For twenty years, the math behind managed IT for a small mortgage brokerage barely changed. You paid per user, per month. That price covered a helpdesk — real people answering tickets, resetting passwords, setting up new loan officers, and chasing down why the scanner stopped emailing PDFs. More users meant more tickets, more tickets meant more technicians, and the bill grew to match.
In 2026, that math is broken. If you know what to ask, it's broken in your favor.
What your MSP was really charging you for
Most of what a managed service provider does for a 5- to 20-person brokerage falls into a few buckets:
- Routine tickets — password resets, MFA re-registration, mailbox permissions, printer and scanner problems.
- Onboarding and offboarding — accounts, licenses, groups, devices, and (too often, forgotten) access removal.
- Microsoft 365 administration — shared mailboxes, Teams, SharePoint permissions, licensing.
- Security and compliance paperwork — policies, risk assessments, and evidence for auditors.
Nearly all of it is repetitive, rules-based work performed inside one system: your Microsoft tenant. That is exactly the kind of work AI agents are now good at.
What changed: agents, not chatbots
The AI of 2023 could answer questions. The agentic AI of 2026 can take actions: read a tenant's configuration, compare it to Microsoft's current recommendations, draft a change, document why, and hand it to a person for approval. In a brokerage, that looks like this:
- Onboarding a new loan officer — account, license, groups, MFA registration, device enrollment, and the access record your 23 NYCRR 500 access review needs, as one approved workflow instead of an hour of clicking through admin portals.
- Offboarding — access removed the same day, mailbox converted, files preserved, and a timestamped record for your compliance file.
- Configuration drift — Microsoft ships changes constantly. An agent can check your tenant against a known-good baseline every week and flag what moved.
- Audit evidence — MFA status, admin role assignments, device inventory and sign-in policies pulled into an examiner-ready package on demand, instead of screenshots gathered the week before the exam.
- Documentation — first drafts of policies and risk assessments written around your actual configuration, not a template with your name pasted in.
| Task | The old way | AI agents + human review |
|---|---|---|
| New-hire setup | Manual steps across several admin portals | One reviewed workflow with an automatic record |
| Offboarding | Depends on someone remembering every system | Same-day removal with a timestamped log |
| Audit evidence | Screenshots gathered by hand before the exam | Generated from the tenant whenever you need it |
| Policy updates | Template edited once a year, if at all | Drafted from your current configuration, then reviewed by an expert |
Where humans still matter
AI doesn't remove the need for expertise. It moves it. Someone still has to decide what "right" looks like for your brokerage, review what the agent proposes, and be accountable when an examiner asks why a control is configured the way it is.
At Firewall Valley, every AI-generated change and document is reviewed by a Microsoft expert before it reaches you. The agent does the typing; a person does the thinking. That's also why we don't believe in fully automated compliance. A regulator reading your written program should see a document that reflects your business, reviewed by someone who understands it.
What this should mean for your IT bill
If your provider's work got faster, your price should reflect it. Not necessarily all the way down — expertise and accountability are worth paying for — but the old per-seat model assumed technician hours that are no longer required for a lot of routine work.
If you're paying your IT company the same amount you paid in 2023, you should be getting a whole lot more for it.
That "more" could be real security improvements you've been putting off, documentation that's actually current, or simply a lower bill. What it shouldn't be is the same service at the same price, delivered with tools that cost your provider far less than they used to.
Five questions to ask your MSP this year
- Which of our routine requests are handled by automation today — and how has that changed our price?
- Are we using the Microsoft 365 security features we're already licensed for? Which ones are turned off?
- When someone leaves, how quickly is their access removed — and can you prove it to an examiner?
- Can you produce our compliance evidence (MFA status, access reviews, asset inventory) on request?
- What does our contract look like next year, now that AI does more of the work?
If the answers are vague, it's a good year to review your entire technology stack. Where should your budget go now that AI agents can do tasks that used to require human helpdesk workers? That question deserves a real answer.
A note for New York brokers
Many small New York brokers qualify for the limited exemption under 23 NYCRR 500.19(a): fewer than 20 employees and contractors, under $7.5 million in annual revenue, or under $15 million in assets. That means no required penetration testing and no required CISO.
But you still need written policies, a risk assessment, an asset inventory, access reviews, MFA and an annual filing by April 15. That is documentation work — and documentation is exactly where AI plus human review saves the most. Brokers outside New York have a similar obligation under the FTC Safeguards Rule.
Want to know what AI-assisted IT and compliance should cost for your brokerage? Book a free consultation and we'll give you a straight answer.