November 30th

All right, we're live. Welcome, everybody. Hope, first off, give us a Hey, O, Gary. I know it was right. There It is. Hey. All right, well, welcome everybody. Hope you all had a wonderful Thanksgiving. If you're in the us, if you're outside the us, hope you had a wonderful weekend. Everybody's happy and healthy in your world. Um, gonna go through just a few quick announcements. Um, first, um, as always, cyber Nation is live. Um, it's at cyber, literally DP, uh, cyber, the Cyber Nation.

Uh, got, I think we're co closing in on a thousand, uh, people there. A lot of interaction, which is awesome. Next thing I wanna go to Gary, and I'm gonna put this in chat. Is your success Summit coming up? Uh, can you tell us just to touch about that? Uh, yeah. So we working with on this, we joined forces with Perch, uh, with IT Glue and ID agent.

And it'll be a, a whole week where every day when you sign up, you're gonna get a different asset around security, around sales, business planning, operations. And then it culminates on the last day, uh, in two weeks on Friday, where we'll do a panel together. Really just trying to get MSPs ready for an extraordinary year, A year when having the right plan is really gonna move the needle As if 2020 wasn't as extraordinary enough. Huh. This time we're, but this time it's different, Andrew. Yeah.

Because, um, we, we know where we are now. Yeah. And we get to, we get to choose and make plans, and we get to control our reaction and, uh, you know, reduce our risk and increase our opportunity. So, no, very Fair. I'm saying, let's go. There we go. There we go. And a, a very Hello there. Out there to Jennifer Vander. We Hey, Jennifer. Great to see you. Jennifer Lynn Walker. Wes, um, talk to us about the MSP threat report. We still have that survey open.

I have it as a i'll a call to action underneath you, uh, under, it's the green little thing there for those of you wondering where it is. It's right below. Um, Wes, talk to us a little bit about that. We had a lot of people filling it out. Yeah. So, uh, oh, I've got some echo coming in here. I'm not sure. It probably got a second browser. Would you fill that out then? Will you threaten people? Yes. And then report on it. Exactly. Right. Hello, Andrew, we see you. I'll say hello to you.

Um, what, what's that painter? You know, the painter. I got my, uh, finally got it fixed. Hey. Yeah. So I would love for you guys to fill that out. It's right down below. We're just doing a threat report just like we did last year. Um, this is gonna be really good data that we need to come back from you guys. Uh, it just makes it more organic. It's, it's gonna confirm some of the things that we're seeing and thinking, so please go fill that out. It'd mean a lot to us.

And, uh, if you have questions and want to talk to us more about it, by all means reach out to us. But yeah, we would love it if you guys would fill that out for us. Awesome. And you know, Crowdcast messed me up a little here. I had this awesome poll, uh, in here, but let me set it up real quick. But while I'm doing that, um, Gary, you and I have been talking and you thought, Hey, you know, we need to stop for a second and level set.

And, um, and you know, and by the way, we'll talk about Dustin, who's on here with us in a moment. But we need to stop and level set and just kind of take a breather. A lot has been going on in 2020. Um, you get a unique view, thousand or so MSPs in your coaching program, 150, 200 in your peer. Just give, give, give everybody a sense of what you meant by that and what you're seeing. Yeah.

So, uh, uh, and I'm gonna say in terms of where we are with security, 'cause I think it's the biggest driver, or at least it's uncovering where I think where we are, and Andrew, you think about, um, just how much it has changed in such a short period of time, right? Right. The threat landscape has changed dramatically. Uh, how SMBs are using technology. It's been changing, but now the pandemic and people having to change the way they work, you know, has just accelerated it.

And, you know, what keeps coming up is that the MSP business model and the constraints around that haven't changed as quickly. And when you look at it, and you have a lot to do, I mean, the first question that people ask me, the two questions I get are one, where do I start? Okay? And the second question is, you know, what do I do next? Right? And so I wanted to open that up to, to the panel.

And you know, Wes, it's one of the reasons why you and I have been harping so much this year about standards, because that's really kind of assessing where you are, right? Is where you have to start from. Uh, you're on mute, bud. Man, I just need an IT guy today. Things are not going well for me. I'm, uh, gonna take some, uh, take some bids here. Uh, yeah, we do need standards. Almost every other industry that's out there has standards, right?

If I go talk to a CPA and he's not following gap, I'm not using that guy. If I go talk to a doctor and he's just doing Willy-nilly whatever, he reads off WebMD, I'm not going to that guy, right? Uh, and so it's high time that we as security professionals align around standards and really say, Hey, enough is enough. We're gonna draw that line in the sand.

There are multiple standards for sure, in different regulatory bodies that apply to us and our clients, but we're gonna mature here and we're gonna stop doing things willy-nilly. And once we align Gary to standards, it gives us that ability to say, this is the right way to do it. And gives us the confidence to say so to a client who may not understand what it is we're trying to do. And that has all kinds of untold benefits to talk about today, right, Gary? Yeah.

But you just tripped over something you just said. I wanna make sure you missed it. And this, I think, goes to the heart of it. You said, as security professionals, Wes, you're a security professional. Ryan, you're a security professional. I work with many MSPs even that are security first MSPs. They're not security professionals by that definition. And I think that's where we are, is that, and we don't just do security for people. We're doing their support. We have to plan it.

We're their VCIO, we have a bunch of other things in their tool stack. We're doing all the things we used to do when the threat landscape was different, but we also now have to fill that gap in. And I don't know, Ryan, I want to ask you that question. Does that concept make sense to you of why MFPs why this is so difficult for them right now? I think it is. I think it's also a different way of thinking about the problem, right?

Typically when you hire a tech, you're looking for someone that can do different things well, right? And this idea that you now had to add information security to that, um, becomes even more daunting. And, and then this, this kind of competing idea, which we talked about a couple episodes ago, um, uh, you know, we were talking, um, uh, with the gentleman that does the YouTube channel, um, Randy, I'm, I'm sorry. Uh, yes. Yes. Cyber, something, cyber, I don't know, I can't remember right now.

Spacial, I'm drawing a blank. Yeah. Yeah. How there's this idea that like, there's such a high barrier of entry to information security that it's become, like some people are actually scared to even try to make the entry point into it. And so I, you know, I think, and every MP is different. Some MSPs could employ a full-time information security professional, and some people just need someone that can start thinking about it and drive conversations.

