, allowing MSPs and internal IT teams to separate responsibilities without giving every administrator access to sensitive credentials. For MSPs, the broader objective is to make privileged access management practical for smaller IT teams that don’t necessarily have the resources to operate complex enterprise security platforms. Now, the new endpoint enrollment and centralized software management features aren’t generally available just yet. Devolutions expects them to become available in December, while its existing PAM platform is available now. But it’s an interesting expansion of the privileged access management category, bringing the question of who can acces

    The Buzz: Huntress uncovers deeper backup-server compromise, Devolutions expands PAM, and GTIA sees security growth

  8. 4일 전

    D&H Canada sees double-digit growth as advanced solutions business accelerates

    Peter DiMarco, general manager, D&H Canada D&H Canada is seeing double-digit growth in 2026, driven in part by significant momentum in advanced solutions, as the distributor continues to invest in the people and capabilities needed to support an expanding Canadian partner base. Speaking with ChannelBuzz.ca at the company’s THREAD conference in Toronto, Peter DiMarco, general manager of D&H Canada, said the company’s performance has exceeded expectations, with growth in some advanced solutions categories running between 40 and 60 per cent. The results follow a year of investment and expansion. When we spoke with DiMarco earlier this year, he argued that companies willing to invest through uncertain market conditions would emerge in a stronger position. The distributor has also seen strong uptake from solution providers looking to expand the scope of their business with D&H. DiMarco said 262 partners have begun purchasing advanced solutions through the distributor this year, making partner acquisition one of the company’s biggest areas of progress. But growth isn’t the only issue on partners’ minds. Rob Brown, vice president of sales, D&H Canada Rob Brown, vice president of sales at D&H, said rising technology prices and supply chain pressures have become dominant concerns for Canadian resellers, many of whose customers are trying to stretch budgets that haven’t increased alongside hardware costs. For D&H, that has created opportunities to provide additional support, including inventory reservation programs that allow partners to purchase and hold products at current prices for future deployment. At the same time, D&H is expanding its focus on helping smaller solution providers pursue more sophisticated opportunities in infrastructure, cloud and AI, without requiring them to build all of those capabilities internally from the outset. DiMarco said the company has invested in additional sales resources and greater partner segmentation to maintain its high-touch approach as the business grows. Brown highlighted D&H’s Go Big AI initiative, which is designed to help smaller partners develop the skills and market knowledge needed to participate in emerging AI opportunities. The distributor is also expanding its Canadian Partnerfi community, which DiMarco said has grown from nine members to 50, with an emphasis on peer-to-peer collaboration, education and business development. In this episode of In The Channel, DiMarco and Brown discuss: What’s driving D&H Canada’s growth and where it’s finding new partner opportunities; How rising hardware prices are changing reseller conversations with customers; The distributor’s strategy for helping traditional SMB partners move into advanced solutions; How D&H is expanding its Partnerfi community while preserving its peer-to-peer focus; The role of AI in D&H’s own operations and its partners’ businesses; and What the company wants Canadian solution providers to focus on as they plan for 2027. Listen to the full conversation below. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news, information and analysis to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show. D&H Canada is having a strong year, with double-digit growth overall and even faster growth in advanced solutions. But as the distributor expands into more sophisticated technologies and works with a broader range of solution providers, it’s also trying to preserve the high-touch approach that has traditionally distinguished it in the SMB channel. At D&H’s THREAD conference in Toronto, I caught up with Peter DiMarco, general manager of D&H Canada, and Rob Brown, vice president of sales, to talk about how the business has evolved in 2026, what they’re hearing from Canadian partners, and where they see the opportunities ahead. We discuss the impact of rising technology prices on reseller and customer budgets, how D&H is helping partners move into advanced solutions and AI, and the growing role of its Partnerfi community. Let’s get right into it, my chat with Peter DiMarco and Rob Brown. Robert Dutt: Gentlemen, thank you for taking the time. Peter DiMarco: Pleasure to be here. Robert Dutt: Pete, when we talked back in February about the investments and ambition for the year, we talked about the idea that the companies willing to invest through uncertain times would come out ahead. We’re getting towards the end of the year. How’s that played out? What’s changed most significantly in the Canadian business since last we spoke, which was much nearer the top of the year than the end? Peter