MSP to MSSP – hear the real world journey!

Welcome everyone. We are at session 98 of the Cyber Call, two away from the big 100. Uh, welcome. Uh, here on the show we've got Wes Spencer Ryan Weeks, and, uh, Gary Pico. It's good to have the co-hosts all back together. Um, no more vacation this summer to eat anybody. Um, kidding. I know. Ryan, you're gonna have some coming up here. Um, before I introduce our guests, I'm really excited about today.

This is a really, um, kind a, a neat one because if you've been in this space a long time, you probably know of these gentlemen or know of their companies. And, um, so we're gonna hear about their journey because this is truly a MSP to MSSP journey, um, not a make believe one. Um, and, uh, let's just, uh, get right on into a few announcements.

Uh, one, uh, in the call to action, we're gonna do the first ask John, anything, John Strand, MSP training, even if you're not using it, you're welcome to join us on Friday at 1:00 PM Eastern to learn a little more about what we're doing out there. Um, the, uh, URL is in that description. Um, Gary, I'm sorry.

Uh, Wes and Tim, I just, before we jump in, wanted to get your take, Tim, starting with you as our guest, Tim Weber, um, which I'll introduce you momentarily, but talk about, talk to us about it Nation Secure, what your, what, what the vibe was, what your thoughts were. We had a lot of, there was a lot of people there. Yeah, Andrew, I was, um, I was blown away. You know, I've been in this space for, we'll just call it a long time, and, uh, had an opportunity to go to a lot of events.

And, um, the, the level, the level of participation, the level of engagement, and, and I think probably the most telling thing for me was is, is the day two keynotes seem to be busier than the day one keynote, you know, and that that kind of goes No, no, sadly, you know, I only had a video part, so no. That they had a retired FBI agent talking about espionage. And, um, but no, it's, it was, it was great.

I mean, it was, it was such a contrast from last year's Secure where they were, you know, kind of in a rate limited mode and hybrid and things like that, that it was, uh, it felt like events were back, you know, it was probably the best way to get it. And, and, you know, obviously for us, with our announcement happening last week, you know, it was already, um, you know, already a bit of a whirlwind, but overall, the event, you know, the event was phenomenal.

You know, you know, hats off to the entire, you know, Jason McGee and, you know, everyone at ConnectWise for, for pulling off an amazing event. Yeah, absolutely. And it was good seeing Eric Wood, uh, seeing this folks out there, Eric Woodard, Keith, let's recap Andrew, huh? One SCH Fest, two write a boom, Three fill in There. There's an ongoing, uh, uh, needling here, Tim, when people come on and go, wow, write a boom was the best event we've ever been to.

Gary's always the second best event, of course. And, uh, Everyone I talked to said that they had a great, uh, great, both vendors and attendees. Uh, had a great, uh, week last week at Secure. Yeah, It Was, it, it, it was awesome. Um, it, you can't beat, uh, right a boom though, Andrew. It, it takes, uh, center stage is the king I, I have to say. But, uh, yeah, it was great. I think, Tim, you nailed it.

Like everyone was back into like, go mode of like conference conferences and so because of that, there was like a ton of announcements happening as well. Like, you see Adam Slatkin's group sort of rebranding into Cyber Fox and what they're doing in identity management. Um, I was there on, you know, representing the Fifth Wall side and what all they're doing is gonna be a game changer for MSPs in terms of like how they handle insurance policies for their clients.

Uh, looking at, um, a ton of like really big announcements, obviously, like Tim and Scott, what you guys are doing is huge, which we're gonna talk about today. It just seemed like everywhere I'm looking, like some big news was dropping or big things were happening, and I love seeing that kind of like, energy in, uh, in the channel for sure. It was great. It's really, oh, and my favorite talk, Robert Chioffi. Oh my gosh, that was great. He Was great. Uh, oh my gosh.

That talk, I mean, I think every vendor should be required listening to hear Robert Chioffi talk. It's just so good. Yeah. Or e even though Eric Woodard didn't speak. Oh yeah, he's out there. You know, either one of them. Robert was awesome, uh, as well. Um, both of those guys, what they've been through and what they've been able to accomplish since, uh, being a Buffalo jump is, is just tremendous. Alright. It, it, it, I'll say that, that is so impactful.

Um, we have, uh, someone who was a peer member who same situation and they request it to be interviewed at our last peer meeting. Wes, same effect. Everyone left that session, you know, different than how they, how they came. Yeah. Really good stuff. Alright, so, um, setting the stage just real quick, um, as I mentioned, had the good fortune to have some amazing relationships in this industry. Scott Putnam, I consider you one of 'em, and it's been a pleasure to know you all these years.

I think about 15, 16 of them now, Tim, probably about a half a decade plus. Um, we're gonna learn today about your journey. Um, you know, not to be cliche, but you hear a lot of MSP, Tom, Ms. PSP talk or an MSSP, and we can call ourselves whatever we want.

Um, but one thing that caught my ear, and we'll probably talk more about it today, was, um, and Gary, you're, you're, you rang in my ear when, when I've heard the companies that are really the furthest along in security, I was talking to Scott and he's like, you know, we saw the writing on the wall about 5, 6, 7 years ago, and that's when we started. And it's like, wow. You know, the, the companies that are really hitting stride right now, it's not, it's not that they just started this journey.

This has been going on for a long, long, long time. Lots of hours, lots of mistakes, lots of resources, lots of money. So that's what we're gonna, we're gonna learn about today. So, um, Scott Tim, welcome Scott, starting off, um, just real quick, yourself, your background. Uh, welcome to the show, Scott Putnam. Sure, thanks so much. Hey, Andrew, it's great to be here and great to be with all of these kind of, uh, leaders in our industry. So excited to be on.

Yeah, I'll tell you, so Apex started in 91, and I actually wasn't the founder. I came on in 95, young high school student, and it's just, uh, four employees at the time. And, um, was just kind of at that point transitioning into, uh, I, I think they called it scheduled maintenance, you know, proactive scheduled maintenance, which was kind of the precursor to managed services. Uh, in 2001, I had the opportunity to take over as president and CEO of the organization.

And really that was the very, very early days of talking about managed services and, uh, started kind of pushing the organization in that direction and, and started very aggressively moving towards reoccurring managed services. And from the earliest days, our clients, uh, just a lot because of where we're at. Were right in California, far, far northern California and, uh, rural area. So a lot of government and a lot of healthcare type services.

