Above the Stack Ep 7: AI is Different Than Cybersecurity

Hey man, today's going to be awesome. Why don't you set the scene for us? We're changing gears. So if you're with us today for the first time or you've been with us, welcome to episode 7 of Above the Stack. We're actually switching gears today. You want to intro kind of what we're getting into?

Yeah. I mean, today we're really kicking things off with basically this scene here of, you know, talking about AI and how that's drastically, in a lot of cases, different than cybersecurity. There's going to be some similarities we talk through, where there's overlap today and how you're thinking about it. But I think the big thing here is if you're an MSP trying to go tackle AI, there's obviously, you know, a lot of daunting things with that. But one of the biggest things is if you try to tackle it with a cybersecurity playbook, let's just call it that, then I think you're going to run into a lot of complications that we'll unpack today and some of those considerations for conversations you're having with your clients, but also, you know, just kind of thinking about the future and positioning of that as well too. I don't know if, you know, if you have more to add to that too, Wes, but that's kind of my high level there.

I'm with you. I think it's a perfect high level because we really are just going to jump right into all the meat and all the good stuff. And it is different and it is similar, and we're going to talk about this today. We've also got a free giveaway for you too. I'm gonna just, um, oh, that episode giveaway is up there. You can scan that if you want to, but I'm going to take that away for now because I don't even know if that's the right link. Um, oh, it is the right link. But anyway, we'll get to that in a minute. Um, yeah, so just quick intros in case you don't know us. Wes Spencer, co-founder of Empath, and Nick Ross, co-founder of Cloud Capsule.

We're not here to talk about either of our companies today.

We just love helping MSPs in their growth. And welcome. The Above the Stack is really about how do we as a company really start to think about positioning. It's more than just our stack. It's, it's our people. It's our process as much as it is our technology. And so it's gonna be a ton of fun. So we are gonna have a free— I guess this one won't be an outcomes and pricing worksheet, but we are going— same QR code. We are gonna have a giveaway. We try to have a giveaway of every single episode. So stay tuned on that. Don't rush. You can scan it later. I'll have the QR up later. But just to kind of tease it out a little bit, one of the things—

Oh, may have lost Wes. Let's see here.

Have something to be able to share with our clients, which is going to be so great. So Nick, why don't you kind of get us onto the playing field here? Oops, I keep— sorry, I keep enabling and disabling. That's what I get being self-producer. As well. I clicked too many buttons. There we go. Why don't you get us in the playing field on how we're, how we're gonna get started today? Because I noticed something. I don't know about you, but when we talk about cybersecurity with our clients, how many times do their eyes glaze over and they cross their arms? How much is this going to cost? When is this going to stop? But it's not quite the same way with AI, is it?

No, not at all. And I, I think, you know, I've talked to certainly hundreds of MSPs now who, you know, are, are putting their hands up saying, well, hey Nick, you know, in all of my 20 years of business was quite put on LinkedIn today too, of, you know, hey, I've been doing this for years and not once has a client ever come to me proactively and said, what could I be doing better in cybersecurity?

Right.

And, you know, and that's kind of the broad statement here, but it's really just like, like you said, it's a very dry topic. It's very much like, you know, we're talking about insurance almost, right? Is in the sense of the dryness because you're saying, hey, we're going to prevent something from happening that hasn't happened yet. Or in worst cases, they've had a breach and they're going through a lot of pain and that doesn't feel good for them either. Versus AI now where there's, you know, there's shiny object syndrome, there's the, I, I feel like my business is going to be left behind if I don't, you know, start tapping into this today. And there's just a lot of, you know, excitement obviously around it too. And then there's a lot of, you know, hands-on keyboard with people using it actively today as well too. So there's a lot we're going to unpack against that, but certainly it's just a different conversation, you know, and a different conversation starter Whether or not you're in that today as an MSP is a question, but you should be. You know, it's something we'll be unpacking as well.

Yeah, exactly right. It's— there's plenty of similarities we can lean into, but it's the end of the day. I think you're right. It's— clients are interested in it. They're either threatened by it and they're scared of it, or they're like, I see it as an opportunity and I want to learn, or they're already using it. And the reality is they're already using it. We're going to just tease next month's guest. We've got John Harden joining us and Hardin's got the data, right? He'll bring the receipts. The receipts just show that your clients are already using it. I don't think that's a, I don't think that's a revelation to anyone. The question is, what are you doing about it? You know, because one of the things we say all the time is, oh, as an MSP, we want to be in the driver's seat. Well, sure. But then we enter into this conversation, the client's like, I'm already using it. I don't, I don't know what you're relevant here for. Now, obviously, some MSPs, like Brian checking in here, probably has, he's probably in touch with his people, his clients, and he knows how to talk to them about it. But I I think for a lot of us, we don't. And so they don't think to go to us. They don't think to be like, hey, Nick, tell me more about what this AI stuff is doing. And so what we're going to talk about today is the differences between cyber and AI, since we've been very heavy cyber-focused and will continue to be on Above the Stack. It's definitely a wheelhouse for Nick and I. But we thought what we'd talk about today is where the differences are, because I don't want you to think of AI as just another, like, add-on, just like we would do with cybersecurity. Right? Like, oh, you know, you used to have AV and now you need EDR. Now you need MFA. We gotta pop it in. Actually, those things are related to this. We'll talk about that. But what it's really about is not another checkbox. This is really, think of AI as a business tool that clients think they understand. And that really is what changes things because the reality is, is we'll unpack today, they probably don't fully understand it, do they? They probably don't fully understand the implications. They just want the benefits of it. And we need to be able to deliver on both.

