How To Build A Compliant Tech Stack AND Remain Profitable!

What is up, guys? Hope you're having a great day today. My name is Chris Weiser, here with my good, trusty companion, Ryan o'.

Hara.

What's up, Ryan?

How's it going? You seem to get like way too happy about that music.

That was good music though. You gotta play like royalty free music on these things. Yeah. Streaming it doesn't zap it because, I mean, if it was up to me, I'd be playing like some hip hop stuff. That'd be, that's be.

Whatever.

So anyway, so we got a great, great webinar for you guys today. Very, very excited. This is like one of Ryan's. Would I say your favorite subjects?

It definitely used to be my, my favorite subject, but it's funny coming with my background, so. So for those of you who don't know, I was a member of this program with my MSP for five years and then sold my MSP to come work on the other side of the fence here. So kind of my journey coming through this program, the way that we send our members through still to this day, I came into that program very much. Like, I love the tech. The tech, the tech, the tech. Like, you know, I don't want to get out of this.

I don't want to get into this typical MSP way. Right. Like, I'm tech focused, et cetera. Right.

Yeah. So I mean, I still find this stuff very interesting. But once I learned the sales process and kind of of went through that, that became my addiction. Cindy calls it your dopamine hit. Right. And I was having so much fun going through that sales process, getting people upgraded, getting people on the stack that I knew that they needed to be on. Like, that's the part of it that was really fun. So I still really, really love this stuff, but it was really about making sure that I knew that my clients were protected.

Yeah. So. So we got a pretty cool group of content today. I'm going to talk a little bit about sales stuff as I always do. Then Ryan's going to go into basically how to build a profitable tech stack for you. Now there's a couple things that I'm going to touch on and I'm going to kind of go back and forth with Ryan a little bit as, as he takes over and does his content. But I'm still very much. And I want you guys to keep this in mind. I'm still very much all about strategy and scale as a business owner. And while it's. I say this a lot during our onboarding calls with our clients, Every week it's is you need sales and process to be your main focus. You need sales and lead gen and revenue as an owner to be really what you mainly focus on. Now, that does not mean that you neglect it. That doesn't need. That does not mean you neglect service or any of those things. But your role as the owner should be lead gen, revenue, cash flow. That's what your goal should be and that's what you should be focusing on. That should be your priority. And then all those other things become great, including making sure that you're really profitable with your tech stack, which is what we're going to talk about today. Also really scalable with your tech stack, which Ryan's going to talk a little bit about today as well. Both of those things really, really matter. And here's another thing that I'm going to tell you. I'm going to get into this with my content a little bit here. You are a cybersecurity provider, whether you want to be one or not right now. So whether you think like in most MSPs, I'll be the first one to say I was scared of security, I was scared of compliance. I was like, it was stuff that I didn't want to focus on. It's one of the reasons I sold my company eight years ago. It's stuff that I was like not super comfortable with because I don't have a tech, a strong tech background. I'm much more of a sales and marketing guy than I ever was a good, I was a decent tech if I was better with people than I was with computers, honestly. So it's stuff that I want you to really be conscious of and be aware of because of the really, really important things. Things as you got, got a couple other things that we got. We got some prizes that we're going to be doing today. We got a live chat going on for our webinar attendees. We have a massive crowd in the webinar with us today. We also have another massive crowd watching simulcasted because right now we're in Streamyard webinar. We got a bunch of people live with us today and that we are on Facebook, two Facebook pages. We're in three Facebook groups. We're on a LinkedIn page and our YouTube channel. So we're across multiple platforms. We're probably going to have thousands live with us today. We got a lot of people on the chat talking. So you guys use the chat. Ryan's going to monitor it while I go live and present. And then as we flip up Ryan's going to present for a little while. We probably got about, I'd say, 60 to 75 minutes today. Ryan, would you say that give or take? Total. So pay attention. Grab your notes. I'm going to get into my content. You guys that are live with us on the chat, please participate. Please ask questions. We're gonna be doing some prizes on today's webinar as we go as well, and we'll come out of that at the bottom. Ryan, you ready to roll?

I'm ready. Let's do it.

Okay, sounds good. All right, let me just get my screen shared here. Should be good. You see my screen? Good to go.

You're good?

Awesome. All right, so today's title, obviously, is how to build a Profitable MSP Tech Stack. A couple things that I am going to promise you guys coming out of today's webcast. Oops, I screwed that up. Damn it. So we're gonna show you how to add a profitable tech stack. Forget the leads, but we're gonna show you how to do the profitable tech stack today. Ryan, any. Any specific things that you're going to work on with that?

The biggest thing that I think people will find interesting, I'm absolutely going to go through the tech stack on a tool category by tool category basis. But the meat and potatoes of what I'm going to talk about is that you're not going to be talking about that stack to your clients, to your prospects.

Okay.

You want to deliver that service, but you don't talk about it.

