Video: How to Succeed as a Startup in Managed Security & Compliance | Duration: 2632s | Summary: How to Succeed as a Startup in Managed Security & Compliance

Transcript for "How to Succeed as a Startup in Managed Security & Compliance": Alright. Hello, everyone. I am Tarek Wiley of Aptiga, and welcome to the first discussion in our new webinar conversation series. Good posture straight talk on scaling your managed security business. This is an ongoing webinar series that's gonna feature discussions with some revenue and managed service practice experts on monetizing managed security services, go to market strategies, competitive differentiation, and more. And, we're kicking things off strong today in this inaugural discussion, with Tim Weber, VP of channel growth at Cyber 74. And he's here to answer some questions about what it takes to build a successful managed security business from the ground up, as well as how smaller organizations can compete with some of the larger, more established competition. So, Tim, do you wanna take a moment, introduce yourself, tell us a little bit more about, Cyber 74? Yeah. Absolutely. So thanks, Tarek, and thanks, Sabtiga, for for having me, being being the kickoff guest. I don't know. I'm up to that kind of pressure here. But, Cyber 74, we are a a national managed security services provider. We're part of the new Charter Technologies portfolio. We provide cybersecurity consulting services for, small to medium sized organizations, essentially, you know, coast to coast. We're a new organization. We were, born about 2 years ago, the combination of, 2 security practices from, MSPs within the new Charter platform. And we, we brought those two groups together to become what is now known as Cyber 74. Great. Thanks, Tim, and, we appreciate you joining us today. Before we we get started, a quick housekeeping note. While I will be moderating, asking some questions, we do want this to be more of a roundtable discussion. So to the audience, we we welcome your participation. So if you have any questions, comments, please chime in through the chat that's on the right side of your screen. And we'll prioritize your questions throughout this. So, you know, this is really your chance to lead the discussion. If you have something that you wanna talk about, something you wanna ask Tim about, please drop a question into the chat, and, we will jump right into it. So, we'll we'll get right into it, but, to set the stage just a little bit, managed service and security providers are facing some major growth challenges, and it's really not gonna get easier. According to one industry insider, Tim Konkle, CEO of the 20 MSP Group, the, golden age of managed services is coming to an end, and mass consolidation is expected over the next 10 years. The market is crowded. It's competitive. It's often commoditized, and some of the smaller providers don't have the budget or resources to compete with some of the larger organizations. It's a real David versus Goliath situation. So with growth at a premium, small providers and start ups really need a strategy to grow, their companies and be successful, or do they set themselves up for a merger or an acquisition if that's their goal. So, that kinda sets the stage for what we wanna talk about the problem that we're we're facing. And, Tim, is there anything you wanna add about kind of the state of the industry? No. I mean, I think that, you know, when I look at the industry, you know, certainly, the MSP industry, is very, very mature. You know, prior to prior to to focusing on security, I was in the MSP space for for 25 plus years. So, seen a number number of changes and evolutions and revolutions in that. You know, what I what I see right now in the MSSP space is that it's it's a bit of the wild, wild west still. You know, there's a lot of folks out there and, you know, honestly, I still think there's a a fair amount of opportunity, but, it's getting getting more crowded every single day is is what I'm seeing. So Yeah. Absolutely. Well, let's dive right into the questions. You know, that's why we're here. So, to kick us off, can you talk about the strategies that you found effective for standing out in a crowded, often commoditized managed security market? Yeah. I mean, it really it really starts with and I'll I'll probably come back to this a number of times of of defining who you are and what you want to do. You know, the security space is so so vast and so broad that, there's no shortage of opportunities, and you you really need to pick a couple areas to focus, you know, to to go after some things and and get really good at it. You know, one of my challenges, one of my probably biggest pet peeves is when I see people that say they do security, you know, and the reality is is that they're selling firewalls, antivirus, and and phishing testing. You know? So you you need to be able to to define what it is that you're doing and then actually articulate it in a way that people understand because it's again, anybody anybody can be an MSP. Anybody can be an MSSP. So being able to to to clearly show this is what we do, and this is how we help organizations. You know? For us, that's always been one of our primary differentiators is to is to really look at things through the lens of the client and not talk about, you know, oh, we can sell you this tool or that tool or this service or that service. But, you know, that we're gonna help you manage and understand what your risks are. You know? Because in the end, you know, all of this business is about risk, and risk is, interestingly enough, more of a business discussion, you know, than a technical discussion, in my opinion. So, you know, we