And so a lot of our services, uh, were very highly regulated customers. So, um, dealing with customers, you know, in the government space, in the healthcare space, banking in those sorts of things. And, uh, so we kind of have been somewhat in security, you know, our, through our entire path. But like you said, about seven years ago, um, we really saw a, a huge need to pivot towards more advanced security services.

Really started realizing that it was a different whole different game than managed services. And that it required kind of different skill sets, different people, different tools. And so we started building that out. And then, um, sometime around the end of 20 19, 1 of my good friends, Scott Young approached me and he was friend from HTG Peer group and someone who I just really, really respect runs a company outta Houston.

And he told me about this guy named Mitch Morgan, who just had this crazy, seemed like a hair-brained idea to put together some of the best managed service providers in the industry, allow them to continue to run pretty much autonomously under their existing brands and companies, but, uh, be able to have greater resources behind them to do more things, shared resources, to be able to build some really, um, specific type of services like advanced security services, um, and, and give business owners the opportunity to take some chips off the table while still staying, uh, invested in the game and have both the upside and some ability to enjoy some of what they've created now.

So I talked to Mitch and, uh, love the idea at the beginning of 2020. March, 2020 became one of the four founding companies of new charter technologies. Um, timing turned out to be perfect. It was, I think we closed like a week before the entire country shut down. And so having, uh, you know, that kind of security blanket of greater resources behind us was fantastic.

Um, and then since then, you know, really the, the whole idea, um, has become just, it, it, it's shown its strength and as we've built this security company, being able to really build something that we can now leverage across 20 MSPs that are now part of new charter and growing very rapidly. So that's been, you know, kind of our journey. And, um, new charter's been a phenomenal part of it.

And somewhere along the way, we bought, brought on this incredible company called AdNet that also had their own advanced security division. And I'll let you know, Tim, talk a little bit about that. Thanks, Scott. So, um, yeah, I've, uh, AdNet goes back also to 1991. Uh, I actually started with AdNet in 1994, so please don't do the math on that. Wes, um, you know, traditional M mss, MSP doing MSP things, yay, Novell, um, you know, and, and everything that came with it.

And, you know, moved into a leadership role, ran service management groups for pushing 20 years, um, started doing security probably the mid 2010s, 20 14, 20 15. Um, but it was one of those things where, you know, we were, we were doing it, we were kind of halfway doing it. Um, you know, it was, it was done through some compliance angles 'cause we had a strong partnership with a, um, with a, a regional accounting firm as well.

Um, but in late 2017, early 2018, uh, Chris Louisa, the CEO of AdNet approached me and said, yeah, I think for us to do security right, you know, we're gonna need to spin it off into be its own separate business unit, dedicated leadership, um, you know, you know, with an intent, you know, all along of actually spinning it off into its own company. You know, you divesting it from AdNet for, for brand reasons and, and a number of other aspects. So, um, uh, July of 2018, you know, we, we did that.

It was myself and, uh, Eric Manda, who is, uh, on the call with us today as well. Um, you know, who, you know, between the two of us, we, you know, we did a lot of stuff and started to grow over the years. And then last August, um, uh, AdNet became part of New Charter.

And, and for me, we were, you know, a little bit later in the process, but when I saw some, some of the other MSPs, you know, such as contact out in New Orleans and, and most certainly, uh, Graystone outta Colorado, um, that gave me a lot of excitement. 'cause those were organizations that I had worked with throughout the channel and, and Peter, Peter Melby, Darryl Dekin, um, you know, these, these were people who I had a lot of respect for.

So, you know, I was, you know, kind of over overjoyed, you know, when I heard that we were gonna become part of this and, and to start to meet Scott and the team out in Redding, um, you know, the, the synergies and, and really the exact way that we looked at things was almost, it was almost identical. Um, you know, we had, you know, some, maybe some different skill sets. You know, they were focused a bit more on the managed services side.

We were focused a bit more on the professional services side. Um, but that's actually allowed us to do some really, really cool things right out of the gate. So, um, you know, new charter's a little bit like drinking out of a fire hose. Um, because every time I turn around I'm like, who's that? Oh, there are a new operating company. Oh, who's that? Um, but, um, yeah, the, the opportunity brings us, us, you know, is, is just tremendous.

So I'm, I'm incredibly excited for, for what we can do and the opportunities that it brings, brings together our team, you know, brings for our teams. Awesome. So Wes, the floor is yours. Take it away. Let's get into what this whole spinoff is about. Yeah, for sure. So, um, love what you guys are doing, right? I've been following you from, I would not even say afar, Scott, sort of like pretty closely. And, um, love the journey.

I love how you guys are not just becoming a model for, um, good MSP and now MSSP practice, but you guys are always giving back. Like I'm, it's never that I'm not at a conference and I don't see like Pete Melby or somebody speak to him. I've seen you on keynote stages being interviewed, like you guys are everywhere, and you've always been open to sort of share where you've been, where you're going. And every time I meet new charter folks, um, I just fall in love, like to just great people.

And so I, I love what you guys are doing, deep respect for all that. So tell us a little bit more, Scott, about Cyber 74, tell us about the name for it. And, um, I, I'm assuming this has been probably a ways in the making. So like what led up, like what were the key things to get there to get Cyber 74 off off the ground? Yeah. Yeah, it's definitely been, uh, a lot of work. We've had a phenomenal team putting everything together.

Um, as far as the name goes, that's kind of the first question everyone asks is what's 74 all about? Why 74? 74 is the atomic element for tungsten, which happens to be the hardest metal, the hardest material on Earth, hardest naturally occurring material on Earth. And so we really wanted to speak to the, the hardness, the toughness of the security that we provide, and really trying to bring something to the next level. And so, um, we call it, uh, the toughest element in cybersecurity Cyber 74.

And, you know, again, the quest, the name is really designed to kind of prompt that question and open up a conversation about that. Um, and just as far as the process goes, you know, we came into this with, um, two companies that had phenomenal advanced cybersecurity divisions that we had been building each for about five years.

So, AdNet having mock blue defense, which was, uh, becoming really well known in the MSP space for supporting a lot of other MSPs with incident response and things like that. And then Apex had digital umbrella, which was becoming really well known, especially in the municipal government space for providing, uh, services for them.

