A brand new cybersecurity peer group emerges... don't miss this HUGE news!

What's going on, my friends? First thing we got to do is dump this epic music. It is epic and it is way too epic, don't you think, Alex?

It is pretty epic.

I mean, it's pretty awesome for like a beginning, like, but let's go to some future pop. Let's see what we get here. Oh, it's not going to be in that '90s garbage music you listen to.

I think my '90s garbage music is way better than this.

I, I happen to agree. How about some chillhop? Let's check out some chillhop, man. How's everyone doing? It's good to see you guys on the livestream today. I hope everyone had a great holiday. Hope everyone had a great Christmas and New Year's. And all those other good things. It's good to see folks in. Shout out in chat, let us know who you are, let us know you're listening, where you're coming in from the ether. We got some fun things to talk about today, I think, Alex.

Yeah, we're doing something pretty cool, which is— and it's getting close— which is partnering up with Barry McKinley, and we're going to do a cybersecurity peer team, right? We've had peer teams for owners and leadership teams forever, and, uh, cybersecurity has finally graduated to the point where owners and leaders care about it. And, and we're going to launch this thing with Barry McKinley and the team here at Empath to really help shepherd some, some CIOs and some, some technical account managers and just some of the cybersecurity leaders in the space down in the right direction. I think it's super cool. I'm really excited.

I'm, I'm pumped about that. So you mentioned something at the very beginning I want to come back to. Usually peer groups are dedicated to the CEOs. And that's fine, right? Like CEOs need a place that they can go and live and talk and breathe and unload and just talk about what it is they want to talk about. But there's a whole bunch of others that have always sort of been left out, don't you think?

God knows, as a business owner, we need some place to vent sometimes, especially solo business owners, right? You just need a place to go to have conversations that you can't have in your organization. But that said, I feel like cybersecurity leaders are in the same place. Most of the team doesn't really understand what they're talking about. They don't speak the same language. Things are a little different. They're dragging people along kicking and screaming into, you know, into some new standards, some frameworks, some things that we've for a long time said, I can just ignore it. It'll be okay. One more year. And that day is long gone, right? We have to stop ignoring it. We have to get people up to speed. These guys have a lot of hard work in front of them and they need guidance. They need instruction. They need to commiserate with their peers and talk about how hard this is going to be. They need a place to take this journey.

Yep, they do. And when it comes to sometimes all things in life, I think as human beings, we're just sort of bred to be pack animals. We're bred to be— we work together in groups, we do things together. We are not isolationists. I mean, we've all seen the movie. What's the Tom Hanks movie where he's on the island?

Castaway.

Castaway. We're not that. We are not Tom Hanks.

Crazy.

Yeah, yeah, we go crazy.

Well, he wound up talking to a volleyball. Let's be clear.

Yeah. I mean, he didn't do so good. Right. Exactly. Fun movie to watch.

He should add to his pack one way or another.

Real fun movie to watch. Yeah. So there are benefits that come with peer groups, right? Like you get to measure how you're doing. You get to talk to your peers on how the heck does this work and how are you doing X, Y, and Z? Can I learn from you? You can commiserate. You got battle buddies. But I think even bigger is to steal a word from Kyle Christensen's vocabulary. Top 5 word for him is accountability, right? And that's necessary in security. All of those things are necessary in cybersecurity. So I'm curious to know from you guys, Scott. No, I don't think the stream stopped. I'm seeing it on my end too. I've got it. Actually, I do this, folks. I do my own live, watch it myself just to make sure things are okay. So I think we're good, Scott. You may try refreshing, but you know, when it comes to cybersecurity peer groups, I don't know of any that exist. Which is shocking to me. I've heard MSPs ask for a peer group to be started in cybersecurity for years now. And Barry McKinley said, we'll go and do one. And I'm super excited about that.

I think, I think 2024 is the year we're going to see some of this stuff come around. I think, I think this year is the year that the coaches start to pick up the fact that, that there's a lot going on here, right? We're seeing VCI University get kicked off. We're seeing cybersecurity peer groups go. Go through every vendor's talking about it. Finally, there's something that will draw as much attention as a sales and marketing webinar, and that's a cybersecurity conversation. So really excited about that. The team at Barry McKinley— and I'm a little biased, I was a Barry McKinley peer team guy back when I had my MSP. So I've known these guys a long time, love their work, love what they do, and just super excited that they chose to partner with Empath to make this happen.

