Running an MSP Isn’t That Hard w/ Jesse Miller

Welcome to the $10 Million MSP Podcast. This podcast is where I dive into the real stories of MSP leaders who have gone beyond $10 million in revenue, how they built their teams, created scalable systems, and turned their businesses into valuable wealth-building assets. I'm Brian Hoppe, strategic coach to MSPs. I work with MSPs generally in the $5 to $50 million range. In each episode, I sit down with leaders who have built MSPs beyond $10 million in revenue to unpack the inflection points that truly matter. From the personal stories behind their journeys to the fundamentals like culture, operational maturity, and driving profitability. This isn't another MSP podcast about tools and tech. On the $10 Million MSP Podcast, you'll get behind-the-scenes conversations with leaders who've built thriving MSPs, their biggest wins, their toughest lessons, and the practical takeaways that you can take back and use right now. If you're an MSP owner who knows that growth starts from within, that mindset, leadership, and strategy align to create both wealth and meaning, then this show is for you. New episodes are released every other week. So let's jump in. Hey, uh, welcome back to the $10 Million MSP Podcast. Uh, we got a, we got a fun episode today. I'm here with, uh, Jesse Miller and, um, really excited to, uh, to jump in with Jesse. A lot of you guys probably already know him and, and what he's all about, but, uh, but he loves to help MSPs build and mature their cybersecurity practices. And we're going to get all into all that kind of stuff. So Jesse, welcome to the show, man.

Yeah, thanks for having me. It's fun to get on here finally because we've known each other for a while and we talk about this stuff in the background and hallway conversations at conferences and stuff. So excited to be here and kind of just dig in and tell my story.

Yeah, there you go. Absolutely. Absolutely. So I always like to start with a good hard-hitting question. So for you, What would you say is something that you believe about running an MSP today that most MSP owners might disagree with?

Oh, um, uh, it's not that hard.

Oh, okay. All right. So the official word is it's so easy to run an MSP.

Well, yeah, it's kind of a, I say that tongue in cheek, right? But, uh, I would say that I think we all really kind of know what we need to do. So maybe, maybe it's not— it's simple might be the better way to say that. It's like we kind of know what we need to do. We just have to do it. And I think there's a lot of things that happen that take us off of our game. But I think if we can stay focused and really just do the things that are, um, the, the boring things that you have to do on a repetition to just create success, I think if you can do that over the long term, it's not—

Hard. Ah, okay. So, so simple, not easy perhaps.

Yeah, I think that's probably the best way to put it. Yeah.

Yeah. Well, and I, that's a, that's a really interesting viewpoint because like, I think back, you know, I mean, 15 years ago, a lot, well, I think everybody was just kind of trying to figure it out, right? How do you run an MSP successfully? And now there's, it's been done so many times and there's, so there's different frameworks. There's, There's a lot of stuff that's out there that's like, hey, if you just do this, you're gonna be successful, right? And where— so a lot more resources, um, available and, and that kind of a thing as well. Um, but, but definitely get your point about like, hey, like, do the fundamentals and do them well, right? Yeah. And you can be successful in this.

Yeah.

Yeah. So awesome, man. Well, hey, so, so, uh, let's get Maybe just kind of dive into your story a little bit. Like, hey, where'd you come from? How'd you end up, you know, being a chicken farmer? No, wait, just a farmer slash cybersecurity guru. Yeah, maybe just kind of talk through the story.

Yeah, I always tell people, okay, short story long, here we go.

Here we go. Yeah, yeah, yeah. Well, under an hour.

Let's keep it under an hour. All right, we'll try and make that happen. So I kind of tell people like, well, how do you know people, young kids or whoever's coming up and they're like, hey, I want to be a CISO, I want to get into cybersecurity, like, how do you do that? And I'm like, I'm the wrong person to ask because this was not plan A at all. And I don't really even know how I got here in a lot of ways. But people ask me, what was your journey like? I'm like, it was kind of a tumble down the stairs. Like, I didn't start in cybersecurity. I started working for Ameritech, phone company, which is now long gone. I'm dating myself.

I remember them. Yeah, it dates us a little bit.

Yeah, yeah. And I was in telecom and I learned the Cisco command line while I was doing that. I started that actually right out of high school and really got to like Cisco networking. And so I went back to school about 10 years into that and got my—

That makes you weird, by the way.

That is not the only thing. We got plenty more to get even weirder with it.

Yeah, yeah.

Um, so, so any, you know, at that point the dot-com bubble kind of took the wind out of the sails of that whole industry, and I went back to school and got my Cisco command, uh, Cisco networking degree and met an MSP at the career fair at DeVry. And, uh, I didn't know what an MSP was at the time, you know. I think I was probably— how old was I? Maybe 30? Not quite. No, I was 25, I think, something like that. And, uh, they had a PBX part of the business at that time. They were a PBX VAR and they're like, oh yeah, you work for the phone company, you come work for us. And I went and got hired in the basement of this 5-person MSP.

Okay.

And I still remember, I'm good friends with the owner still. Kevin's one of them. Uh, he goes, hey, why'd you ever take that job? And I go, Kevin, I really needed the money and I wasn't sure if I was going to get paid or not. I figured let's just give it a shot, right?

Let's go.

And so fast forward is 70, we got to about 75 people and a successful exit. And this was down the road and we'll get there, I'm sure. But over the course of that, helped them build a managed— they were a PBX VAR. So first helped them build like a managed services IT thing. And then they came to me and said, hey, you've built all these other things for us. We want to build a managed cyber practice. Do you think you can do that? And I said, oh yeah, sure. How hard can it be? You know, easy, right?

Easy.

Yeah. And, uh, and that really didn't work out real well. I did what I think we all are still kind of doing is went and built the best stack I could find— SIEM, EDR, everything— went and started selling it to our base and nobody wanted to buy it. Now this is 2014, so you think the cyber conversation's hard now, think back then.

Yeah.

