Cyber Warranty vs. Cyber Insurance

Welcome everybody. We are in week, I think, 1 57 or something like that. It's, uh, it's hard to believe. We're on year three now. Um, got a bunch of the OG in the house with Ryan. Awesome to see you. And, uh, oops, let me turn off my dinghy and Don Doning. Isn't That Yeah, Andrew, it sounds like you're in the middle of a big giant empty auditorium. Yeah, I know, I know. I'm sorry. It's, I, I still gotta a Couch or a rug or something.

I Have to have like, um, the we Spencer Soundproofing crew invite Me over. I'll be happy to come. Are you gonna build a proper studio or whatever in your new I'm just gonna put a bunch of cheeseburgers or something back up here and, you know, have a kind of like a insulation if, if you will, around me. Um, all right. Before we get on into it today, again, fall, apologies about the sound quality, at least I don't have a fan over my head, which is kind of nice for, for after three years.

Um, um, Gary, I just wanted to ask you, um, to, number one, tell us a little about Dacon. Was there a highlight or two that you wanted to point out? Um, it was sold out, I think there was like 3000 or so there three Also. Yeah, it was crowded. The biggest dacon, you know, ever. Um, I've been lucky enough to be involved with many Dacon. Right. And, um, so this one I, I felt was great.

The, the couple upshots I'll take from it is we, I, I was the mc on the m and a pre-day, like so much interest in m and a right now by everyone. Mm-Hmm. Even people that aren't buying and selling, they, they need to learn like our marketplace. We're at the beginning, very beginning of this change. And so, um, it was great to have a whole day to give people perspective. And then I had like three breakouts.

Um, but the big takeaway that I wanna say is the level of just optimism of MSPs about where the market is. You know, we've been talking about this growing tam now for a couple years. The addressable market is growing, but I think people are feeling it now, right? Even MSPs that I've known for 10 years, that can't trip over a nut in the woods when it comes to finding a new customer, are finding some new customers in spite of themselves, right?

And those people that have their s**t together even a little bit and can execute, can make a plan and they can achieve that plan right now. So, uh, I don't know, Tim, you were there. Did you sense that same level of like, kind of general people feeling good about the market? Oh, he's, uh, mute it. Yeah, you're on mute.

Tim Garrett, while Tim finds out his audio there, what's interesting is, um, we really are in a world, an economy or in a world of, you know, as Eric Till has his tale of two MSPs, uh, presentation, we're really gonna tale of two economies. Um, you know, an economy where it's been very challenging for a lot of businesses.

And yet because of that economy and because of outsourcing and because of the need for not just it now, but security with it in the world we live it, it has provided a kind of, in your terms, a boondoggle Yeah. For MSPs. Like, we're getting better as the economy gets worse, which is, and going up market further and further as the economy goes worse because there's more and more outsourcing. Yeah. Although, I will say this, I did a session on, um, uh, co-managed, right?

Which is the other big trend. And too many MSPs are making all the same mistakes they made when they came to the MSP market. They don't understand their cost drivers, they're not packaging it, right? They're going to customers, letting customers tell them what they should deliver and how they should price it. And like, if you're, I told people you're gonna do that, just stay out of it. Yeah. Take your time. Be methodical, and if you do, you can execute a huge opportunity, right?

That's out there. But again, too many people are just running at it with the same lack of command that they had with their current business. No point now. Yeah. It's one of the things I talked to Ryan about, um, and about maturity models that he's really passionate about.

But Ryan, maybe you could give a quick soundbite when, when you look at a, you know, a security organization, both internal and then MSP, their maturity, how, you know, they really have to understand from a people process, technology perspective that offering and what they're delivering. Or as Gary said, you can really screw things up. Is that fair? Yeah, I think there's, there's a, there's probably a whole maturity model just to the, the co-managed, um, component itself.

A lot of MSPs I've talked to, um, uh, even as early as last week, are kind of struggling with this idea of like, what exactly am I bringing on? How am I packaging it? Am I selling it to all of my customers, to some of my customers? And a lot of that, like Gary said, is you gotta get back to like the fundamentals. Like, what are you doing? Why are you doing it? How is it gonna drive your business?

Um, and, and, and starting there, but I think a lot of people are either have done it and done it wrong and are now trying to unwind that and do it right, or thinking about doing it, but aren't quite sure the right way to go about it. And so there's, taking your time and really thinking it through upfront is absolutely critical because you can get yourself in a pretty weird situation, especially with co-managed, um, Especially with security co-managed. Oh, yeah. Yeah. I'm, I'm with you.

If we have time at the very end, I have a little story I told, um, that I'll, that I'll tell, but I don't wanna take the time here. Yeah. Cool. Tim, are you with us now? I'm here. Can you hear me? Gotcha. Gotcha. I, not sure what happened. I wasn't on mute. I had the disconnect and reconnect. Um, getting back to Gary's question, I attended m and a day, and there was a lot of optimism in general in the growth of the market as well as the merger and acquisitions that are happening.

Um, I really like to attend those sessions because I get a sense of how to run a best in class, uh, business, as well as what should I be looking as a business owner in order to position myself in the future if I do wanna sell the business, what sellers are gonna look for. So I believe that that was a, a great session, a lot of great networking opportunities, uh, around the whole entire dataCon. And there was a lot of good announcement that came out from, from Kase as well.

So I really enjoyed the, the event to share. Good, good, good. I'll Tell, I'll tell one quick story, okay. About, about M&a, right? This is not the story I was gonna tell, but I I was in the VIP lounge and a guy came up to me, older gentleman, I, I, I, I, he's probably, he's like probably in his mid to late sixties. He'd been doing this for like over 25 years. And his business, I think it was four or 5 million, you know, uh, a year.

And he said like, he's reaching that point where he's thinking about selling the business. So I tried to ask him some questions. He couldn't really answer any of them. Like, I couldn't even get to a margin. So finally, I just had to say to him, dude, can you tell me what was on your tax return? Like, how much money did you report on the tax return? I'll back in and I'll tell you what your margins are, but I just thought to myself, guys, how great this business is.

You can survive in this business and make a living for 25 years and know nothing about your margins for costs. He didn't like my answer though, about what his business was worth at the end. But other than that, I think I had that conversation with you like 10 years ago, Gary. I was gonna say, Gary, I've, I've been on one or two of those calls and you, you've never been, uh, you've never held back about, um, what the reality is in, in a business. So, all right, let's get on into it.

