CISA's Huge Cyber Mistake! Once again, great ideas but HUGE ERROR!

Hey, hey, what is going on? Happy Friday! Is it really Friday? Sometimes I have to check and like take a look. It is Friday. I'm rocking a sweet new hat thanks to the Cyberfox crew, man. If you guys don't know, I am, uh, over at Cyberfox and just thrilled and pumped to be there. I've taken a new role as Vice President of Cybersecurity Strategy. Let me tell you, it's been some time in coming and I'm really excited about the opportunity. It's one of those things that for me is something, um, I've just been, uh, really excited about the opportunity for and excited about, um, kind of what's going to be happening there and what we're doing. And man, Dave Bellini and Adam, Adam Sletzkin, man, just two amazing individuals. And really not just Adam and Dave, I mean, behind the scenes there's just so many amazing people having so many conversations throughout the week and just getting started and onboarding. I'm telling you Really excited what's going on with the CyberFox crew. If you're looking to solve for privileged access management, cyberfox.com, check us out. Really doing some amazing things for MSPs across the world. And so just pumped to be there. I mean, I just wanted to start off leading with that. So let's talk about some of the things that are happening here. We've got some interesting news that I just— I wanted to break into and cover. And first of all, if you're listening today and there's a bunch of you on, And once again, Restream is doing what it's always saying. It says there's zero people on the stream, but my phone says that is not true. So say hi to me if you're here on the stream. Let me know you're listening. Let me know who you are. Say hello. I've got the comments open, so I'll be able to see you say hello. What we're going to jump into is some brand new data or really some news that's come out of CISA. So, Jen, if you don't know, Jen Easterly, Director of CISA, really big fan of Director Easterly. I mean, she's really awesome. She's done a great job in terms of advocating for cybersecurity. A ton of stuff that's come out from CISA, everything from some really cool open source tools that they've made, some really good research that they're communicating, some collaboration and help between the public and private sector. But let me tell you, once again, they're making the same old mistake. They're doing the same thing that they did last time that they're doing again, and we're going to be talking about that right there. CISA's huge mistake. And I want to know what you guys think about this as well. I want to get some comments from you. How big of a challenge is and when will they finally wake up? So what is that mistake? What are we talking about? Let's just dive right into the article. So this right here is from Sisa Travis. Good to see you on. I'm glad you're listening. And no, no worries, my friend. It's always good to be listening even if it's on a delay. So I see you there, and what's up, my friend? Um, okay, so let's take a look at this article here because it's some pretty interesting stuff. Um, what— oof, that's It's not working. Let's turn off the chat for just a second here. Uh, there we go. That's a whole bunch, a whole bunch of better. So in fact, I'll just do it this way. Okay, so let's take a look at what we see here. So this comes in from Dark Reading. Relatively few organizations have the resources for security programs and security professionals, so the US Cyber Agency is putting programs in place to help them while striving to understand the scope of the problem itself. Hard pause. Think about this for a minute. Do we agree? Well, of course we agree with this. I mean, in the sense of like, sure, small and midsize organizations can't compete. They don't have the resources. They don't have the staff. They don't have the knowledge. They don't have the budget that Bank of America does, that Sony does, that HCA Healthcare does. They just don't have the resources. We know this. We've known this for years, for decades. In the past 7 years, bad guys have taken advantage of it. We know that too. So what are we doing about it? That should be the question. The other question should be, what have we done about it? And I think there's a big— is it schism? Is that the right word? There's a big gap. Words are hard for me between what the private sector knows that needs to be done and what the federal government thinks should be done. And the reason for this gap, this schism, is because we're coming at it from different angles. And as in all things, those that are closest to the ground source of truth typically have a better perspective. You look at war, for example, getting intelligence back from boots on the ground is far more important to the generals making decisions than almost anything else. And this is the problem. If I could criticize CISA for one thing, it's simply this: they do not do a very good job at listening to the boots on the ground. Now, you may think I'm crazy, you may think I'm off my rocker, but let me prove this to you. Let me demonstrate this to you. Let's go back to the article and let's take a look at what's happening here. We agree that few organizations have the resources to do the right things. We