And so how we're exactly gonna handle this kind of challenge of staffing for information security is still, I think, kind of difficult conversation in the IT channel, because everybody's at a different place and their needs are somewhat different. And, uh, the market is incredibly difficult for hiring these, um, and retaining, you know, not just hiring, then you have to retain these people, right?

Um, so, and, And you gotta build them into your model, like how the cogs go into your pricing model so that it's not coming out of gross margin in order to be able to do it. You know, Andrew, um, when you and I were preparing for this, I was kind of taken a long view back over the past, you know, 25 years that I've been in this, and I brought up other things. Yep.

Um, and, and, um, one, like I was saying in the beginning, like, um, when e uh, we were, yeah, we were s spa, um, and every one of our customers, and we had 160 customer companies, we support it. They were all on our host had exchange, the margins were enormous. Like they were 90% gross margins, right? Um, but what happened was, you know, there, it wasn't gonna stay that way forever. So eventually Microsoft came in and said, okay, thanks MSPs. Uh, we'll take it from here.

Uh, the same thing happened with backup. At one point, we had built our own backup solution before the datto's of the world. And, you know, we were getting $22 a gig. Well, it wasn't gonna stay at $22 a gig. And so the need was there. It had to get solved, SMBs had to get backed up, and they couldn't. So the channel solved it. And, you know, companies rightfully so, like Datto and others came in and said, thanks, you know, we'll, you know, we'll take it from here, right?

So now we see this thing, and it's harder to see 'cause security is so huge, but the gap is so wide between what SMBs really need right now and, and MSPs can offer, and what's kinda where the marketplace is. That gap has to get closed in the next three years. Like, our role in security is gonna have to change the future of SMB security. Can't be, can't be every single MSP becoming security experts. Like, I'm hoping that's not, Has that happen? Yeah. I wanna add something to that.

Just kind of following the chat stream too. This idea that information security people only focus on information security is also a fallacy. Yep. Right? So if you're thinking that you're gonna have a tech that focuses on information security and does nothing else, that is not a realistic expectation.

I mean, I, I probably spend 60 to 70% of my day on cybersecurity and the other 30 to 40% on other things, helping it with maturity plans, helping infrastructure with maturity plans, working on business process mapping, or, you know, just other things that are needed to make the business go. And so you don't have to think about staffing for security as someone that's a hundred percent dedicated to it. It's just someone who's mostly dedicated to it.

But also, Ryan, your role too is also on a governance level. And if, maybe just talk about that as well, where you are gonna be, again, if you were plopped into a, a decent sized or an MSP, you're gonna be talking to companies. And Wes love your perspective on this too, about, you know, aligning their, you know, policies with their controls and why that, that's important. Fair. Is that fair? Yeah, I've thought about that.

What it would like to be like to become a CISO at a large MSP, um, and the challenges that you'd have to face. Um, and I think it, the, the question that kind of is most important to me that keeps coming back to my mind is, what are you trying to achieve? You know, you have to really know before you just hire a security person, you have to have a sense of what it is that you wanna achieve or what it is you're looking for.

Because different security people are gonna jive with different, like, if you're looking for a peer governance policy role versus a technical role, versus an application security role, or an infrastructure specific role, or cloud security role, those are all different people that you are looking for. You, you as an MSP, you do need to have a sense of what it is, you know, where it is you're most efficient, and what it is you're really looking for with that individual. Yeah.

But also where your role is and what your policies are. The same way, you know, when I hire someone who, you know, in my MSPs who's a, you know, a Cisco expert, I'm telling them how we configure Cisco, not the other way around, right? Because we have a different view across all of our customers. When I hire A-V-C-I-O, I'm not looking for every VCIO to come in and just make whatever recommendations they make.

We come up as a company with what our standard, this is how we handle, you know, this is how we handle, you know, email security. This is how we handle vp. Like, in a way that's, that's supportable across our customers as they scale. It's the same thing with security. We're not really looking maybe for someone to come in and just bring us all the information they need a base of knowledge.

But as the MSP, just like with everything else we do, we have to know what our security posture is, what we prioritize, how we translate that value, what it costs us, what those roles are. So it's complicated is what I, if you're hear what I'm saying, Andrew, that it's that it's that it's, it's complicated and that's why we're at this struggle, and that's why we're here every week Yeah. To have these conversations. Yeah. No, Gary, uh, really well said.

I mean, think about it, you know, again, for you and I, collectively, what, 2 0 4, you know, give or take, been on this ride in different places, but it wasn't until about three years ago, like it, in terms of having to do things at mass scale, be like, okay, well, like I say, early on, Zenith came out with a knock to give people efficiency and scale. Well, that was triaging alerts. Now we're in a whole different world.

I mean, again, you know, when somebody is encrypted your customer or your MSP's entire, you know, infrastructure and applications and et cetera, um, and or you're dealing with regulatory things. And it, it, Gary, maybe we could segue in there into standards. 'cause we started out with that. You're doing some unique things, uh, with standards, right? In, in terms of a quick start or a jumpstart. Can you, can you Yeah. Yeah.

So we created what we call a a, a jumpstart inside of our software, my T process. So what we just did was, we used it as a special project with our peer groups. They do a couple special projects each quarter that they review with the meetings. So everybody did it. It's basically an alignment, you know, we based it a lot off of CIS, but just some other things that we piece together. And, you know, we have some very advanced security first. Some of the best MSPs I think, you know, out there.

And we also have people that are much earlier in their journey. What was interesting is that project was one of the best ones that we've done. 'cause no matter where they were, they were able to have a conversation around, around something more concrete. 'cause even the most security first ones, you know what they said, you know what, we scored this percentage, but honestly, here's what we learned. A lot of these questions, we could say, yes, but it's not black or white. Yes.

Like, we still have more work to do in that area. So they all came out with a list of things that told them, you know, where they were, where relative to maybe thought, where they thought that they were. And I think that's a really important concept here. Like, you can't say what secure is. Like, we're trying to say, well, what is relatively secure? What is reasonably secure based on that business, their risk profile, what they're willing to invest. Like, all of those things go into it.

And you heard Wes and I through these calls always say this, the big difference between an MSP and a mid-market enterprise company is the mid-market enterprise company just has to make that case to their board to get another resource or to get more budget. The MSP has to figure out how to make that case to every customer and every prospect almost every day. Right? All right. So this, this is kind of leading into go to market.