Right. Well, and they've used, you know, they're using tools today, right? The GPT or Claude or, you know, Copilot, even if they're using Microsoft, maybe to a certain degree, but certainly more shadow AI probably than compliant AI within every organization. And I think to your point, you could, in all the engagements I've done for AI readiness with companies, you can always get executives to nod their head to say, well, you know, your employees are probably pasting some sensitive data into to, you know, a large language model that isn't managed right by the company? And it's always yes. And there's just— there's fear in that, um, certainly, but there's also that excitement layer of, you know, I'm getting all this great output, I'm able to do my job 10 times faster because of this, or I want to automate, you know, invoice processing, and that seems very exciting to me, so I'm going to go heads down and pursue it. And the key thing here is that it's getting easier and easier for the average user to be able to try to even go accomplish that. And what they're not going to be privy to is when it says, hey, give me your API secret or give me your credentials, you know, so I can authenticate and get in here. Then they're going to go, well, okay, let me go grab that, not think about any of the security consequences around that. And so this is kind of the positioning that you have to take. But to your point, you can't come in here and say, hey, this is an add-on product, you know, that we're going to start offering or, you know, not even have the conversation of it of, hey, how are you thinking about AI today? Right. I think that's just the most broad statement. That you can give, and you'll get a pulse on if they are fearful or if they're bullish and aggressive. Um, you know, usually top-down you can indicate how aggressive that company is going to be, you know, just universally. So I think there's, there's a lot there, you know, that is shiny object syndrome, right? If you see Copilot write an email for you, if you, you know, have Claude go write you a whole, you know, research paper, then you're just going to be in this mindset that I'm going to be heads first, um, you know, about that. But You also don't want as an MSP come in as this bottleneck, right, to those operations. And I think that's a key piece too. But where are some of the things that you're seeing, you know, like this I understand AI type of conversation, I guess, from your perspective?

Yeah. So a couple of things stand out. I love that you kind of got into that, like that, that conversation of just asking the client. Discovery, I think, is something that we just don't talk about enough in our industry. Good discovery questions will really help you lean into so much of this. And let me give you an example. My Perch days, I would jump jump on with an MSP, and, um, my first question to them would be like, hey, what does security look like to you? You know, what, what are you doing for security? I know it's a stupid question to ask, right, because it's so open-ended. And sometimes an MSP, like, what are you talking about? Like, that's such a high level. I'm like, no, just, just generically tell me what security looks like for you. I know it's a high level. And the reason I do that is because I want to give them any direction they want to go. And what I've learned over the years— if anyone's been watching me for a while, you know what I'm about to say— what I've learned is when an MSP would say, oh well, I'm using Meraki for this, and I'm using OpenDNS for that, and I'm using Sophos for All great tools. But when you refer to your security stack and strategy by your vendor names, I automatically know you're probably either lower maturity or less technical. That's totally fine. I'm just trying to get my audience. If I'm talking to somebody different and they're like, well, actually, we're working through CIS, we're about halfway through, you know, IG1 for identity management, we're doing this for endpoint management, we're looking like this, we've got policies and, you know, blah, blah, blah. Now I know I'm probably talking to a higher maturity MSP. And that question, that opening question, lets me put into the buckets the right direction. So this is what you were talking about too, the same thing. You should ask your clients, hey, what, what are you doing with AI today? What are your people doing? Are they in the middle of using it in any form or fashion? Like, tell me how that works. And again, the reason why that's so valuable, I think, is because you want to be in a situation where you know what they're interested in, you know what they're trying to do, what they're trying to solve for. And so those discovery questions at the very beginning are so valuable because, Nick, you might get anything back from like, well, I think AI is the devil and 666, right? And it'll take over the world, all the way to like, actually, we're using it in these really cool ways, can I show you? And it doesn't matter the answer you get, all of them are valuable so you understand how to speak. Um, what do you think about that, Nick?

Yeah, I think you could take it even a step further. Like, if you get all this aggregate data across your clients of, you know, well, how are they thinking about it, number one, but also how, you know, they're, they're, you know, what they want, right, the most, in the sense of like, I really want something that could automate our invoice processing, or, you know, use AI intelligence to do this type of research we have to do manually, or however they're thinking about. Could be just basic business stuff of getting enriched leads, right, or anything like that. And the more you hear about that, the more that you can try to package something, or you know where to spend your energies in a competency perspective and a marketing perspective of, well, how do I, how do I pitch this, you know, to my customer? And you can kind of go on the offensive in that regard as it relates to getting ahead of those conversations with those customers, positioning yourself as that advisor that can go and even have the conversation about it. And we'll get probably into, you know, some of the constraints that get around that as an MSP or some of the fears, like you need to be an AI expert or something like that. But just having the conversation doesn't, doesn't make you an AI expert, doesn't mean you have to be whatsoever. You're just hearing them out and understanding and expressing like, they might be well down the road, to your point, of implementing a ton of AI in their business that's created a ton of security risks that you haven't been privy to, right? If they've integrated it to their CRM data, all their customer data, they could have a breach and you're just coming into the fold of, oh, they've done all this stuff for the past 6 months. So I think it's, it's an interesting statement because they'll feel confident because they can chat really well with GPT, right? Or they can chat really well with Claude and they get a lot of great responses, but it doesn't mean, you know, that they can go in and say, "Hey, I can implement that with our existing tech stack or our existing infrastructure." That's where you as an expert can come in with your expertise of projects that would likely, you know, happen in that sense. But also thinking about, it's really all back to that large data set that you can get across your customers about what's working, what's not, What are they interested in? How can I position myself given our competencies? Those types of things as well.

Yep. Yep. Exactly right. And while you're dropping that knowledge bomb, I'm going to do this again just because I want to. I don't know if you noticed, and if you didn't, you held through. I was actually clicking through a couple of things and I mistakenly changed my camera to this one, this NVIDIA thing, and you see my eyes going crazy. So it's NVIDIA, whatever it's called, Broadcast, and I didn't mean to switch to it. It's got this eye tracking with AI and it's so creepy.

Look at it.

And I was like, what's it doing? Why is it doing that? I realized that's what it was.

Oh, I can't even see it on my side.

