Most MSPs run some form of vendor-risk review before a client signs up for new software or a cloud service. AI tools have mostly slipped past it.
Browser extensions with AI features, Copilot add-ons, chatbot plugins and agents that act under a user’s identity show up without a contract review. Vendors switch on generative features long after the original purchase. Employees paste customer data into tools nobody approved. Each of these is a third party with access to client data, and few have been vetted.
The cost is showing up in breach data. IBM’s Cost of a Data Breach Report 2026 found shadow AI was involved in 43% of security incidents at the breached organizations it studied, up from 20% a year earlier, according to Sentra’s analysis of the report. Sixty-eight percent of those organizations lacked the governance to manage AI or detect shadow AI.
Treat AI access like privileged vendor access
The test is simple. If an agent, plugin or workflow can install code, read credentials, change a repository or publish a release, it deserves the same treatment as any privileged vendor connection. Inventory it, constrain it, log it, and make sure it can be shut off fast.
Experts interviewed by SmarterMSP make the same point. “Agent actions need the same logging rigor as privileged user activity,” said Emily Hartstone, founder of Hartstone Institute. Eric Hulse, head of research at Command Zero, added that “MSPs must deploy least-privilege identities for non-human agents so that they do not accumulate too much privilege.”
Managed Services Journal has argued that AI agents are identities. They are also vendors, and the vendor-risk process should cover them.
Three deliverables you can sell now
1. An inventory of everything an AI assistant can reach. List the connectors and Model Context Protocol (MCP) servers each assistant can call, along with browser extensions, personal AI accounts used for work, features vendors added after purchase and any agent that can act on data or systems.
2. A named human approver for each item. Document who can approve an exception, and log every exception that gets granted.
3. A measured revocation time. When a connector or credential is pulled, how long until it actually stops working? Test it, time it and report the result.
Together, those three items make a defined service tier. It fits inside an existing vCISO or managed security retainer, or it can stand alone as AI vendor risk management. Deliver a monthly or quarterly pack that shows the current inventory, open exceptions and the most recent revocation test. Clients renew when they can see what changed.
Tie it to work you already do
This doesn’t require a new methodology. The See-Secure-Save sequence from Managed Services Journal’s SaaS sprawl playbook applies: find the tools, lock down access and cut what isn’t needed.
Start with three clients that already have generative AI in use. Map the tools, assign an owner to each one and run a single revocation test. Bring the findings to the next QBR.
When an insurer or auditor asks who controls a client’s AI agents, the MSP that already has the inventory gets to answer the question.
