Cybersecurity Leadership in MSPs: Real Talk with Wes Spencer and Kaseya's CISO, Jason Manar

What is going on, man? Happy whatever day it is to you. I think it's, yeah, Wednesday. My calendar says it's Wednesday. I don't sometimes know what day it is, I feel like. Thanks for joining. This is going to be super fun. Appreciate all of you joining in. My name is Wes Spencer. We're going to get kicked off in just a minute, but I've got a good friend of mine and guest Jason Menard that's going to be joining, actually has joined us today, and this is going to be a great conversation. This is going to be a super fun discussion. So Jason, I know we got just a minute or two for banner while people kind of come in. How's everything going for you?

It's great. I'm glad you reiterated today was Wednesday. I too, as a CISO, was kind of second-guessing whether this was Tuesday or Wednesday. Sometimes the days blur together. Even my Fridays and Saturdays blur together. And then my wife really likes it when I wake up super early on a Sunday morning and she's like, where are you going? To work. Oh no, it's Sunday. I'm not. I'm so sorry. So I can, I can, I can definitely hear what you're saying when you're a little confused on what day it is because sometimes it does seem like Groundhog Day in the security and education landscape and world that we live in.

Yeah, yeah, 100%, 100%. It's— and you know, you never know what the day or the week or the month is going to give you, you know, just based upon what's happening in the threat landscape and You know, it's— I don't think a lot of people understand just how wild the role of a CISO can be and how unpredictable the day can be.

But it's one of the things that keeps it just so much, you know, fun and enjoyment, quite frankly, because no two days are ever the same and you face unique challenges every single day. And one of the best things is being able to talk to folks that are just getting started all the way up to Anthropic CISO, who's obviously on the cutting edge and everything in between. And so I feel just extremely blessed to not only be in the position, but to be able to talk to people like yourself and the Anthropic CISOs of the world and those people that are just getting started on their MSP or MSSP journey.

Yeah, yeah, it's well said. Really well said. And I, I heartily agree with that. Well, while folks are joining, just want to say welcome. You got Wes from Empath here and we're very privileged to have Jason Menard joining us today. And this is going to be a very fun discussion. We're not going to do Q&A. What we're going to do is we've got Jason and I were planning through this and we just were chock full of great content. And so we just looking through, it's like, man, we don't have time for Q&A later. So if you have questions, you can get in touch with Jason later. He regularly does all kinds of stuff with MSP partners and you can kind of arrange that on your own.

But thank you for joining.

So Jason, I think I think one thing that people don't know about you and I, we both are alumni at Murray State. Go Racers! We're both on the advisory board at Murray State, and it's been super fun over the years getting to know you really well and just working together with you at Murray State. So thanks for joining, and fellow Kentuckian, it's really good, good to be with you.

So likewise, and to provide some context for those listening, what that is, is it really gives us the ability, and especially Wes with his great background and knowledge, to help shape what the curriculum looks like for those, those people that are looking to get into the career field of IT and security. And so having true practitioners sit on that committee and to come together at least once a year and have those very robust discussions around what needs to be in that curriculum, I think has paid, you know, huge dividends. So Thank you for that. And you know, that's on everybody's own dime. Wes Spencer has been doing that for several years and that's just one way in which he gives back to the community.

Yeah, well, right, right back at you, brother, for sure. And it's been good striking up that friendship. You and I both had many times where we, we just call one another, we're batting something off one another. What do you think about this? How do I handle that? I got— what would you do in this situation? And I— to me, that's what battle buddies are all about. So I appreciate you being a battle buddy in my life and, you know, all you've done on behalf of MSP Partners. So Cool. Well, let's jump right in, my friend. So those of you that are listening, Jason is going to just be sharing some of his thoughts and ideas and questions I've had for him about what does cybersecurity leadership really look like and what can we glean from Jason and just your life and career. And so Jason, I think the biggest question I want to open with is this one is just talk to us about some of the biggest strides you and your team have made since you've been at Kaseya. I know you've been there for a while now. You're not ankle deep anymore. Maybe you're neck deep. I don't know what it is, but talk to us about some of the biggest strides you've been working on. All have made.

