The Impact Risk Management has on Valuations

I can't do that. Hey Wes, I accidentally took us live, so we're with everybody. Oh, okay. Right on. Yeah. Too funny. It's like, uh, it's like family around here, so we're All good. It's welcome everyone. Let's see. I think Eric said he'd be getting on, so let me go find him. Hope everybody had a fantastic weekend. Hey guys. Yeah, exactly. We got bloopers. Andy. Um, Hey Louis. Welcome. Good weekend, Wes. Yeah, I had a good weekend. Uh, what all do we do? We did finally go to the beach.

We've been wanting to go back to the beach for a while. You know, it hits that time of year. You're like, why have we not gone to the beach yet? So, uh, we had a good time. Good, good. How about yourself? Which one Did you guys, which one did you guys go to and did, did this, Uh, this time, believe it or not, I hate to say it, we did clear water this time around. Oh. Um, just 'cause we knew we were gonna be there around dinner when we wanted to hit some, some food, uh, too, at the same time.

That's the only problem with our side of the beaches. There's not like a ton of restaurants on the beach outside of Clearwater and maybe Passa Grill. Yeah, yeah, yeah. Passa Grill is really nice. Mm-Hmm. For those of you that know the Clearwater St. Pete area, any beaches you guys prefer and My, my favorite beaches are, um, uh, let's see, Indian Shores, or Indian Rocks, sorry. Indian Rocks Beach. I really like Indian rocks 'cause it's more like relaxed and chill.

And then we like Honeymoon Island and, um, the ferry that you take over to, um, Csi. Yeah. Csi. Yep. We like that whole area. Causeway, getting onto it, all that. How about you? Cool. Well, I wanted to see if there's anybody out there that, uh, asked, been pulling the audience here if they know if, if any of those Oh yeah. Folks. Uh, but, uh, definitely more partial to like, uh, honeymoon Island and Yeah. That kind of honeymoons. Nice. Yeah, really nice. Um, Tim, Tim doesn't like the sand.

Too funny, Tim. Ah, so Joe used to live, live in Clearwater back in the eighties. Nice. Oh, very nice. It's a lot different now. I'll tell you that, That is for certain. Let's See. Hey, everybody, we, we, uh, had a faux pa. We went live, but, uh, it's kinda like, you know, this is what John Strand and team do by the way, before, I dunno if you ever watched their stuff, Wes, but they, it's Like a pre-show kind of thing. Yeah, yeah, yeah. Banter 15 minutes ahead of time.

We should maybe we just start doing that. Well, I think we can all agree to tease Gary for being late once again. Fair enough. Hey, while we're, while we're waiting, I just, I'll, you know, what I'll do is I'll show, show you this, Wes. Um, for those that haven't seen, it's really cool. I'm gonna share my screen, Uh, Chrome tab and I'll start get, I'll get all my dinging and doning off guys. Sorry about that. Can you, uh, can you See? Yep. Got it. Yeah, so it's really cool though.

So this is, um, so the MSP training, is it changing as I do it? So you can see all the sections wise? Yep. Yep. So, yeah, so we, I sent out the email. We almost have the group full we wanted to take, John wanted to take the first 100, uh, in this initial group. And then we're gonna do a few calls with this group of MSPs on feedback on what else he, you know, you'd like built into it. Um, awesome. So, yeah, he did a phenomenal job on, on this, mapping it to the controls.

Um, and then, um, we're, he's gonna pepper in live training, you know, 'cause it's a sub subscription. So he's gonna continually add based on feedback. Yep. And then he's gonna pepper in, um, uh, like the, the live, so like at write a boom, we had, you know, securing Office 365 and Azure, um, those types of, he's gonna bring his top, you know, team in every few months to do those specifically just for Nice. So it's really, really cool what he's doing.

Is the content primarily, uh, offensive based? No, it's not necessarily offensive at all, Wes. It's actually, uh, mapped to controls of Okay. CIS IG one IG two. And then on top of it, um, uh, respond and recover functions of NCSF. Because as we know, uh, Phyllis will talk about this, you know, they're, they're not strong in the respond to recover. 'cause obviously theirs is very prescriptive. Right. Um, um, so cool. Yes. We all know we're, we're live.

And he, uh, even though it was a, even though it was a, a misstep, uh, we're, we're pretending like this is what we do every time. Right? Yeah. Does anyone want to join and say hi for a little bit while we're waiting? Yeah, we got time. We'll bring on, bring in Eric on, let me see if I can find Josh. Let's see if Josh is out there. Hey, Eric. Hey. What's happening? Yeah, we, uh, I was sharing with everybody. I accidentally messed it up and, uh, took us live.

And, um, so it's, so, but this is like, um, this is, uh, SOP for, if you're like, on the John Strand calls, this is what they do. They first 15, 20 minutes, they, they're live, um, just talking amongst themselves, et cetera. So let me get off my dinging and doning all that fun stuff. Eric, how you doing? Good to see you again. I'm Doing well. How are you guys doing? Good. Good, good. I hear you might, uh, be busy with one or two, uh, MSPs these days.

Yeah, I got a couple things going on, you know. Um, all right. I'm, I've heard some fantastic stuff, so, uh, congrats to all the great work you're doing. Thank you. Oh, did I lose you? Nope. Got your video dropped though. Your video dropped. We hear you hear You. I wonder how that happened. A lot of strange things going on today. How do I get my video back? Hmm. I would refresh, refresh your, uh, browser.

Hey, there's Gary All, And Josh, if you're out there, let me know in chat and I'll pull you in. Hey Jerry. Um, you're welcome. I you can go grab some food. I just can't the thing's loud. That's the only reason. Okay. So, Andrew, can You hear me? Oh, yep. Yeah, yeah, we can hear you. I don't, I wonder why I'm not showing up. Like, yeah, that's what Eric just said. Can you hear me now, Andrew, or no? We can hear you. We can hear both of you. We just can't see you.

I don't even have the option for like the, I don't either. I Don't have an option for my camera. Let's see if, oh, hold on, hold on. Yeah, it's weird. It's toggled off there. You're, Ah, Cool. And then error. Try. I didn't do anything though, Huh? Well, I do know they were supposedly upgrading to their next version. I hope that's not the issue. Gary, can you, I dunno, refresh your browser and see if that does It. Now you're dark, Eric. Oh, it's Gary's. Yeah, I did that on purpose.

Hang on one second. Oh, okay. So you can see Gary's Internet's having an issue there he is. He is back. How about now, Gary? Uh, you hear me? Yeah, we hear you. Can't see I'm back. You want me to boot you and bring it? Bring it back. Alright. Josh, are you out there? Josh? There you are. Let's see. Let's see if we can get Josh actually to be on the screen. All right. I invited Jeff. Josh, you should be getting pulled up any moment. And then we're just in need of Ryan.

Is that my dinging and Don still? Or is that someone else's? It's not mine. Not mine. Okay. Still. So Josh is I, I'm gonna, I'm gonna kick Gary out and try to bring him back. Uh, Josh, I'm not sure. Hopefully you tested ahead of time. Uh, Let's boot Josh. We'll try to bring him back again. Let's see. There's Gary and I'm trying to bring Josh on. Hey, Alex. Great to see you. Great to see everybody one, welcome. All right. Josh is having issues. Josh, are you using Chrome?

