eBook | MSP | AI Security Report

/live_board/v2/downloads?uid=0a3d1e83-6701-4544-8fb3-30942a38d5ed&redirect=true

L E A V E - B E H I N D M A N A G E D S E R V I C E P R O V I D E R S

AI Security Report 2026: The MSP Readout Check Point Research's AI Security Report 2026 is our second annual assessment of how AI is being weaponized by attackers, targeted as infrastructure in its own right, and adopted — often ungoverned — inside organizations, built on Check Point's own threat research, telemetry, and named case studies from the past twelve months. This version is specifically adapted for MSPs.

A I S E C U R I T Y R E P O R T 2 0 2 6 · T H E M S P R E A D O U T

The Numbers Worth Repeating

5.91% ~1 in 17

The business services industry — the closest example to what an MSP does — is the single highest-risk industry measured for high-risk GenAI prompts.

2% → 4% High-risk GenAI prompts doubled from October 2025–May 2026.

87–93% of organizations had at least one high-risk GenAI interaction every month.

1 in 13 Claude Code settings files accidentally leaked that carried live credentials, out of 428 found across 46,500 scanned code packages.

41% / 30% the share of AI-generated faces correctly flagged as fake by trained reviewers and ordinary viewers, respectively.

A I S E C U R I T Y R E P O R T 2 0 2 6 · T H E M S P R E A D O U T

Why This Report Is Yours, Not Just Your Clients' Check Point Research's AI Security Report 2026 was originally written for CISOs at the kind of enterprise that has a CISO. Most of your clients don't (that's why they have you). Two of the findings in the report are especially relevant to Managed Service Providers:

First, the report's industry breakdown of high-risk GenAI prompts — interactions where sensitive corporate, personal, or regulated data gets shared with an outside AI service — puts Business Services at the top of every sector measured, at 5.91%, or roughly one in every 17 prompts. That category is the closest example the report offers for what an MSP does. If the number is representative of what you'd find running the same measurement across your own techs, your own shop carries the exposure before you sell anyone a fix for it.

Second, the report's chapter on attacks against AI itself — prompt injection, poisoned configuration files, and abuse of the AI coding agents that write and troubleshoot code — describes exactly the tools your engineering staff now uses daily. An MSP's technicians hold privileged, cross-client access through RMM and PSA platforms. That is the highest-value target profile this report describes, and it is sitting inside your own operation.

That reordering — your risk before your clients' — is the lens for everything that follows.

What Changed in the Last Twelve Months Three numbers from the report, unmodified:

High-risk GenAI prompts doubled, from 2% to 4% of all prompts, in the period Check Point measured (October 2025–May 2026). The average organization now runs roughly ten distinct AI applications a month.

Between 87% and 93% of organizations had at least one high-risk GenAI interaction every month.

The average number of prompts per user rose from 56 to 70 a month, a 25% increase over the same period, meaning volume and risk-per-prompt are climbing together.

Adoption is outpacing the governance built to manage it, and familiarity with AI tools has not translated into more caution. Usage is maturing; risky sharing behavior isn't declining alongside it.

A I S E C U R I T Y R E P O R T 2 0 2 6 · T H E M S P R E A D O U T

This Matters to You as Much as — if Not More Than — Your Clients

1 You and Your Team Are Running the Exact Tools Attackers Are Exploiting

The report documents a specific mechanism: AI coding agents such as Claude Code and Cursor read configuration files — CLAUDE.md, .claude/settings.json, .mcp.json — automatically at the start of every session and treat what's written there as authoritative, with no re-prompting required. Check Point Research's own findings, cited in the report, include two disclosed vulnerabilities in this class (CVE-2025-59536, CVE-2026-21852) and a separate scan of roughly 46,500 published code packages that found 428 had accidentally published a local Claude Code settings file — about one in 13 of those carrying live credentials.

If your team uses AI coding or scripting assistants to build automations, write scripts, or troubleshoot client environments — and they most likely are — this is the mechanism by which a single poisoned project file compromises the session, and by extension whatever that session's technician has access to. That access, in an MSP, is rarely scoped to one client.

Nothing here requires ripping out a tool your team already relies on: it requires knowing which of your technicians' machines have these agents installed, and reviewing a project's configuration files before opening them — the same discipline you'd already apply to an unfamiliar script.