Yeah, so for those, for historical context, I came from government service, 16 years in the FBI, probably worked about 1,000 different intrusions all the way from Fortune 50 companies all the way down to, you know, mom-and-pop organizations and got to work alongside some of the greatest leaders around the world, not just here in the US, and also the largest companies around the world. And so when I got the opportunity to come here to Kaseya, it was very much similar to what happened in Target where they had a distributed model of security and they were wanting to centralize that and bring that all together. And that's exactly what I did as Kaseya's first CISO. And so how, how do you align and how do you centralize was a big part of the questions. And it really came down to like 3 common areas, right? You had to have visibility, you had to have the right prioritization, and you had to have accountability. And then how do you action those things, right? And in actioning those things, one of the things that we came up with very early on, especially with that distributed model going to a centralized model, was still having some of that distribution with security champions and having those throughout the organization. So making sure that we had key people in critical lines of sight in the development process, in the SDLC process, making sure that they were taking the best practices and actioning those and making sure that they were educated on the best security practices and getting that education piece for that accountability model. And then it was coming together with the team of executives and finding out what is the prioritizations of the company, what is the most meaningful things, what are going to create the most impact. Right, as purveyors of risk, as CISOs and security practitioners around the globe. That's ultimately what we want to do. And, and we want to make sure that we get the buy-in from the organization, which means talking to all the executives, making sure that we understand what is most important to them and what their individual crown jewels are. And to have a psychological understanding of where they're coming from when they say these things are most important, because in some cases they may be, And in some cases, once you start talking that through with the rest of the leadership team, they realize that they may have crown jewels in other areas that they didn't even realize the dependencies on. And so it's bringing— and again, it's that whole learning process and becoming a lifelong learner and making sure that you're having others and helping others take that journey. And then finally, it's that prioritization, right? It's making sure that you stay laser-focused on the prioritization so that you can create meaningful traction and so that you can build on that. And so what that's allowed us to do, you know, over the course of several years is build probably about 23 different security teams. And I won't be able to probably give them all credit and name them all, but development security teams, DevSecOps, application security, We have our VDP team, vulnerability team. We have application security team. We, of course, have the SOC, the CERT. We have security engineering, which helps us make sure that all our tools, toolsets and security toolsets are not only set up correctly, right, and configured correctly, but are regularly updated and taken care of and that we're getting the most out of them. And then that we're providing the business a lens of what we're providing as security right back. So it's not just a quote-unquote cost center. So I could go on and on literally in the entire hour with this, this question only because there's been so many strides. But I would say the cherry on top and the biggest thing that I'm most, most excited about is the continued buy-in from executive management. And having that tone at the top and making sure that we have, you know, company-wide security initiatives, that's, that's, that's just huge, right? And it's something that is, is meaningfully impactful on a regular basis and on an annual basis for the executive team to get together, have those security initiatives, and make sure we drive those to completion.

Man, I love that. Absolutely love that. And, you know, I think one of the things you mentioned that I think was so, so great in there is that element of accountability, you know, and just making sure— I mean, with teams that large and that many, I really think at the end of the day, you've got to have some phenomenal deputies, some phenomenal people that carry the torch and are communicating downward and upward back to you and the executive team. That's just got to be a critical component, that accountability piece.

So, so it is, but there's also a trust factor. And I kind of give this analogy, and when we've talked before, I don't think I've ever shared this analogy. So I would love for you live to give me your feedback on it, whether you agree or disagree. But when you're managing, you know, 40+ products for a platform, I often think of security kind of like the air traffic controllers, right? They're not telling the pilots that are in the cockpit exactly what to do or how to fly the plane, but they're making sure that everyone is set up for a safe landing, a safe takeoff, and understand the rules, if you will, of that airspace so that they are as safe as possible to operate within that airspace. Yep. Yep.

Okay. I do like that. I like that a lot. I think that gives some really clarity and good bounds for like what we're trying to accomplish and a good way to think about it. I love that. So I think you're right. I think we could go on and on and on. And so I want to kind of move on to maybe some of the other topics I've been itching to ask you. First of all, when I think about Kaseya and I think about like I have a lot of friends there that have built some amazing things, right? Like you have the Vonahi folks and you have the SaaS Alerts folks. I've gone way back with all of those folks and many others and True Methods. And like you guys really do have the best and most robust product offering. You just consider like everything that Kaseya brings to bear. One of the things I've heard private equity say all the time when I do these analyst calls is, why is Kaseya so far ahead in their product suite offerings, right? Well, they've done a great job of very aggressively understanding where the market's going and understanding what needs to be in the portfolio suite for our partners, right? So the question I turn to you and I look at is, my goodness, like being a CISO of a bank where I came from, it's like, okay, I care about my bank. I got like, it's It's my bank. You've got this juggling mix of you have your executive team and all of the concerns that they have. You have a huge product suite that you're managing and taking and working through. You've got thousands of MSP partners and thousands of their clients, and you even have the government over here as well. Like, how in the world does Jason Menard juggle all of those balls, and what does product security look like for you?

Remember, we talked about that accountability piece, so it's not just Jason Menard, right? And we want to make sure that we preach that consistently throughout the organization when we're talking about the responsibility matrix and the model and how security is a team sport. And it truly is. And when you look at product security, you have to look at folks like Gray Knowlton, who is our— VP of Infrastructure R&D and Engineering. He got up on stage at Connect and, you know, he talked quite a bit about security, product security, the investment in security. And it really starts with his collaboration along with all his deputies, all his VPs with the SDLC integration automation and actually adaptation and adoption, quite frankly, because without his group adopting what is written in the SDLC, it's just words on a piece of paper. And so when you keep up with that, the key part of it, I think I previously mentioned, was those security champions and those security champions that are embedded into each team and each product ecosystem so that they are the boots on the ground that hear things first, that see things first, that are the ones to first start bringing, bringing up potential concerns where the SDLC may not have been followed and maybe it was missed by a control mechanism that we had in place, or somebody that's potentially doing an unsafe practice and being able to see that in real time and provide immediate feedback. And so we can put all the controls around everything, but anyone that's been in security, knows that just like water, it will find the lowest point, the weakest point of whatever control it is. And if there is a point to go through, it will go through it. So actually having people that are vested, right, that have part of their, you know, annual review that's tied back to security and their performance that is tied back to security makes a huge difference in implementing your strategic vision, the policies, the automation, the integration of the SDLC, and ensuring that we basically— security doesn't start with the CISO, right? It starts with the first line of code that is written, and it is really pushing everything to that first point that we start the creation of a product. Or we're starting to make some type of change within the product, and then really making sure that accountability lands within that team.

