Above the Stack: Episode One - Nobody Cares About Your Tools

What's going on, Nick Ross? How's life, my brother?

It's going great, man. Just, uh, just got back from Exchange. Didn't have to travel far, is out here in Denver, but it's good to see everybody in person as always.

Heck yeah, heck yeah, dude. I totally agree. Um, how was Exchange? Good time?

It was really good. Yeah, I think, you know, we had a lot of great conversations and, um, you know, it was just a larger crowd. Obviously, uh, we talked a lot about security. So it was great to kind of preface before this call today too.

Yeah, fantastic. Awesome. Well, to everyone watching, man, it's great to see you all on. Thanks for joining today. This is episode 1 of Above the Stack. I am absolutely purely delighted to be jumping into this with my buddy Nick. This is going to be so much fun. And man, I'm just seeing all the people flood in. Let's highlight some people here. So got Dean Trimpelis checking in. It's good to see you, brother. Alex Farling checking in. Good to see you as well, Mary. So this is all livestreamed out to LinkedIn and to YouTube. So if you're watching there, or I think we're trying to get it into the Empath app as well. So if you're there, hey there as well. Glad to see you. Why don't we do some intros as we get started, Nick? I thought we would just kind of jump into like who we are and what the mission is for Above the Stack and what we're really going to be talking about throughout this entire series. And I'll tell you, Nick, I don't know about you, but we're kind of learning as we go— we're going here and we have a lot of plans for taking this in the direction that y'all want to go. So welcome to Above the Stack. Nick, you want to do kind of an intro of who the heck you are and what you're all about?

Yeah, absolutely. We are, as Dean is calling out, maybe not in space, but you never know. You could have created this artificially here. But yeah, I'm Nick. I'm the CEO and founder, co-founder of Cloud Capsule, which is an automated assessment tool for Microsoft 365. Most people know me, though, from my YouTube channel, which is T-365, which is all about Microsoft Education for MSPs. I've been doing that for close to 8 years now. But my jam's all about education, all about enablement, and just, you know, kind of getting the good word out there about what's possible. So I'm excited to hop into this, too. Got definite passion around the security space and just kind of thinking about things as we move into different eras, right, between AI and the things that are coming down the pipe.

Yeah, man, I love that. Well, thanks for being my co-host today and through this series. Couldn't have picked a better person and a better expert. So, and just Nick, I appreciate all you've done. Those of y'all don't follow not just Cloud Capsule, but everything also that Nick does on his YouTube channel. I run into MSPs all the time like, I know Nick, I've never met him, but like, I watch all his stuff and Man, givers are the ones that win in this world. So I really appreciate that about you. Hey, I'm Wes Spencer. I am one of the co-founders of Empath. Really glad to be with you. I'm a cyber nerd at heart. Been helping in that journey, especially in cyber strategy for years, and love helping MSPs in that journey. It's tricky. It's hard. And as Nick knows, you know, the only way the SMB sector is made secure is by MSPs. Hard stop. And I'm passionate about that. I love the fact that as an MSP, you have so much opportunity in front of you, but the challenge is difficult. And so, you know, Nick and I feel like it's our job to help with that and really to kind of bring you above the stack, so to speak. We kind of were joking around with our promo of like, no one cares about your stack, bro. But really, it's really about is jumping deeper into that. And so, Nick, you know, what are the things you're most excited about this series? What gets you the most juiced up?

Yeah, I mean, there's definitely a ton of things here. I think, you know, one of the big shifts that I feel like I'm seeing in the space and talking with a lot of MSPs as well too is just kind of moving in from some of these more what we're seeing today as support-driven, commodity-driven services into very much, you know, specialization in some, in some respects, but also thinking about, you know, kind of your progression into value-based services. And I think largely that speaks to, you know, the whole title of our series here, which is Moving Above Your Stack. You know, when you ask an MSP, what does your client engagement model look like as an example? You start leading with, well, we sell RMM and we use Ninja to do this and we fulfill these services using this tool. It really, you know, speaks to, hey, you know, we could reframe this and you'd be seen as more of a trusted advisor for the businesses that you work with versus maybe an IT vendor, right, in that case as well too. So excited to share more about that messaging and just kind of unpack what that means, right, and practice in actually using that. That's not super overwhelming, you know, to consume and starting to break things down that are a little bit more complex in nature, like the CIS controls as an example, to something practical you could take away from these calls and start to put into use right now versus thinking about everything you have to navigate to do that.

Yep, yep. Well said. Well said. And I am excited about that. You know, we're going to do some really cool things throughout this show.

We'll—

we will also talk about, you know, new and emerging security news. If there's ever questions that the audience has, reach out to to us. You got both of our emails there, both of our LinkedIn's there. Happy to bring the audience into these discussions and really kind of go in the direction that y'all want us to go. That's really, I think, what we're most excited about. And so, Nick, to start, I think today we're going to do a Control of the Month. And this is something that we've talked about, CIS Controls, many of us have for quite some time. I would say most of our audience is probably pretty well aware of the CIS Controls, but we're going to flip this a little bit and we're going to do this from a Microsoft perspective, especially when it comes to Microsoft 365. And so our control of of the, of the month is of course Control 1, right? Because Nick, this is where we always start, right?

Yep. Yeah. And this is, you know, the thing I love about the CIS Controls is that they're a natural progression, you know, for you to start to be able to consume things. They still in some cases are a little bit vague, but that's what I hope to achieve in this series is kind of breaking this down with you about what is the MSP lens, right, of this and, and how can you think about this with very much, you know, what we're using today from our Microsoft stack that we have in our ecosystem, but really focusing more on the business outcomes and business drivers as part of that, because that's just one lens, right, that we're talking about. But thinking about this as being kind of a base layer when we start to think about talking to our customers about their security and everything that's involved with that as well, too. So on the Microsoft front, you know, and just the things that you're doing within the CIS controls there, there's a lot of use cases I see where we're kind of— MSPs are getting hung up in thinking about the proliferation of all of their assets. I'm not sure if you're seeing that, but love to hear your thoughts too, just on, you know, commonly where you see people try to start here and then fumble immediately and then don't move on to the next controls.