So one of the things you and I have talked a lot about, and I've said it on this call many times, is your analogy around sales, which I've taken to heart for many, many years, and many, many conversations, thousands of them with you, you know, in working for you, thousands of them over the years, is that people are like, Hey, I wanna hire somebody and increase my sales. And you would always be like, Hey, let me ask you a few questions. Talk to me about how much MRI you bring on today.

How often you do that, how consistently, and it's typically, there was no command. I, I, and I, and I think this is the first time in a long time, if ever the MSPs have had to have command internally, like sales when it comes to security, in order to have a good go to market, gimme your perspective. And then can we go around the horn with, with Wes and, and Ryan on that? Yeah, absolutely.

I'll start with Des and then I, and I wanna, I, I only wanna just mention it, but as we talk to Dustin, I think we can talk about it in, in the context and answer questions. But one thing is, what are you selling? Are you selling security? So what does that mean? You're selling tools, you're selling this. Like what is selling security? You know, what is it that you're selling? It's the same question that I've been asking MSPs for, you know, the last decade. What is it that you're selling?

Are you selling support? Are you selling patch management? Or are you selling this intangible in a way that the customer can see how it's going to impact their business? And security is a microcosm of that. Andrew, people don't want soccer scene, they don't want virus protection. They just wanna be able to run their business, and they don't wanna have it interrupted, and they don't wanna be held for ransom. That's all they want. Right? And this is a big intangible.

What Wes, lemme go to you, uh, I dunno, this is, this is a, you know, secure cybersecurity is a big intangible, right? It's like we talked used hurricane analogies and risk analogies, right? You know, before people don't, aren't good judges of risk. This is a big intangible. Give, give us your thoughts, Wes. Well, right Gary, what Gary is saying is correct, and I want to give you some thoughts that I have from the, the purchase nest, so to speak.

Um, so when, one of the things I like to do, if I've ever been on a phone call with any of you guys that are here with me today, one of the questions you'll find me ask in discovery, I'm just getting to know you, is I'll ask you something around the lines of, Hey, what does security look like for you? What are you selling today? And I'm listening for some answers. And I'm not, don't take what I'm about to say as like, this is the only way to do it, or this is the right or wrong.

It's just what I've learned over time is when I talk to a partner or potential partner, like, well, today we're selling firewall, we're selling av, we're selling, you know, some maybe end user awareness training, like no, before, whatever. I'm like, okay, great. What that tells me though, it's less about what you said and what you told me. What you told me was selling, like Gary said, some products and maybe some services wrapped around it. Flip this for a minute.

And I talked to some of our partners. I'm like, Hey, what are you selling today? And they're like, well, we have at our MSP maybe a name for it. They call it the, you know, Joe's Cyber Defense solution or whatever it is. And I'm like, oh, that's interesting. Tell me what that is. And what they're selling is an entire solution. What they're selling is, it may have a lot of things wrapped inside of it, but they are selling their own brand.

They are selling their own version of a security solution that has a bunch of things wrapped up and rolled into it. Love that approach because from a client's perspective, what I'm expecting you to do as the MSP, or when I was at my bank, what I was selling was not a bunch of security solutions to my board. I was selling risk management and risk mitigation. That's what I was selling.

And so, as long as I could communicate in that risk perspective, and I could say, Hey, here are the areas we need to address. Here's how we're addressing them today. Here's some weaknesses and what it's gonna take to get there. The board understands that language. And in the same way clients understand that language too. When we say, I'm not selling you a whole bunch of like, you know, a menu of things that may or may not make sense to you.

I'm selling a solution to you that has these things inside of it, and the output for you is this risk mitigation. Here's how we're addressing those things. And Gary, that goes back to what you said before. You know, I've always said, when we say, am I secure, the answer should be, let me go check. Right? That's Richard Balik is the one that said it.

Give it credit to, to, to, um, who it's due from this idea of like, there's no true security, there's no true like perfect security that is breach list, right? And so my thought is what I'm trying to do is communicate risk mitigation and doing the right things in place.

And the outcome of that, by the way, and I now I'm getting on a bit of a rabbit trail, but when Justin Bolander was on, the outcome of that is not just doing the right things to generate revenue, to reduce risk, but also in the event of some kind of compromise. Now I can say I had, I was doing due diligence, I was doing the right things in place, and yes, a breach happened, but at least I was doing the right things.

There's no negligence to use that bad word in play, or at least potentially reduces that chance. And so, Andrew, those are a bunch of things I have swirling around my head around all of this. But I love that idea of selling a solution that goes with it. Gary, what you talk about like the chocolate cake, so to speak, and not all the ingredients. Ryan, what do you think? Yeah, it was dislodged a lot of things for me.

Um, I, I like the, the MSPs that I talk to that I've had most success in selling security, um, are also packaging it. They're not talking about, you know, wine items that can be added or moved. They're saying, you know, there's a silver package, a gold package, and a platinum package. And, uh, there's a descriptor about what you get. And the, what you get is people, process and technology.

It's not just, we'll do some AV scans and we'll do some vulnerability scans and give you some data and then do some patching, right? Or maybe that's part of your silver tier. Um, but the idea is they can't add or remove things. Um, I've even talked to MSPs where their silver tier, um, used to have no security solutions in it because their SMDs wouldn't buy it. And the conversation then come becomes one about bad revenue, right? Or toxic revenue.

And so you have to think now for every end customer of yours that doesn't want to do the right thing when it comes to security, that becomes a brand liability for you as too. So all those dollars on a p and l may look great from a a revenue perspective that has a stronger decay rate, um, and has the potential to kind of eat into other revenue as well if there's an adverse event for that client.

And so I think the hardest thing is picking the stack, the stack of people, the stack of process and the stack of technology. And the last thing I'll note on that piece is there's, there seems to be this belief that there's a, a well-defined simple stack that all MSPs could or should be using. Again, that's wrong. MSPs are different. They serve different industries, they're different sizes, they have different resources, they have different customers. Um, no MSP is the same.

And so the security program I built at Datto is different than every security program I've built at other companies. You have to figure out what the right mix of people, process and technology is that you can turn into your brand and then package and sell. And so there is some preliminary work that you need to do there of what is it that I'm looking to sell? How do I become proficient in that?