Oh, you can't? So like, I'm looking that way and it, it's, it's making me look at the camera. I don't know if it— anyway, let me change it off that. I was— oh, totally, totally messed me up there. Now I'm back to like normal Wes Spencer again. So sorry about that. Why I was smiling, um, not the knowledge bomb you're dropping, but the truth of, uh, me screwing up here. Um, yeah, so that kind of brings us back to, I think, where we— where I want to start a little bit is We do need to understand our playing ground, our level playing field. And so one of those things I think is important is let's just understand where the client is starting at today. Where they're starting at is, if I come in— how many times have we said this in cyber? If I come into a client like, "Let's talk about Zero Trust," they're like, "Shut up, nerd. I don't know what those words mean." If I come in and say, "You know, I think we need to talk about token theft," super true, but they don't know what that means. If I come in and I say, you know, let's talk about building an identity governance policy, they're like, I, I don't know what you're talking about, right? You might as well be speaking Greek. We've said this over and over. Now I get it. Some of you might have clients that actually get that because you've been educating them for a long direction and maybe they're CMMC and they have to care. They're a bank or something. I get that. But the majority of clients don't understand that stuff. And so we have for years had to come into a security discussion talking about risk, going above that level and saying, Here's the risk to the organization. Here's what we need to talk about. Here are the outcomes. Yeah, there's some stuff we got to do to make sure that we're at best practice levels or following good frameworks and compliance, all this stuff. But ultimately, I don't want to talk about that. I want to talk about the risk level. I want to be a risk manager. So that's where we're coming from. We've had years of this being drilled into us. But AI is different, right? Because anybody within seconds can just go right to Claude, can go right to GPT, whatever it is, right to Copilot. It's now enabled everywhere you see. And it's super quick sign-in and off we go. And they see the tangible benefits, right? In their minds, even if it's basics, right? Like emails being written super quickly. I can take a ton of data and push it into a consumable report. I can build images and do fun little things like that. Like they get that. They see the value out of it right away. And so I think the difference is this: with security, we have to educate first. With security, we have to warn them and talk to them about risks and dangers and get their input on things. Sometimes we scare them a little bit. Let's be honest, we still do that today, and we have to justify the cost. And that's the big one. We're constantly like, let's talk about how to build a budget for this. Let's talk about why, you know, what you spent last year may not be efficient and sufficient for today. But we go to AI, and they're already curious. They're probably already experimenting. They're probably already playing around with this. They're probably already thinking about it. They're probably already like, yeah, I'm using it in certain ways. And they're probably already open to a discussion of how can we do more? And so the posture difference is significant between both of these between AI and cyber?

Yeah, I've always put into kind of these 3 major buckets, right? If you reach out to your customers, probably get 1 of 3 responses, 1 of which is, you know, we're not doing anything today, but we're interested in getting started. They're excited about it. You know, the second of which is we've got a specific project in mind that we'd love some help on, or we don't know how to implement because we don't have the competency internally, or, you know, there's a lot of things that we would have to flesh out. The third is they've already done the project and they've never talked to you about it. Like we've been discussing here too, right? So it's a big piece of that. And I saw you put Brian's comment here in the chat there. I didn't get a chance to see it, but the legacy clients were resetting expectations with—

yeah, yeah. We were just talking about earlier when I was mentioning him, like Brian Weiss might not struggle with this. And he was just saying, yeah, maybe in the old days, but new clients much easier to set the expectation, right? Because as iTech, I'm sure, has matured. And I'm just bragging on him because he's a friend of mine. He's a great MSP owner. But like as they've matured, they're able to bring the right ICP of the right clients along and they're having the right conversations because they're talking to the right people, right? Yeah. So why don't you shift gears for us a little bit, Nick? And I'd love for you to talk a little bit more about how AI is actually similar, not just different only.

Yeah, I think there's obviously, you know, a little bit of overlap in some of the core frameworks when you think about this and still the things that you need to go and have competency around and implement. Implement, which is, I think first and foremost, you know, you still have project work, right, that you need to go in and facilitate with this. It's not something where you're going to turn on an AI agent and it's going to solve all their problems or fix their workflows or enrich their CRM and be good day one, right? In that sense, there's usually, you know, an assessment phase that you're doing to understand where they're at today. There's an implementation phase, and then there's ongoing optimization with this as well too. Like, because of the rate of change, there's actually quite a lot of, you know, breaking change that will happen, or in a couple of weeks your model will be outdated, right? And you have to have plans around that. So I think, you know, Project Works were definitely one. I think there's a secondary piece of it that inherently your data is going to be exposed, right? In a lot of these cases, if you're implementing any AI, you're often trying to maximize, you know, your data and data mining capabilities there. But you're inherently doing it probably insecure ways. I always remember at the last MSP I worked for, we let a client, you know, against our best advice there, implement Copilot. And within 3 days, you know, without actually doing any due diligence, just turning it on, you know, for every user, you know, a good amount of users. And within 3 days, you know, employee had chatted and found payroll data right within there. So it was just a classic, you know, that's a quintessential example, but it was real life. It actually happens in 3 days, right? And so you have to have this concept of when we go into this, it's kind of table stakes that we make sure your data is secure, right? And they get that. But if they— they're so blinded in most of these cases, uh, by the, the benefit, the end state, this business outcome that's really attractive to them, the antithesis to cybersecurity outcomes, right? We're just protecting you and we're reducing your risk. Um, in this sense, there's nothing really sexy about that other than like that seems like the right thing to do as a business owner. And there's a couple more, you know, that I'd call out in the sense of similarities is one is proving value, right? In the sense of, hey, we've taken you from here to here, you know, A to Z or A to X for now, you know, and then we'll get the Z later in this concept. And then ongoing management, right? Security is a continually moving attack surface for us that we have to continue to work at. And the same thing with AI, right? It's like we mentioned, changing all the time. We have to optimize it. We have to work with the changes in your business. We've got to do a lot of testing because it's often hallucinating still in some cases, or there's a lot there that we have to flesh out. So don't know what you think on those points or if you have other ones that you think of too.