100%, right? Like there's so much to say about that. You know, I'd say perfection is, is is the enemy of, um, of good, right? And I'm constantly encouraging MSPs all the time to just understand, like, look, get started. Analysis paralysis is a real thing, and if you're not careful about it, you, you dabble into a little bit of this, you realize just how difficult it is, you realize how far behind you are where you want to be, and you throw your hands up and you say, I'll come back at another time. And, and I, I just want to encourage all of you today that that's a normal thing. It's normal to feel like that. And it's— when you put one step forward and then you put another step forward, what you notice is the iterations start to get things better and you start to move forward. And so we're going to talk about that today. We're going to give you easy steps and easy ways to get forward. And because, Nick, you're right, the proliferation is more present than ever before and it's not going away. And I think that's a wonderful thing. Like, let's not shy away from that. That makes you more relevant as an MSP. Nick, what do we hear MSPs say all the time? They want to be regulated because of all the time and attention they put in to hone their craft. They want to have some amount of protection from ankle biters that come in and just undercut the market. They want to be relevant in front of clients more than ever before. Well, ta-da! You're getting your wish. All of these things that have come in front of us with a cloud-first movement, with AI driven into so much of what we're doing, with cyber embedded and required in where we're going, cyber insurance driving it. Those are all things that answer those 3 calls that MSPs have been asking for for quite some time. So, so I love that. And Nick, where I wanted to get started with today is this. Oops, this right here. I wanted to do just a quick poll to the audience so that QR code right there will take you to this Canva link. So you get 2 things out of that QR code. First thing you get is that QR code is going to give you access to all our slides today and we'll constantly do this. So you're going to always have a downloadable copy of the slides so you can get to them. You can share them out to your team. You can you do whatever the heck you want with them. But also use that QR code and head over to this slide that we're on right now today, because that's going to let you vote. And what we want to know is how many folks are using the CIS Controls today. So this will probably take a minute, so we may come back to this in a minute because people have to load this up. But, but Nick, my experience here is that— and I'm curious what you think too— is that most MSPs have got— they're either aware of CIS Controls, they've dabbled a little bit, they've started to work through them. What's your experience?

Yeah, I mean, I think a lot of people are trying to gravitate towards the CIS Controls as a North Star, and I think that that's, that's great because we do need a North Star beyond some internal checklist that we're trying to maintain that isn't governed, doesn't have the oversight, you know, that you normally would want to have. But additionally, from just even zooming out on a macro perspective, it also helps us attract larger customers, right? Because we're aligning to these frameworks that they are speaking to as well. And it gives us a way in which we can communicate where we're at and where we need to progress to. So it's a gap analysis tool in some ways for us to be able to articulate to clients about their continuous improvement journey in security. But in most cases, what I see is kind of what I was mentioning before, where we have a lot of aspiration. You know, to go into these services, but we don't feel like there's enough enablement material for us to get going. And some things are a little bit vague, but we also have the fact that every client's a little bit different, right? And trying to pair this out is really, you know, hard to do as well too.

Yep, yep, it is. It absolutely is. And so again, all the more reason why we're gonna be jumping into all of this. And so Nick, I want you to kind of take it away for a good portion of this segment. I want you to start talking to us if you would, about inventory, especially in Microsoft 365 and Azure, because I think a lot of us have gotten better at understanding how to do like on-prem inventory. You know, I might start with what my RMM sees, I might start with vulnerability scanning data, and I have some amount of a local source of truth that it's an easier starting point. But boy, we get confused and we get, we get really tripped up when it comes to Microsoft 365, don't we? So walk me through some of this, if you would.

Well, I'd say, you know, to start off here, Microsoft doesn't make it easy in the sense that, you know, when we talk about the various different suite offerings, right, that they have against the identity layer with Entra and that asset as a whole versus MDM, you know, versus EDR with Defender as an example, that's actually a different GUID, right, on the back end with Microsoft. So they don't necessarily correlate to each other. You know, in the admin portals that you're experiencing that. So a lot of people get hung up there too because it's counterintuitive to what we would be thinking. But when we see this, you know, I like to focus in on this as well just because traditionally, you know, we've had this network perimeter, you know, that we're using to gate access, and now we're moving to zero trust and more of this workflow. And more and more lately, even secure network access through access through VPNs, as an example, is being, you know, exploited quite significantly. If we think about the recent attacks on, you know, SonicWall and Fortinet VPNs as an example, there's a lot that we're looking at there. And there's a big focus shifting into— that it always has been, but I think it's more so now that we're seeing more of these attacks— into, well, you need to isolate the user and the device, you know, and we need to basically protect them because Users are working remotely, they're working all over the world, and we need to make sure that they're secure on these access points here. And why I think, you know, the focus should shift from inventory living in RMM to more so inventory living in Microsoft is because that's where the access, you know, is basically granted into company resources and data, which is largely what we're trying to protect here. A good example of this, you know, as we'll get into a little bit later, too, is, you know, if you think about, a user accessing, you know, their data by default in Microsoft, you know, they have access to go in and access their email, right, and their files from any personal device they would have unless you put— starting to put restrictions into place through conditional access, which we'll walk through today. But in a lot of cases, you know, we're not privy, I should say, to, you know, seeing that device unless we're doing heavy network monitoring, things like that. And our RMM tool is only going out to those managed devices but not necessarily thinking about, you know, what are we going to do here, you know, if somebody's accessing it without these protections in place? So I like to think about it there, you know, just from a data access perspective, but also thinking about, you know, how do you blend that out against your other tools that you'd be leveraging, as well, too? And we certainly, I think a lot of us, not necessarily on this call, are maybe using Azure Arc for some of these other considerations, but certainly Azure for workloads that we have in the cloud that relate back to servers and things like that as well too. So I think if we move on, I want to share my screen out here, Wes Spencer, you know, just for the one aspect of what we're looking at here. It's kind of more of a diagram that I think depicts this nicely in the sense of, hey, you know, by default in Microsoft, You can have healthy PCs, you could have unhealthy PCs that haven't been patched in a while. You have users signing in from all over the world, any network, jailbroken devices on mobile, and really they can, you know, access corporate resources without, you know, any hesitation in Microsoft if you don't configure these settings. So these are the conversations I like to start having, you know, with customers when we talk about business outcomes and we talk about why you should care. Right, in this particular sense of starting to look at these things versus, you know, the technical speak of having to lock things down. And some of these, you know, kind of get into some of the conditional access layers within there. But I like to always showcase that to them because they usually don't know. And if I can show them that they have unprotected devices accessing this, that usually breaks things down. So the big takeaway, you know, from all of it is just really around You know, you can't actually protect what you don't know exists, right? What you don't manage today is the big piece of that.