Yeah, boy, you know, that makes me think about— I remember when SpaceX was first sending their test flight up for Dragon capsule. So this is, you know, a couple years, few years ago, and this is a big deal for them, right? Because they've been testing the Dragon capsule unmanned for all this time. And one of the things that Elon had a mandate on was he said, I want every single work order that comes through to have the faces of the 3 astronauts that are going up to space on every single work order. And the reason why is he said, I want to reinforce there are humans behind the decision-making that you're making today. And so if you cut a corner, if you shortcut something, if you're lazy on something, you're impacting these people. And I just thought, what a great way to like prove leadership of saying, you know, my job, I don't, you know, You know, Elon doesn't build the rocket, but he's got thousands of people that do. And we really have to reinforce back to them that you're enabled, you're in, but we need you and you're critical for this. And to me, that's what good leadership does is clear the pathway. That's what I'm seeing out of what you're saying. And you probably don't remember this, Jason, but I actually saw you do this in real life one time. You and I were backstage in the green room. This is like a couple Kaseya Connects ago, and you and I were just sitting prepping and one of your folks— so to get into the green room, you have to be like, it's very secure. There's a lot of ways you had checks to get back there., right? And one of your folks had stood up and kind of walked away for a meeting real quick and you popped up and you saw that she didn't lock her laptop and you walked over and you actually pulled her aside, said, hey, you didn't lock that laptop right there. And I thought what was so neat about that was not that you were nitpicking, but you were just showing to the entire Kaseya team like, I care about the little things because I care about the big things. And yeah, we might be in a secure area that no one else is going to mess with it, but if you care then, you care everywhere else. And to me, that's the culture that real security leadership is bred from is not attacking people, but just reminding them and saying even in the small things in an area like that, that might— most people just say it's no big deal. She's right there in a secure area. You didn't. And I love that about you. I love how you kind of approach the whole team-first approach and really kind of enabled them.

I appreciate that. That means a lot. And no, you're right. I totally forgot about that until you brought it up. I appreciate that more than you know.

I wasn't planning on going there, but it just is— your commentary really clicked with me. I'm like, dude, he's right. He's definitely talking about what he— that's right on the money. So next question for you. You know, let's put ourselves in the shoes of MSPs. They've got a tough world as well, right? I mean, their job is definitely difficult because they're dealing with 10, 20, 100, 1,000 clients that all have different risk profiles and different levels of care and all these things. And so if you were a security leader today, what would you focus on first, Jason?

So I had 3 things, and I still may talk about the 3 things I was going to, but I had a call last night, late last night, with a partner that was in, uh, was in another country. It was the afternoon for them, and one of the things that they wanted to know, their question was, is it's basically, how can you guarantee that something's not going to happen to Kaseya again? And my answer is, I can't. Mm-hmm. And they were like, well, wait a minute, you're the CISO. You're supposed to— I explained all the things that we do to prepare the teams that we have. I said, I can't promise you that. You have to make sure that you set up your systems for resiliency and redundancy. I said, we have to do that even though we deal with the largest customers in the world. You know, you're going to expect whether Amazon is up or not for you to be able to reach out, get a hold of IT, right? We have to come up with redundancies and contingencies for that. Same thing with, you know, Microsoft Azure, same thing for our data centers, right? So when I kind of put things in that context, I think the light bulb kind of went on real quick for them. They were like, Well, we haven't done that. And here are about 4 different options that we could do. I go, great. I said, you know, I would talk through this with your executive team. I'd talk through this with your security team and your IT team. And then I would get with— I would, I would figure out what makes sense for you because some people, it's okay and they can go without services for 24, 36 hours. There are other people that if they go without services for an 8-hour period, their entire business model is at jeopardy. And unless they do that, and if we're just trusting regular third-party vendors, whether it's Kaseya or anybody else, just at their word, and we're not as security professionals and IT professionals setting up that resiliency aspect, or at least having a plan, right? And let me Let me give you a real-life example of this. There was a large company, publicly traded— actually, I take that back. I don't know if it was private or publicly traded. Shouldn't say that. That the majority of their business was web-based business traffic. They had an event and they were down hard for almost 2.5 weeks. The reason that they were down and they couldn't do any business and it cost them almost $50 million for the two weeks. But the reason they were down and they couldn't do business for at least 8 days of that is because they hadn't engaged with an IR company for an IR retainer. And they had very strict rules that their board for certain levels of contracts had to approve. And it literally took a 4-day process to get to their board. And then by the time they executed on it and by the time the IR team got in there, it was 7 days before they made any kind of meaningful progress.

Wow.

