Cyber Roundtable: RMMs! or RATs?

That's some bumpin', bumpin' music right there, guys. We are live. We are excited to be here this afternoon to talk about some, some new stuff we see going on in the cyber world. Wes, you already brought it up, we got the chat up on the side. So if you got anything to say, anything to add to the conversation, any questions, comments, we'd love to be able to respond to those and have you engage in the conversation. Before we get started, we got a couple of people here that we want to all get introduced. So my name is Will. I am in cyber insurance. I work for Fifth Wall Solutions. Excited to talk about— we're gonna be talking about RMMs today. And we'll dive into what all that means. But if everyone wants to go around and introduce yourselves first, that would be awesome.

Yeah, sure. Uh, Reg Harnish here, founder and CEO of Orbital Fire. We are a cybersecurity services partner for MSPs.

Uh, hi, Jimmy Hadsall, um, VP of revenue for QuickPass Cybersecurity. We're a privileged access management tool for MSPs.

I'm Robert Chiaffi, the CTO— wish I could get my title right— CTO and co-founder for Progressive Computing, an MSP based out of Yonkers, New York.

Rock on. You got Wes Spencer here. I am a jack of all trades with Fifth Wall Solutions and Impact Cyber. Great to be with you guys.

Great. So we want to engage in this conversation. There's been some stuff recently that's come out concerning RMMs. So we can talk a little bit about what those are, um, and maybe— I mean, it's always good when we start a conversation like this to define our terms, especially for someone listening in who might not be in the direct tech space. So, uh, whoever wants to jump in, what is an RMM? And then we can kind of get into why we're having this conversation in the first place.

How about—

I was about to say, can I pick on Reg, given I don't think a lot of people, Reg, know your background? So I'm going to pick on you. Tell us— there we go—

a snippet of your background, my friend, and then give us your definition.

Well, you know, I think it depends on the circle, but I actually started a company in 2000 with Kimbal Musk, Elon's brother. It looked a little bit like YouTube, exited that. But after that, I was one of the founders of Autotask. And then fast forward, I was also the founder and CEO of a national cybersecurity professional services firm called Greycastle Security. And in 2020, started a company called Orbital Fire, which our focus is exclusively delivering cybersecurity to small businesses, but partnering with MSPs to do that in a way where we are all sort of in our lane.

And, and I love, even though Autotask is a PSA, I think you're closer to the ground source of building any of this than probably the rest of us combined. That's why I wanted to call you out on that, Reg.

I, I've forgotten all that, I promise you.

You're so humble because you, you never talk about it, which is awesome. So, okay, now What is an RMM in your own words? We're going to start with you.

I mean, for me, I think it's a hammer. I think it's a hammer that MSPs use to do a job more quickly, efficiently, hopefully more securely. But I, you know, I think it's become one of the mainstays of the industry for a lot of good reasons. There's huge benefits to these tools and platforms. And even though we don't use one, ourselves, and actually we don't have access to our customers at all. We are— we work with countless MSPs who are, and in terms of like best practices and, and how can they help us, again, we don't have access to customer infrastructure, so oftentimes we are the benefactor of our MMs.

So Wes, I, I would add that, and maybe I would be challenged on this, but an RMM almost defined an MSP or allowed it to exist, right? Because as an MSP, I'm not sure how we could deliver all of our fixed services and all of the other protection and other layers of IT services that we provide without an RMM tool. I mean, it's what enabled us to adopt this model of a fixed monthly price agreement to handle all of our customers' IT. So it's an indispensable hammer.

Glad we got the only one on the call actively using an RMM daily to speak up on that one too.

Yeah, that's great. So I guess it's good for us to talk through this, understand why we're gathering together as kind of a roundtable. One of the things we're going to talk about is Um, well, I guess we can, we can go to the actual, uh, post here. Um, one of our own, um, Jimmy posted this the other day. Wes, can I share my screen on your thing? I think I can. Yeah. Okay, cool. Um, now I just got to find the right one.

I'll start talking about why you're pulling up.

So basically, yeah, that'd be great. Thank you.

Uh, a CISA advisory And basically what happens is all of the big, you know, three-letter government agencies, when they think that a big security incident worth telling everyone out about is worthy, these CSIRT advisories come out. And basically this one said, hey, everyone needs to watch out for these RMM tools. They didn't say that they got hacked. They didn't say that there's a zero-day or a flaw in them whatsoever, but they're saying hackers are using them to get into people's systems. Specifically for this one, what they were doing is they would basically get into a user's system with an RMM tool. They didn't need admin access to open it because it was running as a portable app. And then they would like talk the user through going on their bank account. And then on the page that they're editing, they would like inspect element, change the numbers in there, and then like convince them to wire money. Like nothing fancy, a tale as old as time. But there were some things in this advisory that are worth noting. Yeah, it's— she's actually advised to disable a lot of RMM ports and limit services. And they were kind of basically saying that you should, you know, have a whitelist-only philosophy with RMMs, which is good advice. But there could be potential backlash or fallout to the MSP community on it. And that's sort of what I talked about there. And then everybody on this call here sort of chimed in. I think, you know, Robert, Reg, Wes all came in with, with great comments, and that's why we're on the call here.

