EP 49: Managed IT and The Reality of Cyber Resilience

It was about May or June time. We had, I think it was about 3 or 4 clients in about a 2 or 3 week period that got hit with the same sort of Quince ransomware attack. And yeah, it was, it was a bit chaotic. We had to basically drive around the country and rebuild networks and PCs. I think when we, when we totaled it up, it was something like we rebuilt 650 to 700 devices over a month period.

And that was essentially every device on the network, wasn't it?

Every single device on all 3 networks.

I heard somebody say in a networking event this morning, there was a quiz about IT security. And the question was, if you've accidentally put in your Microsoft username and password into the wrong thing, does changing your password fix it? And I had a deep belly laugh.

Staff are just an absolute nightmare to come by. They go to university and college and things like that, but the courses don't actually teach people what we do. Now, if someone sits in front of me and says, oh, I've got a university degree and I've done 7 years of this, but someone— Tim Davies, actually. Someone turns around and says, I've got 10 years experience in an MSP. I'd snap their hand off over a degree any day of the week. Hi, I'm Freya. Welcome to the Skynet Chronicles: Business in the AI Age, the podcast that dives deep into the world where artificial intelligence meets business. Join us as we explore the latest trends, challenges, and opportunities in this ever-evolving landscape, from innovative startups to established enterprises, we'll uncover the secrets behind the successful integration of AI technologies. So grab a cup of coffee, sit back, and get ready to unlock the mysteries of business in the AI age.

Good morning, Kieran, and welcome. I am delighted to be hopefully the first person to get you to do a podcast that makes it onto air. What could possibly go wrong? So let's start by talking about Evolve IT.

Okay, what do you want to know?

So when did you start Evolve? What do you do?

So Evolve started in 2017. We're a fault fix service desk or IT consultancy if you want to get fancy. Basically clients pay us a monthly retainer and then we facilitate problems and fix stuff. So yeah, we, clients pay us a monthly retainer, they call up with their problems and they fix it. That's the sort of bread and butter of the business. We also have our own third-party infrastructure where we host various servers and things like that for people. We don't do any development work purely for the fact that there's pretty much an off-the-shelf package for everything these days. So what's the point in paying developers when I think that you can just slightly customize anything that's already made? So much open-source products and things that just seems irrelevant. Not saying that that world's dying or anything, but maybe—

I don't think the world's dying. I think actually it's just getting easier and easier to make more of it.

Yeah, yeah, yeah. So So yeah, we do telecoms connectivity, MPLS networks, fancy stuff, connecting all the dots together, making businesses run smoothly.

And you are hands-on because you were just telling me that you spent the weekend running cables.

Yeah, yeah, yeah. We, well, I like to get involved, you know, I don't like the lads to think that they're on their own. So yeah, when I need to, I also chip in, but I try not to. I try to just do the client side of things and the smoothing over and making sure the account managers know what they're doing and, you know, going to meetings with them and meeting new people and new customers. And that's, that's what we do.

And networking. Yes, not just a little bit of networking, like president of the biggest chapter in the region.

Yeah.

How did that happen?

Yeah, next question. Um, so yeah, we've been a member of BNI for 9 years in, uh, in March now, and, uh, You know, it's worked well for us for quite a long period of time. It's not necessarily the people in the room, but there are certain people that have given me some really good work over the years. And if you can see past the bullshit, then, you know, you've got to get past it and just sort of play the system and you'll do well out of it. And there's, you know, there's a lot of bad talk about it, but it, you know, you put in what you get out and that's about it really.

I think in any room there's going to be businesses and people that you connect with that make sense. And those that you don't.

Yes, I believe that's how we met, so, you know, you can't complain too much. Um, you know, I've met some, some really decent people over the years, uh, through, through B&I, and, you know, some I do call friends, some not so much. Um, but, uh, yeah, no, it's, uh, it's worked well for us over the years, but we're definitely exploring new avenues and stuff at the minute, so that's, that's what the goal is.

But for now, you are still El Presidente and we have to bow.

Yes, apparently so. But, uh, yeah, but, uh, I think the goal, um, you know, I've got some stuff that I need to sort out first, but definitely the goal over the next sort of 5, 10 years is definitely acquisitions. There's some, some really big players out there at the minute that have got sort of deep pockets that are going around mopping up all of those sort of smaller MSPs. So, you know, lots of people looking to step back and, you know, I think—

so you see that generally it's a path to growth is to buy people who are nearing the end of their career?