So just kind of a quick backdrop. So for this session, you know, we've been talking about cyber insurance really, uh, in, in a meaningful way, right? Um, post we, we can all talk about, you know, again, the Post the Kaseya event and all those, the ex exchange vulnerabilities are the things that really started to kick things off. Um, give or take, two and a half years ago when, you know, MSPE, everybody's coverage was ratcheted down, premiums went through the roof, we all know the story.

Um, a lot of players entered the market. Seems like things are starting to normalize out a little bit. Um, we've got some good people on that know this, uh, including obviously Wes, who's been intimately involved. Now, Ryan is, uh, to a degree as well, but, um, which, which we'll talk about momentarily. Um, and, and this has impacted us as MSPs. It's impacted our customers. For some it's been awesome, for others it hasn't.

We've talked a lot of different angles on this, on the cyber call, Gary, over the past few years, we've talked about, you know, we've had, again, Eric told John to talk about the dos and don'ts in helping your customers, but all of a sudden in the past, I know believe, I think it's been, what, six to nine months, um, we've heard, started to hear this thing about cyber warranty.

And Tim came to me, he goes, you know, I, I think it would be really interesting to do a cyber call, um, on cyber warranty versus cyber insurance and what's good, you know, should we have both? Should we change things for one for the other? So that's really the backdrop of today. And, and with that, um, before I introduce our two awesome MSPs, Brian, is it possible for you to just kind of get us on the fairway of what the heck is a cyber warranty?

Um, and then we'll introduce Tim and Dustin and get going? Yeah, absolutely. Um, so cyber warranties have been around for a while. They, historically, within the past few years, have been more tied to specific technology solution providers. So what that means is, you know, hey, if you use my software, uh, and that software is in compliance with certain standards that we set, then we will compensate you in the event of a loss event.

Um, and so you see a lot of these providers, especially the ones that are providing, you know, a, a wide spectrum of security services, starting to include cyber warranties as as part of their, their offering. Um, what, yeah, I think what we're talking about today, um, and full disclosure, I am an advisor to Cork. Um, is this, uh, you know, is, is is this new player in the market Cork.

Um, and, uh, the really, the way that they cork is different is, um, we're not saying you have to use a specific technology stack. You can use any technology stack you want.

What we're gonna do is work with you within your existing tech stack to determine if you have risk signals in your environment that could potentially lead to loss scenarios and tell you about them proactively so that in the event of a loss, you will know in advance whether tell you that that issue exists so that you can avoid the loss to begin with. Mm-Hmm. So, um, cyber warranties are getting, um, a little bit more nuanced.

Um, so cork's offering is a little bit different, um, then than what you, than what you see out there with your traditional kind of solution, provider specific warranty. Um, there's a lot, there's a, a plenty more differences, but we have an hour to get to get into all of them, so I'm not gonna, Can you give the, like, so far I don't understand any of it. Like, um, so can you give like a specific example? Like, I'm an MSP, I'm a $5 million MSP, like, what would it mean to me?

Can, can I, can I tee something up to you, Ryan, to see if this, if I'm here correctly? So remember the travelers incident where there was an MSP, it was about MFA and there was like, let's call it a $2 million claim. They initially it, and then it was one of these, do you have MFA deployed? And along with the questionnaire and the customer said yes. Well, they weren't specific. So in this case, I think it was A-V-P-N-M-F-A that was compromised. Don't hold me to it. Yeah.

Is that the kind of thing, Warren, where if you had the telemetry, you'd go, Hey guys, by the way, you might have MFA here on O 360, M 365, but you're wide open over here. Yeah. So the way a cyber insurer does that is they ask you questions about your environment and they say, do you have these controls? And you say, yes.

And then when there's a loss event, they go back and review the conditions or the fact pattern of that breach, and they say, okay, well you said you have MFA, but it wasn't on, so we're not gonna cover this incident. Right? That's, that's what can happen with cyber insurance, with cork's cyber warranty. And the reason I'm being, I'm, I'm kind of conditioning this, is there are different types of insurers.

There's outside in and inside out Cork is an outside inside out warranty, which means it has a, you know, the ability to monitor your tech stack and tell you when there are issues in your environment that could lead to a loss. And that also tells you whether or not a loss on that asset would be compensable.

So it's proactive in that it's telling you before something bad has even happened, whether or not your asset is potentially, uh, able to be compensated for with your traditional cyber insurance, the only way you find out is to suffer the loss event and then go through the post event review. So go, going back to Gary's question, what is the difference between cyber warranty and cyber insurance?

There are a thousand small differences, but at the end of the day, they're both just vehicles for you to get compensated in the event of a cybersecurity loss, they behave differently. And, you know, that's why I'm saying some cyber warranties are different. The way corks works is inside out. Um, and it's technology solution agnostic. And the reason I, again, I make that differentiation is because 99% of the warranties that exist right now are tied to a specific solution provider. Got it.

Like, I, I'm, I'm mind that, that being hypothetically, I'm, I'm CrowdStrike, and if you have CrowdStrike, um, Falcon, you know Yes, Exactly. We'll cover you up to this if it's deployed correctly in everywhere. Yep. Yeah.

If you, you know, and some solution providers will say, well, as long as, as long as our solution was deployed, some will say, as long as our solution was deployed and you adhere to these five security standards that we require, this is problematic because if you have, as most MSPs do a variety of technologies, and each provider is providing you a specific warranty, there's no, all the warranties have different conditions. Got it. And so that becomes very confusing too.

And so then it's like, ah, I'm not gonna figure this out. I'm just gonna go get cyber insurance. Um, but as we know, cyber insurance doesn't always cover. And sometimes, especially, like, one of the reasons I got involved was as a CISO for the past, you know, two decades, cyber insurance has been a really complicated topic for me. I sit down and ask the, the broker or the, the underwriter, you know, am I going to be covered in this scenario?

And they're like, well, it's depend on, on the facts of the breach, I get a out them and I wanna know upfront count on your insurance compensating me, or do I need to self-insure against that loss? And so I think, I thought when, when approached me that their, that their specific approach to this problem was interesting. Um, but, you know, I think I'm, I'm here less than a, you know, I'm a pretty crappy salesman. I'm a pretty good security guy.

