How To Systematically Identify Gaps In Your Security Solution

you are dialing in from and watching this live stream. We are talking about gaps. Could there possibly be gaps in your cybersecurity solution? Um, maybe you don't tell your clients that there's gaps, maybe you don't tell your prospects that there's gaps, but chances are high you might indeed have gaps. And I am chatting about that today with Wes Spencer. I feel like he doesn't need a whole lot of introduction, but Wes, in case there might be one or two people watching who don't know you, um, do a quick intro, and then we will jump into this topic.

Well, thanks, Jennifer. I'm sure there's, there's plenty of folks. So if you don't know me, my name's Wes Spencer, and I am a cybersecurity nerd at heart. I love MSPs and I've been around them for a number of years. I was one of the co-founders at Perch Security. We sold that to ConnectWise in 2020. And so now I'm just doing all kinds of stuff. I'm very involved at Fifth Wall Solutions Cyber Insurance, where I'm the channel chief there and having a lot of fun with that. And also the founder of Empath Cyber, which is helping MSPs grow in their security, right? That's really— I mean, that's what we're going to talk about today. But Jennifer, you know this better than anyone on planet Earth. It's difficult and it's hard and the conversations don't come easy and they don't— most MSPs don't come from a security background, so they feel like imposters. Right. And so those are all the things I'm really passionate about, just like you are.

I love it. I love it. Okay. So I want to start in a bit of an unusual place. We will get to gaps in the, in the security stack, but I wanna go in a little bit of a different linear angle. So before you can even have a conversation with a prospect or even a client about cybersecurity, hopefully they've come to you because of your marketing efforts. So can we talk about a little around the cybersecurity marketing concept? And maybe there are gaps in your cybersecurity marketing, but let's start there. What are you seeing that's working in the industry for cybersecurity marketing? And then we'll, then we'll shift over to talking about the gaps. You—

that's awesome. So there's two things that work, one that's good, one that's bad, but they both work. What— let's start with the bad. What works that's bad is sometimes we tell people what they want to hear without giving them any evidence or any real substance. And that's a huge problem. Like, I'm not going to pick on any vendors, but like what happens when you see someone that comes in and says our AI-driven next-generation security platform stops all threats before they, you know, before they, before they occur. It's like, well, if that were real, then why? Well, first of all, why do anything else, right? I just buy it now. Here's my wallet. It doesn't matter the cost for this. And then secondly, if it were true, Why are they the ones that don't have press releases coming out every single day of all these, like, new threats that they found and stopped? The unfortunate truth is it works, and people read things like that and they feel like, well, they have ML and they have AI and they have this next generation stuff and, and you don't, and, and I want that. And so they prey on— whether it's malicious or not— they prey on generalities that I think work fine when you're selling like potato chips, you know, but they don't work well when you're actually talking about protecting your business. And then the other one that works well, and I think is a much better way to go through it, is how do you message what you do in a way that resonates with people that don't know your product, that might not be technical, but you do explain it in a way that's effective for them to understand it, in a way that that is real, you know? So like, let's say you're an EDR, and so you explain it in things like, hey, like what we are doing, I'm not gonna go through all the details, but like, you know, our platform, you know, think of us like a home alarm system for your network. And one of the things that we're doing is we're looking for signs and threat activity on your endpoints. And just like an alarm system might correlate, you know, a hallway monitor movement and a window sliding open at 2:00 AM and therefore takes emergency action. We do the same thing in your network. If you'd like to find out more and see a demo, click here, and we'd love to jump in. But like, just really bringing it home for people in marketing that makes sense, that resonates with them, but also doesn't drown them in buzzwords that don't make sense. And so I think that's the flip side. That's a much better way to approach it.