How do I make it so that I'm really adding value to those customers and figure out how to package that. So you don't have to have the conversation about, well, can I only scan a hundred assets instead of 200, you know, and like start having those line by line items. And again, I don't know if any of that is helpful, but it dislodges a lot of thoughts. It is. But there's one thing in there that's really good perspective, Ryan, but there's one thing in there that I want to unpack you.

It'll kind of lead us in, um, you know, to, uh, you know, to talking more specifically with Dustin about his questions. Okay? It's one thing to say there's silver, gold, platinum. The problem with that in real life is that they're delivered many times by people. And I have a person and they can manage so many seats. I'm paying that person whether I sell you my gold program or my crappy silver program. So that's why the margins get decayed.

So where we have pushed our best members, Ryan is the same concept, but turned a little bit to the side, which is, look, you gotta have that core offering and you gotta put everything in there that you think, and you can't be at $140 a seat anymore. That's gonna get you to 1 75, 180 5, 1 95. Then you'll have some people that need added security. And a lot of times what that means is you're working with a third party like a perch.

So it's really easy to know your cogs and to, and to plug that in. But the things that you're delivering, you have an average cost per seat and you are paying everybody every month in all of those roles. Yes. I think it's harder to match that up. And it's also harder to offer different levels to different customers, right? You're talking about Dry? Yeah. Yeah. You're talking about the migration from three package models where one has no security to two packages where both have security, right?

Yeah. You're going from good, better, best to, um, better best, right? Yeah. Better than most MSPs where you can go in and ask one question. Okay. Dustin, you can go in and ask somebody one question. Yeah. How many users do you have here? What do you spend with your current MSP?

And you can figure out that sort and without doing any analysis, you can tell them, look, I'm gonna ask you some questions, but what if I told, told you that I already know that there's a gap in security where you think you are? What would you say? Most common answer. What do you mean, Dustin? We're teed up and ready to go. Yeah. I actually love that shift from three packages to two packages.

'cause it's leading to something that, uh, you know, some of you may know Brian Weiss who runs a MSP on the List. I do, yeah. Yeah. Great guy. He, um, you know, he, he openly talked about his experience with, with cyber intrusions and how it changed the shape of his business. And he talks about, um, referring the customers forward when they don't want security finding another partner for them because he can no longer accept the risk of an SMB that doesn't wanna do security. Well.

Um, and I really like that idea. He actually goes out of his way to find another MSP that's a better fit for that SMB to make sure they're taken care of. And I think that's a really strong part of his brand, right? Especially some of these customers he's referring for have been longtime customers of his that just don't wanna invest. And, but guess what? He went through all that and he retained the almost all of its customers. Yeah. Every one of those customers was willing to pay him more Ryan.

Yeah. Right after they had gone through that with him. But they still trusted him and they, and they figured they were, that they were better off with someone who had been what he'd been through than someone who hadn't yet. And he explained to him the changes he made and what it was gonna cost. And every new client now he sells at a much higher price or he refers them away. Yeah, that is a great story right there.

And, and, and kind of putting a bow on this, Gary Ryan and Wes, you know, Gary, for years, you've said even before all of the cyber controls that we've started to talk about and frameworks, bad, bad, bad. You know, when we talked about bronze, silver, gold, tin, pewter, Right? You know, bad news, your customers aren't qualified. They weren't qualified with it to choose. They're certainly not qualified.

And this comes down to, you know, the big struggle that we're having today is there isn't this common language, there's common language that we all are talking to in the last three years. MSPs have really got, you know, brought up their their game. They understand what if I said, Hey, what's CSF? Three years ago if I said, what's CSF? 90% of people would look at me with a cockeyed head, right? At least we know. Now, you know what?

Identify right, protect the tech, et cetera, is our clients don't. Right? And, uh, and so with that, um, Dustin, want to thank you for jumping on with us and here's where we're gonna take a little bit of a shift. I see a question in the queue already. This is your time. Everybody out there bring us your questions. I asked everybody when I sent out my weekly email, Hey, do you have questions about selling cybersecurity? And Dustin sent us a bunch and I said, Hey, by the way, you wanna come on?

And he was gracious enough, and I appreciate that, Dustin, you, um, you're at a pretty big MSP, but I think what you are asking is applicable to everybody. So first, tell us a little about yourself. Dustin, you've been at Marco for a few years there, I noticed. Um, a little bit about yourself and then we'll kick into why don't you start in with a question that you have and we'll kick it around the group. Um, we'll look for comments out in chat and let's just get right on into it.

Again, everybody out there please shoot us your questions. Things you might wanna know from the panel here. Good. Yeah. Cool. Thanks. Thanks for having me guys. So yeah, Dustin Bond here. I work, Marco Technologies is the IT provider I work for. I came from a smaller IT provider IT that Marco had acquired back in 2012. And, uh, we were at the position of having legacy break fix customers, which was probably 80% of our total customer volume.

And then we had, uh, we grew up to 10 managed services customers and quickly realized our resources. We, we would have to add resources, dedicate roles, responsibilities. And so at that point in time, um, it made sense for us logically to partner with Marco. So the business I worked for was acquired and, and along with that came, uh, it was, it was really revolutionary for me too. 'cause I only knew what I knew at that point in time, coming from a smaller IT provider.

And, and Marco, we had launched our managed services vision back in 2005. So at that point in time had a, a much more mature practice. And I, I quickly learned and evolved and understood really what managed services could be and maybe how, uh, the lack of what we had in in place. So I've been with Marco, uh, since then. Um, I've served a few different roles, just kinda run, running up the ranks from being sales to leading a, a division nationally.

And then most recently here too now helping, uh, at the beginning of the year we pivoted and, uh, converted all of our sales members to be able to sell everything that we do. So a a a chunk of our business is actually printers and coppers as well. But, uh, with the transition in the industry, all our reps are selling everything. So I focus on about 20 reps in the states of south or South Dakota, Nebraska. Awesome. Well, your first question had to do with contract term.

Can you take us through that? And this is again, things that I, I, I bet are on everybody's mind. Um, you guys sell some pretty beefy contracts there. You've had some very good success in in in your cybersecurity stack. Um, Mike Beard, for those of you out there is the CSO of Marco and, and and Dustin's backyard. So talk to us about contract term, what you were thinking there. YY yeah, and you know, we're thankful too.

You know, prior to Mike Ard, our chief information security officer coming on board, we were selling a commodity, a help desk services with your ancillary Sure. Antivirus. I mean, it was, uh, the value add I think was missing. And Mike really rounded us out and took us in a completely different direction. Uh, and, and with the help of perch too, PERCH has been a tremendous partner for us. It's been really helpful with our story.

