Why Clients Think Your Cybersecurity Plan Is Random (Episode 6)

Yep, exactly. Man, well, there's a whole bunch of people hovering in chat. Make sure you reach out, say hi to us, where you're connecting in from. And if this isn't— if this is your first time on Above the Stack, we are super glad you're here. We've been doing some really cool stuff. One of the things that we've been going through is just helping folks understand when it comes to like the modern MSP, how do we really start thinking through not just packaging and pricing, but also thinking through, you know, standardization is great, but ultimately good MSPs understand specialization really matters. And so, um, Nick, maybe just in a minute, can you kind of walk through some of the highlights of some of the stuff we've been talking about in the past few episodes?

Yeah, it's really, really kind of differentiated against, you know, we typically tend to align to our tool stack and, you know, the shiny object that they are and maintaining those because we feel like that's how we're fulfilling our clients' needs, right? It's all about how many services we're fulfilling based off of our email vendor and our backup vendor and our, you know, endpoint protection tools and things like that. Where if you really get down to it, you know, a lot of what we've been discussing is, you know, focusing down on that specialization like he talked about. How can I differentiate in a market which is moving more towards, you know, commodity-level services? But in doing so, you're also thinking about, you What is our actual offering that we're delivering and how is that differentiated? How are we talking about business outcomes with this? And what does our client engagement model look like as part of that? Because that really dictates the perceived value that you have with your customer. And really ultimately, if they're going to continue to do more business with you or they just see you as this IT vendor in that sense. And it really changes the dynamic not only for the relationship, I believe, but also for your bottom line, you know, in the sense of, you know, how much you're charging for services. And again, those perceived value of upsell, of cross-sell, and excited to get into today's topic as well too, just because it kind of extends off of that and, you know, really looks at how we're discussing project work, you know, with our clients and really framing that around cybersecurity as well too.

Exactly right. So really, really excited to be talking through all of this and come join us in the conversation. You're able to share and chat. I recognize people are coming in from LinkedIn, YouTube channels galore, all the things. And if a lot of what Nick said, you're like, man, I missed some of that. I'd like to get back to it. No worries. Head over to Empath's YouTube channel. Head over to Cloud Capsule's YouTube channel. Everything's recorded in there. It's all public. No, we don't put in any codes or anything. Just head over there and watch them. All there for you. And one of the things that we love to do as well is have giveaways. And so we've been, we've been doing a bunch of those things, just giveaways where you can get some of the tools and some of the workbooks that we've been mentioning alongside of all of this. So, yeah. And just so you know who the heck you're talking to, you got Wes Spencer here, co-founder of Empath. You can reach me, Wes Empath MSP, and then Nick Ross as well, co-founder of Cloud Capsule. Nick, I just realized your LinkedIn handle up there is pretty complicated.

You got to actually get all the numbers there. You know, it's like meant to be so because it's exclusive. I like it.

I like it. Yes. So yeah, going back to some of the things we were talking about, one of the things we talked about last time was our outcomes and pricing. And we actually worked through all of this. And it's a really great exercise where the things we're going to be teaching— take these home, use them with your teams, do a lunch and learn and work through some of this. Give your VCIOs and account managers access to these things so that they can work through them. They can start to play around and get experience with this, because ultimately, a lot of what we're talking about, what we're gonna talk about today, is a lot more about the how. How do we talk to our clients in a way that gets them to move on what we know we need them to move on without forcing them into it? So that, that's a big thing. So Nick, why don't you go ahead and get us kind of on the playing field today and what we're gonna be talking about in this idea of cybersecurity projects, tying them to a framework, and how we start moving some of this forward.

Yeah, yeah, we'll definitely get into microprojects a little bit later here, you know, in the slide deck. But, you know, one of the things that we hear a lot, especially at Cloud Capsule now and previously at the MSPs I worked at, and then previously before that at Pax8, was really, you know, thinking about your security projects today feeling very sporadic, probably, to your customers. I think a lot of us there could resonate, you know, coming to our customers and saying, "Hey, we need to do an MFA project." and then the next month going, "Hey, we need to do an email security project." And they're like, "Well, why?" And you try to explain, "Well, there's this risk here and, you know, these things that we need to do." But it definitely feels like, you know, kind of out of nowhere for them in most of those cases. And along with that, there might be, you know, sticker shock of the labor hours that's going to take to go do those and no clear explanation really of how all that fits together, you know, into a holistic strategy for them. And so really, you know, we're going to talk about today how you can start to think about cybersecurity frameworks as your north star, right, in the sense of alignment for not only your talk track but for your backend operations as well too. We're seeing a lot of success with that here at Cloud Capsule just because we have mapped to frameworks and things like that. But, you know, overall we're seeing that that's a big focus in shifting the conversation with the customer. I'd be curious to hear, you know, kind of your initial thoughts on that, just Obviously you have deep, deep expertise in frameworks, especially things like CIS. So just curious if you've seen that too along, you know, MSPs talking with their clients on these projects.

Yeah, yeah. And there's a nuance to all this I think you're hinting at that we're going to get into, which is we care about frameworks, right? Like we security nerds, we IT nerds, we MSP nerds, we care about them, right? Because finally we have something that we can align towards that we know is good. Like I think we're all— I remember the MSP of like 6 years ago, Nick, and like CIS Oasis in particular, maybe a little bit of NIST CSF, but people kind of knew about a framework, but no one was really heavily mapping to them and using them. And so there's always this discussion of like, what's actually, what should I be doing? And how many times do you run into an MSP and they're like, man, I wish somebody would just tell me what to do, like literally tell me what to do. And we've done this really well in the IT world, right? Whether we've taken, yes, there's things like ITIL that are out there, but one of the things, if we can brag on, you know, some of the early visionaries of the MSP space, you know, like the Arnie Bellinis of the world and all those years ago, you know, they would go up on the front stage and say, this is what good looks like. This is what we're gonna do. This is what the best practices that led into service leadership, you know, and all these kinds of things that are great. And I think a lot of MSPs in those days were like, can someone do the equivalent of that security? Just tell me what to do. And so that's where the frameworks came into usage where like you use the word North Star. That's very much what a framework becomes. If you go read any good security framework, I mean, you're gonna see this, right, with Control 1, Part 1, it's going to start saying things like— in CIS, I mean— it's going to start saying things like, you know, as adequate, um, according to your size and complexity, do this, but do it in the right way that works for you, right? So even then it becomes, yeah, but what's— what, what is the right thing for me? What, what is it exactly? So that's one of the areas where I think we still run into some challenge as an MSP. It's like, I know what the North Star says, but even the North Star doesn't want to be like exactly here. It's— this is the range and you kind of do what you want. The second thing, though, Nick, that I think becomes a challenge that MSPs have is that what they've discovered is their clients don't give a rat's behind about a security framework. They're like, that's nerd language. Don't talk to me about nerd language. Shut up, nerd. I don't want to hear that stuff. Now, they're not opposed to knowing that your MSP has built a basis on a security framework. Work. Like, that's important to them. Just like if I go work with an attorney, I don't care about all of the legal precedent that's on their bookshelf behind them, but I want them to care about it. I want them to know about it, and I want them to make it practical. So I think that's a lot of what we're seeing in the channel, where we've made this evolution, but we still have to recognize those are two pervasive problems in front of us.