You can chat, you can send some stuff in chat. You also, I sent you a link on testing your system. Uh, you're using Chrome. Josh might be better with audio only. Okay. He's using, we're trying to gain viewers here, not lose them. As you can tell, they're very good friends. Uh, any e-sign of Mr. Weeks? Nothing yet. All right. And then Josh, did you do the system test I sent you? Not really. Okay. Well, that'll all do it. Um, all right. He's using Chrome. Maybe tell him to try it in edge.

I, All right. Uh, let's see. And I'm just waiting for Ryan, and we'll get going while we're waiting. Uh, let's see. Few announcements, uh, in the, uh, call to action. There's a URL as I mentioned that was showing John Strand's, uh, MSP training before getting the, the feedback has been fantastic thus far. Um, he's got a few spots open for the first group that we're, he's gonna put through and do some, uh, one-on-one calls for feedback. And, um, I'm just closing a bunch of stuff here.

And Andrew, it looks like awesome stuff. I'd, I'd love to get access to it myself. Um, You're gonna have to pay lots. Do you know how pay double? Awesome. Do you know how it's gonna work? Is it gonna be, I think you said subscription based, is that right? Mm-Hmm. Okay. It's subscription. It's ridiculously low price. And then he's peppering in, like I said, his instructors every few months on some other top topics that, like, again, Azure and oh 365 securing Azure oh 3 6 5.

Gary will be in on, uh, some offensive, you know, pen testing. He's Oh, yeah. You know, yes. Big, big in the offensive community. I spent the weekend on that. Yeah. Speaking of weekend, I only Red and blue and purple. I'm, I now have a chartreuse team. You, you're like the charcuterie, if you will, of cybersecurity, aren't you? Yeah. Yeah. That's exactly what he is. Um, Gary, how did the wedding go? And it Was awesome. It was great wedding. My son and his now wife are very happy.

And, uh, so, you know, they, they, they wrote their own vows. Okay. And they were so beautiful that I could see a lot of the women that were there looking at their husband saying, why don't you love me like that? Wow. Wow. Very, very, very cool. Congrats to Gary Jr. Yeah. Now he's on his way. He's right. He's on a plane to Costa Rica right now. Oh, very cool. Costa Rica's awesome. Yeah. Did you call some people out, Gary?

Because I figured, you know, in, in, you know, honor of like, do things, you know? Yeah. I Did a speech I made, you know, people laugh. They cried. Yeah. Sounds like you were being I little Shy in front of people, but I Didn't. Yeah, I was gonna say, it sounds like you interviewing a new MSP and talking about their MRR. Yep. All right. All right. Well, Josh, I'm trying to get you back up again there. Um, alright. So I'll keep working with you. Try to get Josh on. Welcome everybody.

Uh, we are in year. Can you, I was thinking about today, year three of the cyber call. We're starting year three, which is Wow. Um, okay. Some things going on. Our, um, announcement wise, as I shared John Strand's training in the call to action tomorrow is, um, ninja one's, um, event. Uh, Wes, I think you're in that, aren't you? I will be on that one. Yeah, we're gonna be talking about IR and cyber insurance in my talk. It's gonna be really good. Very cool. Very cool.

And then I, John, I know Strand will be there. Gary, are you in that one at all? I am not. You're not in that one. Okay. Um, okay. And then in terms of, oh, next week, um, the CISOs will be on the hot seat, uh, with Jim Manco talking application security. Um, that should be a really, really good one. Josh. I'm gonna try again momentarily here to get you back. And, um, so let me kind of just set the stage. I'm gonna first put up a poll question in light of, oh, you should see the poll.

It's already up. If you could take a look and answer it. Um, so today is about, you know, um, risk management, right? And valuation, uh, the impact it has on valuations, um, in MSPs. Let's see if I, Josh is gone again. Okay. Let's see if I can get 'em again. Bear with me guys. Alright, let's try this again. Alright, so, um, if you think about it, right, there's not a industry event you go to, not a peer group. You attend, not a media outlet you pick up these days, right?

Gary and valuations and m and a is, is the, uh, is a topic. Gary, you still believe we're early I, if I, unless the last few months have changed your thinking, but even as of maybe like six months ago, you said we're in the early innings here. Yeah, a a, absolutely. It seems like there's been a lot of consolidation among MSPs, but if you really look at it, you know, relative to the number of MSPs, it's a really small number.

And even now that, you know, a bunch more, you know, venture and PE companies that come into the space, but it's still a pretty small number of those. Uh, and I think that is gonna continue to double and double again.

Um, so there is right now, like, just when I do some calculations in my head of the companies that I, that I know or work with, there is well over, I mean, there's billions of dollars of capital that hasn't been put to work yet with a B and, you know, regardless of economy or stock markets or interest rates, that money's gotta get put to work. So, um, yeah, we're gonna see a lot more of this in the next five to seven years. Got it. Yeah.

So that, that should be of interest to obviously all the MSPs out there. 'cause you're not in business, you know, again, there's always gotta be an exit strategy, unless, again, it's a lifestyle business and you love it and you just want to do it forever. But, but, but Gary, while we, I try to just maybe gimme a few more minutes trying to get Josh on, can you maybe just explain the numbers?

And what I mean by that is why is it that I, you know, if I'm a conglomerate MSP and I bought X amount of them so far, and I see this decent MSP over here and I'm buying it for seven times or whatever, why does it immediately give that uplift and how do they look? Yeah. Can you kind of walk us through the logic? Yeah. And, and then remind me, I wanna make more, one more point about why understanding this is important, even if you never plan to sell your MSP. Okay, Please.

So what happens is, uh, you start to acquire companies, right? And you try to put some value on them. And in the beginning, that value is based on you pay, at least for the kind of businesses that we're in, not software companies, right? But the kind of businesses that MSPs are in IT companies, it's some multiple of ebitda, which is basically cash flow with the cash flow of it is like any investment, you make some investment, you're gonna buy a house.

You have to, you know, pay a certain price for it that balances what the payment's gonna be. But as you start to do consolidation, as companies get bigger, uh, they have to buy more EBITDA to grow at the same rate. So they need to find larger assets, and there's fewer of them. So they tend to pay more. So if I'm a PE backed, um, equity company, and I sit on a couple boards, you know, you buy a company at seven x, but that's a million dollars of a year of ebitda.

If we have $50 million of ebitda, that 50 is already worth a 10 or 12. So there's an arbitrage there for you even start to grow sales or profitability, organic growth, which is all of the upside. And this is the reason why you see more and more MSPs not just making decisions based on valuation, but based on platform, because they wanna roll some of their deal into the bigger deal in hopes that if they rolled 25%, that that 25% is gonna be worth more than the 75%.

You know, we call that the second bite of the apple. So there's like, there's a different type of psychology, um, that, that is starting to emerge as MSPs become more sophisticated, understanding how, how the financial model works. Does that make sense? Yeah. Yeah. Absolutely. I appreciate you going over it. Okay. Um, Josh, I'm just gonna recommend maybe you reboot, try Chrome again. Let us know when you're in. We'll start off, um, and see if we can see if we can get you back in here.