Yeah, so I, I guess as the, as the, the cyber insurance guy here, and that's pretty much my, my only background, it'd be helpful to, when we talk about specifics of these RMMs and, and how, why, and how they all came into, um, or why this is on alert all of a sudden, right? The, the specific issue, what happened, what we see going on, what's our, what's our response to this, what are some of the ramifications, and what, what could we be seeing down, down the pike? And maybe we should go into, um, some of the specifics of what happened, but Yeah, I think—

go ahead, go ahead, Wes.

Well, I was just going to say, I think Robert probably has a very unique perspective on this, just given your background.

Yeah, you had to bring it up, didn't you?

Well, sorry, but not sorry, right? But I think a lot of this goes down to what Mark said here, right? The risk of an RMM. It's a distribution method. Should we kill email now too, right? It's a tool. It even goes back to what Mindy said, if I can find it. You know, it's a Swiss Army knife. It's a— as Mindy said, it's a tool for remote management and endpoints it at scale. But, you know, you put a knife in my hand, I can, you know, slice up a really nice meal. You put a knife in my hand, I can also do some really dangerous things with it, right? It's a tool. So Robert, I'm curious, kind of your thoughts on that, that whole component, just given, um, you have some unique experiences.

Yeah, so for the listening audience, probably a lot of you may know, uh, we were part of the whole Kaseya VSA incident back in July of 2021. So our RMM was compromised and we didn't do anything wrong. We had all the security settings all set up properly. It was a backdoor exploit that they used to get in and distribute ransomware. So it was using that knife for, you know, with a lot of bad intent. So, you know, we feel that pain. My customers felt that pain immensely. But this was nothing new, right? As far as, I mean, this was a concern that we had as an MSP and in all of my peer groups, a discussion that had been going on for years. In fact, I was not the first company to be affected in this way. There were many other MSPs prior to that that had similar incidents over years. So we all knew it was coming. It was just a matter of time before it happened again. And, you know, it'll happen even further than that, right? It's like when my mom hears that I'm about to take a trip someplace and she's telling me to be careful, right? Like that I'm getting on an airplane. I'm like, you know, I got to get on an airplane. It's a tool, right? If it crashes, like, what am I going to do? It's just part of life. So I think, you know, in this case, what my comment was that I think what prompted Jimmy to invite me into this was I'm thinking there's got to be some additional things that we can do as RMM operators, but that the RMM developers need to incorporate that sort of validate that we are the person who we say we are, right? Like, there's got to be some sort of credential or kind of like the way we visit a website and see the S for HTTPS, right? Users, just the average everyday user, already kind of knows that it's ingrained in their mind, oh, it's secure, right? There's got to be— and, you know, I'm not the smartest guy in the room to figure that part out— but there's got to be a way that validates that I am the person I say that I am and that I'm not an imposter or someone who's not authorized to be using this tool.

I also think it's, uh, we have to look at the net here because whether it's a knife or a hammer or anything else, I think banning RMMs probably defeats the purpose. You know, the, the very folks that we're, we're in the business of protecting, I think, suffer from that. So I think it's important that we look at this, you know, what are the positives, what are the negatives. No doubt tools like RMMs come with their, their own risks, and as operators, I think the industry needs to take probably a greater stock of what those risks truly are. Which for me comes back to the really the crux of this issue, which is managed service providers probably haven't done an effective enough job at understanding their aggregate risk. And what I mean by that is if you are 5 people, you know, working at an MSP, but you've got 20, 20-person companies, guess what? All of a sudden you're a 400-person organization. And I think I probably did the math wrong, but you get the point, uh, that your risk, because of the connectedness— meaning, you know, for us, connectedness in itself is a vulnerability— and so aggregate risk needs to be considered when you're operating these tools, or even when you're making the decision to utilize one in the first place, because it's not just the risk that it introduces to your organization, but rather in aggregate, what are the other potential, you know, risks in the picture? And I think it's a difficult thing to do, honestly. And but I think that that conversation needs to be had a little more often.

