Full Throttle Leaders with Michael Falato - Guest Joshua Hoffman, Episode 2

Hello everybody, this is my second or third episode. I gotta figure out which one it is, but today we got Josh Hoffman from ControlCase. Um, Josh, how you doing?

I am doing fabulous, especially after that intro. I feel kind of amped up. I'm wired for sound, ready to go.

You full throttle?

Full throttle. I, I look, I am, I've got, I've got it wound all the way. So let's go. It's really good to spend time with you.

Thanks for, thanks for making time. Um, so this is about leadership, about what's worked, what's not, your, your journey, kind of a mini TEDx slash Joe Rogan slash slash slash. So tell us like what made you even do this today? Like what's your, what grabbed your attention to even want to tell your story?

Well, the first thing that grabbed my attention is that over more than a decade, you and I have been communicating about growth strategy, about leadership, about demand generation. And so, you know, you have this expertise in that that I've always paid attention to. And so, the first thing that grabbed me is I get to talk to somebody that I have a lot of respect for and that does something that excites me a lot. The second thing that got me excited, hey, look, how do you not join something called Full Throttle? How do you not put the pedal to the metal and go share in that experience? And look, if we can turn this into a Joe Rogan kind of podcast, I'm all there. So, you know, let's make it awesome and make it viral. But really, look, I like spending time with great people and I like talking about things that are going to help others find an opportunity to grow. The middle part of how I brand myself is helping people find a career they only thought aspirational. And so I use these conversations at least as much as I can, and hopefully people see it the same way as a way of sharing things that might help somebody else.

So tell me about your current role and how you, how you kind of got in that spot at ControlCase.

Yeah, sure. So ControlCase, first of all, ControlCase at our core, we're an audit and compliance company. We certify, attest, assess, audit, to 67 different frameworks, everything from CMMC to ISO, SOC 2, HIPAA, HITRUST, FedRAMP. Not quite a you name it, but pretty close to the major compliance acronyms that most everybody hears about every day. We also have cybersecurity services. We provide readiness services, gap assessment services. If it's attached to an IT security-based compliance framework, then we provide that. We're very global. We're in 73 countries. We've been around for 20 years. And so we have a level of credibility inside of this world that makes us a great partner, not only for our customers, but also— and this is where I got really excited to join the company— for ITSPs, for MSPs, for service providers. My last role, I've spent 15 years or so in the MSP world one way or another, mostly driving sell-with strategies. And I was leading go-to-market for an MSP before I came to ControlCase. And I experienced firsthand what it's like when a third-party compliance company that doesn't care about me comes into my customer base and then takes them away, becomes the smartest person in the room. And, and all of a sudden I have a retention problem with clients. I have a credibility problem. And we have a secret sauce to actually help our partners grow. And so now I get to be symbiotic. Customer wins, service provider wins, we win. We're still a direct business too, by the way. So we're in a lot of countries where MSPs aren't even a thing. But now I have a chance to really go help people save time, save money, save stress. And, and it's a need-based thing. Nobody raises their hand and says, oh, I really want to be HIPAA compliant. People do this because they have to. And our mission is to share with them why we have a better model out there. And it's been super exciting. It's been fabulous.

What's your target market as far as companies? Is it what industries? Is it targeting certain industry? And you're talking to CISOs or CIOs or some of these people don't even have that. And so you're kind of Talking to founders and so forth.

Yeah. So it depends on the situation. So first of all, we're vertically agnostic. We can work with almost any vertical because if you're a bank, we do FFIEC, SWIFT, SOC 2. If you're a medical institution, we're HIPAA, HITRUST, SOC 2, and so on down the line. But we have expertise that is very significant in PCI. Which is really associated more with payment standards, and that's a very global thing. We have expertise in India for RBI and our ability to work with the banking industry.

What's RBI?

It's fundamentally, it's a way that the banking associations in India, the banks work with the fundamentals behind payments and financial services. And we have a federal practice that is absolutely amazing. We are one of the few companies in the world where we're an RPO, a 3PO, and a C3PO. And what that means is we can help customers at any point in the journey. If they're going to be FedRAMP, if they're going to be CMMC, if they need to do something to work with NIST, we have them covered. And the rule that got passed on by the federal government in November has created this need in the marketplace. And not only can we fulfill the need and fulfill it fast and fulfill it with expertise, we're truly global. And there are thousands of members of the defense industrial base that are based in different countries around the world, and we have a model to serve them. So we have this other thing that's taken place that has been incredibly valuable, not just to us, But to our customers, they really need this. They're, they're primes. A lot of these are subprimes. Their primes are saying you've got to go do this by X date and they need a partner in that.