But Listen, I, I told you not to Have 'em, but you didn't listen to me. All right, Eric. Um, welcome back to, uh, thank you. The cyber call. It's great to have you with us. Um, maybe just kind of, for those that don't know you, if you kind of lead in on your background, how, how does an attorney turn, you know, MSP owner, uh, and, and, you know, kind of give us a quick lay of the land of how you got to where you, you got to and why you didn't buy ConnectWise from me.

That's probably the most important thing I Wanna know. That's, that's a story for another day. But, uh, but no, thank you for having me again. I really appreciate it. I love, uh, I love being on, um, I like to tell people that I'm a, a recovering. Um, I, uh, I was about a year outta law school when a buddy of mine called me. He said he wanted to start a company and he needed some help. So this was sort of on the cusp of the.com bubble.

So I figured, you know, what the heck, I'll do it for a year and then, uh, I'll go do something else. And, uh, well, 13 years later, um, we had grown that company, um, to be about 250 people. Um, and we sold it in, uh, in July of 2011. And, uh, after we sold it, I became the, uh, the, the general counsel, which for, for the company that bought us with Logic, um, who's a huge global, $4 billion a year, um, IP organization.

Um, I became the general counsel, which means I, I led their legal department. Um, I was their chief risk officer. I was their head of information security and compliance. Um, did a lot of things for Logic. hollist did that for almost nine years, uh, before going out on my own. And, uh, and today, um, I am in practice for myself. I exclusively represent technology companies.

Um, and frankly, almost any company today is a technology company, but I really concentrate my practice in, in MSPs, VARs, systems integrators, IT resellers, um, as well as software companies, um, SaaS providers, things like that. Um, so, uh, so again, thank you for having me on. I'm looking forward to, uh, to sharing some things with, uh, with the audience. All right. Well, good deal, Gary.

Um, I'm gonna see if we can kind of do a, um, little bit of a, um, I guess, you know, shifting the deck here in hopes Josh gets in. Um, is there any chance that maybe you can, um, help me out here, um, to, you know, I, I'm gonna kind of ask you about Yeah, because again, you, you know, you obviously owned and sold an MSP then, and I remember working for you. Uh, well, I'm getting there. Hold on.

And then people, you know, were kind of calling you out, um, as you owned, you know, you were coaching probably eight, 900 MSPs at the time around that, you know, time. Eric was like 20, probably 20 12, 20 13. True methods has grown pretty much. And like, oh, Gary, you know, things are different, right? Cloud, you didn't have cloud, you didn't have, you know, again, it's always technology, right? It's different, Gary. So, but you didn't have those things.

You decided to, you know, invest and build a, you know, another MSP that was struggling. Um, what are the things, maybe the top things you've learned in, again, getting back in the business, selling it, and then obviously you've helped a lot of MSPs sell their businesses. What might be the top things that you've kind of taken away in this, uh, Over the past?

So, yeah, let me tell you what's the same, uh, with the first MSP as the second to the people I coach like two weeks ago at our peer groups like today, right? Right. The part that's the same as we're in a business that a piece of it, right?

Is professional services or technology, and there's people, and if you don't have a level of command, which is putting people into roles, having those roles mount up with, uh, and processed, um, aligned not just with your cost, but with the result you're trying to deliver, right? All the things we talk about here every single week, um, it's really hard. So that part's the same. The difference is the model is, so we have to do so much more, and we have so much, so much more kit, right?

Stack now that it's just much more difficult if you don't have some way to understand that. You hear me talk about command. So that's, that part's super important. The good part of what's different is it is much easier to sell today new recurring revenue at a higher price by far than ever in history. One, we have better prospects to sell to. Two, the prospects aren't deciding whether they should use an MSP.

They, we don't, we do not have to evangelize three, they have more technology, so they're more educated, uh, about it. So they're, they look at it more like an investment, like, you know, and they understand the risk they're in around security. So if you know how to do this, and we see it every day with top MSPs are pulling away, right? They're selling more recurring revenue at a higher price.

And a lot of it ties back, Andrew, to what, what we talk about here on the cyber call, and when we talk about acquisitions, looking at their risk profile, and part of that, you can tell from what they charge, you know, what they can and can't do, but you, there is a cost to acquiring risk. Like it will, it will impact, you know, your valuation. Got it.

So What, so I'm gonna continue here trying to get, uh, Josh, Gary, um, the third, uh, the fourth question kind of goes to, uh, Eric, it might be a good segue, um, for this in particular, if you take a look at that one over to Eric. Oh, okay. Yeah. So Eric, you have personally sold, you know, a very, what most people on this call would say is a very large MSP, right?

So you have process, you know, talk to us about how you're seeing valuations today, um, you know, positively or negatively impact moving forward. You know, in terms of some of the things we're talking about with, with, with risk and what people are charging and those type of things, how they're related. Yeah.

So, uh, you know, I think valuations today are, it, it's, it's tough to put a number on it because if you simply look at the financials of an msp, you put two of 'em side by side, they could have the same financials, but very different valuations. Um, I, I think valuations are high. Um, you know, given where things have been, especially for the right MSPs, I can tell you that in the past six months, two of my clients have, have sold their companies.

Um, one of 'em was kind of a bluebird opportunity where the, the, the purchaser came, came just out of the blue. But the other was a, a bidding situation. And it was a, a solid MSP. And this company had great recurring revenue, great long-term recurring revenue, great customers, been customers for 20 years.

And, you know, we shopped it to, to, gosh, probably five or six different potential acquirers and got five or six very, very different offers for the company that, that range from three x to, to eight x on on ebitda. And these are sophisticated organizations who are all looking at the same thing, but obviously looking at it differently or looking at differently based on their, their particular circumstance, right?

Obviously, if they're not particularly interested, then, then they're gonna bid lower. If it's in the geography they want, maybe they're gonna bid a little bit higher. Um, but, but really, I see valuations all over the board. And, and it does come down to, to the risk profile. You know, how much are they willing to pay, um, for what it is they're acquiring? Yeah.

So, and one of the things is, uh, Wes said they're, a lot of the companies still aren't as good as they need to be of even assessing risk. So I feel like sometimes they're overpaying because they don't understand that. And, you know, you go in, you look at their customer base, we talked about it last week, Andrew, did they even know that they may have risk in that customer base, like based on what's happening with CMMC? Like, because that's not something that might be in their due diligence.

And the MSP might not even be completely aware that they have, you know, some, some risk in there. You look at what their average seat price is, and if it's too low, obviously one that lowers valuations. 'cause it's hard to fix. Other things are inefficiencies are easy to fix, if you know how that one's harder to fix. But now it comes along with something else, which is, you know, they don't have a cybersecurity posture. That is what it needs to be today.

And that on top of, it's harder, uh, to fix. Like, that's heavy lifting. And you know, Eric, you, you know, you see it from that side because of your background, but, um, they're going to start to get educated, right? These equity companies, They are, and, and, and as an MSP, you have to look at what it is that you're selling, right? You're not, I don't care what anyone says, you're not selling your business, right? You're not selling your employees.