need to we need to make sure we're having the right conversations, even more importantly, with the right people in these organizations to to to to be able to help them. So Yeah. And you said something interesting there, that a lot of companies claim, you know, that their security providers are that they're offering certain services. So in kind of this environment where, things are becoming more commoditized and more people are saying that they offer the same services even though, you know, some of them, maybe aren't, can you talk about how Cyber 74 differentiates itself, as far as its services when, you know, many are saying they provide the same thing? I mean, I I think it it comes down to to 2 things, you know, expertise and focus. So, you know, one of one of the things I like to talk about when it comes to Cyber 74 is is that, you know, I think we punch above our weight. You know? So we're, you know, we're we're not a large group. We're about 20 people or so. But the skill sets we have, the the industry knowledge, the certifications, the experience, expertise allows us to play in a lot of different spaces. And, you know, a lot of times, you know, you look at somebody, you know, an organization, somebody that's, again, doing security, and, you know, maybe they've got a certified person, maybe a single CISSP on staff. You know, we've got, like, 8. You know, I forgot. I was I was actually blown away. We were doing an RFP response the other day, and I didn't realize just how many we, you know, just how many we had. And, you know, you you have to have the expertise because unlike unlike a lot of the stuff in the MSP industry where you can kinda fake it till you make it a little bit, and and not that I've ever winged anything, but I've winged stuff over the years, security is too important. You you know, you're you're dealing with the livelihoods of these organizations, and, you know, the the risks are so much greater that, you know, the learning curve is much more narrow. So, you know, for us, it's it's expertise, and then it's the focus. And and for us, our focus is really on, you know, driving actionable information. We spend you know, the majority of the work we do is around assessment services, so pen testing, compliance, risk assessments, and things like that. And we wanna help organizations when they look at this, you know, iceberg like thing that is security, it can be very overwhelming, especially for an organization that's just getting started on that journey. We help them to kinda break it into smaller chunks so that they know what are the things that they need to do. What are the things they what are the questions they need to be asking? Because that's usually where it starts is it's not, you know, it's not ready, you know, ready, fire, aim. It's ready, ready, aim, aim, aim, then fire. You know, because, again, you know, most small businesses and small to medium sized organizations, they don't they don't have the budget. They don't have the security wherewithal to do all of the things that they need to do. So so giving them good advice and guidance on where to apply whatever whatever their limiting resources, whether it's time, money, you know, attention attention units, you know, making sure that they're putting that in the the places that that give them the most bang for their buck. So Yeah. And tied in, like, kind of the flip side of that. Whereas some of the organizations you're working with may not have the budgets for smaller, providers who also are struggling with, having the right budget, the right resources to to kind of scale their businesses, Can you kinda talk about how small providers can compete with some of the more established players when they don't have the same resources? Yeah. One of the things I'm huge on is the channel. You know? And I love the fact that when we, you know, when we when we built Cyber 74, I was able to to to get, you know, the term channel actually in my title, you know, because I'm a I'm a huge believer in that. And and one of the things that that we've done both at Cyber 74 and at the MSP that I was at beforehand was we partnered with others. So, you know, we worked with others to help us fill in the gaps. You know, we recognized as much as we wanted to do everything in the security spectrum, it didn't make sense typically for for budget reasons. You know, why go out and build a brand new SOC when you can partner with somebody that has that? You know, there's some there's some business cases for doing it, but it's not, you know, it's not for the faint of heart, and it's certainly not for, not for everyone because it's, you know, it's you know, I think you gotta hire you know, to do basics of 24 hour coverage, you gotta hire at least 12 people to do that. You you know? So for for us, the the partnership aspect really helped us kinda elevate our game in a lot of areas where we can lean on trusted partners to do do some of the things that, you know, that that we didn't, you know, either choose to do or, you know, weren't in a spot to quite do yet. And and we did it, you know, always with transparency, and, you know, our our rule was always kinda controlling, you know, controlling that last mile. You know, you know, even when we've worked, you know, with folks that that provide some level of services, it's still our team members that are actually in, you know, interacting with the customers. So we're, you know, we're having the back, you know, the back office SOC pieces and things like that handled by others, but they're but we're we're still retaining that relationship, you know, with the end customers. So Great. And we have our, first question from the audience. This one comes