I love that. And if you are just joining us live, I'm here chatting with Wes Spencer. Wes is going to be speaking at my event, uh, June 13th and 14th in Orlando. I'm going to put that link on the screen. Get your ticket. Tickets are going quickly. Um, MSPSalesRevolution.com/ultimate. It is the ultimate IT growth conference, and we're going to be talking about things that are specific to a little larger MSP. So the MSPs are about $1 to $5 million in revenue. This is very workshop component, so you're not just going to take in information, you're going to actually apply it in the room. And so one of the things that we're, we're going to talk about over those 2 days are the gaps that are inside of your organization. And Wes Spencer is here. We're talking about gaps in your cybersecurity posture and the gaps in what you're selling to the end user. So it's interesting because you just said that when you're talking about your marketing, that you've got to present this in language that the end user can resonate with. I love stories. I love analogies. Ironically enough, I'm doing an entire session on story selling and how to use stories and analogies inside of your sales, sales calls and inside of your sales framework. So, okay, so let's assume we've got decent marketing in place. That's probably a very high assumption. Um, let's assume that it isn't technical in nature, um, which, which I want to do a little parentheses here because MSPs, especially if they are the, um, the owner, um, if they're super technical, they're the ones possibly vetting the vendors, and they may also be in a sales role. They're having to take things in in both parts of their brain. So they're, they're doing the really technical understanding, all of the features and the deep learning and the machine learning and deep packet inspection And like all these things. And then they have to translate that into language that the end user is concerned about. And that is a, that's a hard job because usually the end user doesn't care about the tech. They just want to do business. So if you're doing a good job with your marketing, then people will start to say, I don't think I have that. I think I need that. I can't let that thing happen to my business. I can't be down for 2 weeks, 4 weeks. I am concerned about ransomware. Can we have a conversation? So now marketing has done its job and sales takes over. And that's where we have to make sure that what we are selling doesn't leave gaps. So how do we make sure in this, in this very complicated landscape that is growing more complex by the day, how do we make sure that there aren't any gaps?

Yeah, you know, so I'm going to— a couple of things. I'm going to steal a little bit of what I'm going to talk about from this right here, the Cyber Defense Matrix. This is from Sunil Yu. Really, really, really good book. And he saw the same problem, right? His, his problem was— and I met him when Sunil was at Bank of America, and Sunil actually came by our booth at Perch. And like, his whole job at Bank of America was they said, Sunil, you're a smart person, so we just want you to go and find all the innovative stuff out there and make sure that we like if we don't have it, we probably want it because we have an unlimited budget, right? And so like, we don't want to not have innovation, so go find it. And so he just found himself in this really difficult position of like, oh wow, you're Bank of America, you have an unlimited budget, let me sell you what I have. And so everyone wants to hawk their wares to him and everyone wants to talk about the latest and the greatest. And it really was frustrating to him because he's like, we have huge networks and tons of employees and yes, big budgets. But because we have so much, how do I know what I need? Where are my gaps? What, what, what are we needing to address that we don't? What's overlap? And is the overlap okay? And so that's what led him into that Cyber Defense Matrix. And without talking about the Cyber Defense Matrix itself on this livestream, the high level is this: is you got to have a way to understand what do I currently have in place, what's working effectively, and where do I have those gaps. And the only way you identify the gaps is by following some kind of methodical process, right? And this is where a lot of MSPs get scared because it forces you to go down this journey of alignment to a security framework. And so one of the first things— and I'm sure, Jennifer, you get asked this a lot too— but the number one question I get asked by my MSP friends, especially at conferences, is, hey, Wes, take a look at what's in my stack. What's missing? What should I add in? And my response is always, well, before we get to that, let's look at your— what security framework have you chosen? Are you following it? How far down that journey are you? What's that alignment journey look like? Are you 60% aligned, 10% aligned? Because if you're not going down a security alignment journey to a framework that is a blueprint for success, then you are by nature maybe a little of this, maybe a little bit of that, maybe this over here, and you're very reactive. Oh, everyone else says this. I saw a Reddit post. What's the best firewall that's out there? What's the best MDR that's out there, and it's anecdotes everywhere. And so this, this forces us to say, no, I'm going to throw out those externalities for now. I'm going to follow a framework, and I'm going to use that framework to understand what are the gaps that I have according to that framework. And that's the harder direction to go, but it's infinitely more valuable because it gives you the confidence that you're doing the right things in place. You're not just plugging holes where you see them, like an old cartoon, you know. And that's, that's the direction we need to go.