Yeah. What I will say on the. On the bottom of this, we're sharing real skills and strategy that your very own clients are using to do this stuff. And. And our clients are actively working on these things all the time. And this is the same stuff that we teach our coaching clients. If you stay until the end with me today, we're going to be giving away multiple prizes. One winner is going to get a 100Amazon gift card. A second winner is going to get a 75Amazon gift card. If you're out of the states, we'll just give you PayPal cash or something like that. We'll make it work. So I'm not too worried about that. But one thing I will say is if you are here and you're going to be a winner, you have to provide your company MSP email address. This is mandatory. So if you don't have one, if you have a Gmail or Yahoo or. We had a guy a couple weeks ago with an AOL email address, it's not going to work. So you have to provide your actual MSP email address. And then also everyone on this webcast is going to have a chance to win a 50 gift card, but you have to stay until the end. A couple other quick updates for me. Number one, please pay attention. That means no tickets, no client calls, no distractions. This is real content that's tech focused today. We don't do this a lot on the tech focus side because I'm very cash flow, very revenue, I'm very sales and very money. But Ryan likes to talk about this tech crap and RMMs and PSAs and all this other stuff. So we're going to go through that today and we're going to give you some real stuff that's going to get you to a best in class, 80% gross profit margin. It's really important things to think about. So if you're serious about changing your business, serious about changing what you do, how you manage your company, how you work inside your MSP, please give us 60 to 75, maybe even up to 90 minutes all the way through the end. Please do that and it's worth it. A couple other quick housekeeping items for you guys. We have our MSP MRR tour. This is Q1 and Q2 coming up here. I'm going to show you guys what this is. We're already through Dallas, Phoenix, New Orleans and Raleigh. We're already through all those coming up yet. We have Boston in a couple weeks. I think that's about three weeks away, give or take. Here we got Boston coming up on April 25th. You can register at events.seven figure msp.com hit that, that QR code if you want to. Ryan, if you want to maybe throw that in the chat for me, that'd be great. Put the full HTTPs in there so they can just click on it, whatever platform they're on as well. Also coming up is we have our live event, our big three day live event in Indianapolis, Indiana that is called Fast track your way to MSP success. That is May 7th, 8th and 9th at the Wyndham Indianapolis West. We are stoked about this event. Got so many cool things. We have our evening event on Wednesday, that's the eighth at the Dallara IndyCar factory. We have multiple IndyCar drivers coming. We've got a sprint car driver that and I, I grew up in racing, guys. I sponsored race cars my whole life. Racing, racing, race, go karts. In fact, this is funny. I'm gonna show you guys this really quick. My mom sent me this last week. She Sent me a text message. She's like, oh, look what I found. I'm like, great, mom. Way to. Way to bring this out. This is me, Ryan, in my very first go kart.

Nice.

Yeah, so that was me and my very first go kart. I was like, I don't know, five, six. So it was kind of cool back then. So I did that. I upgraded to mini sprints and full blown 360 and 410 cubic inch sprint cars. So I, you know, race gear. I'm actually a gearhead more than I'm a tech guy, which is kind of funny because I grew up in all that stuff.

So kind of cool. Looking forward to meeting you in the simulators for that too.

Oh, that's. It's not gonna be close, actually. Rico's gonna be coming up for that.

Yeah.

I think Connor Daly, IndyCar driver's gonna be joining us in the Sims as well. We got a couple other surprise guests because all these guys live in Indy, so it's kind of cool. So. So I got a lot of connections in that. I don't know if you're Ryan. You also saw I was at the NASCAR race last weekend here in here in Austin. Bell got second, so that's kind of cool.

Nice.

So you guys can register it's events.seven figure msp.com or you can hit that QR code. You can get a $1 sign up with that QR code. So don't hesitate to come. Now, keep in mind, you got to show up. Otherwise, we charge you full amount, so be mindful of that. Okay, next couple things we got here. A little bit about our coaching team. Obviously, you see me. Look how I'm losing weight, man. My. My face getting th. I'm very proud. I'm down, like £40 in two years. So I'm stoked about that. We got me Chubby Chris on that picture. Chubby Chris. I know I need to do that.

That's.

That's only like six months ago. That's kind of crazy. So we got Chubby Chris. We got Cindy Phillips, who's our head of sales, coaching. Cindy is a freaking machine. We will be back with Cindy in a couple months on a webinar again. We're kind of rotating them around here in 2024 doing various different ones. You guys get stuck with me every month, twice a month. But you see Ryan, Cindy, we got Lindsay Badillo, who's our head marketing coach. She was on with us two weeks ago. We did an amazing, amazing webinar. That thing was a cold calling webinar. If you guys didn't see that, it was absolutely magical. And then we got Ryan here as well and you guys get Ryan here today. So I'm going to talk a little bit about my stuff here and then we're going to come transition over to Ryan here in the next like ten minutes or so. So a couple things in the MSP market are different and I know many of you on today's call are a little bit brand new to Chris Weiser, brand new to 7 figure MSP. And I want you to understand that things have changed in the MSP marketplace and it's, you have to be very, very mindful of this. This is very important things to think about now, thinking about what has changed. And I want you to be out there and kind of open your mind to this. Think about the way that you support and Ryan's going to go through a good chunk of this today because the tech stack we're using now is completely different. How did we support clients? Let's just go back to when I sold my MSP of June of 2015. How did we manage support clients back then versus how do we manage support clients now? Now I understand how some MSPS hasn't changed but keep in mind we now have the law, we have legislation, we have insurance companies, we have compliance, we have the FTC safeguards, we have the SEC stuff coming, we have all this stuff around and it's around the world that these are continually being a problem where they're basically saying you, if you touch technology and this goes into my open if you touch tech. In fact the insurance companies have gone as far to say that if you have, we manage your IT so you can manage your business on your website. And Ryan, we had a great review of this on our last Wednesday. All hands call for our clients with Paige Taylor Bennett, who's our in house counsel to where we reviewed a current lawsuit where an MSP is getting sued because they had things on their website like we manage your cyber security and they are being held basically responsible for a breach on a client network. So things have completely changed in the MSP marketplace. But more importantly, think about what it looks like for your clients. Those businesses are not prepared. I want you to think about this, think about the epidemic we have in the, in the entire world right now, not just the United States, but not just North America, the entire world of cybersecurity problems because, and I'm going to go out on a limb here and maybe be a little bit polarizing and even say, for the most part, the IT industry, this, the, the tech person, the msp, the computer shop, all the way down to your dime store guy. There was a person, Ryan, that showed a couple weeks ago in our, one of our groups of an ad that some guy put up, like in a local Facebook group or a Reddit channel or something like that, where he's like, hey, I'll hang your shelving units. I'll hang, I'll clean your gutters, I'll install servers. Like, it was like he's a jack of all trades doing all this stuff and had really no. No rules or no guidelines.