Definitely the quickest way, you know, for a lot of businesses, not just ours. But, you know, it's, it's having the financial backing. We've got some people that we work with that would be willing to put their grands in their pockets. We nearly did a huge deal a few years back, but that crumbled unfortunately. I think the guy still owns it now, so that's no good. But yeah, all in all, gives you a second opportunity, doesn't it? I'm not going back down that route for that one. But yeah, no. So the goal definitely to pick up sort of, you know, IT and telecoms-based businesses. Smaller sort of telecoms businesses tend to be a good route for us because you know, they don't offer IT services, so then we can sort of introduce ourselves, go in, we're already billing them for comms in that case. So then, you know, it's a way foot in the door. Um, so yeah, that's, that's sort of the goal for us. You know, we're taking on more and more sales and accounts people, um, every year. And, um, you know, we've got some, got a really good team at the minute.

Fantastic. And this year the team got stretched a little bit, didn't they, after M&S?

Yes, yes. Uh, so about, um, May or June time, I think it was, it was about May or June time, we had the about 3 in about, I think it was about 3 or 4 clients in about 2 or 3 week period that got hit with the same sort of Quince, I think it's called Quince ransomware attack. And yeah, it was, it was a bit chaotic. We had to basically drive around the country and rebuild networks and PCs. I think in total, it was, I think when we, when we totaled it up, it was something like we rebuilt 650 to 700 devices over a month period. And that was essentially every device on the network, every single device on all 3 networks. And, you know, it was, it was chaotic. And then we were restoring from backups basically is how it was. So, you know, backups really did save the day. You know, you could, you could say, well, how did it all happen in the first place? And it was in some cases user-induced, which was, you know, always going to be the case.

Like Star, aren't they?

Pardon? Most hacks and most, most things are user-induced. Yeah, yeah.

User error, we always used to call it. Correct.

Yeah. And you know, everyone has an off day. You come in, you sit down, something looks legit, you click on it, you bang your details in and well, I get paid.

So I heard somebody say in a networking event this morning there was a quiz about IT security and the question was if you've accidentally put in your Microsoft username and password into the wrong thing, 'Does changing your password fix it?' And I had a deep belly laugh.

No, we tend to find that what actually happens is they sit inside the networks for, you know, quite some period of time. You know, these are the sort of less sophisticated issues. They sit inside the networks for a period of time, normally inside the 365 mailboxes of like accounts people and things like that. They learn who the suppliers are, they learn who they're trading with and things like that. And then they'll intercept an invoice, change the bank details. I'd probably say that's the most common one these days. You know, and then all of a sudden you get a phone call from the customer. 'Oh, I've just sent 10 grand to the wrong person.' Well, call your bank, don't call me. And then obviously that then triggers something in the head. Then they spend the money with us to actually lock it all down, you know, and secure things properly. It's a case of, you know, we try and push all these tools onto our customer base, but they are quite expensive in some cases, especially for the bigger customers that have got a lot of users. Yeah. These tools are only really effective if you roll it out to everybody in the business. Where some people come to us and say, oh, well, I only need these 5 people to have it. And it's like, well, you know, if it's compromised in one area of the business that's not got it, you know, you're sort of shooting yourself in the foot there. So yeah, I just, I really can't stress how much it sort of is important to get someone in to do a frequent sort of audit of everything. Cyber Essentials Basic and Plus, they're definitely 2 certifications that I highly recommend to any business of any size. The smaller you are, the cheaper it is. The bigger you are, the more expensive it is. But it will give you a really good baseline of security. The standards are set by the government, which is, you know, their take on it. We won't talk about them on anything. So yeah, that's some of the subjects we said we won't go. Ah, yes, yes. We'll leave those out. But no, definitely they're the two sort of routes I'd go down. But if you are a small business just sort of starting out, you can spend very minimal money and have some really good security. Any EDR products these days, you know, certainly explain the acronym for us. Endpoint detection response. I had to think about that for a second. You know, we are, in layman's terms, I always explain it as like an ASBO antivirus. We put it across the entire network and it doesn't just pick up the old school sort of like e-bombs and things like that, you know, internet, dodgy internet tabs. It doesn't just pick up and flag things like that. What it does is it constantly scans the entire network for anomalies, you know, people trying to spam. RDP sessions, VPN tunnels with credentials and things like that, it will highlight it. It will go to the EDR company and highlight to them. They isolate the device. They will then contact us and say, is this legit? And then we can enable the device or disable it depending on what it is that's actually happened. True story actually happened last Friday. We had one of our large clients, about 130 users. They signed out, signed off on our EDR product, which is Cynet, on the Friday. This was last Friday. On the Sunday morning, they had someone try to get into the network. With correct details. So it was 100% fluke and saving grace, but it was just pure coincidence more than anything.

And it might have been that they tried before and got, got past, who knows.

I do, I, I believe that they were already in and they were waiting to sort of pounce and we've kicked them out from doing it. So, you know, these tools, like I said, they are expensive, but they are lifesavers, you know, they're worth their weight in gold.

