Right of Boom Musings and Cyber News! Live with Emapth!

Well, well, well, what's going on, friends? How's everyone doing today? Kyle, what's up, brother?

Good, man, good. Just, uh, still got that little conference hangover going on, you know?

Oh man, yeah. Let's pull the music down just a bit.

Uh, let's see, music like we're in an elevator.

Oh, it's—

we're on hold.

I think they've got elevator music. It's like lounge. Yeah, let's play some lounge real quick. I think this is gonna be terrible. Let's see what we get. Yeah, I actually dig it.

Do you?

They also have chill hop, and I'm a big— let's, let's, let's play some chill hop, uh, just as some BGs here, man. So yeah, we got back.

I got back.

Alex and I were on the same flight home. Uh, a whole bunch of others were on the flight with us. Um, a bunch of— did he fall asleep from Tampa? What's that?

Did he fall asleep?

Um, no, he, uh, at least I don't think so. He was a little further back from me. Um, I, I just don't sleep well on, on flights. I, you know, once again, the Wi-Fi was fairly garbage, so I got some things done, but it was just spotty. We got, we got, we got in around like midnight. It took like an hour to get our bags. We're all waiting there. Uh, I just no idea. I guess when there's like 3 flights coming in, there's only one guy pulling the bags back and forth, probably. So I didn't get home until like 1 Did the booth make it back? Um, yes, the booth did make it back because Alex and I kind of walked out of the parking lot together. I can confirm we have the booth. And like all startups, we, uh, had that thing printed last minute. I don't know if you had a picture you can share, but, um, it actually turned out pretty awesome. We were excited.

I mean, let me pull that up because if people don't know yet, we're actually a real company now. Yeah, right.

We've— while you're looking, we've— yeah, we've been building behind the scenes for 6 7, 8, 9 months now, better part of a year, um, over 9 months, man, it feels really good to actually be out, to have a conference, um, to actually have a whole bunch of MSPs sign up, over 100 MSPs that joined in with us. Uh, let me share that out for you. There we are. Yeah, look at that bad boy. Let me just max that thing.

Uh, there we go.

Yeah, man, super cool. Here we are, uh, real deal company, uh, with real deal friends on board, and, uh, man, it was a whirlwind. Um, what hit you, Kyle, the, the most, um, just personally speaking, from that, from Rite of Boom?

Oh, what hit me the most, uh, honestly, how many people were there going to, right? We, a lot of us think about Rite of Boom as a kind of like a subject matter expert, like I'm going to Microsoft Ignite or I'm going to something that's very much based in my skill set. But to see, for me, how many people were going to a cyber-focused small business conference shows that it's an actual point of conversation that everyone's concerned about, and beyond being concerned about it, trying to do something about it. Yeah. Um, I know I made some LinkedIn jokes today about seeing too many owners there, which we can talk about later, but I did talk to a fair fair amount of non-owners.

Yeah. And for sure, Write-a-Boom has been notoriously successful at attracting more mature MSPs. I think, you know, I noticed this in the size of MSPs that we talked to. Not that size dictates maturity. Don't hear me saying that, but also just what MSPs are doing in their security journey. You notice in conversations they tend to be a little bit further ahead. And, you know, I think that's good. I think the industry has always needed a good conference that is a little bit more neutral, that hopefully is not pay-to-play, that hopefully is representing the interests of the MSP first and not those that are piling in the highest amount of dollars to come in. And, you know, that's, that's the flag that the MSP space needs, whether that's cybersecurity, that's operations, that's finance, it's, you you know, just marketing, whatever it is in the MSP space. We need more of that. And so, um, and by the way, I just happen to be wearing this shirt today, uh, shout out to MSP GeekCon coming up in May. If you guys aren't planning on going, that— let me tell you, if you're watching this, I don't know who you are from an audience perspective, but if you're an owner and you're watching today, consider sending your folks to MSP GeekCon. Um, just MSPGeekCon.com, check it out. It's in May. It's going to be a great event because, again, going back to like grassroots, going back to purist mindset, going back to a good focus on an audience and a niche, being technicians primarily in mind, you need to send some of your folks to that conference, reward them and have them get out of their little box and have them grow.

Well, and I think Wes, like, and maybe you can reflect on your time going from bank to vendor to MSP channel, that exposure really isn't just for the owner. Someone needs to figure out who your audience is. And a neutral conference is probably the best way to do it.