It also gives you almost a shopping list. I love events. I love trade shows. It's a great way to stay on top of trends and changes and talk to your peers. And how are you solving this problem? Are you having this issue? How did you solve it 3 years ago? Oh, this person's having a problem I can help solve. And so there's so much collaboration, camaraderie. Love events. I love that the sponsors are there sponsoring the events and talking about their services and their solutions. But it can become a little bit like chasing a shiny penny, especially if the marketing departments are really good at explaining what they do in a unique way. You're like, I don't have that, I need that thing, let me buy that thing and it's going to magically solve all my problems. And so to have a framework or a checklist or some type of a, like a NIST framework or something to wrap your head around and say, hey, I'm going around with my checklist and I know I have a gap. Mr. Vendor, Mrs. Vendor, do you— where do you fall on this? Do you— nope, nope, nope, nope. The thing I'm trying to patch right now is that, that box. Like, I'm almost picturing a grid like a battleship board, and like you're focused on B7, and you're walking from vendor to vendor and you're like, miss, sorry, I love you and I thank you for the swag, but I'm looking to fill this B7 hole. And so you're looking for that vendor where you can say, Hey, hit, let's have a deeper conversation. Let's have, you know, a demo or, you know, something like that. So do you see whether it's having the Cyber Defense Matrix or following the NIST framework, do you see MSPs mentally going down that checklist when they're talking to new vendors, or has it not quite sunk into that level?

I see a few that do it, but not enough. And you know what's interesting too about that, Jennifer, is the ones that are very framework aligned, like I'll mention, like for example, Eric Woodard from ProTech. You know, they've gone down, they've chosen CIS, Center for Internet Security, the top 18 controls. They've chosen that. They've gone down that journey. And what's interesting to me is I notice when he talks to vendors, because he's already very framework aligned, he actually has the ability to kind of see through the fluff of marketing and automatically know, I'm not even going to talk to them because I already know what they do and I don't— I've ignored their marketing. Or I do want to talk to these people because they're doing this really cool thing. And I've seen him attack it that way, like, hey, You know, how do you guys help with Control 14.2? I'm really struggling with this one. This is where I'm trying to address. And a good vendor that really understands what they're doing will jump in and say, oh, I love that. This is exactly what we're doing. We see the same problem. I'll give you an example. I won't name the vendor name, but he was looking for somebody to help him with security baselining and he found a vendor that does a really good job of that. Here's how we baseline and this is what we look for to do. And he's like, that's that. I'm trying to solve that right here. And like you mentioned, the battleship kind of thing. I love that analogy. So yeah, I noticed that with some. But I think most vendors, I don't— most MSPs, I don't see that, unfortunately. And I think when you let the vendor— and this comes from a vendor, I am a vendor— when you let the vendor dictate to you the problem that you have, then they control that conversation a little too much. And they can tell you the problem. Do I really have that problem? How significant is that problem compared to all the other problems I have? Right. So who takes control of the conversation will lead into where the success comes from. And I think it it behooves you as the MSP to take control of that and understand what your gaps are and what the big problems are you're trying to solve. So then you can have intelligent, meaningful conversations with vendors when you speak to them.

Okay, so before I want to dig into that vendor conversation just a little bit more, but in case you are just joining us, I'm chatting with Wes because he's coming to my event June 13th and 14th in Orlando, Florida. It's probably a drive for Wes. For me, it's a flight. But this is going to be all around growing your MSP. It's for MSPs that are in that $1 to $5 million range. We're talking about growth strategies, what is working today. These are not strategies you're hearing anywhere else. And then of course we have tons of cybersecurity content as well. And what Wes Spencer is going to be talking about is finding those gaps inside of your solution stack. So if you don't have your ticket, make sure you get it. Go to mspsalesrevolution.com. There's the link right on the screen, slash ultimate. It is the ultimate at IT Growth Conference, and we're chatting a little bit about these gaps and how sometimes vendors are not necessarily speaking to the gaps. They're not talking to a framework. They're almost speaking in features, bullet points, the things that are the— that make the engineers the happiest. And so what happens if you have a vendor who has aligned to one framework and then you have an MSP and they're stubbornly, right, whatever they picked, they're probably stubbornly tied to that framework. And then you have a knowledgeable MSP walk up and say, how are you, you know, how are you checking the box for 14.2? Is there a disconnect? Do you feel like the vendors should know how their solution maps to every compliance standard under the sun?