Wow. Yeah. So when we start talking about resiliency, this comes back to, you know, like kind of my 3 strategic talking points. And that was, you know, incident readiness, you know, as a service and making sure that you have those services built out. And that's everything from somebody to help you with the IRP to what you as a company, how you're going to respond, tabletop exercises, thinking about, you know, what recovery is going to look like, and that total incident lifecycle, if you will. And then the other things that I think I would start is first and foremost identity and access management. The majority of MSPs that I see provide far too much access and authority. And almost in every after-action that I've seen or been a part of with MSPs, there are far too many global admins, far too many. And one of those has inadvertently got popped. And I hear all the time, well, we had MFA, Well, you and I both know with session theft, with MFA fatigue, with a number of different things that can bypass that, that's not the end-all be-all. So we're seeing it more and more. And then making sure that you have baseline controls across your environment, you know, patching, EDR, backups, the basics, We still see MSPs, some of which that don't have the basics, and then we still see companies at large with the government contacts that I have that still don't have the basic patching, EDR, backup, monitoring, things that you would think in today's day and age are just table stakes.

Yep. I, I think this is all right. And I love that you started with this concept of we all wish that security were black and white. We all wish that there were guarantees. We all wish that they were immutable truths, but that is not the way risk works. It's not a cyber problem, that's a risk issue, is that all things from a risk perspective are— you can't guarantee— we are both in Florida and there's a hurricane that was originally barreling down at us and now it's— thank God it's curved away, but we can't stop that and we can't stop the next one from coming, right? And I remember my days at Perch, I had a doctor that wanted to talk to me and said, look, man, my MSP says I need to buy this stuff. I'm not opposed to it. I understand I got to do it. I'm not excited about the money. He said, my only question for you is, he said, can you guarantee to me that I'm not going to have a cyber incident if I buy this because it's expensive? And I said, you know, I really can't do that. I said, I wish I could do that. And there are vendors out there that would tell you yes. But I said, you know, if I came to your clinic today and I said, I'm going to come in and get a CAT scan, every single year? Are you going to guarantee I'm not going to get cancer? And he kind of thought about it and goes, I see your point. I'm like, this is what we're doing. It's best practice, right? It's defensibility. It's building towards resilience. So I love what you said there because that's the language that an MSP needs to have. And I think you're correct that MSPs, when you look at the aftermath, sometimes we say we're good, but, you know, as you said, privilege management, you know, thinking about some of the basics that we need to be done, have done, we need to buckle down and get those things done and not just say they're done, but really make sure that we've really applied best practice where we've gone. So it's well said. Let's move on. So given this is another— this is the other question I've been itching to ask you is you just glance at— you were over at FBI, right? I would love to know, you know, given your background at FBI, given your background at Kaseya and the large footprint both of those have, what's happening at the federal levels around cybersecurity that you think MSPs need to know about that they might not?

Yeah. So you and I, we had talked about this and I went and I asked some more of my colleagues and I said, you know, what's, what's coming that's going to really have teeth and change the landscape out there, right? And I was originally going to talk about some threats and everything else, but in this new world of AI and everything else, I think we kind of need to probably shift and focus on regulatory and this new concept called rules as a code pilot. It was introduced in Executive Order 14036 or 14114. I get them confused. One of the ones was first, one of the ones was second. So one was back in January, one was in June that added to it. And what this is, is this is an executive order that takes FedRAMP and NIST framework, and it says, you know, okay, we're going to pilot, you know, like an— a way in which we take it away from human text and put it to like machine-readable logic. So meaning that we're not going to take the 3PAO word anymore. We're not going to take self-attestations anymore saying, hey, we've aligned to, you know, NIST 800-53. We are going to put like, you know, JSON or some kind of executable logic. We're going to pilot this concept with a few vendors and we're going to go out and we're going to see who actually meets this NIST standard. Right. And it's what I've kind of been talking about for years where I envision this world where no longer are we attesting and using, you know, third-party affiliates to, you know, attest that we are saying or doing what we say we're going to do, but we're going to actually have somebody come in and basically execute a scan, or run a set of executable rules to actually say, yes, this is actually functioning and they have these controls set up in our environment. And the reason that I want to highlight that is because I really think when we talk about the future, you know, this is where we're going with AI technology and technology as a whole is we're getting away from, you know, and I love using analogies, we're getting away from those questions that your car provider, you know, or car insurance provider used to ask you, like, okay, how many miles do you drive to work every day? How many miles do you do this? And you're like, oh, 30, 40, whatever else. And everyone knows now, right? If you really want that discount, you don't just say it. You have to plug something into your car. You have to download an app to your phone to where they're actually verifying that information. And so we're seeing a means in which the government is actually verifying firsthand what we're telling them. And so I think that's going to be definitely impactful for MSPs. I think it's definitely impactful for all of the MSPs in the community that have to be FedRAMP or CMMC certified right now. But I, I think moreover, what MSPs should know about what's going on in the federal landscape is that MSPs are part of critical infrastructure. The— whether it's the FBI or whether it's the administration, they are— have started recognizing for the last couple of years the prominence that MSPs play— MSP plays in the small to mid-sized business, as well as municipalities and critical infrastructure of the US as a whole. And I think that's, you know, something that I just highlight and foot stomp. And it gives me goosebumps in a good way because for many years I just don't think MSPs got the credit that they deserved for how hard that they were working for the community as a whole or the impact that they have as a community as a whole. Especially when so much of our economy is made up of small and medium-sized business to whom they service.