I agree, Reg, because I think to illustrate that point that you made is it's not just the RMMs that have been picked on to deploy ransomware. We saw, I think it was Webroot a number of years ago, and bad guys got access to their platform and nasty things happened. And I think we'd be shocked to know the number of vendors that have access deep deep level access to our, our networks and do have command and control capability in one form or fashion, whether it's to do, you know, purely updates and things like that, or, um, you know, even more, more capability. And I, I think, Reg, that goes back to that need to really understand, you know, what level of control and access our vendors have and how they try to gate that, that capability. And I think with this push of brand new automation platforms that are all hitting the market now, that's going to continue to become a bigger and bigger concern.

Yeah, I agree. I, you know, I think, and also small business customers shouldn't get a free ride here. Ultimately, third-party risk is their responsibility. And so as MSPs and small businesses are engaging, it's got to come from both sides. The MSP has to be aware of the risk that they're introducing, and the small business needs to be aware of that same risk so that both sides can make informed decisions about what level of access or, you know, what kinds of functions and activities are going to be allowed in the, you know, in the spirit of delivering these managed services.

Yeah, definitely.

So we're all in agreement that like there's a good place for RMMs, you know, you need the Swiss Army knife to open the can, right? It's just you can't bring the— you can't always bring it into the airport, right? You can't always get through TSA security with it. The scary thing here for MSPs is when MSPs tools make the news, it's pretty consistently, consistently RMMs, fear of breach, fear of hacks. And the fallout from that isn't necessarily like, you know, like maybe people will be scared to use MSPs. The potential fallout is, oh my God, we're a cyber insurance provider. We're a big agency with tons of franchises everywhere. We're not going to let anyone using these tools work with us, period. And then MSPs get pushed to the side.

Agree.

Yep, agree.

What's the line? If it bleeds, it leads in news. These are sensational stories, right? I think when you have an RMM compromise or some other tool, especially if it has, you know, the blast radius is very, very large. It's going to make the news and it's going to get sensationalized. Wes Spencer, you started out half jokingly but also half serious with, well, shouldn't we ban email? Because as far as I know, and maybe my stat is wrong, but 85% of all attacks start with an email phish. So if we're really going to be sensational, let's look at that number and say, Well, let's just stop emailing each other because that's, that's the really the biggest way that people can get into our systems. And so for me, it's an overreaction. While we should take these incidents very seriously and up the cyber conversation and the security conversation with the use of these tools, better, better controls, better— what is it, the SBOM, right? The Software Bill of Materials to know what's in this software. To know how it was constructed, you know, how much legacy is in there. These are the types of things that we need to get more concentrated on instead of just saying, well, we should just ban this, this, this, this is, this is dangerous. We can't have that.

I agree. And I think a lot of this comes down to this peer discussion of like risk and compensating controls.

Right.

And I think it's— let's, let's play that out a little bit. I think this is healthy. Take email. So if the risk of email is phishing attacks galore, spear phishing especially becomes the entry point to all attack vectors. What are mitigating controls? Well, we educate, we do document scanning, we try to, you know, limit where people can come in from. We have a little report a phish button. We put a lot of compensating controls in there. I do think with RMM, and this is what I'd love to present back to everyone else here with RMM, how many, how many mitigating controls do we honestly have? Do we have enough? I mean, I'm not saying we do or don't. I'm just asking the question like, Do we have enough commensurate mitigating controls? When I think about the risk to an RMM, I think through no action of my own, all of a sudden, instantaneously, all of my endpoints and all of my clients' endpoints could be encrypted, right? That's scary. So then I think, well, what are the compensating controls there? And I saw a bunch of people like Tim mentioned in chat multi-sig. I think that's a super cool idea of that idea of like multiple people have to be in play to make something happen, make some new script be able to be run. Mark Lamb mentioned a couple of things. I have to go find what Mark mentioned, but I was reading through and I thought it was great thought. So like, maybe that's a question for the panel here. Do we have enough mitigating controls in front of the RMM at this point?

Probably not. That's why I threw out that harebrained thought about, you know, there's got to be some sort of credentialing or some way to kind of acknowledge or prove or prove that that operator is legit. Those other ideas, I think, are, you know, probably have more merit to mine. But I think in that spirit, that's kind of where my head was going. Is once I'm an administrator on one of these accounts, I've got the power of God. I could do a lot of different, you know, dangerous things.

Yeah, I mean, I think like too, we talk about like the fallout from stuff like this hits MSPs. Like we said it in the beginning of the chat, um, if, if you're using an RMM, you basically like— the key to an MSP, the difference of whether or not you are an MSP or break-fix is basically an RMM. And then so when this news hits, it's the MSP's bottom line, their ability to get clients, their ability to protect clients. They have to answer questions on them. I mean, how many MSPs got, are we using Kaseya or are we using SolarWinds in our environment on either a questionnaire, a risk form, uh, whatever it is? But the burden needs to be shared. Like, we need to— like, yes, we need controls from the MSP, and we need, um, you know, the MSP needs to— whatever, you need to have other protections in place, better security around your RMM, all of that. But then we need the vendor side, we need to share some of that burden to help protect the community and lift everyone.