People didn't know what you were talking about. In any case, kind of, you know, didn't— it didn't go real well. And so I had to kind of take a step back and say, well, how does— what's going wrong? Why is this not working? And really came to the conclusion that it's because we didn't have a why. Like, we weren't talking about risk. We weren't helping people understand, like, why do you need these controls? And that's when I found what— like, this term VCISO. Like, what's a VCISO? What's risk management? And, uh, relaunched the practice the next year with that at the— as the spear point, and it completely changed the game. We started having success immediately and really, you know, the cyber program took off and became, like I said, a spearpoint for a lot of other revenue in the business going into co-managed contracts, just expanding with our current clients. It was very successful. So all that to say, the business exited, like I mentioned, and I went and ran the vCISO program for a really large MSP, like 350 plus, I think at the time. They're bigger now. But then after that, kind of looked around and said, well, what does the industry need? What do I really like doing? And I want to build something. And so I came up with the idea for Power PSA Consulting and the Power Grid, the VCISO system. So started doing that 3 years ago, and that's been very successful. Obviously, a lot of MSPs are really winning with the tools that we're giving them and the skills we're teaching them. And, um, that brings us to here today. So how'd I do?

Wow. Amazing.

Yeah.

Yeah. No, great. Great. Not too long. Yeah. Yeah. Well, and, and, and though anybody who follows you on LinkedIn knows you, you also, you know, have, well, I, I mean, is this like your future get, like after you exit, uh, you know, from the MSP industry, you're going to be a full-time rancher, you know, farmer. Yeah.

I should mention about 3 years ago, we bought a farm. We didn't really know what we were doing. We just knew that we always wanted We wanted to do it, and so we did it. And we're like, yeah, we'll keep a couple cows. And before we know it, we have 30 head of cattle, hundreds of chickens. People are asking for more. I just launched a direct-to-consumer website, and, uh, that's, that's really exciting. Now I can't grow it much bigger than that because I have other responsibilities, of course.

Right, right.

But to, to answer your question, yeah, someday, like Semi-retirement, I think that'd just be beautiful, right? To sit on the farm and, and can't really make a living until you, unless you get really big. So I don't foresee that like to that level, but, um, yeah, that would be a nice semi-retirement. Let's put it that way.

Yeah. Got it. Got it. Okay. I love it, man. Okay. So, uh, yes, that was, that was great. Um, and, uh, you know, I guess, you know, as, as I'm thinking through, like, I've been thinking through, like, hey, where do we, where do we take this conversation? Like, I kind of want to, um, think about, okay, like, when you, you know, you're building a cybersecurity practice inside an MSP, it's 2014. I'm very familiar with, you know, because my business, um, at the time was banks and credit unions, or I guess just slightly after that. Right. And they're essentially forced to do this stuff.

Yeah.

And it's still hard to convince them that they need seam, for instance. Like, no, your examiner is telling you you need seam. And they're like, ah, I don't know. We'll take the ding on our whatever. I'm like, no, you can't do that. Here's why. All of that. So when you talk about kind of the, you know, giving them a why behind it, like, And building out that cybersecurity arm, like, what are you talking about there? Like, how do you have that conversation and help people understand? No, regardless of whether some governing body is telling you you need this, here's what that looks like. And here's the why behind that.

Yeah. Well, so I think everyone and their mother out there, all us pundits love to say, well, you got to make it about business outcomes. Like, that's Everyone's like, puke, I'm shutting off the podcast now.

Yeah, right, right.

But no, so like more, more specific, I really do think this is where, because it's a, it's a more bespoke type of service in a lot of ways, you have to be much more intentional about your go-to-market, your targeting, and your psychographics of like your buyer personas and like what are their real buying triggers. And you really have to get inside their head. A lot more than maybe you do with traditional IT because it's, it's more of a— people understand what an MSP is now. But to say the why, people, it's a harder connection to make with cyber. So you have to be much better at your go-to-market. I think that's the bottom line of really understanding how, like, really understanding what makes— what your client's goals are and then helping them see how those goals connect to the cyber program. Okay.

Okay. Gotcha. So, so kind of a, kind of taking a holistic look from a, from a business level.

Yeah.

And then, and then kind of bringing that down into, into security because like I can, I can just tell, I know there's, there's folks listening to this right now that are like, yeah, we have all the offerings.

Yeah.

Nobody wants it or nobody's willing to pay because it's blah, blah, blah, blah, you know? So So how do— so yeah, let's say, let's say there's an MSP out there and they're like, they're like, yeah, we're doing $5 million in revenue. We're profitable MSP. And, you know, well, so for somebody like that, you know, and they have some, they have some obviously base level of security built into their managed service. What do you like for somebody like that? What do you think is their potential? Like if they're not doing true vCISO at this point?

Mm-hmm.

I mean, how much can a, could a $5 million MSP generate if they, if they really, really were doing it and doing it well?

Yeah, I mean, I think so. We've, let's, like, as in terms of how much, it depends on your current customer base, of course, right?

Right.

Um, but we see typically when you have vCISO or true vCIO, whatever it may be, like a real, a real actual strategic service attached to a client, Your lifetime value is going to be 1.5 to 2x more than non— than a non— just a standard IT customer, right? So, okay, you could do the math on that. Like, I could say like double— you could become a $10 million MSP if you're a $5 million MSP, potentially. Yes, you could, right?

Okay.

Is that's— it's probably more somewhere in the middle of that. But my point being is that if you go out and Um, like, so to go back to your point, I wanted to— I wanted to— before this pops out of my head, I wanted to say it.

Yeah.

So to understand like what your clients want and what their business goals are, I always tell people this is part of an ICP, like an interview worksheet we give people to go through and talk to some of their best clients about. But, you know, you, you ask somebody, and this can be used in discovery or whatever else, you say, okay, well, you know, don't forget about technology. Like, I know I'm a tech guy and you want to go talk about computers when I ask you these questions, but even aside from that, right, What are the 2 to 3 goals you have for your business over the next 5 years? Like, what are they? Right? And then it's— and then you dig into that. Okay, well, which feels the hardest to do and which feels the easiest? Well, tell me why. Why is it— why is this one so much harder than that one? Oh, because of XYZ. Okay, well, now if we take those goals and we take 2 buckets and say we have a need to do and a want to do, which goes in which and why? Again, right? So, this is helping— like, they may have never thought about this. In a way, you're almost helping them get clarity. I mean, Brian, you probably do this with them.

This is— It sounds like you're describing my job. Uh, no, but it's actually the conversation every MSP should be having with their clients anyway, right? That's the strategic conversation.