Yeah, maybe not every. But the good thing is there's what we call crosswalks. There's several of them that are out there. In fact, even like I'll use CIS as an example. When you look at CIS's controls, it crosswalks over to like ISO standards to if like, like industry specifics like HIPAA, HITRAC, FFIEC, PCI, it'll, it'll actually cross-reference where they fit into with each other. And so, boy, if I'm talking to a vendor that doesn't know that, how it cross-maps and crosswalks over, I'm either talking to a really immature vendor or just someone at the org that's the wrong person to have the conversation with because there should be somebody at that vendor that understands, oh yeah, we really speak CIS, really speak really well because most MSPs do, but your, your CSF, great, no problems, here's where we crosswalk over that. So that's a solved problem. And if you don't know that as a vendor or as an MSP, go, go figure that out. Just search like, um, like security framework cross maps or crosswalks, and it'll— you'll find spreadsheets that come out with all of that. Because it's one smart thing we nerds have done is figure out, okay, pick your framework that works best for you. But we all recognize they're just frameworks. They're— they, they have great advantages, they have disadvantages, they have problems. No framework is perfect, right? And so yeah, that, that's kind of how you want to solve that one if you're an MSP, is, is just know that there's crosswalks that'll help you.

Love it. Okay, so good advice for the MSPs as well as the vendors. Hopefully the vendors mostly know that at this stage, but good advice. I love it. Okay, I want to take a little bit of a shift. This doesn't necessarily line up to gaps inside of your security solution, but it does pertain directly to selling cybersecurity And that is the growing cyber liability insurance issue, which is near and dear to your heart with Fifth Wall Solutions. How are you seeing MSPs leveraging that trend in our marketplace?

You know, I've— I'm noticing— I saw it coming as a shift a couple of years ago, and I'm really seeing it start to come full force. You know, what's interesting is not just in cyber, but in every industry, insurance holds a lot of sway and they really steer so much of what is done in this world, what can and can't be done, all the way down to like you walk into a building and like, you know, oh, we have to do this thing this way. Well, why? Because insurance requires it. Oh, okay. Well, that's the way we're going to do it. I took my kids to like one of those trampoline parks and had to fill out this really stupid, like, you know, oh, your, your, your waiver expired. So we have to have you sign a new one. I actually asked her just because I was curious. I'm like, why? And she goes, oh, well, insurance makes sure that annually you have to renew. And so you just have to like, there's no— what are you talking about? There's no need to decide it. Insurance just says it. So you have to do it. And at the end of the day, it makes a lot of sense because if insurance is the one that's pocketing the cost or handling the cost of a claim, whether it's cyber or anything else, they're the ones that get the choice to say what's good and not good. Like, that's the— that's the truth.

They get to call the shots.

Yep. They call the shots. And so in cyber, we're seeing that Jennifer is like, like MSPs are recognizing that if we can tackle this requirement that clients have and we can help them with it, then we can leverage the needs that cyber insurance has to determine eligibility to our advantage. So for example, just take, um, FTC safeguards. FTC safeguards are now forcing all kinds of new security controls on top of anyone that's involved in you know, payments, even like car dealers. And so if you look at what happened, it's happened in the car dealer world. Car dealers used to be known— MSPs would agree with me— the most stingy, notoriously not going to spend a penny on anything. Well, now what's happened is FTC safeguards is changing the requirements for that. They have to put in more controls. And now a lot of the auto manufacturers are requiring their dealers to get cyber insurance. So Toyota is an example of this. They require every one of their dealerships to carry $5 million in cyber. So now what happens is the game has shifted because if that dealer wants to continue to have Toyota on their name, on their building, and they want to make the millions and millions of dollars they're earning, then they're going to have to put in some things in place and they don't have a choice about it. And so what's great about it is Cyber comes in and says, you got to do all these things. And if you don't like it, you're not an insurable risk for us. So we're just— I mean, it's cut and dry. Take it or leave it.