And users might think it's a bit disruptive being told, no, you can't use your device anymore, but that's a lot less disruptive than not having a business anymore. More?

I'd say one of the biggest things we do is completely isolate user devices to the point where they can't install their own stuff and they have to call us to say, just install Adobe or something like that. They cry and they moan about it, but of course they don't realize how much it can save them. If they— if we were to give every user admin privileges, I mean, you just wave the white flag now. It's not going to— not going to come out on top, are you? But yeah. You know, it's only going to get— the problem's only going to get worse, in my opinion. Um, you know, people are, even in this day and age, still IT illiterate.

They're not— well, they're not going to be able to keep up because things are changing too quickly.

Yeah, you're always one step behind, you know. You've, you've trying to, you're trying to, um, block a problem that's already— you know, the virus happens, you learn about it, and then you fix it. You know, people come up with new viruses. If it's brand new, nothing, no one's heard of it, you're in.

Just But if you're using some sort of mesh protection that's aware of all of the other things that are happening, these antivirus signatures effectively are looking for patterns, aren't they? And when new versions come along, hopefully the signatures can be updated and pushed out to all of the devices to give you a better level of protection.

Correct. And that's why I said it's important that, you know, some of the questions we get asked is, can we just give these tools to, say, 10 people? Well, it doesn't really work because if it's searching for anomalies across the entire network at all times, if they're all sat in an office, for example, and it's using IP addresses to try and get into these people, if they're already in the network, chances are they're going to get to where they need to be anyway, one way or another. So it really can't be a case of we just roll it out to these specific people. It has to go across the entire network to see, see what's going on everywhere. It just, it just doesn't work.

And if you go back to the hacks in the summer, they were doing wake up on LAN, weren't they? So you were shutting down devices and then coming back on again.

Yeah. So the client in particular, they had, like you said, they had some really fancy kit across the country. And yeah, we were calling around telling everyone to shut everything down. We were calling the data center in question saying, you know, but we were trying to shut the kit down. They were enabling wake-on LAN because they were in like all of the ILO stuff like that. We were shutting it down, they were turning it back on. So in the end we had to just go around and say, right, everyone, network leads, cable leads, like power leads, everything out. And yeah, it was It was chaos. Clever stuff, very clever stuff. I'd never seen it, seen it before, not, uh, not to that degree. But then, you know, that's when you hear about it on the news and it's like M&S and people like that. I always say that it'll always start with a smaller entity. So, you know, people like me and you, you know, they, they want access to our client base, which then puts them into the sort of medium SME. Yeah, they then want their client base, and then that's when they go after the bigger fish, because they've got to start somewhere. They need the information, and the best place to get the information from is people like us, because we want to work with a bigger the bigger people. So their foot in the door is through people like us.

And then once they've been into the bigger companies, they can then look at all of the suppliers and they've got all of the ability to go after them individually.

Well, that's, that's what happened. One of the clients that, that got hit, we were actually there and we were, we were real, we stayed till about 2, 3 in the morning and we were rebuilding all the PCs in the office. And the guy turned around and went, oh, I actually, uh, just forgot to tell you, I got an email from M&S saying that we were on the list of people's, uh, names that got compromised. And I was like, telling me this now? And you know, that afterwards you think you felt a bit bad, but you know, and they were, they were a particular— at the time they were a customer that weren't too interested, you know, they were more of a 'it will never happen to us' type. Yeah, we're not going to talk about that because that's a waste. And now, now it's happened to them, complete U-turn. Yeah, you know, they've, they've gone from, from nothing to everything just overnight, which You know, it's great because it means we don't have to worry about them as much. Basically, we have a, we have a list of customers now where we're there like, you know, they're going to wake up one day with a problem. But you try and educate them, you try and tell them, you know, we've got some great case studies from this year saying, you know, this is what we did, this is what happened, you know, this is how long you'd be offline for if it happened to you. And some people just don't care.

So even with all of that information, they're still not biting.

No, no. I would probably say that one, you know, one of the main things that I would say is the EDR product. Yeah. Brilliant, brilliant software. I think we've got 40% of our client base.

Yeah.

Look at the cost. Yeah. And the mentality, you know, it'll never happen to me. It will.

And we talked before about immutable backups.

Yeah. So, yeah, there's obviously lots of different ways you can skin a cat, but yeah, immutable backups are worth their weight in gold. And it basically just means that you're going to lose a day of work, you know, however you look at it. And it takes the backup from the day, the previous day, then it sort of isolates itself so you can't touch it. But then there is that sort of 24-hour period where you've got the backup for the next day, but it's, it can be, it's already been compromised, something like that. Without those backups this year, we'd be in serious trouble. You know, the client, the clients probably wouldn't be trading now if it wasn't for those. And they appreciate how important that was at the time.