I'm, I'm here more in a capacity of like, trying to help educate what's out there and, and, and how things work. So, um, you know, I think I'll leave it to Tim to do more of like the, you know, how it, how he sees it working for his, uh, his msp, um, as an early adopter. But cyber warranties are becoming more common. You're going to need to understand them.

Um, and they're, there're viable alternative to, depending on your needs or, uh, a viable addition to your, your financial loss protection, um, for cybersecurity incidents. Got it. Alright. That said, Dustin, quick intro for you. Thanks for joining us. You've been on before. Good to see you. And you know, nice to see the Gatorade versus the bourbon is, or is the bourbon in the Gatorade? That's a good strategy. I might, I might do that next time. Okay. Good to see you.

Tell us a little about, Um, yeah. Dustin Bollinger. I'm down in Austin, Texas. Um, two time MSP owner. Um, I've followed and listened to Gary for like 10, 12 years now. So very true Methodist. I'm hoping to get at least one. I'm proud of you today as we go through this to, um, this is my second MSP. We actually went all in on law firms, um, and in our third year hit three and a half million. Um, if you ever go to start a second MSP, it's kind of a cheat code, guys. Um, it's crazy.

I made so many mistakes. I did so much dumb stuff. Didn't listen to Gary on the first one. Um, second time's been way easier. Um, we're hitting a different phase now where it's a lot more difficult, but, uh, went all in single stack. Um, all the cybersecurity stuff baked in, I think we're gonna dig a little more into that later on. Um, and we are at, uh, 28, uh, employees today. Good. I'm proud of You. Good. I was gonna say, Dustin, don't hold your breath. Really. I'm proud of your thing.

Untrue. Untrue. Tim, good to see you. Thanks and welcome. First timer here on the cyber call. Thanks for joining. Yeah, first timer. Uh, looking forward to being here. Uh, Tim g Gu, um, president of PCH Technologies, my first MSP, um, doing about 25 years only really got invested in sales and marketing in the past eight or nine. We've been on through a, a growth track. We focus on construction, manufacturing and financial customers. Uh, 20 to 250 seats typically as our market.

We have fully managed and co-managed, um, customers. We have mostly in the Philadelphia market, but nationally, internationally as well. Very cool. Thanks. Good to see you Tim. Alright, Ryan, I think you're in the, uh, hot seat here. I'm, yeah, uh, I'll do, I'll do my best to, to co-host well, um, so Tim, you know, you run a successful MSP, you're an early adopter of, um, cyber warranties. You know, what MSPs hear from you.

What intrigued you about cyber warranties and starting to discuss them versus cyber insurance or in addition to cyber insurance with your customers? So I've been looking for the past five or six years a way to tack on a cyber insurance like product that I could provide clients because some clients, you know, bef, you know, did not have anything.

And I felt that it could be, you know, a competitive advantage for PCH to have a feathered in cap, you know, beyond just other MSPs that just providing security solutions. Um, we're security first MSP, we're SOC two certified. We have a single security stack that we actually use. And the cyber warranty really intrigued me, um, kind of for two reasons. One is the technology behind it to help with what we call parity.

Um, we have security department here that ensures that all our products are deployed across the entire organization between our, our, uh, Sentinel one, our data rmm, all that stuff is operating and running correctly across the entire organization. We have parody all the time 'cause we don't wanna make, we wanna make sure that we're providing the best possible service for all our clients, making sure all the security is up and running and effective.

Um, so the technology piece of the cyber warranty helps with that. But the cyber warranty in particular, um, is more limited in scope in what it provides. But things that actually are, you know of, are of, um, importance to small business owners. Um, ransomware, um, payment business, email, um, compromise Payment, um, it offers a gap insurance. Um, so your deductible can be funded by the warranty.

So as long as you have these certain pieces of technology in place, the technology stack is warranting that and you're able to quickly get a, get a claim paid out through the warranty while you're waiting for your insurance to get paid out. So it's a very interesting product and I was very happy to be part of the, uh, early access program in order to kind of give some of my feedback from an MSPs perspective.

And they were able to make some adjustments to the program to make it, um, more effective for MSPs. Have you seen your Customers? I do have one customer that is, that is, that has sold on it, but we only, Gary, this is brand new. We had a Phillies event about two weeks ago. We set multiple, multiple appointments, multiple, multiple appointments on it. We have one sale through that, through one of my, one of my long, longer term customers.

But it is an education educational process and it's something that you need to, um, look at client by client. Um, because one of the strategies that I learned by talking to my business owners is that one way some clients can't, um, get qualified for cyber insurance or it's very expensive. The one strategy is to use the cyber warranty to fund the deductible portion of it so you can raise your, your, uh, your retention or your deductible on your cyber insurance to make it more affordable.

That's one strategy that I've learned in the short time we've been providing the product so far. Yeah, And that's a big differentiator for cyber warranties, right? Is is this fact that oftentimes the underwriting process, post incident for an insurer requires the digital forensics and incident response process to be complete so that they can determine whether or not the loss event is covered.

And a lot of MSPs find themselves taking on debt or, you know, um, uh, you know, trying to, trying to scrap around for cash just to keep environments running or pay employees so that, that, that quicker payout, um, definitely helps in the event of a cyber loss, which I, I've always seen as an advantage of cyber warranties. Um, so you have one client set up. What, walk us through the process of working with a client or the prospect. Is that, you know, is that your team alone?

Are you working with the cyber warranty provider? Um, yeah, you know, you know, what, what do you feel comfortable with, um, in terms of discussing it with the customers? Yep. So that's a very, for these initial phone calls, it's, it's myself, a member of the sales team and then a representative from Cork. Um, all three to answer these questions because being a new product, it's not traditional security stack that we're selling 'cause it's actually a financial product.

And we're very clear that PCH has no, um, responsibility on the financial aspect of it. It's basically, you know, basically fully through Cork we're just reselling the warranty service and providing, you know, the, the connection into our, um, our technology stack to, to provide the telemetry. And we're providing, you know, that security work. So we're basically doing these meetings and we get different questions each time.

We're building a frequently asked questions so that we can have all the answers to these questions when they come up, you kind of through a sales process. So right now it's a, since it's brand, a brand new product, I'm getting involved in it.

'cause I wanna be as successful as possible and understand, you know, what risks are the people are, are asking about, making sure we get the, the answers question, the answers, um, properly answered from, from a financial perspective, what's covered, what's not covered, et cetera. It's kind of like selling insurance, but it's not, it's a very odd, um, feeling and it's, it's a warranty I would say. It's not insurance, it's a warranty.