Yeah, it is, right? And, you know, the best thing about conferences are sitting down with people you may not have ever met before, catching up with old friends, and just talking about what's working, what you're up to, what you're into. It's just amazing how we don't have to do this by spending enormous amounts of money at conferences to do this. But that's just kind of how the world works. It's how the human psyche and brain works. We need, you know, birds of a feather flock together, all these things. It's important for us to get together and do it. And conferences just become one of one of those accelerators for that. And I'm shocked by how many MSPs there are that just don't go to conferences, don't show up to them. I'm like, why would you not do that?

No, it's just a party, right? I've heard that before of, oh, it's just a bunch of people hanging out and drinking and going wild. And it's the conversation between the partying and between the sessions sometimes that have the most impact. I mean, Wes Spencer, that's how you and I met. Like, there's people that I have cherished relationships in my life that I've only met and actually built companies with, right? I can firmly say that now because of those, just I was there and present.

Yep. Yep, exactly. Exactly. So to me, that was one of the highlights. But boy, you know, let's talk about Empath for a minute. It's our livestream. We talk about ourselves. I think we can get away with that. You know, I, you guys, you and Alex know, I tend to be a worrier when it comes to our business, right? And I just, it's in my nature. It's in my DNA. And, uh, worry one was, you know, is everyone going to laugh at us? You know, yes, everyone's going to laugh at us. They should be laughing at us. But maybe not from the product perspective, right? Are we really building something that's real? And, you know, when people come up and like, so I see this Talent Factory thing that we, by the way, shamelessly stole from, uh, Peter Kajawa— just the term he used one time, it struck with us what we're building. But, but Kyle, when we also sit down and talk to, uh, MSPs about what we're building, we say things like, well, MSPs don't hire from Microsoft or NSA or Ivy Leagues. They hire from Best Buy, they hire from the AT&T store, maybe even Starbucks. And we hire for personality first, and then we have them next to us, and it's everything's hip to hip, everything's like, follow me around, ask good questions, you know, um, but you're on your own. That's a scary proposition, yet 100% of all MSPs are in that boat, right? Maybe we have some SharePoint videos we've standardized, that's it. There's no There's no accountability in the process. There's no standardization. There's no measurability. How do we get them up to speed into the role that we need them to be in? And how do we measure that? We've never done that before in this industry. And so I think talking to MSPs about that and then showing them in 5 minutes what Empath is all about was powerful. I think people really were really excited about what we're doing.

Yeah. And what's funny is you always hear better marketing from prospects and customers than you do from what we sit around in the room and guess what's going to resonate with people. Mm-hmm. And I was talking to an MSP at one point and he goes, oh, well, we suck at creating process, but if I can show in a quick 2-minute video what I expect people to execute on, that would immediately eliminate half of the thought process that goes into writing a process that goes into a document that then goes into SharePoint to die.

Yep, yep. And let's talk about that for a minute. I don't care if you use Empath or not, You've got to get into that habit. The person who speaks about this most in the MSP channels, Eric Bowles, and Eric is like, flip your camera on and just speak. Don't worry about ums, don't worry about looking at the camera, just flip it on and go. Whether that's internal, here's the mission of who we are, encouraging your folks, whether that's an internal training how-to, whether that's an external, I want to talk to my clients and prospects about A, B, and C. Just flip it on and go. And I think one of the tools you've been enraptured with most lately is not really a pitch. We make no money for saying this, but it's Loom. Talk to me about, Kyle, how you guys— you personally, I mean, I use it too, but you've been in it nonstop. How Loom has sort of changed your game a little bit?

Well, I'm actually going to push back a little bit because you gave me the podcast that I listened to that then allowed me to jump into Loom. I think it was Founders Brand, and they were talking about asynchronous communication versus synchronous communication. And how we've created a society where everything feels like it needs to be synchronous. Everything needs to be a meeting or a chat stream. We've lost the ability to just send memos. Hey, at your convenience, watch this. At your convenience, read this. And I got, I got encapsulated the idea of Loom because I can record my screen, I can record my video and my microphone with a click of the button and instantly send Wes Spencer a video, or one of our other employees a video where Hey, it takes 2 minutes. I can watch it at 1.5x speed and I can real quickly show you the problem I'm looking at or the thing I need them to do. And the funny thing about it is the problem with Loom is there's no accountability. When I've sent the link, there's no way for me to track back to did you watch it? It's still the SharePoint problem of it sits in a folder for someone at some point to go learn. So the fact that, right, there's now a system where you can take that video and assign it to somebody and then have transparency and they never went and watched it, that's like a missing piece to this whole puzzle. And I think even furthermore, making sure someone watches it that may not exist at your company right now, right? Because it's just going to die on the vine if not.