So you got 40% uptake on EDR. Yeah. What sort of uptake have you got on immutable? Not enough, I'd say.

So all the backups that we take to offsite to us, they are all immutable, all of them. You know, it's not something you really uptake, it's a setup. So as long as you've got backup, they tend to be immutable. One of the things I would touch on on backups is 365. We had an issue probably a couple of years ago now where someone deleted a file in a SharePoint site. We tried to get it back through Microsoft. And if you read their T&Cs, they have this ridiculous, like, 30-day reasonable endeavours service. Now, also trying to get a ticket through to Microsoft is a pain in the ass. But yeah, they had this 30-day service and in the end they basically just turned around and said it's gone. You know, so yeah, exactly. And you know, it's another thing we try and, you know, all these customers, a lot of small businesses just use SharePoint, just Office 365 and just use SharePoint. They don't have servers and things on site anymore. And, you know, we said to them, take an offsite backup of your SharePoint, take an offsite backup of your 365. How much is it? Well, once again, too expensive. Don't do it. Well, you know, it's run the risk. You know, if the tenant was to get compromised and all the files got encrypted within the tenant, then what are you going to do? And it's proper game over then. So yeah, our standard 365 backup tool takes all of the SharePoint and OneDrive facilities for— I think it backs it all up for one year and all the mail for 7 years, and we offsite that to ourselves. All untouchable, brilliant stuff. Box ticking exercise. So just if you— everything's gone, you know how it is, everything's per user per month these days because they all want the, uh, they all want the money on tick, you know, even Adobe and, you know, Office licensing, everything's per user per month because they want the continuous cash flow. And, you know, back in the day Used to get businesses reusing Office licenses 3 or 4, 5.

You still do see that occasionally, don't you?

Not— I, I actually don't remember the last time we purchased an OEM license.

No, but I know there are businesses like this.

There's bound to be some kicking about that still do. Oh, I needed that. Um, yeah, there's bound to be some people kicking about still do it. Cheap, but you still got to pay for an email license. So for the sake of a couple of quid and just getting involved, just do it. Yeah, but times are hard, I suppose.

I, I'm not sure that they're that hard.

I don't blame the Labour government, they are really good.

Lying. Yeah.

Um, so yeah, no, there you go.

So Obviously we're starting to see AI being used to write code that is then being used in attacks. There's been an example of that identified by Anthropic recently where in fact they were essentially writing hacking code for somebody, um, and they've seen signs of it. I don't think we're going to be far off being able to have fully agentic hacking that is just using large language models to live code And that's a very scary thing because I don't know how we protect against it other than the methods that we've already discussed. Well, still EDR, it's still antivirus, it's still education in terms of don't click these links, stupid.

You know, basic business practices will always help. But think of it as, as a case of, you know, they're using AI to write attacks. Well, someone's got to be shitting their pants somewhere, right? And using AI to defend against them as well. You know, we don't know what's going on.

I mean, it's always going to be an arms race, isn't it?

Yeah, exactly. So we just better hope that the people writing the good stuff do a lot better than the people writing the bad stuff. But yeah, no, AI, you know, we get quite a few of our clients now using things like Copilot and things like that. You know, we've openly had a few clients come out and say that they won't be employing any more people. They're going to focus more on automation and things like that going forward, which is you know, fine, it suits their business. We have some businesses that are just never going to be able to use it. You know, they make stuff using machines. It's not there yet. But yeah, I don't— I try not to comment too much on AI. It's something that we use in-house for various bits and bobs. Our RMM system that we use, so like our remote management tools, that uses AI. So it helps us identify problems that have come in in the past on the same site with certain devices.

With certain people.

With certain people as well. Yes. So if, if a ticket gets raised through our ticketing system, the built-in AI tool will say, well, we've had the same problem with this device 10 weeks ago. Here's how we fixed it. Or, you know, it's clearly still an ongoing problem. Just replace it. So yeah, we use it ourselves for certain things. Could we use it more? Probably, um, but I don't know where yet. But I think of my best ideas when I'm on the toilet.

It's going to be a continuously evolving space, isn't it? Things are going to move forward all the time, and I don't think it's going to stop.

No, no, no, no, no, no, no, no. And everyone always says, oh, well, aren't you worried about AI and things like that? And they're like, nah, I guess my business will always need some element, you know. Everything, like I said, everything's license-based. Even if it got to the point where no one ever needed support, well, you still got to buy it all. And at the end of the day, you still need to plug it all in.

And people buy people. They want that human interaction. They want a trusted provider. They're not going to— well, there will be people that trust complete automation and that will possibly increase over time. But there's always going to be value of knowing that it's Kieran and I can just pick up the phone and go, 'Correct.' Well, I don't know about picking up the phone.