And since you brought it up, I mean, I think MSPs need help. And we often end up criticizing MSPs, or they end up with the blame or the lawsuits. But, you know, if I'm an MSP, I want oversight on some of the things that I'm doing. So regardless of what controls I think make sense, Why am I not engaging with someone who is an expert in this area to help me, one, be in a defensible position, right? So it's actually a strong story to say, hey, listen, before we deploy this tool to any of our customers, we engaged cybersecurity experts and we understood our aggregate risk and some of the other complications that might come up. But I think as an industry, we have really kind of piled on MSPs and it's It's a difficult situation for them because we're expecting the world from them and we're expecting perfection and we're expecting this every single possible service. And I just think that, that, that component of managed services, which we invented literally 22 years ago, it's antiquated. And we gotta really start to think about how do we start to help these providers do a better job as part of the net, and we were— it's all one community, right? It's MSPs, it's cybersecurity, it's small businesses. I think we need to start really thinking about the jurisdiction, the responsibilities and accountability and liability that we place on each individual, because we all have our part, and doing a better job of balancing that.

Yeah, can I chip in here too? Because I think regarding what specifically happened over the summer were these two attacks, the RMM attacks. And I'm thinking back to the way the criminals got in, just going off what Robert said before, is it was a phishing email. It wasn't like they hacked into someone's— it's not like they hacked into someone's RMM and pretended, you know, pretended to be them using the actual software. They sent phishing emails that looked like legitimate emails from IT or help desk or something like that and convinced them to download the RMM software. I think in this case it was AnyDesk or ScreenConnect or something. I'm just looking through the article. And, and then log into their bank account, and they changed information after getting into the bank account. So they got control of the user's computer using the RMM. The user then willingly logged into their bank account, and then the criminals changed information to create these fake refund deposit kind of stuff. And I there, there is a side of this where we're talking all about, um, the, the how do you best protect your personal RMMs. But on the flip side of that, where, uh, going back to that statistic, I think it is every time I see it, Robert, it's either 83 to 87, it's somewhere in there. But that's a massive percentage of attacks, and it is more often than not due to human error. So what's the approach there? What's the approach of how do we take, um, How do we take something that is— that could easily be solved? I mean, there's lots of suspicious flags. Hey, I'm going to pretend to be your, your MSP. I'm going to download this thing. I'm gonna, I'm gonna ask you to download this thing. I'm gonna ask you to log into your bank account. Like, it's— there's a lot of weird stuff there that normal people don't ask. So what's the, what's the solution?

Are you, are you asking the panel what the solution is?

I mean I have an idea, but I mean, I think in that particular attack there were a lot— I mean, it wasn't an RMM compromise. An RMM tool was used in a bad way. Right. And what was compromised were— I mean, it got through all the email security, it got through the security awareness training, the wherewithal, or what I call the human firewall. Right. That person who accepted that link and went through all of those motions to supply their information. You know, they weren't secure-aware enough, right? Maybe application whitelisting could have helped there. There's so many different layers that that was not an easy attack to pull off. But if you do it enough, right, if it's a numbers game, you'll eventually get through somewhere at some point. You know, I think Reg, you were alluding to earlier, there's this, I think, unreasonable expectation of perfection, not just with MSPs, but with IT departments, that things will be 100% secure 100% of the time. And what I tell our prospects and clients is, if anyone ever tells you that, they're selling snake oil. It's BS. It's not true. It like, Bad things will happen. We're just going to do our best to mitigate those things as best as possible, kind of like what Wes Spencer was saying earlier. What are those controls that we can put in place? So I don't know if that, that helped answer your question.

I think the advice from the advisory was good too. Like, if you're running a Terra, like, you should be blocking ConnectWise, right? Or if you're running ConnectWise, you should be blocking Syncro and all the other ones. So like that, that's good advice and we should be doing all of that stuff. But the, the, the implications of, hey, block a Terra Synchro ConnectWise, Datto RMM, you know, all the time is like, that's what's scary.

