Bite-Sized Lessons in #MSP Cyber Readiness with Wes & Kyle

What's up, everybody? I found this guy here at Nixon in Houston, and we're just eating lunch. We were talking about— right, everyone knows cyber's happening, right? Everyone knows that It's important for whatever reason, right? I've long lost the technical aptitude that I should be accountable for. But this thing, one thing that I've noticed, one of my clients, and it's been eating me up, honestly, and I wanted to talk to Wes Spencer about it, is how do I approach cyber if my business isn't ready for it? And some context on this is there is an unforeseen cost when it comes to a lot of these platforms. And you probably saw a lot of it at Perch. Where just because I have the endpoint doesn't mean that I always have the team to remediate the incident or even investigate the incident beyond the SOC services that some vendors make it seem so easy to plug and play. Am I right about that?

Yeah, you're, you're right. You remember when you and I did that webinar a while back on the revenue stages of an MSP tied to security? And the early revenue stages, especially that pre-$1 million, but even $2 million, $3 million, you know, you're in that owner hustle and there's that desire to like, I want to do everything, right? Because I want to grow my business, I want to grow my revenue. I don't want to say no to anything. Like, I totally understand that. I always want to be sensitive to— I mean, as someone who's starting something new myself, you want revenue, and any revenue in a sense is good revenue. But you do have to ask that question of like, what do you get yourself into when you start offering services beyond your capacity to deliver? And we— I think we're comfortable in IT because we've been in that world so often. The difference is the negative impacts and inability to deliver IT are not necessarily as damaging and dangerous as it can be in cybersecurity. And that's probably what we don't think about. So like, play that out for a minute. Let's say there is some like significant incident that the client has, not only did you not know about it in time, not only did you not respond to it in time, but you also didn't have the capability and experience to respond to it in time, right? And so now the fires of that incident become way worse. And then on top of that, now you're dealing with the ramifications of legal issues with that. Like, uh, how do we deal with, um, you know, the capabilities around, um, incident response and, um, what about, uh, notifications of clients? These are things we haven't thought of. So absolutely we can get ourselves into a deeper hole.

When we're ready. Well, and I want to add another perspective to that though too, which is how am I as an MSP owner supposed to pay for all that? Because I didn't price an extra hour per user per month. I didn't price, you know, all of this extra margin into the agreement to where I can pay the salary of my team to remediate these things. And that's what scares me is we're racing to the bottom a little bit with some of our packaging and with some of the zeitgeist that's out there that I get very concerned to an empathetic level to use, you know, your branding on Empath, But like, what am I supposed to do? Do I just like hide in a shell and hope that none of my clients get breached? Do I hope that none of them have an incident that hits my help desk? Or is, I mean, is it okay to be ignorant?

I know that it's, we all know what, you can't be ignorant, right? I mean, we know that. You gotta do something about it. I think you're right though, to play the empathetic argument. Like I'm, again, I'm very sensitive to MSPs because we've been told for years now, if you're not doing cybersecurity, you're behind. And if you're not doing cybersecurity, you're missing out on margins and you're never gonna get to $150 a $200 a seat, $300 a seat, unless you're doing cybersecurity. So the natural knee-jerk is like, well, then I better start doing it, right? I better get into it.

My competitors are doing it. I gotta match what they're doing. Yep.