from Ash. And Ash asks, do you have any thoughts on how to integrate cyber and physical security with a compliance platform? Yeah. So so so that's a great question, Ash. I appreciate that. It's interesting because physical security is, you know, it's kinda like the red headed stepchild of security and that most of the time, it gets it gets overlooked until something bad happens. You know, so for us in our playbooks, you know, that is certainly something that we, you know, we take a look at and, you know, pull transparency. We we lean very heavily on the Apptiga team for, you know, for their GRC platform to help us manage our, you know, compliance journeys with our clients. But we also have relationships with you know, you know, we don't provide physical security services, but, you know, some of the the MSPs in our new Charter platform do things like, you know, door access systems, video systems, and things like that. We're it's been interesting. I've been seeing more and more MSPs get into, you know, into the video aspect, you know, video on demand and things like that. And, you know, to me, it's good because, you know, you can protect everything in the world for cyber, but if the front door is open and there's no key to this get to the server room, you know, I I I saw how somebody have their server get stolen once, you know, back in the the mid 2000. So, you know, all the all the cybersecurity doesn't do anything in the world if somebody can just walk off with your hardware. So Great. Another question. This one comes from Paul. Does Cyber 74 cover the CMMC compliance sector? Yes. We do. So we've, we've spent a lot of time in the CMMC front. That's actually really where, where we kinda get our start, you know, with working with the Aptiga team is, you know, we're still kind of finishing digesting all of the the final rule sets and and changes that have come out. But, yeah, we see CMMC as a as a huge growth area. Really, all of compliance because we're we're at a point now where, you know, it used to be a sliver of organizations fell under some type of compliance framework. And now, you know, we're gonna get to a point probably in the next under 5 years where it's gonna be unusual for somebody to to not be under a compliance framework. And, you know, I'm seeing organizations now that you know, I've got one customer I work with that I think they fall under 4 different frameworks, you know, because they're, you know, they're dealing with some HIPAA stuff, and they've got some PCI, and they've got some state requirements and things like that. So, you know, that's a that's an absolute area that we see, continuing to grow, you know, not just CMMC, but compliance, you know, compliance and compliance management, you know, as a whole. Great. Jumping back into how oh, let's see. Sorry. Alright. Just to see if you wanna comment on this. Asha says, Tim, your response is logical, and yet there is inertia towards integration of these silos. Cybersecurity is a silo. You wanna address that? And it's yeah. I'll I'll I'll hit that one. I can't argue with that. You know? And that's and that's one of the challenges that we face as security practitioners is really breaking down those walls because for a long time, cybersecurity was thought of as just something that the IT manager needed to own. To me, if I'm dealing with know, any size organization, obviously, I need to work with the IT manager director. But I need to make sure that we're dealing with the c suite because, again, you'll go back to what I said before. You know, if you're making risk decisions for an organization, it needs to be somebody that's empowered that can look at things from a whole. I I think where where the silo comes in is a lot of times still the physical security is, you know, that's like a whole different group within an organization, you know, type thing. And, you know, like, I'm you thinking some of my manufacturing clients. So I I think we're getting better from breaking down those silos, but, you know, I I fully agree with you, Ash, that, there's a there's still a long way to go. And part of it is is that we need to do better as an industry. You know, as a security industry, we get super stupidly focused on talking about the newest and the coolest tools and things like that. And the reality is is that that's not always where we need to be having these discussions. It needs to be, you know, something where it's it's it's holistic. You're looking everything top to bottom because when we talk security, it's it's people, process, and technology. So let's you know, obviously, we'd like to spend our time on technology because that's the cool stuff. But, you know, we can't we can't overlook the people and the process aspect of it. So Great. Follow-up question from Paul. Paul says that, they have a lot of clients asking to have, enough cyber insurance coverage. So do you have any recommendations in regard to cybersecurity insurance coverages? My only recommendation is is yes to have cyber insurance and to have as much coverage as you can afford. So, you know, we're we're seeing we're seeing a sea change in that industry as well. You know, the the legacy carriers, you know, have struggled to kind of adopt their risk models. That's why we've seen the the cyber insurance questionnaires go from this much of a single page to now, you know, 15 to 20 pages. They're getting there, but it's still it still can be a process. You know, but the interesting thing is is that we're seeing things like, 5th wall in coalition and and kinda what I would consider, you know, NextGen. I hate the term NextGen, but I don't know how else to describe it. You know, NextGen industry, insurance