What happens when 1,200+ passionate cybersecurity professionals gather under one roof to level up, connect, and take on the growing threat landscape? You get one of the most engaging and energizing IT Nation Secure™ events yet. This year, 65% of attendees were first-timers, bringing fresh energy, diverse perspectives, and a collective urgency to tackle what's next in cybersecurity.
If you missed it (or want to relive the highlights), here is your quick recap of what made IT Nation Secure™ 2025 one for the books.
Key highlights
- Elevated event agenda: The conference featured 100+ sessions, including immersive labs, gamified challenges, and unfiltered panels with top industry leaders.
- Record-breaking engagement: Over 1,200 cybersecurity professionals attended, including 600+ MSPs and 65 exhibitors and sponsors from 15 countries.
- Cybercrime is big business: Threat actors are now AI-powered and highly organized, underscoring the urgency for smarter defenses.
- AI raises the stakes for SMBs: 83% of SMBs say AI has increased cyber risks, but only half have adopted relevant security policies, creating a key opportunity for MSPs.
- ConnectWise cybersecurity innovation: New tools and enhancements, including next-gen SIEM, tighter PSA security, and broader ecosystem integrations, equip partners to lead in an AI-driven threat landscape.
Breaking the mold: What was new this year
Cybercriminals are no longer lone actors in dark basements. They are highly organized, funded, and AI-enabled. For perspective, if cybercrime were a nation, it would have the third-largest GDP in the world, trailing behind only the United States and China.
That is the reality that businesses and MSPs face. That is why IT Nation Secure™ 2025 raised the bar with a bold new agenda, more immersive learning experiences, and unfiltered discussions on what's working and what's not when defending customers and growing a profitable security practice.
Cyberthreats are evolving, and so is IT Nation Secure™.
Here is how we elevated the event this year:
- Refreshed agenda with 10+ hands-on technical sessions: This year's agenda prioritized "learning by doing" and real-world applications. From start to finish, it was about enabling action, not just awareness. Attendees spent less time in traditional lecture formats and more time rolling up their sleeves with live simulations, guided labs, and interactive problem-solving.
- 120+ cyber experts on-site: Attendees had direct access to cybersecurity professionals offering expert guidance, real-time answers, and collaborative problem-solving to help tackle challenges faster and more effectively.
- Immersive, interactive experiences: The event also introduced several new interactive experiences to make cybersecurity education more engaging and memorable. This included gamified hacking challenges, a Cyber Warriors Arena Party, and a Hacker Hideout Warehouse Rave.
Inside look: The state of cybersecurity 2025
“Securitatem firmantes concursu.”
Strengthening security by coming together.
The opening keynote set the tone for the event, which included a powerful panel discussion featuring some of the industry's most respected cybersecurity leaders. The discussion was framed around three critical questions: What's working? What's not? What's next?
The panel delivered an honest, insider perspective on the current and future state of cybersecurity.
Panelists included:
- Patrick Beggs, CISO, ConnectWise
- Kyle Hanslovan, CEO, Huntress
- Jon Murchison, CEO, Blackpoint
- Jay Ryerse, Senior Director, Global MSSP, SentinelOne
Together, their unfiltered dialogue gave attendees a rare look behind the curtain at how different organizations approach cybersecurity, especially as AI reshapes attack vectors and defense strategies.
Debunking common cybersecurity misconceptions
The conversation around cybersecurity misconceptions hit home for many during the keynote. Despite the rise in tools and technologies, several recurring myths still hold businesses back from building stronger security postures. Here are a few that stood out:
Misconception #1: "Technology can fix everything"
It’s a tempting mindset, but layering on more tech isn’t a silver bullet. Speakers emphasized that cybersecurity is not solved by tools alone; it’s a combination of people, processes, and technology. Without strategy and ownership, more tools can mean more complexity.
Misconception #2: "What we don’t know won’t hurt us"
In reality, what you don’t know is already hurting you. Many overlook blind spots such as unknown assets, unpatched systems, or poorly configured cloud environments. Visibility is the first step because you can’t protect what you don’t know exists.
Misconception #3: "Security is just a technical problem"
Strong cybersecurity starts with ownership and time. It’s about knowing who’s responsible for the process, not just the tools. Some may spend time in the business but not on the business, neglecting strategy and risk assessment.
Misconception #4: "Deploy now, secure later"
Every new tool, feature, or integration introduces risk. Whether AI tools or third-party apps, each must be vetted, configured, and secured. Without that due diligence, productivity gains can come at the cost of data exposure. Jon Murchison highlighted, "We can’t avoid change because we’re not perfectly secure. Our job is to manage the risk and move forward." In other words, don’t let the pursuit of perfection prevent progress. The goal is to stay adaptable while making smart, informed decisions that balance innovation with security.