Yep, I absolutely am too. I'm gonna see if I can get a better view here. I think this view will work. Let me just thin my screen out just a bit here. Yeah, that's well said, Alex. And, you know, there's— there are a lot of great peer groups, right? And we're not, you know, here to pick winners or losers. We're just here to say we want to support, you know, one that came out and said we're going to do one on cybersecurity. Why would we not say we want to help? Right. And so we'll talk a little bit more about what Empath will be doing inside of the peer group and kind of helping in just a second. But here it is. If anyone's curious and wants to see it, this is a website. Website. Let me pop a QR code up if anyone wants to scan it. If you don't trust me on scanning a QR, I get it, but it's just BMC— or I'm sorry, bmkcommunity.com/cspeer-team. Or you can just Google Barry McKinley Cybersecurity Peer Team, it'll come right up. So here you are, um, and this has got all the information about it, right? And so one of the things that we're going to be doing is we're actually diving into probably one of the most difficult, uh, components. Oh, like My name is misspelled. That's awesome. We'll get that fixed later. One of the most difficult components of security is aligning it, right? Is the strategy, is the getting started, getting past the inertia. And security is not going to Reddit and asking everybody what's in your stack. Security is not listening to your vendors on what they tell you that if you buy their product, X, Y, and Z won't happen. Security is not doing what the groups of the hive mind thinks. Security is like all things. It's following roadmaps and blueprints and best practices and approaching this from a scientific viewpoint.

Let's be clear, the herd, the hive mind, the collaborative genius that is cybersecurity today is getting breached left and right. So the answer is we have to do better, right? Not just go do what everyone else is doing and try and slap a product on top of our current stack and call it security. And I had that conversation with Steve Taylor today. We were talking about, you know, what we're building at Empath and how all this comes together. And I said, you know, the, the vendors and they're not doing anything wrong, they're going to teach you enough to sell their software licenses and that's their job to make sure you can be successful with their software.

Right.

It's not their job to teach you the 101, the 201, the 301 courses that lead up to understanding what that software is supposed to do and maybe even learn how to do the function manually without the software through regedit and, you know, group policies and real security practices. And yeah, the software is great. It makes it easier, it makes it faster, it makes it more scalable. That's where the software comes in.

Yep, exactly. And so because of that, one of the things we have to do is we have to put the horse back in front of the cart. And that horse is a blueprint to beginning. If you don't know why we're talking blueprints, let's just assume someone's listening today just for a second. They have no idea what like a security framework is, right? So security is not finger in the wind guessing. Security is following process there. And when it comes to frameworks, there's a number of really great frameworks that exist. On Cyber Call this week, we talked about frameworks and we talked about the approach. But one of the reasons the MSP industry is generally sort of centralized around the, the CIS, the Center for Internet Security controls, is for a number of reasons. One, there's 18 of them. So it's, it's not overwhelmingly difficult. They tend to be very prescriptive, like do this, do this, do this. A lot of government controls that exist in government frameworks are more prescriptive, right? So you should do this thing over here. I'm sorry, descriptive. Sorry. So they just sort of like explain what you should do, but they don't tell you how to do it. And you're left being really frustrated with like, I get that you're saying I should develop a policy for identity and access management, but I don't know what that means. Like, how do I do that? How do I accomplish that? And so the CIS controls are very, very, very prescriptive in nature, telling you exactly what to do. And so it's— here's the analogy, Alex. It's like if I'm going to build a house, it's not like Minecraft. When I play Minecraft with my kids, I just start whipping up a house anywhere I want to go and it's always ugly. And my oldest son, who's really good at architecture, makes fun of me. He's like, Dad, you— no matter what you do, you do— you are horrible at this game. I'm like, yeah, I know. And he's got these awesome designs that he's built because he's following blueprints.

Yeah.

Same thing in security. We follow blueprints.

Well, and, you know, to your point, they've even taken the CIS controls and ripped them apart. Right. So now we have implementation groups 1, 2, and 3. And we were talking about this again with Steve Taylor today. You know, inventory is not just control 1, group 1, right? Control 1 has 7 parts or 8 parts. I can't even remember. And they're split throughout. Control or implementation groups 1, 2, and 3. So the first thing you do is an inventory and it's probably a spreadsheet and it's probably really manual and it probably sucks. And the better you get at it, the more you add automation back and the more you add tools and processes that streamline things and make them easier. So again, we learn how to walk, then we learn how to— where we learn how to crawl, we learn how to walk, we learn how to run. And that's how you really get an understanding of the fundamentals that let you build a culture around security instead of just trying to buy a product, whack a Band-Aid and call it done. Yeah, and that's what we're going to talk about in the, in the peer team, right? We're going to walk through each and every control. We'll talk about the implementation groups and what order to get started in. We'll give a little bit of guidance as far as all those things go.