Yeah, I don't think handyman and cyber security really go.

They don't really go together. They definitely don't. So I want you guys to think about all the stuff that's changed, all the stuff, and how we could be supporting your clients, but then coming back around to we all know. And it's funny because this is. I talk about how the good, better, best is dead. And I'm going to talk about that in a few minutes here. But you think about the question. If we as IT people had the choice between basically, if we said, hey, we have unlimited budget at every single client, would we put in the good, the better, or the best? Every tech person that's worth their weight in anything is going to say, well, I put in the best. So why, why don't we. Well, we've allowed the clients to dictate this entire path because we don't have enough business. We don't have a smoking gun. We're scared of it. We don't want to talk to them about sales, we don't want to talk to them about cyber. Like, there's all these million reasons why the MSP has that. They don't want to talk to people, but it brings it all the way around to. Your clients will get hacked. There's no. And keep in mind, this is being attempted all day long, every single day. Spam, emails, port attacks, DDoS. Okay? Like, there's stuff that's happening. Your clients are getting barraged non stop 24 7, 365 and you can't. I don't care how good you are, I don't care how good your tools are, I don't care how good your stack is, how good your texts are, blah, blah, blah. You can't stop at all. But your clients really think you can. But at the same time, they're out there treating IT support as a bargain basement service. They're. They've always Been sold certain things, certain ways, mostly with being able to dictate the path of support and also mostly being able to say, well, I just don't want to pay a whole lot, so just do it month to month. Just do all these other things. You heard Brett Galant, one of our guys, on the call this morning. Ryan. Brett's been in our program two and a half years, and he had a guy literally pretty much talk him into just doing a project last week. And he's like, man, what did I do? Oh, my God. This is what. I let this guy completely pull the wool over my eyes because I wanted the deal. It happens to the best of us. It's part of the deal. And the big problem with all of this is your clients as you sit out there, they see you as their I. T. Company with whether it's like I said on this one, IT support, help desk, IT support, break fix installs, all these other things, they just assume it's all the same. Think about the objections you get when you talk to prospects. Are you looking for a new IT guy? You worried about cyber security? Oh, no, we have an IT guy. We're fine. They lump it all together. They don't understand. So you have to be the one that trailblazes, that leads the charge to them saying, you have to do more about cyber security, Mr. Client, and you have to mandate it. You can't let them say, oh, but I don't want to. Okay, no, it's got to be like, boom. So a couple things that you have to do, you have to sell and you have to lead with cyber security. This is mandatory. Couple things that you can do. And Ryan's also going to come around on this today for you guys. Thing one, get rid of your good, better, best, one plan, full stack. Now, the only caveat I'll give you on that, the only allowance I'll give you on that is if you want to have a good, better, best is all three of them better have full blown cyber. And then maybe your good doesn't have on site labor. But my problem is it's not simple anymore. And what happens when you give people multiple options? What do they choose? They choose the crap. Okay, if you want to be the one that controls whether they get the lesser one, that's fine. But if you offer all three, they're going to take the cheapest. So my suggestion, lead with cyber security. Offer your best plan. In fact, most MSP insurance companies, Willow Risk and Skyberg Tech, Rug, some of these other companies that are out there that are brokers and broker dealers for insurance companies. They mandate. Now, they're expecting you to put a line in the sand that says, I offered you my best. You chose less. You at least have to show them. That's the big deal. So eliminate the good, better, best. Just go to the best and offer that. Why do we want full stack only? You have to be able to show you weren't negligent. This is mission critical. You have to be able to show. Look, I ran a cybersecurity risk assessment. I presented them my best offering. They declined it. I gave them a letter stating that here's what's going to happen when they have a breach. They're going to get hacked. So I showed this pattern of support. So you can be like, yeah, you got hacked, but it ain't my fault. Because think about this. How will you or your clients in that scenario refute a charge of gross negligence? You have to be able to say, well, I tried. You were the one that was negligent, not me. Really, really important stuff. Okay? So I want you to think about that. Brian. Anything in the. In the chat that I. That we should call attention to?

We had a question about how does the compliant tech stack reduce the risk of data breaches and cyber threats and what are the implications of a business's bottom line? I.

We're gonna.

I know we're gonna talk about that stuff. So I just kind of tease the answer a little bit. Basically, our job today, Nobody can stop 100% of all attacks. Our job is to put the client in the best position to have their claim paid. And if we're not doing the things from a standpoint of the business's bottom line, like they're trying to save money. So they're not implementing a tech stack. Good luck getting that claim paid. Because the insurance companies are requiring a minimum level of service. They're requiring a minimum level of incident response when that breach occurs. And there's a whole lot of gray area there for gross negligence that they're able to apply.