Yeah. Wow. So if anyone has any questions, any thoughts for Nick on this as we kind of are moving through some of this, by all means fire them out. Let us know. We're paying attention to chat in here and happy to jump in. So, Nick, is this kind of in your, in your mind, is this where MSPs when it comes to inventory in Microsoft 365, this is really where they need to start?

Yes. I mean, I think today, you know, where we see a lot of people get hung up is largely around, you know, thinking about how do I catalog— when you talk about CIS controls, how do I catalog every single device, you know, that's in the company, right? Everything from peripherals, right, all the way into, you know, what I would consider to be critical assets, right? You know, for the organization where data can be exposed, where users are subject to, you know, different types of attacks largely around the identity layer, but also obviously just from the endpoint needing to be protected. And that could be an attack exposure that significantly increases your risk, you know, from the things you're seeing there.

Yep. Awesome. Awesome.

Cool.

Anything else on where inventory lives before we move forward?

No, I think, you know, we've, we've had a lot of considerations for, you know, monitoring this and having a source of truth. In a lot of cases, again, it falls back to this being where users can actually sign in, and you can see that activity between the sign-in logs and, you know, the access of registrations, right, within the portal as well. So it's a good place for that, just because you know that versus, you know, any tooling you have that's connecting that you're pushing an RMM agent out to, you might not be privy to the holes that are exposed within that.

Yep. Okay. Okay. That makes a lot of sense. So let's move on and let's talk about where we typically get tripped up, Nick, if we can, because I think that we understand what we just saw. We said, okay, cool, that those sources make sense. I'm ready to get started. Talk about where some of the trials and pitfalls typically are when it comes to inventory in Microsoft.

Yeah, I think it, you know, it largely starts with your onboarding and offboarding workflows, right? You know, a lot of times we have some breakdowns there, you know, where we don't necessarily clean things up. But on the Microsoft side, we have and see, especially in Cloud Capsule, because we do an assessment on your tenant, in most cases we see a ton of sprawl with, you know, devices that are in Entra that are just dormant. That they haven't been cleaned up over time. And that's not necessarily anybody's fault because, you know, we typically think about this with managing them with Intune, as well. And Intune has, you know, policies we can use for device cleanup rules where if the device hasn't been checking in in a while, we can actually remove it out of our ecosystem, as well, too. So it's, you know, a capability that doesn't extend back into the devices that are in Entra, again, because Microsoft does have those siloed IDs. So in a lot of cases, we see these dormant devices sitting in Entra that are still active, could still be used if they were picked up either, you know, maliciously or otherwise. And it creates some exposure there, but it also, you know, gives you an inaccurate view of what's actually active within your environment and what you need to protect and isolate and lock down. So you know when something malicious or suspicious happens to go and respond to it. It's kind of the whole basis behind the implementation groups, right, with CIS is really to focus in on what is our approved asset inventory, right, that we have today, and how do we make sure that unauthorized assets don't get access to the network. So we see a lot of this, you know, within there, and it comes back to that point of by default in Microsoft, any unmanaged device can actually sign into accounts, can access data with no restrictions. And so there's a lot of holes with that if you think about users accessing really unhealthy devices, devices that haven't been patched in a long time, things like that.

Yeah. And that idea of dormancy and being able to just have any— the true, you know, BYOD, bring anything you want in when you want to bring it in, is a scary thing because I think for a long time the idea and the mantra was, Well, if it lives in the cloud, we secure it in the cloud, and zero trust means any device can just access it from the outside world without having to worry about it. I use zero trust in quotes like that intentionally because typically that's what people mean by it. But that's really not the case, is it? I think we've seen plenty of incidents and breaches where those, whether it's dormancy or unclean devices accessing, have caused a lot of problems.

Yes. Yeah. Even at the mobile layer, right? You know, we've seen a lot there where Users have a jailbroken device or, you know, something's misconfigured on it, and they're able to access it through that account or even perform token theft and things like that, as well, on unmanaged devices. And, you know, it can really breach an entire, you know, system or entire business as a whole. Most client conversations that I have, when I can bring up a fact of, you know, we're normalizing this to business-readable terms, right? Like, "Hey, your users can access," you know, this PII or this data that you have, you know, from any device in the world, you know, that's something we need to clean up. Doesn't require a lot of explanation to understand, like, that's actually a risk, right, in a lot of these cases.

Yep, yep. So, tying this back to inventory again is this idea of the classic, we can't secure what we don't know about, right? And so having visibility into what exists. But what Nick is doing is he's taking this one step further and saying, y'all pay attention to your Microsoft world. The fact that we can have devices that have checked in that are now dormant but can come back again at any point in time and access things. The ability for devices that you don't have full control over accessing far more than you ever might have expected. We haven't even gotten into things like Copilot and how that might work in an inventory perspective. Can you tease into that just a bit, Nick, of what the Copilot world looks like and how we handle— how data inventory is critical in that perspective, too?

Yeah, I mean, right now, you know, with Copilot, a lot of concerns obviously around both insider threat, you know, considerations that you would have, but also, you know, just the consideration that attackers now have all this tooling, you know, that they never had access to before. If you think about how quickly they could penetrate your network if they had a chatbot like Copilot to begin to, you know, do a lot of reconnaissance within your environment, it could shorten the span, you know, to breach, to, you know, escalation of privilege, to lateral movement faster than we've ever seen, right? And, you know, DEF CON was a month ago. My co-founder went to there, or went there, you know, to take part and just kind of visualize what was going on. And there was a lot of, you know, different use cases of attackers and hackers using AI to breach these networks. And I thought the most fascinating one was around, you know, these companies, right? They pitched that, our product is AI-powered. I always think of that SpongeBob meme with the rainbow with the AI-powered above it there, just to kind of express the, you know, the hype cycle, right, of what that is. But these attackers are using that, and they're using what's now known as prompt injection to be able to ping, you know, that bot, which is accessing, you know, data on the back end. And they were able to pull out some sensitive customer information, you know, based off of just prompting it with different types of cues that expose that to the front end. And Copilot's no different, right, when it comes to that. But when you talk about, you know, these AI tools being leveraged on these unmanaged devices and things of that nature, you know, it's even more of a broader attack surface for somebody to come in, expose, you know, a personal device in that nature, and then be able to use that to harvest, you know, all this data, you know, on the client environment or get access to Copilot because the user has it and surface all this sensitive data to move into ransom or whatever that might look like. So it's just kind of the speed of breach, you know, is significantly reduced with that exposure, as well. And you want to understand from a data loss prevention perspective, you know, what clients or what users are doing, you know, from even a data exfiltration standpoint, right? Downloading things locally and moving things into unmanaged locations, you know, that we've seen before too.