Yeah. So, so it's like, okay, then, then I understand where we're going. I understand what is the aspirational goals, right? The, the wants, the wants are the aspirational, then the needs are the survival. So you have to balance those, right? And so, yeah. Once I understand those things, now I all of a sudden have pain points that are associated with those. Like, why can't you get that goal? Why is this hard? Oh, because I have these things in the way. Well, how can technology, how can cybersecurity help make that easier? Okay. Or from a negative and a positive risk standpoint. Okay. Now, when we understand that about our target market, we say, okay, well, out of the clients that we have, which ones are more prime for these pain points? Right. Have said similar things and say they like, we see that there's value there. Okay, now we create value pillars that associate with those. And now it's like when— now it becomes repetitive. You can start making battle cards for your salespeople, right? You can do all these things where— okay, I always say salespeople are like batters in a batter's box. They don't need to understand the physics of what makes a curveball spin. They just need to be able to see the curveball and hit it. So, right, they—

Yeah.

So they don't need to know the technical. So my point being is you have these value cards. associated to pain points that you've done all this research on. So when someone says something to a salesperson, they have that right there, and all of a sudden it resonates. So you do this, now you've created this why, almost like a system for the why for cybersecurity, and that all of a sudden opens up the conversation and helps you to identify right-fit prospects and help ones that are not right-fit self-select out, right? So I just kind of like went on a complete monologue there, but—

No, that's great.

This is, this is the way that you do the why and make it about business outcomes. But there's— and like I said, there's a lot of work that you have to do behind this. Like, this isn't just, you know, 15 to 250 manufacturing companies in between, you know, $10 and $100 million. This is like— like, this would be an example, like, in a manufacturing company who has a CTO role or a COO role who's investing in Industry 4.0 and cares about automation And has these things standing in the way with these regulations that they care about and sells into this type of industry like the Big 3, like GM or something like that. Now we're coming across somebody who's a really unique individual and we understand the exact pain they have. And now our cybersecurity controls meet those exactly. Now, right, that doesn't help when you have an existing base, right? But you have to start to segment and start to move towards the ideal that way.

Yeah. Okay. Yeah. So, yeah. So you're talking ICP, right? You're saying, hey, well, if we're smart, we might think that, well, I'll take that back. It might be a good idea to get really specific about who you're trying to serve, like really, really, really specific as opposed to, well, any business out there and we're going to try and sell them vCISO services. That's probably not going to work. Right?

Right. Well, and so here's the— this is why it helps. Like, we're talking about 2 things, right? Net new and current base. I still think the current base, you have to level set and you want to go out and give everybody in your base a risk assessment. Right. And this is— this comes from what I did, like what I went through 12 years ago when I built that first practice. As you said, we didn't have the why. Right. Well, how do you give them a why? You say there's risk. Well, what do we all know when they say there's risk? Well, we thought you did that for us. You talked to our cyber guy. Like, we— you just told us we had to buy EDR from you last month, right? Like, I thought this is handled. So the thing is, like, the risk assessment shows them their risk, but I say present it to them in a way that says, okay, well, without our IT services, you'd be at 95% risk. With our IT services and the cyber that we've sold you, you're at like 60% risk, right?

Mm-hmm.

We typically like to see customers at 30% risk, and there's a delta of about 30 there. So you don't have risk management. You might want some sort of VCISO. Maybe we don't call it that, right? But some sort of strategic cyber advisory. And there's some other controls we can recommend. So now we've preempted all of that. We've showed them that they have risk. And then if they choose to do nothing about it, we say, okay, that's fine. We're not going to force you. I'm not somebody who's for signing a— like says, sign a waiver, sign my waiver.

Right. Yeah.

But at least that's in essence, we're doing that, right? So a story about this actually that happened with us. This is about 10 years back. We went through and did the risk assessment for a large customer of ours. They were co-managed IT, about 350 people, I think. And they had their own cyber guy, right? So we went and did the risk assessment, did this motion. We were doing this, getting risk assessments to everybody in the base. And said, okay, well, you have a lot of risk, right? They, they didn't have any of our cyber services. We were just IT and they had like an EDR and we're like, well, there's all sorts of problems in the environment. You have like an 80% risk. And typically companies that have 80% risk tend to see ransomware within a year.

Right.

We got to the point where because we had done this so much and seen so many environments, we said, okay, well, yeah, if you're at this level, The outcome is probably going to be ransomware if you don't do anything about it. They said, no, we're fine. We got it. Big customer, one of our larger accounts, right? 6 months later, they were hit with Conti ransomware. And I'll never forget getting that call that night and said, you know, so-and-so has been ransom— all their computers have ransom notes. And I'm like, oh, man. But because—

I told you so. Yeah.

Oh, yeah. And it was like, oh, man. But, you know, here's the thing, though. Doing that, they weren't upset with us. It wasn't, we thought you did this for us. It was, you told us, you showed us our risk, you prepared us, and we accepted the risk. So now we need your help. And I think at the— by the time everything was said and done, their backups were gone. We had been recommending a cloud migration on the CIO side of things. So, well, we're just going to do the cloud migration live and rebuild everything in the cloud. So we did all this. So all that to say is that, um, you know, all double-time ransom— because we charge for incident response double our standard rate, so it's $500 an hour for all this stuff, right? And I think we made around $250,000 in just the incident response and recovery. And then after the fact, they came back and said, okay, yeah, now we're going to sign up for cybersecurity.

Now we're going to sign up.

Yeah, so that was like $23,000— I think it was like $23,000, $24,000 a month on all that, with vCISO and everything else.

Wow.

So all that to say is doubled our spend with them another quarter million, and the relationship was better after everything. Now, that wasn't fun. I don't hope that happens to anybody, right? And it definitely taxed us to do it, but at the end of the day, it was very profitable and, yeah, you know, better relationship. So I guess my point is, is you got to get risk assessments to all of your clients And presented in the way I just said, because once you start doing that, you will uncover a ton of opportunity that you didn't think existed, right?

Yeah. Well, and I would probably take it a step further to say, hey, you're doing a disservice to your clients and yourself if you're not doing that, that level of risk assessment, because they're assuming 95% of the time, they're assuming like, hey, you're taking care of security for me. Even if you told them you're not fully taking care of security for them, right, they're assuming that you are, and, and you're not even giving them the chance to say, oh, I want you, I want you to do more for me.

Yeah, yep, exactly right. I, I'll remember we— so again, people say like, oh, uh, you like, my customers don't care. I was like, have you really presented it to them in that way though, right? I'll never forget I was doing one, it was a 12-person nonprofit, and we did the risk assessment, and I'm kind of like, yeah, whatever, we're going to do this, they're not going to do anything about it. They're like, oh yeah, this sounds really good. They want to sign up for the VCSO. So I think it was like a, it was like a $2,800 or like right around $3K a month for just the VCSO for a 12— I think it was more than their IT spend or close to what their IT spend was just for that.