I mean, you know, despite what some dictators might say there, there's no indenture servitude. You can go work for whoever you wanna work for. You don't have to work for your, your employer for forever. You're not even selling your customers in the true sense of the word. Right? You can't go sell the Home Depot or General Motors. What are, what are you selling? And all you're selling are your agreements with your customers, your contracts with your customers.

The vast majority of MSP deals are asset sales as opposed to stock sales. You're just selling certain assets of your company, and that's where the value is, right? So you have to look at where your risk lies in those contracts. Who are the contracts with, and what do the contracts say? And, and to, to the second piece there, what do they say goes to, what's the genesis of your customer contract? Did you get it from Google? Did you get it from a member of your peer group?

Did you come up with it on your own? Um, did you get it from your insurance provider? Right? All of those things. If you're looking at the value of your company and trying to take risk out of the equation for potential acquirer, you really, really have to buckle down and look at your agreements with your customers, what you've gotta deliver, how you have to deliver it. Yeah.

So I'll, I'll, uh, I'll pass it over to Wes, but I'll say every decision you make about how to reduce your risk for a potential sale or how to increase your valuation, it also, every one of those decision lowers, it impacts you like a great company to sell all the factors that make it great to sell, when really valuable. It also makes it great to keep Wes, I'll hand it a to you, my Friend. So, yeah, I, I have so many thoughts on all of this.

Um, so for those of you that don't know, I happen to sell a company to a top 10 PE company in the world, and I have experience in, uh, m and a, even in perch serving m and a acquisition deals, dropping perch into, um, uh, certain companies before the acquisition was done. And I'm, I'm just shocked. I'm shocked by the, the low level of due diligence. It's done across the board. And I think there's a lot of reasons for this that are going to one day rear its ugly head.

One is an assumption of, oh, well, if they have a breach, then we'll have, we have a clawback. And so we'll just claw back the out of the damages from the acquisition. No, you won't. It's not that easy is Eric, you know, placing an understanding where that threat and proving that it happened before the breach is oftentimes impossible. And so there's I reactions there. Have money, Wes? What's that? I already spent the money. Yeah, well, they'll go, come find it. Uh, yes, they will.

The other thing too, I think is so challenging is, um, we have the wrong people asking the questions. Like, uh, I see way too many people that lead due diligence that sort of just go off a questionnaire and they're acting, they're either paralegals or they're just people that like, that's their job is to do m and a, but they're not security practitioners. And so they're asking all the wrong questions.

If you've ever gone through an audit where you're just going through a box checker audit, sometimes due diligence, Eric is like that, isn't it? Like they're just, they're, they're asking the wrong questions and they're getting feedback where I just say, oh, not available, not available, not available. And they're like, oh, okay. Well, they said not available. Just move on. And you're missing critical things. I mean, Eric, this is a huge problem, isn't it? It's, it's a huge problem.

And, and, and you're right. You, you, you said it, they're box checkers, right? And, and even sophisticated m and a attorneys on, on one side of the table or the other, they don't understand the business. They don't understand the risk in the business, and they're relying on the business owner, whether it's the acquirer or the seller to, to help guide them there. And if they're not asking the right questions, they're never gonna get to the right answer. Yeah.

And where I think this gets compounded, Gary, I know you see this too, is we, we often use this word frothy, like it becomes a really frothy market where there's a lot of like desire to go grow by acquisition. And I saw this in banking, and we're seeing, oh, it looks like we got Josh. Well, miracles never cease. Yeah. Oh, Josh. So, uh, it, we, where we see Eric, some of this desire to like grow is in the banking world, we call it growth by Denovo, right?

Like banks learned, you know what, we really are terrible at like putting a new branch into a brand new location and then just growing it organically. It doesn't work that way. They're like, it's much easier for us to go pay a premium for a bank that's already there, and then just can just rebrand them and build them up.

And we're seeing exactly that happen in the MSP space to a, where they're like, you know what, if we wanna get out to like Mayfield, Kentucky, why don't we just go buy an MSP out there instead of trying to build out there? Like, that is the easiest growth path to acquisition. And so sometimes we sort of like sider some of the things we might normally do if we're building it ourselves to grow that way. Right?

And so, Eric, a question for you is, if I'm an MSP business owner, and I'm thinking about this, I'm like, okay, I wanna sell in five to 10 years, Mm-Hmm. What should I be thinking about? What should I be doing? What should I be concerned with? Yeah.

And, and, and that's a great question, Wes, because you know, and, and you know, Josh and I were talking a week or two ago, and, and he, he threw out the static, I forget the exact number, but the, the, the percentage of MSPs that are owned by people who are 50 years or older, right? So people who in the, in the next five or 10 years will be in the mark, likely will be in the market of, of selling their company. And, and, and Josh, what was that number?

Well, look, it's a, it's a bit anecdotal, but, uh, my, my guess is that 70% of MSP owners are north of 50 now, right? So, so hundred Percent are exhausted. Exactly. So 70% odds are out of the bus, out of the business, not out of business, but out of the business, you know, in, in the next five to 10 years. So, so when do you start preparing? Do you start preparing six months from now or six months before, or a year before? No, I think you prepare now.

Um, and, and, and you think about just the little things, right? Let's say that you, you prepare now by starting to get all your ducks in a row. And, and I use, you know, a an example that's near and dear to my heart, and that's getting your contracts in order, right? If today you get your contracts in order, and you've got a customer base of a hundred or 200 or a thousand different customers, it doesn't mean that tomorrow all your customers are gonna start using your new contracts, right?

You're, you're gonna have to wait and you're gonna have to come up with some method or methodology, and it might literally take years before you can cycle through all of your customers to get them on the, the latest and greatest agreements. Um, and, and then when you start digging even deeper into your customer base to come up with what are the true risk factors, um, in my business, and, and maybe today it's CMMC, maybe tomorrow it's something else.

If you're not thinking about it as an MSP owner who is going to be selling, then you're doing yourself a disservice. And at the end of the day, by doing yourself a disservice, all it, it's, is money, right? It's just gonna cost you money.

And Go ahead, Gary, or, uh, I just ask a question on, on your question there, Eric, just like percentage wise, you know, and when you work with a new MSP, when you look at their security controls, what they're supposed to deliver, what percent are vague, where, you know, if, if something happened, you know, Ty goes to the runner, it's, you know, the business owner or, you know, defense attorney is gonna be the one in charge on this.

So over the past year or so, I've looked at about 50 different five zero different MSP contracts and, and almost always my first engagement is to look at their MSA right? Or their terms and conditions, whatever they call their, their governing document with their customers. And they've all been bad. Every single one of them has been bad.

I think that there may be three or four of the 50 or so that haven't been so bad that we haven't started from scratch, let alone just changing and tweaking what was there. Um, and, and, and it goes back to my comments earlier, you know, where did these agreements come from? Um, you know, who, where did they, where did the business owners get them? Right? Well, I think we know the answer to that, right? Yeah, we do.