Um, but it is an interesting, um, something new, which I like to do new things. So, um, you know, that's what that kind of would say about that. Ryan, can I just, so Drew has an interesting question. S and, and maybe this is like, I think Carlson, uh, the CEO of corks in the audience, but he can answer it. But if, if any of you, Ryan, or any anyone on the call feels comfortable, drew says so and MSP can provide and speak, um, to the cyber warranty 'cause it's not insurance.

And Cork has an agent question mark platform question mark that helps monitor and access a cyber monitoring service as well to a degree. Can you someone unpack that a bit? Because I I'd love to know too. Yeah. So it's, regardless of whether it's insurance or warranty, there are two types of coverage outside in which you should think of as the questionnaire process or inside out. We look at your environment to determine whether or not there are issues.

The Cork warranty is inside out, which means there is a platform, the platform uses API integrations with your existing tech stack components. So you bring your own tech stack, cork plugs into it, monitors it and tells you if there are risks in your environment that could expose you to ransomware, business, email compromise, et cetera, and proactively tells you whether or not those assets are out of compliance.

Meaning if there were to be a, a loss event on that asset to tell you whether or not that asset would be covered by the warranty. So you don't have to sit around and wonder if your insurance is gonna pay out. You would know upfront this asset is or is not in compliance. So I know I have financial protection on it in the event of a cyber incident. The, the one thing I'll say not to represent, not to um, defend the carriers, I don't represent any of 'em, so I don't really care about 'em.

But many of the carriers are actually doing the same thing though too now. So they're now doing the inside out. They've recognized they've had to, and the reason they've not done it is not because they didn't want to, they just didn't know how. Um, so Yeah, s had something, yeah, has had connectors since 2019. It's the weirdest thing. They don't advertise 'em at all. So they've had a 365 connector since like 2019, but you'd never know it because it's not on their stuff.

It's, um, insurance is, I hope no carriers are watching this insurance is still pretty ignorant on the cybersecurity side. So it's just like, oh, this is a cool idea, but they have no idea how to do it. You see the people in this room, cork leading the way, and then insurance goes, that's awesome, I'm gonna do that next. So it's almost like, and again, we've used this analogy, Wes, it's almost like, you know, my son's now becoming a driver. Hey, do you want an opportunity to reduce his rate?

We can put this thing car letting you know, is he going too fast? I was gonna say too slow. Obviously that's not the case, right? Right. It's, it's, it's that kind of thing is what kind of risk is, is he now for us? And you know, based on that we're gonna determine your loss. It's helping us determine. Yeah, I, I agree. I mean, Wes, I'm seeing the same thing, like move pretty quick with a lot with providers where, um, I, I almost think 'cause they have to right, get to the same point.

It's almost like they're the, The markets, the market's pushing them that way, right? There's, I mean, you're having a record ransomware year, the rec, the losses are gonna be again And can't trust MSPs and they don't wanna not pay out. They wanna do what they're supposed to do, which is pay out based on them not having incidents for things that they're supposed to be doing. Yeah. And I mean, think talking about costs going up, right?

You go to renew your cyber insurance policies next year, I can pretty much guarantee you your costs are gonna go up again because of how bad of a year this has been for insurers. Quick question on ransomware, and I promise like humorous 30, 60 seconds. Yeah. Um, it, it seems like, you know, when you look at what LOP did, you know with just exfiltration without ransomware, with the social engineering and BEC leading the way this year, pretexting really, but ransomware still having record years.

It doesn't, it just seems like It does. I mean it's, it's, it seems like everything's having a record year, right? BEC is having a record year, ransomware's having a record. The takeaway is threat actors are having a very good year and it almost doesn't even matter which type of attack they're using. They're broad success. Yeah, well they're In an expanding tam. Yeah, It's true. Yeah. They're In the same marketplace that we are. It's good marketplace. It's true. Yeah.

I think, you know, regardless of whether you're firmly in the cyber warranty or cyber insurance camp, the main takeaway from this conversation is the market is likely moving towards inside out monitoring. Mm. Inside out monitoring to use our, you know, to use our right of boom left of boom nomenclature inside out monitoring provides you left of boom insight. It tells you the issues in your environment so you can be proactive about fixing them to avoid the loss scenario to begin with, right?

You can identify the risks and you can correct them. You can protect against those losses that's left of boom. If you're using a legacy carrier that's outside in questionnaire based, doesn't understand anything about your environment, you're just kind of sitting there hoping that they're gonna pay out on your claim and with the way the losses have been going over the past couple years, that's an increasingly losing strategy.

So I think as you're looking at your cyber insurance providers, you really wanna start asking yourself whether or not there's an inside out component so that your security team like Tim has, can actually be seeing the same things the provider is and be making sure that your financial downside protection is in good working order at all times. Hmm. Yeah. I just wanna mention real quick, um, we're using the car analogy in our sales meetings, uh, because it's a matter of kind of risk reduction.

All the different securities tool sets we're putting in, like our email protection that has bannering, that's like airbags almost for people using email when we do, uh, no before campaign or SI cyber education, we're, we're training our drivers, which are, you know, operating computers and the cork platform is kind of like that device you put in your car to make sure that you're a good risk, you know, to the actual, you know, to the, to the warranty service from that perspective.

So I think there's a lot to be said about a safe driving program is very similar to a safe cyber cyber program and different, it's just different, uh, components because you're basically reducing your risk from an insurance perspective. They don't want people to get in car accidents, so they'd use risk reduction in that case. Same thing for the cyber insurance. They don't want people to have cyber events, so they put mitigation risks in there, um, to do that.

So I think the two things are very closely aligned. You can use that, that to business owners that may not understand cyber, but they understand driver, you know, driver safety, driver education, GPS and the cars. All those things that you're putting in to basically reduce your risk overall. Brian are, you know, it makes sense with controls that have APIs and things, but are we ever gonna find easier ways to do the hygiene, mundane inventory account management stuff?

Do you foresee a day where that that might get easier? I mean, I don't, these are hard problems to begin with. Um, you know, and, and part of the problem with the cybersecurity landscape is everybody wants to sell you something to solve the problem.

When a lot of the times to solve these problems, you just need good people and process, which can be tough for MSPs, attracting people, retaining people, building robust process that scales across dozens or, or maybe if you're lucky, hundreds of SMB customers. So these, these kind of fundamental problems that lead to hygiene issues, um, require a different approach. Like, you're not gonna tech stack your way out of them.