So who are you selling to in those companies?

So mostly we sell to CISOs, to heads of compliance, to CIOs. Candidly speaking, we do a lot of work with chief legal officers depending on the size of the organization, with founders, with CEOs, with presidents. There's a whole host of different people then. And by the way, I hate to use the word sell to because really what we're doing is we're partnering with them to help them get to the finish line for this. But the contacts that we have, if you were to look at our buying committee, it fits into those titles that we just talked about. If it was an MSP, usually we're working with the founders, we're working with their heads of compliance, we're working with their head of IT or their heads of delivery. And we're finding ways to partner together so that we can help the IT service provider grow and actually monetize these services. We're legal, uh, monetize these services and help them drive retention programs where now instead of just being the center of the technical universe for their clients, they're the center of the compliance universe. I really want them to be the smartest person in the room, not us.

So how many endpoints is a good MSP for you?

Oh boy, that's a great question. Look, the candid, the candid response is any MSP that has a client that has a need is a good MSP for us. Any MSP that's trying to grow their readiness practice, that's trying to grow their professional services practice, that's trying to grow their consulting practice, they're a good MSP for us. Yeah, there's a sweet spot in there. And that sweet spot tends to be MSPs that are sitting in that, let's call it 25+ employee range. But the reality is that some of our greatest MSPs, they're 5-person shops. They just happen to have a client centricity that's around medical or community banking or retail, something that fits into a compliance framework where we can help them be better for their clients and their customers will appreciate them more for it. And so it's a very symbiotic relationship.

Tell me about your role at the company and your team and the size of your team and how is it broken up versus—

Yeah, sure. So my role, Chief Revenue Officer, but really the way that I look at it is accountable for, of course, our sales team. But really what we are is we're compliance experts. I'm accountable for partnerships and helping us grow partnerships, whether they're MSP partnerships, technology partnerships, referral partnerships. There's a whole host of different ways that we partner with organizations, and I'm accountable for our marketing organization. And your team is broken up globally. Sorry, go ahead.

You're a private company, right?

Yes, we are. We're PE-backed. And so we sit in the same world as a lot of the customers that we actually serve. And you had asked me about the team breakups. So given that we're in 73 countries, you would find members of the team that I'm accountable for, and I prefer I prefer to tell them that I work for them, not the other way around. So I'm not going to say people that work for me. You would find them scattered really all over the world. I have a large population in the US, in Latin America, a large population in Asia Pacific, in the Middle East, in Europe. And so we have people that are all over the globe.

And is there a particular client, if they have Workday or SAP or or, um, was it, uh, Palo Alto Networks? Is there certain ones that are better fit for you based on their current state, or are you, uh, industry and tech technology agnostic?

Yeah, we are agnostic when it comes down to it. Now don't get me wrong, there are some things out there that make it easier. There are some, you know, pieces of software and tools that provide either better evidence or easier evidence to get to. But the reality is that every customer is different. Every customer has a different scope. Every customer has a different footprint. And in many cases they have different ITSPs that they're working with. And so when we work with a client, we do our best to assess their environment, their needs, and what they're trying to do from a timing perspective. And then we fit our services to match them. And so it's not like we have a price list sitting out there. You can say, go check the box and this costs this. Every arrangement has a little bit of unique nature to it, but it's, it's, it's high value for us to get to know our clients, to get to know our partners so that we're serving them not just for this go round, that they have to keep doing this. And so they have to keep getting, you know, if you're CMMC, you have to be assessed every 3 years and you have to do stuff in the middle. If you're SOC 2 or PCI or ISO, there's accountabilities that you have all along the way. and we want to make sure that they continue to be successful.

What's the best strategy you've learned, tactic, whether it's good or bad? Like, for me, it was one of the things that I learned was when I, when I had someone come up on a, on a, on a roundtable or one of these one-on-ones, like, you booked a time with me, Josh, what, what, what grabbed your attention? What brought you to the table today versus Josh, what keeps you up at night? You know, it's very salesy to me. That was what I said was a little bit like it just wants you to get you on the same side of the table. So what's some of the— what's some tips, tactics, strategies that you can share with us today?