100%. I love that analogy, right? Because that's really clear depiction of, of really what it is. And I think I've seen, you know, a lot of MSPs gravitate towards CIS because it is the closest lexicon to business speak in a lot of cases that we can get to, and probably the most consumable comparatively to NIST, you know, 800-171, right, as an example, or any of these other frameworks that are a lot more theoretical in nature and they're a lot more policy-driven where it's more wide open space. To your point on we need direction, we need to understand where to go, and CIS is definitely a lot more prescriptive in that way, but you still have to interpret it like you mentioned on these different layers. But subsequently, kind of coming back to our previous talk, you also kind of want to map that back to the customer, you know, in the sense of their language, right? If they're, if they're an accounting firm, right, you want to be able to map back to how is this going to affect you from the common things that you do day to day. And a lot of these cases too, I see a lot of MSPs when they do align to CIS, they're also reading line by line, right? Each control, Implementation Group 1, let's go through it one by one. And to your point also, it's, you know, that's where we get eyes glazed over and they're saying, okay, well, how do we fix it? Right? Because they didn't absorb anything you really just said. They just want to know, like, what's your plan to go execute against this? And so I think that's really where, you know, this is coming into play too, is because, you know, we want to align to a framework to give ourselves, you know, this, this idea of how are we articulating a continuous improvement roadmap for security to our clients, I think is the core thesis of how you want to go execute, right? And to do that, you need to be organized first and foremost. And so this is where we look to controls like, or frameworks like CIS. Then subsequently, you know, you want to get your clients there. So that's kind of what we're going to be unpacking today as we keep going throughout the episode, because in a lot of these cases, you know, what we see is, you know, security projects come up, like I mentioned, ad hoc, or in a lot of cases, somebody gets popped And then we're going through an incident response plan, and then they ask, you know, how do we solve for this moving forward? It's like, well, we can slap this Band-Aid on it and make sure everybody has MFA and, you know, number matching and authenticator or whatever it might be, right? But then, you know, or they have an audit, you know, there's reactive touchpoints is my main point versus a proactive, hey, we're continuously doing this. Yeah.

Yep. Yep. So where do you think is the best way to start? Do we want to start kind of— I don't want to assume that every— I think most people that are watching today, just knowing our audience, they probably know what a framework— like they've seen CIS, they've seen this, they've seen ISO, they've seen some of these things that are out there. But like, do we want to start with kind of what, what a framework is and isn't? Is that probably the best place to start?

I think so. Yeah. I think further articulating that is really helpful because again, you don't want to over-index to your point on that side of it of being overly prescriptive, but it's also not, you know, again, the checklist that you're dumping on the client, right? And saying, hey, yeah, here's everything we're going through. This is not necessarily even the resource that you might bring to a QBR every time. You might reference it briefly to say, hey, we're moving forward on this. This is our progress on it. But you're not getting into the weeds on the individual details and really treating it, you know, in a lot of these cases as that continuous improvement roadmap. Right, for them to plug in projects over time. Um, love to hear from you too also, other, you know, thoughts on what is in a framework, right?

Yeah, so like, yes, I could go drop all 18 controls and 157 or whatever it is sub-controls on their desk and say, you know, you suck until you do all of these, and there might be truth to some of that statement, um, but that's not what they want to hear, right? Um, one of the things I like to just make sure of is I want to look like a professional in front of my client. I want them to say and to think about me as he knows what he's talking about, he's— and he's not making it up, right? That's really the defense that I want to have in my mind of like, when I'm asking you to do some of these things and we're pulling you into a better state of good than where you're at today, this is not me just willy-nilly saying I think you should do this. And, and we have to get the client to understand that, otherwise they're going to knee-jerk like they always do and, oh, Wes Spencer is just here to sell me Wes is just knocking on my door because he's got this new thing he signed up for and he's got to go sell it, you know, and I don't want that. I don't want to have to go spend money every time my MSP talks to me. So how do we get that antidote? Well, a couple of things that stand out to me is, yes, we have these security frameworks that are our North Star, and that's the defense mechanism for the rationale that I have of pulling you towards that known standard of good. Don't shoot the messenger. Like I used to say all the time, and I would teach people what CIS was, I'd say, you know, you may not know a lot about it, but like, like literally thousands of people hours have gone into this internationally from leading cybersecurity experts, from academics, from government, from, you know, leading security practitioners. Like, we've, we've done a lot to say this is a standard of good and we adhere to that. And wouldn't you want us to adhere to it? You don't have to know all the details behind it. Wouldn't you want to know that we're doing the right things for you based on something that I didn't create myself? That is very helpful for a client to understand that I am not just flinging something at you. And so I think that's what we really want to do is I don't want to just drop a big checklist in front of someone. I want to say to them, this, this is our roadmap that we have for good. And it lets us prioritize. And it lets us kind of standardize one thing after the other. And we're not going to expect that you have to do all of this right now. We recognize that this takes months and years to work on. And so we're going to work on the most important things first. We're going to slowly build and mature towards it. And I think that's a helpful way to go about it, because then we can explain to the client all of those things that they need to hear, that, yeah, I'm not where I need to be. Yes, it's based on good, peer-reviewed approaches to a standard of good. Yes, I'm doing what others are doing, best practice, all those kinds of things. That helps defend the rationale of why I should make these movements that might interrupt my processes, that might cause a new budget to be added to do some of these things, and might be willing to commit to doing some of this, especially because— I'll finish on this, Nick— especially because if we don't do it, the fear is that another MSP is going to come knock on the door and say, you don't have to do all that junk. You know, I'm half the price of Nick. Why would you want to use super expensive Nick? Nick costs double what I charge and I'll do way less and I'm not going to interrupt anything. Well, that sounds good until they recognize, well, wait, so you're not best practice, dude. What you're going to do— I realize Nick is twice as much, but the reality is Nick is doing the right things and my business can't afford to not do the right things. That's where we need to get our clients to understand, because that's the bastion of defense that we can start to deploy around, you know, the folks coming in there saying you don't have to do all those things.