You're gonna have to really focus on, on your holistic people process and technology solutions like this, which are, you know, you know, the, the, the reason I got involved with Cork, you know, I actually wasn't super interested in cyber warranties or cyber insurance, but I remember the meeting I had, it was, it was cold. We we're having a coffee and we were talking about it. The reason I got interested is it's a, it's a really interesting technology problem.

How do you take the information about what's going on out in the world leading to losses for SMBs and MSPs and codify that into a platform that proactively alerts the MS p to the issue so that they can prevent the loss to begin with? And that's when I was like, oh, the, the warranties that go with right, the value is the fact that I'm able to proactively see what's wrong in my environment and correct it.

And then when we started talking about, you know, this idea of bring your own security stack, oh, now that's an even more interesting problem, right? And now I'm not trying to solve it with these three solutions, I have to figure it out for end solutions. And so how do you abstract away these constructs but make them applicable to all these tech solutions? That's really where I'm working with the team and I'm the most excited because it's just a hard, interesting security problem.

Um, like I said, I'm a crappy salesman, but I think, I think there's a lot of value here in this approach. Um, and I think it's complimentary to, to ci, so it's, it's definitely worth, worth having a look, but, you know, don't take it from me like Tim was the one that got sold on this idea. Right. Um, so Tim, you know, I brought up cyber warranties, poten, you know, especially specifically inside out cyber warranties or insurers helping you with your left of boom considerations.

How do you foresee cyber warranties changing your security stack, if at all, or your approach to your security stack, if at all? So our security stack is just gonna, at this point in time, kind of stay as is. Um, until we add another other product in. I think it enhances, um, our stack. It's one more layer by having that enhanced parity and making sure that we're in a, in a better place. So it gives some tools. What you're Saying it, I dunno what it Is. What are you referring to? Sorry.

Thank you for Thank you Gary. So the Cork platform, the cork technical platform, gives us the ability to add to our tech stack in order to make sure that our clients are more, more secure. The warranty piece is, you know, a financial, um, consideration that will help in case there is a claim that has to get paid out on the most common things that happen.

But the, the, uh, the, the technology platform is really the big, big key for us, um, to, to try to prevent anything from happening at all in the first place. So I guess here's, here's the big question, Tim, the one that everybody's probably wondering, do you still feel cyber insurance is necessary and are you carrying one or both as you introduce cyber warranties?

So us um, us as a company, we carry, you know, cyber insurance and each year we review to see where we're at to make sure we have the proper coverage and things like that. Um, this is more for our, our clients the cyber warranty. And we feel that the clients, this can be a cyber warranty, can be additional to complementary to the cyber insurance.

Um, in most cases there you could make a case for certain industries, certain clients that do not have any type of cyber insurance, um, more like the construction field that's completely cloud-based or a cyber warranty could be used, um, to mitigate their risk, um, from that perspective. So it could be standalone in very, very specific use cases. Um, and also in cases where clients can't get cyber insurance or it's not even, uh, feasible financially.

So there's kind of two cases for it, but most cases it's a complimentary product to cyber insurance in very certain situations where the cyber warranty from Cork would be a kind of a standalone product for, for our clients. Yeah. Using it to pay the premium is pretty cool. That's a, that's a good idea. Yep.

So basically what the more strategy would be to, you know, allow them to raise their, their limit on the deductible so the cyber warrant will pay that the first dollars in and then that, that will make a financial sense. Plus also we're getting the additional, um, telemetry to making sure that it doesn't even happen in the first place. So that, that's kind of a win-win, I'm talking to a small construction company right now.

Um, they don't have cyber insurance that's around $15,000 a year for them and they have to pay a 25,000 a deductible and they're, they're all cloud-based products. They're secured properly. They're like, what is my, what is my risk, you know, in some of this, no personal information besides, you know, 25 clients or so, but they're considering just using the cyber, the cyber warranty piece, um, in this, in this particular case. Alright, well I think I'm, I'm tapped out.

I think I'll hand it over to, uh, to, to my friend Wes. Awesome. So Justin, I'd love to hear from, I mean, I've already heard the story and I'm, I'm always blown away by it, right? But I've told people over and over and over, um, if you wanna hear from an MSP that's really kind of seized the reins on this and really I think saw what was coming here before any other MSP I've ever talked to.

It was you, um, when I was still at ConnectWise and I was talking at, um, it Nation secure on the keynote that we'd see cyber insurance drive changes way faster than, um, you know, compliance and regulation coming in. That was way back in 2019. I remember you came up, you are like, Hey, I see the same thing. Can we talk about this? So, so talk to us about Clear Guidance's journey. I'm just bragging. I love to brag on my friends. Talk to us about your Journey. You did. I I heard you say that.

Uh, yeah, so Dustin, talk about your journey. Talk about what you've done with this. Talk about, um, like give other MSPs some tips and hints to do the same thing. 'cause I know it's worked well for you. Yeah, so my old MSP, um, was the, the anti true methods. We were doing a lot of stuff a la carte. And so a lot of it that unclear guidance was like, I don't wanna sit there every year and tell you, okay, hey Wes, I need you to buy this new firewall, right? This, that and the other.

So it was kind of that one stack, but at that point, seat price goes way up. How do we justify it? So I started looking at what's the stuff that's just a huge pain in my ass that we can turn into a competitive advantage. So that was 2020 where cyber insurance started hitting really hard. It was like, great, I'm gonna go out and be the guy at the MSP that says, I know how to fill this stuff out. Uh, you know, we already check all the boxes for it.

So a lot of what you're seeing people do today, we were doing that 2020, um, we actually doubled our MRR 2020 to 2021. Um, and it was almost entirely around clients switching to an MSP that was more security. Uh, Tim used the phrase earlier, security first. I absolutely love it. We say the same thing. Um, so being able to go in and say, look guys, this cyber insurance stuff, like insurance is saying, this is a good idea, you know, you should be doing this.

They're right and I can do all this and make it easy for you. So that was really what drove that is, um, in a lot of cases I've found something that it's just a huge, it's a, you know, I'll call it a necessary evil, uh, cyber insurance. Um, you know, okay, how do we turn that into a competitive advantage so we're not just sitting there suffering through it? So that, that was what really got that going. And, um, it's sad that that base level of security is so low that insurance is driving it.