Right.

So now the MSP is like, oh, Oh, well, I can use this now because now anytime someone's got to be— they need to have insurance, I can sell them a package of things that they need to have in place, like EDR everywhere, MFA everywhere, managed backups that are immutable, security awareness training, vulnerability management, all these required solutions that you have to have in place to be eligible because insurance requires it. And here's what happens, Jennifer, is like, I've never seen a client go, yay, that's awesome. But what I always see them say is, ah, Well, cost of doing business. We'll do it. And that's what we need sometimes.

That's amazing. Yeah, I love that. It's so interesting. Anytime the pressure is coming externally, like almost from this entity that you can't control, it's kind of like, well, I can't argue with you, so I guess I have to do it. I have a client who they got a phone call from a prospect, tiny little company. Hey, I've got 3 or 4 computers and the MSP was about to say, I'm not interested, you're too small. And they said, before you tell me that I have to have 10 or 15 computers, can I explain what's happening? I will meet your minimum. I will spend what I need to spend as if I had 10 or 15 computers because I make a component for PlayStation or Nintendo or something. And I am the only supplier. Like, you want to talk about supply chain risk? And so the game design company sent to this tiny little manufacturing company You must get serious about cybersecurity because right now that is a risk to us if we lose you. You have to be able to make this, this component, this chip, whatever it was. And so this tiny little company that had probably not cared a lick about cybersecurity said to the MSP, we need it and we need it in a month and we don't care what it costs. That's like fantastic because the pressure was external. And so I love that cyber insurance angle. I feel like there is a lead gen play, like, um, download our checklist or sign up, tell us when your, um, when your thing is renewing and we'll meet with you 90 days before and help you to fill that out. And magically we're going to find gaps because they're there, and now you slide in with, with your solution that hopefully doesn't have gaps. Um, and now you're the hero, which is a completely different pivot, uh, from normally where, where you're scrounging and, you know, scraping to try to get leads.

That's right. Yep. I kind of look at it like this. There's really 3 ways to get a client to, to do the right things when it comes to cyber. One is they're in a regulated industry, so period, they just have to, like, you know, banking, healthcare, DOD, manufacturing, uh, that just— you have to. And then the second category is if you're a good educator, if you're a really good teacher of security, you can get clients to move. And that goes back to what Mark Lamb said in that comment of, you know, we have to be— we have to help them understand the risks. And so if you go into those conversations, you can actually detect this with a client. Jennifer, I know you know this too. You can ask a client, so if you had a cyber breach, how much do you think it would cost? Right away, the answer that they give you will tell you how much they need to be taught on this because the knee-jerk is usually, oh, like $50K, $100K. You know, it really stinks for us. Be bad. No, that should be a lot more. Let's explain why. That's the second way. And then the third way is mandates from, like you mentioned, their supply chain. They're required to carry cyber insurance, or you educate them on why they need cyber insurance, which then turns into the mandatory controls you have to have to be eligible. And so I just look at it as like a third opportunity for MSPs to be able to sell, because I know at the end of the day, it's easy for me to sit here in my, you know, ivory tower and tell an MSP— MSPs like, yeah, Wes, you always tell me I need to be better at selling, but it's really hard in the trenches when I have a small client doesn't want to budge. I get it. I know I get it. I can tell you all day long you should educate them and they try and sometimes it doesn't work. So sometimes you just need a little teeth. You need a stick, not a carrot. And cyber insurance can be that, that stick in the right situation.