Misconception #5: "Testing and training are optional"
Phishing simulations, user education, and attack surface management might not sound flashy, but they’re foundational. As Patrick put it, "60% of the pain goes away" when you consistently manage configurations and test your environment.
The bottom line
Cybersecurity is not about finding a magic solution; it’s about continuous vigilance, thoughtful processes, and real accountability. For MSPs, that means moving beyond tools and into conversations about ownership, architecture, and education.
The cybersecurity challenge: AI raises the stakes for SMBs
In conjunction with the event, ConnectWise released the latest findings from The State of SMB Cybersecurity Report for 2025, and the results were eye-opening. Malicious actors increasingly leverage AI to launch more sophisticated cyberattacks, leaving many SMBs concerned about the potential consequences. For instance, 61% of SMBs surveyed said they worry a serious cyberattack could be enough to put them out of business entirely. Even more telling, 83% believe that AI and generative AI have increased the cybersecurity threat level for their organization.
Despite those concerns, only 51% have implemented security policies or best practices tailored to AI use. This growing gap between awareness and action presents a challenge and a significant opportunity for MSPs. MSPs prepared to guide customers through secure AI adoption and offer the tools to back it up will be in a prime position to lead in the next phase of cybersecurity growth.
The future of cybersecurity: Key trends shaping what’s next
The panelists reflected on how far the MSP security community has come and what’s needed to stay ahead. They discussed several trends shaping the future of cybersecurity:
- Agentic AI as a force multiplier
Threat actors are leveraging AI to accelerate attacks, but AI can just as powerfully support cybersecurity defense. When paired with human oversight, clear processes, and thoughtful management, AI can boost efficiency, shorten response times, and free up security teams to focus on the most critical threats.
It’s not about replacing people, but enabling them to do more with less. A growing part of this evolution is agentic AI—a blend of automation, intelligence, and autonomy that enables systems to take initiative and manage tasks independently. By combining speed and adaptability with human guidance, agentic AI helps MSPs operate more efficiently without sacrificing visibility or control.
The benefits of hyperautomation go beyond automating individual tasks. Streamlining entire processes from Tier 1 support to advanced threat detection helps MSPs operate more efficiently, reduce manual effort, and deliver greater value.
- Security as a shared responsibility
No single MSP or organization can tackle today’s challenges in isolation. From engineers to CEOs to third-party vendors, there is a growing call to prioritize collaboration and make security a shared responsibility. When we do, we get ahead of threats.
Peer networks, strategic partnerships, and open sharing of threat intelligence and best practices are critical for the industry. The MSPs who actively engage with and learn from their community will be far better positioned to defend their customers and scale their businesses in the coming years.
Lessons learned from Neil “Grifter” Wyler: Defending one of the most hostile networks
In his keynote, Neil Wyler gave us a behind-the-scenes look at what it’s like defending one of the most challenging networks out there. Managing Black Hat’s network isn’t easy, but his experience offers real, practical lessons on staying ahead of threats that any security team could learn from.
Lesson 1: Real-world threat hunting requires prioritization, not alerts
At Black Hat, the network is so saturated with suspicious traffic that traditional alerting mechanisms are practically useless. Wyler described it as searching for “a needle in a needle stack,” where everything looks malicious, but only a fraction is genuinely harmful.
Over just six days, the network operations center (NOC) detected 2.65 million threats on the Black Hat network. Out of those, only 241 were blocked—a number intentionally kept low to avoid disrupting training sessions and red team labs. This underscores the need for human-driven threat hunting, powered by full packet capture, anomaly detection, and contextual investigation.
Wyler’s team of 15 experienced threat hunters and 40+ vendor partners sift through massive traffic volumes using real-time dashboards and collaboration tools.
Their mission: find the one incident that matters in a sea of noise without triggering a false positive that disrupts learning or legitimate testing.
Lesson 2: Automation is critical at scale
As Black Hat has grown from 1,500 attendees to over 25,000, the demands on the NOC have scaled accordingly. With 1.1 million URLs browsed, 14,939 confirmed malicious domains, and thousands of endpoints on the network, manual investigation alone doesn’t cut it anymore.
To handle this load, Wyler emphasized the importance of automation and orchestration. The NOC uses a SOAR platform to collect logs, correlate alerts, and group related indicators into a single incident, saving hours of manual work across different systems. This allows analysts to move faster and focus on what matters.
They’re also using AI and clustering techniques to flag outliers. For example, if a training class has 20 students all triggering the same exploit pattern, that’s expected. However, a lone device launching a different pattern becomes an instant priority. This method helped identify unusual behavior from a compromised speaker’s laptop, which was exfiltrating data via a malicious Chrome extension—something a rule-based alert would have likely missed.
Lesson 3: Invest in a dedicated decryption solution
"If you’re not decrypting traffic, you’re blind to most of what’s happening on your network," Wyler warned.