You know, I feel like a lot, though, a lot of the CISA and other federal advice that comes out kind of comes out in a vacuum, like assuming you've got unlimited time, money and energy, this is what you should do. Yeah. And they don't really consider this question which to me all cybersecurity boils down to, which is, is it worth it? The reason we don't get rid of email is because it's not worth it. No matter what risk comes through that channel, we're never getting rid of email. Well, not, not in my lifetime, probably. But RMMs, there's sort of confusion. There's a little mystique around this. Like, you know, it's not exactly the same to everyone. And so the question is much harder to answer. I think if CISA had at this, in the same breath, said let's get rid of email, they would cease to exist as a federal agency. Like, it just doesn't make sense. So if you're asking yourself the "is it worth it" question, you're effectively managing risk. And that's what this is about. It's not about turning everything off and disabling and uninstalling. It's about understanding what, what level of risk have I reduced or can I reduce with this control? What level of risk do I introduce? Because let's face it, it's just software. It is— even though this particular instance, the RMM wasn't compromised, it can be compromised. It is code and it is written by humans and it is vulnerable. And so you ask yourself these questions. Now, I'm going to contradict myself because that is such a complex question to answer that as a— as an industry, I think we need to do a better job translating these complex concepts, the problems and the solutions, into language that consumers, and I mean customers and MSPs falls into that category as well, so that they can make informed decisions about these things. I, you know, I blame myself. I'm part of the cybersecurity industry. We don't do people many favors in that, in that sense. I think we enjoy complexity and hype and fear because it sells products. So, but I think we need to take a different approach in this case.

Tend to agree with that. And, you know, I think when we look at the, the MSP sector as a whole, um, actually, let's not do that. Let's just— let me talk generically for a second. We have an industry that has a lot of legacy stuff laying around with a lot of legacy code that was built in an era in which, uh, security was an afterthought. In serving clients that did not care about security, that were not targets. I just described almost every industry out there, right? Not just the MSP space. I came out of banking, it was that way. Anyone in healthcare can say it that way. The, the poor folks in the energy sector are absolutely that way, right? We're all in this boat where, Reg, you're right, like, this is the world that we're in and we all have to deal with it. And I know as an MSP you might feel particularly vulnerable because you know, what can I do about it? You're caught in the middle of it. And I think the RMMs, I want to believe, and maybe I'll throw this to the panel, I want to believe that they're really taking this seriously. Most of them have spun up like trust sites and they're trying to give better visibility into what they're doing and code audits and, you know, shifting left and all these things that they're doing, which is great. But we still have a lot of tech debt, right? So maybe I'll throw this out to the MSP, Mr. Chiaffi, and just curious what you think, Robert. Do you think that they're doing a better job? Are we seeing progress progress here, or do we need to get to where someone said it? I think they said, just a random LinkedIn user, I don't know who it was, that are we moving to an RMM-less world? Because we're not seeing that the pace of this. Robert, what's your opinion?

Well, taking that last part first, uh, we have been thinking about what it looks like in an RMM-less world. Uh, we're not quite yet ready to move there simply because it would be very, very difficult to get there. I mean, and we can debate, you know, how does an MSP exist without an RMM. And, you know, there are ways to do that. But as far as the vendors tackling this problem head-on, like you said, taking the accountability for their technical debt and upping their game with cybersecurity, I will say this from everybody that I've seen on stage live or virtually or in emails, everything that I'm reading, seeing, listening to, says that they're all sitting upright with their shoulders back and they're listening and talking and saying that, yes, we acknowledge this and we're going to do a better job and we're fixing these things. Uh, but to your other part of that question, are they actually doing it? Quite frankly, I don't know. I can only go by what they tell me and what I see in their software. My feeling is that things are moving too slowly, and it concerns me that all of the RMMs that are out there, I'm not seeing these— maybe not a quantum leap forward, but these major leaps forward. They keep talking about re-engineering products and coming out with new versions and getting rid of some of the old legacy, but we're still using those products because there is nothing else to use. So does it frighten me? Absolutely. And every single other MSP out there should have the same exact concern. So that's why, you know, we are putting in other controls and measures to help mitigate those things. As you said, we're trying to, we're trying to do our own internal security monitoring and checkpoints and, you know, least privilege and all of those things in order to contain blast radiuses because it's not a question of if it's going to happen, it's going to be a question of when.

Yeah.

So we like, everyone agreed, like pretty much we're turning off remote desktop, right? Like, like you get a server and you make sure that's like disabled everywhere. It's like a general, like it's, is our Wes Spencer, is this real or will maybe you guys are in cyber insurance, you might have a better take on it. Will you like, is there a potential that these things will eventually get banned? And like if you're using these tools, you're uninsurable, or would there be like a regulation or franchises or whoever like banning these? Is this something to be concerned about, or is this all, you know, me making sensational headlines on LinkedIn?

