# For Investors — CyberSentriq AI Governance ## The AI governance gap _in the MSP market_ The technology components exist. The governance layer does not. CyberSentriq is building it. 48% of MSPs name AI as their clients' top need 13% are generating meaningful revenue from it 150+ AI governance vendors, none serving MSP delivery The market ### A frozen market with clear demand The managed service providers who look after the IT infrastructure of small and medium-sized businesses are uniquely positioned to deliver AI governance as a managed service. They already have the endpoint management tools, the network visibility layer, and the client relationships. They are missing the governance workflow, the evidence layer, and the packaging. The gap between detection (what AI tools are being used) and governance (policy, workflow, exception management, compliance-grade evidence) is where the revenue opportunity sits. The 150+ vendor market ### Three categories. None of them fit. The evidence layer does. Most of the 150+ AI governance vendors fall into one of three categories. None of them serve the MSP delivering AI governance to 50–200 SMB clients from existing managed infrastructure. | Category | Day after you buy it | Buyer | | --- | --- | --- | | **Policy and risk tooling** | A policy document or compliance report | CISO / compliance team at enterprise | | **Technical / model governance** | A drift alert on a model you deployed | Data science / ML team | | **Advisory and frameworks** | A decision about what to govern | Internal or board strategy | | **CyberSentriq (the evidence layer)** | A dashboard of AI tools in use across every client tenant, with PHI/PII classifications from backup data and a QBR-ready evidence report | MSP operator managing 50–200 SMB clients | The 150-company count is CyberSentriq's friend when the answer to "what does it do on day one" is specific. Why the gap persists ### Why existing products do not fill it DNS filtering and RMM telemetry tell MSPs what AI tools are in use. They do not provide a policy engine, an exception workflow, or the compliance-grade evidence that auditors, insurers, and enterprise clients expect. Enterprise AI security tools are designed for enterprise security teams, not for MSP managed-service delivery at SMB scale. They do not fit the MSP operating model, do not integrate with PSA platforms, and are priced and positioned for direct enterprise sale. Microsoft's native answer sits behind E5 and Purview licensing that the SMB estates MSPs actually manage do not carry. The resulting data-sensitivity gap on Business Premium and E3 tenants has been confirmed independently across MSP field interviews, and it is structural, not a feature wait. The thesis This is a software and packaging problem, not an infrastructure build. No product currently packages AI governance for the MSP operating model at SMB scale. The double obligation ### MSPs must govern twice MSPs face two simultaneous compliance obligations, and most address only one: #### Own compliance As technology businesses, MSPs must comply with ISO 27001 (or equivalent), SOC 2, GDPR, and increasingly ISO 42001. Their own staff use AI tools. #### Inherited client compliance When MSPs manage IT for clients, they take on technical control responsibilities for their clients' compliance programs: HIPAA for healthcare, SOC 2 for tech, FCA for financial services. An MSP without its own posture established cannot satisfy the second obligation. CyberSentriq helps the MSP establish its own posture first, as a billable internal governance project, before the MSP can package AI governance as a client service. The CyberSentriq approach ### Integrate, not replace CyberSentriq does not compete with DNS filtering, endpoint management, or Microsoft 365. It integrates with them, normalizing events from across the estate into a unified governance layer. #### Signal integration, not replacement Events from DNS filtering, RMM platforms, Microsoft Purview, and backup and recovery platforms are normalized into a unified governance event stream. The MSP's existing technology investments become inputs. #### PSA-native workflow Governance events become PSA tickets. Exception workflows run through HaloPSA, Autotask, Kaseya BMS, or ConnectWise. #### Dual-purpose evidence The same evidence store serves two audiences: client-facing QBR proof and the MSP's own SOC 2 / ISO 27001 / ISO 42001 control evidence. Timing ### Why 2026 is the right window #### Regulatory pressure is live, not pending MSPs in regulated verticals are being asked right now to demonstrate AI governance capability. #### Copilot is in the installed base Copilot readiness assessment is the largest AI governance entry point, and it exists across the MSP installed base today. #### Competitor positioning is weak No product currently packages AI governance for the MSP operating model at SMB scale. #### MSP infrastructure is ready DNS, RMM, and Purview are already deployed. The signal infrastructure exists. The missing piece is the governance layer above it. The regulatory tailwind is live: the EU AI Act is in force, HIPAA AI obligations are being enforced, the UK Cyber Security and Resilience Bill is progressing through Parliament, and ISO 42001 is appearing in enterprise procurement questionnaires. ### Talk to us about the evidence layer Market analysis, estate leverage, and the MSP operating model thesis, built on field-validated demand. [Contact the team](mailto:partners@cybersentriq.com)[Review the architecture](/architecture)