And as we began talking to all of our new charter partners and really wanted to elevate this to the next level, we realized that, uh, for our new charter partners, you know, digital Umbrella was Apex, this advanced cybersecurity division. And M Blue Defense was Ad Net's, uh, advanced cybersecurity division. So we really wanted to create something that was new charter's, advanced cybersecurity division, and that would be owned by everyone.

And so, uh, we came up with Cyber 74 and, um, have a phenomenal marketing team behind us at New Charter who have helped us with the name and the branding and all of that. And so, yeah, it's been a really, uh, fun process. A lot of work for sure. So, okay, this is real. So I'm going right off script here. Uh, I just have to ask this question.

It's, it's gotta be extremely difficult, Scott, when you have all these different companies that are coming together, they've been doing things their own way, own Tech stacks, their own go-to markets, their own individual practices in terms of like the industries and locations they serve. How in the heck do you merge that into one cohesive strategy like you guys have done? What are the secrets to that you've gotta share? Absolutely.

I mean, the secret is all in the people who come in the door, right? It's, um, really, really amazing people who, everyone respects everyone else around the table and really humble people. So, you know, when we get together in a partner group, it's like everyone is just in awe of the people around them at the table and saying, man, I have so much to learn from all of these guys, and they all feel the same way in return.

And so as a result, I think we just realized that, um, you know, the, the whole is greater than the sum of the parts. As we all put our ideas forward, the best ideas will rise to the top. Um, the difference between our model and kind of the typical PE model, we usually end up at kind of the same sp place.

We all end up kind of coming to the same decision, but rather than someone saying, uh, here's what you're going to do, follow it, or, you know, you have no choice, um, versus saying, here's what we think we should do, what do you guys think? And ultimately, we, we come to the same decision because there's a lot of smart people around the table. Okay. So we talked about this a lot. Go ahead, Tim. Sorry.

Yeah, I would equ that Wes a lot to, to, it's like evolve, you know, which, you know, in, in the end, you know, we, you know, ad net's been a part of, I still call it H two G, sorry, you know, since like 2007, 2008. And I had opportunity to, to do some owners meetings and service manager and group meetings. And I got so much out of that.

And, and what I see in this new charter world is it's exactly the same, but it's even that much more important because in the end, we're all the same entity, even though we all have our own individual identities doing our own thing, it's, it's being able to leverage the, the collective wisdom of the group that helps us all accelerate.

So, So what I'm hearing is that thread, and it's something we've talked about quite a bit on the cyber call, is that, um, the quality of character trumps technical aptitude every single day, because I can train and get people up to where they need to be. And there's a myriad of ways we can do that, even with what John Strand is doing, for example, that he's given so much time.

So, um, Tim, share with me a little bit of like, what do you look for in, in that talent and how do you decipher it, right? Like what, where have you guys been successful in that journey? I, I, I mean, I, I think it's, it's all about a attitude. You know, you know, one of my favorite quotes, you know, herb Kelleher, former, you know, the deceased, you know, CEO of Southwest, you know, train, you know, hire for attitude, train for skill.

Um, now obviously that's, you know, you have to have some skills. You, you know, because we can't, you know, we can't take somebody right off the street and do this, but I, I will take passion and communication skills over technical skills every day of the week and twice on Sundays. So, um, you know, we're fortunate in that we, we started with, you know, an incredibly strong team and they're reaching into their networks to bring in other people.

You know, one of, I think, Scott, our first non acquisition hire was, you know, was Brian, who was a web pen, a pen tester that worked with one of our existing pen testing guys, and the guy's a rockstar, you know, so it's, you know, we, we continue to leverage that.

And, you know, we also get the, the air cover that the, the national new Charter organization provides us, where we have an entire recruiting team, you know, and one of the benefits of the pandemic is, is now, you know, this work from anywhere model, we're not necessarily limited to, to the metro Hartford area or Northern California is, is we can bring talent in and have brought talent in, I think, uh, six, seven states where we have, you know, current, current cyber 74 employees.

So, Can Wes, can I throw something in real quick? Scott, can you talk to me off camera about this? But I, you just gotta say this. 'cause I thought it was so amazing. I was asking him, Wes, about talent, you know, and finding talent, and he's like, you know, we look, you know, we find some amazing people, but they're just not quite there. But what we do is we want to give them training resources and keep in touch with them, help them get their skill level better.

And, and then when they're starting to get some aptitude and we see they're committed to learning, we'll hire 'em. Scott can do I got it about right. I mean, I, I, this, I was like, wow, that's pretty awesome. Yeah, absolutely. Well, I mean, I think e everyone in the industry kind of realize in the cybersecurity industry realizes there's a huge shortage of talented cybersecurity people. Um, there's no shortage of people who want to go into cybersecurity.

There's just a, a shortage of people who have those, those skills. And so when you find someone who's passionate and who has a desire to get into the industry, I really feel like we all have an obligation to, to the industry and to those people to help them, uh, get into the industry if they're really passionate about it, and help them get the skills that they need.

And, and for us, just selfishly speaking, you know, if they've got the right personality, they've got the right, um, you know, character traits that we're looking for, then we want it, have them join our team, and we wanna get them up to speed. So, yeah, I mean, I think what you and I were talking about was this incredible program that John Stran has and trying to, um, get more of these candidates into that program. We'll pay for it because it's really inexpensive, very reasonable for it.

Get them the skills that they need, and then they can come back to us, you know, six months later after they've done some of that training. And now maybe they are a fit for us, and hopefully they'll be loyal to us because we've provided that training for them. So, um, yeah, I, I, I think we've gotta think creatively as an industry because, um, frankly, you know, the way that we're training people right now just isn't keeping up with the demand. Very cool. I, the, the lessons learned, right?

We talked significantly last week. If you guys are listening today and you didn't go to listen to last week, go listen to that. 'cause we dove deep into Scott. A lot of that wisdom you're sharing there. So, um, Scott, I wanna read you one of my favorite quotes, somebody named, uh, Booker t Washington, who's, uh, definitely a hero, I think of myself and probably a lot of people.

And he said this, he said, success is to be measured not so much by the position one has reached in life, but by the obstacles by which he has overcome while trying to succeed. I love that quote. Uh, talk to me about what you foresee as some major obstacles over this next year.

Yeah, well, certainly what we were just talking about, I mean, finding talent is right now, you know, one of the greatest obstacles, um, the reality is that, uh, you know, the people who really have a lot of experience, and, and let's face it, I mean, the, the industry as a defined cybersecurity industry is still pretty new.