To me, I tend to go, 'Yeah, call the help desk.' But yeah, no, I know, I know what you mean. And that, and that doesn't— that's not just an AI thing as well. That's like a large corporate issue as well, I believe, you know. Like I said at the start, it's a case of there's some huge corporate IT, American-funded, obviously, firms that are going around picking up a lot of MSPs. I would say in the last two, yeah, last two quarters, I reckon we've had 14 new clients off one of these firms that just got bought out purely for the fact that they don't want to deal with these huge corporates. They want to deal with sort of smaller businesses, you know, we're, we're a relatively small team, I suppose, in the grand scheme of things. I don't know, I don't know what a decent-sized IT company looks like these days.

I think there's no such thing.

No, no, no. You know, my, uh, the guy that trained me on everything in my very first job in IT, he's a great bloke. And, uh, yeah, I think he's been sort of growing slowly over the years, and he, he probably has the same issues that we do. Staff are just an absolute nightmare to come by. You know, they get— they go down to London and they sit with these huge corporates getting and earning loads of money. So for us to pick up, you know, decent solid staff— fortunately I'm in a case where I have got a good team. But yeah, getting decent engineers is hard and no one wants to do it. You know, it's not like it's— they go to the university and college and things like that, but the courses don't actually teach people what we do. Now, if someone sits in front of me and says, oh, I've got a university degree and I've done 7 years of this, but someone— yeah, exactly— someone turns around and says, you know, I've got 10 years experience in an MSP, I'd snap their hand off over a degree any day of the week. You know, that's— I've got some very autistic clever people and they've got fancy degrees and stuff, but they're just as good as the lads that come out with absolutely nothing. I am not qualified at all and I know quite a bit.

I think experience is actually qualification.

I agree with that. Yeah, definitely. Definitely, yeah. I can't, can't knock you for that one at all. That's, uh, that's bang on, I think. And I think that the whole, uh, sort of structure of— we're going off topic here, but I don't care— uh, the whole structure of education needs completely scrapping and reform. Definitely.

How does that work? Because I mean, I see the same thing. We see the degrees, the content of the degree courses that we've got degree apprentices on It's not up to date and it's never going to be able to be because things are moving so fast. How can the curriculum keep up? But that creates a large problem where effectively people are going and earning a degree for 50 grand, coming out, and the majority of what they've been told, if it's anything to do with tech, is just incredibly dated. I mean, they're teaching them how to code in PHP and you're just like, really?

It's, it's Yeah, how does it work? I don't know, that's a good question. Not, not only that as well, like you said about the cost of it all and things like that. I mean, it does need just a complete overhaul, but one of the things that probably gets to me the most is, um, you know, I've got, I've got an account manager with me. He did the— he went to uni, did 3 or 4 years of business or something like that, right? And, uh, yeah, he earns good money. I think, careful, good money. And you know, he's commission-based as well. So he does have some really good months. And you know, by the time he's actually paid a chunk off his student loan, the compounding interest is more than what he's paid off. And he is never gonna pay that back. And I just think that you're either good at something or you're not. And he could have, he's the same person as he was before he went to uni. And I think he's got it in him to be decent prior to that. But I, like I said, the system just needs scrapping, you know. There's too many people that haven't got basic skills for optimum— maths being one of them. The amount of people that I meet that just can't count, and it's like, my English is not great. I'm not particularly illiterate when it comes to things.

I think you're incredibly articulate. You just sometimes choose words that are not necessarily socially acceptable.

I know, I know. But one thing for me that has always been key, you know, I would say is maths, you know, being able to count. It should just, should just be fundamental. But yeah, they'd rather go and go to uni and spend 50 grand doing media studies and shit.

But it's not just basics of maths, it's basics of peopling. People can't hold a conversation. They don't know how to go up to people and just start a conversation about something, which is just— they should be teaching networking at school.

I agree with that. Not only that, there was, um, oh, who was it? It was something I watched the other day. It was on YouTube or TikTok or something, and they said that all these, uh, millennials crying about what alcohol does to you and all this sort of thing. And someone, I can't remember who it was, but came out and said, well, you know, look at the price we're paying for people that don't have a conversation. You know, no one talks to anyone, no one goes out anymore. When I was like 18, 21, around that sort of time, we used to go out, you know, not that I've got a problem, put that down, 3 nights a week. At least, at least 3 nights a week. You know, we'd finish work, we'd go down the pub, or definitely Thursday, Friday, Saturday you'd be out. And you know, the town would be heaving, clubs would be packed. But look, just look how dead it is now, you know.

And it's not just dead in smaller cities, it's dead in London too.

