About Author
Kristian Wright
Kristian Wright is CEO and co-founder of enhanced.io, a channel-only SOC-as-a-Service provider built for MSPs. He has over 30 years in IT leadership and has co-founded three service delivery businesses.
enhanced.io, the channel-only Open XDR SOCaaS for MSPs
TL;DR
AI has become the default marketing line for every security vendor. That does not make it real.
Applied AI should deliver 3 things you can measure: faster triage, fewer false positives, less analyst time per incident.
Roadmap specifics, integration depth, telemetry coverage and governance separate real capability from packaging.
Test any AI feature against a buyer's checklist before rollout, not after you have signed.
Every vendor pitching you right now has an AI story. Most of those stories sound the same. You cannot tell substance from packaging by reading a slide.
enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. Here is the test I use before I trust any AI claim, including our own.
Why every vendor suddenly has an AI story
AI-first messaging is everywhere in security marketing right now. Vendors are hiring senior AI roles and rewriting their homepage in the same 3 months. That pattern alone tells you nothing about what the product does.
The problem is not that vendors are lying. The problem is that the claim and the feature are 2 different things, and most buyers never get past the claim.
What applied AI should actually deliver
Strip the marketing away and applied AI in an MSP context should show up as 3 outcomes you can measure. Triage that runs faster than a human doing it alone. Fewer false positives reaching an analyst's queue. Measurable analyst time saved per incident, not per feature.
If a vendor cannot point to a number in one of those 3 places, the AI claim is describing a roadmap item, not a shipped feature.
Signals that separate real capability from packaging
Roadmap specifics. A real date and a real scope, not "coming soon."
Integration depth. Does the AI feature reach every surface it needs data from, or only the 1 it was built on.
Telemetry coverage. AI is only as good as what it can see. Ask what it cannot see.
Governance and audit. Can the vendor show you what the model decided and why, after the fact.
A buyer's checklist for testing AI features before rollout
What decision does this feature make without a human, and what decision does it only suggest.
Show me the false positive rate before AI and after, on the same data.
What happens when the model is wrong. Who sees it, and how fast.
Can I audit a specific decision 6 months from now.
Does this run on my full environment or a subset of it.
Where enhanced.io fits
We are operator-first. Automation does the first pass. Your named Fractional Security Director interprets what comes out of it and owns the result. That is not a caveat. That is the model. If a vendor cannot tell you who owns the outcome when the automation gets it wrong, ask again.
FAQ
How do I know if a vendor's AI is real or marketing?
Ask for a number, not a description. Faster triage, fewer false positives and less analyst time per incident are all measurable. If the vendor cannot show you a before and after on any of the 3, you are looking at a roadmap item dressed as a feature.
What questions should I ask a security vendor about their AI features?
Does AI in a security tool replace human analysts?