It's a great question. Um, so in cyber insurance to this day tends to be extremely reactionary, right? So to Robert Chioffi's point earlier that, hey, this is a big thing in the news right now, everybody's freaking out about it, reactionary. When I say reactionary for insurance, I mean it's like years in the making. So, so you think 2 years from now they're going to look back on their data— they've got actuaries just studying this stuff— so they're going to look back on their data in 2 years and say, hey, how many breaches/losses did we see due to RMM hacks or RMM scams or things like that, right? And that will oftentimes influence what we see. I can't say whether or not it's going to be a straight, like, like, hey, you're not going to get a policy because your, your MSP uses an RMM tool. They may start asking a lot of the questions you're addressing now about how you're securing your RMM tools, how you're, how your MSP— you know, it's the kind of thing where we're even starting to see on some applications that MSP— there's like little— oh, that's a great question, thank you. Um, uh, so there's some— there we're starting to see those questions where it's like, hey, do you have an MSP? Yes, who are they? This person. Can you have them fill out this section? And MSPs are like, I don't want to touch that, that seems like a weird thing to be filling out on someone else's application. But at the same time, you could see questions around RMMs. Hey, what, what tool, what RMM tools being used? How is it being protected? You know, questions like that. Um, will it affect eligibility? It's too— I think it's too soon to say, but you could potentially if it continues to be a consistent source of attack, you could see exclusions come up or things like that on policies.

Yeah, I remember years ago, um, a platform that everyone here is probably familiar with offered a very inexpensive insurance policy that they could bundle into their managed services, uh, and there were 3 groups of people that, that the policy would not ever cover: terrorists, cannabis dealers, and MSPs. Those are the only exclusions. And so that's the company we're keeping right now, I think, um, probably unfairly in a lot of ways, but, um, I'm sure you all know what I'm talking about.

I— yep, I, I do indeed.

I don't know if I should be insulted or feel proud of that distinction.

One of those is making a lot of money.

So I, I wanted to come back and posit this question back to the group. I don't know if you all remember when this happened. Um, it's now sort of not news anymore and hasn't been for over a year. But I remember this spun up. This is a big, big, big deal. There is precedent for insurance coming in and doing some kind of big things. Now, this was not— I don't think, if I remember right— and Will, if you came across this news article, let me know. If I remember right, this was not Allstate saying no to their clients. I think it was Allstate saying no to using these particular RMMs internally, if I remember right. But there is sort of some precedent here for cyber insurance may be saying enough is enough in certain ways. I'm curious just what the rest of you fine folks think about something like that.

Yeah, I mean, this is like, you know, I talked about like the ex facto ban and the de facto ban, right? And this is different from cyber insurance, right? You're uninsurable, potentially uninsurable if you're using these tools. So it's effectively illegal or banned, right? But this would be like a more direct situation. So we'd MSPs, when we have this conversation, we talk about agents, right? Like, uh, say you're doing business with, um, you know, Burger King franchise or a McDonald's franchise or, uh, an Allstate agency or a car dealership that's affiliated with GMC or whatever it is. Like, you can— those— the third party or second party, whatever, however it works that way, um, can, can just ban these tools. And that, like, it's It's real and it's starting to happen, but how much of it will actually affect MSP business, we don't know. And how much worse will it get? We don't know.

Well, the cyber insurance industry is probably gonna have to catch up with legislative action, which again is, in my opinion, really problematic because it's tough, tough to find any kind of regulatory mandate that is truly effective. But I think one thing MSPs should really start considering selfishly, um, I'll be transparent about it, is that IT is one of the last industries on the planet where there isn't established consistent oversight. So building inspectors are constantly watching construction sites, and malpractice attorneys are watching doctors, and auditors are watching accountants. But in IT, you can kind of walk in with a really powerful tool and do anything you want. And there's no way to— there's no balance, there's no check and balance for that. And in cybersecurity, it makes it even doubly complex and impactful because not only are there sort of the usual stuff that you would expect, like threats and things like that, but now that kind of fans out into insurance claims, to law enforcement, to lawsuits to a lot of us. And if I'm a, if I'm a mature MSP, and we do see these, by the way, I'm not demonizing MSPs in any way. MSPs should be saying, for the love of God, please someone come look at my stuff and help establish in a credible, objective, neutral way that what I'm doing is actually not introducing unreasonable risk to my customers. Now, I'm going to continue to use an RMM because By the way, it helps my customers be more secure and I reduce risk with that platform. But introduce some oversight, like there's— and not legislative. I'm not suggesting that. I think those tend to be distractions because the people that write them are just looking for reelection. But I'm talking about like—

Not a hot point in the right one.

A legitimate qualified partner that can take on some of that accountability and liability with you. And helps, you know, put a second set of eyes on this, the same challenge, but from a different perspective, really sort of a risk management, not an IT perspective.