So, you know, when people are asking for, you know, 15, 20 years of experience, and the industry has only been called that for 15 years, uh, you know, it's, it's difficult to find those people. So, uh, finding talented people is, um, definitely, you know, probably our biggest challenge and keeping up with just the demand. Um, beyond that, you know, it's, we're, we've always gotta be kind of looking over our shoulders at what the attackers are doing, right?

I mean, now as the offenders, we're getting actively attacked. We've gotta protect our, our own house. We've gotta protect all of our new charter partners. We've gotta protect all of our customers and just keeping up with the, the constant change in the type of attacks.

And, um, you know, one of the things that, uh, is becoming, um, more and more true, I think is an attacker doesn't even necessarily have to succeed any longer in breaching an organization to really have a significant impact on, on that reputation's the, the reputation of that organization. Um, all they have to do is create the appearance that they have, you know, breached an organization and that can really, uh, kill that organization's reputation.

So now we're not only defending against real attacks, but we're defending against all the misinformation campaigns and stuff out there that that could drag either ourselves or one of our customers through, um, you know, reputational health. So we're trying to avoid that. So those are some of the challenges. But I, I would say definitely keeping up with the talent war is number one. Indeed it is. My last question, Tim goes to you, my friend, so everyone knows you, right?

Like you, I see everywhere, right? Uh, you definitely are becoming that, that cyber evangelist role. Do you foresee that, um, continuing through what you're doing at Cyber 74, and talk to us just a little bit about how you guys use your thought leadership in this, uh, in this adventure? You guys are going on. Thanks, Wes. Yeah, it's, um, absolutely, it's gonna continue. That's actually gonna be a big piece of my role in, you know, in my role as VP of channel growth.

You know, I'm kind of tasked with a few things, you know, one is, is to help all the operating companies, you know, with the positioning, the selling of cybersecurity, you know, the educating their markets, but it's also to be very active in the industry community. Um, you know, I, I've, I've had the great fortune, you know, and I, and I view it that way, of being able to participate in so many events and make so many connections.

I mean, you and I met last year when, you know, I sat in 12 hours of, you know, rehearsals for a five minute keynote presentation that I did. Um, you know, I I Detect a little shade there and I don't blame you. Nah. It's all, it's all good. It was actually, it was, honestly, it was, it was great. 'cause it was, it was fun to hear some unscripted ConnectWise people. Um, for me, partnership is about going both ways, you know?

So if there's things that I can do to help the industry community, I'm going to do it. Ironically, I never read Go Giver until earlier this year, and I recognize, yeah, I've been doing that for a decade. Um, I like talking about things that I'm passionate about.

And I think that those of us that are, that are in this space, that know these things and are comfortable, you know, with, you know, with being that in that evangelist role, um, we actually have a duty, you know, an obligation to share that. You know, I will, as, as a number of you on this call, will, will, can attest, I'll talk to any group about cybersecurity for any period of time because I believe in it that much.

Y you know, and, and if I can share something that helps an organization or helps an individual avoid a problem or work through something or better tailor their solution, um, the community's better for it. You know? Now that all being said, this isn't a hundred percent altruistic. You know, we do have visions of, of creating a channel program outside of New Charter, you know, for other MSPs to, to sell Cyber 74 services.

You know, you know, we had a long history of doing that at Advent, a lot of success with that. Um, and we'll look to continue to replicate that. So, so there certainly is, you know, some self-motivation in there. But, but for me, it's really about, you know, I want people to understand what this is all about and if I've learned something the hard way, you know, I wanna be able to share that.

'cause I've learned so much from other people in this community that anything I can give back, I want to. So, Love it. Such good advice and glad to have you here. Uh, Tim, you're so needed in this space, Ryan. Thanks. So, uh, for Tim, when you're in a position where you get to speak to other MSPs, when you, when you talk to them, what surprises you about where they are in their cyber resilience, uh, cybersecurity maturity journey, and what doesn't surprise you?

And, you know, I guess second part of that question is like, what advice do you give someone that's trying to make the type of leap that, that AdNet has made towards A-M-S-S-P cybersecurity oriented service company? Yes, thanks, Ryan. So, I mean, I think that what, what doesn't surprise me is that the industry gets it, you know, I have yet to come across an MSP that it's like, eh, security, I don't need to worry about that. You, you know, so, so that's, that's good.

'cause that, that would be a big flaming problem. Um, what does surprise me, and I got a question kind of in this regards, you know, after a presentation I did about selling cybersecurity last week, is, is I don't think there's a chunk of MSPs that still understand exactly what it takes to get into this space to be able to sell what I would consider advanced security.

You know, the, you know, the question came up, you know, um, you know, after presentation I did with Peter about, you know, came up with the rates that we charge, and, and somebody's like, well, what do you guys do for that?

'cause I wanna be able to charge $300 an hour, you know, plus, and, and to me, you know, we answered the question nicely, actually had a great testimonial from another m ms P in that, which was completely unscripted, but awesome, nonetheless, is, is it, is, it misses the point to me that if you're going to get into security, you have to want to do it, and you have to want to do it for the right reasons.

Um, yes, it is a business, yes, it's, it can be a profitable business, but it's, it's borderline of calling, in my opinion, because when you do security, you have to, you have to do it, and you have to be all in to whatever limit you want to take. And I think that's the, that's always the biggest thing that I, that I say to other MSPs is, is that you have to decide what you're going to do and how much you're willing to invest to get there.

Um, you know, I was very fortunate working for, you know, working for Chris Louise who, you know, allowed us to make an investment and to, and to make that, you know, to make that leap. But it wasn't insignificant, you know, and it, and it becomes, it's a totally different mindset, and, and you also can't wing it.

You know, I, I see, you know, I see some MSPs and being in my existence, you know, the, the, you know, Jason Slagel had in his, uh, presentation last week, the $99 pen test, you know, gimme a fricking break. You, you know, to do this stuff and to do it well, you have to be able to charge for it. And to be able to charge for it, you have to have people that are qualified, capable, and the processes and the technologies to, you know, to back that up.

So, you know, to me, an MSP, you know, they have to be in the security space, but then they have to decide how much it are they gonna do themselves versus, you know, who are they gonna partner with, you know, or how much do they want to partner with? Because that's an area that I think we can bring to the table is, is if somebody doesn't want to do, you know, advanced assessments or, you know, incident response, okay, you know, we'd be happy to partner with 'em.