I'm, I'm shut gonna go back to you, but Gary, you remember like in 2 0 5, when the RMM platforms are starting to gain steam, what was the, like the number one question you would get right after someone like, oh, I learned about this RMM, do you remember what the number one question was? No. Hey, this MSP thing's really cool. Does anybody have an agreement? Oh, yeah, I've been asked that question. A I'm going to estimate a hundred thousand times.

Like having the right agreement was gonna be the thing. It was gonna be the difference between success and failure, right? But, But, but, but you simplified it really well in true methods. I remember there was three things, but I, again, I, I'm just chuckling isn't the right adjective, but it's just to your point, Eric, is I, I, I'm, I remember a lot how a lot of people got their agreements.

It wasn't really, you know, but again, We weren't, back then, we weren't living with the risks that were living with today. It was an apple in an orange mm-Hmm. You know, compared to how it is today. And when we slip in a question for Josh, since he's on now. Yeah. Do you, so you want Wes to finish up, Bob? Yeah. Well, yeah. I, I don't, I don't want interrupt him. Yeah.

Let me ask maybe one more question, and then I can, we can flip it over to, to Ryan, who I think has the majority of questions for Josh. So, you know, one thing I will highly encourage you to do if you're an M Ms P, be prepared for m and a and act like it's gonna happen because you can't predict with the next 1, 2, 3, 4, 5 years are gonna look like you might fall into serious health issues.

Maybe you have this aligned as like a family business and your kids don't want to take it over, uh, may, maybe disaster strikes in ways you could never have imagined. When you find yourself cash strapped like never before, and m and a all of a sudden becomes advantageous, you have to just wisdom as a business owner, you have to act like that's in a window of possibility. And that's why Eric, what you said earlier, I think is right on the money.

Like, we, we have to act that way and assume that that's a legit possibility whether we want it to or not, because every company, even the big ones here, right, that are on this call today on video, it happens. And so we have to be ready for it. It all, like, that was a huge lesson learned I had at a perch. You just have to be ready for it. Right? So, like Eric, um, talk to me a little bit more about that.

Like, if you're, like, if you're in those shoes as an M Ms P and you're like, no, I'm no plans to do it. What are some of those things they should be doing anyway no matter what? Yeah, it's, it's, it's making sure, I was gonna say, making sure your agreements with your customers are good, making sure you have agreements with your customers.

Um, you know, I can't tell you you how many times I'll, I'll, I'll get involved with a new customer, and while they might have an msa, maybe they just do everything else in a handshake. Um, and it happens and it happens more often than I think anyone realizes. Um, so, so it's, it's getting agreements in place, getting decent agreements in place, getting long-term agreements in place.

Um, it was a real eye-opener for me going to the last acquisition I did with one of my, one of my clients where, um, you know, she was fortunate in that she really spent a lot of time over the past six to nine months revamping our contracts, getting people signed up from month to month to three year contracts.

Um, because when we start talking to the, these organizations who are going to be making the offers they place, absolutely, they ascribe no value to a one year contract, let alone a month to month contract, right? A one year contract is meaningless to an acquirer, at least the ones that we were speaking with. Um, and, and even with a three year contract, they were getting upset because, oh, well, some of 'em were gonna expire in 19 months.

Well, okay, fine, I can't give you all brand new three year contracts starting tomorrow. But so, so it's doing the best you can to, to get that in place, making sure that, that your agreements with your customers can be assigned. Um, can they be transferred to an acquiring company? And then finally, just making sure they're good, right?

Making sure that you have the proper terms in place, making sure you're indemnities and warranties and liability caps and all the other stuff that, that, as lawyers we talk about all the time, that, that kind of go right over most people's heads, making sure they're solid. Because when you get into due diligence, the acquiring company will look at those, right? And if they see risk there, they are not going to pay top dollar for your organization, period.

And, and like I said before, do it now, because if you don't do it now, even if you sell in two years, you're still not gonna be completely rolled out as if you started five years before. Yeah. That, That's solid gold. Andrew, that's a clip right there. Uh, that's solid gold. Uh, Ryan, I'm gonna flip to you. Uh, so you, and, and Josh can have some good time to chat as well, but, uh, Eric, really, really good. And, and that's legal advice, isn't it? No, it's not.

So, Josh, when you're looking at a potential acquisition, how does the security maturity weigh into the decision Making process? Well, you know, first of all, apologies for the technical issues, uh, and, and arriving late. Um, I wanna make a, a comment just, uh, just on this last exchange. I think the advice is, is really from a legal standpoint, and otherwise run your business the right way.

Not because you're going to sell it, but because it's a good idea to run your business the right way, right? Whether you sell or not, risk is real. We're carrying risk in a bunch of different forms, right? Eric just went through a lot of legal risk. Uh, it's a huge part of what we look at.

Uh, you know, and when I say we, you know, I, I wear a bunch of different hats, uh, but I've, uh, you know, within the last couple of years, been a part of five acquisitions, and we're looking for good businesses. We pay top dollar for good businesses.

Um, it's very important for MSP owners, whether they go to market or not, but especially if they are, to make sure that your ducks are in a row so that people like me, when we evaluate, you know, once we've evaluated ebitda, uh, and we start thinking about the multiple that we're gonna use to value your business, that we don't start marking you down, uh, for, uh, poor contracts marking you down for poor terms, marking you down for misaligned packaging and pricing.

Uh, all that sloppiness that the MSP owners and the audience know exists in their business. Um, I wanna say this in a way that doesn't sound so predatory, but I'm looking for it. And not because I don't want to pay the most I can possibly pay for a business, but once you've made a decision as an acquirer to, to buy a business, everything else is risk management.

How do we make sure that the business that we think we're buying performs the way we expect it to perform over the next 3, 4, 5, 6 years? And, and it's all these little, you know, all these little things crossing the t's, dotting the i's so, so on the issue of, uh, of cyber risk, um, you know, there are, there are a lot of different types of risk in a business, right? We're looking for client churn, employee churn, you know, market competitive, uh, competition issues, things like that.

Cyber risk is one of those things that's, uh, you know, uh, an existential threat, uh, to an MSP and to an acquirer, right? I mean, the worst possible outcome for us in a transaction is that we close today and tomorrow there's a breach, right? Actually, the worst thing is probably 90 days down the road when we've made enough internal changes so that we're clearly responsible, uh, for the, uh, you know, for the breach. Yeah. That's the worst situation.

It's Marriott, Starwood all over again, right? Yep. Um, let's, let's rewind. Can you Introduce yourself? Yeah, thanks, Ryan. Why, so who you are and what you do. And So, so, I'm, I'm Dr. Kotler. I'm a former MSP owner who built an MSP between 1998 and 2019 in Miami and Tampa, uh, about a six and a half million dollars MSP 30, 32 employees, uh, to the point we made earlier. Uh, at the beginning of 2019, I had zero plans of selling my MSP. Gary knows my history.

He knows the arc that we were on, the, the success we were having from a business maturity standpoint, a profitability standpoint. We were really dialed in. So I had no thought about selling. And, uh, you know, what happens when you have a good business that you don't wanna sell, people wanna buy it.