I think somebody put in the chat earlier, and I'm not here to promote CompTIA, but CompTIA has their Security Trustmark that they're relaunching. I think it's in March, which I think is supposed to help move towards this. Reg, I thought you were going to spill the conversation more towards the, you know, the regulatory oversight. I mean, I kind of say, say the same thing to my clients all the time. If I want to provide medical services, I need, you know, I need an MD. If I want to be a lawyer, you know, I've got to go to school for that, and I've got to be, you know, credentialed and admitted into the bar. Just like you said, I can't even sell insurance, right? Sorry, Will. But yeah, I mean, you know, you need certain certifications for that. Like you said, in the IT business as an MSP, anybody, I mean, my mom can print the business card and call her an IT consultant, call herself an IT consultant. As long as she knows a smidge more than the customer, you know, a transaction is born. And I think that's what's wrong with this industry. Even for those of us that are more mature, we don't have any real good concerted unified either frameworks or credentialing to follow, right? I can go out and get manufacturer certs around things. I can go get that CompTIA Trustmark stamp, but it just seems like, and, you know, maybe some other MSPs would hate me for saying this, but I think it's time that we rise to the level of an accountant, a lawyer, and a doctor and really understand that we provide such a critical service that needs that type of oversight. I would prefer if the industry does some sort of self-regulation and not come out of Washington or the state capitals. I think it's high time that we as a community come together and figure this stuff out and figure out ways to say, yep, Progressive Computing in Yonkers is, you know, they're— they got an A grade on that, or no way in hell, you shouldn't use them. And they can't even practice, right?

Yeah, you know, um, when it comes to regulation too, it's, it's too much to expect. I, I think we see it in the insurance space, and you can see it, um, I think in the MSP space as well, just that because technology is exponentially shifting always, it's going to be delayed. I mean, it's never going to be up to date anyway. So the people who are going to know what good security looks like and what good controls look are the MSPs. So some sort of self-regulation is probably at least a more updated approach.

Look at that comment from Heath, uh, Heath Spencer. I mean, even a real estate— and again, I don't mean to diminish real estate brokers here, but like, what are they really doing in comparison to what, what an MSP does for our clients? I mean, this is a world of difference of what we do, and there's, there's no licensing requirements How do we, how do we get this without it turning into, you know, um, MSP standards by XYZ, you know, mega conglomerate vendor?

Should it be—

oh God, whoever's doing these, uh, captions behind the scenes should get a raise. They're just on fire.

We've definitely ended up in Wes Spencer's stream.

You could tell.

Sorry about that, Jimmy. What was your question before we ran all off track?

The same, just like, like our, our world is very commoditized, right? We don't have like a, like a bar association, right? Like you have— if it was— if the bar existed in MSP world, it would be like the MSP bar brought to you by XYZ vendor of, you know, Mega Corporation.

Yeah, yeah. And I joke about this, right? Like, that's part of my joke about being a dictator is like, when I'm elected dictator, all these problems will be solved. It's sort of like, who will be that dictator to decide? I mean, ultimately there's one group that would have the authority to ramrod it through. We can't do anything about it. That's the federal government. But we're still years from that. I don't think anyone on this panel or anyone listening is like advocating that because we all know, you know, the outcomes— that's not going to be the right outcome. So, but we've been talking for years about self-banding and maybe, Reg, I'm curious your thoughts on this. We've been talking for years about us getting together, but man, you get 3 MSPs in a room, 4 MSPs in a room, you get 4 different opinions, maybe 5 or 6, right? And that's just part and parcel to our industry. I kind of celebrate that, but we talk about it. What's the outcome? What's the reasonable, um, next step here, Reg?

Honestly, I I got nothing. I mean, I think it's an industry that would be— it would be tough to tackle that, although probably not any harder than physicians or attorneys. But very religious about our technology and our approach. And I think for something like a bar to be successful, God, I don't even know. Like, it would be— have to be magic, like unicorns and, you know, pixie dust. I, I just— I don't know.

You know, I think a good example of this is that I, you know, I, I had to take my insurance licensing course before I got started in this role, right? And that's a regulated course. And I work inside in the cyber insurance industry. That's all I work in. So there's no other lines of business that I'm doing yet. On that entire test of 150-plus questions, maybe a little more. There was one on cyber insurance, and it wasn't even like that relevant to the industry. So it might be worth— like, I don't know how they would be able to keep any sort of regulation around the MSP business. It's just, it's consistently shifting and changing that it would, it would need to have some sort of— I don't, I don't even know where the continuing education would come from.

Is the panel stumped? The panel is not stumped.