Yep, yep, yep. This is— thank you for walking us through that because it really is, it really is a big deal. And we can't just slap the AI on all the things and expect everything to just go stellarly, flourishingly well. We're going to run into those, those issues of data governance and control over that data is just so important.

So yeah, I love that.

I love that. So let's, let's switch topics again and let's jump into some of the technical must-do options. And by the way, I, I think people were able to fill out the, um, the, the poll that I did earlier, but I don't think it showed it live because I didn't have that Canva Live thing. So I'm sorry about that. And hopefully everyone can still kind of read the screen here. In fact, let me just change the, the view here. There we go. That might be a little bit better. Um, so yeah, let, let us know what you think around, um, technical— what, what we must be doing as, as MSPs.

Yeah, I think, you know, first and foremost, the purging of these stale devices, you know, having that, you know, approved asset inventory at all times, knowing what you're protecting, but also reducing the overhead and the complexity, right? If you have a clean inventory, that makes things a lot easier to understand when there is suspicious behavior or, you know, breaches that you need to go respond to from an incident response perspective. But this all kind of zooms back out into what does your onboarding and offboarding workflows look like for devices and accessing data? How does it— how does a device gain trust, right, to the network as an example of that? Or if you're zero trust, right, it's how does it gain access to data and how do you trust that to perform that process? So there's definite, you know, SOPs we've typically had in places before, but it's basically saying how can, you know, anyone such as a regular user not go in and just register a device, right? We have restrictions that we can put into place that aren't there by default. There's some settings in Microsoft that you can configure for that. But also starting to think about leveraging tools like Intune, as an example, to get them fully under management and get them to a higher level of "compliance" in that sense, right? The first step is just getting and saying, "Hey, we have managed devices. Everybody else that's not on a managed device can't access corporate data, 101," right? That's what you should strive to do in every client environment. The next step up is saying, "We want to have stricter policy checks for what we're looking for that says that this device isn't going, you know, enough or getting outside of compliance, as well, too." So this is saying, like, "Hey, the firewall's always turned on. You know, it's always been patched. If it's unpatched, pay on to," factors, you know, we can say that it doesn't require access to the device. So getting a little bit more considerate there. I think one question I'm seeing come through is, you know, what's considered stale? Is it 3 months and is it 6 months and so forth? I think this largely, like we in Cloud Capsule kind of baseline this at 45 days as an example, because that's how the CIS organization defines that as well too. But I would say there's deviations where you need to define an internal policy with this as well, too, which is, you know, hey, I've worked with schools, right, that have seasonal workers that will go away for some time and then come back and so forth. And you're really defining what it means to you to have a stale device within the organization, as you say, is purged after that as well. So Um, but great questions.

Um, another, another one good came in from some guy named Kelvin or Kevin. Those of you don't know Kelvin, he's awesome and a good friend. I think he was your sponsor too, if I remember right, for, uh, for your MVP.

Yeah, yeah, Kevin. Kevin is great. He loves to be called Kevin now. Um, yeah, I love Kelvin. Uh, he's, he's doing great work in the channel. I've always looked up to him. He's just— it was my inspiration for starting T-Minus. I can't thank him enough. For all that work. But the attack vector we need to protect the most is the user in the device layer, right? Kind of coming back to that, you know, that earlier statement around people are largely trying to protect the network, have users use VPNs, right, to secure the network traffic as an example of that. And there's not only the third-party supply chain risk, you know, that we're seeing being exposed through that as well, but we're also creating a lot of inflexibility with the client that they're not going to be on board for when we talk about remote work. That just makes you feel like you're adding a lot of friction to their organization, and they're less likely, you know, to want to invest, right, in security if you're starting to lock things down where they're getting frustrated every day, you know, when things aren't working. But it also, for you, from just an operational perspective, makes things a little bit more cleanly organized in the sense of your management, right? If you're just using, you know, these, these base layers that you already have access into with existing licensing, then why try to create a bunch of complexity when we can still have the same level of security, if not better, right? In some of these cases as well.

Another question I think people would love to hear an answer is, what's your advice on getting through some of these must-do actions with as little user impact as possible? Because— and we're going to get to this at the end of the segment, sort of how we describe and talk to our clients about this. But, but I'd love to hear from your perspective, how do we intentionally do this without just making them all revolt on us because they feel like everything just broke out of nowhere?

Yeah, I, I think this is a big, big talking point, right? I see it all the time where, you know, we're trying to be seen as the hero, not the, you know, the provider that, that creates a lot of frustration in the organization. And that's why with everything I've tried to create, I've tried to create progression paths. And largely this is what CIS does with the implementation groups, but I think it, you know, we're going to try to break it down in the series in even more granular layer. A great example of this is saying, "Hey, we want to require, you know, managed devices." A lot of organizations can fulfill that. There's not much of a gap, if any, to say that we could start fulfilling that today and not create a bunch of friction versus if we said, "We're going to roll out compliance policies with Intune and require that your device is compliant." And if you don't have a compliant device or falls out of compliance, you won't have access to your data. That actually creates a lot of friction, right? So it's trying to get quick security wins, you know, that won't create that buffer of frustration. But I've always gone into these organizations, especially when I was working at an MSP as well, to say that we had, you know, a pilot group that we were using to test. So kind of a change management you want to do so that you're not, you're not an enterprise that's creating a bunch of bureaucracy, but you're understanding the constraints that might be unique to that customer. That you didn't really consider. You know, a great example of this is the mobile application management policies we push out to phones, personal cell phones, to protect the data but not have the user enroll their device because they think, you know, we're going to read their texts and see their images, right, on their devices as well too. But even that, you know, creates so much friction with, you know, mostly C staff, right, that has, you know, their contacts and their calendar that they have natively on their phone that they want to continue to be able to use. And so if you don't address these things upfront, you are going to make a lot of people angry and they will continue to see every project as like, I don't know, you know, last one we rolled out, this was a ton of friction for us. So I think addressing it in a pilot, you're never going to cover every single use case with a client, but that's also how you communicate with them too, right? Like we're not going to ever know all the different use cases in your organization, or we're going to try our best, you know, to pilot this out, document, you know, what maybe is unique to you, and then move on, you know, to a broader deployment, you know, that's all inclusive of the considerations. And it's smoother on all fronts. You don't deal with the frustration. You can micro, you know, package that out so that it's not like we're cutting over email, right? That classic example of doing that and having all these help desk calls. Coming at you from there. Um, so it's hard to do, right? I'm not saying that to say that it sounds easy, you know, in that sense, and there's some labor involved. But I think the alternative is, is definitely going to be, uh, you know, giving you some negative light, right, if you do it the other opposite.