I agree with that 100%. Side note on this. I'm gonna come around to this a little bit. But basically it is on you now to just show them. Think of, think about this, everyone. And actually, I'm gonna hide that a second. Everyone in every business right now is actually spending money on zero roi Risk management. It's called insurance, health insurance. You know, insurance, all their different insurances. What is the best case scenario? What's the best case scenario? ROI on cyber security coverage. Hopefully zero. Like we don't like, we don't want to ever have to use cyber security insurance, but we, if we have to, we want to be ready. That's the big right. Okay. Somebody else said here. Henry said you need. Oh, sorry, I clicked on the wrong one. There's this one. Do you have the resource or article of the MSP that got sued? Ryan could probably put that in here. It was on what that was on.

It was a channel site, I think, but I'm sure I have it here.

Yeah, we'll find it and we'll put it in the chat for you guys. But it was. It was on an MSP channel website. I think it was on channel E to E. Well, his name was on channelede.com.

That sounds right.

Yep, that's where it was. So it was there. So we'll get back to that. Okay, a couple more things here as we go. Gonna get going into the rest of my slides here. Step number two on this is every single existing client, every single new prospect. This is a non negotiable for you. From here on out, everyone gets a client discovery risk assessment. Not a orange jump drive that scans automatically. Okay, not a bad product, but it's got to be deeper than that, guys. You got to be asking very deep questions now. You got to be looking at their bank account. You got to be looking at how much revenue they're doing. You got to be looking at their bank account, seeing if they have MFA turned on. On their bank account. You have to see if they actually have approval process for sending out wire transfers and ACHS and all this other stuff. Who holds company credit cards? Do they have password protection and MFA on all of their company credit card accounts. Looking at how much money they make a month, looking at how many patents they have, looking like, looking at all of that stuff because it's completely relevant and putting it in front of them and saying, that's fine, if you're going to tell me that you're going to just switch back to paper, but are you ready to eliminate all of this stuff? They don't, they don't understand yet. They're not ready. Their. Their brain has not shifted from it as a commodity, which is basically installing new things and fixing what breaks to it as a network necessary service that they have to have to manage risk. Our job is to flip that so we present the best, including full cyber. We justify it by educating them by doing a client discovery risk assessment. Obviously, we want to gather data, we want to find pain points and tech issues. We want to Find that pain and tie it together with emotional ties. But more importantly, we have to know their network and their data better than the hackers. And it's not how much data they have, it's the type of IT that really matters. Namely, what are the hackers after Now I want you guys to think about that. The hackers aren't even really trying to ransom anymore. They're more ransoming to release data or to not release data because they just want money. That's what the hackers want. They figured out that it's, it's a much easier path to just take the money and get people to wire it and maybe ransom, to not release the data and give them bad rep. But they're actively about the money. But you also have to show that prospect and that client. This is the stuff that makes MSPs squirm in their seats. For the record, they do not like having these dis. This, these difficult conversations. You have to show the client what a hack will really do. Think about that. Think about what a, what a breach does to a company. Think about like we had one over the weekend that happened to one of our members and it literally brought the client to its knees. Luckily, our member was completely ready for it and did a great job, did full incident response. The whole thing's going to get paid by insurance. But if he wasn't prepared, he sent me a message. It was like, thank you, thank you for preparing me for this because I had no idea it would be this level. Even though he's been with us for two years. Had no idea. So we also want to show that here's a little deliverable for you guys. Get your phones ready, get your screenshotters ready, because this is a QR code, but it's basically a way for you to do this on your own. So step one, eliminate that good, better, best, have only the best. Step two, everybody gets a csra, a Cyber Security Risk Assessment. We have a couple of deliverables around that. But namely this is what you want to do and you can see this is our full, full run the play worksheet that you can do. And it's, and the whole concept of this is, you know, list all the accounts that have paid you, run a full CSCSRA on them. CSRA is cyber security Risk Assessment. Start running your scans, gather all your data, do all your questions, and then you come back to presenting your risk findings. Now in our coaching program we have a full done, complete PowerPoint template that walks you through exactly what to do and how to sell and how to educate the prospect because we're leading them down a path and we're telling a story of what a hack will do. But a couple key things with this is do not talk tech. Don't talk about what your service is, don't talk about your tech stack. Don't talk about the tools. Don't talk about how big your hard drives are, talk about how long your backup retention is. None of that matters, guys. What matters to owners is the stuff that moves the needle. What moves the needle in business, pretty much every owner around the world, cash, money, records folks, that's what moves the needle. Show them how much money they potentially have at risk. Show them how much money you're protecting. Note, I didn't say the word prevent. I didn't say the word guarantee. Don't use those words. You can't. You cannot prevent anything. You can't guarantee anything, period. Make sure they know that it's okay to state that it's okay to talk about. In fact, I'd say it's mandatory to talk about that now. Really critical.

I would add to that would be, I think one of the common traits we see with MSPs, almost to our own detriment, is that everybody wants to help their customers. Think about it from that perspective. Is it more helpful or less helpful to let them know what they really stand and have at risk with, with regard to cyber security or not talk to them at all because it's uncomfortable? You need to help them. And having this conversation is the first step.