Yeah, you know, it's funny, you actually just took the words out of my mouth. So when I'm sitting with a client or a partner, I really try and if we're not literally sitting in the same room, I try and get the vision across that we're on the same side of the table and there is a an opportunity, a problem that needs to be solved. That's on the other side of the table and we're there to go solve it together. I'm a huge believer in sell-with models. And so, I spent the whole first half of my career at Dell. Dell was very much a sell-to environment. It was a hard-closing, hard-charging, at times very transactional environment to be a part of. And it was a great place for me to grow up as a salesperson. Yeah. Over the last 15 years, 15 years I've been building sell-with models at Avaya, at Palo Alto Networks, at Datto, at Poly, here at ControlCase, where the mission is to partner with our clients or our partners and to go solve problems together and to be on the same side of the table and to co-create whatever that solution is. And so I'm really a big believer not only in that same side of the table approach, but also using the word co a lot. Are we going to co-create? We're going to co-decide. We're going to co-deliver. And so those things are really valuable to me. Tell me about your— what's your perspective on that? Like, what's some of the secret sauce that, that you've used in your career to be successful?

I like customer— challenger customer, the challenger sales approach, like find a problem and say you're spinning I've got $6 million in this and I could sell it for $600,000. Why wouldn't you listen to me? Yeah, that's one thing. Understanding what makes them tick, what the pains are. Like, I always ask myself what they're thinking. Who cares? So what? Why are you telling me this? How does this help me keep my job? And then stop selling and stop pitch-slapping. And this is kind of what I do on my email, LinkedIn. This is how we got attached to— it's like, Hey, I'm producing a roundtable, I want you to be a special guest, but I need to talk to you first. Yeah, so they're going to book a time, I'm going to learn about them, why they should be on my roundtable or podcast. And there is a podcast around table because I'm doing one round, but it's, it's me wanting to give them some sort of PR and in place to either talk to other founders or other executives or talk one-on-one to have some content about their company also circulate across the net. So that's the way I do it. I also look at event data, conferences, other LinkedIn Live things, scrape other events, intent data, signal data. Fish where people fish. Stop pushing things that might not fit at that time and see what other signals there are on Facebook, on LinkedIn, and email. And conferences that make sense. When you go to a conference, have a plan. Don't sit there behind your booth and just wait for someone to come up, what do you guys do? That's a lot of bad conversations that I've had at conferences. I'm like, I had 40 meetings going to, uh, I forgot, was Channel Partners, which probably you guys go to too. Um, it's like I had 40 meetings set up because I made a, a, a basic outreach saying I'm going to be at Channel Partners, I would love to get a chance to talk with you. Can we spend 10 minutes right in front of the exhibit hall? Yeah, it's like people don't do that. They like, let— what leads did you get? You didn't get leads, you got people just stopping by your booth. Yeah, so I think people kind of forget to do it the right way and use automation where you can to open the door, but you need to— once you open the door, you need to walk in and talk.

Yeah, it's one of the things I love about what you do. I mean, look, in the end, You help people grow, you help companies grow, you help them meet their goals. And if you use that same approach when you're with any customer for any reason and turn it into a dialogue about, look, you grow, I grow. And so if I only spend my time focused on your goals, on what's going to help you be successful, on what's going to help you grow, then I believe that I'm going to grow because of it. Some of that is almost like a belief in karma. But there's really the genuine belief that if we're all in it together, we're going to be ultimately successful. Doesn't mean it works out every single time, and that's okay. I don't expect it to. What I do expect to have happen is that we end up with a trusting, well-built relationship that's founded on some sort of shared vision of what's the future. Like together. And it's one of the things that I respect the most about what you do.

Thank you. Yeah, I mean, if you don't act like you care, or have, have, make it a win-win, then there's going to be a win-lose thing. It's never going to work out.

Yeah, I'm going to go a step further. I want, I only want people on the teams that I work with that actually care. Look, there are some people that can act and actually do a very good job of it. But what I really want, I want people that actually do do care, that actually find some emotional bond to other people's success and are motivated by it. When they say, my client, my partner, my whoever is successful and they feel good about it. It's not just, it's not the cheesy sales guy, snake oil guy.

Speaking of that, what's the best place for you guys to get that sales consultant or sales AE or whatever your title is for your, for your, uh, hunters and farmers, mostly hunters, what's their personalities and what's their background that, that, that are good fits and what's ones that you don't like to hire from because maybe it's they're too hardware driven or they, they work for a particular industry in the past, it just doesn't fit all the time.