Um, this year we, we took an aggressive approach to go out and basically signed up all the contracts in our region for sure and included in perch just 'cause the additional benefits. But what we're running up against is, you know, we're, um, commission based like most and get paid by contract term. And we're starting to see more and more of this as well where month to month contract terms we're after three and five year deals. Um, we're, we've been pretty successful five year deals on renewals.

Um, the new new client acquisition when you're competing against month to month. But we're starting to see more of that and more, you know, and from our perspective, we will start here with Gary. You know, we, like most others, when you have a more packaged offering, we, we don't have brown, silver, gold. We have one offering we did in 2012, we moved away from it 'cause it was too confusing even for our technicians to understand what was included.

But now we're running into a lot of month to month agreements and, you know, as we're after longer term relationships, do you get any advice for myself, for some of the others, I might be running up against more short-term contracts when of course we're all financially motivated looking for long-term relationships for more of an extended deal. Yeah. So one thing I would tell you is take it in two parts.

So, um, you have to cr you have to create enough separation before you get to the contract term. And if someone is month to month today, especially now, even compared to a year ago, it's usually an indication, uh, sometimes of a, a little bit less mature, uh, business. And so that has other ramifications that as you go through uncovering pain and starting to match up your solution, your, like what Ryan talked about, you know, your process, your roles and technology and how you make that work.

Like, you know, your chocolate cake, um, you gotta be able to deal with those things around pain and money. Uh, and that last one is decision. And so one thing is if they're considering the contract term as a deciding factor too early on, it, it's really gonna make the, the, the, the decision for them complex. You have to make sure that you're controlling the factors that they're using to red flags to narrow it down to one or one or two vendors.

And so that the contract length is almost, you wanna make it, you wanna make it a red flag if someone is month to month, yeah, yeah. That's what you wanna do. Now, getting to five years is one thing, but I think getting to a one to three year agreement, I'm finding, you know, a lot of people today, they don't wanna sign a one year deal. They want price protection and they're willing to go three years for that price protection.

It's the cu it's the customers that are driving the MSPs, uh, to the longer ones. But does that logic make sense how I'm taking it apart for you? And I don't know if Wes or Ryan has anything to add to that. Yeah, uh, almost echoed too, a little bit of the, the spin that I've taken on it too is echoing a little bit what you had said earlier is more risk, right? Is it, or is it, is the customer worth the risk, um, for the reward, right? And I think you'd mentioned, uh, bad, bad revenue.

I, I think is what Ryan, Ryan had mentioned there too. And that's kind of the spin on it. Sometimes that's hard for salespeople to hear and understand, but I, I think what I heard there, uh, like other people's opinion is getting ahead of it or a little, little bit more early on and using it as kind of a deterrent for better qualification.

But what I will say too, though, what, what, you know, you probably, we've all been in sales situations and, and let me ask you, if you have Dustin, you've been in a sales situation where you basically are telling somebody, Hey look, I want to help you, but I can't, let me find somebody for you. You're selling from a position of no. And oftentimes, right? If you could always sell from a position of no financially, you know, Sandler, financially independent, don't need the money, right?

That's what Gary's also suggesting here, right? And a lot of times you're gonna find those customers go, wait a minute, you don't want me, right? And, and why don't you want me? Well, let me tell you why we don't want you right here. There's this huge risk factor that you're not considering that we just can't get comfortable with.

And I, I would make it tie to the result, you know, and just say, listen, we normally, this is not an issue we have, you know, we have a hundred customers, 80 customers, 20 customers. This has been an issue. So can I really talk, can we really talk through what your concern is? And can I tell you on the other side, like the commitment that we make, how we front load this to do it, and how the business relationship works.

I think once we talk through that we can, there's other things here that are bigger decision factors. I'm gonna make sure we're on the same page. Very cool. So, hey, so we can stay on track here 'cause we also have someone that also also wants to come up. Um, by the way, Wes, Ryan, did you have anything to add to that particular one? No, no, I think, I think you covered it. I mean, look, we at Perch we do, the only thing I'll say very quickly is we, we understand the same thing.

In fact, uh, Dustin, as you know, we, we've sold many agreements with, um, through, through you guys at Marco with, I think we even did a five year deal at one point with one of your clients. Um, we're happy to do those things. Usually the messaging and that, I've noticed a couple things on multi years. One is it's usually the larger the org. And when you're selling as a var, which as you know, Marco has a very strong var arm of what they do, it's much easier to sell multi-year in that way.

Banks, for example, love multi-year. I mean, oftentimes it's hard to find a bank that'll sign for like one year they want three. Uh, and there's reasons for that, right? Um, and so a lot of it does come down to relationship handling. And one of the things, we'll say a perch, oftentimes we'll say, Hey look, if we wanna do month to month for now, that's great. Let's establish a relationship. Let's prove the trust relationship there.

Um, but here is what it's gonna look like to do a one year and a three year. I just wanna lay these out in front of you so you can see the price difference if you're willing to commit to this. Because it really helps in our budgeting as well. And at some point, like when you, when you get a great relationship with that client that you will see them say, you know what, let's go ahead and budget in one or three year multi, um, it makes sense for them from a, an accounting perspective.

So that's kind of what I, I think there's no right or wrong way to do that. And, and I've noticed the smaller the client is, the more often you're gonna see month to month no matter what. It's just how they wanna roll and operate and that's okay. Yeah, Good point. Absolutely. And pre this year, you know, the churn rate among MSPs was historically low, right? Historically low. We've seen an uptick for the first time this year for a lot of the reasons we're talking about today.

Yeah, I like the, uh, I like the, I call it the stop the bleeding model, right? Don't bring on met new customers that don't share your ideal about security. Just, just don't add to the pile of the existing problem you have and then figure out a more supportive way to move those folks from where they are that are already incumbent to you to where they need to be. 'cause last thing you wanna do is abandon them. You know, they're your partners with them.

And so it wouldn't be the right thing to do. Just be like, yeah, we can't do business with you anymore. Um, you gotta try and help 'em along, but certainly you don't have to bring on more high risk revenue, um, and add to that kind of situation that you're already dealing with, Assuming you have a sales engine, uh, and, and you have choices. Sometimes the reason people do it is 'cause they don't and everything looks like a glass of water in the desert. Yeah.