Yeah, absolutely. So coming around to that, then. We don't talk tech. We educate the client on cyber security. Make sure they understand you are going to get hacked. I cannot stop it. Most MSPs, I will tell you are like, I can't say that to my client. You better say that to your client. I promise you that. Now, how you deliver it is key, obviously, but you have to say that. And then as you talk about your CSRA findings after, they're like, holy crap, this is a real problem. Yeah, here's what we found on your network. I know you thought we were probably doing this, but I'm here to tell you times have changed. We have to do things differently. Now, I know that you pay us X amount per month, but we have to talk about different things. Now, you don't have to Put this in, Mr. Client, but you better at least. My job is to make sure you're aware. You don't have to take the medication. But I'm going to let you know, here's what it does. That's the kind of concept you want and you want to create that emotion and that need. And our job, we call this the risk light bulb. Our job is MSP owners, presenters, salespeople, whoever you have, is to turn on the risk light bulb. They have to get it, that things got to go on. They have to understand, holy crap, we're going to get hacked. And this is what's going to happen when we do. And if you walk out of that room with them being like, well, this isn't going to happen to me, I'm not going to say you didn't do your job, but you definitely didn't get the message through. Now, there's always that one jerk client. I get it. I understand that. There's always somebody that knows better. It's way better to be able to say, look, I ran a CSRA on you. I presented, I offered you my full package. You declined it. I gave you a letter that stated, here's where we stand. We call it in our program the risk acceptance letter. And that's fine. I'll continue to service you. We're never going to tell you to walk away from money. We're never going to tell you to walk away from MRR guys. But we're going to say, know where your risk is in your liability set. And then as you present, as you get to the right prospects, as you get to the right clients, you're charging more, you're doing the right things. Note I said 80% gross profit margin. Ryan's going to walk through that and we eliminate the price objection by showing them they have to have this. How many of you, think about this. How many of you have actually filed an insurance claim for your car? How many of you have actually filed an insurance claim for your E and O insurance, for your general liability insurance, for maybe even your cyber security coverage, but you still have it. Why? Risk Risk Management. So we get that, but we don't understand that the same things applies to msps. Our job has to be conveying that message to the prospect and actually especially to your existing client. Okay, Ryan, you got anything otherwise? I'm.

We've got a question. In the chat, does this apply all apply, even when the breach is internal?

Absolutely. Because here's the deal, guys. The breach internally, first of all, you got to find it, you got to discover it. Somebody's got to pay that bill. Somebody's got to figure out the downtime. Also, here's what I'm going to tell you. The battle you're facing now is probably more against the insurance companies than anybody. Because what are the insurance companies in the business of? They're in the business of making money. They're not in the business of, oh, we're going to pay out this claim because we're nice guys. Doesn't work that way. They're going to look for a scapegoat. They're going to look for somebody they can dump the blame on so they don't have to pay out the money, and they're going to try and pass the buck. So you need to be able to insulate yourself. Really important stuff. Okay, Ryan, I'm gonna head over to you here.

All right, so this is one of my favorite topics that we have in the. In the Facebook group, whenever the topic even remotely touches $300 per seat, in our IT and business owners group, I always bust out the popcorn because there's a ton of different comments. I mean, those, those threads end up like 200, 300 comments long. And it's just really interesting to read through some of the responses that we see. So just a few of them. How are you charging that much? Where are you located? There's no way I can do that where I'm at. That's probably one of the more common.

Ones, the biggest one.