A I S E C U R I T Y R E P O R T 2 0 2 6 · T H E M S P R E A D O U T

2 Your Helpdesk Is a Target for the Identity Attacks

The report's chapter on digital identity documents voice cloning, real-time face-swapped video calls, and AI-generated personas now being sold as ready-made fraud services — platforms like ATHR run fully automated AI voice agents that walk a target through a scripted account-recovery call with no human caller involved. In a controlled study cited in the report, even people trained to spot AI-generated faces caught only 41% of them; ordinary viewers caught 30%.

An MSP helpdesk that verifies a password reset or an access-elevation request by voice or video is verifying against a signal this report says can no longer be trusted on its own. This is an internal process question before it is anything you'd put in front of a client — and closing it doesn't require new tooling: verify identity-sensitive requests through a second channel your team already has, such as a callback to a number on file, never the number the caller provides.

3 Your Clients Are Exposed Without Knowing It

The adoption and high-risk-prompt figures above describe your client base as much as anyone else's. The report is specific about how the leakage happens, and none of the mechanisms it names are attacker-driven, but rather they are ordinary, approved business use: a legitimate, company-sanctioned connection between a tool like ChatGPT and a file- storage service that can pull hundreds of internal files from a single ordinary question, and employees defaulting to personal AI accounts for work rather than sanctioned tools — so- called Shadow AI — which the report notes affects roughly one in five organizations independent of any leakage through approved tools. Copy-paste and browser file uploads bypass the data-loss tooling most environments already have in place, because that tooling was built to watch a perimeter this traffic doesn't cross.

Regionally, the report also flags Latin America as a region where the high-risk-prompt rate is still climbing — up from 3.68% to 4.15% between January and May 2026, a 13% rise in five months — worth noting if your book includes clients in that region.

A I S E C U R I T Y R E P O R T 2 0 2 6 · T H E M S P R E A D O U T

4 This Is the Shape of a Service, Not Just a Risk

The report's own answer to enterprise-scale AI exposure is a governance and visibility layer that discovers which AI tools are actually in use — sanctioned and unsanctioned — assesses risk in real time as prompts happen, and prevents sensitive data from leaving before it reaches an external service. That is a description of a rapidly opening gap almost none of your clients have closed on their own, because almost none of them have a security function purpose-built to close it.

What Actually Fits an MSP's Stack Here Not every product in the corporate report is built for an MSP's book of business. The one built for exactly the exposure described above is:

T H E O N E P R O D U C T N A M E D H E R E

Check Point Workforce AI A workforce-visibility and data-loss prevention category: discovering which AI tools people are actually using, sanctioned and unsanctioned, and controlling what leaves the environment through them. It's the direct answer to Sections 3 and 4 above — the same visibility gap on your own technicians' AI use, and the same gap sitting inside every client environment you manage.

It is a workforce-visibility and data-loss layer, not a firewall or endpoint replacement — evaluating it doesn't require displacing whatever endpoint or network security vendor you already run. It's available pay-as-you-go, with no upfront commitment, so you can package it as your own managed service rather than resell it as-is.

A I S E C U R I T Y R E P O R T 2 0 2 6 · T H E M S P R E A D O U T

Three Questions Worth Asking in Your Next Customer Conversation Whether or not the client raises AI first:

1 Which AI tools are your employees actually using — not the ones IT approved, the ones people use?

2 Has anyone reviewed what leaves your environment when someone pastes a document into one of them?

3 If an employee got a password-reset call that sounded exactly like your CFO, would your team catch it?

The Reordering, Restated Every mechanism above starts from the same assumption: that someone watching the environment already knew what was happening in it. Close that gap in your own shop first — the callback-verified helpdesk request, the reviewed configuration file, the honest count of what tools your people actually use. Once it's closed there, you'll know exactly what you're looking for when you go looking for it in a client's environment.

Become a partner See a demo

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599

U.S. Headquarters 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391

www.checkpoint.com

https://partner-signup.checkpoint.com/ https://pages.checkpoint.com/mssp-infinity-portal-demo.html

eBook | MSP | AI Security Report

Item Type: pdf