Yep, I completely agree. And you know what I hear, and I'm sure you hear the same thing when I talk to like mature MSPs that have put a significant amount of time into growing their security practice and doing things the right way. They embrace that. They're excited about those things because they say finally there's some defensibility on what it might mean to be an MSP, and it keeps the ankle biter that just comes in comes in, you know, last minute and undercuts everything and throws security to the wind all in the, you know, the ability to chase some cheap dollars that really harms us, right? Just like I don't want a two-bit doctor, I want a doctor that's really well practiced. I don't want a two-bit lawyer, I want a lawyer that really understands the law. And so really love, love that aspect. And do you think, maybe just to follow on, do you think there's a day that some type of regulation comes overhead and dictates what it means to be an MSP? Are we years away from that? Is that an impossibility? What do you think?

So I don't know. It's hard to say because— and I think you and I have talked about this maybe a couple of years ago. I don't know that you remember, but unfortunately, when you look back historically at how regulations have come to be, it's usually out of some kind of crisis. When you look at the banking crisis and all the regulations that were put, you know, around the banking industry, it was because of crisis. When you look at You know, you look at financial crisis as to why there's so many rules and regulations on a CFO and public, public reporting for public companies. So unfortunately, I think there has to be some kind of catalyst. And I think likely there will be some kind of cybersecurity catastrophic catalyst that requires regulatory, regulatory action.. And again, I don't want to get political, but, you know, in somewhat political dysfunction in Capitol Hill where it's very hard to get, you know, bills out of Congress, I think it's going to take something of that magnitude before you see significant regulation that, you know, meaningfully impacts the channel.

Right. So unfortunately, it's one of those things where, you know, God forbid we don't— no one wants that to happen. But I tend to— actually, I don't tend— I fully agree with you.

I get asked the same question.

Question. That's exactly how I answered is like, be careful what you wish for. In order to have something that happen, something that is, something catastrophic's got to happen of which the channel's never seen before. So 100% agree with that. So that, that really kind of dovetails perfectly into this next question I've got for you of Jason, what do you think the next 3 to 5 years look like for the channel, whether it's vendors, whether it's MSPs, whether it's just the ecosystem as a whole, the economy, all of those kinds of things? What are your thoughts on what the next few years entail for us?

Yeah, so I wouldn't be surprised if in the next 3 to 5 years we, we see something that is the catalyst for that regulatory action. So I see the regulatory landscape kind of squarely landing on MSPs, and maybe that's not going to be the case. But you kind of see that with all the small to mid-sized businesses now. When an MSP is just an IT provider and not a security provider, how many times after an incident does that customer call back and go, but I thought you had me covered. I thought that you did X, Y, and Z. And so I really think the next iteration for MSPs is not just an MSSP, but to add that compliance and regulatory piece and for them to become that full-service MSP where compliance becomes a differentiator in a regulatory landscape. And it's yet one more item that MSPs are going to have to become very proficient in down the road.

Yep, yep. So, so yeah, a great way to say it. One, one thing that you should be thinking about as an MSP is even if it's a catastrophic event that's going to cause you to become regulated later on, and God forbid that doesn't happen, doesn't mean you're not already married up. Doesn't mean you're already required to be doing a bunch of this stuff from other regulations in which you're included in, right? So CMMC that Jason already mentioned is a great example of this. If you're serving federal manufacturers, ta-da, CMMC matters for you, right? But if you deal with a significant number of banks, and I have MSP friends and this has happened to, regulators can knock on your doors in MSP and say, congrats, we're now regulating you like we regulate our banks because we've seen you work with enough of them, right? So we're starting to see outside regulation and understand what an MSP is doing and starting to put their claws into that as well. And I don't think that's a bad thing. I think that's an interesting direction and is probably very helpful for MSPs that really say, now we've gone through the burden and we take this stuff seriously and there's a differentiator there.

Yeah, I kind of see it as kind of like almost compliance as a service and it becoming like a differentiator for a lot of MSPs. So it's, you know, they're not just managing the IT, the security, the firewalls. You know, they're making sure that they're going to be your partners to ensure that you pass those audits and that you're first to market with, you know, whatever X category you're in within your industry.

Yep. Yep. That's it. That's it.

The other thing that I didn't add real quick, I'm sorry, is I really hope in the next 3 to 5 years, right, we get some true baselines and non-negotiables for cybersecurity. So when I talk about that, I talk about like a minimum cyber hygiene and what that looks like because we have so many frameworks, we have so many best practices. But getting that, you know, understanding, quite frankly, across the U.S. of what that minimum cyber hygiene looks like. I would like to say within the next 5 years, you know, that's not something that people are just going, well, it's X for me. There is, you know, clarity on that. And it may come through regulation. But I would finally like to, you know, when we talk about table stakes, everyone understanding what those table stakes are and what that, you know, minimal expectation is.

Yep, yep. I like that. You know, I've never met Wendy Nather. She's someone I deeply respect. You may have met her.

I bet you have.

She coined that term cybersecurity poverty line, and I think it's a helpful way to look at it to say, what is the actual poverty line and what does it take to stay above it? Yeah, I'm with you. I wish we could get to a stage where that could be well-defined. You know, I think cyber insurance has their statements on it, but they're not unified from one carrier to the next, right? Each regulation is a little focused in different areas. And to me, that's one of the frustrations that a security practitioner has to deal with is what exactly is that thin red line of the poverty line? And it's not been expressed.