Yeah, yeah, yeah, that's great. But what are your margins? How can you gouge your clients like that? That's, you know, a lot of people's first responses because they don't believe that they have that much value that automatically we're gouging our clients. What are you providing for that much? What's in the stack? So it always boils down to pretty much those things right there. And today we're going to lift the curtain a little bit and talk about how to take and build that profitable MSP stack. So what I want to start off with is kind of another question. Who knows better what a business needs these days when it comes to cybersecurity and IT, for that matter, is it them? They seem to think that it is, and we seem to allow them to go down that path. A lot of MSPs that I talked to, you know, when I started my MSP back in the day, like the sales process was really, how much money do you got and what do you want? It wasn't us telling them what they needed. It wasn't us educating them as an expert in this field. But things have changed. Cyber attacks are way up, and we need to make sure that we're informing our customers that that's the situation so when it comes down to it, are you going to be the expert or is your MSP a glorified retail store and you're just allowing your customers to go down the aisle and grab the things that they think that they need with usually very little context, very little understanding of what they need, or worst case scenario, somebody who knew a little bit about it back in the day and knows enough to be dangerous. We no longer can approach our customers like a retail store clerk. We have to be the doctors, we have to be the lawyers. That's the world that we live in these days and, and that's the approach that shows the value that we're going to talk about. We need to embrace our expertise and stop allowing that client to dictate the path of service. I mean, at the end of the day, as an owner of an msp, as somebody who works in an msp, do you want to be treated like a retail store clerk or do you want to be treated with the respect that you see a doctor or a lawyer have? Because that's the position that we sit in right now and we need to make sure that we follow that. We know better and we need to educate them. That's exactly why Chris was talking about. We need to make sure that we're letting them know what's really going on. We need to lead with what we as the expert know they need in today's environment. And what we know is the most important part of our MSP stack is security. And you cannot sacrifice the security parts of the stack. All of these layers, you know, in a properly set up cyber security stack that we're going to go through, all of these layers, work with each other, complement each other. You can't have, as somebody who doesn't know what's going on, have somebody go through and look at that cyber security stack as a menu and say, okay, well, yeah, I'll take this, I don't need that, I'll take this. Because we know you pull one part out of that stack and then maybe three others are basically useless at that, that pl, you know, that your customers don't know that. And what's going to be the driving force of all of this regulation is coming, it's going to happen, it's slowly leaking out, but we're going to quickly be in a position where these businesses don't have any choice. MSPs will probably be there first as the providers of these types of services, making sure that they're doing those things internally. But insurance is definitely catching up and being it's one of the driving factors of all of this. So some of the things that insurance companies are now requiring proper cybersecurity infrastructure. Okay, we've seen over the last two, three years those cybersecurity questionnaires that your clients are receiving, that you're receiving, going from nothing to one page to three pages. I've seen one as long as 12 pages at this point. So the insurance companies are asking for specific things, requiring you to have specific things. And that's the black and white stuff. They're still leaving that gray area on the back end to where they can still call gross negligence, depending on how the hack occurred. And that's one of the other reasons why they're also requiring proper incident response and forensics. Used to be you could just say we had a cyber attack, give them minimal information, they filed the claim. Now they're requiring proper incident response from a qualified incident response company. Sometimes it's one that they choose or they give you a choice of a group of incident response companies. Sometimes you can bring whatever one that you want to the table, but you can't. If you really want to make sure that that claim is going to be paid, no more can you go in and just do a wipe and reload and expect to have them get that claim paid. That is essentially contaminating a crime scene at this point. So I caution MSPS this all the time. There's a lot of really, really smart people in the channel. Not everybody is qualified for incident response. And probably the majority of MSPs, I would argue, are not qualified for actual incident response and actual forensics. So important to make sure that you partner with an incident response company that you can work with to do those types of things. And even better, having those negotiations with your customers and their insurance companies before a breach even occurs. Because just like Chris said, no matter what we do, we can't stop 100 of attacks. It's all about preparation and recovery, reducing the risk as much as we can. So they're not likely to get hit. But we want to make sure that we're able to recover them, get their claim paid on the back end. And all of that stuff kind of comes into play with all of that. Ultimately, you don't want to be the one left eating that risk sandwich. If you're not having these conversations with your customers, just like Chris pointed out, they are assuming that you are doing everything that needs to be done in order to protect them. And that goes for even Break Fix. I have had Break Fix customers who have thought I thought you were doing this already for break fix. It's again, just another example. Like we know what we're doing, they are assuming the majority of what we're doing. And we can't assume that our customers know all about this. In fact, we have to assume the opposite of that. You need to make sure you're having this conversation. That's why you need to lead with what your recommendations are for them. Let them make that conscious decision to either accept their risk or see the value and the differentiation between what you're offering and what maybe another company that they've worked with in the past is offering. In most cases, the feedback that we get from our members, especially the new ones coming in and just going through and running this process the first time, it's pretty common that they will go in and have a conversation with somebody and go up against a much larger MSP who's not asking these types of questions. And it doesn't matter about price at the end of the day, because the differentiator is there because their risk light bulb was lit up, because they were talking about things that no other MSP or IT provider had talked to them about before. They didn't want to be left. They didn't. They understood that they were eating the risk sandwich at this point and they wanted to protect themselves against what could happen because of that. So all of that boils down to what is a seven figure MSP security stack look like? So that that big question there that we get a lot of, that's great, $300 a seat is great, but what's included? What's included? So I'm going to walk through kind of from a category level, what some of these tools are. I'm not going to get into what, what vendors provide which tools just because there's so many out there and it changes every day. I'm going to start with kind of the categories of tools and this was all based off of CIS version 8. Most of the frameworks are going to be loosely related and mappable to each other. So this should apply to most of the common cybersecurity frameworks that are out there. Although this is just from a technology standpoint, if you truly want to be compliant, and I think as an msp, you should, at the very least, you also need to fill in those gaps from a standpoint of written policies and documentation, not just the tool stack, because there's a big piece of compliance to these cybersecurity frameworks that is completely policy driven. Okay, so just make sure that you take a look at those stuff and I'll talk a little bit more about that as we wrap this up again today too. So starting off with support services, and I am not going to spend a whole lot of time on this because this is all the stuff that most MSPs are doing today. I would even tell customers and prospects that I talk to. I'm not going to talk to you about this stuff that much either because this is the easy stuff. I would straight up tell people you can go and call five MSPs and probably most of them will be able to provide a reasonably good level of service on these types of things. This is the traditional MSP stack. This is the stuff that we've all done and always done. Okay, so I'm not going to go into this very much now we start getting into the new stuff. Skip through that. The cybersecurity stack, the new standard. This is the way that you need to be looking at things. And the first part is, and I start out here because this is kind of your base, your foundation for how you're going to build out your stack. Because nobody's stacks are going to be identical. Of the hundreds of members that we have, I would argue there's probably not two that have the same stack. Everybody's got slight different variations. And this is also why we don't talk about the stack and we don't talk about tech when we're talking to our customers. Because what our stack is today is very likely not going to be the same exact stack that we have six or eight months down the road. And we need that flexibility to change that. That's what the cybersecurity landscape is like right now. It's to going constantly changing, it's constantly evolving. So I always start with centralized account management. This is kind of your foundation of how you're going to build on this. My shop, we were in Azure Active Directory, which it has a new name now. I was informed I've been out of the mix now for like almost exactly a year today actually. Chris. And so they've got a new name. But Azure Active Directory, I'm sure you're all familiar. That's what, that's the stack that we built in miamisp off of.

What is that called now?

Entera, I think ent, something like that. I don't know. I. I was telling somebody the other day, I was like, it's just like the Sears Tower to me. I don't care what it's called now, it's always the Sears Tower.

To me. Yeah, yeah. So we put the Willis Tower. The Willis Tower, yes.

It's the Willis Tower now, I think. Yeah. I don't know. It's very confusing. So Azure Active Directory is what we built off of. If you're an on prem Azure direct Active Directory user, whatever you're using for your centralized account management is going to in part dictate some of the other layers that you build on top of.