I love it. If you are just joining us, obviously we are chatting about gaps inside of your security solution. I'm talking to Wes Spencer because he's coming to my event in Orlando, June 13th through 14th. If you don't have your ticket yet, you're going to want to get it soon. We just announced a keynote speaker. It's not even out on the website yet, so you can get in at the super early bird pricing. Very excited about the keynote address, but I'm also excited that Wes Spencer is going to be there. We're going to be talking about a framework that helps you to identify these gaps that you probably have in your solution stack right now. It also provides a way for you to vet vendors and find— I, I just used the analogy a few minutes ago of a battleship, like I'm looking for B7, and you can then go, oh, you're a miss, you're a miss, you're a miss. And they're like, oh, you might be a hit, let's have a demo. And so it makes it much easier for you not to get into technology overwhelm or adopt a shiny penny that you don't really need. Um, so make sure you get your ticket. This is really designed for MSPs that are in that $1 to $5 million in annual revenue. Um, so these are not, um, these are not hacks, these are strategies and systems that are designed to help you grow.. So get your ticket, MSPSalesRevolution.com/ultimate. You get to see Wes Spencer, you get to see me, and about 150 of your colleagues. So it's going to be an amazing event. So you were just chatting a little bit about marketing and how marketing leads to the sale and how MSPs need to get better at selling these solutions. Let's park on the, the concept of the, the insurance for just a while longer. So you said carrot and stick. So the carrot would be, you should do this for the good of your company, the good of your employees, so that you can weather the storm a little bit easier. The stick would be, I'm sorry about the insurance company making you do this, but we happen to be able to help you. One thing that I hear a lot from MSPs is that they don't want to sell based on fear, the FUD, the fear, uncertainty, and doubt. So it feels to me like the insurance angle is a very comfortable, non-fear, uncertainty, and doubt way of selling. Is that what you're hearing from the MSPs that are using cybersecurity insurance as an angle?

I am. I love that you asked that question because let's take a minute and think about why do we sell on FUD? We sell on FUD because we're not confident. We sell on FUD because we think, well, I don't know how to get them to move unless I scare them into it. And there's always an element of like when I do my cyber insurance talks, people will come up to me like, oh man, that was a little scary. I'm like, but why was it scary? I'm like, was it scary because I scared you about hacking stuff, or is it scary because you realize you're not ready and you've got a lot of work to do? And they're like, it's the latter. I'm like, okay, good. Then I'm okay with that.

Yes.

But the reason we go to FUD is, is honestly because we don't know another way. And so if we can scare them into it, Well, what else? What other opportunity do I have? And so, yes, I 100% think I'm— that's why I love that you asked the question, because it's yet another avenue for us to not sell on FUD, but sell on reality. And so you can— and you can be the rescuer in these situations. I can't tell you the number of conversations I've been on where it's us and the MSP and the insured, you know, the client, their clients trying to get through this insurance thing. And sometimes it's even a prospect that the MSP brings in with us because they're like, hey, we've— this, this is a local client. They couldn't, they got dropped on their insurance, they got denied, they're trying to fix it. And they, you know, the carrier came back and said, you need all this gobbledygook, we don't understand. Fifth Wall, can you help? And so we'll join in and all of a sudden the MSP gets to be the hero. You know, that whole like, I don't know if you've seen like the whole like StoryBrand kind of thing of like, you know, turn them into the hero. Our job at Fifth Wall is like, I want to turn the MSP into the hero. I want them to be the one that comes in and rescues at the last minute with the solutions that they need so that the client can get what they need, which is not paying more money for security. It's that they keep their contract with their supplier so they can continue to make money. At the end of the day, that's what they care about. And so the client has to spend another $10,000 to $15,000 this year to be able to still be— to make their millions of dollars and buy— put bread on the table for their family. They're going to do that. They're going to be happy about that because the MSP comes in and rescues. And so So to me, yes, that's what all of it comes down to is another opportunity for the MSP to be able to come in and not sell on FUD, not sell on things like, well, you should be scared. Look at this darknet market. What this darknet, you know, no, let's just sell on, let's, let's help you in your journey. Let's lead you forward. I'm like, man, I'm so glad this MSP helped me because otherwise I got denied coverage and I didn't know what the heck I was going to do to solve that problem. Oh, isn't that awesome?

Yes. Yeah. Then you are the hero. I mean, truly, you've ridden in on the white horse and saved the day. And that's a completely different position than, oh, I scared them into a sale. Even if they both end up in the same place where they've bought and they're much better protected and their risk is reduced, it's a much better, stronger position. So someone on Facebook is saying, is there a leading cybersecurity provider for healthcare that MSPs work with for their clients? And I don't know if we're talking EMR or what's— do you know specifically what they might be asking?