Yeah, look, our greatest fits have come out of IT security. They've come out of compliance. They've come out of the managed server— excuse me, managed service provider space. They've come out of organizations like that where they have some great fundamental knowledge, some foundational knowledge that helps them be smart. I don't want people that are just regurgitating speeds and feeds. They have to understand what's going on inside the environment. They're coming out of roles that aren't always quote, a base roles. They're coming out of roles where they understand what the customer's needs are, how to have empathy within that, and how to have compassion. You know, we don't sell something that— and I actually am using the word sell again, which I hate doing. But look, we don't sell something where people say, oh, I've been thinking about it. I really want to be high trust compliant. I really want to go through that journey. I'm excited because it's it's going to be fun. They're doing it because they need to do it. And we have to respect that relationship that they have with their needs. And we need to help guide them through it so that it is less painful, less time, less money, less stress. We want to make things as easy as possible for our clients and partners. You know, again, nobody says, oh, I'm just dying to be HIPAA compliant.

So obviously health is a good industry for you. Right.

Yes, pretty much.

And what other industries are like— they have— there's not a choice, really. They have to have someone that does what you do.

Yeah. And so first of all, we're very agnostic when it comes to vertical. But when you take a look at some of the things that are growing the most in our clients' minds, certainly CMMC. So the federal space is absolutely a massive relevant CMMC. Yeah. And so I think what that stands for, if you're a member of the defense industrial base, if you're one of the 80,000 companies that has a contract with the Department of Defense, not weapons of war, because that's a whole other level, then you have to be compliant to the cybersecurity framework. This maturity model is where CMMC goes to and the You have to do that within a certain period of time depending on whether you're the prime or the subprime. And there's 80,000 companies out there that now have a requirement to go do this. If you're a member of the medical or healthcare industry and you have to be HIPAA compliant or HITRUST compliant or SOC 2, that's a very good sweet spot for us. If you're inside the financial services industry, there's SWIFT, FFIEC. There's PCI, there is SOC 2 that fits into that. If you're in retail, PCI is a must-have. And so you could go out to things like ISO where we do, you know, 9 different kinds of ISO, we do 9 different kinds of PCI. If you're overseas and you're trying to manage to the Essential 8 or Cyber Essentials or NIST 2 or DORA, a lot of people are using CIS as a foundational framework and NIST as a foundational framework. All of these things, plus another 40 or so, are things that we are the auditor, certifier, assessor, attester to. And then there's another 200 or so frameworks that we help people get ready for where we may not be the ones that actually sign on the dotted line. We're the ones that help them get prepared for somebody to come in and help them sign. And so it's I hate to say that we're industry completely agnostic, but the reality is that our clients and our partners, they need somebody to come in and help them get through this. And we have the ability to do it. And it's okay if you're a part of, you know, not one of the top two industries that need this out there. We want to help everybody get through the journey.

What type of AI do you think that's changing the way you do sales or marketing or business development, like what's some go-to AI things that you like? Like, well, tactics, strategies.

Yeah. So there's a couple of things. So first of all, we're AI-driven as a company. So our ability to help customers get through their journey faster is because we have created AI around the frameworks that allows us to help customers understand where they are on the journey before it gets to a person. And so if you're— so we have a GRC, we have a compliance tool, a GRC that we actually give to our customers for free. We don't sell it. It comes with our service and it allows them to upload evidence. And if you're going to upload your password policy, not only is AI going to read it and first give you an assessment about whether it's acceptable evidence or not, it still has to go to a person. But AI is going to help guide you along the way. It's also going to take that that information and distribute it not only to the frameworks that you need, but to the other 66 so that you can see where are you on the journey for things. Now, that work is work that we've done internally. We have developed that. We're one of the first AI-enabled compliance companies out there, and we will stay very far ahead of the game with that. When it comes to our sales marketing teams and how they're working with things, there is a variety of things. Things that have really made a difference over a very short period of time. The growth that we're seeing even in some of the fundamental tools like ChatGPT and things like that. Look, it's amazing what you can accomplish with that to learn more and learn on the fly and become a better— not a better salesperson, a better human being for it, for being educated. And then some of the tried and true tools out there, things like Salesforce, Salesloft, HubSpot, ZoomInfo. Look, there's AI being deployed inside of that that's helping people get smarter and faster about this? Look, what you do every day, I'd like to hear it from you because you're the expert in this. You, every day, you help guide companies through better strategies to become more productive in this. What are some of the tools that you use that are helping to drive the growth forward?