Relying on built-in “checkbox” decryption features bundled into existing security tools can make the solution unnecessarily expensive, and this method often underperforms at scale. “Don’t just check the box. Get a tool that’s made to do the job properly, size it appropriately, and use it to gain real insight,” Wyler advised.
Purpose-built decryption tools are better equipped to handle large volumes of encrypted traffic, integrate with other security platforms, and provide the depth of visibility needed to detect threats hidden in encrypted payloads.
Lesson 4: Endpoint, identity, and access management matter
While much of the conversation around cybersecurity focuses on advanced threats and detection tools, he emphasized that basic operational discipline around identity, access, and endpoint management remains one of the most critical and overlooked factors in maintaining security and stability.
At Black Hat, the longest network outage in the NOC’s history—a 90-minute downtime during a live show—wasn’t caused by an external attack. It stemmed from a misconfigured identity and access management (IAM) solution and an uncoordinated firewall change.
This incident drove home three key points:
- Limit who can commit changes: Only a trusted few should have the authority to make live changes in production environments. At Black Hat, only Wyler and his counterpart now hold that final commit access.
- Test everything before deployment: Even small configuration updates can have unintended consequences. Without testing, you risk outages, instability, or unintentional exposure.
- Centralize and communicate changes: All updates must flow through a single, well-documented process. When coordination fails, even a high-performing team can introduce risk.
Grifter’s advice is a powerful reminder that security is not just about the tools you buy; it's how well you manage the basics. He closed with a powerful reminder: even seasoned security pros fall for phishing or misconfigurations. What matters is how we respond: “We’re all in the same boat just trying to do better.”
Unifying cybersecurity and efficiency with ConnectWise
Cybersecurity is a long-term growth opportunity that allows MSPs to expand service offerings, deepen customer relationships, and differentiate their value in a crowded market.
At this year’s event, ConnectWise unveiled the next wave of innovations designed to help MSPs stay ahead of threats and take full advantage of the growing market.
Take a closer look at our latest innovations, enhancements, and integrations:
The platform advantage
Individual tools such as RMM, remote access, and EDR serve a purpose, but managing them separately can slow teams down. A platform unifies these tools in one system, improving efficiency, performance, and the ability to innovate.
The ConnectWise Asio® platform combines MSP solutions into a truly unified experience with a streamlined UX, real-time visibility, and shared platform services. At IT Nation Secure™, Jeff Bishop, EVP of Asio Platform at ConnectWise, announced that two of our flagship products, PSA and RMM, are now fully integrated on Asio.
ConnectWise PSA™ offers a sleek new interface, real-time visibility, and deep integration with ConnectWise RMM™, giving users a more efficient and simplified way to operate. Shared data and embedded AI and automation reduce silos and help elevate service delivery. A ConnectWise Pro package was also announced. This package bundles MSP core tools (PSA, RMM, CPQ, and RPA) into one flexible package, eliminating tool sprawl and aligning licensing with how MSPs bill clients.
The next evolution of ConnectWise SIEM™
The cybersecurity threat landscape is accelerating, and MSPs need tools that keep up. That’s why the next evolution of our SIEM solution delivers enterprise-grade threat detection and response without the enterprise overhead. Here is what sets it apart:
- Faster, smarter detection and response: Advanced automation streamlines alert triage and dramatically reduces response times, helping teams avoid threats rather than react to them.
- Enriched ticket data for analyst efficiency: Every alert becomes more actionable with deeper context, giving security analysts the insights they need to respond faster and more accurately.
- Cost-effective scalability: Optimized data ingestion means lower storage costs and more efficient resource use without compromising visibility.
- Simplified operations: Say goodbye to juggling multiple tools. ConnectWise SIEM now unifies log management, threat detection, and incident response into a cohesive platform, reducing complexity and boosting productivity.
The growing ecosystem
As highlighted in a recent Canalys report, a platform's core capability is investing in integrations or “sides.” We continue to grow our ecosystem with key integrations, including Microsoft, Pax8, and Proofpoint, to help partners deliver more cohesive, end-to-end protection.
ConnectWise MDR™ for Microsoft 365 bundles RMM Pro, MDR for Microsoft Defender, and Backup and Security Dashboards to simplify endpoint management, enhance security, and streamline operations—empowering MSPs to deliver stronger, more efficient services to SMB clients. This bundle is available via Pax8.
Looking ahead
IT Nation Secure™ 2025 was a powerful reminder that cybersecurity isn’t standing still, and neither are we. The stakes are increasing—from the rise of AI to the growing threat of sophistication and SMB awareness. But so are the opportunities.
ConnectWise remains committed to helping our partner community and industry build resilient, future-ready security practices that grow with their customers’ needs. We invite you to explore the tools and insights shared throughout the event and to take the next step in evolving your security offering.
Get started today with these resources:
Let’s keep raising the bar together.