providers that are actually taking a different approach where they they actively help organizations manage their risk. Sometimes they they'll provide appliances and monitoring and things like that. So they're they're coming at it from a different direction. This is one of those areas where to kinda go to Ash's point, this might be an area where it's necessary to break down a silo because a lot of times, organizations will go with the broker that they're working or whoever bring and brings in whichever carrier they do. In some cases, splitting off that cyber insurance, you know, maybe into, again, into one of these kind of more modern, you know, providers may actually make sense. So Okay. So safe to say that, they can never have enough, insurance, just as much as they can get. Yeah. I mean, to to to me, one of one of the things that people don't realize and and and, again, we we have a challenge in this space where insurance and cybersecurity are something that you don't wanna spend money on until you need it, and then, man, you wish you've you've spent money on it type thing. You know, when you look at somewhere around 40% of the costs of a security event are in lost productivity, that that adds up very, very quickly. You know? I mean, you know, a a ransomware event is easily a 7 figure event for most organizations between forensics, legal, potentially PR, if p you know, personal informations come out. But, usually, the big nut is around, you know, if the system was down for a week, you know, if you're a professional services, if you're a law firm, and you've had your attorneys not billing for a week, how much does that cost? If you're a manufacturer and you couldn't ship products for a week, What does that cost? And and those are just those are kind of the things that people don't think about until, unfortunately, they've gone through some type of event. So, yeah, you you guys could do a whole session on cyber insurance. I am I know enough of it to be dangerous, but but that's a that's a whole separate separate animal in and of itself. So And we have. If you're interested, you know, go to the big website, check out some of our previous webinars on cyber insurance. Another question from Ash. Ash asked for your thoughts, on breaking down silos and building an integrated solution, cyber physical compliance and insurance, 4 pillars of integration. Yeah. I I I think that's the right approach. You know, the challenge becomes is is tying it all together, and making sure that you've got kind of the best pieces that you can have in each area and that you're not sacrificing. Because that's that's always a challenge when you look for a single single solution or or single platform is is, you know, is it doing the best of everything that it can type thing? But, yeah, that's that's absolutely that's absolutely the driver of where we're trying to go. So And any thoughts on, how how they do that? No. I I I wish I wish I could answer that. I mean, because the the the challenge is that so many these things are all so different, and, you know, they're they're coming at it from different angles. You know you know, personally, I'd like to see the cyber insurance get to a point where they're all using one type of framework to help evaluate their clients. I know that they probably won't because for them to see you know, the the black box aspect of what they do is is how they make their money by managing risk. But, there's in my opinion, there's just still too many variables. So Got it. Thank you all for asking questions. This they make this makes the session go by much quicker, and and Tarek's got no idea what I'm gonna say when you guys ask a question. So it's awesome. So Yeah. Appreciate it. Keep them coming. And, Tim, you mentioned at the beginning of this, conversation, the importance of kind of establishing value prop, as a, you know, smaller provider. So can you talk a little bit about the secret to defining and communicating a unique value prop in a competitive field, and, you know, how do you align services with the specific needs of your target customers? Yeah. So so when I look at kind of back at our, you know, in our our growth journey, you know, we wanted to do everything all at once, so we recognized we couldn't. You know? So we picked a couple of key areas and got really good at it, and and we picked areas that fit the client spaces that we were working in. So, you know, for us, the risk assessments was a a natural starting point, excuse me, because we had organizations that needed that for HIPAA or SOC 2 or things like that. From there, it all became about messaging. I I I hate the term thought leadership, but I don't know. I haven't come up with one yet to replace it. But doing a lot of content, blogs, marketing, events, you know, events are are probably one of the best ways to to get the word out about what you do and also to help others. If you if you go out and you speak at events and you're not trying to sell, but you're trying to educate, the the return on that is is phenomenal. And that's, you know, that's a big part of my role. You know, we were talking before this started. You know, I spent the last 3 weeks on the road talking to talking to folks around the country about, you know, about some of the concerns. You know, a lot of lot of discussions in particular, you know, around AI right now. Before you can sell to these folks, you have to educate them. You know? And you have to help them understand, one, that there is no there is no silver bullet. There's no one thing that you can can do that will, fix everything. You know? And anybody that says I've got a silver bullet, you know, I I always tell people to run, don't walk from