Yeah.

But they understood it because they have a board and they understand risk management and the people on the board are, had come from enterprise, some of them. So they're like, oh yeah, this makes a lot of sense. What if you didn't ask them about that? That's $3K a month that you just left on the table, right?

Yeah, 100%. Yeah. And so I want to kind of go back as well to thinking about— because you're talking about the, you know, VCIO, VCIO and vCISO as advisory, right? As opposed to like— and we'll put that in contrast to, oh yeah, you get an assigned VCIO every time you sign up for one of our managed services plans. Um, so, so maybe talk a little bit about that. Like what did, what did in the MSPs that you were a part of, what did that look like as far as like having a true advisory role versus, um, just kind of what everybody calls VCIO?

Yeah. So I think number one, it starts by charging for it, right? Because if you say it's included or it's a, it's a part, it's an upcharge on the user count, like that's, it's just not going to happen because it's an afterthought. Right. So when you charge for it and you start understanding unit economics for what it takes to deliver that service, all of a sudden you can make— you can either hire or carve out a role for somebody that's currently in your organization to start making that their focus, and they own it and they drive it forward. Right?

Right.

That's the way that it actually becomes successful, is when we create a service and charge for it. And, you know, I— again, I think the per— adding, like, tacking on the per user count doesn't really work because You could have a 15-person SaaS company that needs ISO 42001, you know, for some AI thing that they're doing, right?

Yeah.

And so you, you add— you couldn't add enough to the user count to make that profitable, right?

Right.

And then likewise, you have a 250-person manufacturing company that maybe needs just, you know, a risk assessment once a year, an incident response plan, and then some quarterly strategic meetings with their executive team to just help you know, kind of push them along, they, they would— they'd be far overpriced that they'd never buy it if you did it per user. So you— I think you just need to have a separate service for it, to answer your question, that's carved out and has its own set of profitability metrics with it.

Yeah, yeah, yeah. So, and, and same, same with vCISO, you would say? Like, hey, that's, you know, that needs to be, uh, I mean, even more so than You know, we're our security stack, right? Which, you know, which obviously we're charging for, but, but you have to charge for the time that it takes to actually run their information security machine, if you will.

Yeah. And I've done it both ways and it just doesn't work the other way. So I say learn from my mistakes and this is what— and, and here's the other thing. When this— clients value it, you know, it's the whole thing of that you value something that you pay for, right? And so if something's free, like, we're gonna go give free risk assessments to all of our clients. Oh, that's great. Do they— they're not even gonna care. They'll be like, okay, good, you're just trying to sell me something. If it's free, what's the catch? There's always a catch if it's free, right?

Mm-hmm.

So again, when you go and give risk assessments to your clients, you have to ask them to pay for it. Say, hey, we— this is a new cyber world that we're living in. You know, 10 years ago you didn't need antivirus, or you just needed antivirus. Now we have all these other things. We need to really help you baseline your environment, and it caught— this costs money to do it, right? And so we're asking you to pay, you know, not a crazy amount, but we're asking you to pay something. And so it's a whole different conversation. I think— I forget who said this, but just if you can get someone to pay you a dollar, it's a whole different conversation than it is for free.

Right, right, right. Yep. Well, and, uh, and you're speaking, uh, you're speaking out of the, you know, one of the playbooks. Um, you know, I do a lot of work with service leadership and, okay, and part of their, um, you know, I mean, part of the recommendations and actually I won't even say recommendations. I'll say part of what makes the most successful MSPs successful is that even as part of, um, bringing on a new client, like before we even make a proposal, We're doing a paid assessment for a client, um, for a potential client in order to, uh, yes, assess their environment, look at what they have, figure out if, if they align to your stack, all that kind of stuff, but also to assess the risk of that prospect to me, the MSP.

Yeah.

Because I'm, I'm entering an agreement in which I'm saying, hey, we're going to do unlimited support for you. Um, and, and so I, but I have to first understand like, Well, can I actually make money doing support for this company? Or, or is it, is it a complete mess and they're not willing to spend, they're not willing to spend to fix the environment, right? And so it's probably, and part of that too is like getting to a quick no if they're not going to be willing to pay for the assessment, right?

I was just going to say that.

Like you said earlier, um, you know, you're looking for the strategic buyer who's actually going to value your opinion And say, yeah, well, we'll do what you recommend we do.

Yeah, this is exactly what we would do with prospects. Um, and I can remember I've said this so many times till I'm blue in the face, and I meant it. And, you know, it's, it's a mantra we have in the Power Grid where we say value over everything. If you provide value and it's the right fit customer, you're gonna win, right? 9 times out of 10. But to customers, you know, back in the day, I would say, listen, We— this risk assessment is not meant to be gated because I think still to this day shops come in and they do— they'll do like a cyber risk assessment and they'll give you like a long list. I'm like, no, when this is done, you could literally take what we give you and walk it across to your own IT team or to your current MSP or to whoever you want to give it to. They could take the findings and they could execute on them. You're going to get a ton of value out of this. So we don't gate anything. We We put our, you know, we, we show you through proof what we can do. So when at the end of this, you're going to have a complete packet of like how to get better. Now, whether you use us to get better, you just do it yourself or whatever the case may be, that's fine. But there's huge value there. So that's why we ask people to pay for it. And yeah, you know, if it's the right buyer, like you said, they're gonna be like, oh yeah, this makes total sense. Let's see what you got.

Yeah, yeah. And you don't have to charge a ton for it, but, but you got to charge something. Right. And, and even if it's like, hey, we'll credit it, you know, we'll credit half of it back to you if you, you know, all that, that's totally fine.

Yeah.

Um, you know, if, if you need to do that to, to win the, to win the assessment, but, but what you're really looking for is that, that person who's actually going to value the work that you do. And then, by the way, if they're, you know, if they're, if they don't value it that much, they're not gonna show up to your meetings.

That's right.

They're not gonna, or they're gonna be like, ah, we can, we can skip this month because, or this quarter because we don't have anything new for you, that kind of, that kind of stuff. It's like, no, we can't, we can't skip. That's not a thing that we can do, right?

Yeah.