Yep. And guess who's saying all of that? It's the vendors. And it's the, the, the coaches that are out there. It's all those people that are like, well, I can get you to $300 a seat. You just follow my plan. They actually, I don't think they're lying, but they're definitely, there's an ulterior motive that's forcing you, pushing you into going to the edge of a cliff and maybe pushing you off if you're not ready for it. So I haven't answered the question yet, but I just wanna say, let's be cognizant of that. So I think a couple things. I think one is, remember, this comes down to risk and risk mitigation, right? So like, there's things that you should be putting in place no matter what that I don't think matter the size of your MSP. One of those is cyber insurance, right? If you do the right things around cyber insurance and make sure the client has the coverage that they need and that they're meeting the controls eligible to make them eligible for cyber insurance, then when the big incident happens, you're not the one that's commanding the shots. You're not being the incident response quarterback here. The cyber insurer is going to, to pull those folks in. Second The second thing that I would say, just to get even more practical though, is understand, I think, what you can do and then what you should not be doing that you can find a great partner. I'll brag on a partner. I love what Orbital Fires do, Reg Harnish, right? I'm not paid by Reg to say it. I'm not— He's just a good guy. He's just a good, smart guy. And what's great is his model is really built towards smaller MSPs saying, hey, there's a laundry list of stuff that you don't have the capability of doing, but we can do that for you. This might go counterculture to a lot of vendors that want you to buy their product instead of going to something like what Reg is doing. But the reality is you just have to understand, as a new starting MSP, there's certain things that you can't do. And you can rinse this analogy into almost anything in life, right? I'm gonna get started in weightlifting, I'm not gonna start benching 300 pounds. And if I do that, the bar is gonna fall on me, I'm gonna look like an idiot in the gym, right? So we gotta start somewhere and recognize that you have limits in what you can do, and it's okay to outsource some things, lose potentially some margin on it, but know that you're doing the right thing for the client and giving you the capacity to scale and grow over time.

Well, and really the margin that you're losing out on is that upfront margin, that margin I tacked onto the endpoint, which let's be real guys, it might be 15, 20%, that's still only a quarter. Like we're literally talking about pennies here. And when we talk about that $150, $175, $200 a user, you really need to think how much of that is the good margin, the services that I deliver, not the endpoint margin that's making me pennies on the dollar. So, you know, my response to that, or my question there is, why do you think we're so afraid to outsource cybersecurity? Like I'm curious on where your head is head goes to that insecurity of I have to do it. Where do you think that comes from?

I think about this a lot. I mean, as an IT person myself, we're doers. We want to have our hands on the things that we can control, and we don't want to give out something to someone else and have to have— it's a lot of trust that goes into that, to say someone else is going to handle this thing for me. And it's a bit of an unknown, and it's something that honestly I want to learn myself. I'm actually interested in cyber because I think I can do this, and I've always wanted to do it. So now you're telling me I gotta go shop that out to someone else? Come on, man, I really want to do that myself. So there is that inclination— to do. And again, I want to come back to this. There's also that, um, there's been a lot of the— you mentioned the zeitgeist around pushing us to do something we're not ready for. So I think just really analyze yourself and spend some time talking about this in your teams internally and say, strategically, what can we handle and are we really ready for this? And the cool thing is you can always unplug from that as you continue to grow. You can always bring more things in-house. It's way difficult to start doing everything in-house, realize you can't do it, have to have the oh no customer-client conversation, we can't do this, we can't deliver this. How does that make you look? So that's some thoughts I would—

well, and I mean, to add on to that, right, I mean, from a tactical perspective, right, we're in budgeting season right now. We're all planning on how much money we're going to make and spend next year. And I think kind of distilling more of what you're talking about is build a budget for traditional R&D, right? Go into that MVP cycle, that minimally viable product, to I understand how I'm going to approach cybersecurity, what costs are going to go in from sales maturity, operations maturity, or financial maturity, so that when I deliver my cybersecurity practice, not only is it ready to go, it's ready to be packaged and it's properly priced to where you can make money on it. I now also know the ROI, which means how many cybersecurity packages I need to sell to start making money. So now I'm making strategic moves to say, hey, I'm going to do this the right way. Now, I think what you can distill from this is that's going to cost time and that's going to cost money. So if you aren't ready to make that investment, to offer that thing that I want to do, just because I'm a tactical professional, right? Then I have to have the maturity for my business, the security of my clients and my employees. Let's not forget about those guys, right? We don't put their jobs at risk or their raises at risk, right? That I mature step away from it and say, let me identify the risk that I can and pass it on to somebody else that can handle it because they have the right protections and products. In place.

Yep, yep. And I love it. The last thing you're making me think of is I think people are going to pause that and be like, wait a second, you're talking about budgeting, you're talking about forecasting. I'm not doing a lot of that at my MSB. I'm flying fast and loose. So maybe what would you say to people that are hearing that and say, well, how do I get started in doing that?