Alright, so talk to us about, so in there Dustin, what, what your thoughts around that? Yeah, you know, this is something that came into, um, market. We, like I mentioned earlier, perch partner and I think it's been a little over a year, 18 months or into that relationship essentially. So that was a learning experience for, for all of us, including our customers as well.

Um, so, so my question is, you know, Wever embed perch other tools into our contracts and um, we got our small business owner, right? Our, our average customer is right around 35 to 40 users seats. That's our average customer size. Um, trying to help them understand the justification 'cause all some customers are offering it or some MSPs are offering that service, some aren't.

Um, um, and, and that seems to be still an area where we can continue to provide some differentiation outside of our people processes. But I feel like sometimes we're not quite hitting home at the importance of SIM and SOX services. I know, yeah, I know Aaron says he wants to be as mainstream as traditional antivirus. I mean, I think sometimes we're not in the non-technical space. We're not quite driving home the value add as, as well as we could.

And I'm kind of curious like thinking in mind of that small business owner that same thing speeds and feeds over. He's trying to run a business, wants business value out of the solution outta the relationship. But you know, you've got some cost justification tricks or, and different types of analogies. I know the dentist ones got brought up, but nothing that we could all benefit from thinking, like I said, in in parts of that small business owner looking to make a decision.

And typically we're, we're more expensive because of the inclusion of service we Offer. I I have some thoughts for you on this. Uh, shocking given. I that's shocking. Yeah. Given that I'm, we happen to be partners with Dustin and also happen to sell sock and sim services. So, you know, one of the things Aaron and I, my CEO joke about all the time is we have been able to build a company without, with like 90% of the time not using the word sim.

When we talk to a client or we talk to a partner and we have the luxury oftentimes, and Marco, you guys do this, Dustin, um, where I jump on with your clients and I'll talk to 'em a little bit and oftentimes I won't use the word sim and we can sell a deal without using and saying sim. And so what we sell on is who's watching the network. And I use you guys, many of you know, I use this analogy over and over a home security.

You put a home security system in your, in your home because we want it. We, we expect at some point a bad guy's gonna, and we know when they break in the door locks aren't gonna stop them. And so the the goal of the alarm system is not to stop the bad guys to tell us when they get in. And that works because a client's like, ah, I get it. And so what you're selling to me is the value of watching over my network. It's less about SOC and sim stuff.

So I think when we find ways to communicate that, that helps. I will also say, look, I'm biased, right? Like I wish everyone would, we, we sell it say this all the time, we want it to be as ubiquitous as antivirus. It's not there yet. And I understand that. So I totally understand a partner saying, look, we're gonna have two offerings, one includes that and some other things. Uh, and and another's more general. I get it. If that's the way to sell, I understand.

Um, I, I would say let's be patient. What you're going to see happen over time, especially where I think this is gonna happen is just me speaking, but I think insurance is gonna drive this too. You go talk to a Chris Laer, you go talk to a lot of insurance providers and they will simply say, if there is a breach and we have no logs, we are completely in the dark. And that just greatly increases our cost in the recovery phase.

And so you're going to see insurance companies begin to say, we must have some amount of logging in place in order for us to offer cybersecurity at all, both for the partner and for the the clients. And so I think we, if we wait another year or two, you're gonna see that continue to solidify and you're gonna see more and more insurance providers carry all that. But those are a bunch of thoughts I have around it. Um, Gary, what do you think?

Oh yeah, man, listen, you brought up the insurance thing. I don't want to get, you know, completely make it about that, but, um, something I've spent some time on right in, in in the recent months, and if we fast forward the way the trends are going, even two to three years, you're gonna see SMBs, you know, their rates are gonna go up and MSPs, they're gonna go up so dramatically if they can get it, that they're gonna have to put it into their seat cost.

And so when you tie that back and you can say to someone like, Hey, yeah, you're really a bunch more than the other person. Well hey, there's a bunch of reasons why this, this, and this, but one of them is that here's what we do around events and logs. Let me tell you how this correlates, uh, to, to insurance.

You know, what if I told you that if you had an incident that um, and you called your insurance company that this might be the thing that would get you paid or not paid on that, what would you say? You know, and that's a huge deal, right? For them. And that's where you start to, you know, so maybe you're 400 bucks a month more and the big scope of their business relative to, and again, let them attach a value to it. You don't give them that value. Dustin, do you know what I mean?

There's another thing to think about. I don't know where your seat price is, but you're bundling all this stuff. You start to get now the gap between the average MSP and top MSPs used to be, you know, 10, $20, $25 a seat. Now what I'm seeing is the gap between the average MS P and the top MSPs we work with, it's 30, 40, $50 a seat, right?

So what's happening with those top MSPs is, um, there's a percentage they're using that difference as a wedge, but they're also making a decision who their customers are and realizing that they might not get every 35 user business owner to understand or value that risk and they're gonna have to live with that. Gary, I I think the other thing too here is, and Justin from Tech Rug, you know the insurance if you guys have been on with Justin, yeah, he talks about this.

I think a lot of times, you know, again, if we're talking using your, your question, Jeff, Dustin sock, you know, soc sim, let me tell you why. It's almost like they're on one side of the table and we're on the other side of the table trying to convince them you need to do this. On the other side, what Gary's talking about and from the insurance perspective is, Hey, let's jump on the same side of the table. Pretend I'm your, you know, your CIO I'm your ciso, let's assume there's an incident.

Here's what's gonna happen. And this is where we have to get our knowledge up to speed. Let me talk to you about what's gonna happen when the insurance company calls, right? When you, when the in, when the lawyers get involved, here's what is going to transpire. Do, where do you wanna be if that happens? Has your MSP had this conversation with you? Has the other vendors you're looking at had this conversation with you? Because if not, we gotta get on the same page on this.

'cause I'm here to look out for you. Number one, whether you decide we're the right people or not, I'm here. Really, I go out and educate people. 'cause if things are changing very quickly, I wanna make sure you're making a decision with your eyes wide open. If that's us, that's great. That happens a percentage of time and we run a great business. But if it's not, that's okay too. But I want you to make that decision based on what you know, not on what you don't know. That's powerful.