Yep, exactly. I want to bring a chat up that just came up because it's really, really good. Here it is from the one and only Mr. Forbus himself. It's very easy to get started using Group 1, meaning the Implementation Group 1, sort of the very beginnings. Once you get that covered, move on to Group 2, etc., it becomes something that can be obtained step by step. That's exactly right. And what I love about that comment is this is how we begin. There is inertia that's involved with the CIS controls. There's inertia with anything that we do, right? I mean, how many of you guys like said, I'm going to go to the gym January 1st and you're just getting past the inertia, even waking up early enough to do it?

Yeah. Yeah.

So inertia is just— it's been built into the laws of physics since the beginning and it exists up here. And it exists in our pen and paper approach mentality of how we get going on something, right? Even business processes suffer from inertia. And so he's exactly right. James is right that for us, like, understand— to use an elephant analogy— understand that it feels like eating an elephant and you do bite it one, one bite at a time. You'll get through it. And that's what we're going to do. Just what you said, Alex. We're literally going to get started by saying We're beginning with inventory of hardware and software, guys. Well, first of all, we're going to do in the peer group is we're going to talk about the CISSP. We're going to walk through it. We're going to show it. We're going to describe it. The peer groups will all be able to kind of talk through like where they're at with it. We tried it, we failed. We haven't even begun it. Security is interesting to us. We're trying to mature. We're already through IG1. We want to keep whatever it is in your journey. We're going to level set and then we're going to introduce CIS Controls 1 and 2 on the very first week, which is coming up in just a few days. And guess what we're going to do? We're going to talk about how hard those first two controls are. We're going to talk about that inertia to get past. We're going to talk about that difficulty. And here's the good thing. I want you to talk about this, Alex. Good security doesn't happen overnight. Good security is never perfect. Good security is something that we begin the journey on and we are constantly iterating to better maturity and success as we go forward. And the most important part is that first step, right?

And you used one of my favorite words, iterative, right? We every— I can't remember how many times as an MSP I would walk into a prospect and they'd go, oh my God, it's terrible. This network is the worst thing you've ever seen. I'm sure you've never seen one this bad. Oh my God, it's awful. Like we have outages all the time. Life sucks. And we would always sit down with them and say, I promise you, it's not the worst we've ever seen. We found a dead bird above the above the ceiling tiles in one of our offices, wrapped up in some of the network wire. And I promise you, it's not that bad. But you're right, it needs some improvement. And it didn't get here overnight, and it's not going to get to perfect overnight. We can't fix it overnight. What we can do is build a plan, build a roadmap, and start to work our way through it. That was a lot of what we did at Lifecycle Insights. We help people understand that it is a— it's a staged process. It's iterative. We're going to continue to improve a little bit every single month, every single week. Every single day we're just going to check one checkbox, move one, move the needle one, one notch, right? If we get 1% better every day, we're 52% better at the end of the year. Life is a whole lot better. That's a huge improvement, right? Um, so the goal really is that we just help people, number one, understand what good looks like, give them that roadmap, that framework, help them dissect what is still a little bit of a complicated framework. I mean, NIST is way more, like you said, it's way more ambiguous, doesn't really give us the direction that we're looking for. Um, CIS is easier to manage, easier to handle, and then what you'll grow into from there— once you really understand CIS, you'll understand, oh, you know what, this— the CIS thing maps to NIST, it maps to, um, to CMMC, it maps to HIPAA. Oh, if I do, um, all, you know, my inventories correctly, this is how they map. If I do authentication correctly, this is how it maps. And oh yeah, some of those ones that sounded really nebulous and gross when I looked at them on another framework they're actually kind of manageable now that I understand what it means. Yep.

And I'll give you a practical example here. As we go into software inventory, first thing people need— we actually did this in Empath a month or two ago, Alex. You remember we did sort of a workshop. We did like a Miro board. We sort of broke down this whole process. That's what we're gonna do for this one. And you remember when we first started saying, well, where do you as an MSP get your software inventory from? And every hand goes up, the RMM. And you're like, great, absolutely. You'd be a mistake. It'd be a mistake not to have the RMM. And then we start saying, but aren't there things in your network and even your customers' networks that don't exist that RMM doesn't see?