I don't think anybody in this call is gonna say, insurance is cutting edge, right? I mean, it's just a, it's a baseline, it's there, but great. That's gonna lift up those SMBs, get them to actually listen. But, but I mean, even more, you've gotten your insurance license, you spun up. Yeah, I did. Uh, is it, is it paradigm? I mean, just talk a little bit more about some of this.

Yeah, so I ended up, um, the other part of it is I talked in chat a little bit about it was, um, all the insurance people, um, I can say we now, we the insurance people, you know, try to scare you. You can't talk about this, that, and the other. So at one point I was like, well, screw you. I'm gonna get my license so I can go talk about it.

Um, and we're doing webinars and stuff now, and I, I'll do it as my MSP and I'll do a webinar to, you know, I did one a couple weeks ago for local law firms and we had two meetings come out of it because I was talking about cyber insurance update 2023 for law firms. Um, so really again, just grabbing that. Um, so yeah, I got more and more into it.

Um, I'm, I'm a half insurance nerd now, but the craziest thing to me is, and I don't mean this as a brag, it's more of kind of a insult to the insurance industry. A lot of times I'm this Dustin Bolander and God forbid, is one of the smartest people in the room for cybersecurity. The last big conference I went to, um, I was with, uh, Reed, well, up from Fifth Wall, and we were looking through the sessions and all the brokers are all excited. Hey guys, there's this cool session.

It's called MFA 1 0 1, and that was the big technical session. Um, it's just insane. So that's what gotten pulled more and more into that. Like Ryan was talking earlier, so everybody on this call, the inside out scanning, that's the logical thing, right? The port scans, that kind of stuff. Like, okay, it gets you a little bit, but it only shows you half of what's going on. Or probably it's the tip of the iceberg. Let's say that it only shows you 10% of what's going on. Like it's a paper.

PDF is a terrible way to do anything these days. Um, so that's been an exciting thing as we get more into insurance. Um, just the, the industry is so outdated far behind. Um, sorry, I know I have actual insurance friends on this call. Sorry guys. But, um, yeah, so that's where I've been pushing, getting more and more integrated with that. But from the MSP side, it's like, Hey, apologize for nothing. Do what? Apologize for nothing.

But, um, One thing you said that I've loved was, um, and, and maybe you should reiterate the title, which was something specific for law firms. How did you, what was the title? Yeah, uh, we did, uh, cyber insurance, uh, update 2023 for law firms. So it was going around the controls that they expect to see, um, you know, just the industry specific.

So I think Ryan or Tim touched on this earlier was you see a lot of the stuff of, you know, wanting specific controls or more, you know, detailed nuances on it. Uh, so running through like, here's the stuff you gotta have guys, here's the table stakes for your customers. But I just wanted to like, again, say, I'm proud of you Justin, but no, seriously, um, I love what you're doing just from a marketing side and the MSPs, please take note in this.

Like you could have said, Hey, this is what's new in cyber insurance, but notice Dustin said for law firms, right? And then he might say, you know, to niche even further down, you might, you know, he might do it again and go, Hey, we're gonna do one for law firms specific, you know, specifically in litigation or m and a because of the, um, sensitive data you hold and the more niching, um, you get, you know, Gary talks about building wedges, getting people to show up.

Um, Dustin, seriously phenomenal. And if we have MSPs do more and more of these types of things, you'd be surprised. Just little tweaks like that. Um, Dustin, you've probably seen it, right? More people show up because you've said it's for you. Yeah. And we have, um, my favorite example, all the people that say cold calling is dead. Like it's not great, but we do, uh, once a year we'll do a, uh, email, cold email campaign with fault cold calls.

And again, it's targeted by industry and say, Hey, you know, in your, uh, let's say manufacturers, here's the six things. Is cyber insurance a headache? Right? Headline, here's the details. Uh, here are the six things you need to be doing. Free piece of information. You're not registering to make it easier. By the way, here at Clear Guidance, you know, we turnkey, everything's easy, we'll help you fill out your application. Um, the response rate we get from that, that was going back to 2021.

That was my entire, the whole year all I did was market around cyber insurance. That CGP makes it easy, right? We have the experts, we have the security tools, um, that, that ship hasn't quite sailed yet. So there's still opportunity for people to get in. You're seeing more and more MSPs talking about it, right? It's a popular topic, but there's still, most of them aren't. So you can still, you know, I think probably another 18 months that's gonna be a great marketing tactic.

Justin, I always also wanna ask you about risk age, right? So, um, you don't, you don't talk about it all that much, right? But you, you spun up and built a company with Mike Riggs and some others that's doing some really cool things around. Yeah. Um, you know, what, what even what Ryan talked about, right? Sort of that inside out and just talk to us a little bit about like how that's the future of where, um, we have to go in terms of, of assessment and kind of what risk age is doing there.

Yeah, I felt like the whole first half was like a tee up for that. Sorry. Um, but yeah, so that was, um, like I said, it's like everybody on this call is, we all kind of know this is the road direction it has to go. So what, um, what I saw was as I kind of got a foot in the door in insurance, I mentioned about earlier the being the smartest dumb guy in the room. Um, I got a little bit of a platform there, so it was like, look, we can do this.

So we built, um, the prototype and got it deployed in, uh, late 2021. Um, doing that telemetry. We have, uh, 12 connectors for MSP software specifically. My frustration was out of like, if you look at at bay and Cowbell, they have a couple things that they integrate with. It was like, these aren't the tools that we use, right? Like, I have Huntress, we use Huntress, there's an API, no carriers integrate with Huntress.

So yeah, with risk age, we built it up, um, and we actually have, uh, two carriers and a reinsurance, uh, reinsurer using it currently. So it was on that side of it that it's a, um, again, Ryan's on the right track, like they figured it out. It's that notification. Are you in compliance or not? The craziest thing was though, at first it was like, Hey guys, we're gonna be a big data big brother platform, right? Everybody can see what's going on. Insurance will know exactly.

Uh, everybody hated that idea. Surprise, surprise. Like I should have seen that coming. But, um, where we ended up though was even the insurance companies hated it. They don't want to know, they don't want that data because it's a liability for them. So what most of them are asking us to do, we have, uh, one that's, um, gonna be going in the Ms P channel shortly, and it was, uh, 72 hours of notifications to the MSP before they carrier even sees it. So it was just like arm length.