Yeah, I think, you know, remember that we've all been taught, if you've been through any like Marketing 101 or like StoryBrand or anything like that, we've been taught the hero's journey. Right. And the idea behind the hero's journey, it's an old, like, 1970s book that someone wrote. And it's basically— and I forget who wrote it. I should remember because it's such a great book. But anyway, the idea behind it is, you know, here comes this adventurer who's in a life of normalcy. All of a sudden they're thrust into like some kind of external thing that forces them to go and leave what they've known to leave behind. They initially struggle, and while they struggle, they encounter a guide. The guide points them on the right way. The guide can't be the one to do it for them, has to point them on the right way. And then ultimately they have to go through this journey of fire before they see success. And then they go back to normalcy, right? It doesn't matter whether it's Star Wars, it doesn't matter whether it's Wuthering Heights, doesn't matter whether it's Little Women, doesn't matter whether it's Harry Potter. All stories follow this format. The vast majority do. And it's the same thing when it comes to all this AI enablement stuff that you— that's what made me think about is this idea that at the end of the day, I'm focused on my client and I have to realize I'm the sage that's coming in. Them, that they feel like all of a sudden this AI stuff has been dropped in front of them. All of a sudden things are different and they're hearing all this hyperbole of jobs being laid off, of new technology coming out left and right. Everyone's got a new AI something or other. And if you look at the, the, the varnish has really worn off in 2025 of all of these AI startups. I've talked to VCs about this all the time where VCs are just so interested in just shoving money at anyone who said anything about AI in 2025. In 2024 because it was the hot new thing. And now we've learned most of that stuff is just wrappers with GPT behind them. There's not really any real value and it's not doing things. So now a client has been like, dude, I've gone through this whirlwind of worry, of disruption, of hyperbole left and right. I need someone to just help me clear through the weeds of like what actually matters because I'm not— I'm not resistant to AI. My people are using it. And so our job is, to your point, is to walk into that client conversation, to be the sage, to be the Yoda, the Dumbledore, to be the whatever it is, and come in and say, let me help you get there. And part of that, as you said, was a whole bunch of things like what we want to do is I don't want to just come in and put the guard down. So you can't do any of this because you haven't done an MFA rollout, your conditional access isn't right, blah, blah, blah. That all might be true and probably is true. And I loved how you led with this example of like, we definitely want to let you have AI at your full fingertips. But before we do it, and I love how you get that use case of like payroll data all of a sudden being queryable by all, right? And that's something as a leader, you're like, wait, yeah, no, I can't do that. So the job is what you just said of here's the value it can provide. So to rewind this whole conversation, so why we start with the high level, what is, what are you doing with AI today? And then what we do is we take those use cases that they're seeing. We say, I wonder if there's some ways that we can help accelerate that, some ways we can help expand that, some ways that we can bring "Let's bring this better to market. But let's make sure we do it the right way so that Nick Ross's idea that was gold does not occur," or a number of other things. Now you're the sage. Now they're going to lean in and listen. So maybe just one question, though, because I know we have a technical audience that is listening today, Nick. What are some of— put your Microsoft— I know you're— I'm asking this out of the blue and unprepared, but what are some of the Microsoft configurations? What are, in the Copilot world, what are some of the things that need to be thought through by an MSP before they can really bring AI to market tangibly for their clients?

Yeah, no, it's timely. I mean, we talk about it a lot, so I can certainly speak to it. I've actually created recent videos on my YouTube with T-minus, you know, around this topic because it's just so important that you kind of have layers. But to that point, you don't be a bottleneck for the customer to say, hey, we need 6 months until you're able to even chat with a, you know, a bot here to converse with AI. So they're not going to be on board for that. But I think, you know, the big thing that we take a look at in the sense of like an AI readiness assessment, you know, it's very marketable. But it's also something where you can go in and in a lot of cases, especially for our market with SMB, there's a lot of data sprawl because there's never been a concept of a data governance officer, right? There's, there's not a role to fill there. So you have sprawl from legacy SMB file shares all the way to they've replicated that into SharePoint, never had really good governance behind it. They've got a lot of guest users that have been dormant for a long time. There's just so much risk, you know, already existing. And then to put an AI model on top of that, just, you know, compounds that pretty significantly and really quickly. Even thinking about if a user gets breached now is really interesting because if they have Copilot, that attacker could basically just, you know, chat with Copilot as like social engineering and peel back as much data as he can potentially find. So the speed at which they could do lateral movements, things like that, is quite significant. What we always say, though, from a technical sense is, you know, first and foremost, we're going to evaluate all of your, you know, your hardening controls as it relates to sharing settings, you know, kind of basically saying there's a stopgap we're going to create. Right here. And we're going to say that, you know, we're going to lock down all the sharing, you know, to approved workflows. And we're going to take an evaluation of all of your data repositories, mostly SharePoint, and start to look for over-permissioned, you know, scopes. And so that takes a look at who's all members, you know, what type of sharing permissions exist on that site, some of the legacy settings that can open up Copilot and allow them to index that. But you have natural capabilities now with a lot of the tooling that Microsoft's continuing to build on top of to go in and start to restrict some of the things that even, you know, we would say like don't index the finance site because we don't want data to show up from there as well too. So there's a lot, you know, it can seem very daunting, right? Because if anybody thinks about like how do I govern SharePoint, it's usually like, I, you know, I don't even know where to start in these situations. But I think it leads with, you know, a lot of those foundational governance layers. Like we always recommend that you get an AI usage policy, you know, that you get in with your customers that they can they can put out to the rest of their team that starts to put some guardrails in the organization and brings awareness to the employees around what they need to go and be cognizant of. But then also be really diligent about getting quick wins, right? If you can stand up a great chatbot for them that queries their HR data and is very secure, I think you can do that in a week, you know, depending on the organization, right? It's going to vary, but I've done it in weeks in a couple of different organizations and that's a quick win for them, you know, to get, get AI under their belt, prove yourself and your competency, build some trust, and then move on to the next piece of that. So there's obviously a lot, you know, that you can pack with all the various controls and settings that you'd want to see there. But in most cases, I think this is, you know, where I've done other talks before too of this is actually an inflection point where if they are coming to you and asking you about AI and they're excited about it, it reignites a security conversation for you naturally because you're saying, hey, if you want to get this business outcome of this HR chatbot, there's a couple of things we need to clean up and this is going to be part of the project scope. And this allows you to build not only like foundational competency back into security, but then you don't have to pull teeth on why this is so important, right? Because there's a business case that says this is why this is important. That's the linchpin to, you know, opening up your business back up again from a security perspective.

Yeah. And this is a tale as old as time, isn't it? This idea of, hey, Ms. Client, Mr. Client, if you want to do these things, these are the precursors, right? I'm dangling the carrot. And I'm using that motivation, right? Like let's— analogies are aplenty. Here's one. I want to redo my kitchen, right? So we start working on the kitchen and the builder comes back and pulls back this wall and says, hey look at all this mold behind the wall. Are you aware of that? No, I am not. We need to get that taken care of before we go build a kitchen. I can just go slap a beautiful kitchen on top. You still got the mold. No no no no no no no! We cannot have that. I know the danger of what mold does. Let's get that taken care of. Wow, I'm so glad you saw it. I wasn't planning on this. Honey, we gotta cancel the vacation that we had planned because we gotta get this mold treatment done, right? Same exact thing of the kitchen is dangling all of these things like that chatbot that you can, you know, what, what if we could bring all this to all of your employees can query this one thing and now all this internal exhaustless data that was hard to find, hard to see, hard to utilize, hard to operationalize is now just a chat away. I want that. I want that badly.

Great.