Well, it wasn't really a question, it's just more of an observation. Like, it— when you, when you leave it up to a regulatory board to create things in the technological sphere, it's always going to be outdated. There's just no way.

Has something like this happened in the past 75 years? Like, you know, like insurance, right? Like Doctors, lawyers, physicians, like this stuff's been around for a really long time. This is technology has like, like they, they, I know they're trying like to make like OpenAI and that turned into a company too. Like, like the AI board, but like, has there been, is there anything we can compare it to that happened in like the 19th, the 20th century?

Well, oh, go ahead, Reg.

Well, I was going to say, I feel like I spent a little bit of time in East Africa. And there are, there are ways to institute like a government and, you know, that sort of manages all of these different tribes. But I don't know if the government actually solved any problems there. And we continue to see, you know, infighting and disagreement and dysfunction at times. I don't know. It's again, I think when you have groups that are even if they're pursuing the same goals, it seems like it's a very religious, almost spiritual sometimes. I mean, I see people clinging to their RMMs and stuff like that. I just, I think it would have to be a sensitive group, a neutral objective group that wasn't putting everyone on the defensive. It was actually showing immediate progress and what's unification, I guess, is a good word. But I just, I think there's no shortage of challenges, I think, in that, that effort.

Well, I, I am curious. Um, I do think it needs to be grassroots. I think it needs to come from the Chiaffees and the Harnishes of the world. I think it needs to come from leaders that have respect. I think that the vendors will follow— the good vendors will follow what the MSPs do and say. I think a nonprofit that's created and reflects the MSP industry as a whole, that probably is made up of the MSPs, that represents the MSPs, is the right way to go because we certainly can't put 1,000— what, 40,000 MSPs in the room together and then expect one aligned vision to come out. So it's going to end up being a, you know, a vision that we can all make compromises and at least get to the basics of. And probably the best way to do it would not to be to not over not to overprescribe, but to at least start at the basics and make sure we stay there. But then you still have the question, where do the teeth come from? You know, like PCI was spoiled because there's only so many actual payment card processors that are out there that had the authority to sort of ramrod their way through come hell or high water. And we don't have that with, you know, 40,000 MSPs, you know. So I like it. And I was even looking at Mark's comments here of, you know, in Scotland they're working for some stuff. I mean, Mark, I ought to bring you on to a livestream at some point and have you talk about it because A, you're just awesome. B, I love just listening to you speak because you have the best accent on earth. And 3, um, it'd be good for us all to hear. But, you know, I don't know, I just pose that back to the group again. Like, I don't know the mechanics, but I do think it must be led by MSPs and owned by MSPs to move forward. But boy, getting them all together to agree is going to be one tough cookie.

Yeah, because someone made a comment about the MSP Alliance. There are many others in the industry who are— I think it's got to come from folks who are not making money off of MSPs so that it can really truly be neutral and objective. And so I think it would require that those consumers— I call them consumers, but small business customers— are part of that, because I think they're the ones that can help us define what is the level of acceptance Because when you say to that small business customer, hey, listen, by the way, you can get a certified MSP or an uncertified, the certified one's gonna be twice as expensive. What do you want to do? I think we know where many of them will go. And so they have to have some, some authority to define what is the appropriate level of, of acceptance and certification. Or I think it will be difficult for the MSP to take this new thing and push it out to their customers in a way that's economically feasible.

Well, a little plug for Will and Wes Spencer there too is the driver might be insurance. If insurance now starts to say, do you have this certification, yes or no?

Yeah, in 2 years.

Yeah, in 2 years. But in— well, that might be fine. At least it's in 2 years. At least remember, security is a journey, not a destination. Destination. So as long as we're moving in the right direction, but you make a really good point, Wes Spencer, about the, you know, what's the impetus for me to get off my butt and become certified or part of the MSP bar, whatever we want to call it, become credentialed. We've got to figure out ways to incentivize MSPs to do so. Or maybe better yet, to make it really painful if they're not.

That's a—

looks like we got part 2 of our stream.

Wes Spencer comments, man, they just derail everything. So yeah, I think, I think the, uh, the summarize— to summarize everything, it is, uh, is there anything— are RMMs going to be banned or RMMs going to cause issues? Maybe. So, um, that's That's where we leave it. But in reality, this has been awesome. I appreciate you all jumping on this call. And Jimmy, thanks for organizing this. I think it was a great idea.

Yeah, thank you.

And we will— I don't know where you could find any of us on LinkedIn. We're more than happy to talk to you more about this. Just, yeah, reach out. It depends. That's it. So yeah, until next time, thanks everyone for joining in. Thanks for for, you know, listening in, watching, all that good stuff. We'll catch you.

Awesome to be here.

Yeah, thanks guys.

Thanks everyone.