know this, right? And CISA is trying to put programs in place. Okay, well, what kind of programs are we trying to put in place? Keith Barthold checking in. Chasm? Did I— what did I say? Did I say chasm? Maybe I said chasm. Keith, words are clearly hard. You're now my czar of words from here on out. So, Keith, thank you. And I still owe you a flight on your ridiculous airplane. So let's try to make that happen this summer. All right. Keith was telling me, if you haven't seen, if you're not following Keith Bardtold on LinkedIn, you need to. The guy is not just an awesome MSP owner, but a legit crazy person. He's like, hey Wes, why don't you get onto my airplane and fly? And I'm going to do this YouTube video series and you're going to be on it. But by the way, you got to wear a parachute. And I'm like, hmm, how is this going to work out? I got to sign a waiver and I got to wear a parachute just to get on his plane. Like, how is that going to go over well? Schism, chasm, chasm, chasm, chasm, chasm. I don't know what the right words are here, but, you know, like I said, words are hard. But definitely check out Keith, what he's doing. Awesome MSP owner. Thanks for checking in. And yes, I'm going to get on your plane, Keith. Okay, so let's, let's, let's cover this a little bit more about what we see here and what's missing, because you're going to see probably what I see, right? So every day attackers are attacking small U.S. businesses, election offices, local government agencies, hospitals, K-12. But most such organizations do not have the funding or the dedicated resources to defend themselves or even know that they're being attacked. Right. And so we read this and we're like, yeah, no doubt they don't have the resources. It'd be nice if they had the resources, but they don't have the resources. And they're— here's the thing, they're never going to have the resources. Just by being— nature of small business means you don't have the resources that everyone else Yes. So anyone looking at this is like, yes, they're not going to have the resources. So the solution in mind should be tied back to the assumption that they don't have the resources in place. In other words, if we say— let's use a medical analogy because I love to use these— if we say, boy, a lot of people really struggle with, I don't know, cancer. So the government's going to create this really amazing, super sophisticated cancer screening tool that you can use, and you've got to be able to like read chemistry levels and be able to take your own blood draws and all this kind of stuff. And now we got early cancer warning systems. What's the average American gonna say? You know what? We have a problem. You recognize the problem, but your solution is not geared towards the audience. I don't know how to take my own blood. I don't know how to read chemistry levels and all this stuff. If you're gonna try to make that the solution, then you've got the wrong audience in mind. The solution should follow the audience. And this is the big gist of what we're getting across in this article is everyone agrees that small businesses are being attacked. Everyone sees this. As, uh, Aaron Peters checking in— hey Aaron— they have the resources, they don't have the prioritization. In many cases, that's true. They— what do we focus on? What do we prioritize? But I can also say, because I work with a lot of small and business— small businesses, they don't have the resources, not in terms of like the technical capability. So like sometimes they're even bereft of both. Right. So we all agree this is a problem. I mean, I talked to— I've talked to probably 7, 8 school systems over the past few years. I'm sorry, past few weeks as I've been finishing up my time at Fifth Wall. And a lot of the K-12 school systems are a great example of this, right? They have like the IT administrator and they're dealing with the sprawl of thousands upon thousands of endpoints in their network. And that single IT person is supposed to keep IT systems up, keep them updated, keep teacher systems going, build computer labs and keep them going. And oh yeah, I guess you got to keep them secure on top of that. You can just add that like fifth little— that should be no point, no problem, right? Of course, K-12 is being hit left and right. An open school environment, challenges with teachers unions, lack of budgets for controls, dealing with boards who just don't have the budget or the knowledge of it or understanding to like do something about security. No doubt K-12 has been under attack like never before. We know that. So we agree with the problem. So CISA aims to help these cyber poor places. So that is a direct quote from Director Easterly, cyber poor. And this gets into a little bit of this, this topic that's been brought up over the past decade, this idea of the cybersecurity poverty line. And I want to know from you guys, what is the cybersecurity poverty line in your mind? In other words, what, what do we do who are cyber poor and what is that level of cyber poor? I think this idea of a cybersecurity poverty line, first of all, I wasn't the one to create the term. The term has been around for 10 years or so. You should Google it. I can't remember the, the, the, the security researcher and lady who