Yep, yep, it's all well said. And to me, what's nice about that too, um, Nick, is that it's— it should be a bit of a safe space for people that have been practicing good IT and security hygiene for years in the sense of like we roll things out in test groups and we really understand what the impact is and what works and what doesn't. And then we learn to make sure that we have executive buy-in and understanding of the why behind what we're doing, not just because security requires it, but because we have to protect what we need to, the assets that are valuable and need protecting. We'll get into that at the end of this segment, some things that I think will be helpful for you to learn how to message this correctly. But that's why I asked the question. I love your answer. And to me, the thing that stood out most is just that idea of like, we'll just blindly flip a switch on, understand what you're doing, be a student of the technology you're using, and then roll it out in small increments to understand what the impact is. And so you can get in front of those things and learn how to message things correctly, because we do have to understand our clients are very important here and we have to be careful about how we roll the right things out. So yeah, it's all well said. So you made this comment earlier to me and I wanted to kind of bring this up. I don't even know if you knew I put this in the, in the slides. But I thought this was awesome. Kind of walk us through, you know, yo, your RMM is not your source of truth. Maybe it was 5 years ago and 10 years ago, but today not so much.

Yeah, I mean, this was, you know, kind of going full circle. I was mentioning earlier, you know, we had this use case, and this is just kind of going through some of these stale devices with partners on calls because, you know, Cloud Capital Services this. But regardless, if you go through your— I would, you know, implore you guys today to maybe go through an inventory that's in Entra, you know, and see if there's any of those devices that are, are signing in that are personal devices, right? As an example, in most cases you can likely find one, but in this particular case, like, the OS was, you know, significantly out of date. I think it was behind by like 30 patching cycles, you know. So there was a significant amount of risk, definitely like public exploits, you know, on that device that could have been leveraged. And luckily they didn't have that, but it was a hole that, you know, wasn't in purview of of the other tooling we were leveraging in place, you know, for access or things that they were seeing. So there was definite, you know, exposure there that you want to start locking down, but also another reason why you want to have that approved inventory, have the, hey, this device is gaining our trust because it's doing these 3 things, you know. And I've certainly given recommendations on, you know, how to lock that down more. It has to go through an approved work stream, right, to get onto your network to be able to do that. And then you have all the monitoring in place to know that it's a healthy machine moving forward. Yep.

Okay. That makes sense. And just a word of warning for folks, right, of just be aware if you're leveraging— I don't want to say old technology, but if you're leveraging tools that are not fully suited towards your new architectures, you need to reevaluate that.

Right.

And this is why, again, all good security frameworks come back to inventory because because it helps us work through that assumption of things that might have materially changed. Same thing with like risk assessment frameworks, which is why like we're asked to be doing risk assessments every time we make material changes to, to our infrastructure and our architecture, just to make sure we've thought through those things to say, you know what, yeah, we may not be able to see some of those things. What are we doing about that? So I love it. And we're not trying to overwhelm you here. I know there's a lot to do as an MSP and a lot to think about, but I think the goal is doing this wisely, intentionally, and understanding the tools that are at your fingertips makes this a lot easier. And so with that kind of being an intro, walk us through this right here, some questions we might want to be asking ourselves to really help us think through some of this.

Yeah, I think, you know, the most basic question is, can any user sign in from any device, right, to Microsoft as an example? Can they sign into their data? It's a more broader question there that goes outside the Microsoft ecosystem. But then, you know, like I was saying, how does the device gain trust? How do our onboarding and offboarding processes look like? But focusing again, you know, not at the full breadth. This is where again, where I see MSPs hung up on thinking about every single device type. You know, when we were in our MSP, it was like every peripheral was an IT glue and, you know, every workstation and every single network device, you know, our switches and so forth. And it was, you know, overwhelming to think about like gathering every single piece of metadata. Versus these really critical assets to start off with, which is just, you know, what do the workstations look like, you know, that our users are accessing daily that have the biggest risk exposure to us? So it's really just kind of the prioritization behind that as well too.

Yeah.

Yeah.

Okay. That makes sense. So any areas where you feel like if you had to point to one of these three that you feel like MSPs are probably weakest at, which would it be?

Well, I'd say today that the number one, you know, can users sign in from any devices, where I see the biggest holes, and we see that in Cloud Capsule through most of the tenants that are onboarded, they don't have a policy in place that restricts device access to corporate resources. And, you know, I've even shown previous videos, too, this could even help with these very much growing attacks today, like adversary-in-the-middle token theft and phishing. You know, this can actually prevent that from occurring through that phishing flow. So not only does it, you know, fulfill like an approved asset inventory, but you have this ripple effect of security that can really help protect a lot of these incidents where this is where the leadership aspect to me becomes the focus of instead of looking at reactive post-breach mitigation tools, you know, we really want to shift the attention span to what are the policies we can do not only to implement and get, you know, some of these core foundational elements in place, But thinking about, you know, that preventative posture, so not answering a call in the middle of the night saying, "User signed in from Japan," right, as an example, like some of these things that you'll do will compound with what you're looking at again, as well. So I think that's the biggest one, you know, that I see. And obviously, the process has to be in place for you to maintain access, you know, of those devices, you know, coming onto the network.

Yep, yep, okay, that makes sense, that makes sense. Any thoughts, you know, let us know, any questions, any feedback. Oh, Abhi, good to see you on, brother. He said, once again, LinkedIn doesn't put my name, but now it's showing your name, Abhi. I was wondering who that LinkedIn user was, but I appreciated the security opsec going on there. So nice job, Abhi. All right, so let's kind of walk into this one, Nick, if we can. Sort of this idea of like tips of kind of getting some of this going. I know we kind of talked about some earlier tips of like implementation, what to be looking at, but walk us Talk us through some of this.