Yep, yep. And so I encourage you to take Kyle's advice there, whether you use Loom or OBS or Microsoft Stream does it now too. Yeah, pick one and go, but get into the habit of quick videos, quick training, quick how-to, quick encouragement, quick Friday thought, quick Wednesday business XYZ.

And lunch and learns where the entire company has to shut down for me to show you a process.

Yep, do it. And then, yeah, I mean, like you said, the fact that now with Empath we have a place for it to live, to a place for you to send it out to make sure folks have watched it and even standardized processes around what if you have a ton of looms? Here's our— here's critical— here's who we are from a mission's perspective. Here's what we're all about. Here's the kind of clients we have. Here's what we— here's how we talk to clients. Here's how we handle objections and problems. Here is our culture. I would MSP say, I make sure every employee knows in onboarding, if you get— if you're talking to a client and they're cussing you out and you're angry, you hang up on them. Because he says, you as my technician are far more important than any client out there, period. We're not dealing with that. He's like, that's a mission thing. Unless I tell them, they're going to like, they're going to, they're not going to know how to handle that situation. So he's like, we're pushing that into empath onboarding so that every one of my new employees knows what we stand for. What a great idea. It takes 10 seconds to record that on a Loom and push that out, right? So exactly right. I think that's so important for us to really start thinking about formulating. One of the things we talk about and why that's so important Kyle, I'd love for you to elaborate on this, especially with your background with even Best Buy, as I mentioned them. You've got to have an organized process to onboard and standardize for new folks, whether you hire 1 new person a year or 1,000. If you don't have a standardized onboarding process, you're going to be in a period of pain consistently because of lack of consistency, because of people marching in different orders. Talk to us about why that's so important, Kyle.

It's so important because at some point people have to be able to do their job. The number— and here's something that every MSP can go measure, which is how many days does it take every one of your employees on average to go from zero to accountable? Meaning, what does accountable mean? In that instance, they can do their job without dragging on to another employee. Now, they're not going to be an expert employee. They're not going to be the most efficient employee. We're not asking for either of those things. It's they have the ability to transact tickets for a lot of MSPs, right? That's going to be mostly the help desk or the sales outbound or the, or the, the AR reconciliation transactions. But regardless of what their definition of is working day to day, how many days does that take to get them to that point? And when we were, when I was at Best Buy, it was 290 days. So a Geek Squad employee would take 290 days to go from zero to now I could stand at the counter without my boss standing behind me and give a client the service that they need. And we realized when you're hiring 1,200 employees a month, 1,200 employees per month, that that is way too long because that means for 290 days I'm not making a dollar of revenue out of that employee. And when you're an MSP and your hiring cycles are slow, that really then becomes a cash flow constraint because now I have payroll tied up in just training. So I see a lot of MSPs where they do this rip the band-aid thing off and they sit someone at a computer desk and say, just drown yourself in training for the next 30 to 45 days and learn everything. But then they never go back and double-check everything. And that's the scary part. And you see a lot of labor burn that happens because no one goes back to the 37 portals to say, hey, did you take it? But then here's the other thing, Wes, that I challenged an MSP with at WriteUp Boom was if they expect me to write all of their training as a software vendor, they're missing a third of the education that they need to be successful because a vendor can't train your employees 100%. I'm curious, Wes, at Roost— or I'm sorry, at Perch. Wow, a little slip there. Aaron Chernin is fresh on the mind for me. But at Perch, how many tickets did you guys get on the help desk that were, hey, Perch isn't doing what it's supposed to? And it turned into a configuration of how they were using the tool, not the actual tool.

So common that we ended up building that into customer success before we would say— before we could mark an onboarding MSP partner or one of their clients as like complete. It was so like things like the network taps or however they were doing their routing so we could see the traffic wasn't set correct, um, the logs weren't correctly being deployed because of agent issues, um, like visibility. Just so many of those common configuration issues where 99 times out of 10 when a client would come to us in the early days and say, yeah, we're just not seeing a lot of value, I'm like, come on, what? Um, and so we would have to deal with those things. And then also even dealing with education that comes around it around like If you're not seeing value and we do know that you have, you've been onboarded correctly. Now we know how to talk to the client. Now it's actually your shields are up and we're not seeing a lot of things. That's confirmation that controls are working effectively, like not seeing anything is good. How often you get mad at your alarm system when it doesn't alarm, alarm you at 2 a.m. every night, but you shouldn't get mad at them at all because you know it's going to if that were to happen at 2 a.m., but we don't expect it to happen often. So, so it really drastically affected the data comes into effect. How do we know what to say to the client where they're at? So, so yeah, I think those things are just critically important and you've got to have that in place.