Yeah, I think that's, you know, clearly like down the line in the sense of how you can position this. And I think really going into these conversations this year with your clients, you can lead with this empathy, right, of maybe they've been experiencing pain of you coming to them with random projects, right? Over and over again saying, "Hey, you know, we're doing some of the things that are helping improve your security, like we're turning on MFA or we're, you know, we're getting your endpoints all protected and things like that." But showing up as these individual projects and from your perspective, it probably feels very random, right? And so you lead in with a question that just expresses empathy in that sense because it's always— they're always going to feel, you know, a certain level of that if you've been positioning it that way. And then really position this as like, "Hey, you know, moving forward, we're aligned to the CIS controls. It's a structured security roadmap." that we're getting into, just so, you know, that you know that we have a continual improvement process for your business. But it's also predictable, to your point, it's budgetable, and it's tied to real business outcomes for your company. And that's really leading again with like wrapping it all back into, hey, we're doing this for you, and we're understanding that we're going to prioritize these things based off of the risk in your business. And so, you know, when they're looking at that, they might ask you questions like, hey, is this "some big security overhaul at once, a big fat, you know, piece of money that I have to hand over," you know, in that sense for you, as well, too. But it's about progress, right? And you're getting them into that mindset that we're taking you on this journey, and we're going to feed you, you know, in the sense of the return on what the security updates are looking like. In most cases, what we'll get into a little bit later, you can often do that in a faster throughput, meaning if we're doing these projects on a continual basis, through understanding the feedback loop of we're continually improving, but we're able to do them on a more cadence level beyond even a QBR in some of the cases where I see MSPs really excelling at the end of the day. So how do you feel about that with just tying it back even to the business? Because I know you're a master at that. So I'd love to hear your take on that piece too.

Yeah, I mean, let's get practical for a minute. Right? Pick something, right? We need to do a new strategy around data loss prevention, right? I just pick something. It's probably a bad one to pick, but I pick it. And I can go to the client. I can, I can give them the what, the when, the how. I can do all those things. What? Oh, we need to like put in this data loss prevention so that you don't start losing, you know, data out the back door and that your employees don't do something dumb. I can, I can answer the when of we should do this in the next 2 months. I can do the how. We're going to deploy these controls to make it happen. But if I do all of that, like, the client's gonna be like, you know, at best they're gonna be like, I trust you, so we're gonna do it, but like, I don't like this conversation. At best. At worst, they're gonna be like, nerd, shut up, go away, I don't want to do any of that, you're interrupting me, right? Because I'm going to put on my Simon Sinek hat on for a moment, because I missed the why. The why is the important part, right? Because the why is this important criteria that comes in where I have to explain to the client the rationale and the reasoning why I need to do all of these things. And if we start with the why, to steal from Simon Sinek, now we get the client to understand a little bit more. So what is the why behind this data loss prevention? The why is a little bit more of this. Hey, you know, from a privacy perspective, we got to make sure that we're doing these things because if we were to have a slip in some of this data coming out, this is going to be a nightmare for you. This can end up in lawsuits. This can end up in fines. This can end up in lost customers. We've all seen those scenarios where some kind of data leaks out, not because someone's doing something nefarious, but because of an accident and we didn't have the controls in place. It becomes a major privacy risk for the organization. You see why we talk about the why? And that leads into, okay, now I get the rationale. Now I'm open to the what, the when, and the how.

Yeah, yeah. And that's anything that you're, you know, repositioning in that sense. Like, we, we see it a lot because we're doing these assessments against Microsoft, and, you know, there's a bunch of Microsoft speak in that lexicon there of like, hey, give us some examples.

I mean, I'm not— I know you don't want to like go sell Cloud Capsule. Give me some examples of that because I'm super interested.

No, yeah, it's, it's more just, you know, what we see on a daily basis too, of just the regular conversations of saying something like Hey, you still have legacy authentication enabled, and nobody knows, you know, what that means, right?

Okay.

It's like, hey, if you reposition that, it's like, hey, we want to reduce your risk of account takeover, right? And somebody getting compromised within your business, right? You don't have to talk about legacy authentication or, you know, like shared mailboxes having weak access restrictions and people talking about that versus, you know, preventing unauthorized access to, you know, sensitive data, to your point a little bit earlier. And so it's just normalizing. A bunch of these controls, DLP policies, conditional access policies, right? There's all of these, you know, lexicon, Microsoft's lexicon of terms that we try to normalize and just say, "Hey, this is how you should go try to talk to, you know, the client about their main risk," right? It's really like, you can summarize probably in 3 bullets of some of the top things you'd go want to work on and not overwhelm them with like all the minutia of, you know, every single red X that's in there. There's, you know, IT people at co-managed companies that might want to see that, but not the average business that you're serving, right? You know, as a managed service provider too. So it's like, how can you, how can you really take this overall summary that you're living and breathing every day, obviously, but then going back and saying, well, what are they, you know, what's their bread and butter as their business? And then mapping that back to, it's not fearmongering at that point. It's just exposing like, this is where we know you have the most risk. And this is where it would be more detrimental to the business at that point. But yeah.