Let's do it. But I'll build a project plan to make this happen. So it's not going to query all the wrong things. There's some things that we've been talking about we got to get done, to your point. And all of a sudden now the client's like, OK, cool. I'm not excited about the money, but I'm excited about the output that the right things in place allow me to get there, right? And so that right there is, I think, one of the most exciting components of where cyber and AI are actually very well aligned is doing this in the right way. And so that's, I think, how we have to do it. We have to balance this line, I think, between, how do I get the client to understand, I need to do this the correct way, but I also am interested in doing it in a way that gives you the outcomes you're looking for. And we talk about this often of how can I give you what you want, and use that as the method to give you what I know you need at the same time. And so I think this is the key to really starting to operationalize that. I'd love to hear, for those that are listening— there's a whole bunch on— give us your comments. How does that look for you? How— and we'll show your comments on screen. I'd love to see how others are operationalizing this. What talks, talk tracks are you giving? What, what, what, what conversations are you having? What questions do you love to ask? And Nick, I think now is a good time for me to tease this. I'm going to bring this up real quick. We're going to give a link to this at the end. But I just want people I want people to see this. We are coming out with this right here for you, and this is all gonna be free as a component. Let me bring it up on screen. This is our, our client AI discussion guide, and we're not saying like this is 100% perfect and everything you need, but it will defeat the blank stage for you. So this is all gonna be in a Canva link, coming to you, and it's all just black and white so you can brand it up however you want. You can pretty it up. It's no, no branding, no nothing, no attribution back to us. Just happy to help. So it starts with some opening questions. Of, you know, what are you doing, how is, how are you using it today. And then it walks a client through a lot of what we're talking about today, how it is different, but how it, why it matters right now, why we've got to do something about it. Gets into a lot of the things we've already been talking about, how cyber is mostly invisible. It's these, one of these things where like the client doesn't really want to buy cyber, they want to buy the outcomes, right? But AI is visible. We can see what it does for us. We can see all the things it brings. And then it just walks you through a whole bunch of things. And one of my favorite things I want to land on, and we'll probably talk about this a little bit more, but how do we even start getting our clients to, to understand this. And, and we've got kind of this 4-step adoption plan where we at the MSP level, we've got to do some things first. We've got to secure some things for you. We got to get your identity management set up. We got to clean up the data. We can't have AI just walking through and resourcing everything in the dirty, messy house. We got to clean the house up. But you're responsible, Miss Client, for the guardrails. We need you to help us build and approve the policies and make sure you have insight into what tools we're using, what kind of data retention you need, and ultimately to help us find those use cases, right? Because we're not You. We don't always know. We're going to ask some questions and query your folks and see what they're using. But you're going to own that component of it, right? And this is something I think clients get really excited about, Nick, because they finally get to say, "Man, I'm excited to go down this journey in a way that gives us some measurable outcomes that does something different." So we're going to be giving that guide away here in just a minute.

Yeah, and I think, you know, the big piece is this, this shared responsibility model ultimately, right, of, you know, you have to own some of this. And we're obviously going to try to understand you know, the components of this as much as we can. And I think that's actually another good point of every engagement I've talked to an MSP around with AI readiness or, you know, going in and talking about AI projects or just generally speaking in the ones that I've done, you get to know their business so much more than you did before because you're targeting in on a very specific focus area that probably hasn't come up in conversation or tools that you didn't know that they had, right? Because they're isolated and they're not on the network or whatever it might be. And in these cases, like, you get, you get a much more intimate picture and you can open up the conversation to so much more that you already offer in that sense as well. So I think it's really important, but the latitude that they get around the excitement layer, right, lean into that, lean into their excitement and make sure that they understand that you're that trusted advisor then to guide them through that journey to make sure they're doing it without exposing themselves to a bunch of risk, you know, as they go down that path. And certainly like they might have some really outlandish ideas, right, that you can start to quell down of like setting expectations. You may not be an AI expert, but you can tell them like if they're saying, hey, you know, I want to aggregate all this data here and we want to have this machine learning model that's doing this and this large language model that's doing this, you can say, hey, well, that's probably going to be like a $50,000 infrastructure deployment, right? You know, just setting expectations for them as well. And that, you know, it's— I think if you don't start that conversation as an MSP, they will find it. Find somebody else that will have that conversation, right, that will come help them. In most cases, you'll butt heads with them because they're doing things insecurely, or they're going to be doing things in a silo that could, could lead to exposure back to the business that you're trying to protect.

Yep, that's right, that's right. Um, checking in on some comments. I love what Brian says here, you know, AI doesn't have the wisdom that humans tend to come with. It requires being trained with wisdom via guardrails, which which is exactly what you're just saying with proper data identity governance. Microsoft has this governance built in, and this is why, like, it's not that, like, Nick and I are, like, shilling Copilot. Like, it's not that. It's kind of what Brian is getting towards is that we're— MSP is already a Microsoft ecosystem. I mean, almost exclusively. And so Microsoft has done a great job of building not just the controls in and the capabilities in, but the, the, the need that what we have necessary to, to build the governance layer that's important, whether it's conditional access, you know, all those kinds of things. And so love that. And even just continuing this, right, they're 365 modern workplace migrations are a big push for us right now and cleaning up folder structures, aligning departments and roles along the way for proper AI readiness. And Nick, this is what, this is what we should be doing as MSPs, right?

Yeah, yeah, 100%. And certainly like we don't even use Copilot, right, internally. We use different AI tools, but we've gotten our house in order, you know, in the Microsoft side. We use Microsoft Purview tools and, you know, others to, to clean that up and put governance around it because No matter what, we don't want our data exposed. And naturally you can now create all these MCP integrations or natural hooks from an OAuth standpoint into these tools that are going to look at the same level of data, you know, that, that you have if you were to turn on Copilot. And so you're just, you know, putting those parameters around that. And I think there's certainly a lot of tools that you can get native in a Microsoft— to Brian's point there on the Purview add-ins now too, there's there's a ton of discovery tools in that that you can actually leverage to then say, hey client, this is where your risk is. I, I do that in those engagements and I can always show there's a bunch of PII exposed in users' OneDrives. There are SharePoint sites that are totally open to indexing from Copilot or being just shared publicly to the internet, right, with a public anyone link. And so it doesn't have to be a ton of data that you bring to the table. It's just a few things that invoke like, oh, this is actually a problem. Like if any of this got released, like that would actually cause us some pain. And you're not fearmongering at that point. That's, that's the reality of what they, they have in their ecosystem. But just a quick little checkup, like, hey, if you want this, you know, AI automation bot, then, you know, these are the things that are exposed, and that's why we got to clean it up. And it's a quick— every time I've done it, every conversation I've had or been on a call with an MSP, it's like a one-liner, which used to be— before, you'd be like talking about, you know, credential stuffing and why MFA is so important My users are complaining because they have to set up this authenticator app, right? And it's like, now this is like, again, a very streamlined conversation. I'll say it's always easy because you still got to deal with a bunch of friction from client-specific use cases, but it certainly is, is a, you know, an inflection point, you know, like I was mentioning earlier.