That's one of the reasons why we, you know, broke off into a separate organization. So, Tim, just to, before Ryan goes back, so back to the $99 pen test, you're not a believer in the, in the two to three day SOC two either. I have, I have feelings on that. We'll just leave it at that. Okay. That's great. Um, so you talked about, you know, it needing to be a calling people. That's one piece You also use processing technology. So let, let's stick with you on this question.

I get this question all the time from MSPs. What should my stack be? What security tool should I get next? And for anybody that's been listening for a while, they know that my first answer is always to tell them, look at what you currently have. Try to understand if it's operating well, if there are other capabilities you can enable, look at your people and your processes before you add more tools.

How do you think about people and process and your ability to deliver your solutions successfully? So I'm gonna, I'm gonna use a quote that somebody on this call, uh, who may or may not have worked in my organization said, which is, is a, a fool with a tool is still a fool. So it becomes something that it's, it's not about the technology that you have, it's about the people in the process. The reality is, is the technology continues to leapfrog itself.

It's about making that, making those pieces applicable for organizations. And to make 'em applicable, you have to understand what risk is. You know, a core part of my presentation last week was, is that risk is a business discussion, not a technical discussion. And, and to be able to do that, you have to understand it.

You have to have the education, you have to understand the markets that you're in, the compliance requirements, and then what does solution A or solution B, you know, bring to the table? Obviously I work with a number of partners that, you know, vendor partners that have been great and very instrumental in my career, but that's third on the list, you know, in the people process and technology.

It starts with the people aspect, because you have to have incredibly smart people who can, who can kind of bridge those two worlds. They have to be able to, to, to understand it and help organizations understand it. It's not, it's not just about being a geek who can talk about, you know, what ports are open or this, that, and the other thing. You have to be able to make it real for people. So You got, you got our, you got a little clip there for Andrew for that, that quote there.

That's a good, that'll be a good clip. It is. It's, it's, uh, it reminds, Tim's thing reminded me of, there's this great, uh, YouTube video of Sunil, uh, doing an RSA presentation. And I, if you guys remember that, where he talks about the shelfware and he, he just, you know, asks the group, you know, about shelfware and what do they see the biggest shelfware?

And it just really kind of goes back to your point, Tim, of how much, you know, people spend, these organizations spend millions upon millions of dollars. Uh, you know, because obviously he's enterprise, but how much of it becomes shelfware? Yeah.

Well, and I think, I, I think the big challenge is as an overall industry, we do a lousy job be because there's, you know, I, I see ConnectWise has really started to pivot towards that and give them a lot of credit for it, but there's very few other organizations out there that are selling anything more than technology, you know, and as a result, it becomes a, it becomes an arms race. And again, the technology's good, but it's just, it's just one, it's just one pillar out of the three.

And Considering bad guys have engineered around most of it. Exactly. Yeah, exactly. I mean, it's, it's an arms race. Well, and the other thing, anyone who does incident response will tell you, you know, when you get into these, quite oftentimes, the customer that, that's been breached, they had all the tools, they had all the alerts that were telling them that this was going on, uh, but there was no one watching those tools.

And so, you know, now you've just documented the fact that someone broke into your network. And that's good. It's better to have documentation of it, or, or worse yet, sometimes, you know, you've got the tools that should have documented all of that and audited it, but they didn't turn on the auditing and they didn't turn on the log. So, um, yeah. You know, very often people have the tools they need, they just don't have the people to set up and manage those tools correctly.

Well, they don't have the time. I, I mean, and, and that's where I think the, you know, the, the opportunity for organizations such as Cyber 74, there's never been a better time for this, because even organizations that have IT teams, you know, anybody met an organization whose it team's looking for more stuff to do? No. You know, you throw, you know, you throw, you know, you throw more stuff on their plate, something's gonna fall off. So that's, you know, that's what we bring to the table.

And, you know, other organizations like us out there where I think we're, I'd like to think we're gonna help be able to make a difference, you know, and that's, honestly, that's a big part of what drives me. Cool. So I'm gonna, I'm gonna pivot over to Scott for this next one. So when you're, especially when you're first starting out building a security program, one of the, one of the things we hear a lot is, oh, do I build, do I buy or do I partner?

Um, and so, you know, when you were kind of building this out, what was the importance of partnering in gaining the maturity that, that you've ultimately gained? And, you know, can you share some examples or give us some challenges, uh, along the way that you, that you encountered there? Yeah, absolutely. I mean, I think, you know, as in any area of technology, you know, cybersecurity is just so broad and so deep there. There's so much that no one can do it all alone.

I mean, I think partnership is really necessary, and particularly as we try to scale, um, there's just no way that we could scale the way that we're trying to at New Charter without bringing in partners. Um, at the same time, we're trying to revolutionize the way that cybersecurity is done in our segment of the industry. We really feel like the SMB market, by and large, has not handled, uh, cybersecurity, um, very well. And so we're trying to change that.

And you don't completely revolutionize the way something is done just by relying on, on partners or reselling someone else's services. So what we've really tried to do is, um, find the combination of that. And where we've really been most successful is finding great partners. ConnectWise has definitely been one of them, uh, who are willing to kind of flex with us and scale with us and understand that we don't want to just resell their products and services.

Um, we want to partner together to build something new and something that that's better. And so the, the best partners out there have kind of allowed us to say, you know what? We'll be, uh, really elastic with you, and, uh, as you grow and outstrip your capabilities, we'll go ahead and, and give you access to, you know, our soc and our team and, uh, additional incident responders and that sort of thing.

And then as you build your own capabilities, we'll just pivot those resources to, you know, what you need next. Um, so we've, we've worked with some really great flexible partners who have assisted us with that. You know, things also like incident response, I think of, um, digital forensics and incident response. It really has to be very flexible, because on any given day, you might only need, you know, one or two dedicated defer people.

But, um, you know, if something major hits the fan, obviously you've gotta be able to bring in significant resources. And I think the way that we, we, as an industry can do that is really forming great relationships and partnerships where, um, you know, we've got some resources, others have some resources, and we will, uh, share those resources as necessary when, when there's a significant demand. Hey, uh, Ryan, just a quick question to Scott.