Um, so yeah, so there's a lot that goes into that. And, and, and I think to the, the, you know, there's always pushback, um, every time I introduce this concept with a client of mine, um, or, you know, or really, uh, many MSPs, because it's like, hey, the way that we attract potential clients is with free assessments. And I'm like, I don't know. I haven't ever met a client that was like, free assessment. What? Oh my gosh, come. You know, like it's not a super value add or it's not usually what wins you the opportunity to talk to the client.

Yeah. So basically you just attract tire kickers with that. Like, because I've done, I've done that too. I've done the free assessment thing and I don't think, and maybe I don't think I closed any deals off of that. Or if I did, I wish I didn't.

Yeah, yeah, yeah. Those are the ones we actually didn't want.

Yeah, but I'll tell you though, you know, how you attract them is what I just mentioned, is talking about their pain points and talking about their business like you actually know what you're talking about. So what— that's through SEO, that's through print. That's like SEO. I mean, everyone, you know, knocks on SEO, but it's still a lot of the way that You know, we get leads in. If you have to understand what they're Googling and what the keyword searches are going to be, if you really want it to be effective. So if you don't understand that, then you're not going to get the right types of leads in. And it all goes back to really understanding and talking the way that your clients talk.

Yeah. Yeah. And a lot of that's through interviewing them, doing the risk assessments. Yeah. Under— and having that strategic conversation like you were talking about earlier. Right? Like you're going to find commonalities in that. And, um, I think, I think often we forget, uh, MSP owners forget like, hey, uh, your clients have all the answers as to what potential clients want to hear. Right? Like if you have good clients, there's other people out there like them that are looking for the same thing.

Right? Yeah. Yeah.

So, um, totally makes sense. So, um, so I want to switch gears for a second and, and just kind of talk about like what, You know, as you were growing, I mean, you're with these growing companies, right? And you, you know, you grow into kind of cybersecurity leader and that kind of a thing. What's, you know, I mean, what do you kind of point to as like maybe some of the big lessons that you learned along the way in leadership?

Well, I'll tell you the first one that always comes to mind when somebody asks me a question like this is Because you really, really have to overextend yourself in terms of communication when you're building something like this out in an MSP. Because I'll just be frank, I made a lot of people unhappy with launching the cyber program because guess what? It puts more work on everyone's plate, especially vulnerability management.

Yeah.

Like, you go to your engineers and your sysadmins and your help desk, and all of a sudden we have all these vulnerabilities that we have to fix. And, you know, you're pointing out we didn't patch this, or, you know, so it can cause a whole bunch of friction in your MSP. And so you really have to do a lot of work upfront to say, here's what to expect. How can we make this work for you? Okay, if this starts happening, what's that gonna require from your team? Are you gonna need more resources or can we do it this way? You know, and the typical thing, no, we can't do it that way. You know, okay, well tell me how we should do it.

Yep.

And, uh, so I think taking the biggest lesson I learned was really being open and going above and beyond to go past what you think is fair that you, you know, that you should do to really spoon-feed it to people in the organization because there's a whole lot of benefit on the other side. And once we got through that, we realized that, but there was a lot of unnecessary friction because I just assumed, hey, this new service is great. It's going to make the company a bunch of money. Everyone's going to be on board. Well, there's all sorts of competing priorities and personalities and politics, right, that feed into that, as we all know. So, uh, and this— and it's new. So when something's new, people maybe don't want to admit it, but they're a little bit intimidated, a little bit scared by it. And so that, that causes even more walls to go up, right? So you just have to spend a lot of time addressing all of that when you get started.

Yeah. Yeah. Well, and I think, uh, I think that goes for, golly, most everything in leadership. Yeah. Um, when you're trying to build a culture, um, when you're trying to communicate with your team, um, it's like once you feel like you've said it 1,000 times, then it, it just takes like 1,000 more in order for people to really start getting it.

Yeah.

Because, yeah, I mean, it's, it's what seems obvious to, to me as a leader to just— it's, it's like a— I don't know, it's— it doesn't make any sense to people until they hear it over and over and over again in different ways and stories and imagery and, and, and, and, yeah, it just takes so much to really get the concepts across that you're trying to, that you're trying to share.

Yeah.

Yeah, that's what I've found.

Well, and I just, I just saw, I forget who said this the other day, but I was watching a video on LinkedIn and someone was talking about how whenever they would sign up a new customer, the whole help desk would groan because like, oh, another customer. And I'm like, I remember those days so well.

Yeah.

Because I, you know, I started on the help desk and It's like, oh yeah, I didn't really think about that. This meant that the business was doing better and potential more people. And I just thought, oh, more tickets.

Yeah, more tickets, more work for me.

So you have to understand, right, people, like you said, as a leader, you forget those things. And so you really have to understand, okay, this is going to mean more tickets, but I want it like, it's going to help us all grow. And if we really do like this place and we built a culture that we all want to love, that we all like, and that we want to protect, This is part of the thing we need to do to protect it. And so when, again, it's almost like we're talking about selling cybersecurity and understanding their goals.

Yeah, right.

It's seriously the same thing, right?

It is. Yeah. And in a lot of ways, and I've, what I found in my MSPs that I've built over time is when, so when we, what we started to do was align compensation with, um, you know, with the health of the company financially, right? And so, so what people got on— we, and we didn't call it a bonus plan or anything like that, we called it incentive, right? So it's— but it's like, hey, part of your incentive is aligned to you while doing things you're already supposed to do, like putting in your time and showing up on time and, uh, you know, and, and utilization and stuff like that. But then a big part of it is based on How the company is doing, and specifically for techs, it'd be based on services gross margin, right? So which is what the biggest lever for an MSP profitability, and it's the it's the one thing that they can actually help to control. And so when you align incentive with that, and then you actually teach them the things that helped you increase gross margin, for instance, for an MSP, it's like oh. adding a client's a good thing. That's great. And then you, when you teach them like, hey, if we add a tool, that's going to cut into gross margin. And they're like, ooh, maybe we don't need that tool that I said we really, really, really, really need. Um, or, you know, if we add another team member, that's going to cut into the gross margin. Are you good with that? It's like, well, maybe, maybe we're okay. Maybe we can work a little bit harder. Right.

Right.

And so, you know, I think that that's, um, you know, that that's another, you know, another piece is like, how can we, how can we teach our people Like how what they do actually aligns to the success of the business. And that's what that story reminded me of.