Yep, and exactly right. Um, oh, by the way, I did put the guide— there it is, the guide right up there. So if anyone wants to grab that guide, we're just going to leave that up here What that will do is it'll take you to a page. Just sign up to the, above the stack, just pop your email in, and then later today or tomorrow, our teams will be emailing that guide out. So again, free guide for you, all usable in any way that you wish. Don't have to attribute any of it to us. It's all just black and white. So you can customize it however you want in Canva. So there's the, get guide. I'll leave that up. So yeah, just going back to kind of what you said, I think That's the direction, right? And if you look at this evolution of where we've gone as MSP, you know, I've been in this world since 2016, so not as long as many others, but one of the things that I've learned is that we've been down this journey and been going down this journey that we're continuing to customize. I think the MSP days of old where we were being asked to just commoditize and everything comes in as all-in seat price and it never changes off that and project revenue is bad. And, you know, I'm not hating on the old thing. The old thing still has value. But what we've seen is good MSPs are today coming in again above the stack, to steal from our show, but they're coming in being able to solve business problems. What does that mean? Well, it means that we're coming in today much more like a consultant walking into a conversation saying, tell me what we're trying to solve for. Tell me what's mission imperative. Tell me where we're trying to go as a company and then bringing to bear the resources and the needs to be able to make that happen. And this is the evolution of what an MSP of the future is doing, because it does come down to still wrapped around all-in-seat price for sure. But it also comes into project revenue. It also comes into solving some of these problems. And this is where we get the lock on the client where they never want to leave us because they know the MSP is not just here keeping my Microsoft licenses around. They're also here keeping me involved with everything that I need to be able to be successful into the future of where we're trying to go, whether that's AI that's pushing it or something that's different.

Right.

And I love that. I love it. So that kind of gets us into, I don't know what direction you want to take it from here, Nick, but I think a good maybe shift in this conversation in the last, you know, 20 minutes that we have left today is let's talk about the client and the client ROI side. How do we, how does AI start to introduce in where clients can visibly, tangibly see value in what AI can bring to them?

Yeah, I mean, I think, you know, to that point, point, um, a lot of MSPs are, are creating this bridge right now, right? It's, it's saying, hey, we're not going to be, you know, 100% just AI company tomorrow, and we're going to start to help our clients with this, but there's things that we can begin to do today to make sure we're prepared for that. First and foremost, it's having those, those conversations, right, to our point earlier about just like, where are you at today gathering a bunch of data? Um, you know, some of the most progressive MSPs that I talk to are reorganizing their hierarchy. They're making new scaling tracks, right, for their technicians and other employees to then move up into a different focus area, like, you know, technicians moving into more robotic operations center types of roles and automation capabilities and things like that that can really fold into some of these, you know, these components. But as far as, you know, some of the— some of those business use cases, you know, and I think think, you know, showcasing value and things like that. I think it can be as easy as, you know, getting them plugged into, um, you know, a basic check workflow, you know, that they have that's approved, it's compliant within the organization, that starts to provide that value, right? Usually when I go in, you know, you can usually ask like, what are, what are some departments that have really highly intensive admin work? And that's usually a good place to start because you can either automate some of that, but you can also start to show them the power of our AI, that's not very high complexity. We're talking about things like some of the ones I've done in the past is we automated, you know, whenever a loan was filled out and came in, there was an AI agent that had a, you know, system prompt that reviewed it against known knowledge base and criteria and made an approval or rejection recommendation. This was taking somebody internally 30 minutes every application. They got 20 a week. They saved that amount of time, right, by doing that and getting this pushed over. Humans still reviewed it, not auto-deploying anything that's AI-generated out to our customers. But it was a way for them to, you know, provide value, you know, integrated the tooling that was native in Microsoft without having to buy additional tooling. That was another big key is like, we're not going to try to throw down a bunch of tools into your tool belt like N8n and, you know, all these very, you know, flashy AI tools. And certainly clients will probably come to you with that, right, as well too. And you need to have your proper vetting process for those and understand if that's the best solution or, you know, if it exposes data. Like, a lot of these AI tools use legacy protocols. They use insecure credential practices. Like, there's a lot there that you can then provide, you know, that layer of guidance around, too. So there's a lot of different ways. I'd love to hear from your perspective, too, and talking with MSPs, kind of what you're seeing out and what's working well.