And I started getting calls from, from, uh, some private equity groups that were looking for a platform from, uh, consolidators that were already active in the space, and ultimately, uh, you know, worked out a deal with Compass MSP in, uh, late 2019. Since 2019, I've worked with Compass MSP in a variety of roles, but what I've really focused on is m and a. So developing and leading the, the strategy for building the company, uh, scale through through acquisition recently.

Um, I have left as a full-time employee, uh, or as an employee period of Compass, MSP, and I'm working with them on a contract basis to continue to drive buy-side, uh, activity for Compass MSP. Um, that's in a pretty narrow geography. Um, beyond that or outside of that geography, uh, I've started, uh, an m and a consultancy, Samson Street, uh, partners that is dedicated to helping MSP owners exit in the right way, right?

Making sure that whether they do it this year or next year in five years, uh, that they execute, uh, a transaction that really does change their life. So that's what I'm doing now. Thanks. Yeah, that's, that's an awesome background. Um, so you've, you've assessed a lot of MSP's security programs and, and, You know, I've looked at hundreds of MSPs. Yeah. And Have you ever said no to acquiring an MS P based off of their security posture? You know, I mean, it's a combination of things.

I, I guess the answer would be yes, technically, although, you know, if, if we run into a business that's aligned from a packaging and pricing standpoint, culture standpoint, we feel like there's a good opportunity. Uh, we get into some pre LOI or letter of, uh, interest, uh, uh, diligence, um, and we start looking at all these areas of risk we've talked about, we might find an MSP that, that has cyber risk that hasn't adequately addressed it, but has really good contracts.

I know, Eric, that's the, uh, uh, unlikely three Years, Right? It doesn't, it doesn't happen that way, uh, a lot, but it does. And we may, you know, assess that in a short amount of time, we can sort of clean up the cyber risk. We've got good contracts that will offer us some protection, but, um, you know, things have changed in the last two and a half years. Two and a half years ago, we didn't really look at it much. We really didn't.

We, you know, we sort of accepted the idea that there was this big a pile of risk in this dark corner, and no one really wanted to look at it, because guess what? It was in our business too. And we felt like we hadn't adequately dealt with that Since then, uh, I think our, our security posture at Compass, uh, has been much more professionalized.

And as we've gotten into the risk, you know, as we've seen sort of where the, uh, the landmines are, we've started to look for that, uh, in our diligence process. So yeah, the short, short answer is absolutely, if it's a mess, that's a deal that's not gonna happen. Yeah.

I think maybe if I could put words in your mouth, it's generally not the only reason, but generally, if you have, don't have your security house in order, it's probably an indication that there's other fundamental structural problems with the business as well, right? Yeah.

And, and look, I think we are getting to the point as we have more and more, uh, breaches that, uh, that, that are more, uh, sort of below the waterline hits, um, that, that we're starting to look at it as a standalone area as a go no go. Uh, you know, part of our, our risk management or due diligence process, it's, uh, it's an indication that you're not serving your clients very well, right? If, if you don't care enough to button up security for your clients before you sell. Yeah.

So you said when you look at it as a standalone area, gimme some meat on that bone. What, what do you look at? What do you actually doing when you do that diligence? You know, so it starts with the, uh, uh, the, the basic alignment work that we do around packaging and pricing. So when I talk about packaging, you know, what is the outcome that, that the MSP is selling to its customers, right? And then that outcome has a lot of different components, right?

So, uh, the tool stack is a place we look, right, which tools are being deployed on every seat as part of the standard engagement with their customers. Then of course, we look to see whether they're executing, uh, on that stack, um, or whether it's, uh, you know, just a check on a, uh, on a checklist. Um, the, uh, you know, we're, we're looking for any, uh, past breaches, right?

Uh, we require that our sellers sign some pretty, uh, carefully crafted documents about what's actually gone on, what they're representing. This is part of something broadly known as reps and warranties representation. We wanna make sure that our sellers are repping to everything that might have happened and that they, they are aware of that might happen, uh, as we go into a transaction. Because again, we're trying to protect our investment.

So, Ryan, to that question, so we had, uh, Gary brought on two MSPs that you know, well, Josh, Keith Bartol, and Miles Keo, who are excellent MSPs run top businesses, been coached by Gary for years. Both of them are advocates that they are client, we call it client zero. Yeah. Right. Uh, does that play at all in, 'cause you, you're talking at looking at their stack and what they're delivering to their clients. Do you ask, well, are you client zero in some way, shape, or form?

I'm not probably familiar with the expression or the term client. Zero to, to answer that directly. Maybe gimme just a little background. Yeah. Gary, you wanna Yeah, go ahead, Ryan. The security program that you would put on your customers you have implemented for yourself, got, like, you, like it's the cobbler's kids scenario, but you actually take care of your kids first. Yeah. So, so that, uh, right.

We, we are the weak link, uh, in our m ms p in most cases, uh, because we're staffed MSPs or staffed with people that kind of know how to circumvent some of this stuff. And we'll do so if they think it's convenient, uh, unfortunately. Uh, so we look for maturity in their, in their process, uh, and their execution, uh, around that. Yeah. We wanna make sure those tools are turned on them. Uh, the process is turned on them for sure. What was that word did you say? Process. Process? I don't know.

Am I supposed to say, say process or process here? Oh, Processes. I'll take processes. That's fine. Okay. Processes. Yeah. Ryan, I, um, so I'm on the m and a committee, right? Mm-Hmm. For on the board, for the company, the compass. And for me, the, the quick things that I like to check for, obviously, what is their average seat price, what's their average MRR, like, what, what, how, what size customers are they dealing with?

And then I wanna look at their org chart and match it up to see are they set up from a service delivery standpoint in a way that's even capable of delivering process in it. And if the answer is no, it doesn't mean you flush 'em down the toilet, but it means you factor that in. 'cause there's some things now that they can solve. Yeah. Like they have a great, you know, maturity program and there's other things based on that are harder to change and fix with customers.

So, but it does affect the more work you have to do to get that acquisition where it needs to be Josh, right? That costs money that affects valuations, Right? Work equals risk or, or the requirement for work equals risk, right? There's a gap. And that gap will cost MSP owners money as it should every time. So I wanna tie together a conversation from last week. I'm sorry, I'm just gonna totally off script again, second week in a row. You can't, can't hold me down.

Um, we talked last week about benchmarking spend on security primarily from like an SMD perspective, but let's say, you know, you have a certain A RRC and you're a certain like, maturity customer. Are you looking at how that revenue translates into the investment in the security program of the MSP in themselves? Like, are you, are you saying like, oh, you should be spending at least one, you know, anywhere from one to 5% of revenue to protect yourself? Like do you have a benchmark like that?

Uh, we don't have a benchmark, uh, uh, per se for that, but we are, we are looking, uh, for that spend. Sometimes that becomes a conversation, uh, as we're working with the seller to determine what EBITDA is or isn't, right? EBITDA, I believe is a fact, but it's a fact that requires a lot of input and, uh, you know, a lot of conversation to arrive at, um, investing.

It's a fact that buyers and sellers don't agree on You're, I mean, you're even, In fact, you're right, It could be incredibly high because you're under investing in security. It could be. Absolutely. It also could be that re EBITDA's a little low because you have, uh, spent a lot of money and, and time catching up to the, to the current state of, uh, uh, of the art, right? Yeah.