Can I turn the tables and kind of ask you a question a little bit here? Wes Spencer. Of course. So, and I don't know whether you've seen this or not, but in talking about this, you know, one of the thoughts that just kind of popped into my head and maybe MSPs are doing this is I'm all about change from all levels. And I'm just wondering in my mind as we're talking about this, how MSPs can potentially change this for their customer base. I'm wondering about health scorecards or scorecards that shows them in their, you know, area, even if it's just what the MSP knows about. Out, like, here's our customer base and you, you know, XYZ, rank in our 20th percentile. You're amazing. This is why you're amazing. And these are probably the benefits. Or going to somebody else and going, hey, you're in our lower 20th percentile. And in order to, you know, move to the 50th percentile, here's kind of what offerings you need. Right. And I wonder if that could not not only be a great sales opportunity, but a way to kind of, you know, lift all boats and all tides, you know, or rising tide lifts all boats. So I don't know, I'm just wondering what your thoughts are about that or if you've seen MSPs do that or if you think that would be potentially helpful or not.

It's very helpful. I think we're— I think we have the data to prove that it's a great idea. And I'll give you an example for those that are listening today. Look at Microsoft Security Score. Score, right? Is, is it the be-all end-all? No, but at least Microsoft took the time to say, look, if you enable these controls and configurations in the Microsoft ecosystem, it outputs into this score and you can automatically see, wow, you're at 52, whereas the rest of our clients are at 86. I don't even, as a non-technical decision maker, I don't even have to know what that means other than, oops, I'm behind the line. And Jason, I'll tell you where I first learned that. When I was at my bank, my bank would often talk about the Texas ratio. I'd be sitting in board meetings, my CFO would be like, well, our Texas ratio It was better than these two competitors and blah, blah, blah, blah. And every single board meeting they mentioned the Texas ratio. And finally I got done with my board meeting and I walk over to my office like, what the heck is this Texas ratio? So I type it in and I Google it. And wouldn't you know it, it's just a bunch of financial gobbledygook that looks at asset health of the bank, but it outputs into a ratio that if you're, I think that if you're 100% or better, you're in a good— or 50, I forget, let's call it 50% or better, you're in a good ratio. And what I learned was I started asking other people, like, I don't know what goes into that, only the CFO knows, but I know what the output is. And the output is what drives the decision-making. And I know that good science goes into the formula to drive the output. And that's where I think we need to be is get to that stage where, yes, there are the smart people that drive the formula and that calculate it, but the rest of us as decision-makers are simply looking at what the output score is. We use this all the time in things. Take MPG on a car. I don't know what tech goes into making your MPG better than my MPG, but I know your car is more fuel efficient. That's all I have to know. So like, I really wish that we would get closer into that and I really wish that someone would spend some time really getting closer into that because, boy, wouldn't that be a great thing?

Yeah, I agree 100%.

All right. So the question I think everybody wants to know is let's talk about this AI stuff, right? I know every talk It's always there. I know you just got back from one of the bigger security conferences in the world and you had some great conversations there. Can you help us demystify from a security leadership perspective what is AI genuinely doing in cybersecurity and maybe where is the snake oil? We see a billion vendors doing all this AI-driven whatever. Help us understand what's real and not real.

Okay, so I'm gonna get to that, but I think one of the things that I found immensely just interesting is breaking down what goes on behind, um, some of these models in these language models and how they're built. And hopefully everyone watching will find this as interesting as I did, and you'll allow me to just to geek out a little bit. And so one of the things in our discussions with Anthropic was understanding. So in order— my philosophy is in order to secure something, you have to better understand it. And so as we roll out AI models into our ecosystem, I'm really diving deep on understanding all things about AI, and that includes its, lack for a better term, brain, or what it's called, its neural network, which is designed after a human brain, right? It's organized with a group of layers. There's inputs, there's hidden layers, and then there's various outputs, right? And, and, and so this neural network is kind of how it thinks about what the output it's going to give to you. You. And there's some very, very interesting things. And one of the things that I found most interesting were some of the concepts about these neurons, if you will, that it— that Anthropic will tweak and turn up or turn down. And what that is, is it is the equivalent to— gosh, basically our— I think it's called our synapses and the weights within our brain. It's called synaptic plasticity, right?

I'm going to trust you on that.

