According to Check Point, SMEs are rolling out AI faster than large companies, often without anyone monitoring it. The security specialist is selling MSPs oversight of this shadow AI, and some partners will make it mandatory starting in 2027.
“If a large enterprise wants to introduce AI, three months of committees, change management, and rules follow,” says Dave Meister, Vice President of MSP and MSSP at Check Point Software Technologies. “In an SME, the business owner does it on a Friday night while watching football. On the couch, with his laptop.”
Meister is speaking at Pax8 Beyond EMEA in Copenhagen, on the day Pax8 introduces 8os, a platform for managing AI agents at SMEs via an MSP. He worked at MSPs for fifteen years and joined Check Point following the acquisition of Avanan. “If it has an MSP sticker on it, I’m responsible for it in one way or another.”
Shadow AI in the SME
According to Meister, AI in an SME doesn’t wait for a company decision. “If the company doesn’t offer AI to its employees, they do it themselves. That is unfortunately just the reality. Run a scan and you’ll see it’s happening, one hundred percent certain. I dare say it’s happening in almost every SME in the world today.”
In a Pax8 survey of 402 American business leaders, ninety percent of SMEs are using or testing AI, and 23 percent have a documented AI policy. In a WatchGuard report, 64 percent of employees say they use AI tools without their employer’s knowledge.
The challenge is to implement governance and a framework quickly enough without stifling innovation.
Dave Meister, Vice President of MSP and MSSP at Check Point Software Technologies
“Shadow AI has emerged enormously over the past twelve months. Two to three years ago, it didn’t even exist,” says Meister. “Someone from marketing says: look what I can automate. Someone from administration says the same, and then someone else and someone else. The challenge is to implement governance and a framework quickly enough without stifling innovation.”
For the business owner, Meister reduces it to one question. “As a small organization, do you want your data going out? And do you want to know where it’s going?”
What Workforce AI sees
Check Point brought Workforce AI to MSPs in June, at Pax8 Beyond in Salt Lake City. “You deploy an agent on the device and you see all AI communication,” says Meister. “The prompts people use, which documents, personal data, or other company data they put into the AI agent. If you don’t want that, you set rules to block it. Is someone connecting their PC to an MCP server? We can see and block that.”
According to Meister, the software recognizes Claude, Grok, Copilot, and OpenAI’s tools, as well as 14,000 other AI applications. Check Point has invested heavily in AI security in recent years, including the acquisition of Lakera and an AI Network Firewall that makes MCP traffic visible. Once oversight is in place, Meister says a company is free to innovate and roll out, as long as it stays within the frameworks it finds acceptable.
Licensing follows the model MSPs are used to: per user per month, with no minimum and no fixed term, on a multi-tenant platform. Check Point uses the software internally, in line with the AI policy the company previously explained, and provides partners with free licenses for their own use. “This way they become familiar with it and protect themselves first before rolling it out to their customers.”
Employee privacy was not part of the conversation. Workforce AI shows which prompts employees type and which files they upload. A Belgian employer monitoring this way must align it with the GDPR and CBA No. 81 on the control of electronic communications, and inform their staff in advance. The SME should ideally determine beforehand which of that data the MSP managing the platform gets to see.
Mandatory starting in 2027
Among MSPs, on which four out of five Benelux companies rely for their security, the rise of shadow AI is leading to a hard line. “We are talking to partners who are implementing a price increase on January 1,” says Meister. “They aren’t even giving their customers the choice to refuse AI governance. It’s mandatory, just like endpoint security and email security.”
Check Point is pushing this itself. Since June, Workforce AI has been included in its MSP bundles, alongside email, endpoint, and browser security, SASE, and DMARC, in a single license that aligns with the customer’s Microsoft licenses.
SMEs carry more technology spending today than ten years ago, and thus their operating costs are higher.
Dave Meister, Vice President of MSP and MSSP at Check Point Software Technologies
For the SME, this means an extra cost, and Meister does not deny that it carries weight. “SMEs carry more technology spending today than ten years ago, and thus their operating costs are higher.” However, he finds this conversation easier than the classic security talk. “Regular security software stops attacks. This is about governance, about the way users work. The return on safe AI use is that there can be AI use. The company can invest and innovate with AI and AI agents, knowing that its data is not being used maliciously.”
Security as a selling point
Meister knows the pitfall of selling security from his time at MSPs. “If there is never a breach and your customer never hears from you, they will eventually value what you do less. Cybersecurity is a cost item.”
His solution is a service that aligns with a framework such as NIST, so the MSP can talk to the customer’s commercial director. “Ask him: if you can add our security analysis, which happens every three months and aligns with NIST, to every quote or tender this year, does that put you ahead of your competitors? Companies prefer to work with a partner who can prove they are secure, because they are going to share data.”
In Belgium, NIS2 plays a similar role. Companies falling under the directive must vet their suppliers. “You can ask them to also be in compliance with NIS2,” said Ulrich Seldeslachts, CEO of LSEC, at the ITdaily roundtable on two years of NIS2. The CCB offers CyberFundamentals, a Belgian framework on which an MSP can build such a service.
Enthusiastic and nervous
According to Meister, the MSPs themselves are enthusiastic and nervous at the same time. “They say: we can do so much and we already do a lot, but I know we’re not doing it securely now. Some MSPs push through and hope for the best. Others wait until they know it can be done safely.” Meister points to the data breach notification requirement that applies in many countries.
“There was a world before OpenClaw and a world after OpenClaw. What will be next?”, says Meister about a playing field that shifts every month. Check Point therefore constantly updates Workforce AI with new AI agents that emerge. “No product can stand still today, because it becomes obsolete very quickly.”
There was a world before OpenClaw and a world after OpenClaw. What will be next?
Dave Meister, Vice President of MSP and MSSP at Check Point Software Technologies
For SMEs with partners who make AI governance mandatory, it will be on the invoice starting in January, alongside endpoint and email security. Pax8 aims to make 8os generally available by early 2027, so that MSPs can also roll out AI agents to their customers themselves. Which rules apply to those agents and who gets to see the prompts will then be up to the SME and MSP together.