created it, but she's a brilliant person. And I like the idea of a cybersecurity poverty line. And the thing is, that poverty line is shifting all the time. In fact, 10 years ago, I think it was fair to say a cybersecurity poverty line was probably antivirus and firewall. Like, that's the minimum standard. And if you don't have that, you're below the poverty line. If you at least have those two things, you're at least at the poverty line. Like, it's not great, but at least you got the minimum standard. Well, what's today looking like? Today, the cyber poor poverty line is gone way higher. There's inflation, right? Let's use this, this economic advantage or this idea. You know, maybe the median income salary 15, 20 years ago might have been $30,000, $40,000 a year. If you're making that much now, it's hard to survive because of inflation. Same thing in cybersecurity. We've had inflation come in, and that inflation of raising the minimum standards is because we suffer from a threat actor who knows who we are, who is operationalized against us, and has discovered just how lucrative and honestly easy an MSP or an SMB is to attack. So we've had a shift in the poverty line. So I want to know from you, what is the poverty line that you see? I'll give you some examples of what I consider to be the minimum standards to be at the poverty line. First thing is you should be doing multifactor everywhere. Now, I hear you and I know this. Multifactor is bypassable. There are fatigue attacks, there are API-based attacks. There are ways we can bypass MFA. Sure. But until Microsoft comes to me and says, hey, you know what, 99% of the attacks that we see could have been stopped if we had multifactor in place, until we see them come in and say a different story, like 40%, I'm going to continue to say we need MFA in place. It's like this idea of, look, I know of somebody that got in a wreck and they had their seatbelt on and that caused the fatality. That's sad. But does that mean we turn— it's really sad. But does that mean we say seatbelts are terrible? No, we know how valuable they are. Oh, hey, Ron, checking in. Oh, he's referring to all resources, not just internal. Yeah, totally, totally hear you, my friend. Totally hear you on that one. So, so that's one. MFA everywhere is one. Another one that I would point to is EDR everywhere. We know that EDR platforms are one of the most important things you can put in place. If you want an example of an awesome EDR platform, platform, check out my friends at Huntress. Not being paid to say it, get $0 out of it. I just know they're awesome. Big fan of Huntress. They're an EDR platform that can actually look for footholds and see the beginnings of bad stuff happening before the real bad outcome happens. So EDR everywhere is the new minimum poverty line. Vulnerability management, like literally scanning your networks for vulnerabilities and having a patching hygiene regimen in place, not just like, oh, we just enabled auto updates on Windows, but actually looking for vulnerabilities, that internal and external. That's the minimum poverty line. Identity management. What we're doing at Cyberfox. Who are your users? Do you have admin sprawl everywhere? Because if you do, you're not going to lock your house down. The instant the bad guy gets even minimum levels of access to a machine, bad things happen. The fact that they can install anything, bad things happen. Cybersecurity awareness training. Another example, look at my friends at PHIN, finsec.io, P-H-I-N. Awesome. Some other great ones out there too. But look at FIN for security awareness, what they call human vulnerability management. How are we training our users? These are the things that come into the poverty line. There are others, and I'd love to know what are the minimum standard poverty line issues that we need to have in place for small and mid-sized business. Keith checking in. Minimum requirements for cyber insurance applications are a great place to start that cybersecurity poverty line. Indeed. Yes, I agree. That's very well said. In fact, I'm going to give you a link right here because I think it's a really valuable one. This comes from Fifth Wall. And one of the things that we've done at Fifth Wall is we've created the minimum standards that all the carriers need because Fifth Wall is looking from that perspective of 40-ish carriers they work with and they looked at the minimums for all of them. And here's— here they are. Let me take— let me show you these. These are the minimum standards right here. Let me scroll over and let's take a peek. Why is my browser Not updating. Well, that's sure weird. Oh, here we go. Share this tab. Okay. New updates only show one tab at a time. That's pretty— thank you, Brave, and your new updates. Good to know that. So here we go. So here are the minimum standards according to Fifth Wall. If you want access to this, 5 Practices That Lead to Cyber Insurance, or just DM me, I'll get you a link. But here you are. MFA everywhere, segregated backups, EDR, next generation antivirus, cybersecurity training for your employees. Those are the standards. Those are the things that we— Travis, I can post. I don't have posting ability in here in directly. So but just DM me and I'll get you a link over to