I'll have him clarify what West Boggs, uh, been in the industry forever too. Um, down in Florida. Remember Rory Sanchez, he was with Rory for years of SL powers. And, but, uh, so he, but he, he's, no, I, he's with a different firm, but he says, Hey, how are you differentiating yourself from perch, rocket, cyber Highwire Networks?

My answer was, you know, that's just a product, you know, so, but I didn't wanna put words in your mouth, but I figured you could answer it since you were kind of on this question of build by partner. Yeah, absolutely. I think, um, well, first of all, hi Wes. It's great to see you that Wes and I have been, I think Wes was actually one of the original people who kind of helped me shepherd the way and managed her this way back in the early, uh, two thousands.

But, um, yeah, so we really view this as a security program. If you look at how enterprise companies talk about cybersecurity, you know, they don't talk about products. They don't talk about, you know, just, uh, processes or anything. It's, it's a comprehensive, unified program, and there's gotta be someone running the program. There's gotta be risk analysis to identify all your risks.

There's gotta be a process to either accept, mitigate, transfer, your risks, and all of these, uh, things, you know, have to be done as a pro program that includes people, processes, and technology. And so, you know, perch is one awesome example of one part of that program. You know, I mean, having, having a soc and a SIM tool and, um, having that implemented is important.

And, you know, we've, we've worked a lot, not on Perch specifically, but with ConnectWise as soc on Sentinel One particularly, and, and backing up our own SOC with Sentinel One. Um, but just understanding that you can put all of the individual pieces into place and you'll still be missing kind of the mortar that ties them all together.

Uh, and so that's where we really, uh, play with our clients is coming in and, um, providing both all of those individual components, all of the pillars, but the mortar that ties it all together, because in cybersecurity, it's really, uh, the correlation game. It's about having all of these tools, all of these people, all of these processes that all work together, uh, to, you know, close all of the gaps.

Um, 'cause as we all know, all the attackers need is to find one gap between the tools that you need and therein. So, Ryan, back to you. Yeah, so I was just gonna go all the way back to the top. You had said, um, you saw the writing on the wall back in 2015, um, and it's taken you seven years to get to where you are. Do you think it's too late for other MSPs that are just now seeing the writing on the wall? And what advice do you have for them? I mean, I'd say it's, it's not too late.

I'd just say that, um, they need to get up to speed probably very quickly. And there's no way, from my experience to just get yourself up to speed in a year's timeframe. I mean, this is a journey. It's a difficult journey. There is a lot of learning. Um, there are a lot of things that we thought we knew about cybersecurity that we actually had to unlearn before we could truly learn cybersecurity.

So I would say, you know, if, uh, MSP's in that position, partner with someone who's further down the road right now, get as much help from other experts in the industry as possible, and don't try to do it all on your own immediately, and then, you know, build it out over time. Um, the, the real risk is, you know, if, if you're not partnering with someone who is further down the road right now, um, to your clients, the the adversaries aren't gonna wait for you to catch up. Right?

That's Really, yeah, for sure. Over to you, Gary. Yeah, I was gonna say, so Gary, um, speaking of, you know, probably one of the top, you know, adversarial emulation guys in the industry, let's turn it over to you. Yeah, absolutely. Um, very technical. So, uh, Tim, you know, I, uh, I love what you guys are doing. I get a bunch of different perspectives, right? I have 250 MSPs and a peer group, so I get to stay close to that. I also sit on a couple private equity boards.

Um, we've seen a similar strategy, um, even with, um, like Thrive, they're pretty far down the line line, right? In terms of having scaled and then having built their cybersecurity, um, uh, you know, practice. And I wanna get your opinion on this. Kind of what I see is in the past, you know, big MSPs and private equity backed MSPs didn't really have a competitive advantage in the marketplace, you know what I mean? Like scale mainly made you worse, not better, right?

But now there's three things that scale helps with recruiting is one you mentioned, right? Uh, sales and marketing is a second one. And then the third one is why we're here today, which is cybersecurity. So how do you see that impacting the marketplace? And do you agree that, you know, you have a competitive advantage now in the marketplace because of, because of, of scale? No, it's, it's a great question.

And, and it's funny because when I, you know, when I started at admit two and a half decades ago, you know, I was employee 13, so I've, you know, I've worked in that, that Uber, you know, uber small business. Um, and there were advantages, you know, when it was all about relationships or a hundred percent about relationships, you know, having that connection, you know, really works. But as the world's changed, so have the needs.

And, and I think that, you know, I think that if if we hadn't become part of New Charter, we would've continued to grow in our business. You, you know, yeah. Because we were, we were doing 30, almost 40% growth over the last three to four years. But, but what New Charter does is it's an accelerator for us. You know, obviously we have, you know, we have access to, to capital and to resources that we wouldn't have had otherwise.

Um, you know, and, and huge kudos to, to Mitch Morgan for, and our board for, for believing in Us, you know, and, and making that investment. Um, but the biggest thing that it gives us is just, it just gives us scale.

I mean, I go from, as being part of AdNet being part of a 60, 65 person organization with seven sales, 10 re seven, 10 sales resources to being part of an almost 800 employee environment with, I don't know, Scott, a hundred people out there selling between sales and V CIOs, um, and things like that. So it just gives us a, a much bigger breadth.

So I think if I actually answer your question, 100% agreed that this is something where size is absolutely important, because to Scott's earlier point, you can't get into security overnight. You have to make an investment, and you have to be able to, to balance that with your, you know, your kind of current profitability and operational needs. And, and we've got the ability now, you know, like for me, one of the big things is I really wanted to grow our, you know, our forensics practice.

And, and that was, you know, we did, you know, bootstrapping, we did a lot of kind of, you know, iterations. Now we've got the ability to bring in whoever we need within reason, bring in the tool sets, bring in the partners that are gonna allow us to, to make some, to make some rapid jumps. So, Yeah, 'cause you have, uh, those V CIOs, you have that, uh, cross-sell engine, uh, set up across that whole, uh, customer base, Right?

Well, and the other, and the other benefit that we get from scale is, and, and actually I, I missed this point, Wes, with your question before, is, is I get to become smarter in the process, which is, that's one of the reasons why I love doing presentations. I, you know, I'm involved as an instructor in, in one of my side hobbies as well. Anytime I teach, I always learn. And, and that's the same thing.