Well, for all intents and purposes, it's not really up to Perch to train their employees how they configure the tool, but you have to do it because there's that expectation of it. And we saw this all the time with PSA configurations of they would call ConnectWise and say, Sierra Pacific Group set this up this way, and we need you to help us, uh, to replicate that. And they'd be like, well, call Sierra Pacific Group or do it yourself, right? When you go buy a Pardot from Salesforce, you buy a HubSpot, right? They give you the nuts and bolts, and then they tell you, okay, as long— you need to create the documentation of how your company uses this tool. How do you swing the hammer? And those are where things like Loom or Microsoft Stream are so valuable Now it's, hey, here's how we expect you to complete a ticket or to set up a log system or set up SNMP.

Yep, yep, exactly right.

And I think this comes full circle for Write a Boom because, right, a lot of this stuff isn't tool your way out of the problem.

It's not, right? It's not tool your way out of the problem. And nor does buying a plethora of tools solve these problems, right? You can't hire your way out of those pain points. You can only start using tools to address processes that you're aware of, burdens and gaps and deficiencies that the human element is struggling with because you know you have it because you can measure it, right? And then we can begin to see those things, right? So like, and how many times do we actually introduce added burden when we rush off to something new and we haven't properly calculated? So I had a conversation with MSP one night at ReadyBoom and he said, you know, we've been doing all this work around tracking profitability in our security offering. And he's like, I just can't quite nail down what that perceived price should be. And I'm like, that's because there isn't a perceived price when it comes to a security offering. There are bare minimums that come in place that you have to do regardless of whether the client is 2 employees or 2,000 employees. Have you thought about that? And he's like, no, tell me more. I'm like, think about things like risk assessments, things— think about things like data flow diagrams, think about things, all of these things that go traditionally into what you're doing is a month-to-month service for the client. There are bare minimums. It doesn't matter how small they are. And he's like, whoa, I could kind of see the brain kind of shock right there. And those are things that like you can't tool your way out of. You have to be thinking about that from that perspective of what does it look like from my perspective to be able to correctly and efficiently offer security services or IT services, whatever it is for that client, right? And if we haven't done those things, we're going to struggle finding profitability. Can't rush to a tool to solve that problem.

I think MSPs, if there's— for people watching, the one thing that you would gain so much value out of in learning would be what agile process development actually looks like. What does MVP, product market fit, all the stages in coming up with a true product? Because so many MSPs, so many, I see it, I have to rip it apart all the time, is they start with the tool and they try to build a product on top of the tool. Yeah, they're not starting with the problem they're trying to solve and work themselves back to a tool. And then, like you mentioned, realize, oh, there is a minimum size or price that I have to charge because of all the costs that, one, just to develop the product, but two, all of you might need 3 or 4 endpoints to solve the problem. And that's fine. The endpoint's okay, but what is the time invested and the time to manage that you then need to make up to make a decent margin? Right? When you see the booth— I'm going to call vendors out— you'll make 80 points on your endpoint, on our endpoint. Well, great, it's 80 cents on $1.50, and then I gotta charge for it, and then I gotta have someone manage it, I have to have someone to set it up. It's bullshit.

Yep. Uh, well said. So those, those are things— it's funny we stumbled in this conversation because it's something that I've been speaking about a lot. I've learned a lot of it from you just in, in these these same conversations. So yeah, you asked a question.

So we did a man on the street, spoiler alert, and you asked a question of what's the snake oil?

Yeah.

What was the most common answer you got?

The most common one I got, which I thought was great, and I might do some commentary after we produce that whole on the street, but was that there's no 100% security. It seemed like vendors and MSPs alike are all saying there's anyone that tells you that 100% security exists because you bought XYZ vendor or vendors, That's a lie.

The vendor with the bingo board on the wall. Mm-hmm. Mm-hmm.