Yeah, I think, you know, one of the biggest things you can do is set up a conditional access policy to require a managed device, right? I think, you know, there's policies you can do if you're hybrid, you know, that are more built into the grant controls of a conditional access policy. But there's also, you know, some settings for filtering out Microsoft Entra joined devices, you know, that would allow you to say these are the only devices that can access resources. And I've shown that on previous videos on my channel. But it's really one of the best policies you could begin to institute that, again, to our point earlier, doesn't create a ton of friction. Most organizations, if not already, they should be narrowing this down into, you know, just managed devices can get access to corporate data within the environment. And then, the next step up from there is thinking about, you know, getting devices enrolled into Intune, you know, and under management to start monitoring first, you know, for more of the compliance, you know, that you would want to see against that device, such as, the overall health of the device or any specific configurations. And the same thing is true for mobile device use that I was speaking to earlier. So you can do a lot of baseline protections that can elevate your risk exposure quite significantly in the sense of like the reduction of what we're looking at there. And then really tightening up what does onboarding and offboarding look like? Do you have, Do you have things restricted into Entra where not just anybody can join a device into, you know, Active Directory, as an example? Do you have things, offboarding workflows built in so that when a device goes offline, you actually remove it out of Entra, even if it's just sitting in dormant, you know, inventory physically, you know, in that location? When you rejoin it, it will rejoin the asset and the network on, you know, the Microsoft side, and you'll be able to start pushing down all of your security behind that as well, too. So just kind of thinking about this from the, what's the minimal amount of time, you know, to get the most security benefit with the least impact to end users is kind of like a shortlist to start doing that.

Yeah, and thanks for sharing that because I think that's what we all want to hear, right? Like, give me— I wish Microsoft would just say push this button and get the best benefit for the lowest impact. You know, having some people like you that really have been through this and understand this is where I would start and this is what I would do, this is where I'd focus, I think is extremely valuable. And then knowing you have, like we talked about before, knowing you have the safe space to say, we're going to do this in a control group to make sure things don't absolutely explode and then we expand it from there. Right. So hopefully that gives you, if you're listening today, some ability to say, okay, maybe I don't have to be as fearful to get started, then that's a huge win both for this show and for you and your customer. So I love that. I know that these links are not going to work for folks here just by looking, but this QR code will take you to this slide deck. So if you joined us recently, what we'll always do is give you the slides through Canva so you can access them. It's just a public view link. So yes, you have to trust us and we're two, you know, very upstanding and trustworthy people, I tell you. But that will give you links to all of those T-365 articles. Anything else you want to mention on those articles in particular, Nick?

No. So these, yeah, these I spent a lot of time with. There's more of these visual diagrams like I was showing earlier, but it kind of goes through different workstreams, right, of personal devices needing access. If you need to do that, right, for client environments, what's, what's certain considerations that you'd want to apply or recommendations of how do you progress in there? Guest user access is another common one that would typically come up. Like, I guess users aren't going to have corporate devices. How do they get access securely? As an example of that. And, you know, just thinking about the various use cases, right? So this breaks this down, you know, and I'd recommend again starting with your onboarding/offboarding workflows as well as requiring managed devices and then moving to those other different business use cases from there just as a consumable flow because it's likely, you know, depending on the customer side, you know, that will come into play.

Yep. Yeah, love that. Love that. Absolutely love that, man. That's awesome. So now what we want to do is we want to shift this a little bit into a bring-it-home segment of how can we get this into— how can we, how can we start messaging this correctly? How can we get to a stage in which, as we know, we need to make the changes, we know what the pathway is and where we're going, how do we get the buy-in? Because ultimately, you know, you and I can have all the best intent in the world and all the desire to do all the amazing things, and we can be held back by our MSP leadership saying, I don't think we need to do this. I'm scared to make these changes. You know, ain't broke, don't fix it. But we also can run into the same problems too with our end users and the decision makers there of, don't you touch any of this stuff. I pay you to make my problems go away, and now I paid you money and more problems came in front of me. And so therefore you're an adversary to me, and I don't— that's why I didn't pay you. I'd rather go pay someone else. It's, by the way, a lot cheaper and isn't going to cause me so many problems. If we're honest, that's the fear that we have, right? And so we have to, we have the challenge of saying, how do we juggle doing the right thing for the user, knowing that it's going to cause some impact, knowing that it's going to potentially cause some, some challenges they may not have seen before, but also know that we have to make it happen. We don't have an option here. And so that's kind of what we're going to shift this, this segment into a little bit more, just from the talk tracks and to think about and even some, some how we might measure it. So what we want to do is we want to kind of start here is, you know, before we talk talk about all of our IT and our grand strategy and grand security strategy, all these things, you know, we have to know what's there. And so where I would start in the decision-making criteria, we actually began with this, Nick kind of started out with this mantra of one of the basic core tenets of security is I cannot manage what I cannot see. And I also cannot manage what I don't have centralized control over. So there's kind of two major components here. If I have to have control over the things that I, centralized control over the things I want to secure, well, I have to know what they are. And so this is a much bigger problem than I think we sometimes understand it to be. And this is not an MSP problem. This is not a small business problem. This is an everybody problem. I shared this story before, Nick. I remember years ago when I was at my bank, I got a regulatory letter in from one of our core critical vendors. I won't name which one, but they were immensely large, publicly traded. And one of the challenges that the regulators had discovered is that they— this, this, this this technology provider had entire segments of networks. I mean, we're talking like Class Cs, like hundreds of them that had never been scanned, that had never been seen before, had no shields up on anything. And you know what happened? Like, one thing leads to another and we need some IT service over here and we got to spin up this capacity over there and we just do it. And then we say, we'll come back and report on it later. Maybe we do report. There's no process to drive it. It's no process to keep it accountable. And so this is where we run into these problems, is that I don't think anybody intentionally says, "I'm going to introduce complexity and then ignore it." I think what happens is, as we go through our day-to-day of doing business, these things creep in. And then if we don't come back to it and have a process to manage it, all of a sudden we got burning fires on our hands. And I think we can point to plenty of incidents where this has been seen before. But to start here, Nick, that's my thoughts on it, is we really have to understand this is the core philosophy that we have to communicate and get across to our decision-makers to understand, this is what we're addressing and why we're doing this from a philosophy perspective. Anything else that comes to your mind here?

Yeah, I like to reframe, you know, kind of the whole positioning of that, you know, to lead with this, right? Which is to say, like, what's the business outcome we're going to give you here? Like, we're going to give you, you know, secure remote work, right? As an example, if you really roll it up in that sense. And in order to do that, we need to know what we are managing, right? To show you that you are secure. And being able to do that. And that starts with these few policies, right, that we're going to implement and start to lock things down a little bit. But it's going to have, you know, or it's not going to restrict your flexibility on working wherever you want, as an example, because we're locking things down so that users can communicate with each other appropriately and get access to work documents and so forth. And that's very much, you know, leading into, oh yeah, we really want to do this, but we're worried about it because we have a, you know, workforce that's in 3 different countries, right? Or they're all over the United States, as an example. So yeah.