this, to this article. Right. So those are the minimum standards, the things that we need. Okay. Now, the reason I show all this is because this minimum cybersecurity poverty line is not the level that you should adhere to. It's the minimum level that you should accept. Right? So if you're talking bank, you're talking to healthcare, you're talking to a manufacturer, you're talking to a large non-regulated entity, you need to go down this discussion with them of like, what does the minimum poverty line look like and what's your, your acceptable standard? Travis, thank you, that is the link right there. Yeah, thank you for posting that. So click on that link, you can trust Travis, it'll go to a nice safe place, I promise you. All right, so, so these— I, I throw these out there because we need to really define the minimum poverty line. Now let's get back to the article. All right. Let's jump back into this guy. Here we are. So cyber poor, you know, dealing with all that. Agency continues to work. And they mentioned this, that typically the CISA has really just worked with large companies. And that's, that's pretty true, right? They've really been focused on large orgs like— and that's not helpful in this conversation, right? Large orgs need help, but really the small ones do even more. The goal for CISA is to understand their needs and what they need to be able to invest in security, where CISA can help them defend in their capabilities. Again, we all agree with this, right? That's a totally agreeable statement. But how can we help a school district or a small health hospital or a water facility using free services, using assessments, using things like our cyber hygiene and vulnerability scanning? If you didn't know, one of the things that CISA provides, which is awesome, is vulnerability scanning from the external side. You can sign up for free and they will give you free reports that come out of that. Pretty awesome. But again, I come back to this. What is a small water utility in Nowheresville, Kentucky, know what to do with a vulnerability scan that comes back from CISA? Remember, this goes back to if you just joined us, we're talking about this idea of a— of what CISA, they're trying to help the SMB space but they're missing and forgetting about how we solve it. So great, give me a vulnerability scan report, but you're assuming that we have somebody that works there that knows what to do about it, knows how to read it, knows how to interpret it, knows how to prioritize it, and knows how to address the issues that come out of it. And let me tell you, most SMBs don't have that capability. They don't have that person. Even if they have that person, that person is overworked and under— overwhelmed and just doesn't have the ability to tackle all of this stuff. Right. So this is the problem that we have. So you guys know know where I'm driving at here, right? Director Easterly went on to say, can we help them reduce the threats? So we're trying to spend a whole year doing this, and at the end of the year we'll see if we've been able to make any difference. Let me just say something hard and fast right here on this live stream. There is but one KPI for us to look at to know that at the end of this year if they've done it right. And you know what that KPI is? Did you include MSPs directly, deeply, and intently into your analysis of reducing threats. So at the end of the year, it's this simple, Director Easterly. I'm just telling you, I wish someone would share this webinar with her. If you don't include MSPs in the centerpiece of this solution strategy to help SMBs reduce their threats, you failed straight away. It's an A or an F. There's no— it's black and white. Now, I realize not all SMBs use an MSP, but almost all of them do in some form or fashion. So if we don't include MSPs into our strategy, CISA, we failed from the get-go. Going back to that analogy, if we're expecting— using that cancer analogy, if we're expecting patients to be able to self-diagnose themselves and know what to do with cancer, we're missing the boat. So we shouldn't give that tool and that research for cancer to the end user. We should give it to a doctor who knows how to interpret it and handle it in the same way MSPs are like that doctor for their SMBs or for their patients, the same exact thing. So I applaud what CISA is doing and I'm so glad and thankful that they're finally saying, you know, these small businesses are under attack like crazy and we've seen way more damages in the SMB sector than we have upmarket. It just when you aggregate everything. So let's focus on them. But you're missing MSPs. How do I know this? Let me just do this for you. Ctrl+F MSP. You can't see that, and I get 0 out of 0 hits. Literally, the word MSP does not come up in this article. Now, it could just be Dark Reading is missing MSP, but I know they're not because they're quoting everything that came out of this meeting, this conference with Director Easterly. I just have a problem with this, and I'm curious to know in chat, give me some comments. Do you guys have a problem with this as well? Like, here's the deal. If I am in Director Easterly's seat— again, I'm not criticizing her, she's done a great job— but she and her staff are missing the key critical