How many printers get an RMM agent, right? How many of your network cameras get an RMM agent? How many of your switches and firewalls and wireless access points exist in your RMM? We used to get that at Lifecycle. People come to us and go, yeah, I know where all my assets live. I pull it out of my RMM. And then we start to ask those questions and it just all falls apart. And then crap, we don't have a good inventory. Right. And then you go, what are the things that get breached all the time? Well, it's not always a Windows device. A lot of times it's that, that weird edge device that nobody's looked at forever that had a vulnerability on it because it hasn't been patched since 1999. And, and that's the thing that gets breached and turned into some kind of a botnet. You know, these are the things that create problems for us because we haven't done an inventory. We forgot it existed and it was just laying there dormant on our network, waiting to get breached.

And That's right. And so what we'll see in this as we unpack it is what are some other sources. So we'll discover vulnerability management. If you're not doing some of that, you're going to be able to pull some information from that. You're going to be able to pull, pull some stuff from some of your cloud management, some of your cloud reporting, even like Office, your, your Microsoft 365 scores. There's a lot of places you can pull this from. And then what will naturally happen is MSPs will begin to say in the peer group, well, how do we put that together in a cohesive process? Let's talk about that, right? There isn't really, you anything out there that just magically does that. So we'll talk about how that works. And then what we're gonna do is we're gonna assign some homework out and we're gonna say, okay, so between now and the next meeting, here's what we're gonna do. If you guys have questions along the way, this is what we're here as a peer group, we're gonna self-solve these problems. I do not have all the answers, neither does Alex, neither does Barry McKinley, but together we will be able to dive into those challenges and find ways to get through this and really be committed to work through this.

And so, yeah. Well, we saw this when we did it with the peer group, or with the, the empath group, right? We had guys just jumping in with things and go, oh wow, yeah, I hadn't thought about that. Like, yep. Oh, and, and oh, there's a tool that helps with that. Okay, that's pretty interesting too. Um, didn't even know that thing existed. So, you know, there's a lot of that when you get 10, 12, 15 smart guys in a room, uh, everybody with a different background and a different view on things. You'll get to where this all of a sudden looks like it's manageable because all these different opinions help you create better processes and, you know, see things that you didn't see before.

Yep. The other thing I wanted to mention too, you may be listening today and be like, I got it. We're already doing this. Well, how many new folks did you onboard to your MSP? New employees do you have? Like maybe some new VCOs, maybe some new account managers, maybe somebody that's in a, you know, some kind of technical role but wants to learn security. This could be the perfect peer group for them. So, so I want everyone to know this is not necessarily just for the MSPs that have never touched CIS controls, never really dove deep into security. It's 100% for those folks., but it's also for folks that are matured and doing great in their journey, but they want to assign 2 or 3 folks to really learn security well. That's— this is for you too. And I really encourage you to think that because, I mean, Alex, the mission of what we're doing at Empath built into the deep ethos of what we have is this idea that if we're not constantly upskilling, constantly getting better at what we're doing, we're not constantly saying, this is where I want to grow into and this is where I want my employees to be, then we're going to stagnate. We're going to run into some trouble. And so Empath is about that and it's about you saying, I want to pick some folks that are already— that need to learn this journey and have them get into this peer group and learn.

And, you know, we're— we understand that if you're not upskilling, the bad guys are right. This, this industry is changing every single day. And the only thing that artificial intelligence and, and all the new tools are going to do is make it move faster.

Yeah.

99% of the AI companies that have turned up in the last 6 months are going to disappear. They're going to die, whatever. That's fine. But we have to pay attention to how fast it's going to help our industry, our industry as a whole move. Things are going to change and we're going to have to have new controls just to deal with AI.

Yeah.

Do we need a new policy that tells our users how to handle it? These are all things we'll talk about in a peer group where we talk about security and, you know, what these new technologies and just how fast the world is changing. What does that mean to your business? Does it mean you need to check things more often? Does it mean You need to update things more often. Well, probably. And we'll get a few smart opinions to kind of, kind of put that together. I'm going to make one last comment because one thing I hear every now and again, and it just annoys me, is folks who go, I don't need a framework. Like, what we've been doing works. And, you know, I love to give the example, like, what are you going to do when you're wrapped up in a breach and you're sitting in the courtroom because the insurance company decided they were going to sue your MSP and great, you got insurance, no problem. But you're going to go sit in the courtroom and somebody's attorney is going to say, Wes Spencer, where did you come up with the standard that you— standard of care that you applied to this customer? Where did you come up with the technology and the framework that you used to secure these guys? And Wes Spencer is going to go, oh, some bald guy on the internet gave it to me, shared in a Reddit thread, and that was what I decided to do. Right. And that lacks the defensible positioning that we want MSPs to have in 2024. I really want you to say we adopted a best practices standard that's adopted, that's accepted worldwide and comes from a nonprofit institution that this is all that they do. And we adopted that and started deploying it in the order they tell us to deploy it in, in the, in the implementation groups that they tell us to implement it in. And yes, my customer didn't make it all the way to IG3 because he didn't have $1 billion to spend. But we were following best practices and this is how we got here.