So, And we, and we can have a whole nother conversation, a whole nother call on adjusted EBITDA and, and, and what that looks like. Yeah, Leave me off of that one. I feel, I feel the same way. I feel about EBITDA as I do averages. I feel like it lies and you need more context and more facts around it. But, um, but yeah, I mean, so, so thanks for that. Do, do you do any technical assessments? Like are you pen testing? Are you doing threat hunting engagements?

Are you, you, are you, you know, are you, are you bringing in third parties to, to help, you know, vet your own diligence? Talk, talk to me about that. Like, if I was an MSP and I was like, yeah, I've never really thought about selling my business before. I wonder what it entails from the security side outside of your, your standard questions. What else should they expect in terms of, um, kind of assessments. So yeah, we'll do everything.

We do everything we can to, to validate what we're being told. Um, you know, running pen tests and doing sort of unauthorized, uh, uh, work to, uh, determine whether or not a particular safeguard is in place is not something we do. There's just too much liability associated with something like that. Um, but we'll go as far as we can go with the active participation of the seller. The seller doesn't want to damage their business either, right?

This is, uh, That's where the representations come in, right? That's absolutely, that's a way to, so you threw that word out there. I wasn't gonna go there, but representations are actually really critical during deal, close process. Can you just maybe give sure, two, three sentences on what representations are and why they're important? So, so when an acquirer works with a seller to, to put together a deal, um, we're focused on the seller's MSP, right?

Who knows everything about the, the seller's, MSP, the seller, not the acquirer, right? So we have to find ways to sort of fill that gap and get people comfortable about the things that we don't know. And we do that through representations and, and warranties, right? So if we ask, um, let's just take one that's not really related to security at all, but, uh, that I think we'll be clear. Are there any unpaid taxes? Right?

We don't know that as an acquirer, we don't know enough about the business to determine Josh. That's a real example, by the way. Yes. Well, it's a real example. Um, the, uh, you know, when we asked that question, the seller in this real example, knew that they would have to represent that all the taxes hadn't in fact been paid. And to their credit, they disclosed that there were some that hadn't. Right?

But had we gone in that transaction, uh, closed it and six months down the line, got a letter from the IRS, guess what that representation that you made as a seller, that the taxes have been paid is, is your responsibility. That's a legally binding document. And whatever it takes to make things right with the IRS is on the seller, not on the acquirer.

So, reps and warranties are how we sort of, uh, fill in those gaps, uh, in our risk management program between what we can clearly see for ourselves and what only the seller knows. So let's say I represent that I have no material deficiencies in my security program, and then the deal hasn't closed, and I suffer a Security breach. I think Eric probably gonna have a stroke here. He doesn't even like the suggestion of that language. Don't rep. Yeah.

Because like I said before, reps and warranties don't work well in the world of like, post-incident. When did it, when did it occur? How do we know? How do we have evidence for it? Because a lot of acquired companies, right, simply don't have the data.

So, Look, that that's an area that, uh, uh, I suggest any seller who's, who's going through the process, work very carefully with their lawyers on, uh, only, you know, consider a, a, a third party audit and consider making that audit the sole basis for any, uh, reps and warranties around security. Uh, it, it is, it's a, it's a bit of a, you know, black box, and it's really hard to, uh, sort it out.

Look, no one goes into an acquisition wanting to pull out reps and warranties and throw 'em on the table, right? But no one wants to lose 7, 8, 10, $15 million either. So we're talking about real money with real stakes, and, you know, you have to prepare the right way legally, uh, you know, in your process, in your execution. It's, uh, just too much on the line.

Josh, We're talking a lot about MSPs being acquired, but we know a lot of MSPs that are, you know, 3, 4, 5, 6, $7 million MSPs that are looking to acquire other MSPs. Yes. Now you gotta be really careful because they're usually buying smaller, less sophisticated companies, and they're less sophisticated in under, they know the business, but they don't really aren't educated in all the things we're talking about today.

So I feel like there's a lot more risk in that relationship too, as you're, you know, you're a sole proprietor or what, you know, m solely owned MSP tr trying to, uh, uh, to grow through acquisition. So one of the things I'm doing is working with MSPs, like you described, you know, 30, 40, 60 employee MSPs that want some scale maybe before they go to market, maybe just to make their businesses better, and, and they're gonna buy those two and $3 million MSPs.

Um, you have to, you know, this is where the lawyers become so important, right? Because you can't, can you say that again? What's That? Can you say that again? The thing about the lawyers is that they're so important in a process. You Never usually hear those two words in the same sentence, right? Yeah. Look, it is, uh, anyone who's acquiring anyone who's taking good, you know, hard earned cash and pushing it across the table for an asset, uh, is, is doing.

So, uh, you know, in a, in a, it's a very risky process. You've gotta manage the risk. The less mature the business, the more risk you're gonna find. One of the reasons that, that we like, and I don't think this is a secret to anyone, when I say we, I mean compass in this case that we like true methods businesses, is we know that the level of maturity at any level is going to be better than what you find in the market, uh, significantly better. Um, yeah.

It, it's, uh, by the way, uh, going all the way back to the beginning of the conversation, this is a great way for MSP owners who are thinking about preparing their business for sale, uh, to, to get their heads around the, the topic. Imagine you are buying a business, right? Think about the risk that you'd be looking for, um, and, and how you'd like to sort of tie that risk down. Oh, I thought you were suggesting that the cyber call become a brokerage. That, I'm sorry, Joshua. Not a bad idea.

We Will give you a rock solid cybersecurity assessment. I can guarantee you That. Yeah, yeah, exactly. Ryan, you got a few more? Should we turn it back to Gary in the beginning? If you do, that's fine. Gary had some in the beginning for Josh, so I just wanna make sure we get that. And Eric there while Ryan looks, any comments? 'cause I, I, I, I saw your wheels turning on a few things, uh, over the last few questions.

Yeah, I mean, look, it's, uh, legal stuff aside, if, if you're gonna be selling a business, um, make sure it looks good and, and, and, and looks good from the, the security side looks good, from the legal side, looks good from every aspect, and this goes back to the diligence checklist, right? People think that, oh, you know, someone's gonna come by my company, they're gonna ask me 20 questions, I'm gonna give 'em the answer, and they're gonna make me an offer.

Well, it's not exactly how it works, right? That they, they, they dig deep and if everything looks good, if you're prepared, if, if your financials look nice, forget about what they say. But if they look nice, right? It's, it's going to give the perception that, that you're more prepared, that you're more sophisticated, and I think you're gonna get higher valuations if you give everything to someone with a nice, neat little bow tie on top of it.

Um, so, so again, it's, it's the, you know, the, the Boy Scout motto. Be prepared, um, but be prepared across every aspect of it, including all the things that maybe you haven't thought about before.

So the, the other to the point, the risk management checklist, guys, if you, Eric's got one he's gonna send out if you, I'll put his email in again, if you want his risk management checklist, Due diligence checklist Due, sorry, due diligence checklist, uh, subject would be due diligence, uh, or yeah, due diligence. Gary. Gary, go ahead. So Josh, sorry, Josh, you were gonna say something to my Apologies. Well, yeah, I was just gonna make a quick comment.