Yep. Yep. So speaking of no 100% security, let's flip over some news real quick. I wanted to share a couple news items that I'm not sure a lot of people have either kept up with or seen before. I want to talk about them just a bit. Let me hide our caption little guy here so we can kind of see each other. There we go. Now we've shown up. So this is a really interesting one. Most of us have heard of Change Healthcare having a big ransomware attack. You know, they suck for everybody. Let's get out the empathy first. Don't wish it on anybody. I hope they get through it. Certainly hope that there's not a cost to the business more than what we're currently seeing. Just want to say all those things, right? And we're not hating and coming down on— this could happen to anybody. But one thing I want to talk about is one of the things that we don't often talk about is the ramifications that occur whether it's a ransomware attack or a business outage, whatever the cost of supply chain. So I want to show this, this one right here. Hospitals have been unable to check insurance benefits of inpatient stays, handle prior authorizations needed for procedures or surgeries. So now, now we have major multimillion-dollar billing problems because this ransomware outage has caused us to be ineffective in knowing, can we even do this surgery? What does insurance say? What does the other doctor say about this? Or processing billing payments. And we all know how messed up America is with, uh, billing and insurance in healthcare. Pharmacies have struggled to determine how much to charge patients for prescriptions without access to the records. So when they come up to the table to say, I need to buy XYZ medicine, I might be paying $14, you may be paying $5,000. It all depends on insurance. We no record of this, forcing some to pay for costly medications out of pocket with cash. So now they're like, we don't know, so we're charging you full price. We can't even— there's no electronic billing. This is an absolute cluster, Kyle. I am just shocked by— these are the things that, as MSPs, if we're not talking about ramifications, it's not just, oh, I got hit with ransomware and I gotta pay some money to get out of it. It's also these kinds of things that are just mind-bogglingly shocking.

Right? And MSPs, I know quite a few of them where private practices, small practices, are managed by MSPs. And I think there's a component here. And by the way, this is very topical for me because my little sister got a pink slip this weekend from her hospital as a labor and delivery nurse because their profits are in the tank right now because they don't have the cash flow to support themselves. Now, there's a lot of probably other variables in there,. But right there, there is the empathetic approach of people are either losing medicine or losing jobs, and these are critical needs that a little due diligence might have prevented.

Yep, yep.

Someone cut a corner somewhere.

Well said. You know, there's also some drama going on here too, because, um, apparently Change had paid the ransom. Uh, but look at this. Russia, prolific ransomware gang, taking credit for the cyberattack on Change, claimed without yet publishing evidence to have stolen enormous banks, uh, containing— I guess data banks— containing millions of patient private medical data from their systems. In a new twist, the ransomware gang now appears to have faked its own demise and dropped off the map after receiving a ransom payment worth millions in cryptocurrency. Now that is crazy interesting to me because one of the reasons people pay ransoms is because they hope and trust that if they pay the bad guy, the bad guy will do what they say. Meaning that they will give the— give access to the decryption key. They won't start leaking all the data. And there's some— let's be honest, there's some amount of trust that we good guys have in bad guys to fulfill their end of the bargain. And it's always been predicated on the bad guys to say, we've given the data back, we haven't leaked it onto the dark web because you paid us and we're after your money. It's not personal, it's business. That's always been what they've said. Now, all of a sudden, for one of the first times I've ever seen, Kyle, we now have a ransomware and there's apparently some internal conflict going on inside this ransomware gang between the affiliate and the actual operator in payment not being met between—

can you break that down? Can you explain like I'm 5 on that one? Because I'm, I'm an idiot at this stage.

Yeah. Let me break this down. So the way ransomware works in today's day and age, you have the operators themselves, you have affiliates. Affiliates, right? So just like, you know, I'm Amazon and then I have affiliates, right, that are trying to sell products on Amazon, right? And so these operators create the ransomware frameworks, the software, they teach you how to do everything, and they recruit affiliates. Affiliates are the ones that do the actual dirty work and they take a cut. And so typically what happens is if I'm an affiliate and I ransom you, Kyle, um, the software is going to say— and I get to choose as your affiliate— let's say it's $1 million that I want from you. The second you pay $1 million, it actually goes to the top-level creators of the ransomware software those that make it, and then I get a cut. And it all depends. It might be 50/50, it might be 20/80. It all depends on the capability and the negotiations among these bad guys, right? So it's just a pure affiliate scheme like we do in the real world. In this case, there's some arguing going on between the two. And, and as they say right here, that the gang now appears to have faked its demise, dropped off the map, and are not communicating with Change. So now you have this position in which allegedly Change paid $20 million, if I remember correctly, to get access to their data back. And so far they have not gotten it. This changes the game completely on ransomware. And I wonder, Kyle, if we'll see this used as precedent at a national level outlawing and forbidding ransom payments, because I think the government can continue to look the other way and say, we don't approve it, we don't like it, we don't recommend it. But, you know, we also understand you have to do it time to time to get your data back. Now we have situations like this where the bad guy is just like, look, I'm Dread Pirate Roberts over here. I made all this money. I'm walking off into the sunset. I don't care about giving your data back because now I'm filthy rich, like beyond human reckoning in Russia rich. Now we have to wonder, is law— is Congress going to finally have the motivation from things like this exact article to say we're just done? No more paying ransoms. We're just— we can't trust them. We're just done.