It as you go.

I would say start here, this is what you want to go. My recommendation, just because it was super flexible and I like to look at the scale of my stack as well and the uniformity of it, Azure Active Directory was just super scalable, allowed us to do so many things. It was a game changer for me from a standpoint of scalability. It just, it streamlines so much of what we did with our msp. Mobile device management would be the next one on the list. This is one where, you know, again, maybe two or three years ago, this was like a nice to have very quickly. We've got a lot of people who are more mobile. Covid taught us a lot of things about, you know, needing to be mobile, whether it's, you know, you're always mobile or needing to be prepared for it tomorrow. And that means you're going to have users who are going to be using things like their cell phones a lot more, they're going to be using tablets a lot more. So making sure you have means to monitor and manage those devices is really, really critical. So I think this is a key piece to any cybersecurity stack going.

Yeah. And you got new iPads coming out in the next two weeks that are basically PC replacements too. Then the new iPad Pro is going to come out. Yeah, pretty much going to be, especially with iOS 18, it's going to be like borderline PC replacement. So they have to really be managed.

So now's the time to start thinking about that stuff because you don't want to be caught with your pants down when they, hey, you know that CEO brings in that device, they don't usually give you a couple weeks notice to make sure that you're prepared to manage it. They're like, hey, I got this new thing, can you get it set up for me? You want to make sure you're all caught up with this stuff and make sure you have these things in place. So mobile device management, I think, is going to be a very, very important part of your stack going forward. Obvious, clear one. This is no shock to anybody. Endpoint detection response definitely need to have that. This is one of those things that's typically on most of the insurance applications I see these days, kind of a critical and honestly basic part of any cybersecurity service at this point. Data encryption. This is another one of the fun topic discussions for techies as they get into your various arguments and debates on different things. So data encryption, I think we can all agree, definitely needs to be done. Kind of the side question Here, though, is BitLocker and FileVault enough? Like, when you look at most of the controls that deal with data encryption, I would argue there's kind of a gray area where, like, I can see it both ways, but when you really drill into it and you start thinking about the safety of your customers and the safety of their Data, you know, BitLocker and FileVault are only as good as that device being unlocked and logged into. And in most cases, what we're seeing with these breaches is the attacker gets in and sits there for months at a time. So if they can get access to that data while you're logged into that computer, because they're already in there remotely with a, with a foothold, they can Download that. And BitLocker and FileVault is not going to do anything for that.

Yeah. And then, and then there's the whole data at rest, data in motion discussion too. Right. And I'll still go back to. Now you start to think about it. If the hackers are after money, they're not necessarily so worried about your data being encrypted is going to help you in terms of penalties and fines related to compliance. But I don't know that it's going to help you if the, if the breach actor, the bad actor, is in there trying to witness bank, bank credentials and stuff like that and get access to the bank account or get, or get the staff training tricked into sending out wires like, so it can't be just like. And part of where this comes from is we've actively seen an MSP say, I have BitLocker. It's good enough. Like, can't be that naive. Guys like, that's, that's not a good mindset.

Yeah, there's a lot of stuff to consider. And, and again, you know, this is where we need to really step up and start thinking about things and making those hard decisions and explanations to our customers because they don't understand much of what encryption is in the first place. I had one client, great client, just could not fathom even, you know, with the explanations that I gave about cybersecurity everything boiled down to firewall. Like everything that was security related to her was a firewall. Yeah, they just don't understand what we do.

People use that term very broad, like, oh, I'm behind the firewall, I'm fine. Like they don't understand that.

Yeah, it just means that they learned everything they know about cybersecurity from TV and movies.

Yeah.

Another obvious one, multi factor authentication. I think this is one where this was one of my golden rules. There were certain things that even with a risk acceptance letter, I wasn't willing to take that risk. And if I had a prospect or a customer that refused to use multi factor authentication, I needed to think about managing my risk just as much as I was asking them to do theirs. To me, even having them sign a document stating that they were accepting that risk was, was gross negligence. To me. That was just, you know, my personal feeling. But I could totally see a judge looking at that going, you let them do that. That's, that's just, that's negligence. You, you definitely know better than allowing them to not have multi factor authentication. So something to consider there as a well.

And what happens in the insurance policy if Ms. MFA is not even on there, like highly likely you become the complete scapegoat if you don't and the policy probably voids. And I mean, there's multiple scenarios there. But we've, and you guys that are watching this, maybe questioning some of these things. Ryan and I have watched this stuff happen over the last two years. Like pretty much every scenario that we're talking about here, we've seen in action now. We've seen an insurance company completely void a policy because an MSP screwed up or was, or was. I'm going to border on willfully negligent, at the very least naive negligent.

And they're only tightening things down. You know, every time we see it, it's more and more and more so it's really, really important. And that's kind of the gist and all. You know, when I go into finishing this up, I'm going to tie all this together. Like why we do this is because we're trying to make sure that we're again, making sure that they're going to get that claim paid and we're covering that gray area and that, that gross negligence wiggle room that those insurance companies leave there intentionally. If we can go through and say, hey, we built this stack, this, this provide. The service that we're providing is based on a globally recognized cybersecurity framework. It's going to be really difficult for them to come back and say that you weren't doing what was reasonably acceptable to protect them or put them in the best case to succeed. That's what we're trying to do here.

Yep.