Uh, you know, Eric's right, the, the, the more that you can package and present, uh, in a, you know, professional way, uh, the better off you'll be, one of the little wrinkles there is that, you know, due diligence is hard. It involves hundreds and hundreds of areas of inquiry. If a business comes to me and it's really well packaged and presented, I might, I might not go to a, a couple of places that I would otherwise go to my detriment, right?

So don't give people to a reason to look in that corner, especially if you don't want 'em to look in that corner. Yeah. And, and Right at all, I, I've seen, I, I looked at the financials. A friend asked me to look at his financials for these reasons, thinking about what do you want to do? And the $12 million MSP, and it was frightening. And I'm like, dude, in step one, you gotta go get your chart of accounts in order. Like, I can't make hener tale of this.

Don't, don't embarrass yourself by showing anybody this. Mm-Hmm. And, and it's a good business, you know, um, decent business. He gets his metrics in other ways, but his actual financials didn't, didn't have his arms around him. So, uh, Josh, it's great to have you, man. You, you hear me teasing Josh a little bit. And because, um, we go back a long way and, uh, we're, we're, we're very good friends.

Um, Josh probably has as much perspective and command, uh, about the MSP business as, as anybody out there, um, you know, today. So the first question I wanted to ask you, Josh, every single week I'm talking about how we go to how we commercialize security, right? We talked about it at our peer meetings, uh, two weeks ago.

So when you look at a company and you look at security, tell us how you look at how they take it to market, how they package it, how they talk to their, you know, how they talk to their customers and what that tells you about how they're gonna be able to deliver it. Yeah, I mean, I think we're, um, you know, we're, we're looking for aligned MSPs, right? That are serving the same market that we're serving.

So just for context out there, uh, we're serving, uh, the SMB space, particularly the sort of mid to upper end of the SMB space, that's compass, right? So we're looking for businesses that can serve that space, right? With the appropriate tools, the appropriate, uh, solutions and the appropriate people, right? That they've got the right staff to carry those conversations. Um, when we see a, uh, a well run security practice inside of an MSP, right?

We're looking for, yeah, the tool set's important. The process is important, right? What happens with, with tickets that are generated by these tools? What is the relationship between the, uh, you know, the third party soc if, uh, if it's a third party and the, you know, the help desk, what are the, uh, you know, you know, what's the process around that? And then we want to go and we wanna say, what kind of conversations are they having with their customers?

Are these basic conversations designed to get $25 per user per month out of a customer who's just freaked out about security or they higher level conversations where real business risk is being targeted, right, examined, targeted, and, and addressed, right?

When we see that, we know we're dealing with a different, uh, provider, and even if they're serving the smaller end of our market, uh, maybe small to mid, we know that those people can grow into the upper end, which is a little more lucrative. Yeah. Uh, so again, helps us evaluate whether the business we're buying today will be the same or better going forward.

And the last thing I wanted to, because we getting to the top of the hour, is talk about, you know, you deal with so many MSPs, and I'm always telling everyone, whether you're a buyer, a seller, or never want to buy or sell, you need to be aware of everything that's happening with m and a because your world is changing, your competition is changing. Talk to the kind of advice you give to those MSPs that you talk to and you realize they shouldn't sell. They're not ready.

Talk about some of the advice you'd give them and, and how you explain the world that they're living in now. So one, uh, there's, there's one term that I'd like to see more MSP owners get their heads around and, uh, used as a, as a touchdown for every business decision they make going forward. That's something we didn't talk about five years ago, and that's enterprise value, right? A lot of MSP owners kind of look at their MSP as a cash flow machine, right? I'm just trying to flow cash here.

I'm just trying to maximize cash from month to month to month, uh, instead of thinking about the enterprise value that they're building in the business, right? And that has a lot to do with what are you gonna be worth when you go to market, right? Uh, so start thinking about, uh, making longer term investments with some confidence because it will immediately and then forever impact enterprise value.

Um, think about, uh, think beyond the transaction, the day-to-day, closing tickets, signing up some Nuer, uh, and, and think toward how can I create a business that is more and more attractive to upstream buyers? Because it, at the end of the day, 95% of the folks out there are gonna sell their business, right? And Josh, and think about this. We talked about this, uh, recently as business owners. Everything that we make and want to take outta that business is at ordinary income.

We're paying the maximum amount of state and federal taxes. It is a huge headwind. When we grow our enter, we make the right investments, and we grow the enterprise value of our company, we pay no tax right now on that appreciation, like that appreciation is tax free, and eventually when we monetize it, we're gonna pay long-term capital gains. So the, the impact that has I is, is massive. And so that's one metric, right?

We've added, uh, absolutely to true methods, um, benchmarking is that enterprise. I'm, I'm glad you made the point because, you know, I can talk all day about what it takes to move a multiple from 5.7 times to say 7.2. Well, tax strategy can do twice that in one quick move. So definitely a good point, right?

Why pay, uh, you know, regular income tax, uh, on, on your cash flow when you can transfer that into, uh, long-term enterprise value that you're gonna pay 20% on or less, I always say, listen, I'm happy to pay taxes later. Right, right. Eventually. Fantastic. Hey, um, so Eric, closing words from you. Uh, thank you for coming. Uh, any thoughts, final thoughts?

Yeah, look, my only final thought is, you know, and, and, and Josh talked a little bit about the process, um, of, of m and a and that is a little bit of preliminary due diligence, then getting to the letter of, of intent or the interest or whatever we're gonna call it. Um, that ba that's a baseline, right? And, and it's a baseline, assuming everything is within normal limits, that number never goes up, right? It can only go down. Um, at least Josh, I hope you'd agree with me on that.

And, and it goes down when all the stuff that we've talked about isn't in place, right? So just because you get the $5 million offer on paper doesn't make it a $5 million offer when it comes to closing. So everything's gotta be in order, um, or at least within the normal limits of order to, uh, to get to what you think you're worth. Awesome. So, um, one, one announcement then, Josh, I'll thank you.

And, and everybody on here, one announcement next week, Jim Manco moderating the CISO panel, uh, with Ryan, uh, uh, Patrick from ConnectWise, uh, David McKibbon from the Naval, and then Jason from Kase. Please show up. Here's why I'm saying this. We have a level, in my opinion, of apathy right now, because since the July 4th incident incident in a year ago, relatively not much has happened.

This is gonna be the same group where we'll have a thousand, 1500 people live should an event happen and everybody's throwing stones. So show up next week, ask good questions. Let Jim bring those to the attention. I'll be with him helping out. But please, uh, ask your peers, ask everybody to show up so that you actually have a voice. Don't wait, and then kind of say, oh, you know, you start pointing fingers. We're doing this for you to ask those tough questions.

So anyway, um, on behalf of Gary West, Ryan, Josh, thanks so much and look forward to having you back on. Uh, I really appreciate everybody's contribution is always, uh, wonderful having you back. Until then, we'll see you guys next week right here. Take care. Thanks everyone.