Q&A: Why SMBs need enterprise-grade security in the age of AI

As cybercriminals increasingly weaponise AI to automate attacks at scale, mid-enterprise organisations are finding themselves on the front line. They are in a unique position of facing enterprise-level threats with limited, legacy defences

Threat actors are using AI for reconnaissance, credential harvesting, and other attack processes, enabling them to target large numbers of SMBs simultaneously and with greater precision.

In this context, channel partners and managed service providers are playing a critical role in helping resource-constrained customers strengthen their security posture. As such, they need platforms that provide the essential security capabilities SMBs need without overloading tech stacks with new tooling.

CRN heard from Kendra Krause, general manager of ThreatDown, on how the threat landscape is changing, why AI-speed attacks need more than human-speed detections, and how ThreatDown is helping partners and customers defend against threats without adding further complexity to IT environments.

CRN: ThreatDown formally separated from Malwarebytes earlier this year. What opportunities does operating as an independent company create?

“We started the spin out in around November of 2023. It’s been a slow process, but we became a full legal entity in February 2026. Operating as separate businesses enables Malwarebytes to focus on consumer priorities and we're able to build a dedicated go-to-market channel and roadmap for IT-constrained organisations in the channel.

“It's allowed us to move a lot faster as an organisation. This has set the foundation for a channel-first strategy from a sales go-to-market standpoint and from a product architecture standpoint to ensure we have RMM and PSA tools purpose-built for MSPs.

“Our new partner programme really focuses in on deal protection, margin retention, rebates and MDF. All the things that partners need to help grow their business.”

CRN: Which AI-driven attack techniques concern you most right now, and why?

“Any AI-generated malware, deep fake, social engineering, or autonomous attack agents that basically chain exploit on their own is concerning. The techniques that a lot of these attacks are doing are very familiar, and we've seen them for years.

"But AI is making them unpredictable in how they hit and when they hit. It's compressing the dwell time that they need in an organisation to have an impact. Especially in the mid-market where you have a lot of headcount-constrained and IT-constrained resources. It's really causing a lot of problems.

“In these IT-constrained companies, often employees are using a lot of new AI tools without a policy in place. Or if they do have policies and settings, they don't have the visibility. We recently addressed this with an AI visibility tool within our platform.

"We surveyed our early adopters and 75 per cent of them said they have way more AI tools active in their environment than they knew of. So that's causing a gap for AI-generated malware to come in.”

CRN: ThreatDown’s response to this changing threat landscape centres on three pillars: Govern AI, Detect at AI Speed, and Defend at Scale. Why are those three areas so critical for organisations today, particularly for MSPs and VARS?

“Govern is about whether I can see what's going on in my organisation. Can I see what employees are using, and can I set policies and have control over it? Whether it's an end customer doing it themselves or partners managing it for them, that visibility is really important.

“Second is to be able to detect at an AI speed. AI-generated malware is reducing dwell time. So human speed detections are not going to catch up with AI-speed attacks.

"What ThreatDown has built is detection across the endpoint and the identity and the email and the browser. It's backed by 20-plus years of behavioural machine learning, which is combined with AI correlation so that we can read those threats in seconds. That's then serviced by partners.

“Our third pillar is defending at scale, and that's really where the managed detection response comes into play. Because even if we're detecting at AI speed and generating all these alerts for the customers and partners, thousands of alerts a second creates a lot of noise. You need a lot of expertise to understand what’s going on.

“And this is where our MDR really matches that scale. We use AI to triage 95% of the noise, and then industry expert analysts respond 24/7, bringing that human element to understand what’s going on in the network.”

Many vendors are adding AI features to existing products. How is ThreatDown building AI into the foundation of its platform rather than treating it as an add-on?

“Our philosophy is definitely around building on our foundation. We’ve built AI into the fabric of our ThreatDown MDR platform. So, whether it's the ThreatDown AI tool that handles 95% of alerts, we strongly believe that should be built into the foundation of what we already have, delivered together as one platform.

“The nice part for partners especially is this is not a new console that they have to manage. It's not a new agent that they're installing. It's not a new line item. It's what they know and what they're already selling and supporting, and it just gives them that added value inside the platform that frankly all of our customers need.”

CRN: How can those in the channel ensure they are meeting the unique security needs of mid-enterprise organisations?

“With AI-powered attacks, adversaries really don't care about the size of the organisation. They're just going to find where the security gaps are.

“A lot of these mid-market companies carry that same enterprise-level risk, but they don't have that enterprise-level security team. They don't have a team of analysts sitting there and identifying threats 24/7.

"So really this is where the channel matters the most. Because partners can come in and identify what they need. They can manage security and help customers depending on what the customer wants to do themselves and what they want to outsource. We're seeing more of those services being outsourced to partners and to managed service providers.”

CRN: Looking ahead 12 to 18 months, how do you expect AI to reshape cybersecurity, and how will this be reflected in ThreatDown’s product roadmap?

“I don't think anyone can tell the exact shape AI attacks and tooling will take over the next 18 months. It is changing that fast. If you look at most vendor roadmaps, the pace has already outpaced many of us.

"So, our philosophy is instead of trying to figure out exactly what going to happen next, we are building out our platform to ensure that it extends to all new risks, new ways of telemetry, new identity types, and new detection models, and having that in our ThreatDown platform.

“AI is changing the way that attacks are happening, but they’re still the attacks that we know, and so we’re continuing to build out those capabilities so we're able to detect and protect against them.”

Click here to find out more about the Threatdown partner programme.

This article is sponsored by Threatdown.