Yeah. And I'll even take it one step further. Thank you, Dean, for the comment. You're an awesome human being. I'll take it one step further. I like to read into my decision makers, and I will sometimes end up talking to— like, I can remember this from my banking days. I remember my president of the bank, he was so non-technical. So I couldn't even get away with simplifying things like, Oh, we should reduce account takeover. He's like, what's an account again? I don't, I don't know what that means. Like, he was that un— so sometimes I'll even take it a step up depending on who I'm talking to, and I'll say, you know, we, we— the big thing that you got to know is like cyber insurance. We got to make sure that we're eligible, and there's a couple things on it that I know we're not. And if we don't have cyber insurance and something happens, you and I don't want to be on the hook for millions of dollars of loss. So just trust me, can I get some of this stuff done to make sure that we can be cyber insurance eligible? Well, yeah, of course you can. What's that going to take? Well, there's couple of things we're gonna do here. Just these things. You don't have to worry about them. It's going to cost this much. It's going to take this much time. This is leading into our microprojects, I realize, but sometimes I'll even take it up a step further and just literally go to the top of the org of risk and just throw it out there of like, I'm not— you're too valuable for me to waste your time on these things. It's my job, but I'm just letting you know we got to do this because of the top level. So it's OK to do that. And I would just say to your point, Nick, know your audience. If it's the co-managed IT director, you're going to have to get more in-depth. You're going to have to come with some ammo. If it's the CIO, maybe a little bit less. If it's the president, if it's the CEO, probably a lot less. Right. But we've got to get to that stage. We know the audience, we speak correctly to them.

Right. Yeah. Yeah, 100%. And, you know, I think that kind of leads into the next topic of why do you think about projects and implementing them, you know, from the front end, the back end? A lot of what we've seen, you know, what we coach on at Cloud Capsules around this concept of micro projects, and it's, it's working very well. I think traditionally MSPs have always struggled to get into like various profitability angles with projects, but also for the client, they're also very painful. They're 6 months in length before you see any ROI. You know, there's, there's a lot of friction. In a lot of these cases with these projects that we're doing, in some cases, they're you can't avoid it, right? You're doing a migration or an upgrade and, you know, it's all or nothing versus incremental additions and things like that as well, too. But when we think about microprojects, I love them because, you know, you can get into a lot of the inverse of what we typically see with, you know, ongoing CapEx expense and really shift this model into an OpEx expense that fits back into your MSP operations. So for the client, you don't have to have a repeat sales cycle, which is really nice to, you know, to get into from a budgetary perspective. You understand like there's a consistent throughput here. When we talk about this, you're talking about doing, you know, fixed hours, right, that are combined to these micro projects. But what we see, I think, is the biggest thing that changes the perception is that you're able to increase the client touchpoint on the ROI and you're going to decrease the delivery time. Of, you know, something getting in their hands that says, we improve your security, even if it's, you know, a micro increment. They're going to continue to get that. And the more frequently they get that, the more they're going to be, you know, getting this like dopamine effect in some cases, or just positive response that you guys are constantly doing work, you're constantly improving their security, and increases the stickiness of you, you know, as an MSP as well too. And how you think about this with the frameworks, is really thinking about how can we break down, you know, incremental improvement to the CIS controls. With that, where on the front end, we've talked about this in a previous episode, front end's more of the business speak to the client, right? This is the business outcomes we've achieved and so on and so forth. On the back end, you've kind of building these micro projects that you can, you know, go work for as an MSP, such as, you know, basic conditional access policies, right, to help protect identities or devices within the organization. And you can do that with, you know, again, going back to an SOP, but this is something that your technicians can follow. It's repeatable. You can scale it across your clients. And then, you can also describe it in a way that's not just driven based off that framework, but, "Hey, we're protecting the identities in your business. We're protecting the users in your organization," right? And so, you're trying to mix this blend of, you know, the business speak that you use but also get your team to start using that speak, as well, too, because they're, in a lot of cases, interfacing the clients as well. Um, so love to get your take on this too, because this is the first time you've, you've been looking at this as well.

Yeah, you know, I, I think, um, we talked about this a little bit on the last episode. Um, projects have always sort of like past 5 to 8 years, they've sort of been treated so often as like, ew, gross, if you can't find a way to bundle this into consistent MRR, don't do it. You know, it's not predictable, you don't know how much it's going to scale, it can be feast or famine, all these kinds of things. And there's elements of truth to some of that for sure, but like The reality is we're going to continue to see project revenue become a big part of what MSPs are doing. And the reason is not because MSPs did anything wrong prior. It's just because of the evolution of where we're starting to go. There's new— there's more need to do a lot of these kinds of things. Like, just take like AI. Like, we talk about this all the time, right? But like, in order to be ready for it, there's a whole bunch of precursors before we can really intelligently, correctly, and accurately bring AI to bear for a client. And so, so that's an example of like, you didn't do anything wrong. It's just the world is continuing to change. It's the same message we've given in cybersecurity over and over and over as we tell the client, like, you know, I know that, you know, you felt like a year ago you were doing enough of the right things. But the reality is today that times have changed. We got to keep up, right? It's that same element that kind of exists. So, so I think what I like about this, Nick, is kind of thinking through, and I would encourage you as the audience to be thinking about this more, is like, what do microprojects look like? What does it— if you talk to any good project manager, what are they really good at? They're really good at saying, "This is the huge complex thing we got to do. But here's how we're going to split it up into elements that we can accomplish." Right? Like we just got done with our annual planning at Empath, and seeing Chris and one other person I can't say the name of yet get together and build the roadmap, you know, taking these huge, colossal co-founder ideas of big stuff we want to do, and then say, "All right, that's Great, guys. It's wonderful that you want to do that. But here's how we're going to split all this up. And guess what they did with me? The very thing you're talking about, Nick. They were like, OK, well, Wes, in order to give you that, these are a couple of prerequisites that we've got to do. These are a couple database things we've got to make happen. I can't do this without doing this. Well, because I know the why and I know these are the big things I want to see happen, I'm willing to give them the time and the investment to let us get to that stage. Right. And so to me, this is why where micro projects are so good is it allows us to unlock to the client. We can do these things you want to do, but we got to do these things as a precursor to get there. And, and here's how we can chop it up into digestible pieces. Those are things I think clients can get behind and say, yeah, okay, I get it. I don't love it, but I get it.