Yeah, well, we— there's been a bajillion downloads of that QR, which is super cool. So go grab that if you're just joining us. This is a free guide. I actually want to bring it back back up because it kind of follows along with that. One of the things that we've got that's here on slide 6 is, is when you're talking to your clients, you do also want to kind of give them some thoughts around, um, what this does for us, what it could do. And so I would start with even some of the basics with your clients, like, hey, are you seeing that people are already using it to draft up emails and documents? Yeah, we totally are. Like, I've talked to a bunch of people and like, I, I know that they're using it to speed things up. Man, that's really great. You know, I want to make sure— again, it goes back in that conversation of like, let's, let's talk about doing that more, but let's also make sure that what we're having it summarize and do is, is private to us and make sure we're structuring that in the right way, right? Or like, you may have note-takers. Many of us have these online note-takers like Fireflies and Phantom and all these others that are out there. Um, really great, right? We can take all of that and we can produce that into some kind of summarization that lets us see a little bit more of the forest through the trees, right? We can let it help us produce produce proposals and reports. It can take tons of data, market data, external data, client data, internal data from us, and easily push that into one medium or the next. I use this all the time. I'll take, for example, Nick and I, and we game plan what we want to talk about. We have everything we say is, is recorded into transcripts. So now all of the knowledge that's in my brain and in Nick's brain gets turned into, from transcripts into a methodical discussion. Where do you think we got all these ideas from. We didn't just say, ChatGPT, build this. We go and we talk together on this, and then we use that, and then we have it turn that into things like what you're looking at today. I said, take all this and produce it into some slides that we can use that are client-facing. Take all this and turn it into a proposal. It doesn't mean that it's perfect out of the gate, but it defeats the blank page first, and it uses prior knowledge, like what Brian said earlier, when— if I bring up that quote that he had, it was somewhere over here. There. It doesn't have the wisdom that we have. So we give it the wisdom layer and then we can have it transmedium across whatever format, whatever purpose we need. So helping them understand this, searching internal knowledge, we mentioned this already. How awesome is that when you can come to a client and say, "We build this chatbot. Now imagine newly onboarded folks can quickly at their fingertips get everything they need. People who've been around forever can discover those things." Right? So this is stuff that's already here today, man. Missed Client. Some of this your teams are already doing; some of this they may not be doing. And we want to, we want to help them bring this in. And then what you really need to do is think about this slide right here, this tangible ROI. So how do we start to think about the benefits that we can, we can measure? And I don't know about you, Nick, but like, I think we should be accountable to these kinds of things. I think we should be accountable to, you know, all of these things, like how many hours a week have we saved? And some of this might be a little bit more soft metric. We just say, hey, we know that normally this thing takes this long, but now this process and we can just sort of do the math in our heads. But others, I think we can actually kind of write in and dive in deeper. So let me pause and ask you this question, Nick, because I'm curious what you think about all this. Do you find that MSPs are actually able to calculate tangible ROIs with their clients today, or is a lot of this just sort of like soft pie-in-the-sky kind of stuff at the moment?

I think, I think the latter, but I think, you know, where you want to achieve is, is the former in the sense that, you know, a lot of these things, and especially with AI right now, there's so much hype and excitement and there's so many flashy tools that can do these really cool things that ultimately might not provide next to zero business value, right, for you in general. Or you might end up spending more time trying to build it than you would if you just did the task yourself and, you know, just kept doing it in that sense, because it's not going to impact your major levers. I always think about this at the macro view of the company layer of like, whatever— what does every company want to do? Like, what they want to get more customers, They want to get more revenue. They want to decrease churn. They want to increase retention. They want to get more demos. Like there's these high-level, you know, concepts that any business can, can relate to that you could also play around that you can quantify really quickly. Because if you can't, then you're just kind of sitting there and, and basically creating AI that could create some really cool text. But if it's not moving the needle on your demo booking rate or your sales or your customer success numbers, then what are you actually spending all this time and effort into? And I think that that's where I even have to check myself, right? Because I, I get enthralled by, you know, the technology and how much we're doing with that. But there's a point of which you're saying, okay, well, how are we going to actually measure that? So having that predefined upfront and understanding the scope, right? Because some customers will come to you and say this is a massive problem, and then you quantify it and you realize it's maybe a couple 'Like compared to this thing over here that Tim's doing by himself and he's spending 50 hours a week and he's not getting his real job done because he's wearing 6 hats, right?' So you find these things and then I think that's where you can actually present them back to the business and they'll really love that. And that's to your point earlier of how the MSP is kind of evolving into this business consultant. And I think there's a lot of people that are trying to grow competencies, like I mentioned, around automation obviously, but also just, you know, a business process analyst or operations analyst. Optimization, you know, concept of I can go in here to any department, I can take a look at where there's, there's a lot of waste, um, not employee-wise but just time spent, and I can go in and optimize that. And that probably in a lot of cases doesn't even require our AI to use, right? It's just like you can come in and just clean up a process. And so there's layers to what recommendations you give, but it all provides value back to them, and you can, you can quantify all that as well.

Yeah, that's right. And this is why I'm going to go tease John Harden for our next event. This is where I'm really excited to bring John in because John has spent a ton of time— if you don't know John Harden, over at SASLIO, then got acquired by Aviq, and he's now kind of building some things on his own. And John's been really deep into that exact same conversation. And one of the things I think we're going to end up talking about is how do we— and I'm going to tease just enough of this, John talks about how do we build even like a steering committee? How do we start embedding ourselves with our clients and start discovering the use cases and how they're using it? What you'll discover, he'll say, are things like a lot of times the people are using AI the most are not the highest on the totem pole, you know, on the org chart. They're people that are maybe at mid-level or even entry-level, and they're using, finding new ways to automate, speed up what they're doing. Those are the people we seize into. Because I don't believe that AI is here to to take the job. I think KI is here to make us be able to do more than we've ever done before. And if we're not locking into those efficiency gains, if we're not locking into all of those new things that it brings to bear, what are we— how are we going to survive in the future? And that's where a bit where the fear comes from, but it should be a positive fear of like, I have a lot of opportunity, I got to lean into it. Well, I don't know how to lean into it as an MSP until I lean into the client themselves. And so John's going to talk about that. We'll talk about how to build a bit of a steering committee and how you should share that with the client. And these are just normal VCs. VCIO motions, by the way. If I were a VCIO at my, at my company, I'm sorry, if I were a CIO at my company, you better believe this is mission imperative. You better believe that I'm going to have a steering committee and I'm going to have all departments represented and I'm going to be hearing from the rest of the company how we're using AI. And then I'm going to report that upward to the board of this is what we're doing today. This is where I think we should be leaning into. These are some of the efficiency gains I think we can get. These are some of the budgets I need to make this happen. But what board is not going to say yes to all of that? And so that's the kind of thing that I think MSPs need to be doing in their VCIO function, is starting to get into those. And so that's why I'm really excited to bring John on as a guest so we can start talking more through that.

Yeah, and I think to that point, um, it's also just reflecting on your own MSP, right? And what does your culture look like around AI, and, and how are you guys using it internally as well too? Because I think I think that that kind of dictates, you know, the conversations you're going to end up having with the client and your own, you know, learning curve around it as well too. So it's, um, it's a big piece of that as well. But, uh, see, yeah, Brian put in here, AI discussions high level with clients. AI is designed to help eliminate human error and human hours, and we dig into areas where hours are wasted and error is introduced. Yeah, uh, so yeah, just echoing that, um, in the sense that, you know, there's, there is a lot of potential waste, but there's a lot of potential savings, you know, that we can get as well too. That, and then you just feed those ROI data points back, and that's going to reinforce like, oh, we're progressing in this way, just like you would with the natural cybersecurity piece. But their eyes aren't going to be like glazing over, you know, in the sense of, well, I don't really care, you know, about this. I'm glad you did it, you got us to this level, you know, we have this risk reduced, versus, oh wow, we just saved 50 hours a month because you know, we automated this workflow or we introduced AI to do this for us and things like that. So I, yeah, I'm excited to have John on as well too. I've been tuning into his podcast every once in a while, like his Coffee Talk podcast. You know, he's had some great guests on there too. So.