Yep, awesome. Yeah, exactly. And so as we kind of think through this, I want to bring an analogy up that I think is, is rather helpful. And I think this is something that you can probably use to really get your decision makers to sort of understand the rationale of why we're trying to do it. So, so here, picture this in your mind, is, you know, we're trying to get our clients to understand And if you think about it as like a complete asset inventory, including what's in Microsoft 365, is like if we don't have that, it's like trying to guard a warehouse without knowing all the doors are. And that's impossible, right? So, so I have this valuable warehouse with even more valuable assets in it. Could you imagine we say to a security guard, hey, your job is to go guard this monstrous thing, but I have no idea where the points of entry are. I don't know what doors are locked and unlocked. I don't know. When people are accessing them and the right people and the wrong people. We have no prob— we don't even have policy to know if that person should be accessing this warehouse or not. What rational decision maker would say, yeah, that's great, that sounds like a good plan of action, especially given the value of the assets that are in there? No one would say that's a good idea. And so I would play into that and say, this is kind of what we're doing is, you know, for a long time, it's not that we haven't had your warehouse, so to to speak, secured. It's that as we have shifted into a cloud-first mentality, enabling all of these business services like work from home and the flexibility to, to work where you're at, and even potentially have some of your bring your own devices that come in— those things are wonderful, those things enable us so much, and you and I recognize we're not moving back from that. But we also have to recognize that bad guys are aware of that, and bad guys are taking advantage of this. And if we don't put some controls around this and start locking, finding where the doors are, and then locking those doors, we're going to get ourselves into a world of trouble. And you might just pause there and say, does that, does that make sense? You know, and a lot of times the decision makers say, okay, I get that much. You know, I didn't know it was that wide open. And you go from there. But sometimes they might come back and say, well, prove it. You know, like, how do you know that? We might want to be armed with some, some examples of breaches. And so let me put you on the spot, Nick, if I, if I might. What are some like examples of security incidents, like some types that a client might see that could lead to damages far more than they ever expected when it comes to this?

Yeah, I mean, I've seen it, you know, in kind of some of these engagements that I've been doing with certain clients around, you know, AI talks, right? They're approaching us now for a lot of these conversations because they have some type of ROI that they see, right, with AI. And a great example was I worked with a company that, you know, was a loan officer company and, or, you know, more of a fintech firm itself and was trying to stand up, you know, these agents that would allow them to auto-process loan agreements. But doing initial investigation, you know, could see that loan officers actually were working from personal devices and were downloading, you know, customer PII locally as well too. And one of those loan officers is kind of why the engagements came up as well too, was He actually, you know, clicked on a phishing link, you know, that we all might get, you know, through our email but didn't have any of the native protections on, you know, the endpoint, you know, for, you know, the malware protections, the web browser protections, and so forth. And that actually caused, you know, the breach. And then there was data exfiltration, you know, that occurred because they were actually managing that customer PII locally as well, too. So that's one example, you know, of some of the things that we're seeing in that sense. But you could think about it both from external threat to internal threat, right, as well, too, just from users being able to exfiltrate data. And a lot of business owners are very concerned with that, you know, the insider risk equation that might come up, you know, from users having their personal laptop, but all the, you know, the Coca-Cola formula, right, is downloaded to that personal laptop and exposed there. And then they upload it into ChatGPT, right? And start chatting with it and expose it in multiple different areas. So just a few examples. But I mean, it's your analogy there is spot on in the sense of, you know, basic protections, right, to secure your organization.

Yep. Yep. I love that. So we're going to come back to this. The business risk here is that if you don't know about it, you can't protect it. And bad guys are preying upon that. They're literally preying upon the fact that they are taking a gamble that the work they're going to do to get an entry into your network is going to pay pay off in dividends because you haven't done some of the things to, to really reduce your, your blast radius or your surface, your, your surface footprint. And so because of that, they're, they're banking on just give me some persistent access and I'll take it from there, thank you very much. And what we've seen is time and time again that's held to be true, right? And so what we're talking about is not trying to be Bank of America, we're not trying to be the Pentagon, but we are trying to apply the right processes in place that we think will really aid. And also, by the way, Miss Decision Maker, you know, we're not going to haphazardly do this. So we've identified a group of maybe 5% of the network, and what we're going to do is start rolling that out and just make sure things are working well. And you can go talk to those people in that test group and kind of find how, how it works. And, um, yes, we— there may be a couple speed bumps along the way, but, but we're going to work through that. So, um, yeah, yeah, really good stuff. So the comment that came in, um, and I don't think it's going to show all of it, so I'm going to read it, but it says, you're actually fighting two sides though. One, the business owner agreeing to the budget, and two, the other company's pretending to do the same thing even though they're not. The owner can be like, I understand what you're saying, but this other company will do it for less money, even though they, even though they won't, the client won't know that necessarily. Yeah. So we talked about this before, sort of that idea of positioning against, you know, competitive MSPs that are trying to come in and say sort of the same thing, right? Of like, oh, well, you know, we're going to be able to, you don't have to worry about that with us and we're also cheaper. And that's a challenge, right? And that is something you have to be prepared for. And I think there's a lot of angles you can take with that is, You know, one is to just lean back to best practices and say, yeah, you know, they might be cutting some corners to do that, Ms. Client. It might actually even be a little bit cheaper, but one of the things we want you to know is we're following actual best practices. There's a whole nonprofit group called Center for Internet Security. They've built out one of the world's leading cybersecurity best practice guides, and we follow that, and I'm pretty sure those other guys don't. And, you know, you don't have to understand all the basis and background to all of it, but what I do want you to know is if they're not following it, they're probably cutting corners. And if you don't, if you're, if you're okay with someone cutting corners in service delivery and putting new risks in that could cost you a lot more money in the long run, then who am I to stop you? You know, and then I might tie it back to just like a doctor. Hey, if you have a real medical issue, are you gonna go to the quack, or you're gonna go to the guy that really knows what they're doing, that's following best practices? And it's the same kind of thing we're talking about. Our company is too valuable to cut corners in some of the critical ways. And I would just say it that way, just state it out there and let them kind of chew on that. I think it's gonna ring true with them. Anything else that sticks out to you on that comment, Nick? Nick?

