AI readiness assessment for managed service providers

A level-one technician picks up a ticket: a client's file server is throwing an error nobody has seen before. The quickest route to an answer is to paste the log into a chatbot. That log may carry hostnames, usernames, a share path with the client's name in it. Nobody wrote a rule against it, so nobody broke one. Multiply that by every technician, every day, across every client you look after, and you have a question worth asking properly.

Calibre Forum is an AI readiness assessment for managed service providers that asks each person on your team, on their phone, in about eight minutes, what they do in a week and which tools they use to do it, including personal accounts. Owners see results only as groups of three or more. You get a scored report, a tool register and a controls checklist. It is a different thing from your own clients' security reviews, though it answers many of the same questions.

Where AI shows up in IT providers and managed service providers

Ticket notes and log files

Find out whether technicians paste error output, configuration exports or PowerShell scripts into public chatbots to get a faster diagnosis. Ask which accounts they use, work or personal, and whether anyone strips out client names and credentials first. The same applies to the knowledge base articles your team drafts after closing a ticket, which can quietly carry client detail into a tool you do not control.

Quotes, proposals and security questionnaires

Account managers and vCISOs answer long client questionnaires and write proposals under time pressure. Find out who uses AI to draft those answers, whether the output is checked against what you actually do, and whether previous clients' answers are being pasted in as context. A confident wrong answer about your own controls is a contract problem.

Vendor tools with AI switched on

Your PSA, RMM, remote support and documentation platforms may have added AI assistants that summarise tickets or suggest fixes. Find out which features were turned on, by whom, and whether anyone read the data terms. Some will process client data in ways your agreements never contemplated. The tool register is where these show up beside the chatbots staff chose themselves.

Scripting and automation by the team

Engineers use AI to write scripts, runbooks and onboarding checklists. Find out whether generated code is reviewed before it runs across a client's estate, who approves changes, and whether any of it is pasted from sessions that included client credentials or tenant identifiers. The answer is rarely nothing, and rarely a disaster. It is usually uneven between people.

What puts IT providers and managed service providers at risk

Client data in tools you did not approve

Your managed services agreements, data processing terms and client security schedules promise how client data is handled. An engineer pasting a customer's logs into a personal chatbot account sits outside those promises. The exposure is less about one paste and more about not being able to say, when asked, which tools touch client data and under what settings.

Insurer and client questions about your own practices

Cyber and professional indemnity renewals may ask about governance of AI tools, access control and incident response. Larger clients add their own supplier questionnaires. A provider that can show a tool register, a policy and evidence that staff were consulted answers faster and with less guesswork than one assembling it the week the form arrives.

Privileged access and credentials

Technicians hold admin access to many client environments. Any habit that moves screenshots, configuration exports or secrets into outside tools raises the stakes beyond an ordinary business. The report shows where practice differs between teams, such as the service desk versus projects, so training and a clear policy land where they are actually needed. Those differences are what a sensible policy should address first.