element. You do not secure the SMB sector until you include MSPs, period. So I'm just thinking, looking at this, like if I'm in her shoes, what I'm saying is all the things she said, we're going to focus on helping them. We're going to provide free vulnerability assessments. We're going to spend a year looking at this and helping reduce threats. And the way we're going to do this is we are going to be working part and parcel, hand in hand with MSPs. We've actually assembled a whole team of advisory MSPs led by my good friend Jason Slagle, is how I would do it. And we've gone down this journey to help and start. But it's not here. That comment does not exist. And that's a problem. It's a huge problem. So let's continue to look at the article because there's still some good stuff in it. But we have an audience problem with CISA. So the focus on smaller organizations acknowledges that SMBs, local government, schools, etc. have been overlooked. The government always tried to do these public-private partnerships for quite some time. But they typically focused on the large side. But look at the problem with this. Especially ransomware gangs have hunted for smaller groups who do not have deep cybersecurity resources. These groups are numerous. 99% of all businesses in the US have 250 employees or less, and pretty much outside of a bank, pretty much other than banks, any org that's 250 or less probably doesn't even have one dedicated security resource, probably couldn't even tell you what EDR stands for, probably couldn't even produce a vulnerability scan report if they asked. Probably couldn't. Eddie Phillips checking in. I'm skeptical that an SMB would dedicate the training resources and commitment to security that an MSP would, but I might be a bit biased. No, Eddie, you're right. So, I mean, that's, that's it, right? They are not going to do it because they are not going to understand the threat until they have been attacked. Here's the problem with security. I've been saying this for years. People don't care about security until they care. And when they care, it's because they've been forced to care, because they've been hit by something and they point their finger at you and say, how could you have let this happen as an MSP? So, Eddie, you're completely right. I 100% agree with you. You've got to have an MSP in place that can train, that can teach, that can educate, that can show a security roadmap and show here's where we're at, here's where we need to get, and here's how we're going to get there.. It's not going to be cheap, but it's also not going to be something you can't afford either. We can do this. Only an MSP can solve that for the SMB sector. Only. I know I'm speaking in black and white today, but it's pretty much true. Travis checking in. You should try having a cyber insurance claim without an MSP or at least a dedicated security person. It's rough. This is just like that. You can't tell someone to do something they don't know how to do, especially around technology. Yep, totally agree with that. This is— I love we're seeing this audience. You guys are just rocking it today. This, this— you guys see the problem as I see it. So let's jump into this article just a bit more. Really great feedback. Thank you all for this. So 99% of small business is 250 employees or less, which means they don't have a security resource. And if they do, they have one. So they still want— they're still not doing security the way they need to. We really tried— I quoted this here— we really tried to shift the paradigm from decades of public-private partnerships, which frankly were episodic and unidirectional and not necessarily the right type of mechanism that we needed to defend the country. Correct. So she's saying we're doing this periodically here and there, we seem to need them, and it's sort of unidirectional just for all the industry involved. We're not focusing on industry sectors, we're not focusing on size of industry. Correct. All of this is correct. It's been very like just throwing it out there. Oh, here's a burning issue. Let's deal with this. Oh, here's a hotbed, you know, threat actor doing something nasty. CISA, put something out on it. But they haven't really— it's been episodic in nature. So completely, completely agree with this. It's been a problem. So now to get into part of like what Director Easterly's solution kind of is in mind, right? And before I get to it, let me get back over to this quote from my good friend A-Aron. Even when they care. They still don't understand how to remedy it. I agree. Like a doctor being required to perform their own CPA audit. Very well, that's a great analogy. They can speak the words all they want, but they didn't get into business to be a CPA. They got into business to heal people. Yes, it goes into this idea of like who, not how. My good friend Kyle Christianson always talks about this— who, not how. So if I'm a CPA, I should be wanting to handle finances. If I'm a doctor, I should be wanting to handle medical stuff. They don't want to cross paths. I want to go find someone that can help me so I can do the thing I do best. That's the key. That has always been the key. You're exactly right, my friend. Hey, hey, Ron, uh, that's exactly what we're trying to solve