DiMarco: Yeah, so to answer your first question, it’s played out really well for us. We continue to grow at a double-digit pace. If you look at our advanced solutions space, that’s actually growing 40%, 50%, 60%, depending upon what category. That actually includes cloud as well. So everything has turned out, honestly, better than expected. We hired a bunch of resources. We had to put them in place and get them trained, and the onboarding and acceleration of those resources have helped fuel our growth for this year. The results honestly came out better than expected. Robert Dutt: Where are those hires, where are those resources centred right now? Peter DiMarco: Mostly, 100% in customer-facing and market-facing roles. So support teams, sales teams, team leads, operations managers, pre-sales engineers, and then a couple of field roles as well. Robert Dutt: All right. Rob, you’re now a year or so into the role of leading sales. I’m curious what you’re hearing from Canadian solution providers. Where are they finding opportunities, and what are they asking D&H to help them do that wasn’t maybe on the radar a year or two ago? Rob Brown: Sure. Well, the obvious answer is the supply chain challenges we have and some of the price increases that have plagued the entire channel and put pressure on customer budgets. It’s kind of shifted everything. And you’re right, a year ago, we really weren’t having this conversation. I’d like to say there’s never a good challenge I like to waste, because it’s an excellent time to offer value, right? So I think our general role in distribution, as a channel community as a whole, is to supply as much transparent information as we possibly can so that customers can make new decisions. They started their year with a budget. Their budget’s probably not going up, yet the prices went up by 10%, 15%, and sometimes even more than that. You might have a customer that needed 100 laptops, and now he can only afford to buy 80 with his budget. He still needs the other 20. What do you do? There’s a lot of value distribution and the ecosystem can supply in that type of environment to offset some of these challenges, add value, and give customers good answers from which to make solid business decisions. So I would say, in general, to answer your question, it’s the price changes. It’s dominating the conversation. They need technology. The legacy technology they have is not the technology they need to move forward. They need to be able to invest in some of these emerging, largely AI-based technologies, but there are budget constraints around pricing. Robert Dutt: How’s that conversation evolved over the course of the year? We had the initial RAMageddon shock. I’m just curious how you’ve seen resellers react to that and how the conversation has evolved. Rob Brown: It went from shock and awe to, “I’ve got to manage this process. I have no choice.” It’s funny how quickly you can adapt. The smart ones are adding value and telling customers, “The best price I can guarantee you is today, because I don’t know what tomorrow’s going to look like. I don’t know what supply’s going to look like tomorrow.” We’re likely going to be here for a while. I don’t think this is going to resolve itself by the new year. So you need to think about this thing long term. You need to talk to your finance teams about your budget long term, and you need to work with partners like D&H to help you overcome some of these challenges. We have a reserve warehouse. We’re more than happy and willing to put your inventory in it. We can buy and hold it at a current price and hold it for later, and we’ll project-roll that out for you. And one thing I can guarantee you is the price that we charge to buy and hold your product is a lot smaller than the price increase you’re about to incur. So there are answers out there. You just have to explore. And I think that once the resellers and the solution providers themselves realized the situation they were in, and once the shock wore off, it was into solution mode. Robert Dutt: You must have seen a lot of pickup on that offer, especially in the part of the year where quote validity was shrinking to hours, sometimes it felt like. Rob Brown: Yeah. Our reserve warehouse, if you walked through there, it’s a nice big warehouse, lots of space for us to grow. And our reserve inventory shelves were largely empty prior to this challenge. Now they’re stocked full. Robert Dutt: Peter, you touched on some of the growth areas a bit earlier, but can you elaborate a bit on where the growth is coming from today? Is it primarily more business with existing partners, bringing new partners into the fold, expanding the technology categories? Where’s the growth? Peter DiMarco: Great question, and it’s something that we look at often. I’d say it’s all of the above. Many new partner relationships. If I have to look at where we are more successful, or where we have faster success than I expected, it’s partner acquisition. So, for example, in the advanced solutions space, this year we’ve done business with 262 new advanced solutions partners. They hadn’t

    D&H Canada sees double-digit growth as advanced solutions business accelerates
모두 보기(20개)

소개

Cutting through the noise for Canadian VARs and MSPs

정보

  • 제작진
    ChannelBuzz.ca
  • 방송 연도
    2011년 - 2026년
  • 에피소드
    20
  • 등급
    전체 연령 사용가
  • 저작권
    Copyright © ChannelBuzz.ca 2026
  • 웹사이트 보기
    ChannelBuzz.ca