Yeah, I think it's a great question. And I think, you know, the way that I've seen it approach really, really well in the sense of the reframing is the more that you can dive into, you know, upon the discovery with that customer about their business goals, their business drivers, and understanding their business, you know, you're really relating back to them, right? Of, I actually know your pain points and I know what goals you're trying to solve for. So it turns the conversation into just the commodity level, right? Right? I can go, everybody can go in and put a conditional access policy in your tenant, right? But not everybody's going to know how to do that. That's going to, like we were talking about earlier, have the least amount of friction but also pare back to, you know, this is how we're going to, you know, scale this over time, as well. So the more that you can do to showcase, you know, something beyond just the tech value is always going to be the leading part of that conversation. The tech should be just the, you know, the side piece of it. Yup.

Well said. Yeah. And hey, Mindy. And I know Mindy knows how to answer that. Mindy's just being an awesome human of giving us a talk track on that. But yeah, Mindy, good to see you. And thanks for asking the question. That's, that's fantastic. So what we want to do, let's kind of shift a little bit into some of the burdens that we have as MSPs. And this can also be a help for you, right? Like, I'm— while, you know, sometimes we may see compliance and regulatory requirements as an onerous burden and that maybe you're focusing on the wrong things or whatever, We also recognize that we can't stop it, right? I've been saying for years that you remember Indiana Jones in the— I think it's the first one where he replaces the sand to grab the golden icon, and then all of a sudden it triggers that ball. It's a little slow at first, but once it gets going, you don't stop it, right? And off it goes. And that's really what regulation is, is it's not going to stop. It's going to continue to get both more onerous, more complex, and also is going to get grips on the MSP. MSP, because what all regulations are starting to understand is risk profile. You know, when you look at NIST CSF 2 that came out, one of the things that had major changes to is understanding third and fourth-party supply chain risk, which is another way for saying, hey, as an MSP, you're involved in this. You are part of the supply chain risk of every client. Ta-da! Welcome to being an MSP. And so you can choose to say, oh, that's so terrible that all these things are being added to me, or you can choose to say, We embrace that and we're glad for that. And because that's correct and we are a significant risk to our clients and they to us and we and them to their fourth parties. That's just the nature of the game. So we should probably seize upon that, understand it. And so, you know, you look at this and you look at CMMC and HIPAA, FTC safeguards and plenty of others that do require some kind of asset inventory. It's not just a CIS says it, but we're starting to understand that almost all frameworks and regulatory requirements have inventory. And I remember this in my bank. The very first question that my bank examiner would ask me every single time they came in every year was they'd say, where's your inventories? I want to start with that. And they go and look and they'd ask me questions and they'd even spot check a few and say, show me where that is in the network. Show me that you can see it. Show me the name is the same. Show me last time you scanned it. Show me where your controls are at. Go to that machine and prove to me the things that you say are running on that are actually running. And the reason they do that on a spot check of 5 or 6 is to say, is it accurate? And are you running it? Are you making decisions on it? And so, Nick, I absolutely love that. I think it's really valuable. And so what I would just say, as we kind of close out today, is just frame inventory. I hope you like my YouTube image. I didn't find a good one of you. Like, you're going to have to send me some goofier ones other than just like your nice prim and proper one in your 3-piece suit, which is awesome, by the way. But I was like, I'm going to do one of my stupid ones. So yeah, frame it as a maturity journey. Business owners are not afraid to start thinking about all things in iteration. They're not afraid to take things into parts and work on them. In fact, that's what they prefer. Sometimes we are guilty as security people to say, you gotta go for the whole shoot match right now, you gotta do everything now. And the truth is, that's too much to swallow. It's too hard for the client to understand. They're not ready for the risk, they're not ready for the burden. And so slice things up slowly and give them things in iteration because that's going to really help as you kind of move, move forward and then just continue to let them know if I can't see it, I can't protect it. And same for you. All right. Do we want to talk about these metrics as we close out, Nick? Any in particular that you would focus on?

Yeah, I think, you know, the big thing is just kind of that what you just mentioned, I would kind of piggyback off of. Right. Which is we've seen a lot of success in instead of doing like a 6-month-long project to get ROI.

Right.

Right, saying, you know, hey, we're going to do this to increase your security, then 6 months later you see it, is the more frequent touchpoint behind progress, right, in saying, hey, we've made incremental improvements, but it shows the client, you know, that you're working on stuff, it's moving forward, and they feel really good about that. And so I think, you know, we talk about it from a metrics perspective, you know, you're really talking about the empowerment, right, you know, for secure work, and this is kind of our progress behind that. It's not putting a bunch of stale reports into their face of, you know, the, the technical speak of, of all these use cases. But you certainly want to have your own internal metrics, right, that you're measuring, you know, that you're saying this is healthy within the organization. A lot of that's, you know, obviously management into, you know, broader areas of compliance within there, but also starting to take a look at hygiene. Me personally, you know, might resonate for, for more out there, but I really love it when things are clean, you know, like in the sense of the, the devices that are in Entra are, you know, the ones that are active. They're not the ones that have been sitting for 6 months or 3 years or however it might be, because when I see that, I wonder, has that device has been breached? And this, you know, ping of fear will rip through you when you see that type of thing as well too. So it's more so about— I would, I would encourage everybody out there to try reinforce like their business decision around the outcome, right? And you can do that with metrics, but it's really enforcing like, hey, you know, this past quarter we've got you all locked down for secure remote work, and we know every device is under management in our purview. It's a great win, you know, for you to communicate as part of that.

Yeah, love that. Love that. All right, we're going to skip the last poll and let everyone know, since we're out of time, our next episode is going to be September 24th. At 2 PM Eastern. So mark your calendars. There's a QR code to go get registered for that, but it's just going to be on LinkedIn. It's going to be on YouTube, just like last time. So easy for you to go and connect up with us. I hope to see you. And also reach out, send us an email, send us a DM on, on LinkedIn. Let us know what was good about the show, what wasn't so good, what you'd like to see us improve on, what you'd like to see us cover more. It's not just CIS controls as it goes to Microsoft 365. We'll be talking about a whole myriad of other topics topics. But give us some feedback on all those things and let us know. Nick, this has been a lot of fun. Thank you for making some time for this. Hopefully this was helpful to MSPs, and we'll continue this journey of going above the stack.

Awesome. Yeah, it was great to be here and just echo that. Love the feedback and everything you guys want to see here.

Awesome, awesome. Well, cool. We're gonna head it, hit it from there, and we'll be in touch. If anyone has any questions, feel free to let us know. But thank you all for joining us so very much.