I don't. But this is a great opportunity. It's a great question. It's a great opportunity to peel this back to the beginning of the conversation, which is there's a lot of great providers. What I would want to do if I'm searching is, again, what am I trying to solve for? When we talk about cybersecurity, what element? So you don't know what element unless you know where you're at in your security alignment.. So you can kind of figure out what am I trying to address. So now, so what I would do to answer that question is I would say, well, first let's find out where, when it comes to like HIPAA and high tech and the requirements around ePHI, what am I doing now to make sure that I'm compliant with those regulations? Then once I know the regulations and the requirements that I have, I can then start to see here are my gaps. And then once I understand where my gaps are and what I'm trying to solve for, now I can intelligently go to other vendors and say, What do you provide according to this, like HIPAA section, whatever, whatever, whatever? I'm trying to solve for this. What are you doing around that? Maybe log retention. How do you help with that? Is that something you do? So, so that's— that would be my answer is there's a lot of great vendors, but first you got to know what you're trying to solve for. You don't know what you're trying to solve for until you know your alignment into the regulations and the requirements there. So sorry to not give an answer as an answer, but there you go.

Yeah. What's the question we're trying to answer? And then now let's solve for it. I love it. So if you're just joining us, Wes Spencer is going to be joining me in Orlando June 13th through 14th. That is my annual event. So if you don't have a ticket yet, MSPSalesRevolution.com/ultimate. The room holds 146. We're gonna somehow figure out a way to cram in a few more than that because tickets are moving quickly and I want you to be in the room. So if you are a growing MSP and you are serious about tackling the cybersecurity challenge and you're looking to grow and you're looking for strategies for that, come get your ticket. MSPsalesrevolution.com/ultimate. It is the ultimate IT growth conference. You know it's the ultimate growth conference if you've got Wes Spencer, you've got me, uh, you've got Ian Richardson. We've got some surprises in store. Oh, we've got some out-of-the-box surprises if you're not on my email list, um, you should get on it. We're announcing that via email tomorrow. We also put it out on social, I believe, yesterday. So very, very fun, um, unique way of looking at business and life. And everything that we do is very workshop-centric. So this is not the kind of event where you walk out with a million things to do and then you go back to the office and it becomes business as usual. Um, this is actually an opportunity in the room to get things done. So, and I agree, Jim said Wes makes everything better. So Jim, I don't know if you have your ticket yet, but you gave me an open invitation there. You need to get your ticket. Yeah, Wes Spencer is fantastic. Anytime I have a chance to share a stage or be in the room with him, I take that opportunity because he does indeed make everything better. So, and Jim was also saying earlier that it was a great question that you were answering about HIPAA, high-tech HIPAA, how to ask good questions and knowing what question it is that you need to answer. So, Jim, I appreciate you being on for sure and engaging in this. So Wes, we are about out of time, but my goodness, thank you so much for all of the value that you added just in this live stream. Any final thoughts as we wrap this up?

Yeah, I think final thought is I hope you come away with there is, there is a pathway. That pathway is going to take a little work. But you know what's interesting to me, Jennifer? I have yet to talk to an MSP that said to me, you know, we've spent a better part of a year working hard on alignment to a security framework and building maturity into that. And we regret that we did it. I've never met anybody that said that. Everyone is like, that was some hard work, but we're now better for it. At. We are— engineers are much better at speaking. Our salespeople, they know how to speak and make sure that it aligns correctly and that they can talk to the right industries and they have the right conversations with decision makers. They speak with more influence and more authority. They're not just wishy-washy. They know it's good security because they know it's aligned. And lastly, our revenue is starting to grow like crazy in security. So it's some work, but if you're willing to put the time into it, it will pay off dividends. And I've yet to talk to an MSP that regrets it. And I don't think I'm going to because of how valuable all that is.

Amazing. What a great way to end this conversation. I cannot wait to see you in a couple of months. Always a pleasure. Thank you so much for your time. I appreciate it.

Jennifer, thank you for having me.

Absolutely. Have a great day.

Thanks.