Dustin, what do you think, man, what we're saying? Yeah, no, I, I agree. It um, again, the conversation's definitely evolving and I'm thinking of a couple opportunities and that I'm working on right now too are kind of changing the pace a little bit. And I was taking a couple notes here as well, so I yeah, I, I I completely agree. 'cause like I said, especially in a more inclusive offering like ours is, um, we are traditionally more expensive too. So kind of defending that and yeah.

And uh, Can I make one other suggestion? I'm suggesting that these are the kind of conversations you should be having with sales and VCIO almost together. 'cause it's the same conversation that you're having with your customers and that makes you in sales less of a sales person and more of a consultant. 'cause it's the same thing. We're just trying to help small businesses, man. Yeah. So, so Dustin, as you a talk about this last question, I'm bringing up Matt Hopper on here.

He had a, I hope I pronounce his name correctly by the way. Who? Matt? Matt, you'll correct me when you come up here. Yeah, I think it's Matt Hopper. Yeah, hopper. Alright. And um, so you had one last thing there, Dustin, on teams expertise. Can you walk us through that? Yeah. So yeah, uh, based upon this group's expertise, you know, I, I see this specifically for us too, this paradigm shifting, right?

We've included more tools and, and more, um, applications to help better manage customers and have, provide more and provide more, um, visibility into environment. But now we're probably in this balancing act of you got tools I walked that you got processes and then you got your help desk people, right? And, and so kinda my question is kinda what value do you place and let, let's just even separate kind of the tools and processes versus the people, the actual help desk.

Hey, I'm calling and I'm needed help. Is it a 50 50 split? Do you think the, um, we're in a position where applications and tools are gonna surpass the ability to answer a phone call effectively or effectively or what are your guys thoughts? Maybe Gary, you want to hit on that one first? Oh my God, I'm gonna have to give you the Reader's Digest version. I think this could be a whole episode of the cyber call. Okay. So, uh, literally I'll explode.

Like I have, here's the Reader's Digest version, okay. Of this, it's not about support and it's not about tools. I put the value I put on tools is their tools cost at 70% gross margin. Uh, the value I put on support is that cost per seat, whatever your cost per seat is eight, 10, $15 or whatever. You figure it out for support and they're assuming that it's gonna be good support. The only difference between MSPs isn't normally the level of support for the most part. It's their cost of support.

Some are efficient and do it for $7 a seat. Others are inefficient and it costs 'em $20 a seat to make their customers happy 'cause they haven't figured out that part of the business. It's those other things. What are the, what are those roles? What are those standards? What are the roles we have that are truly proactive and security based in our business that we can show the customer? We wanna minimize which tools we use 'cause that's our problem and we wanna minimize support.

And just assuming that the only thing that we can do is be less efficient and that's expensive to them. Does that make sense? Yeah, that makes sense. Makes sense. Yep. Gary was used to like to say, Hey, we answer the phone on the second ring. Yeah, exactly. Yeah. Right. We wouldn't answer on the first ring. We answer on the second ring. How do you like me now? Right. All right, great. Hey Dustin, thank you so much for coming on. Stay with us.

Um, yeah folks, if you have any other, we're gonna go right to the top of the hour. I know this Matt, uh, Matt pronounce your last name for me so I don't butcher it. Hooper. Longo. Hooper. Alright. Hey, and for Those of you we're, we're Hooper and he's got a good question And I do, yeah. Follow Matt on LinkedIn. If you want a good laugh every day. Um, Matt, you do a heck of a job getting those together every day. Seriously. I got a question for you and then we'll let you ask your question.

How long does it take you each day to do those? They're awesome. Every single day. Uh, it depends. Sometimes, uh, sometimes just a few minutes. Sometimes I'll just observe something and then write about it. Uh, I try to have a couple of them in the bank, but you know, there might be something that happens on my way to work that changes it a little bit. Well, you're, you're a legend out there with these things. I love what you're doing. Alright, bring us your question.

I thought it was an old web. I love what you're asking, so please, uh, come on. Sure, sure. So, you know, Windsor, we're trying to be real security focused and make sure that we're baking security into our offerings, but obviously that makes the seat price just a little bit higher. And so we'll go into organizations and we've done really well this year.

I'm not gonna complain there, but I do find that when we go into organizations and, and they're saying, you know, we wanna put more of an emphasis on security, and then we tell 'em what we can provide and how we do it, and they're like, oh yeah, that's great. But we, every once in a while we get undercut by somebody who is just doing the base offering. So the question that I have is, and, and, and you know, the security manager, I'm really invested in this. I want security baked in.

But should we do more of a, a la carte with security and, and just have that base offering like everyone else does? Or do we just bake the security in and make that seat price that much higher? What are your thoughts? Awesome. So I do want, I do have a question for you. Maybe Dustin, you know, we bring you into this too, but Matt, when I think the first thing you said was the customer says what they said something like, we wanna be more secure. Right? Something like that. Do you, yeah.

Do you, do you qualify them back? What does that mean in your world? Just curious. Um, well, I, I think I, I know what they mean. It's, it's basically that that risk versus reward. They say they want to be more secure. I liken it to, so my wife was a hairstylist for a while and she would get a client that would come into the chair and says, I want something completely different. She'd be like, okay, great. So should we take three inches off? And they're like, no, no, no, no.

Should we curl here? No, no, no. Do you want color? No, no, no. So basically they want something totally different, but they look the exact same when they leave the salon. And I think, I think organizations tend to do the same thing. They wanna be more secure, but gosh, we don't want that login banner and we don't, you know, we don't want to have to enter a a a BitLocker password when we start our computer. And gosh, we don't wanna spend that much more money.

What do you, how do you quantify that? What do you tell, uh, organizations? Do you wait for them to be breached, uh, before they start making it rain? Or what do you, what do you, what do you think Dustin? Y yeah, we've taken the approach where we don't, we don't separate, we don't separate the two. It's, it's all in one. It's uh, hey, this is, this is the package. This is what we believe.

And according to the NIST framework, and this is like I said, a testament of Mike Berger or our CISOs efforts, but is this is what we deliver to small to medium businesses Exactly like yourself. There's nothing we can cut out. Uh, we're not willing to sacrifice and we can't deliver a shittier experience either. So we can't, there's not a whole lot we can do with this. And, you know, do we win every deal? Absolutely not.

So I think we've taken the stance more so of, um, kinda like what Ryan and Gary said too, that just know that you're not gonna win every 25 30 deal. But I can tell you last week we had a customer that did get breached and their contract was up. And now we're starting to get these boomerang customers that maybe are starting, Hey, I heard what they said. I recognize what they did.