So next up we have perimeter security. So this is either going to be. You have the firewalls that we just talked about. SASE was something that has become more and more popular lately. It's a lot more stable than it was four or five years ago to where it's easily able to be implemented in most scenarios. This was where we moved our stack to. It was so flexible in that when.

Ryan says our stack, this is what we're using internally through our stack internally.

And what I was using with my msp.

Yeah. So I'm a big fan of sase specifically because we are a completely digital remote company. We're on. Most everybody's on a laptop around the world. So it's a lot more controllable. Yep.

So it's a firewall essentially that follows you around and it'll, it covers your butt because you're, you're never going to know if that CEO that you're covering is in a Starbucks or at home or at his parents house or someplace else. This allows you to have that visibility as it goes. And when, when I had my msp, we built the stack to be secure and work from anywhere because even my clients that worked in the office 99% of the time, that thing that we learned from COVID they need to be able to work from home or anywhere else tomorrow because who knows what's going to happen overnight. It also from a operational standpoint, a lot easier to manage and a lot more predictable. So I could put, you know, just a basic firewall in every location because the SASE was my primary and we don't have to worry about the three year licensing and all that updating, it made it very, very scalable and flexible. This is one of my soapbox items, vulnerability and network monitoring. So many MSPs I see vulnerability. I think everybody can agree from a CSRA standpoint, when we're doing an assessment of somebody's environment, scanning for vulnerabilities and CVEs, that we find is really, really powerful. Right. Showing them, hey, your, your current MSP is not protecting you, they're not doing your updates. But then when they turn around and they sell that customer and go into ongoing services not using vulnerability scanning and then relying back on that, that RMM patching that the other MSP that they took over that business is probably using as well. You need to start looking at these things from a cybersecurity perspective. Patch management I think we can all agree needs to be done. But I think we all also know as MSPs are recovering MSPs, it doesn't always work right and you can't count on it too. What about the situations where you have an exposed CVE in a piece of hardware or a piece of software that your customer is using where a patch doesn't exist for it yet? If you're just relying on your patch management, you don't know that that ticking time bomb is sitting there. At the very least you need to know that that's there so you can make some decisions on either. Is this like something that is a non negotiable in production and we have to accept the risk or can we do something about it to minimize that risk? So it's really, really important to be looking at that kind of stuff and making sure that you're looking at everything through the lens of cybersecurity, not through the lens of oh well, manual vulnerability Patching is a pain in the ass. It absolutely is. But it's also that one thing that you might get caught with your pants down with your customer if you're not keeping your eye out for that kind of stuff. So again, that's a little soapbox item for me. SAS monitoring and response. I think this is another thing that's, that's just so much more important than it was four or five years ago. Most people that I talk to are using Office 365, Microsoft 365 or Google Workspace, one of those two. At a minimum, there are so many different SaaS applications that you're using that your customers are using and those things are just sitting on the web and a lot harder to monitor than having a SIM on your network and monitoring all of that traffic, making sure that we're watching that stuff. Because this is one of your big objections that you're gonna get from your prospects and your clients. Oh, we're using software as a service or this software as a service or that software as a service. So it's all on them. We're good. We don't have any risk there. One, you absolutely do. Take a look at the service terms and agreements for those companies. They don't have. They waive all responsibility and pass that off to you. You need to know what kind of stuff's going on there. And in most cases those breaches are occurring because the Attackers are logging in with your credentials cause they stole it one way or another. Those SaaS companies, you know, they just see that as a valid login. So making sure that you're monitoring this stuff, a lot of this is just about, it's more about knowing what's happening than it is about stopping it. Because we all know that we can't stop all of this stuff. It's almost more important now to have the visibility to know when something gets in so that you can stop it and recover from it than it is to, to play that futile game of trying to keep everything out because you're not going to be able to. Security Operations center. This is another fun topic for people. A lot of MSPs tend to think, oh, Security Operations Center. And I got a spelling error in my slide. So we both had a slide issue today. Security Operations center with an S. So SOS may. I'll just pretend I did that on purpose. So Security Operations center, you know, this is, you know, the means of monitoring all of that, that stuff that we're looking for to make sure things are not getting past our security because we need to know those so we can act quickly. A lot of MSPs that we talk to just think that they're going to spin up their own Security Operations Center. It's no different than a knock to them, but it's very, very much different. If you really wanted to spin up a proper security Operations center, we're talking millions on a yearly basis to do that properly.

Properly done, absolutely. I mean you look at companies that are actually doing this, the big factor guys, is doing it the right way. You can't skimp on doing a sock. You can't skimp on building a sock. It's not just as simple as having a bunch of report like a bunch of monitoring and, and logs happening. You have to do real time event management, event monitoring and management and it has to be responded to and you have to be compliant. Like, this is not a joke anymore. It's not nearly the same as spinning up a help desk anymore. It's kind of crazy we have to say this, but the amount of MSPs that Ryan and I see out in the wild that are just like, I'll just run it on my own with one of my help desk guys. That's what they believe. A lot of MSPs believe that.

And realistically, not even from a security perspective, but even from an operation standpoint, if you really want to streamline and make your MSP scalable, outsourcing to a managed SOC is like just. It's a no brainer when you look at it, right? I mean, a proper managed SOC is going to be handling a lot of that day to day ticketing that even your level one guys probably hate doing. I mean, how many people are going through their EDRs on a daily basis and just looking at false positives? So having a security operations center, a managed soc that can go through that stuff, take that workload off of your back, and look at things from a trained eye so they know like what actually is a false positive and what needs to be further investigated is so huge. Like a lot of this stuff is just.