Yeah, yeah. And I think the bigger the client is, the more, you know, you're going to bring those up in the QBRs for the budgetary cycle that they're in, and you can plan those out and you can sketch them there. But I think what I've seen, you know, traditionally, like MSPs have done a lesser job of is the communication loop back to the client of where we're at in the project. And obviously, to your point, it depends on if you've got good project managers that are communicating, you know, the wins and such of that. But if you break that into micro chunks, they could just be milestones, right? And you don't have to overthink anything with projects in this regard. But the key focus here is around like how you're communicating the whole loop of, hey, we've gone from this wide range of security projects that we've been doing ad hoc, we've aligned it to this framework, these are the ones that we want to do this quarter. I think you're going to have a much better win rate in trying to talk about those as even account managers or BCIOs, as an example, just because it's aligned to a holistic business strategy, right? And it's not just a, well, you have this risk here. Well, how big is that? That risk, you know, it's, it's not really playing back to the business in those senses as well too. So I think Danny was— we just posted a question here if you want to pull that one up here. Yeah, for MSP supporting many low maturity clients, how do you apply frameworks in a way that drives real risk reduction instead of becoming a compliance exercise? And I think especially with limited resources, right? That's a great, great question, Danny, because it's That's one of the objections, right, you'll get in any of those conversations, even the smallest client saying, "We don't want to enable MFA," right? Even at that layer, you know, not thinking about that. I think— I'd love to hear Wes' point on this, too, but I think from my perspective and the ways that we won in the past was leading with empathy again with those in the sense of, "Hey, you're not bound by any compliance regulatory body," right, in some of these cases. But what we want to do is make sure that we protect your business and we align it to, you know, the top risk that you have within the company. And this is why we're going to use CIS Controls, but every project we're going to do, it's going to be aligned to all the top risks within your company, um, and we're going to express those. We're going to bring those up front to you so you know, like, what we're doing before we roll it out. And then, you know, go through, you know, the actual event, and we'll show you afterwards, like, how we've done that. Or we can just store these things so it's a little bit more asynchronous that way. So it's just a lower touch point, but just kind of leading not talking again. If you mentioned CIS, to Wes Spencer, it's like very brief, you know, you're not, you're not going into it in depth. You're not showing them the whole CIS 18 and all the controls or anything like that, because that's where they're going to be out immediately as well.

Yep. So a couple of things I think about all of this that I'll add to it. And again, thank you for asking the question. This is exactly what we want to see more of. So please continue for the rest of the audience, ask questions. We'd love to answer them. A couple of things I think with this is is first of all, we do need to know what the expectations of that client are. And side note, we want to make sure that we meet those expectations, that they fit our ICP, right? That's a bit of a different discussion, but I'll dovetail back into that in a second. So for example, most of the frameworks have like— you take, you look at CIS, it has Implementation Group 1. The idea behind that is like, these are the basics, these are the things that everyone should be doing. You look at the Cybersecurity Performance Goals, the CPGs, that's sort of a component of the NIST Cybersecurity Framework that they realized we built this overly complex thing that doesn't fit 98% of the market. Whoops. So the CPGs are like, these are the minimums. I actually really like the CPGs. I— we, we should talk about those at some point on this show. But anyway, um, those are things I think you can map to and say those are the ones we want to do. And then what you might be surprised of is you do a basic analysis and you start looking at like the IG-1s, you're like, huh, they do a pretty good job of this, this, you know, maybe asset control is not great, but at least they have a list that, you know, I got from a couple tools and then exported, you know, from, um, you know, accounts payable, just have some idea of where our money's going to. It's not great, but it's a starting point, right? And again, you look at what most of it says, it's some degree of complexity that you build based on what the client needs. So my point is, sometimes these smaller clients, you may, you may be surprised that there's a lot less that has to be done, or you might just go to a couple of those IG-1s and be like, eh, we'll get to that later. It's just not— we'll accept the risk. We'll make sure the client understands we're not going to do that yet. Yeah. Now the thing I want to dovetail into though, please don't hear me as saying that is your excuse to get out of something, right? Like, um, sometimes in the MSP space I've seen MSPs want to use those whole like dis— what do you call them, like the one-pagers? You want them signed to say, well, you're going to disavow the risk, right? You know, and what happens if we're not careful is we like tip— we tip our toe into something we need to know they need to do, and then they are resistant and we go, oh, okay, well, you don't have to— here, sign this page, right? And And we're actually doing them a huge injustice. We need to push back on them more. And at some point you have to draw the line in the sand to say, is this client a good fit for me or are they not? I understand as a small, you know, growing MSP that might be listening to— I'm not saying this, Danny, but if you are one, that any money is good money. I get it, right? And I also understand it's our job to bring everyone up as much as we can. But at some point you have to define the ICP and say, they're not gonna do these things, I can't get them to do these things, they're more risk to me than not, and I've gotta move on, right? So there's a bit of that element in there too. So hopefully all of those thoughts give you some things to work through, but I would just start with understanding the expectations, seeing where they actually line up, and then seeing how they react to the changes that need to start being made. Yeah.

Yeah. All right.

So shall we get to— oh, go ahead.

Yeah, I was going to say this, that kind of leads us into the next piece here for the, you know, kind of thinking about this bridge, right, of how are we going to get from where we're at today to maybe building around the framework if you're not using one today, or if you are, how are we maybe reframing that if we've been just, you know, reading the line items off or sending CIS reports to our customers, right, as an example of that. And really it's, you know, beginning here, defining your north star. So kind of picking, you know, and this leads back to ICP, but also your specialty, right? Who are you serving, right? You might be serving a lot of businesses that need to do this, right? As an example, CMMC, right, is a great example right now that's very much talked about just because there's a big focus on that and all the changes going through. And so CMMC might be your north star, right? Right focus. And you might already have been doing that, obviously, with that one. But it's really just choosing something. And I would say the CIS Controls and IG1 is where we see most people gravitating towards because it is the most approachable. And there's a ton, you know, just in IG1 that most, most businesses on average don't fulfill, even just from a basic, like, having an inventory of devices and software perspective, right? The first two controls is pretty nonexistent. Like, every Every tenant that we analyze always has, you know, a bunch of different stale devices and a ton of different software sprawl. And so those are just basic things that you can start to get into with the client to provide immediate security benefit, but get down this talk track as well, too. And the target security maturity behind that is like, hey, where do we want to, you know, continue to go over time? Just thinking that there's never going to be a ceiling that you hit, right? I don't believe in that. Is a constant moving target, and you need to communicate that appropriately. A funny story with that: I saw one MSP, he really expresses the Secure Score for Microsoft to his customers all the time, and he's adamant. He's like the most adamant I've seen on having dashboard reporting around it, and all of his customers are at 95 or above for Secure Score, which is really great. But he's run into this problem now where his clients are coming back to him when he's trying to do additional work and saying, like, "Well, our Secure Score's at 95. We don't need to pay for anything else," you know? And so they've artificially created their own ceiling because he's done such a good job at pitching Secure Score and really leading behind that. So it's important that you always anchor back into, you know, like, not to say that we're just doing this for money, right? It's just more of the attack surface is always shifting. There's always going to be new threats. Your business is constantly changing, and we're going to have to align back to it, or there's going to be new risks that show up as you grow, or has things changed over time too? So I'd love to hear your take on this as well, just, you know, kind of piggybacking off the ICP comments.