You know, it's a funny, like, thought experiment with that is if we stop paying ransom, are they going to stop attacking?

Yeah, right.

Like, if there's no money in it, will that decrease motivation to do it? And I don't know if that's— Wes, I don't know if that's even like a thought that's in the cyber world of motivation to do it, because I know there's just people that want to put M80s in mailboxes and watch them blow up. But money is a great motivator.

It is. And I'm curious to know what folks think that are watching. Do you think— let's see, we got one that came in from Mr. Zoidberg. He'd pay your ransom.

Thank you.

So kind of you, Dr. Zoidberg himself.

Yeah, great, great.

Oh, is that— I was wondering. So I actually kicked us out instead of minimizing. I kicked us off the stream. We're back on the stream. Here we are again. I don't think anything I just said came out. Yeah, it'll be interesting to kind of see what happens with all of this. If the entire ransomware world has been predicated on trust, even though we won't say that, It'll be interesting to see what happens. And if we take the money financial component out of it, all of a sudden, you know, what's the, what's the, the, the motivation for the bad guy? There is none. It, it really is chicken and egg kind of thing, isn't it? It'll be interesting to see what happens. Um, let's go to the next, the next item. Um, literally no one is talking about this.

You told me about this one.

Yeah. Um, maybe we'll do a longer live stream on this. I can pull in like a Brad Gross, uh, since he's an attorney and also in, in Florida. Y'all have to let me know in chat if this is something of interest to you. But literally no one's talking about this one. So I was passed this information from a friend. This is House Bill— this is a Florida state bill, right?

Not—

not federal. Yeah, let me do that. So this is— there we go. So cybersecurity incident liability. And what's interesting about this, this is sort of like a— oh, I don't know. The best way I know how to say as a non-attorney is sort of an attachment to Florida's already enforced cyber incident reporting laws. Right. So if you have a cyber incident, you have to report it. If you fail to report it, you get billed. I think it costs you $1,000 a day. And then it tells you how many records have to have been exposed before you bill it, all the things you have to do. So this is sort of an attachment into that bill if it gets passed. It's currently sitting in, as you see right here, last action was actually just the 5th, ordered enrolled. So it looks like we're very, very close to this actually going into law. And here's what's interesting about it. I've actually got the text up right here and I want to talk about this a little bit, Kyle, because one of the things it says in this law— let me go and flip down to this, this prospective law. Okay, here it is. A covered entity. So this is like a third party that this would apply to. So basically someone operating in Florida, this would apply to. What happens is if you're collecting information and you have a cyber incident. And look what it says right here. If you've adopted a cybersecurity program that substantially abides with the current versions of any standards, guidelines, or regulations, and you implement— they give an example of this— NIST 800-171, the NIST Cybersecurity Framework, 800-53, which is like a sort of like a risk— basically how to build a risk management program. They mentioned like all these other like sort of industry-neutral ones, the CIS, SOC 2, which I think is an interesting one in here. Basically what happens is, is that if, if you have one of these in place, one of this endless list of security frameworks in place, what happens is you are now removed from tort, which basically sort of says at the end of the day, you still may be fined by the state of Florida, but you can't be sued for liability is the way I read this. And what I think is interesting in this and the reason I'm mentioning this as a law that is, or a potential law, is now all of a sudden the state of Florida is saying, put in mature cybersecurity framework here, do, do what's required, the minimum standard. And now we're going to protect you by saying, because you've invested in this, you're now not liable for something that is at the end of the day going to happen to every business. I think that's really interesting as a motivator on why small and mid-sized businesses need to adopt a security framework and follow it.

It's, it's a check. It's a negligence checkbox or a de-negligence checkbox in a way, right?

Yes. Yes. Now, what's interesting to me, and this is probably the other, the flip side of the coin that one might argue, is, is this introducing something worse? But because there's no measurement, like all they're doing is they're saying you've substantially adopted. Well, how do we know? Based on who? Based on how do we know?

Hey, we looked at it and it's sitting in my inbox.