No, this is great because you just triggered something that I wanted to talk about earlier when we were talking about the whole leadership thing is, you know, okay, putting in OKRs for that exact reason, right? So objectives and key results for those of you listening who don't know what that system is. Um, and that plays well with EOS as well if you wanted to, you know, whatever you're using to build your business. But the point being with an OKR is that they all waterfall down from business objectives, right? So I was, I was actually the one who said we should do OKRs and helped implement this in RMSP, right? So, um, create—

I created—

we created 4 categories. It was like growth, sustainability, financial, um, and efficiency. Right. And then, uh, everyone— those were the 4 OKR objectives. And then every department had to create an objective for each of those that fed— and we had organizational goals that that leveled up to, right? And then people had their goals that leveled up to the departmental goals. And so they would see exactly like, why am I doing this thing or updating this documentation or working on this? Because it feeds into this departmental goal, which helps the organizational goal. which helps us get healthier, which helps me make more money at the end of the day, right? And so, like, doing that is so helpful because when you're, you know, able to share the financial health of the business, they're able to see what they're doing on a day-to-day basis directly affects how that financial health gets worse or better or worse. All of a sudden, it's a whole different ball game. So, no, OKRs is a great way to go about that, in my opinion.

Yeah. Yeah, I mean, that's, that it's a great system. And, you know, what I always say is like, hey, I don't care if you run OKRs, if you run EOS, if you run, you know, scaling up, whatever, have some kind of system that by which you running your, running your business and doing actually doing planning. Because I can't tell you how many MSP owners I've talked with that I'm like, hey, what are your goals for the year? And they're like, well, we want to grow and I want to make more money. And I'm like, well, hey, you know, those are, that's great, but they're not really goals, you know? Um, and, and, and a lot of MSPs just kind of run like, you know, hey, we're just hoping that we grow and, and, and do better next year than we did this year. And, um, and oh, well, it can work for a while, but you can't scale that way, right?

Yeah.

Um, it's, you've, you've got to have some kind of system in place. That connects where you're trying to go with what people are doing every single day.

Yeah, the— it's funny, back to the, back to the, uh, it's— that's maybe the contrarian opinion too, is that like all these frameworks, they're kind of the same.

They're all kind of the same. Yeah, yeah, yeah.

It's just about accountability and everyone rowing in the same direction at the end of the day, right?

There you go, there you go. Yeah, and it's like, hey, the you know, the guy who invented, who created EOS, actually he branded EOS. He took all kinds of concepts from all different things and branded it, right? And I mean, that's, that's really what it is. And so, um, yeah, there's, it's kind of like there's nothing new under the sun. It's just like pick something and, and, and run it, right? Um, and that's, uh, that's a huge, that's a huge piece of, uh, well, it was a huge piece of my success. And I don't, I don't know any MSPs that have been highly successful that aren't running some kind of framework like that.

Yeah.

And, you know, I mean, some things break at scale, but by and large, yeah. So I gotta, you know, when you think about what MSP owners are missing right now, like what do you think folks are missing by and large?

I think they're— I think by and large they're missing just taking it, taking a step back and being more strategic. I, you know, I find myself falling into that. I think it's a struggle for every entrepreneur. Um, but you— no one's ever going to care about your business as much as you do. And so it's hard to see somebody do something as 80% as good as you can do it, you know, and just let that be good enough, right? But that's the way you grow. And so I think by and large, most people are just really need to take a step back and give people safe environments to fail and understand that it might not be as good as you did it, but 80, you know, 100 times 80 is better than 100 times 1. So.

Well, you know, that, that is, that's something that, well, I also talk about often. Um, is, you know, because, because it tends to be like for, for most MSP owners, I mean, they, they kind of grew the company on their own back, right?

Yeah.

It's like, hey, I've always been the best sales guy, the best tech, the best, you know, everything. And, um, and, and, and I talk about it a lot in the, in the realm of like identity, um, because it's like, hey, right now, or I mean, this business is your identity and letting go of stuff is extremely scary.

Yeah.

Right? Because, okay, well, what, you know, and then there's, we go through a lot of different conversations around it, but, you know, ultimately what's the worst that can happen? Well, you might lose a customer. Probably not, but you might, you know, if you allow somebody to do something only 80% as good as you could do it. I think the real trick is Um, that finding people who are better and smarter than you and not being intimidated by it, because, because I think there's a lot of folks who, you know, they really, they probably could find somebody who's better and smarter. Um, but, but they kind of want to be the smartest person in the room.

It's, that's interesting is because the, you know, the MSP that I, that I cut my teeth in, it was, they just did that naturally. It was a it was not a technically founded MSP. It was founded by 2 guys. One was a sales guy, one was a marketing guy. And so they're like, yeah, we know we're not the smartest people, but we know that we need to hire those people and we know how to sell, right? And so that's— I think that's a better way that most MSPs could, could operate. And by the way, I think this also contributes to like the shiny object syndrome, right?

Mm-hmm.

Is getting excited about a piece— like if, if you as the owner are the one making all those decisions, who's gonna call you out and pull the reins when you say, oh, this is really exciting, I want to go do this, and you take a left turn and just completely abandon all the things that were working because this is exciting, right? If you have a good leadership team that's smarter than you, they can course correct and be like, no, we're not doing that.

Yeah.

Or we're going to do that, but we got to do X, Y, and Z first. Like, one thing I always remember asking in the strategy meetings was like, we want to do this, and I go, okay, well, What's the market research that's backing up that decision for us to do that? And it was just like, you know, you can see like, oh, Jesse, come on, man. I'm like, but seriously, like, what is, is there anything here that, that says other than this one customer wants this right now and it's a hot opportunity that we should go do it? Like, what's the macro view of that? We should really do this.

Yeah.

And then it was like, oh, well, you know, a lot of times there was like, there was a macro view, but we want to think that through and make sure we understand that before we go down that path. path, right?

Right. Yeah. Yeah. Well, and, and it's, that's kind of along the lines of, of making, making data-driven decisions, um, rather than, you know, I mean, because yeah, a lot of owners, it's like, well, I've, yeah, I've got 1,000 ideas. So I want to do this and I want to do that and I want to do that. And then you tend not to finish, uh, the things that you've already started. And, um, and, and so like, how do we, how do we become more of a data-driven organization? and what data tells us that we should make this decision versus that decision, or whether we should spend this money or not. What's the framework by which we're making those decisions as opposed to what does one guy think, right? I mean, because, you know, that might not be the best, uh, the best way to, to think about it. So yeah.