Um, this will be shocking for you, but I don't have a ton more to add on this one. I think you really did cover this correctly, and, and I think very succinctly. This, this really is what, what it's about. Um, and, uh, I, I guess the only thing I'll say is you'll get better at this the more you do it. Um, it might feel like what Nick is talking about is like deep dark work magic, but start practicing these things, understand how you want to speak to it and deliver it and what your North Star is, and you'll get better and better at it as you continue to go along.

I think we may have missed Stage 3.

Oh yeah, it went— yeah, I don't think I have Stage 2. You want to just talk about it?

Yeah, let's talk about it. So Stage 2 is all about translating the framework, you know, so again, we're not we're not leading with that speak of, you know, CIS in some of these cases is still too much for the average business holder to, you know, undertake. But even thinking about your team, right? They could be, you know, who's ever working on that within there, I would hope, you know, has competencies around this. But I really like to normalize it into, you know, identity, devices, data, and then, you know, kind of monitoring and response. Because it's a clear, you know, path that makes it more translatable from a business sense as well, too. And it often comes back to, you know, the controls, right, that you're fulfilling within there. And then you're creating artifacts behind those. So, you know, kind of a controls catalog or a microproject library to your point earlier, you know, of, hey, how are we thinking about fulfilling, you know, some of the common holes within environments? Obviously they're going to be different, you know, on the ground layer when we talk about client variants or exceptions we have to make and so on and so forth. But if this was the ideal state, how does my MSP facilitate this type of micro project? And then what are the deliverables as part of that? And then how does that feed back into, you know, the communication loop with the client as well too? Yep.

Okay, awesome. So then that brings us to— let me bring this back up. Here we go. Stage 3.

Yeah. And so this is really like, how are you, how are you packaging that up right to the client, right? How are you engaging with them? You know, not letting their eyes glaze over or sending them yet another report, just like your support ticket report that they're not reading and, you know, they're glazing over in that sense. But how are you conducting, you know, that baseline assessment today? Is it a set SOP that you have? Is it automated? And the ideal goal would be that you get a really firm, you have a really great talk track around this with your clients, and then you look for ways to automate, you know, and reduce your COGS in the sense of time or in the sense of cost, right? If you're paying for something in that sense as well. And trying to think about this, this kind of goes back to our last talk that we had, but the client engagement model, right, that you build around this, this should be the focal point that you're doing because it's going to translate all the value of everything, but also make sure that they're aligned to continuous growth, which protecting your future state, right? Which is saying, hey, we're going to have better conversations. We're not going to have breaches or as many breaches potentially depending on, you know, how we're operating within them. But we're also getting that baked into, you know, the other stakeholders, whether or not you have BCIOs, even you as an MSP owner, you know, if you're that size, right? You're having those conversations yourself. So just thinking about the communication track with that.

Yeah, and what I think about with this too is where you want to get to with every client, ideally, is this stage where you've hit a cadence on the roadmap, right? To where, like, if you don't have a roadmap with a client, that's where we need to start getting to. That probably needs to be one of the earlier things, going back to the North Star, right? Like, we need to— do you not have them? In fact, let me go back just one slide since we're missing stage 2. But if you haven't done this, then you're not going to be able to get to this, to the stage 3 stuff, right? You just, you're missing the precursors to it. So if you've done that, then the next question begins: How do I get to my happy place? To think of like Happy Gilmore. Well, my happy place should be a stage where every time I'm sitting down with the client, we're working through the roadmap, that we're somewhere in that journey at a known position. On the roadmap. I'm not saying we deliver on it 100%, never make a mistake. I'm saying we're in a happy place where we sit down, we know, and the client knows where they're at on the roadmap. And that all the prerequisites that show it, like you mentioned before, the maturity scores that we took, that sort of judge where it's at, are being published and shared. And what we're doing is we go— I don't want to use the word "maintenance mode" because that makes it sound like we've gone into like passivity. But, but a mode in which when we sit down with the client, there are not surprises to the budget, there are not surprises to the timeline, there are not surprises to where they need to be going. The healthy stage where you want to be with every client ideally is you're sitting down with them and you're saying, okay, this is what we said we were doing, this is what we've done, we're a little behind here, we're a little ahead here, but we're really in a good stage and we're ready to do these next things. And the reason that's a healthy state to be is because now the client says, every time I sit down with Nick. I know that Nick is going to bring to me what he said he was going to bring. I don't have major surprises. When we start cleaning up things on the roadmap and we're getting further down the road, part of that meeting is going to be talking about, hey, what do we do in the next 6, 9, 12 months, right? Maybe 18 months. And I love that as a business owner because now I'm sitting down with somebody who's talking to me like a mature adult that respects me and my business enough to get in front of the things that need to happen, to happen, so that I can think about it, I can have a budget for, I can discuss it, I can prioritize it. I can agree or disagree. And, and that is the kind of MSP relationship where a client is not going to want to say, you're not worth it, get out of here. They're going to say, this is super worth it because now we're working on a known cadence. And so how do you think about like incentivizing your, your VCIOs to that? I would pull some Net Lynch metrics. She's a good friend of ours. And some of the things that she loves to incentivize, like for example, things like no unknown, you know, changes to scope that have happened, that the client is consistently meeting with you and not pushing you out or canceling you or sending you to, you know, a gatekeeper. There's certain things you can do. You can push some metrics in to really say, are we doing these things correctly? So I love this here because it really shows us the happy state we want to live in with our clients. And I know it takes work to get there. But when you get there with them, these become your A+ clients.