It's dead everywhere. Yeah, it's completely dead. And I don't know where the world's gone wrong. Social media has got to be something I blame for it. You know, I'm not a huge social media person. I don't do stuff like this. Um, I don't do LinkedIn, I don't do Instagram, I don't do any of it. I hate social media with a passion, and I do think it's ruined the world, in my opinion.

I just don't consume it.

So no, no, you're a gangster.

But I'm like, I'm not against it, it has a place, I'm sure, but it's just a waste of time as far as I'm concerned.

Yeah, LinkedIn's an interesting one. I mean, we, we post quite a lot of, uh, stuff on, on LinkedIn to do with work. Do we get anything from it? I don't know. But does it give people an insight to what we do? Definitely. But when it comes to the likes of fucking Instagram and Facebook and TikTok, like, these people need burning. Like, just, it's so bad. I think it's a, it's appalling. And, um, I think there's a country at the minute, I think it's Australia, that's just turned around and said that they're going to block it for under 18s. Under 18s. Well, I think they should block it for life.

I don't think it's going to work because I mean, they'll find a way around it.

Yeah, look at the porn thing. Yes, everyone's just using VPNs.

There's always going to be a way around it. But I think if we come back to LinkedIn, you don't know whether it's working, but if you make an inquiry to a company, the first thing they're going to do is they're going to check your Google, they're going to check your LinkedIn. And so it adds that social proof, doesn't it? It shows that you are real people, that you're helping solve real problems. And whether it's how much of a difference it makes, you never know.

No, no, marketing is, I think, one of the weirdest things. I can't get my head around it. I, you know, I don't— it's not that I don't care about it because that's wrong. It's— someone said something not so long ago and they said— it stuck with me a bit— is, is how other people see your business because you won't see it the same as them. Yeah, something like that. I can't remember the full, the full expression, but And I thought to myself, well, I've always said marketing is a bit of a, you know, flop. Like you said earlier, people deal with people, but then how'd you get your foot in the door anyway? So, um, yeah, you know, we've only recently really pushed sort of marketing things. And have we got anything from it? Yeah, a shitload of spam. Um, but, uh, I don't know, is it working? Who knows?

Well, thing is, you're growing a business, and so there's, there's lots of levers that you adjust, and you don't really know which ones make the most difference. People on the phone definitely, definitely cuts through and gets people talking. But yeah, end of the day, the more tenders you respond to, the more proposals you put out, the more lucky you get. And it's the same with marketing content, it's the same with almost everything in life. If you're not trying, you're not going to get anywhere.

I I think in our entire trading lifetime I've been to one meeting in about 2018, 2019, and the guy turned around and he just went, oh, I've noticed that you put a few, uh, a few blogs up, a few blogs up not so long ago. And I was there like, yeah, yeah, yeah. And he goes, oh, and you've just stopped doing them. And I turned around to him, I said, like, man, you're the only person that's ever gone to our website and checked our blogs page that I know of. And there were others, but they never mentioned it to you. Yeah, probably. However, I would say this, this past— what, we're in now December— this sort of past 10 months, we've had people come and say, you know, your marketing's really good, it's really, you know, it's on there and stuff. So it's clearly people do notice.

Whether or not it does anything, maybe, you know, maybe it's one of those unknowns, isn't it?

It is definitely—

businesses stop marketing when times are tight and it's like, well, actually shouldn't you be upping it there? And it's just—

I, I think so. I think, I think when— maybe it's the inner, inner gambler in me, but I think if I was ever struggling or the business was sort of on a flop or going downhill, I wouldn't be scaling back things like that. It would be a case of, right, what, what can I do? What have I got left? We've got, you know, this much money, right? Let's go buy— let's go hire 5, 10 salespeople and let's try and fill that gap.

Chance of rolling double 6, it's worth it.

Correct. Yeah, I would much rather throw the dice and just say, right, we'll give it everything, then, uh, you know, stop. Yeah, I think it was one of my parents that said— I can't remember, I remember what we were talking about, but I turned around and just said, if I had the chance to double everything, if there's a 50-50 chance to double everything I've got or lose it all, I'll take that flip. That's a good coin flip.

How many times would you take that flip though? Because technically it's 50/50 each time. As in, when you say how many times would I take the flip, as in if you, if you got a double, if you doubled, if you doubled, if you doubled, what, how many doubles do you need before you stop?

I don't know what I'm worth, so, but it doesn't matter. Hmm.

Do you have a number in mind for retirement? You have a point when you're going to stop? I thought you weren't planning to retire.

I'd be well bored. No, we couldn't do that. We've got to do something.

Um, you know, so if you've got to do something and one of the ways of doing something is you're just continuously rolling and doubling and doubling and doubling, how many times do you take that bet?

7.

7.

I think 7. Yeah, I think 8's pushing it.

I think 7's probably pushing it.

