AI adoption promises significant business benefits, but what happens when governance, security, and costs struggle to keep pace? For MSPs, these concerns are part of a much larger cybersecurity conversation.
On this week’s MSP Influencer Primecast, Joey Pinz welcomes Rob Gregory, Chief Information Security Officer (CISO) at Optiv, to discuss the hidden costs of AI, cybersecurity leadership, emerging threats, and four important shifts shaping the industry’s future.
1. Cybersecurity Is a Business Risk, Not Just an IT Problem
Gregory believes cybersecurity must be treated as a business risk rather than simply a technology responsibility. Effective security leaders need to understand organizational objectives and communicate how cybersecurity decisions affect business operations.
He emphasizes that security leaders rarely have complete information when making critical decisions. Understanding business risk tolerance and acting on available facts are essential. For MSPs, this reinforces the importance of connecting security services to client priorities and demonstrating value beyond technical expertise.
2. AI Adoption Is Repeating the Mistakes of Cloud Computing
Gregory draws a direct comparison between today’s AI expansion and the early days of cloud computing. Organizations embraced cloud technology for scalability and efficiency, often moving faster than their security and governance practices could accommodate.
He sees similar challenges with AI, as businesses adopt tools without fully understanding their usage, data exposure, or costs. Gregory advocates cross-functional governance involving technology, cybersecurity, legal, and operational leadership. He also warns that overly restrictive policies can encourage unauthorized AI usage, creating additional security risks.
3. The Future of Authentication May Not Include Passwords
One of Gregory’s most interesting perspectives involves his changing position on password security. Years ago, he supported frequent password changes and increasingly complex requirements. Today, he advocates eliminating passwords wherever possible.
Calling it his “war on passwords,” Gregory explains that frequent password changes often encourage predictable patterns rather than stronger protection. He favors passwordless authentication technologies, including passkeys that combine device-based credentials with biometric verification. His perspective encourages MSPs to reconsider whether traditional authentication practices remain the most effective approach.
4. Post-Quantum Security Deserves More Attention
While AI dominates cybersecurity conversations, Gregory believes post-quantum cryptography isn’t receiving enough attention. He raises concerns that future quantum computing capabilities could threaten widely used encryption methods and expose sensitive information.
While Gregory acknowledges progress on post-quantum standards, he emphasizes the challenge of protecting existing encrypted data against future threats. For MSPs, this highlights the importance of looking beyond today’s cybersecurity headlines and preparing for risks that could affect clients years from now.
Looking Ahead
Rob Gregory’s insights reinforce that effective cybersecurity requires business awareness, sound governance, and a willingness to reconsider established practices. For MSPs, understanding these changes can strengthen their role as trusted security advisors.