here. So MSPs need to be able to communicate that to the client. Hey, look, your job is to build these widgets for this contract. I love that. Good for you. That's how you make money. My job is to help you to be able to do My job is to let you be able to grow and scale and be efficient and not have outages and deal with any external risks that you may have so that you can continue to grow and scale your business. I'm an enabler for you, Ms. Client. That's my goal. That's my job. Very well said. Doctor's job, same way. I'm here to keep you alive so you can live a wonderful life. So very great quote from there. Totally agree. So here's the government's approach to this is this idea of NIST. National Institute of Standards and Technology. It's considered the gold standard for communicating a cybersecurity plan for a business. The document is hard to understand and implementation is difficult. Yes, it is. Have you ever seen the NIST CSF? I'm— look, I'm a big fan of it. I've been talking about this thing for years, but it's very, very, very descriptive. It doesn't tell you exactly what to do and how to do it, and it certainly doesn't work downmarket. Now, why is that? Let me just tell you why it is. The CSF, as awesome as it is, was created in 2013. It was created by government and help from large industry because in 2013, small business wasn't under attack and wasn't a target like they are today. So I'll just say it verbatim. SMB was not in the audience of focus when the CSF was created. When President Obama put his directive out to issue out a national cybersecurity standard, SMBs were not considered. Let's just be honest, call a spade a spade. They weren't really considered in this. And so this is why when it talks about you should do all these things and have a process for this and people for that, people like, I don't know what that means nor how to do it. That's okay. Like at the end of the day, what do we talk about in the startup world? We talk about this idea of iterating to success. So we did something for a while and didn't— it worked for a while, but it could be better. We iterate to fix. We threw something out there, it didn't work well. We iterate and correct, right? We fail fast to succeed. Unfortunately, the NIST CSF is fail slow and not succeed because what should have been done within— as soon as 2018 and 2019 rolled along, they should have immediately come out and said, you know what, we're going to create an SMB version of the NIST CSF. They never did. And so this is why the CIS controls have become so popular downmarket because the CIS controls, if you don't know what they are, they are a set of very prescriptive controls. Do this, do this, do this, do this. It's literally 18 of them split into a bunch of subgroups with a beginner group, a medium group, and an advanced group. They call these implementation groups. By the way, if you want to know more about all of those, just jump into Empath Cyber. There is a link right there to Empath Cyber. I'd love for you to join in if you're an MSP and you're trying to like get better at cybersecurity. I know Matt Lee He says don't scan these. So if you don't want to scan them and make Matt Lee happy, which I totally get, just empathcyber.com/join and you can jump right into Empath Cyber. It is all about helping MSPs solve this stuff. I don't know what CIS is. I don't know how to communicate it. I don't know how to speak it. That's what Empath Cyber does. Empath Cyber helps everyone in the organization, organization, the MSP, speak cyber better. It's a training platform and it's a community built for the non-technical, built for account reps, VCOs, and MSP owners and directors, service level managers, anybody that needs to speak cyber and doesn't feel comfortable with it. What we're talking about today, that right there gets you there. Empath Cyber. I'd love to have you join in empathcyber.com/join and you can jump right in. I'd love to have you. Right. So I'm speaking that because CIS has become so important and a lot of MSPs don't really know how to leverage it because of that reason. So going back to this, look what they said about the CSF. Because they know that it's been so difficult, CISA has introduced the CGs, the Cybersecurity Performance Goals. Now, if you don't know what the CPGs are, let me just tell you a couple things. One is at Empath, we did a full deep dive into the CPGs. If you would like to see that, DM me. I will just, just give you a free copy. I've got it available for you. You don't even have to join member. Eric, thank you. He put a link right up there. Empath Cyber thecyber.com/join. Thank you, Eric, brother. The CPGs is a, is a way that they sort of said, you know what we're going to do? We recognize that this monstrosity of the cybersecurity framework is so difficult downmarket. What do we actually focus on? On these pages and pages and pages of do stuff. What's the most important? Where do I start? Well, A, the CIS controls have already solved for that. But B, because the NIST CSF needed this solution, they created the CPGs. Now, I'm a big fan of the CPGs. I'm not going to go into it today. I could do a livestream on it later. And if you want a copy of what I cover, just DM me and I'll give you a copy. But the CPGs cover kind of