And hey, if, if you had the idea and it was just your intuition, we— and we prove it out, I'm gonna, I'm gonna be the first one to pat you on the back and say, wow, you You really know your stuff.

Yeah, yeah, yeah.

Good, good. You got good vision, my man.

Love it. Love it. So, so I want to think, you know, I'm really interested to get your opinion on, I mean, what do you, what you see kind of unfolding over the next few years as far as, well, what things are coming down the pipe? And I'll let, I'll let you say the word. But like, what do you think is, what do you, what do you, how do you see things changing over the next few years in, in the MSP industry?

Yeah, man. I, uh, I, it's so interesting right now because it feels exactly like it did when cloud was happening 10 or 12 years ago. Right. And everyone's like, oh, this is different. Like this is a much more powerful technology. And I'm like, yeah, that's true. You know, but it's also like, so, so yeah, AI is going to change things. Just to be frank, I just feel like I'm just so sick of talking about it.

Um, well, you know, I've got 12 more questions on AI. Yeah. So just, just settle in. No.

Yeah. Not in a, like, you know, but it's just like everyone and their, everyone and their mother is so like the hype. We're in the hype bubble right now for sure. You know, and I don't think it's actually delivering as much as the hype is saying. So this is what I go back to shiny objects is like, we got to go AI first. Well, yeah, we have to integrate AI, but like, again, what's the macro vision for the— for where we're going? So, so where's the industry going? But I, but I think, again, AI is accelerating. What I think we all knew is that I think we have to get better as— because what is AI doing? It's making technology much more accessible for everybody.

Mm-hmm.

Like, so, uh, you know, again, the trite stuff, oh, tier 1's going away. You know, I'm not gonna say that. I mean, I think tier 1 will change cuz some customers are more willing to solve things on their own with AI. The new generation will. But I think at the end of the day, we really do have to, we have to start building that moat around our clients. So it's not good enough to just do IT services anymore. And of course, this is me being a hammer seeing a nail and being like, oh, you should be doing VC. So, but you should be doing some sort of strategic motion with your clients.

Right.

Understanding their business and helping them move the business that way. So if you're— if you don't have a dedicated function for that, I think you're good. It's something you need to put in place, right?

Mm-hmm.

So where's the industry going? Um, I think the industry is going towards, uh, it's— we go in cycles, right? Like we can— we, with software too, we consolidate everything. We want everything with one provider and then we splinter it out. And like we're in the middle of this, we need to go back to consulting more cycle right now. So I think in the next 5 years, it's going to be really important to be able to go into a client's business, understand their business, and then help plug in the pieces of technology and cybersecurity and risk and AI and everything else that take them there. So all that to say is I think, yes, specialization and focus is going to be really where we need to focus as an industry going forward. So the days of the generalist IT provider, I think, are going away at some point. And so maybe I put my foot in my mouth for saying that, but I really do believe that because I've seen—

Some people come at you.

Yeah, I'm sure they will. But I've seen this both ways, right? And so, as you know, because if, you know, we're connected on LinkedIn, this is— I talk about this all the time. It's like the more focused you can get, the better success you're going to have because you're going to be able to talk more intelligently about those types of businesses. And that's not to say you have to focus on just one, but I really do think you should. Like, if you're thinking about this from a strategic perspective as an MSP, pick a vertical that you know you're really good at and then get focused in there and start creating these motions. And once you've got that kind of stood up, then you can say, okay, let's pick another one. Let's do the same thing. Right. And so that's the way we're going to see success. And whether that's— and it depends on your organizational DNA, whether you're a cybersecurity MSP, Or you do want to go to like the AI, AI-first type of thing and use that as your, your spearpoint. There's different ways to go about it. But I think all that aside is like the consultative focus on a vertical and really understanding how to enable those businesses is where we win.

Yeah. Well, I mean, hey, I will not argue with you there. I, you know, I've built 2 MSPs. The first one was a generalist MSP. And the, and after that experience, I mean, we did, we did great. But after that experience, I was like, my next MSP is going to be absolutely vertically focused. And because, because I just saw from, from seeing my peers and, and other things, just how, how much easier it can make a lot of those conversations, the marketing, the, and where, where you show up, the, the conversations that you can have, the introductions to To other people. And the MSPs that I see growing the fastest now are those who are like very specifically focused, not even, not just medical, but like eye doctors, right? Like we do, we do eye surgeons and that's it, you know, or oral surgeons or that kind of a thing where it's like, hey, we know everybody in this industry, everybody in the industry knows us, and we're the go-to guys in that, you know, in that space.

Yeah.

Right.

So yeah, I always say like CMMC is not an ICP. Now if you're doing CMMC for people who manufacture submarine parts for atomic submarines, now that's an ICP.

There you go. There you go. Yeah. Yeah. I mean, yeah, the more specific the better. And I think a lot of folks are scared of that. But I think that there's, well, there's enough benefit to at least explore it and see how you might do.

Yeah, and like I said, you know, if you're looking for some crazy, like, new answer from me, you're not gonna get it because that's just like, you just do that. Just do that on repeat and you will have success, right?

Yeah, yeah, yeah. And, and I'll, I'll throw it— throwing in my 2 cents, I think that it's kind of, you know, on, on what's coming down the pipe. At the end of the day, um, and I heard this a long time ago, I didn't make it up, But, and I have no idea where I heard it or who I heard it from, but MSPs own the last mile to the customer, right? And we've had, you know, there's been plenty of super large companies that have tried to do SMB managed services and it's never worked and it's never going to work because of the relationship, right?

Yeah.

We have, like, we're the local boots on the ground relationship with the customer. And I think that's going to continue to be the case in the future. The caveat I will throw on is don't let somebody else come in and be the expert for the next thing, right? Which is probably AI, right? So, you know, you're going to have to address that. You can't stick your head in the sand about it.

That's right.

But you do have to own that relationship. Um, in order to be successful.

Yeah, 100%, right? And, um, I, you know, I don't know, uh, if, if we don't have a place to put it, whatever. I— we have an AI enablement framework from the Power Group that we give away for free for those conversations. So, uh, yeah, if people want that, you can ping me on LinkedIn or whatever, Brian. If you've got a place to put it, we can do that. So yeah, I'm not saying we should ignore it. Like, we have ways to do this, but I also say we have to be measured, and it's a risk decision. Right? Like, what are the positive risks? What are the negative risks? And to your point, we have to continue to build that moat.