Yeah. So anyway, so what that is, is it's the things that make up who we are, what our decisions are, what our ethics and morals are. And it's the compilation of, of who we are. And the reason that it puts this into language models is because they have endless amounts of storage, and so it never forgets. And, and then just the concept of why it would be good for a computer or a language model to forget that is because we're so reliant on cooperativeness. And if I remember that Wes told me something wrong two different times, I may all of a sudden not listen to Wes because I'm going to think he's going to be wrong the third time, and I'm going to give a higher prioritization to something that might not be as wise as Wes Spencer Spencer. And so they're literally going in and tweaking these nodes within the AI to get the outputs that are more human-like. So it's collaborative, so that it's cooperative, so that it is— so it has better answers. And it's just very interesting, very interesting how it goes on. And then when you're really pushing as to why it's done like that, that. It's because of some of the— and I'm sure, I'm hope, I'm hoping everyone that's listening understands the term jailbreak— but some of the jailbreak scenarios that have happened with AI where it didn't have various components of empathy, understanding, and, and where it would, for lack of a better term, go rogue. So all that was super interesting. And I say all that to kind of go to here. What is hype and what's not? There is no doubt that the magnitude— the magnitudes of which AI is getting faster, better, and smarter far exceed anything that we've seen in the technological— the technological landscape within the last, I would say, you know, 100 years probably. It literally is getting on magnitude— it is magnitude better like every time we come out with a model. So what does that mean? That means higher efficiency for the current workforce. That's going on right now. Like we're using AI to find new and innovative ways to compress data that literally saves us hundreds of thousands or millions of dollars in log ingestion. That's happening today. We're using AI to more quickly aggregate data that our SOC can look at in a more meaningful way in minutes versus an hour. That's going on today, right? Our workforce is using that to compile, you know, certain messages or certain information, you know, within Kaseya so that we can better communicate to each other. Again, helping with efficiencies. And then what we're trying to do within Kaseya is make sure that with all the data that we have, that we're providing the customer within the Kaseya ecosystem so that they can, you know, leverage an LLM to ask within their own Kaseya environment, hey, go get me X data and it can go get that. And you're not having to, you know, perform command props. You're not having to change windows. You're not having to do this. So, so I, I think there's, there's not hype around the efficiencies and time that it saves. And I think it makes everyone so much better. The other thing that I think it helps is I think it helps greatly with research, education. I think it helps when we're talking about code and being able to quickly scan and aggregate various vulnerabilities that may be within code. So all those things are going on today. Right. I don't see it displacing, right, half of the workforce immediately. I do see in the future potentially it replacing lower-level, entry-level, you know, jobs. And one of the things that, you know, Anthropic is doing is testing that right, right now in, you know, their security environment, which was very interesting to hear that use case and hear how they're how they're doing. So it's not all just hype. It is very meaningful. There are also some very scary components because if we haven't done the basics with our data, which means classification of data, which means tagging our data, it is very likely that AI will have access to data that it shouldn't have. And then we're going to get in trouble with with regulatory bodies. We're going to possibly leak information that we don't want to leak. And so it comes back to what we were saying just a few minutes ago, where we have to have a baseline of table stakes and understanding. And unfortunately, there are so many businesses and executives that don't understand that and just want to bolt on, you know, AI or an LLM within their environment without doing all the work required to make sure that they have their baseline data secure, properly tagged, and that you properly configured that AI tool within your ecosystem.

I hope anyway everyone listens.

No, hopefully. I'm sorry, I really geeked out and I probably went astray and lost some of our viewership and I apologize, but I just I find just the neural net and the understanding of the LLM brain, if you will, just so unique, so interesting. And it's just— I just love it. I just think it's really, really cool. It's almost science fiction.

Yeah, right. And what's that quote? You know, something sufficiently advanced is indistinguishable from magic. And I think the big takeaway from what you just said there— I hope everyone is listening because you nailed it. And I think one of the things that's really important from what Jason just said is to make sure that we understand the true science behind what AI is and isn't. If you're just rushing, to his point, if you're just rushing to throw it into your org without thinking about the use, why we're doing it, the governance around it, what data it should have, how it works, you're doing yourself a major disservice because he's exactly right. It's going to end up in ways that you— outcomes that you did not intend for, which could potentially even be security incidents. We're already seeing that happen. So man, I think you nailed it. We could go on and on on this question because I think it's so insightful and so interesting. Maybe the last thing I'll peel out that I thought you said that I thought was also awesome was understanding that it is disruptive and trying to get grips on where and how it's going to disrupt. There is a really great TED Talk by Eric Schmidt a few months ago where he was interviewed on what AI is doing. Of course, he was who is the co-founder of Google, for those of you that don't know, that are listening. And he made this comment of like, yeah, it's going to displace a lot of tasks, but it doesn't mean it's going to displace the people. And he said, and I think about that for the MSP today and say, think about, ask yourself this, what does your Tier 1 do today that 5 years ago you'd never dream of them doing? What are they doing today that 10 years ago was not even on your radar? I think the outcome of this is that your Tier 1s, your young people, your entry levels are expected to do to do far more than they've ever done before. And I think what AI is going to do is push that envelope. So if you're not investing in your people and you're not investing in the toolsets that they're using and where the future is going, that's where you're going to get behind, is that it's just making our people more efficient and the outcome and burden of what we expect them to do is greater than it's ever been, and that delta is only going to grow. So Jason, I love that. I don't think you geeked out at all. Like, I mean, it was the right geek out. It was exactly, exactly what I think we need to hear. So thank you. We've got time for just another question, maybe two. So if you don't mind, I want to go a little quickly on this question. In fact, can we skip this and go to the next? There's a question when you and I were game planning this question, you said some things that I thought were so impactful and I want to come into this first and foremost and make sure we leave time for this. Hard skills versus soft skills. What's your opinion of them? How do you as a leader invest in your people and how can we hone these things? Give us your thoughts here.