them. But also helping to educate folks that this is a journey. You know? Because if you go out and you do a big push and you get people to do a lot of security stuff, you know, in 2025, there's gonna be new threats, new concerns, new risks. If you haven't positioned things right, you're gonna get some serious pushback from folks to go, but I bought everything you told me to do last year. So the more you can set people set people up for that you know, I had a a funny exchange with somebody about a year ago in an event where they're like, you know, they raise their hand and like, Tim, you know, I've I've got a small business and I've never I've never had to spend money on cybersecurity like I'm like I have to now. And I said, yeah. And 5 years ago, you didn't have to buy n 95 masks and hand sanitizer either. You know, the world has changed. The world is, you know, the world has evolved at this point, and, you know, your choices are to to to either change and evolve with it or to be changed by it. So Yeah. Hash, comments. Tim, bring the best breed stakeholders together and use no code automation with APIs to integrate. This will soon happen. Yeah. I I I I think we're seeing a path to that. I mean, certainly, one of the challenges is is there's no shortage of tools out there. And, you know, as security practitioners, when you have to look at 8 peens of glass to see what's going on in an organization, you know, that breeds inefficiency and certainly breeds an ability for things to fall through the cracks. So I think the the more things that can be connected you know, obviously, the more things that get connected, now you have some risks with with that. So there's always a there's always kind of a yin and a yang with some of these things. But, yeah, I I I I see that's where we're going as an industry as well. So Great. And, you know, as a start up, you could have some of the best people. You can have great services. But, you know, if nobody can find you, that's gonna be a problem. So you would talk to about, you know, the importance of marketing. How can smaller providers who who don't have, dedicated marketing teams or, you know, have very small marketing teams or, you know, don't have this huge sales organization, how do they without those resources, how can a large company, kinda execute marketing and sales at a high level? I mean, some of the best things are are low cost. Social media, you know, being on top of of what's going on from, you know, from a security news standpoint. You know, being able to you know, if you see a security event that happens, you know, maybe doing a blog post on it or a LinkedIn post relating it back to clients. Getting in with the local news media, that was something that I did for a number of years where, you know, if there was a cybersecurity story that happened here in Connecticut, you know, I would get a call to, you know, to to to comment on it. Those kind of things build a lot of bit a lot of credibility. But leveraging partners, you know, there's some there's some folks in the MSP space, you know, that will provide MDF, will provide a lot of marketing support and really, really help kind of people level up, in my opinion, you know, on some of these things. So, you know, leverage MDF. I mean, we're we're huge consumers of MDF across all all of the partners that we work with. And, it's been great because it you know, again, for us, we we spend a lot of time and a lot of those resources on events, and we see huge return on it. And and and sometimes it's not immediate. You know, the the engineer brain in me wants to do an event and then see a lead come from it, like, the next day, and that's that's apparently, that's not how it works. I wish. Although although it's happened twice in the last week for me. You know, I did an event last Tuesday in in Albany, New York and had a call with a prospect about, you know, about something from me yesterday. So it it does happen. And sometimes even if it doesn't happen immediately, you've gotta keep planting, you know, you gotta keep planting seeds everywhere and everywhere you anywhere and everywhere you go. So Great. So let's talk a little bit about growth and, scaling your business. Can you can you talk about some of the, key milestones in Cyber 70 four's growth journey so far? Yeah. I mean, for for us so, again, you know, our journey when I when I take back kind of my journey, it started, you know, at Advent Technologies, which is the MSP we came from. And we made very, very deliberate moves. You know, we did we did a risk assessment, so we did MDR, and we did some SOC SIM, and then we started to move into pen test and compliance. So we really kinda chased where, where we saw the opportunities go. You know, fast forward, you know, obviously becoming part of new charter and having private equity backing, is very, very helpful, because it gives you, you know, it gives you funding to do things. But I think if you get really good at it, you can build very profitably as long as you don't try to boil the ocean. Don't don't try and chase everything. Like, you know, one of the areas that that we're expanding right now is digital forensics and incident response. And, you know, if I had my, you know, if I had my way, we would have been doing that 2 years ago. But we recognized to do it and to do it well, you know, we needed a bigger team, specialized tools, and things like that. So we had to we had to get very, very okay with saying either no or not now, and and things like that. And I think that's the right where I see some providers fail is when they try to be all things to all people, and they end up doing none of it well. So so pick some things, do it really