Yep, yep. And we sent out a memo about we're going to follow CIS. So what does that actually mean? Now, some frameworks are better than others in measuring them, right? But some aren't measurable at all. They mentioned SOC 2. All SOC 2 says is everything, if it's designed correctly, this would be true if it's all operating correctly under the design principles that you've declared, right?

SOC 2 feels like lawyer bro just Googled give me types of compliance and he saw SOC 2.

Yeah, exactly. So I'm curious to know from the audience, what do you see in this? I, I just to throw it out there, I see this is better. It's better than nothing. Um, yeah, I think there's a motivator to it. I'd rather see a fine that would, would occur instead of, um, lack of like, we'll remove you from tort. Um, I'd like to see both. I'd like to see some financial teeth in this. If you don't have a security framework adopted from one of these measurable ones and you're hit, you're automatically going to be hit by, you know, some amount. I think that'd be even better. Nothing like teeth to regulation instead of just removal of, of tort.

I'm curious, Wes, because we talked quite a bit about the SolarWinds thing and the CISOs now are being scared because they're scapegoats.

Yep.

Do you think this brings a, a reasonable avenue to, to get CISOs excited again and not just sitting in the back burner going, I don't really want the S in my title, can you just drop that because I don't want to be the guy with the bullseye on my back?

You know, I, I, I think so. You know, I think that makes some amount of sense. But as always, you have to measure the culture of your own company, too, and say, to what degree will you guys actually care and to what degree will you guys actually help and assist and back up and reinforce our security program? Right. And same for MSPs. If you're helping them in their security journey, your clients, you need to assess that from your clients and understand exactly what level of, of What kind of involvement are they going to have? Going to FTC safeguards, that's why it starts at the very beginning, establish somebody who's the shot caller of cybersecurity. And it can be a third-party outsource that you're working with like an MSP, but ultimately you're responsible, not the third party. So we're coming after you if something happens. So you have to ask that question. Yeah.

Here's a fun exercise. If Wes, the great dictator, was able to create this law and execute, how would you adjust it? How would you word it?

Yeah, I, you know, I would, I would slim down the number of these third-party. I understand you might have to have some that are on there, like they, like they do, like, uh, like, um, uh, FFIEC for banks, HIPAA. I get that, right? Um, but I would slim down the numbers of those because some are not meant to be, um, frameworks that we measure the maturity of. Like 853 tells us how to build risk risk management framework. It's not actually a way to measure my risk framework. So I would slim that down significantly. I would spell out if you choose this one that we expect, like for example, we would say if you are 5— if you are— I don't know, I'll just make a number up off that. If you're 500 employees or fewer and you choose CIS, we want to see all of CIS IG1, you know. I, I would really try to spell out some minimum standards. Second thing I would do is I would do some amount of defining of fines. So there's actually a financial penalty that can occur, and I would spell out the maximum and I'd spell out the minimum. And it needs to be fair, right? You can't go and sue or fine a small business $1 million, but you can absolutely fine some big major healthcare corporation that's operating in Florida $1 million, right? So how would you spell out the minimums?

It'd be a percentage of revenue, a percentage of profit. Yeah, like I always— like my brain always laps around fines of what is the most fair way to find. Because if you make it a dollar amount, a big enterprise might go, oh cool, $100 grand, here you go. Correct.

Well, and take, uh, for example, for the overarching actual enforced incident reporting law that Florida has, wouldn't you know it, it's $1,000 a day, and then it gets into monthly fines from there. But sets a maximum of $500,000. Okay, so for small and midsize business to walk in as an MSP and say, if you have a cyber incident and you choose not to report it and you mishandle it, $500K in fines, I'm like, whoa, I'm listening. I did not know that. If I'm super large org and I'm making, you know, $25 million a month, I'm like, sounds like a risk I can take. I, I paid more than that to my, like, carpet cleaning company, right? So like, no big deal. So yeah, I think some kind of percentage of revenue or profit makes a lot of sense to normalize the damages and force orgs to care.

Yeah, do some type of headcount or something like it. I always get fascinated by those things because I've been— and I know you probably have been too— I've been in those conversations where they go, hmm, I'm willing to put millions of records at risk because this fine is really not that big of a deal.