Yeah.

And the more things you have to do makes it more complicated, the more types of clients you have to work with. Like, I think about it like a slot machine. It's like slot machine math, right? You have like 4 reels on a slot machine, on your MSP slot machine, okay? You have your marketing, your sales, your onboarding, your service delivery, and your customer success. So, 5. reels, right? 5 things you got to do. Now, each type of company you work with is another symbol on that reel. And so the more symbols you put on each reel, the more options you have, the more things, the more chances you have to make a mistake.

Yeah, there you go.

What do I want on each reel? I want a cherry on each reel. That's, you know, like you said, that one type of medical that's going to come up jackpot every single time.

Yeah, jackpot every time. That's a great That is a great analogy. I love it. I haven't heard that one before, but I love it. I love it. Awesome, man. Well, yes. And we will, you know, yeah. So just kind of as we're wrapping up, I, you know, this is one I always love to ask. And when you think back, what do you think is the biggest mistake that you've made as a leader?

I think it was thinking I was the smartest person in the room. Or, or, yeah, I, I remember, I remember one, one thing, um, and still I hear myself say this and I'm like, I don't know who that person was, but I, I, I'm glad I'm— hopefully I don't end up like that anymore. Uh, we had, this was in during COVID Um, and you know, I was the guy that was always coming in as a sharpshooter and I could always fix it and I always, always could figure it out, could always save the day.

Right.

Mm-hmm. And we signed up, uh, one of those emergency hospitals. at McCormick Center in Chicago. It's like a 10,000-bed hospital, had to be stood up in like 2 weeks, right?

Or 2 months.

Wow. It was crazy. That's the biggest project I've ever been a part of. But the salesperson on it, I wasn't a big fan of. Um, she was, you know, uh, didn't follow procedure, one of those people, you know, that's, you know— anyways, wasn't a big fan of her. And she again went around a bunch of things to get this deal done, and so dropped a bunch of stuff on our lap at the last minute. And I remember saying And that call, I said, well, I guess I'll just fix it like I always do. And I couldn't fix it. It was too big of a project, right? I had needed help from everybody to get that done. And so, yeah, probably the biggest mistake I made was just being arrogant and thinking I could do it all. And that's a really bad place to be.

So don't be. Right. There you go. Don't do that thing. Don't do that. Okay. Yeah. I guess like, yeah, well, I'll leave that there for now. So I want to— so I just kind of want to do a wrap-up, and I always like to wrap up with some rapid-fire questions. So this is just kind of like first thing that comes to mind, quick answer kind of a thing. So first one is, what's a belief that you've changed your mind about in the last few years?

Hmm. What's a belief I've changed my mind about in the last few years? I think our medical system and homeopathic healing. So, yeah.

Okay.

Okay.

Interesting. And you don't have to expand. What's something that you have been curious about lately?

Well, that's a tough one. What's something I've been curious about lately? I've been curious about kind of where— I've been curious about where we're going as a society. I feel, yeah. And I think like we're, we're on the— we think everything's always going to improve. And it's, I don't think history says that it always will. So, okay. Yeah. Not, not, not, I know, not, not in a doomsaying kind of way, but I've just been kind of curious about like macro socioeconomic type of things that are going on right now. So yeah, that's it.

That's, that's an interesting one. Okay.

Yeah.

Um, what is— what's one thing that you can't live without in your daily routine?

Cattle.

Working on the farm. Yeah, working on the farm.

It really is like, that is super grounding. Like, I go out and I have farm— I get up super early and I do farm chores before I start my day every day. And like, and then I have responsibilities at the end of the day When, you know, and for evening stuff. So I, yeah, I couldn't, I don't know if I could exist without that.

Yeah. Okay. And then what's, what's your, what's your go-to way to unwind?

Tractor, tractor therapy, I call it.

Okay.

So if you, if you're having a bad day and it's tough, you just go outside and go move some stuff or cut a field or whatever you got to do on the tractor. And that usually solves the problem.

Love it. Love it. Okay. And then what is a book or an idea or a piece of advice that has shaped you the most?

Um, boy, a book. I, I'll tell you what, uh, going back to like really digging in the crates for this one, but The Goal, um, from— I don't know if people know that book, but it's— more people in our industry probably know The Phoenix Project, but it's It's what the Phoenix Project was based on. I think the concepts—

Yeah, but Eliyahu Goldratt, right?

Yeah, yeah. I think, I think—

I know it from my operations management class in college, right?

I think, I think the concepts in there are so timeless. I think everyone should read it and understand like the, the idea of bottlenecks and throughput and that kind of stuff.

Yeah. Yeah, yeah. No, so good. So good. Awesome, man. Well, this is, this is, this has been great, Jesse. I'm really glad we, we finally got to do something in hit the record button. And, you know, yeah, I always like to give a chance to, you know, I mean, well, if anybody's been on LinkedIn, they've probably come across your stuff, but where can people get ahold of you if they want to?

Yeah, so obviously LinkedIn, look me up. It's backslash SecOpsWarrior, S-E-C-O-P-S Warrior. Yeah, I made that back in the day. So that's what we use. And then, yeah, if you want to check out the Power Grid vCISO system, that's powergrid.group, P-O-W-E-R-G-R-Y-D dot group.

Okay, awesome, awesome. Yeah, and, and if nothing else, follow Jesse on LinkedIn because you get a lot of really cool stuff. I'm on LinkedIn as well if you, if you want to get in touch. Either of us would love to hear from you. But Jesse, man, really appreciate you taking the time here and yeah, just throwing out some knowledge bombs on the crew.

Yeah, it was super fun. I felt like we could just keep going here, you know, but yeah, the always. Yeah, like Brian said, reach out on LinkedIn. You have questions or just, hey, what did you— if something you heard you wanted me to get deeper on, I'm happy to chat. I'm always on LinkedIn, so drop me a DM.

Rock on. All right. Well, thanks so much and we will see everybody next time.

Later, guys.

Thanks for listening to the $10 Million MSP Podcast. I'd like to encourage you to take just one insight that you heard today and put it into practice because small shifts create big momentum. If you enjoyed the episode, make sure to rate and subscribe on your favorite platform so you never miss a conversation. Thanks again for tuning in and I'll see you in the next episode.