well, establish some strong partnerships. You know, a lot of folks in the MSP channel, they you know, Atega is a great example that you guys wanna see us succeed. You know, we had a ton of support from Atega in doing things, because our sponsors are for events, things like that. You know, a lot of lot of really, really helpful things. And and you're one of a you know, some critical critical vendor partners we work with that do that. And and that allows us to to, again, you know, I think I said it before, level up and do do things that we might not have been able to do on our own in the past. So Great. And perhaps you just kinda touched on on this next question in in that answer. But, can you can you think about how do you scale while, also maintaining service quality, continuing to meet the needs of customers? I mean, it starts with being able to find people. You know, that's that's still weirdly a challenge in the security space. You know, there's there is a there's a glut of people, but there's a challenge finding good people right now. You know, one of the things that's been very successful us for us is by being a virtual organization, we're we're not limited to a specific geography. So, you know, you know, there's, you know, myself and a couple of us here in, you know, in the Connecticut area, but we've got folks, you know, that go coast to coast. We got a number of folks in California and all the in all the states in between. You have to be deliberate with it, you know. And and sometimes you have to make bets. You have to put, you know, you have to put some chips chips on the table and, you know, where where I saw success in the past is when we said, you know what? We're gonna do this and this is what we're gonna do and we recognize that it's, you know, it may not be great to start, but we think it's gonna take this much time to kinda, you know, to kinda build out. So, yeah, you gotta you gotta take some risks from time to time, but don't put all your chips on the table all at once because, you know, who knows? You know, the economy's been a little bit weird from an MSP standpoint this year. I think it'll be very interesting to see once we, you know, once we get past the election in another week or so here if that, you know, kinda takes the throttle off a bit or if it stays it stays tight or whatnot. So, yeah, I don't know that I actually answered your question. You know, I I think it's being deliberate. You know, being very, very deliberate and and having a plan and being able to fill in with the talent. Because, again, you know, you're either partnering with somebody to do some of these key services or you're building that talent expertise, in house. And while the the market's cooled a bit and some of the salaries are a little bit more realistic, it's still a a not inexpensive, you know, group of folks to bring on to to truly do security. So Great. Yeah. And you mentioned, you know, the difficulty finding the right people. But, what are some of the, the other big, big challenges that you've faced, building Cyber 74, and how did you overcome them? I mean, you know, I talk about not trying to be all things to all people. That was that was something we tried to do when we first started, you know, and, you know, we had a little bit in some areas of, you know, if you build it, they will come type aspect. And, you know, we were maybe a little optimistic, you know, with with how some of these things were going to, you know, going to play out. So, you know, I think that, you know, as we've continued to focus and and really kinda stick to our knitting, you know, the challenge then becomes is we've probably said no to too you know, while we've said yes to too many things at different times, we've said no to too many things at other times. So, there is no right answer on that. It's because it's it's math and it's it's spreadsheets that define the math and things like that, but it's also it's a little bit of gut intuition. So so trying to thread that needle of of doing new stuff and being ready to support it without getting yourself so overextended that you, you know, that you kinda cut into the core of what you're doing. Yeah. That's that's that's probably the biggest one. I could I could probably fill the rest of the afternoon with stuff that I wish we had done different. So Great. Another question from Paul. How have you been able to set, Cyber 74 apart from the rest of the pack of cybersecurity companies providing services like this? Yeah. I mean, for for us, it's it's about making sure we get our name out there. So, you know, you know, we spend a lot of time doing events. You know, I do a lot of vendor events. You know, so speaking with you all today, I'll be out at IT Nation Connect last week next week doing, doing a panel with them. You know, getting out there and sharing our opinions. You know, sometimes people will disagree with me, and I actually I actually enjoy that because I love kind of a good spirited dialogue, but also picking what you're good at. So for us, it's you know, when people ask me what do I think differentiates us, it's the expertise, but it's also that drive for actionable information. You know? Anybody can run an automated tool and dump a pen test or risk assessment report on somebody's desk. And sometimes if somebody wants to just check a box, that's fine. But if somebody truly wants to understand where they're at security wise, you need to, as a security practitioner, be able to take that type of information, because that data is absolutely critical, but then help people understand what to do with it. And I think that that's, you know, that's one of the biggest things that we've done. You know? You