I mean, I'm, you know, I'm working with organizations that I never would've thought I was working with, you know, because, you know, we're a national firm now, and I get to learn from our operating companies, you know, so many different things I've learned just in the last eight months that we've been doing this, that I'm just, I'm just blown away by it. So, Yeah. You know, what I see is, if you think about it, so you both have sat in peer meetings, Scott, you've sat in peer meetings, right?

They're real valuable, and I'm gonna get back and ask you another question about that, but it's not the same when you're sitting in your meetings, like, because now they're much more strategic. That's how I feel when I'm sitting in the room with our peer groups, then I go to a board meeting, right? And for a company at scale, and really, it's, it's a different conversation, right? Do you find that like a stark difference For me? Absolutely.

I mean, I think, um, when I think of new charter, I think of kind of like that peer group concept on steroids, because yeah, first of all, we are having the more, you know, business level strategic discussions. I mean, I've been fortunate to be in some fairly mature peer groups, so they've, they've done a good job of having those really strategic discussions.

But the other big thing is, um, you know, let's just say Tim and I were in a peer group together previously, and, uh, Tim says, you know, I'm really having this problem with whatever. And I say, oh, I've got a phenomenal guy who, who knows all about that he can help you, you know, call him and, and he'll, you know, give you 20 minutes of his time. You know, that's really what I could afford to do. Whereas now I can say, you know what? We'll just send that guy there for two months.

He'll completely revamp your processes, and we're all one company, so we're all invested. It, it helps me out to help you out. And so I think that's been one of the huge differences for us in this. Um, you know, the peer group concept is it works, it's truly successful, but this just kind of takes that even to the next level. Yeah. So, um, I'm gonna stick with that for a second then I'm gonna circle back to Tim. Uh, like, because I'm seeing this with like within our peer groups now. Mm-Hmm.

How important was being in a peer group to, to that security journey that you took, right? Uh, yeah. Having a group of people who were talking about it instead of taking it on your own. 'cause it's moving so fast right now. Absolutely. There's no way we'd be here. Oh, sorry, go ahead. Go back to you, Tim, in a second. But there's no way we'd be here without peer groups.

I mean, it's truly, um, you know, people like you, Gary, who have taught us, you know, first of all how to correctly sell services and how to, um, have the right conversations with our clients, which, uh, incidentally has been really, really helpful as we've gotten into advanced cybersecurity, because we're kind of right back to that step again of, um, you know, don't give away all your candy, you know, those concepts of, uh, making sure that you can truly sell value.

And so we're, we're going back to a lot of the early, uh, um, true method stuff that you taught us on sales. But, uh, but yeah, the other thing is, um, like I was saying earlier, you know, security is such a broad concept and there's so many different aspects of it that being able to have peers who have said, you know what?

We've done this component of it and we know how to do this well, that, that's one of the huge benefits for us of bringing in AdNet into what we were doing previously at Apex, is that they had some real strengths in digital forensic and incident response. We had some real strengths in building security programs and, uh, security assessments. And so we're able to kind of find the best of all worlds.

And then we've taken other peers from our peer groups who had other strengths, and we've learned from those things. So, you know what otherwise might be a, a 15 year journey, you can compress to a, a three to five year journey with peers. Yep. So, thing there, what I wanna say is, if you're an MSP today, and you're not in a peer group, it doesn't have to be Connect Wises or True Methods right there, uh, there's a bunch of them out there.

But the point is, I think everyone should be in one, and it relates directly back to cybersecurity and the ability to play catch up together instead of a loan. Um, I I, I wanna address, Larry said this feels more like a new charter sales pitch than a talk about MSP to M-S-S-P-I, let me tell you why. Like, I disagree. Everyone should be listening to what you guys are doing and this business model. 'cause you're not the only one I'd mentioned.

Like, you know, I'm on the board o of, of a couple platforms, right? So everyone listening needs to understand, I'm presenting Monday in Vegas at, uh, the CAE event. I'm, uh, at the, um, m and a forum. And one of my messages is everyone needs to understand what's happening with m and a and cybersecurity and, and what's happening with this change in structure of your competitors. 'cause it affects all of us.

So, Larry, I, I'm gonna politely push back, is that seeing this business model and what's happening with it, we need to be on top of everything right now. Right? And listen, and I, again, I'm a representative of that 1, 2, 3, $4 million MSPI fight for them every day. And I think they have a great future, but they gotta be up on all this stuff, man. Andrew, you're with me, right? Yeah. Like, yeah, no, I, I, I, I couldn't agree more.

This is about understanding the, I think again, just like we, if you're a fan of the stock market and crypto market, in terms of the economic, the macroeconomic backdrop of what's happening, right? With inflation and disinflation right now, you have to understand the overall market. This is what, this is what PE is doing to our market. And like, you know, we already saw this one last thing, Gary, I'm gonna say, and I'll turn it back to you. We saw right this fail in early 2000, right?

Where we got a lot of, we tried to put, remember comp, compute comms together, and, and it failed. It seems to be working this time. So I wanna understand, and I hope everybody else under wants to understand what's changed, right? Does that make sense? Back to you, Gary? Yeah, absolutely. It is not the same. Uh, this is not all covered, uh, you know, 12, 13 years ago, right? This is a completely different play and in a completely different, uh, market.

And it doesn't matter whether you ever wanna sell your business or not, it makes no difference. You can do whatever you want, but you do have to live in a changing environment, a changing economy, a changing security landscape, and a changing competitive environment. I mean, it's just the reality. Our industry is growing up right now, and we all, to some degree, need to grow up, uh, with it, right? And within that, we can choose our lane.

We can run a great company of any size that, that part's all good. So, Tim, I want to ask you, can you walk us through the sales structure and process in terms of, you know, business development reps, sales versus V CIOs versus VC sos? Like, give us an overview of how you view that from a sales and, and, and go to market. Yeah, so, so, so from our standpoint, and again, this is, this is the space where I live. Um, you know, so it's very near and dear to me. It's, it's about understanding needs.

You know, and I'll, and I'll give you one of my favorite examples is, is, you know, you know, we get a lot of people that come to us saying, I need a pen test. You know, I need a pen test. Well, why do you need, I need a pen test. And, and you start to, you know, you start to ask questions to understand what the business need is. And, and people hear pen tests. 'cause that's what our, you know, our market likes to talk about.