It's just sitting there kind of whispering in your ear saying, Hey, you're outta compliance, you're outta compliance kind of thing. So it's all going. Um, I know Wes, you've done a couple presentations, like, we know, we know what the industry's gonna look like in 2030. It's like, how are we gonna get there, you know, who's gonna be there first? That sort of thing. Um, I don't think there's any, uh, debate on where we're gonna end up. Like even everybody up here, right?

It's warranties versus insurance kind of thing. We're all gonna the same place eventually. It's just what do the next couple years look like? Well then that brings up the next question then is from your perspective as both a someone that's deep into insurance, but also an MSP owner, um, do you need, like do you advise your clients to need both a, a warranty and, um, in like an insurance policy itself? Are there differences between the two? Uh, in your mind?

Walk us through what's in your brain there? Um, I saw the CEO is in the chat somewhere, so I'll say I'm super interested in Cork now after what Tim said on paying premiums. Like that's a cool idea. 'cause historically we were talking at the beginning, like the Sentinel one. Um, I don't use Sentinel One, so they can't kick me outta the partner program, but theirs is so limited.

I was always like, man, this isn't, you know, what are the chances of the, you know, the moon was half waxing and it was a day starting with a t it'll pay out kind of thing. Like, it's just not practical. Um, so I've never really paid that much attention to warranties. Um, we do follow, I think both Brad Gross and Eric k said right into your contracts that you require, uh, cyber insurance. Um, we do that. Every single one of our clients have that.

Um, just coming off of the advice of lawyers, so, and then obviously I've talked about kind of where I dabble in it. So, um, yeah, the, the insurance a hundred percent. Um, we do our tech e and o, um, it's a huge, we're going through it right now. It's a 60 day process kind of thing. But um, yeah, on the warranty side, um, cork is definitely unique compared to everything else that's been out there. So, uh, my tune might change on that, um, you know, once I get to see what they're doing.

But historically now, I've never really relied or even thought about the warranties because like Ryan said, right, it's been that product specific, so many restrictions on, I pasted the Sentinel one into it earlier. Like it's crazy how restrictive it is. Yeah. Yeah. It, it has been that way.

And I remember in those early days when I would talk to MSPs and, and even other security practitioners outside the channel, they'd be like, yeah, it's great marketing, but you know, what does it actually do? It, it it's not, yeah, it has no, it's, it's not effective.

Um, maybe the last thing I'll ask, and I'll hand over to Gary is, um, even like, do you run into, I'm sure because you have law firms, you, you end up with some that are quite large, you know, they're gonna want 3 million, $5 million in coverage and that's really difficult to get a hold of, right? Yeah. I mean, these days money is drying up, right? And so it's hard to find carriers that'll be willing to go to those higher, those higher limits. Can you talk about that a little bit? Yeah.

Um, you're having to get the security, you know, much more up there and then starting the process early. Um, so that's been one of the bigger struggles or I guess an advantage, right? I said earlier, convert it to a competitive advantage. It's like, all right guys, now you really need me, right? We got the really good security that you're gonna have to have to get this. So that might be an opportunity for warranties too.

Um, Tim, I don't know if you can speak on that where it's like, you know, okay, you're having a hard time getting 5 million coverage, then maybe the warranty you can get a $3 million insurance policy or a $2 million insurance policy and then a three, a $3 million warranty to cover it. Um, that might be a good play with that too. Yeah, the warranty is here right now we're looking at a hundred or 500,000.

So it would only, it, you basically have to look at a very, I think you could get a very large deductible retention policy to try to afford that larger policy would be the strategy from, from that perspective. So. Gotcha. I just, I wonder though, does it cover things like, um, incident response? Does it cover things like legal, some of those things that really stack up into the cost? I mean, I don't know. I'm talking from ignorance. Yep.

So the things that are, that are included in the, the, basically the incident response, depending on the package, you have business email compromise, uh, payout, the stupid thing where, uh, you send out the gift cards, things like that incorporated as one, as one of the items. It's stupid, but that's what people fall for, you know? Yeah. Um, you know, and they, and basically the other cost business, uh, interruption is included depending on the package you have.

So all the things that happened, or ransomware payment, uh, as well, data recovery. So the things that you would need to initially do right away, um, to that the insurance would typically pay would be the first things, the instant response where you're kind of executing with M MS P typically, or somebody that's the insurance company's using, would get paid through that warranty first, and then the insurance would cover basically after that.

So that's kind of the strategy to, to use from a cyber warranty perspective. So, Tim, one other quick question for you too is this came up earlier is like, how do you, um, I'm assuming co court kind of coaches you around working with insurance or like provide the list of approved insurance carriers that you can combine it with. Can you talk through that?

'cause that was something that came up earlier and I was like, I, I know that's an issue, but, uh, since this is so unique, I'm curious how CO's handling, sorry to put you on the spot. No, you're fine. Yeah. At, at this point in time there's no, um, there's no restriction on the insurance carriers, um, that they're, that I'm aware of that they would work with.

So they're gonna, you're gonna basically have the, have those costs, uh, as an a gap coverage on those for those costs as long as, as long as his costs are gonna be approved by the, you know, typically your typical cost there. So that'd be my answer, but I can get a get clarification after the call on that a little more for You. Let's, let's jump to Gareth so he gets some time here, Gareth. Yeah, so let me take a look 'cause we have limited time.

First off, can I kind of digest what I've heard so far? Sure, go ahead, Gary. I, I don't think this is a call about warranties, right? Warranty insurance, like I almost don't care. Like, uh, this is about alignment and however you stay alignment, whether you do it currently, whether you use a third party, there's two on the call now that do it. And I know of a few others that do that same thing. And I think that's the takeaway here is that, um, they almost don't have to be coupled.

Like one is one thing, which is how do we know at each customer that we're doing the things that we need to do, like for that company and so that their insurance will pay out? How do we know separately now that we have that, how do we go get coverages? Gary Insurance coverages, warranty. It's insurance. To me it's all different types of insurance.

Say what you've summed up and if I'm hearing you correctly, is if you want to be good at this, you're having a risk conversation with a, with a business leader. Is that a fair statement, Kara? Yes. You're having a and being able to do it. 'cause it took us an hour to get here, like with a prospect or a customer. Like you got three minutes to be able to articulate something.

If it's a prospect to get them to wanna stay on the phone for a minute or to let you stay in the room for another few minutes to think that maybe we know something they don't. If it's a customer, it is why they should do something different than the way we're doing it now because things have changed and what it means to them and we have to get it, we have to get it down to that.