like, I think it's like 8 of the most important pieces of the CSF which have the most bang for the buck. And I think that's awesome. But you know what? We still have a problem. You know what that problem is? I can give those CPGs to a, to a client, to an SMB, and I can say, these are hard. I'm sorry, these may look hard, but these are the things you want to address. And they look at that and go, well, I don't even know how to like disable admin accounts. So like, thank you for sending this to me. I guess I theoretically understand what this means and I understand how you're saying that this is like in the red as far as like one of the most important things to address because the CPGs told me it's a critical issue. But how do I do that again? So you see how we're missing this? Like, I applaud the CPGs. I'm a big fan of them. But once again, we're missing the audience. We're missing MSPs out of this. This, and it's a huge problem. The CPGs have really helped in terms of, again, an easier, simpler metric that these INS can use to help drive down the risks. But only if we have an MSP that can help them do this. Otherwise, they're still bereft of the ability to do anything. Ransomware is a particular focus. We know this. CISA has created a vulnerability warning pilot that enables the agency to scan private systems and come back and say, hey, look, looks like you've been hit by something. That's awesome. But again, what are they going to do about it? We get these tips and they said, you know, we've got this ransomware, you've got this bad stuff on your network. You need to do something about it. So here's my, here's my closing thoughts on this. I'd love to see that CISA has woken up. They've gone from we have these threats, we're going to focus with big companies to solve them. We're going to give you an awesome GitHub repo where you can download free access to a lot of our tools. We're going to have vulnerability scanning stuff. We're going to be doing threat intelligence and publishing threat briefs and reports. And they've done all this and yet no real impact from CISA downmarket. None. Ouch. That hurts. Maybe what we're doing isn't working. So they've come back and they've said, I guess we got to do something with SMBs. So we're going to focus on them. Good. But I still think they're missing the MSP. MSP is the only way we fix this. Really. A quote came in here. Let me see if I can read all this. Let's see here. MSPs got into business to protect other businesses, to negate what an MSP does in any plan will not garner the results that they're looking for. Yep. Do you think that the MSP space is considered fad or snake oil by regulation bodies? As imperative as this model is, I think we're still playing catch up. Think the audio industry. Think about the auto industry. Auto insurance wasn't even a thing literally until it was understood that cars are only going to be more prolific and they would impact the infrastructure of our safety. Good point. Then regulation came down and required it to be required for driving a car, but it wasn't from a Fed level, from a state level. So does industry— oh, industry level. Yeah, yeah. It's like a state or a self-governing organization. Right. And does not recognize the MSP then as an MSB, SMB help the number. So I got a little lost in the end of that text. But yeah, that's a great point. Right. So like I think what we're seeing is in motion here, A-A-Ron, to your point, a lot of this happening, right? We— I covered just a while ago and we saw the National White House Cybersecurity Strategy come out and there's some focuses in there. And one of those focuses is we're going to push to software manufacturers liability. We're going to try to do that. And then— but how do we actually determine what makes something liable and what doesn't? Well, in a lot of other industries, we have self-governing organizations. Think about attorneys. Each state has their own bar association. That is what determines what an attorney is. They have the ability to grant and revoke your ability to practice law. It's a self-governing organization. Do MSPs need something like that? I argue yes, we do. But this is a great point that Aaron makes, is that we— many of us that are like leading the edge here would all agree, yeah, we need a self-governing organization here. Let's get in front of it before the federal government does. The problem is we're not ready for it yet, and I think Aaron's right here. In the sense of like it took cars a long time to become the standard. We're not getting away from this. It's not a fad. This is the only way we're going to travel in the future. Therefore, we better figure this thing out. I agree with Aaron that I think we're still getting that positive momentum. We're still seeing MSPs prove that this is not a fly-by-night industry. It is here to stay. And I am telling you, it is here to stay. I'll stake my reputation on that. MSPs are not going anywhere. Sure, the makeup of an MSP might change and how big they get with private equity coming in and mergers and acquisitions, but MSPs aren't going anywhere. So I totally agree. And so I think we're still years away from a self-regulating organization, but that is the best outcome for us. That way we can establish what does it