Yeah. Yeah. And that kind of leads to stage 4, which is really around, you know, communication with them and really thinking about, you know, how much can we reduce tool speak and talk in that business language again, but also thinking about, you know, this is your security roadmap to your point. And this is not— this is when we hear missteps in the sense of like, this is best practice, right? Every business should be doing this, right? "Everyone needs this," or "The security project of the month, you know, that we're doing across all of our clients is X." Or saying even, again, that lexicon of Microsoft speak of saying, "Hey, we're going to get all your devices enrolled into Intune," is not, you know, going to move the needle. It's just, you know, you knowing that's a positive thing for them but not expressing the sense of, "Hey, we're going to reduce a ton of risk in your organization by making sure every device is under management." and we're going to have all of our, you know, software on there so that it's easier for our users to onboard. You're coming out with dual angles, right? There's a productivity angle in a lot of these situations, too, that you can play into that is going to be more attractive to them, right, than the drier, you know, security side or whatever we're doing in that sense. And the same thing is true now with even people asking about AI. It's the same conversation, right? You lead with, what could it do for your business? And then you anchor back into, well, table stakes is we're going to do these security things, too, because if we do that, that'll leave your business exposed in that sense as well. So those are, those are some of those pieces. And then the last piece, uh, stage 5, is really around, um, you know, automating, uh, measuring and scaling, right? So how do you— how are you reassessing? How are you, you know, doing postmortems and figuring out, like, is there a good talk track that works with one client that could work with others because they're in the same industry? Um, is there workflow automations that we can begin to create That would speed up some of the time of evidence collection or of, you know, how we're thinking about scoring or building that back into our PSA tool. So there's always room for that. But I think laying the ground, you know, the foundation of this should always be kind of a manual effort till you normalize and then you figure out, okay, this is where we have the most, you know, the biggest constraint, right, if you will, for the business. Yep.

I love it. And so I, you know, I think the other— you made me think of this. I wasn't even thinking about it until you just said it. You said it early, this idea of scaling up, like, these are the things that you, you are correct, it starts feeding all the elements of the business. An example of this is as you start to understand, hey, we did fix those pain points and we did it in an automated way. Now I got a case study on my hands. So like, now I can go take this to my marketing team and say, hey, let's interview this client. We did these things. Now I've got a case study we can use with others. We can arm this into pre-sales motions of like, this is what we solve for. We start thinking about our website copy, which we talked about a lot of that, like episode 2 or 3, I think. Now we can inform these things correctly to make sure we're speaking to our ICP correctly and talking to the pain points we know that resonate with them, right? So we do get better at this over and over the more we do it. By the way, you know, I'm a vendor. Nick is a vendor. We're good at this. Like, that's the— this is the more you do these kind of things, the more you learn how to do. Like, I just— my point is, we're, we're doing the same things that we're recommending for you to do. We put those same things in motion. We eat our tacos just like we— you eat your tacos. I learn more and more to how to speak to the problems that MSP has by having lots of conversations with MSPs. You do the same thing with your clients. So I love this idea of like turning this into— basically what we're doing is we're putting gas on that fire, right? We're saying we know this is working, how do we automate it to work more smoothly, right? And this is where I think we go into a lot of challenges. If we haven't done the mechanics of it, we don't know what to automate. If we haven't had the conversations, I don't know how to turn it into the correct kind of speak. If I haven't tried this with a bunch of different kinds of clients, I'm not going to know what my ICP is. So all of this to me kind of gets down to I've eaten my tacos. Now I know how to build the taco stand, so to speak.

Right.

And now I know how to replicate that taco stand, if that makes sense. I don't know why I'm going into tacos. I guess I'm hungry.

Yeah, it's, that's around lunchtime for me, but I'm getting really hungry now. But yeah, I think you can shorten that distance to an aha moment. I think it's always what you're going to get with the more client conversations that you have, especially if you do serve again. You know, we've talked about this in previous episodes, but clients that fit the same vertical, right? If you serve dentists, if you serve banks, you know, they're going to have similar pain points and you should know that a little bit going in. But as the technology shifts, you know, especially in this new era with, you know, a bunch of hype around AI and things like that too, you'll find that they might have similar interests or you might find a solution in one business that they discovered or you worked through with them and you bring that back to the other business and say, hey, is this something that sounds attractive to you because it worked over here? To Wes Spencer on a case study, right? And I think those start to compound, and it's not a wasted effort. You know, you may feel a little bit stuck at first, but I think the more that you have there, the more that you have— like, like you were saying— just the ability to uncover a bunch of those talk tracks that really land well for the value perception that they're deriving, but also just, you know, clearly articulating how we're thinking about the next security effort. And getting better and better at that over time too, because it's never perfect, right? And there's different personalities you're dealing with obviously too.

Yep, that's, that's exactly right. So that kind of gets us into, um, let me bring this back up, what this kind of looks like. We've kind of talked about this throughout, right? But like, I want to make sure we express this in a way that you can capture this. By the way, screenshot if you wanted, email us, we'll give you these slides, they're all on Canva, no big deal. But yeah, this is kind of if we say we're doing all these things, then this is what it should look like, right? It starts— should we have a quarterly maturity cycle where it's clearly expressed? We document in a way that the client reads and understands, like, yeah, no, I get it. That's exactly right. Thank you. Right. They appreciate the work we've given into that, you know, predictable security work, right? So they know the things that are coming up ahead of time. Throwing a budget at them nonstop. To channel my inner Alex, my co-founder, you know, Alex says all the time, your clients will always cross their arms and say no when you put them on the defensive because you walk in and they didn't know that they had to spend money on something. It's less about the sticker shock and more about the sticker surprise of, you didn't tell me that was gonna happen, and I don't want to do that now because I know if I give in now, I'm gonna give in over and over and over and over again in the future. What they want to know is is it's coming up. I knew it was coming up. You told me it was coming up. We budgeted for it. I committed to the budget. I had time to go get that budget freed up and make it happen. We're good, right? That's where we want to be, right? So just really think about that, right? And you can see the other things in here as well. I want to ask a question to the audience. Give us some feedback from what we've talked about today. What's a strong point and what's a weak point in your MSP from what we've talked to? So for example, you might say, you know, strong point, we've really done a good job aligning to CIS, right? And we've really discussed it well with our clients. Weak point, we're not good at great roadmaps and we haven't gotten there at all, right? I'd love to know what's your strong point, your weak point. What else would you point to here, Nick, while we wait for some comments?