know, I got asked this very question when we were the finalists for an RFP, last year for City in California, and they said, what do you think differentiates you? And I said, it's, you know, the the drive for actionable information. You know? I wanna make sure that when somebody doesn't doesn't engage with us, when they come out of it, they've got a good understanding of what it is that they should be focusing on. You know? It then becomes their decision. You know? Because, again, risk is a business discussion, not technical discussion. And, you know, do I wish that everybody would fix everything that we tell them that is wrong? Yes. But I'm also intelligent enough to know that, I've yet to meet the organization that has the budget to do all of those things, you know, all at once. So you've gotta you have to be you know, my favorite word is pragmatic. You have to be pragmatic with these things. And sometimes as security practitioners, we, you know, we we bump our heads because we're so up on our high horse about the way people should do things that we don't recognize that, you know, outside of us, nobody's business is about cybersecurity. It's about, you know, providing legal services or accounting services or making widgets or this, that, or the other thing. Security is a means to an end to make sure that their that their business keeps going. So and and we need and we need to make sure we don't ever lose sight of that. So Great. Kinda talked a lot about the challenges, that smaller providers face versus, you know, some of their larger competitors. So I wanna flip the script a little bit. Sure. Is there any, what would you say are the advantages of being a smaller provider? Agility. Yeah. Yeah. Yeah. I mean, it's it's it's all about nimbleness and agility, and I've seen us pivot pivot on a dime, on things. We also have what I would consider to be more intimate relations with our clients, you know, in that, you know, we're closer to their business, and and you'd be start to you know, I I have always thought as an MSP that if you can't you know, if you're getting invited to the organization's holiday party, you know, as as their MSP, you're doing well because they see you as part of their business. And, you know, we're not quite there in the MSP MSSP space, but the more they can see you as part of their business, that's that's the best. And, you know, we we've got an ability to kinda pivot, you know, to pivot quickly on things and and really kinda drill into things for organizations. And, I try to avoid doing one offs because if you do too many one offs, then you become, you know, more of a kind of a craftsman shop, and that creates a whole different set of issues. But being able to be flexible, I think, is key. So and being real. So Great. So as the VP of channel growth at Cyber 74, can you talk about how you approach building strong channel partnerships and how crucial have they been to your success? Yeah. Yes. I think I've hit on a hit on a little bit already, but, I would not be where I am I am today nor would Cyber 74 be without without the the the strength of those channel partnerships. So, you know, I've again, I've been in this space for a long time, big into the ConnectWise, evolved community and things like that. And what's interesting is is that the Cyber 74, we're both, a consumer of partner services, but also a provider of partner services. So, you know, one of the things that we do, we've done it since our inception, is is if if there's an MSP that, you know, maybe one of their clients needs to do a pen test, but they don't have that type of expertise, that's something that we can help people with. And we do it, you know, we do that all the time. So it's it's, again, it's a little bit of a give, you know, give and a take. But for us, we would not have been able to grow without some of the, you know, the strategic channel partners we've had behind us and being able to to to kinda add business, you know, through some of these, external relationships has been fantastic. I you know, I'm I'm doing a call at least a call a week with other MSPs about, you know, stuff that their clients need. And, you know, you know, I give those MSPs credit for recognizing, hey. This is something my client needs. I recognize I can't necessarily do it myself. Let me let me partner with somebody who can help us take care of the customer, you know, as opposed to to trying to wing it, which is which is not good from a security standpoint. So Great. And we're coming close to time soon. So if, anyone has any any lingering questions, please, you know, ask those now. If not, I'll get into the next question. So, are there any industry trends that, smaller company startups should be aware of as they develop their own growth strategies? Start with where your clients are. So, you know, don't don't go chasing after something if you don't already have kind of a a book of business to go to go after. You know, if you're working in the health care space, learn how to do assessments that help people beat the HIPAA. Again, there's, you know, as I mentioned before, there's there's new compliance standards popping up left and right. If you're working with folks that are doing DOD manufacturing or anything in the DOD space, get knowledgeable about CMMC. You know, it's it's looking like the rules with CMMC for MSPs weren't, you know, quite as onerous as we were all concerned that they would be, which I think is a a good thing from an industry standpoint. So there's a lot of opportunity there. But you see new regulations coming up every year. I mean, as of last year, car dealers and tax accountants now have to be compliant with the the FTC safe harbor