mean? Just like we have a poverty line for security, we should have a poverty line or a minimum standard to be an MSP. You can't use the term MSP until you hit this particular standard. So this is great stuff. This is really good communication. This is really great collaboration here around all of this. I just wanted to dive in at the end of this weekend and really get your thoughts going to really start to consider what this means around minimum standards. Travis, please do. I'd love to talk to Jim. I don't know him, but I would love to do so. And just so you know, I and some others are working with some groups from MITRE and CISA. Jason Slagle, who I mentioned earlier, actually went to D.C. around some discussions around how do we protect the RMM, which will sort big downmarket consideration. Um, I won't put words into his mouth of what his thoughts were post-meeting in DC around that. I'd love to see him— he may have already done a livestream. And Jason, if you're watching this now, or anyone's aware of it, link to it here. Um, but traction is being made. So Travis would be happy to talk to anybody in those circles. Traction's being made. I'm not a hater of CISA. I'm a huge fan. But I will call out areas when they miss it. And I think that's too— it's a crit— it's a— I'm doing it critically to help, and I, and I think we all are. I welcome CISA to continue to help, but the beginning of this conversation starts with an MSP. Eddie checking in: my barber has to be federal— federally licensed. Why not an MSP, right? Yeah, good point. Fair point. Fair point. So there you have it. I hope you guys have an awesome weekend. I'm going to stick around just a little bit longer in case anyone has any questions, has any additional thoughts. You're they're quickly firing out to get out there. But I guess let me end on a positive note. Even though I think SISA is still missing the boat because they're missing the audience of the MSP, they're getting there. They're moving in the right direction. I think eventually they're going to recognize the criticality of the MSP, and I think given enough time, they'll begin to be considered, and I think we'll see some positive traction. But the ultimate goal and outcome of a self-regulating body for MSPs, which is what I think we all want, I think to get there, I think we're going to need— it's going to— we're going to need some time. So there you have it. Travis, best email for me? Wes at empathcyber.com. Wes at empathcyber.com will get me there. And I guess I'll just end on that. If you guys are looking for an awesome platform to learn and grow in your MSP journey, me, check out what we're doing in Empath Cyber. Just a super quick 30-second peek at the platform. It's really pretty amazing. We have all kinds of content. We have courses galore. These courses are teaching you all kinds of things, like I'm new to my MSP, what are all these, these things that we're talking about, how do I learn what they are, what is application whitelisting, what's the future of antivirus, what's spam filtering, what's multi-factor authentication. Every single one of these has a video that comes with to teach you how they— how you use them, how you think about. I've got a course on Intro to the Cyber Defense Matrix, which is just an incredible course. We've got one on cyber insurance. We've got some soft ones like what I call the birds, the bees, and the breaches— how to speak and have a hard conversation when the time is right, um, with a client who doesn't want to budge. Everything in here is all video driven, so it's really fun, easy to watch, easy to consume. We do lots and lots of events as well. If you click on events and you go over here, we do We do lots of trainings and lots of things together all around interesting things like data flow diagrams in your sales discussions, looking at other MSPs who are doing a great job, like Bob Miller from Global Data Systems sharing his cybersecurity maturity levels. Really good stuff. We do ask me anythings. Many of my members say it's the most important part of all of Empath Cyber is all of that. We've got chat galore. We've got all kinds of things coming up. We've got video content that helps you in your journey. On all kinds of things with MSPs, and we're just bringing you into a community of peers to help you get better. By the way, there's the CISA CPG. So if anyone wants access to this guy and wants to see more about it right here, I'll give you a copy of it if you want to see it and take a peek at it. But if you want to join us, empathcyber.com/join. Happy to have you in there. Happy to get you in. And I'm telling you, it'll take your MSP to the next level. All right, my friends, this has been super fun, super helpful. I am encouraged, even though they're missing the boat a little bit, CISA is. I think given enough time and given talks like these and us all continuing to preach the message of MSPs are the future for downmarket, it's the only solution that we have and it is the best solution that we have. This is how we make progress. I hope you guys all have a great weekend. It's been so good to talk to you all. Tell your boss if you're still working, Wes Spencer said you can go home and begin the weekend. All right, my friends, thank you so Very much.