Honestly, if you're not at the point where you're forecasting and budgeting, then I don't think you know how much money you have to spend to develop a cybersecurity offering. If you don't know how much money you have to spend, don't spend it. Go work on your margins. Go make sure your current product that you currently sell really well is making you enough money to afford you a proper R&D cycle, a proper leadership team. And then when you are ready to start building a budget and you know how much cash is in your business, chances are— and you're gonna love this— don't spend it on cybersecurity product. Spend it on getting really good at selling your MSP or product right away. And then when you start hitting target market plateaus, then you go into product development. And that's thinking like a business owner. That's thinking like an entrepreneur. That's not thinking like a consultant who wants to do and be tactical. And this is a lot different than what you guys are used to hearing, but I can tell you right now, MSPs that are growing 30, 35, 40% year over year, they're not worried about what their professionalism of their career path as a technologist will bring them. They're worried about the return on investment of themselves as entrepreneurs. It's a totally different mindset. Now you do have to get to it, and I think you and I wouldn't disagree. You need to eventually build a vCIO product. You need to build a cybersecurity security product like my MSP. I built a whole MSSP, but I built it using the cash flow of my MSP, not through some debt mechanism where I was underwater and, you know, wanting to not sleep for weeks on it. Right.

That's a safe way to do it.

It is the right way to do it. And you know what I did in the meantime? I didn't do it. I didn't make the promise to my clients. And I'm not saying I'm the example by anything, but I didn't want— I had a lot of legal clients. That was my niche as an MSP. They know how to sue. They know how to bring you to court.

Yeah.

And I couldn't put that on my books. So what if you're not ready? What do you think are some easy ways to identify yourself from those asks that your clients may have that are in the compliance sector?

Yeah, specifically from a legal perspective.

Yeah.

So I think one thing is you've got to— you do have to be a student of your client, right? You have to understand their industry, right? So if they're sort of a non-regulated industry, that's a totally different category than clients that, for example, a bank, for example, healthcare, for example, even legal, potentially even Now CPAs and others with FTC safeguards that have come in. So you got to understand the clients that you're working with. Can I really deliver services to that client? I'll just give an example. As a bank, as a former banker, most of the time as an MSP, if you don't have a mature cybersecurity program yourself, if you haven't followed good cybersecurity frameworks that include getting into the maturity of policies and actually following those through and the maturity therein, you're not ready for a bank, right? You shouldn't be going and saying, hey, we can deliver this for a bank. Because when it goes south, you're going to have a hard time. And by the way, the bank is probably going to be smart enough to do enough due diligence on you to understand that you're not mature enough. So you can imagine getting buried in a month of due diligence work that the bank is just literally doing a full check on you, a full exam.

Or have a sales rep that's literally spent the last 90 days trying to close this. Yep. Yep.

Only to have that deal fail.

Yeah.

So do you really want that? Of course not. So I think that's partially where it starts, is understand the industry that you're working on. As you mentioned, build that niche, get really good at one or two industries. And then you can think about expanding from there. Making sure you have your own bases covered in terms of like cybersecurity insurance, right? Making sure you're doing the right things from a due diligence perspective so that word negligence doesn't slip in. So for example, if you're not monitoring your own tools, if you don't have the capability of like looking at the activity, like EDR rolled out fully and incident response yourself of understanding how we'd handle an incident when it happens at our own MSP, the last thing you should be doing is going and doing that for their clients, right? So again, eating your own tacos, starting this with yourself first. And I think the key to all of that is beginning with a security frame and really saying, this is the guidepost of what good looks like. Let's follow that, start down that journey. Let's make sure we're doing those things because then you have the confidence in knowing we are doing those things and now I can extend that to my clients.

Yeah. So guys, I think this whole conversation's really wrapped around having the discipline to take on what you can for your business.

Yes.

And do it when you are ready, when you have those protections in place, when you have those margins in place, then your business is ready. You need to earn that, which requires a lot of discipline, which is something that we have to work on more as business owners. This was fun, man.

I love that we're having this conversation because it's, again, it's the antithesis of what you hear so often of like, oh, you should do this.

It's only $1 an endpoint per month.

Yeah, buy my thing and it'll all work out, right? Yeah, this is a great conversation.

All right, guys. Well, anywho, we'll regain this. Stay accountable. See you later.