Yeah. So even though we skipped that, I think I touched on— look, being a CISO is one of the most challenging things that I've ever done, but it's also the most rewarding. And for the simple fact that we've crossed paths and I've crossed paths with so many other people that have made just a a significant difference in my life. So I very much appreciate that. Hard skills versus soft skills. Um, most of the people that we interview have decent technological skills, and when we talk about hard skills, I equate that to technological skills. Um, technological skills too, with the right mindset that I'm a firm believer can be taught. When we talk about soft skills, one of the things that I look for there, just to be perfectly blunt, is people that have gone through very difficult circumstances. And the way I described this to Wes Spencer was, I said, I'm actually looking for people that have dealt with some kind of trauma, basically. You know, and one of the most important questions that we ask in our interview and we challenge people on is what is the most difficult thing that they've ever had to deal with? And you will get a plethora of answers. You will get people that, you know, talk about just incredibly personal things, right? Certain people that they've lost or certain positions that they've been in or things where they had to take care of family members. And they have been extremely resilient. There's also people that have gone through great, great technical and emotional challenges at work where they've spun up whole security systems, where they have had to convince leaders of the importance of projects, plans, and everything else. So it doesn't just have to be this personal tragedy, but there can be tragedies at work where you lose entire leadership teams. And you have to step up, or where you lose direction and you're finding that you're setting your own direction and path. We've heard a number of answers, but what we don't take is we don't take someone going, oh, I had this really hard project at school and I did X, or I was given this really hard task at work and we did that. And my immediate response will be, I really appreciate that, but I'll stop them, right? Because it does you no good if you're not getting what you need out of the interview. So I'll stop them immediately and I'll say, look, one of the most challenging things I ever went through, and I'll either give them— I'll give them both a personal one where I've had personal loss and tragedy and trials, and then I'll talk about something I had to overcome at work. And I've got literally a 60-second clip on that. In the FBI, gone through many investigative as well as interviewing classes, and it's called give to get. You're providing an example, but you're also giving someone examples and giving them the freedom to open up to you. So I found it to be a great indicator of how much care, effort, and if you will, grit someone's going to have and bring to the table and the job. And if they have the majority of the hard skills, you know, we will create a plan to give them the rest of the hard skills, but we find it very important important that you have to make sure that they are the type of person, and especially as we were building out the program, I mean, so many people are used to being, you know, single-threaded in cybersecurity. And when you're building out a program, and especially in an MSP, sometimes you have to wear multiple hats. And someone that doesn't have those soft skills and doesn't have those resilient qualities and doesn't understand how to communicate is going to find it immensely challenging to be successful within those environments. Mm-hmm.

You know, I think, I think of diamonds, you know, and they're only forged in great pressure, right? And yeah, we now have lab pressure diamonds. It's fake pressure. I mean, it's pressure, but it's fake, right? And, you know, it's like, yeah, you're looking for those diamonds because it's the pressure that outputs into the growth, man. We can end on that, and I think we're gonna, we're basically going to have to. Can you give me just one last, maybe in a minute, maybe 60, 70 seconds, how do you personally avoid burnout in this kind of job that's nonstop high stress?

Yeah, look, in 60 seconds, you have to reach out to people, and Wes, you've been one of those people. I remember probably about 6, 8 months ago, we hadn't talked in 6, 6, 7, 8 months, and I called you up out of the blue, and I, you know, I was, I was having an issue, and we talked for about an hour. And I can't tell you how many times I've almost stopped myself from doing that. And the question that I always had for myself is, how would I react if someone reached out to me in a similar way? And whenever I frame it that way, I would be honored if somebody cared enough about me to reach out, and they have. But to reach out and say, hey, I'm going through something, I'd like to talk it out, or I'd like you to just listen, or I'd like your advice, whatever that may be. I've always found it an honor to be on the other side of that phone. And the way that I view it is that if I don't give somebody that same opportunity, I'm taking that feeling away from them. And so the way that I got on the phone with you was I, you know, rationalize that by saying, hey, I'm taking a wonderful experience and opportunity away from Wes Spencer if I don't reach out to him. And so it's having people in your life, whether you've talked to them in the last 30 days or the last 10 years, reaching out to them and being open with them. And, you know, Wes Spencer is one of those people that I know I could talk to today, tomorrow, or in the next 2 years, it would be like, you know, we, we never left, right? We just pick up right where we left off. And there are a ton of people in your life that are like that. But a lot of times we or I think that I'm imposing when in fact I'm potentially taking away something from them by not reaching out. Wow.

That, that is the quote we're going to end on. If you're not following that advice, I would I would highly recommend you do that. Battle buddies are something we all need. Oh my goodness, this has been so good. We could easily stretch this another 2 hours and, and Dove Rogan style into something long, but I really want to respect your time, Jason. I appreciate you as a friend. I appreciate the work you're doing at Kaseya. Really just thankful for you coming in and spending an hour with us. It's been awesome. If you want to learn more and follow Kaseya, of course everyone knows kaseya.com. You can pop that QR code there. There. There's Jason's LinkedIn as well. And then lastly, Jason's going to be, of course, at DataCon. So if you want to see him, give him a high five, say thank you for the webinar, he will be there out and about. Our next livestream is going to be on September 25th at 1 PM. So mark your calendars and we'll see you there. Jason, thank you. I just thank you so much for spending the time. It's been amazing.

Likewise. Thanks, Wes Spencer. Always a pleasure.

All right, everyone, thank you all so much for joining and hope you all have a great day. Thank you.