Yeah, I mean, I think, you know, the big, big thing here is, is really, again, kind of combining a lot of the episodes we've done in the sense of, you know, it's really client engagement model that you're talking about, but, you know, having some structure that you can do that's not just a simple checklist. There is, you know, some concreteness in that, but one of one of the, you know, the biggest benefits I find in most, most MSPs that are using a framework like CAS is that their whole team is behind that. And so there's a common, you know, like working relationship with this. So there's not just front-end benefits. I think there's a lot of back-end benefits as well too, just in the sense of your organization of that, but also how, you know, they're talking about this and thinking about it in the sense of the lens of the client. Because ideally, you know, what you get into is just like reinforcing the buying decision over and over and over again with everything that they're doing with you. And certainly, like, the more evidence you can bring to those conversations, the better. And that's probably where you should try to spend more time versus just, "Hey, you know, we need to do this Intune project." But it's like, "Hey, these are all the devices that you have exposure to." It doesn't take that long, but it's just a simple touchpoint so that they see something tangible and then, you know, they're knowing that, you know, you guys are being really diligent on the continuous improvement journey, and that's going to again reinforce the stickiness of your MSP and to the point where they would never leave you, right, in that sense. And you're providing them an excellent, you know, really world-class service in my opinion if you are aligning them to that and getting them into those stages. And it's a great working relationship at that point too because you're maximizing your benefits, to your point earlier on the analogy of a lawyer. When we hire or when we talk to our lawyer, I don't like to do it because they're expensive, right? But, but we have to, and I know they're going to do a great job, and I'll always, you know, be doing that in that sense, um, you know, to complement. And so you can think the same here.

Yep, yep. Uh, Julie checking in. Julie, hey, good, good to see you on. Thanks for, thanks for the comment. Um, she said we, we need to establish roadmaps. We've gotten much better at assigning our AMs each client, having frequent touchpoints, but we lack the deep understanding of each of their businesses. Yeah, man. And you're right along with where I think the vast majority of MSPs are. So it doesn't put you like behind you. I appreciate the, the comment here. And, you know, I think one of these things is that's a great next step to really start to think about is to make sure we're arming our AMs with the right questions to be asking. And maybe they don't even have to come back with all the answers right away. We say ask these criteria questions ahead of time. Collect the answers. And then let's work on it on the back end so that the next time we speak to them, we can start building out that roadmap. And to me, you know, Nick, some of those questions I might be asking would be, you know, some of the high-level things of like, "Hey, you know, where do you see the business going in 2026 strategically? What's important? Any large projects? Any big things in front of you that you know you need to accomplish? Any fears that are, you know, in the market around you that you want to make sure you're ready for?" You can ask high-level questions like that to sort of zone into some of the things they want to, they care about. But I definitely start there, the things they care about more than the things that I care about and I want them to care about, just because that will help, you know, put them, you know, in lockstep with us, or help us get in lockstep with them is a better way to say it. What else would you point out too for Julie here?

Yeah, and hey Julie, by the way, good to see you again. You know, we— I always love the question of, you know, where is technology slowing you down? Where do you feel like technology is slowing you down in your business? It's a wide open question. Some people might say I don't know, Nick, you know, that's too broad. But a lot of cases, like, I've always had that land where they really get into some pain point they're in. So you can immediately show empathy around, "Hey, there's this big pain," and let that open up the conversation to, you know, that could be just the whole productivity project. But again, there's anchorings of security that needs to be backed by any project that we're doing. But I think, you know, the touchpoints there, you get them from all over your team. And so the more that you guys can collaborate internally too, like the project team might uncover a lot, you know, that you might not as an account manager in this particular case because they're in the weeds with a client on something. And often that's where I find there's a lot of discussion around, well, we have this big pain point over here or we do things this way and we need to do it this way because the client expects it on our end. And that's where you start to derive, you know, this feedback loop. And so it's really important important to have a system where you can, you can share those notes or, you know, have open discussion with it as well too, because they come up all over. Um, and I think it's not just, you know, all in the account managers to think about that too.

Yep, yep, that's well said. Well, we're about out of time here. Um, this has been a super fun discussion. I want to show a couple last things, Nick, as we kind of close up shop. First thing I want to share is, um, this right here if anyone is interested— oh, it's just sharing the single screen, darn it. Well, what I was going to show was if you go to Empath's YouTube page or you go to Cloud Capsule's YouTube page, whichever, and you go to the live tab, that's how you can find our previous episodes. So I said this at the beginning of the show, but a lot of people have joined late. No worries. If you're like, dude, this was helpful, this is good, I want to share this with my team, you can do that. It's just literally go there, go to live, and you'll see them. Um, same with all our previous episodes. So everything above the stack is on both of our pages. Easy to consume, easy to watch. Literally just grab the link and send it out. It's that simple. So go check, check out that as well. And then, Nick, we're gonna— this— we're gonna kind of close. This is the last wrap-up episode we've had on our very first series, which was just around pricing, packaging, commoditization versus specialization. We're gonna now shift gears a little bit in Above the Stack, and we're going to be talking about, um, not just AI. I know everyone's talking about that. But we're going to talk about how AI is a little different than cybersecurity. We're going to talk about how, you know, with cyber, it's one of these things where like they have to do it, they may not want to do it, we have to explain why it's valuable. AI is a little different because they're very interested, they're curious, they're threatened by it, all of these things. And so it's different than cyber. We're going to talk about those differences, we'll talk about the similarities too. But Nick, I'm really excited about this. Anything that you want to mention on this?

Yeah, it's, it's a very hot topic, obviously. Just, we, we hear a lot here because of what we're doing. But I think, you know, a big focus around this is also just thinking about the future state, you know, of AI and how that intermixes with cybersecurity, but also the clear delineation to your point there as well too. So there's a lot that we could unpack. I think there's more than one, just one episode, but we're going to bring the highlights for you guys.

Yep. So I got that comment there. We're going to see on the 10th, February 10th. 1 PM. I hope to see you there. Nick, this has been a great discussion. Uh, thanks for the, the chat today. Thanks for the talk. And if anyone wants to reach out, you'll know how to get a hold of us. Nick over at Cloud Capsule, Wes over here at Empath. Um, Nick, it's been great. Thanks.

Yeah, yeah, same, Wes. Always, always a blast. So appreciate it.

All right, y'all take care.

Thanks.