Yeah, exactly. Exactly. And that gets to the last thing I wanted to share out real quick too. And then we'll jump because I've got a 3:15 call I've got to jump over to. Is this right here. So most of us have been talking about this quite a bit. NIST finally released version 2 of the CSF Cybersecurity Framework. Many of us have known the Cybersecurity Framework. If folks are interested, let us know in chat or comments later if you'd like us to do a deeper dive into this. We're actually just finished up a course on Inside of Empath on the Cybersecurity Framework. It's not a deep dive. It's more of like a what those unfamiliar with it need to know. But what's great about the new version of the Cybersecurity Framework is it introduces two things that I think are pretty helpful. One is it introduces a new function. So you've always had identify, protect, detect, respond, recover. Those are like the big sort of functions in it. If I said that too fast for you, don't worry. It's just how technically you design a security program. But inside this yellow circle, they introduced a new one called governance. And I'm trying to see if they have a picture of it. I guess they don't on this little high level, but What's nice about governance, one of the things we've always failed at in security, we've always been terrible at, is how do we actually know our security program's running well, right? Like governance answers the, but how do you know? How often have we been in situations where we have to answer that question? We're doing all this stuff, but how do we know how effective it is? How do we know it's actually operating correctly? Yes. So now we have, we can bring in the A word into these discussions in security. So I'm really glad to see the CSF bring that out.

It's funny that the government that built the military that is predicated on trust and verify took this long to figure out trust and verify.

And also the group of inside the government, the National Institute of Standards and Technology, didn't really define good measurable standards. There's some irony there that happened, but I'll grant them this is 2013 when they first wrote it and produced it, really 2012. Okay, I get it. But it's about time that we have this update, right? And so I think governance is huge. We need to have that. So there's a larger discussion to have around governance across the board.

Well, that means that you have to be able to measure it and be very objective on what is good and bad. And I think that's where CIS kind of kicked them in the butt, right? Because it's very easy to measure that.

Yep. And this is why MSPs have always liked it. Do this, do this. Very prescriptive. And you can absolutely see how you're going in your journey through IG1, the implementation group, the very beginning journey. Great. It's something I can measure and see. Yep. We've always struggled with this.

It's full circle with Write a Boom, by the way. I was really proud of vendors that had the CIS control that they satisfied or helped with on their marketing. I even saw someone that had a beautiful graph of all of the CIS framework or all of the steps. I forget what they're technically called. But they put their logo on the ones that they would help with. Mm.

I love that.

That's beautiful. It's perfect. I can easily objectively see this helps with that.

Yep.

And also they were willing to say, I don't help with this control and I don't help with that control. Yep.

And all marketing folks listening to this, all it's going to do is help and not hurt. There's going to be some in your audience like, I've never heard of CAS. It doesn't make sense. It doesn't matter. It doesn't hurt the conversation. Those that are actual practitioners are going to look at that and say, Good for you. Now I actually understand what you're doing. I respect you even more for that transparency and clarity. So I guess you're a marketing person. Get with your product team to understand that.

Yeah. Compliance Scorecard and Connect Secure. I'll give you guys a shout out. That was a beautiful piece of marketing.

Yeah, that's Tim Golden and crew over there, which I would expect them to do that just given the depth that Tim has in security governance and frameworks, all that. So, yep, exactly. Well, Kyle, this has been a lot of fun. One thing I did want to just let folks know, if anyone wants to see what we're actually doing at Empath, you can go get a demo. We'd be happy to talk to you. Just jump into Empath MSP right here. Um, you can click on that schedule a demo, or you can just scroll down a bit and you can kind of see it right here. Um, but either way, we'd love for you guys to, to check us out, to get to jump on a call with us in 5, 10 minutes. We'll show you the platform, 10 minutes full discussion. We'll have a great time. Love to share with you what we're doing, um, all around Empath pricing. We don't hide it, it's all right here. So it's, it's awesome. So if you guys are interested in jumping in and helping your MSP transform and get better, reach out to us at Empath. We'd love to have a conversation with you. We'd love to talk to you more about how we can help you in, your own journey. Kyle, why don't you take us out, my friend?

Yeah. And honestly, if you don't even want to talk to us, you just want to jump in and play with it, you're a tactical learner, you can sign up and get a 30-day trial without even talking to us. That's how transparent we are. We don't want to have to beat around the bush. It's a platform to train your team. Get in, look at the courses we have, but start uploading your own. But on that note, man, um, it was good seeing everybody. It was fun hanging out. It was nice, uh, finally showing what we've been in stealth for, for so long. And I would love for people to tell us where we suck so we can get better. So the only way you're going to know is jump in and give it a try.

That's exactly it. Kyle, thanks so much for joining. It's been super fun. Everyone watching today, thanks for spending some time with us. Share this out with your friends. Let them know about this. All you do is hit like, hit share. Appreciate you guys tuning in today, and we can't wait to talk to everyone soon.

Thanks, guys.