Maybe it isn't, the pastor wasn't green over there and we're just at this point staying back and we're comfortable waiting. Um, I certainly, and then we can come back and, and, and hold our margin essentially. But we, and some of it too is I don't, I'm not convinced that at this point our sales team is, is able to deliver the right message to separate the two anyways.

Um, so we're, we're trying to simplify it for both our customers, our technical team, and like I said, um, do we win every single deal? Absolutely not. Is it frustrating as all heck sometimes it certainly is. But we're, we're getting a lot of repeat customers that are our customers that have maybe chosen a lesser solution and came back just by our, our tenure and kind of persistence. So I have some thoughts on this too that I want to chat about, right?

And so like, here's some things to think about. If we were to go back to a la carte, we're, we're unwinding what we're doing and that's a problem. And unwind use Goes back to like what we were talking at the beginning of the call. Now I'm putting the client in charge to say, will you pick for what me what you want? And that would work if security were a hardware store. But security is much more like a general contractor. And here's what I mean.

If I go to Lowe's and I say, look, I want this widget and this thing and that thing, they're gonna sell me whatever it is. I want no questions asked. If I go screw it up and be like, ha, sorry for you. But it's the same thing happens with my contractor. And I say, I want a new roof. And he goes and picks out what he wants and he does it the right the right way. Or let's say something happens, it's not so good. Who am I gonna call? I'm call my contractor.

I'm gonna be really p****d off with him for what he sold me and why it doesn't work. And that is who we are. So if we unwind all that, what happens is we invariably go back to being break fix with cybersecurity and, and maybe a good litmus test for all of us. Like how many of us would be unwilling to unwind our, what we're doing for IT management and go back to break fix in that world. None of us want to go back to that ever again for all of these same reasons.

And so a lot of this comes down to command and understanding of cybersecurity and knowing how to say it. And Matt, I'm not saying you don't, you have a great job and a great command of this. I'm saying I think Dustin's right? I think there comes a point in time where you just have to have an honest conversation and you have to say, Hey, they can't secure you at that cost. I wish they could. If we could do it, we would as well.

We simply cannot secure you at that cost and neither they, and so this is where we're at. We'd love to have you, but if you need to go somewhere else, going back to the earlier conversation will help you find another partner. Um, but you've gotta put that line in the sand because the risk is too great for you and it's too great for us at the same time. And so those are the, the frameworks that go through my mind in answering that question.

Wesley, you wait, I want to hear Gary 'cause he was about to speak, but again, you, you aligned it to us sitting on the same side of the table. Like we, we sit on the same side of the table as our clients, you know, for me to sell you a less expensive solution that's not in your best interest, it's not gonna be secure. And therefore, let me find you somebody else, Gary. Yeah, listen, uh, you got good advice, right, right there. Um, both from Dustin and from Wes.

Um, the other part that I'll say is the same way when I sold and just version one and two of MSP, we never sold ingredients. Same theory applies here. That's not even the conversation that I want to have with the customer. I don't even wanna have a conversation about what's in and what's out. I'm gonna sell 'em at a conceptual level. 'cause that is where I can use our priced being higher as a competitive advantage and weaponize a competitor's low price. I can't do that.

If they have a menu in front of them and they want to know how much the nails cost, how much the shingles cost, what kind of shingle it was, like, I, I can't, I can't have both conversations at the same time. And I'm, if I'm dealing with the right decision maker, they shouldn't be qualified to have that conversation with me. I'm putting my arm around 'em and saying, listen, let me tell you where you are right now. Like this is the risk profile and this is what's happening to you.

Before I walk through the door, I just want to give you the, the ability to see it through our eyes. 'cause we have 30 other or 40 other customers we deal with. So we have a different view and I want to share it with you and almost get, I, I like to finally get to the point and say, well, let me ask you this. You know, let's say that security was a scale of one to 10 and no one gets to 10. Okay?

If you knew you were gonna spend $4,000 a month and you were gonna get to eight and at least be able to sleep at night and the only other choice was to spend $3,000 a month and get to five, if that was your only two choices, then what would you do? Matt? I'll spend the next 20 minutes with you, but that's your only two choices man. And I'm gonna show you why. True, true. Boom. Very good.

And That's what I call apply the ether, Gary, It's, you know, you, let's use a, you know, surgery analogy, right? Hey, I gotta take you in for cardiac surgery. Um, can you, you hold some of the, uh, you know, staples over here? Can you not cor you know, cut my staff in his veins over here, et cetera? No, no, no. We, we will hold all that. So Matt, does that help at all, by the way, going through any of that? Oh, absolutely. And, and it is really just more or less raising awareness and stuff.

The thing is, is that you still have the organizations and I meet with them regularly who, you know, they take the approach of that'll never happen to me. Uh, of course they'll never happen to me. And so it's, it's very difficult sometimes because as you guys know, when you follow my LinkedIn post, I stay away from fud. I don't like the, the fear, uncertainty and dread, I just don't like it. And I try to use some, some humor.

But at the end of the day, our, you know, our, all of our mission is to make sure that our customers are secure and, and we wanna make sure that message is getting out Reasonably secure, right? The other Gonna be secure. The other Thing reasonably secure, Sorry Gary, the other thing too is, you know, Sunil, you, we've had on and he does a great job, right?

Talking about assumed breach, you know, and what solutions, so I mean, I think we also have to bring a, a dose of reality to our clients, right? Nothing is gonna keep you a hundred percent secure. So if you're gonna assume at some point you, you're, you know, the bad guys are gonna get in, where do you want to be at that point, right? If we're gonna have a hurricane in Florida at some point in time, where do you wanna be in terms of your insurance, in terms of what your windows are like?

Let's assume that worst is gonna happen. And, and, and again, if you sit on the sadden side of the table, I think, I think those conversations might go a little differently. Hey, I know we're at the top of the hour. Ryan had a already bolt. We're a few minutes over. Fantastic. Dustin and Matt, thank you so much for jumping on, Wes. Thank you. Always awesome having you, Gary.

Always a pleasure and everybody out there wishing you guys a fantastic week and we're gonna do a lot more of this type of stuff. Let us know what you want. Shoot me an email, andrew@thecybernation.com. Until next week, have an awesome day everybody. Thanks everyone. Thanks Guys. Thanks.