Yeah, I use a LinkedIn automation tool, and I use like a ZoomInfo type of database that has like an outreach approach. And I really like, for just keeping things in my head that I can't keep, Fireflies or some type of note-taker. Because I, I'll say, hey, tell me what Josh said, let me regurgitate it, and then tell me what I need to do to keep him in mind and also make sure that he heard— I heard what he said. Because yeah, one thing that I learned a long time ago, well, it's at Monster.com, is like My boss Marsha used to say, so I heard you, what I heard you say, Josh, is, and she used to repeat that. I'm like, she's really eloquent. And she used to say that just so that you know that she heard you.

Yeah.

And then, you know, mirroring a little bit of the body language. So that, I really like that. Um, the ChatGPT and taking someone to go, you know, I'm preparing for this, um, podcast with Josh, like give me some good questions. To ask him. Or like that animation that I ran at the beginning of this, it was from ChatGPT.

Oh nice.

I mean, you know, think about— I, I worry about some of the tech like Upwork and Fiverr and all these things where we used to look for people to do these little projects. Now I'm like, I could kind of do some of this basic stuff myself, you know.

It is really cool, right? Like I found myself, uh, taking a leap forward lately, at least from my own inner growth perspective, and actually having conversations with AI and trying to get live feedback. And instead of me trying to just type it out and say, you know, go do this and treating it like Google, I'm trying to have almost a live dialogue with it, gain feedback along the way, refine the approach, let it refine me. And, you know, look, it's not always perfect, but I will say that it is helped me organize, at least organize my thoughts better. Yeah, given me an approach that is different. It's another sounding board. And I'm fortunate to have great people that I work with. Like, I work with people that are just, you know, handfuls smarter than I am. And so I have great people to talk to about these things. But it is nice at times to have a, I guess, I'm gonna call it an objective perspective. Perspective, that it's not an emotional link, it's an intelligence link. And that's been a helpful other, you know, wheel on the bus.

So this last question, then we'll, we'll shut this down a little bit and let you get back to work. What about your executive team, your CEO, COO, CMO, any of those folks that you came aboard? What about their methodology, their think, their think-take approach. What about them made you say this is the right company for you?

Oh boy, look, I could probably go on for hours about this, but I'll share a few things. First of all, I work with a brilliant leadership team. They are experienced, they're smart, they're also caring, they're compassionate. I'm going to sound like I'm throwing out way too many C's, easier. They're committed to the mission. I'll give you a great example. When you join a company that has gone through transition during a period of time in our company, we are a PE-backed company. The—

how long ago was that?

9 years ago.

Okay.

And this is actually kind of the key point behind it. Our founders, they're still here. They are motivated. They are driven by making this industry better, by helping our clients be better. Like, you can feel the emotion in the room in addition to the intelligence where, where things are just— it really is this caring, compassionate environment, but we're madly driven to get better. And so our rate of improvement over time, whether it's being one of the first companies with a GRC, being one of the first AI-enabled companies in compliance, being one of the only companies that's actually global and can work across all of these different frameworks. What's behind it is a group of people that are absolutely incredible. And so when I sit here and take a look at, you know, whether it's Mike or Satya, Suresh, Kishore, Shamala, Darryl, and I probably just forgot somebody. So God help me, please forgive me. When I take a look at this team that I get to be with every day, it's motivating. It's legitimately motivating to be a part of.

How can people get a hold of you?

Well, look, the easiest way, since we're doing this here on a podcast, is you can find me on LinkedIn. It's Joshua Pete Hoffman. You can look at ControlCase and find me that way. You can always reach out to me on phone, email, WhatsApp. Almost everything that I have is under the handle jhoffman, so jhoffman@controlcase.com. But look, LinkedIn is always a great pathway. But we have a team of experts here, and it's not just me to get a hold of. We have an army of people that are driven for our clients' and partners' success, and we want to keep helping people grow. That's our mission, is to make this faster, easier, less expensive. And I know that we can. The proof is in the, the 20-plus years that we've been doing this. And thanks for asking the question. I appreciate it. No worries.

I'm going to play a little video from our sponsor. You know, our sponsor happens to be Full Throttle Full Auto Leads somehow. I'm going to play this for you. And then I just want to thank you, Josh, for making time. And, and I hope to talk to you soon.

Hey, look, all the thanks goes to you. I appreciate what you, what you bring to the, to the market and what you bring to organizations. You make a difference. And it's one of the reasons why I get so excited to talk to you. So thanks for having me on. Thanks, Josh. Full throttle. Let's go. Full throttle.