Um, and you start to unwind it and you realize, well, maybe they need a full security and risk assessment. Maybe they need this. Maybe they, they need that. So, so to me it's, it's about educating that, that frontline sales team, you know, which, you know, for us is, is that VCIO and the sales group as well as our technical teams, you know, technical people are one of the best sales hunters that are out there, if you train them properly.

Is is, is being able to spot to hear those, those potential triggers of, Hey, I just got this letter from a vendor that I need to sign. Hey, we just got our cyber insurance application.

And I mean, there's, there's so many different triggers now for starting that cybersecurity conversation that, you know, my goal in my role is, is to help people be able to start that conversation, then bring in somebody else, bring in myself or, or somebody else from the team to, to really kind of get it to that, to get it to that next level. Um, Tim, can I just throw in there? Absolutely. What about, and what about these different departments?

Like there's a reason CIS as an example, added service providers to the controls this year. And Ryan has talked about this numerous times of, you know, around log four J as the example, right? And we asked of did a poll, do you know, you know, your client's inventory on third party providers? And, you know, again, most didn't.

Um, so this is again, like, again, just, I, I think it's awesome that you're sharing back to the community and John Strand said it last week, his technical team sells more than anybody in his organization. Yeah. So, Hey, before we, I know we're getting to the top of the hour, one question I want to get in, which is, you're making these changes, you're building these programs, Tim, um, how do you know how to price things? It, it, it's, it's a lot of work.

I, I mean, it, it, it becomes, because you, you have to look at it, you know, this is, this is where my degree in accounting is both helpful and hurtful. Um, you know, is, is is you have to be able to understand some cost models, but you also have to understand what the markets, you know, what the market can bear. You know, and, and to me, you know, my, my favorite word in all of this is, is pragmatic. Um, yeah, it's a little bit of an exercise.

I, I don't know that I've got a simple answer for you. What would be Your target growth margin for your cybersecurity services? What's your target? Gross margins. Fif 50 to 55% service gm Gotcha. If not higher. Yeah. Gary, I, I wanna go back to something that I think you taught me. I, I believe it came from that, which is that, um, yeah, people don't wanna buy the ingredients to the cake. They wanna buy the whole cake, right? Yeah. And people are not looking to buy all of these.

They get tired of hearing us say, well now you need security awareness training. Well, now you need multifactor authentication. Well, now you need penetration tests. Well, now you need security risk assessments. Now you need EEDR. Um, you know, they're getting tired of that because those are a whole bunch of individual inre ingredients that don't solve their problem. Yeah.

And so when we come to them and we say, what you really want is to solve your security problem, you really wanna solve this risk. Um, it is expensive to do so. And so usually the price point that we come in at, which is typically I'll, I'll just throw it out there in the, like $80 per seat for an all-inclusive, uh, security offering. Um, yeah, typically the initial react, I wanna be Clear, that is the security offering, not your managed service offering.

That's in addition, that's Managed security services only dedicated managed security services. Yeah. So I wanted to, to share that, to kind of give the community, you know, what we're selling it at and what a lot of people are initial reaction is in, in the SMB space, in, in the enterprise space, they're used to spending $300 a seat for security.

But in the SMB space, a lot of 'em will be taken aback by that pricing initially and see, say that seems like a lot, but once we educate the customer and once we educate them about implementing a true security program, and we help them understand that it's not death by a thousand cuts, but it's really implementing a comprehensive security program, most customers who have more advanced needs are, are willing to pay that price, uh, as long as they're getting a solution to the problem security rather than just a whole bunch of individual, um, point products.

And so, yeah, that's been the, the, That's probably been the greatest learning process that we've had through this. And, and if that's one thing that I could share with the community is that we started with this whole concept of no one's gonna pay that much, and so we've gotta sell this for $10 and sell this for $5 and sell this for $12. And our clients just got exhausted on all of these things that they were coming in.

And so when we finally said, okay, this is gonna be a lot, it's gonna give you some sticker shock, but we don't wanna keep coming back to you. That's what finally resonated and where people started adopting. Okay. If you were on this call for the last hour, uh, the last 30 seconds just paid for your time, right? Yeah.

Those last 30 seconds, Scott and everyone I know who's having success and they're selling, you know, 80 to a hundred bucks for the security, or they're selling overall security first for two 50 to 300 seat. They had to get to that same point that you just mentioned. And I saw Keith said, isn't price always the same cost plus lift plus profit margin? Yeah. Keith, if you know your cost, like on a tool or a firewall, that's easy.

But all the things we do in our process and all, all, all the, you know, the roles and process to provide this, it's not always so easy to know that cost and get that unit of measure. So, uh, really, really, really good. And like I said, you ended it with, with, uh, paying for the price of admission there, Scott. And, and I wanna comment one, one thing. I know we're out of time to Mark's comment. Absolutely.

You need to have a la carte pieces because, and that's something that we've had to work into our model because there are a lot of solutions out there. So you have to give people methods to kind of grow into it. Is it ideal? No, but I would rather have 50 or 75% of the solutions rather than none of them. So, yeah. And also you may start off with something a la carte because the pricing model doesn't work to bundle it yet. And you're, or you're figuring out the costing.

So you have one thing that's a la carte, but maybe in six months or a year you figured out the costing or the costing has come down in range. And now we, now we bundle it in. That's what we've been doing for 15 years, by the way, before security. That part's not new. Really, really good stuff. Gary, I'm gonna close things off before I thank everybody. I know we went a few minutes over. Yeah. Great job today. Yeah. Amazing. Amazing. Here's what I wanna say.

If you, you know, Scott, you nailed it with end result, right? What's the chocolate cake? Okay, in our industry, and Ryan put it up there, implementation group, one of CIS and I'm gonna sound like a CIS sell. But just think about this, look up the community defense model, right? Why is it that they did all of the study on tens and tens of thousands of attacks? 'cause they know the top five top attacks map to Mitre.

And if you implement implementation group one, you can prevent 80% of them, right? So look at the stack, look at the process, look at the tools you need for IG one. Learn it, live it, know it, and that's your end result. That's your chocolate cake. Gary, can we get a boom? Boom. All right, Scott, awesome having you, Tim. Awesome having you. Um, as always, uh, Gary Ryan West, really appreciate the, uh, partnership, everybody tuning in.

Thank you as always and we look forward to seeing you guys all next week. Best of success to everybody. Take care. Thanks everybody. Take care. Thanks.