No, I'm happy with 7. 7's good.

So 7 opportunities to lose.

I will take 7 coin flips and not one more. And it'd have to be the coin of my choice, and it would be double-sided.

Well, then you may as well do 8.

No, no, no, 7's enough. No, I think people might know. I think 7, that's got to give me a few quid. But, you know, we, what, one of the main things that we're, we're trying to do, just going off topic back to what we were talking before when we started out, was, is diversify a little bit, um, you know, The reason we offer, you know, we're an IT company that does telecoms. The reason we offer telecoms is because it's a great latch into it. You know, the contract lengths are longer. You know, it's a good thing. And, you know, we've got some stuff coming early next year that's going to sort of cement us with customers and being able to offer more services because we do have a pretty, pretty damn good reputation.

You've got a great too, huh? You've got a great team.

Yeah, yeah. No, I think that's what it is. Yeah, we've got a great reputation, a great team. So the more services we can offer at a great service, obviously, you know, the better it'll be for us and them and me.

Well, of course, all more for the coin flip.

So, but yeah, no, would I, would I ever retire? Would I ever do anything? Certainly not yet. You know, it's not happening for quite some time unless someone made me a ridiculous offer, but it'd have to be ridiculous.

The thing is, it would need to be ridiculous because there's so many toys. So many things that could be bought, so many things that can be played with.

Yeah, but it's more fun trying to earn it yourself. Absolutely.

But you'd still take the flip 7 times.

Yeah, but that's different. That's like, imagine the suspense.

The suspense, it would kill people. Yeah, people would die from that suspense.

I reckon I'd make the money back just in like a YouTube clip of that.

Well, I think you would.

Yeah, yeah.

I think some of the people that have made a fortune on social media, MrBeast, effectively just funding these crazy, crazy things.

He comes up with these games which are worse than coin clips, in my opinion. And, uh, you know, that's it. I'm not— like I said, I don't do social media, I'm not a massive YouTube thing, but one of the things I probably do watch— I watch the— like I said to you, I watch the Bad Friends podcast and I watch a bit of Rogan, things like that. But yeah, he's one that's sort of— quite a few people I know talk about, but I'm just like, why? I sort of sit down and watch it and I just think, why? How are you worth that much?

Game show, it's stupid.

Yeah, but Yeah, I always just say stick to what you know, but I don't know, I'm— here's me saying that we're about to diversify and start offering a load of new services.

Well, no, but it's just extending service offering. It's still the same core, isn't it?

Correct. Yeah, yeah, they'll just be add-ons and things like that, but it's— it'll be a slow uptake, I would have thought, to start with. But we'll see how— we'll see how we go. I think it'd be good.

So you've always got your eye on a new car, and I saw a picture of a new car that I think somebody in our old chapter— sorry, your current chapter is going to try and sell to you shortly, because every time he does a presentation, he's got a picture of you in a little Yaris.

Oh, you're back, Chris. Yeah. Oh, um, I hate Toyotas with a passion. However, all the work fleet is Toyotas, and I did own a GR, and it was one of the best cars ever. It was brilliant. Um, I sold it, and I shouldn't have done, really. It was great. Uh, what have I got my eye on next? Um, I don't know. Well, I do, I'm not saying. And it will, uh, it'll be a while until I can get my hands on that. I think it might all go to shit before then anyway.

So it's a leap above the, um, RS then?

Uh, oh, about the same level. Okay. Um, but different purpose.

All right.

So, but, uh, that's all I'll say. And, um, yeah, you're not looking at Rolls yet then? Shit, no, I don't do Lambos. I don't do any of that sort of stuff. I avoid it with a plague. But no, I know what I want next, and I'm— but it's not going to be for quite some time. I don't know how the way the world's going at the minute, probably not going to be for a very long time. But yeah, we'll see, you know, see what happens.

So if you look ahead 2 years down the line, how much has your industry changed from AI in that time, do you think?

As in how much it changed in the past 2 years, or how much is it going to change into? 2 years going forward. Hmm. We will definitely see some far more complex attacks. With that, we'll see some more complex EDR antivirus. I would have thought that there'll be a lot more systems that are streamlined. We've already talked about open source products and things like that. I would have thought that there'll be issues with more people will be buying off-the-shelf products and not going down the development route even further, which, you know, I stand by. And I know you probably disagree, but I do think development stuff is dying.

I think, I think it's actually the opposite. And I think we're going to see more and more people writing their own stuff. So the vibe coding will get to a point where you can actually get reasonable quality output, and that will create a whole new array of attack vectors because they won't know what to check for. They won't be putting the necessary checks and balances in place. So I think we'll just end up with a far more broad spread of solutions. And instead of a company having maybe 10 different SaaS products, they'll go, I don't need a Monday, I'm just going to make it. I don't need a CRM, I'll make it. And then they'll expose themselves because of the interconnections between them. And it'll be very difficult to support that.