Yep, that's right. So one more thing I want to bring up from that client discussion guide and the QR is right there. So anyone wants it, grab it. We'll send it to you. Just got to pop in your email and we'll know to email it to you. This right here. I want to start— I want to kind of wrap up the last few minutes with this, Nick, of at the end of the day, what you should be talking to your client about as you're working through all of this. We need to shift into, hey, here's some starting points for us, right? So we want to make sure— and this is what I would embed into my BCIO motion. I would say, as an owner, I want to see this from every client that we're doing technology strategy for, which ideally, hopefully, is every client, right? I want to know, I want you to come back, Ms. BCIO, Mr. BCIO, when you meet the client, identify where AI is already being used, approved or not. There's a lot of ways you can do this, right? If you're using SaaS management tools, you can find out who's using it. But more than that, I would just go query because almost everyone's using it. I mean, that's just a fact of the matter. So I would start there. What are you using it for? That's awesome. That's super cool. I'm going to document that. Wow, how neat. I would then from all of that data choose 3 to 5 practical use cases and I would present those to the client to say, how do we start piloting these? We have some ideas, but which are most interesting? To you. Then I would also have a plan that comes back with them to say, these are some of the things we need to do to operationalize and standardize this. These are some of the guardrails that we want to put in place. And then I would say, hey, how does it sound to you, Ms. Client, if we can measure ROI in this way? I'm not saying we're going to get there, right? This is all new. It's new for you, new for us. But we want to start making sure we tackle this from an ROI perspective. So what if we could shift our— I'm just going to use something totally What, what if we could shift our marketing engine to be AI-driven and the content for our newsletters, the content for our blogs, the content for our client outreach, the content for our cold calling is driven mainly by what we're doing from an AI perspective. Man, that's great. What an awesome idea, right? There's so many ways that you can tackle this. But I would just find something that the client believes is already in use today. And then how do we scale it up? How do we put the guardrails around it? How do we measure it successfully? Success. Doesn't have to be, we're trying to eat the elephant altogether in one, one fell swoop. It doesn't have to necessarily be that. But what it needs to be is some type of easy ROI, easy win, easy sort of like addiction moment to the client that says, "That was great. Let's continue that." So again, it's not hitting a grand slam out of nowhere. It's just enough to get the client to say, "That was a worthy investment, worthy use of my time. I can't wait till you come back in next time. Help us go down this journey of transformation." There's nothing wrong with an AI transformation journey, Nick, taking taking, I don't know, weeks— I'm sorry, I'm sorry, months and years.

But days, hours, days.

Buy my tool, you'll have it in an hour. Yeah, $9 AI readiness.

Yeah, well, I think it's like, like you said, the number of, of, uh, you know, quick wins, you know, that you can share, that there's progress. That's the other, you know, thing that they get out of that is like this feeling, this dopamine hit, every time you say, hey, we did the next one, we did the next 'Next one,' and not trying to package this thing up into a 6-month-long AI project where the first 4 months we're going to be applying sensitivity labels to all your documents because we're overly paranoid about, you know, how things get exposed. Like, not to be naive with security, but you've got to isolate things out and give them those wins and, and reduce scope where you need to, and then do the POCs where they say, 'Oh well, maybe that's not worth our pursuit,' right? And that's that's just as worth you scoping that down as to, you know, you do an 8-month project and then they say, well, just, I don't think this is going to work out for us, right? Because it's just classic scoping, it's classic product even, you know, from a dev perspective, um, as far as this goes too. But I, yeah, I think we all have to be patient because it's going to progress, you know, at a pace faster than all of us can even keep up with individually. But as a collective group of MSPs, would love to see, you know, the collaboration around what's working well with customers, what are you hearing the most? You know, is there workflows that are repeatable that we can begin to think about as a group and, you know, really kneel down to go out and one, I mean, it's just like a rising tide type of motion, right? You're going to help the client, you're going to help yourselves, you're going to get your own competencies aligned, and then we can develop more in the future as well.

Yeah, you nailed it. And what a great way to exit today's discussion. Shane is the boss today. I love this. Um, AI has reinvigorated my passion for this industry. Conversations on cyber readiness, which once felt mundane, have evolved into AI readiness discussions that are far more engaging and energizing. Bam! Drop the mic. 1000% true. If this is not getting you to be more excited than ever before, what do you even do in this industry, right? Go be a bookkeeper somewhere. Go get into insurance actuary because I don't know what to tell you. Brian is 1,000% right. This is really, it's so much fun. It's introduced this unlock for us that really makes all the stuff we know we needed to do for the client much more palatable to doing it the right way for the right reasons. Absolutely love that. So I want to invite, I know we're out of time here. Here's the bingo, but make sure you guys come and join. There's the QR. Next month, this is gonna be March 11th. Sorry, it's got to pull that, but March 11th, 11th at 1 PM. We've got John Harden joining us. It's gonna be so great. He's gonna be talking about this AI client engagement model, who's doing this right, what it should be looking like. So he's gonna help us expand on what we've introduced today. This is gonna be a lot of fun. We actually have multiple episodes planned around talking about AI enablement, going above the stack. So John's gonna be our first guest on today, or next month, March 11th. Make sure you QR that so you have that scheduled and just follow our social media at Empath, Cloud Capsule Empath— I'm sorry, Cloud Capsule social media. And you'll see all of this. And really, really hope this has helped you today. Make sure you grab that guide up above. It says, "Get the AI guide." That will give you access to all the things we've talked about today so you can start these conversations with your clients. Nick, take us out. Any other final moments you want to— any final things you want to say?

No, excited to have, have John on next week and, you know, really dive dive into it. But, uh, this was a great conversation. I love, love talking about this. I echo Brian completely there. I've, I've personally even, you know, just running, running Cloud Capsule with our team, you know, we're very AI first, but we're doing it very securely. And, you know, it is very exciting, you know, to come to work every day and have like excitement around what's possible in that sense. So appreciate everybody who joined, and, and thank you guys for commenting and enjoying and having some time with us here today too.

Nick, thank you so much, and I will be in touch. Thanks, y'all.