guidelines. You know, you know, I'm I'm amazed that every about once a month, I hear of a new compliance standard that that I've never heard of. And, you know, the newest one is, TSACS, which is apparently something for automobile manufacturers in Europe. You you know? But I've got a partner company that needs, you know, need some help in that area. Yeah. But probably the biggest biggest thing is is don't reinvent the wheel. You know, the other area where I see that there's a lot of growth, but it's still, you know, fledgling is around helping people be ready from an AI standpoint. You know, obviously AI is the, you know, is the buzzword in our industry. And I, you know, I think that AI does, you know, completely revolutionize, you know, the, the IT industry. But, yeah, there's a lot of risks that are associated with it. So, you know, if somebody starts implementing AI, whether it's Chat GPT or Copilot in their organization and they don't they don't have their stuff kinda locked down, that could be less than a stellar experience for them. So, you know, I think that, certainly, the AI is probably an area that you're just getting started. That's that's probably where I would put a bunch of chips on the table right now. So Great. Final question from Ash. How come there's so much apathy and lack of drive to change, with CTOs, CISOs to accept and welcome change? Even with high turnover, they seem to be lost. Verticals include, health care, enterprise, financial. Yeah. I mean, I think there's a I think there's a couple of reasons, which is is is people have begrudgingly spent money on security in the past. And one of the things that and and I say begrudgingly because they haven't wanted to. You know, one of the things that we're starting to recommend to people is is that security and IT should be separate budgets. You know? And I'm and I'm hoping that much like IT in general and marketing and things like that, where there's there's industry rule of thumbs of thou shall spend us this amount as kind of a a revenue as a standard, You we're not there from a security standpoint, but we need to get there. You know, when security is in the same budget as IT, you're always, you know 80% of IT budgets are spent, you know, quote, quote, unquote standing still, which is keeping the status quo going. So if you're trying to do something new, you know, with security, whether it's a a pen test or a new SIEM solution or things like that, you know, where you know, what are you turning off? I think the other thing is is as an industry is is we don't do a good job of quantifying things. So there's some, you know, there's some new solutions out there, you know, that I've seen that really help organizations start to quantify that risk. And the more that the more that we can talk to the business owners, the CEOs, the CFOs, and articulate this is your dollar aspect of risk. Because a lot of times, people only view security as, how much are you asking me to write as a check each month? And, again, you know, that that $2,000 a month for a SIM solution or an MDR might sound expensive until it prevents you from having a 7 figure, ransomware event. You you know? And for whatever reason, potential costs and actual costs are it's like a left brain, right brain thing that people don't necessarily connect it. So, I also think it's just overwhelming right now, Ash, in that there's just so much stuff and there's there's so much messaging and it's so much about tools and people get burned. They spend money on tools and they think it's gonna protect them or take care of something, then they still have an event and, then then something bad happens. So Great. Question for Paul. What is the best way for an MSP to contact you in the event that your services are needed? Yeah. Certainly certainly hit me up on LinkedIn. Anybody that wants to connect with me, You know, if you couldn't tell, I've got a lot of passion around this. This is, you know, I've had to sit across the table from people and deliver very bad news for them. So, you know, I'm I'm always about kinda giving you know, I've gotten a lot out of the MSP community in my 25 plus years of doing it, so anytime I can get back. But, yeah, if you're an MSP that's on this call and and you wanna have a discussion and, you know, you need some help for your clients or you just wanna kick some ideas around, certainly, don't hesitate to reach out to me on LinkedIn, and you'd love to love to start a dialogue. Or if you happen to be in Orlando next week for our IT nation connect, yeah, us and 4,000 are closest friends. So Great. I think it's a good way to wrap things up. I wanna say thank you to everyone who contributed to the conversation. Appreciate the engagement from the audience. Tim, thank you so much for joining us today. Pleasure. Thank you for having me. Yeah. This is really insightful. And thank you, Optiva, for being such a great partner. Yeah. We we wouldn't be able to do a lot of the things that that that we do without without your guys' support. Your your your tools and your platform is fantastic. But more importantly, you guys are you guys are a great organization to work with. So so thank you for that. So Appreciate that, Tim. Yeah. We're glad to have you as a partner. Alright. So that, kinda concludes, this conversation series, and a recording of this, will be available soon. So be on the lookout for that. And like I said, this is the first of, of many of these conversations, so be on the lookout for our next good posture event, coming soon. So, thank you again, everyone. Appreciate your engagement. Tim, appreciate it. And, you know, we'll we'll talk to you soon. My pleasure. Have a good day, bro. Thanks, everybody.