But it also probably begs knowing your mind that this is, again, if we're gonna do this in our business, who, what's the role? What are the metrics? Like there's, even if you're having these conversations, there's cost in this, right Gary? Absolutely. Yeah.

I mean, look, this is all stuff we should be doing anyway and the reason we were looking to yet another platform stack, whatever it is, is because we're not sure that we are at least enough to know when things hit the fan that we're gonna be okay at that customer compared to the other 60 70 customers that we're trying to do with that too, that have different environments. Like it's the hard part, right? Of, of the, it's the hard part of the business. Andrew, you said use that as a wedge.

I had just written down wedge. So with the last couple of minutes I have, I want to ask Tim and Dustin kind of the same question, Tim, not just with your customers, but like prospective customers. Have you been able to make this a wedge? So this is not really a wedge, um, because it's, there's too much to explain upon it because when we first order discovery calls, we want to find out what the pain points are.

Now if they say we're having trouble with cyber insurance, then we would bring up cyber warranty as a option on that call. But typically this is at the later in the stage when we've already, you know, given a proposal or starting the proposal process where we're gonna give a cyber warranty.

Let's say if two security first MSPs similar stacked PCH has a warranty financial backing, that's gonna be the competitive advantage for us that we're gonna be providing the service from that and we could talk to about being able to provide that. So that's how we see it. It's not a wedge right up front, but it's a, a way to close a deal when everything's kind of aligned. This, you know, similar. So that's how we're doing the product from a sales perspective.

See, I, here's how, here's how right here I'm, can I role play with you how it would sound? Go ahead. Yeah. This is my, this is my own my own way I do things. So go ahead. Yeah, Yeah. Based on what I know would be, yeah. Hey, Mr. Prospect. Yeah. We asked some questions about security. You feel real comfortable with where you are. How about your, how about your cyber insurance? Yeah. Um, do you know what the lag is when you'd have to pay? Do you know when this happens? Great.

Did your current provider offer you a warranty as well? Do you understand how cyber warranties work and how they're different to what this is? No, I don't. Tim, please tell me more. Great. That's a great wedge, Gary. That's a great wedge there. I'm giving you that for free. Tim, thank You. Thank you. Thank you, Gary. I appreciate it. Only Philly's hat, a Philly's hat on top of your guy in the back for, uh, Yeah, I got it sitting over there. Yeah.

Gary, you can put it back right on, right on there. So it's right On my chair from Connie Mac Stadium. So there you go. Uh, and Dustin, last question I I wanted to ask is, um, and I seriously, not kidding around, I'm super proud of you, like how far you've come, but like to go that far with insurance, like your knowledge of that, the fact that you know so much more about this than the average MSP, how has, like, how has that been a wedge for you?

Like, are sales conversations with customers and prospects much easier than they were three years ago because of it? I kind of think they are. Uh, yeah. So not as much as you would expect though. So there's a lot more comfort because I know really well on where those lines are and where they're not, but it's still, so I, I finally broke down and hired my first sales guy and I've trained him. So talking wedges is, it's, you know, hey, this is Dustin from CGP.

I was wondering, you know, how much of a pain in the butt was your cyber insurance renewal this last year? Like, did it go up? Did you have a ton of paperwork and everybody, what are they gonna say? Yes. Right? Yeah. It's like, all right, what if we made that really easy? What if we made that a five minute conversation here? We're gonna put all the security in place, we're gonna help you fill it out.

And, you know, I can't guarantee what your rates are gonna do, but a lot of our customers, you know, it barely goes up, stays flat and immediately they're just like, oh yeah, stays flat Yeah. For MSPs, like that's all you gotta do. Yeah. And you're certainly in the top 1% because everybody's still kind of scared of it.

Um, so yeah, Gary, I mean there's a lot more I could sit here and rant and talk for another hour on it, but like, that's the nutshell of, like you said earlier, we're not talking about warranties. Gimme a warranty and I'll sell the hell outta that same concept. Um, it's the, I want to move my MRR higher, my seat price higher. We're doing deals 2 53 50 a seat. Um, my co-managed is almost 200 a seat in most cases right now. Um, and that's with zero help desk, right?

Because again, it's like we're security first we can do, Well, I wanna piggyback on that. Forget about warranty versus insurance. Inside out monitoring tells you when there's a compliance environment in the event Mm-Hmm. This machine does not have the security stack that should be on it in order for you to prevent cyber risk. That's a, that's a selling opportunity there. You, you need to be, you know, you need this control on this set of assets in order to be protected.

It, it provides these insights for you to have, you know, risk conversations that also increase your MRR. Yep. Andrew, I'll, I'll just work top of the hour. I'll close by saying you got a couple successful MSPs, you know, on here. It's not like, you know, they're both obviously secure.

I mean, we're having this conversation today 'cause they're out ahead of stuff, but they're both, you know, make security one of the most important things and they matured that aspect and they sell based, you know, based on it. So, um, I, I don't, I, I just met probably a hundred new MSPs last week and I, I don't know that I met one that is Thrive really thriving that can't say the same thing right now. Yeah, Yeah.

Well you heard, and Gary, you've said this many times, we've talked about this many times, sales and security are very aligned 'cause of command and you hear it from these two today. They have command of a business, they have command of risk conversations and it's awesome to see, um, you know, this type type of stuff. And, and appreciate Tim and Dustin coming on. Ryan, always awesome to see you.

I know we're gonna good job more of you, um, in the upcoming months and, and then Gary, I'm hoping that um, we can get Chris Garrett on next week. Yeah. Who, um, is phenomenal. He founded in info, um, site, right? Ryan Info. Yeah. And Ryan was, uh, involved in the initial acquisition of Info site and da and then obviously DA got acquired by Kaseya, but Chris is phenomenal so we're gonna try and get him here. He spent a number of years leading the US Air Force cert.

He's worked over 3000 incidents. Um, and what's awesome about Chris is you typically don't find someone with his technical chops who can also speak business very, very well. He's good. Um, so until then, Dustin, Ryan, Tim, thanks so much for coming on Wes, Gary, always awesome. See you and to our awesome audience. Um, thanks for everything guys, and wishing you a fantastic week. We'll look forward to next week with you all. Take care Everyone. Thanks Andrew. Great job everybody. Yeah. Awesome.