Yep.

That is the position that we want to see MSPs in in 2024. Yeah, because Ryan says it all the time, we have to assume breach. We know it's going to happen. We need to be defensible when we get there. And this is one of the steps to becoming a truly defensible cybersecurity company.

Yep, exactly right. Well said. And, you know, one of the things that comes out of this is when you commit to doing it, doing it right for yourself, you will build the expertise and the capability to then go to your clients and say, we're asking you to come do the very thing that we've done. We're not asking you to do something that we've never done before. We're not asking you to do something that we think is cutting edge. We're asking you to come follow us in best practice because your business will suffer great harm if you do not. And something bad is going to happen at some point. We're realists here. You know, we're not defeatists, but we need to be prepared for it. We need to put those things in place. And honestly, at the end of the day, if we're not doing these things, I don't need you pointing at me saying, how could you have let this happen? We need to put you in a defensible standard. You're not going to go to a doctor that's going to use an old school 1980s technology to treat your cancer, nor should you go with an MSP that's going to be, you know, using something that's ages old and way out of context for the threat landscape that we're in. So unfortunately, or I shouldn't say unfortunately, what comes with this is it's not free, right? We're not doing this for free. And the reason we're not doing it for free is because our time is valuable and we want you to have a commitment behind it. So what we've done is we've designed this in a way that's really awesome. It's not that expensive. It's $395 a month is what it is. I think we might be over the 10, but there might be one spot left. I don't know, at $295. But let's just— I think we're over the 10 now. So it's going to be $395 a month. That's going to make you committed. What's one of the best things you can do? Every MSP can afford this if they're saying, you know what, we're going to put the money behind it to force us to really be committed to this and we're going to see the results as we grow and we mature. And the second you sign up one client with a new security program, you know, you've gone through this, it's well worth the money, right?

So to say, just the project revenue alone to go deploy some of these new and updated standards that you're going to need will pay for this 10 times over. Yeah, we found this at Lifecycle when we were teaching folks how to do account management right. All of a sudden they went from, I'm only $2 million, I can't have a dedicated account manager, to MSPs coming to us and going, Well, you know, at $800,000 a year, it was a stretch to bring in an account manager, but he generated $300 grand his first year. He's really paying for himself. Um, and so this is one of those things where if you learn how to go have this conversation with your customer, the cash will generate itself. You just have to take the, take the plunge and get it done for the first couple of months while you can, you know, while you get, get your, get your ducks in a row and get out there and have that conversation. And again, turn yourself into customer number one. Deploy all of this at your MSP so that you can go talk to your customer about the journey that you're on to make your MSP a more secure, stable, reliable service provider and why they should come along for the ride with you.

Yep, exactly right. So I love that. This is what we're doing. So it's well worth the cost. What you get out of this is just no question. So if you want to see more next week, it starts next week. Yep. We kick off, I think, the 18th. QR code over there, if I can get my pointing right. So go check that out. Yeah, exactly. But the website is just bmkcommunity.com. CS Peer Team, or just Google, just jump on Google and search Barry McKinley Cybersecurity Peer Team. It'll come right up. This is the link to register, or just hit us up in the comments and we'll get you over to it. But love to see you there. Empath is very excited to be working with the Barry McKinley team on this, and just, we'll be joining in on those calls. We'll be talking and sharing with you. We'll be teaching. We'll be learning from you as well. Um, I no doubt, I've already seen some of the folks that have signed up and be like, I can't believe that person signed up. This is awesome. This person knows more than I do about this stuff.

It's going to be a good group.

Yeah. So I won't spoil those names. It's not for me to say, but some great people are in this and I want to see more people join in. We still have room for quite a few more spots. And heck, if we have to open up a second peer group to make this thing happen, we'll do that, right? That is totally, totally open for us. But I'm glad to see this happen. Thanks to Barry McKinley for taking the leadership and getting this thing going. And we'll see other peer groups really start to focus in security too. I think that'll be great. I'm glad to see this being the very first one and very excited to see what happens with it.

Awesome. I think that wraps us up, Wes. I think it's a great spot to end. So with that, I will see you next week.

Fantastic.

Yeah. All right. Be blessed.

Thanks, everyone. Take care.

Take care.