I understand what you're saying. But one thing I will say, we had a, you know, once again, true story, we had a client that had a bloke in-house who had developed, this is years ago, he developed an Access database for them from the ground up. This is a big company. They're a big firm. All right. He developed this Access database and they've been using it for years and it was starting to get clunky and slow and all this, but it was a key component of their business and he'd bolted on all these things and there was no off-the-shelf product. There was, but it would require a lot of work and a complete overhaul and, you know, painful. About a year or two ago, bloke died. He died and he was the only one that knew how this system worked and how it was built. And all of a sudden we've got a huge company here in the UK that was at a complete dead end. They couldn't develop it any further because it was clunky. It did have quite frequent problems. They had to pay— I think they paid us a bit, and then they also paid another firm huge amounts of money to sort of reconstruct the whole thing backwards. And then all the company did that they got in touch with, just sell them an off-the-shelf product and tweak it. And I just, you know, I said to them for years, if you use one person to do one thing, it's like using a an IT company that's a one-man band, you know, there's a lot of them out there. They are cheaper than us because he's just got to look after himself. Yeah, but you, it's a single point of failure. If you buy an open off-the-shelf product or an open source bit of product, you've got huge access to forums and things like that. When these products arise, even the open source stuff, yes, you, you can mess around with it and do a lot with it. But everyone else is as well. So you can ask questions and someone might have the same problem. So yes, you're right, development work will grow on that side of things, I think. But in terms of what you said, people building a product for themselves and then using it or trying to sell it, I think it's a stupid idea. I think it's going to have huge implications if people do that.

I think it's going to happen anyway because they all think they can. And in fact, we've had experience of customers deciding actually they're going to do something themselves instead. So we'll build something and then they'll think, actually, I can just do it with ChatGPT. And you think, okay, but you, you don't understand the implications of what you're doing there. But if that's the right choice for you, yeah, you go for it.

And I suppose it comes down— there's a couple of factors. It probably depends on the size of the organization. If they have got, say, a team of developers working on it together. Yeah, that immediately you spreading the risk a little bit there. But if they just employ someone in-house, one person, yeah, just give up now. In my opinion, because it will go wrong at some point, it'll break and the guy will be on holiday in Egypt or whatever.

But the amount of businesses that still rely on, well, not just Access, but Excel, and where people have built out these hugely complex systems running in Excel and you just look at it and you go, Yeah, really? That your business runs on that?

And going back to the whole thing about, you know, cost of tools and antivirus and things like that, same thing. They've spent so much money here and they've spent more money added to it and added to it and added to it for someone to come in and say, oh no, scrap that, buy this for £20 a month off the shelf. Well, we've spent, you know, hundreds of thousands over the past 20 years developing this. It's crap.

But the bigger problem then is actually the change management within the organisation because people really don't want to change much. And so if you're bringing in a new shiny tool and they all really like their Excel, then there is a fundamental struggle in that change.

I know what you mean. There's a trick of the trade in our world when it comes to giving someone bad news. You don't call it a change, call it an upgrade. Believe it or not, just that small terminology change there makes people's lives better. You know, it's exactly the same thing. But if you call it an upgrade as opposed to a change, for some reason, clients have always just gone, oh yeah, upgrade, yeah, like, like that. Whereas if you say I'm changing this, they go, oh no, no, don't, don't change that.

And you understand upgrade often means more money too.

Well, yeah, true. But if you tell them that the change costs the same as the upgrade, you know, anyone's going back to the coin flip then. So yeah, um, yeah, we'll see, we'll see. But I think you're right, you know, people will try and develop things themselves, but I think it'll backfire massively. What do I know?

Well, it's what we're all just guessing. It's ultimately everything's a coin flip, isn't it? I don't know whether you're doing your marketing or not, it's a coin flip.

It depends if you believe in time travelers. If time traveling is real, walk through the door now. No.

Okay, why would they come here?

No, me.

Oh, okay.

You never know, I could have just walked through the door.

Yeah, possibly. But you wouldn't be allowed to see yourself because that would cause problems.

Yeah, true.

Well, that's it.

Or would it?

We don't know. It's never been proven.

No, I know.

Um, well, we've successfully managed to get through a podcast without saying anything too offensive, so I think we should probably draw that to a close.

Hard not to swear as well. So it's like my weekly Wednesday morning meetings where I promise I won't swear, and sometimes occasionally a little fuck comes out, but it's fine.

Yeah, it's fine. Nobody died.

It's fine. No one died.

Perfect. Awesome. Thank you, Kieran.

No worries, Tim Davies, for having me.