From IT Provider to Security Partner: The Evolution of MSP Cybersecurity

Corey Nachreiner  0:00  
Hey everybody! Welcome back to the 443 Security Simplified. I'm your host Corey Nachreiner, the CISO of WatchGuard Technology, and as you can tell, this is a special episode coming from the WatchGuard Impact Conference in Nashville, Tennessee. You might also notice our co-host Mark is not here because he's probably downstairs speaking right now. But I do have a pleasure to introduce Andrew Morgan, founder of the Right of Boom. Andrew and I today will talk about the evolving role of MSPs in cybersecurity, lots of other ways MSPs are changing, and we'll also take some time to talk about AI in cybersecurity and how it's affecting MSPs as well. In any case, it's such a pleasure to have you, Andrew. You're like such. Oh, go ahead. No,

Andrew Morgan  0:44  
thanks for having me. Yeah,

Corey Nachreiner  0:46  
you're such a huge person in the MSP community. Why don't we just start by having you introduce yourself and tell us what you do, how you got into the MSP community?

Andrew Morgan  0:56  
Yeah. Well, thank you. I don't want to blow up my ego. It's I feel like you know I'm more of a you know servant, if you will, to the MSP community. I've had the pleasure of being in this crazy industry for three decades. Sat on the side of the MSPs when I started. We were system integrators and vars. There wasn't even a term MSP right in the late 90s.

Corey Nachreiner  1:18  
We started the channel, and it was all var.

Andrew Morgan  1:20  
Yeah, exactly. And I miss those days of making 60 points on hardware, you know. But yeah, I was fortunate in that growing up in the. I was talking to somebody recently about growing up in New York, but said, you know what? I got to get out of here and move down to Tampa.

Corey Nachreiner  1:41  
Cool.

Andrew Morgan  1:42  
And happened to meet a gentleman named Arnie Bellini, who said, "Hey, you know, I'm building some software. I want you to come see it. I was one of the first employees of Connectwise.

Corey Nachreiner  1:53  
Oh wow!

Andrew Morgan  1:54  
So I got this like vantage point right when the managed services was getting going right, and this is back in the day when Enable, I think they were called Nitro, right? And managed services and this idea of recurring revenue was getting introduced, and it was a rocket ship, to be honest. You know, just how you know MSPs were you know went from you know break fix to block time, and then they started hearing ways of what if you charge for an outcome instead of you know using time for money.

Corey Nachreiner  2:32  
Yeah,

Andrew Morgan  2:32  
and so I was there for a number of years. I had a few stints away, but in 2016, I came back and started working on security strategy, cybersecurity strategy for Connectwise, till 2019 when we got acquired. I guess I wasn't really a private equity person, and I was helping some of the vendors in the space, like on their go-to-market, how to look at their integrations, and said, you know, I'm thinking of going on my own, and and I took a chance. The pandemic hit, and we all know what happened. All the peer groups, all the conferences, you know, went away overnight.

Corey Nachreiner  3:24  
Yeah.

Andrew Morgan  3:25  
Coming out of it, I was fortunate that I partnered up with a few of the big sponsors of this event that we called V Cybercom. We had 1,700 people.

Corey Nachreiner  3:37  
Wow.

Andrew Morgan  3:38  
Over the course of a week in this virtual conference.

Corey Nachreiner  3:41  
Was this the first time? It

Andrew Morgan  3:43  
was the first, literally, from what I know, the first webinar, right, or big con, if virtual con, because the conferences had shut down. Coming out of that, people had such a great time. We had CTFs during it. We had all these incredible speakers. People like, what are we going to do now? We want to stay together. So that was the impetus for something that you came on recently, which was the cyber call.

Corey Nachreiner  4:13  
Yeah.

Andrew Morgan  4:14  
Now, in six years later, I think something in the neighborhood of 30,000 MSPs have viewed one or more episode of it, and and then last but not least, getting to write a boom. I thought there was an opportunity to really work on two big personas in the MSP space: the director through C-suite on how to build security practices, whether you're building a VC sub practice today, an AI governance and advisory practice, a CMMC practice, I thought there was a real opportunity to bring in experts that have built, sold, exited successfully those types of businesses, and then for the hands-on practitioners, I wanted to bring in true. Cybersecurity talent, people that have trained at Sans, you know, been Sans instructors, Eins instructors,

Corey Nachreiner  5:08  
transox,

Andrew Morgan  5:09  
yeah, and and bring those practitioners in to train, teach and train. So, a typical MSP, if it's a practitioner, Corey, they'll leave with. I think last year was 24 to 26 CPE credits they could apply to ISC squared or ISACA, and for the business, what's

Corey Nachreiner  5:26  
that? That's almost a year of CISP right away. You're almost there,

Andrew Morgan  5:30  
right? Yeah. So that's really been the ethos. We finished our fifth year, just shy of about 1000 attendees. That's

Corey Nachreiner  5:38  
awesome. It's such a growing conference for only six years. Yeah. Normally, by the way, I'd be asking your your hacker origin story, which is for some of our guests that either got into IT specifically or security. But your role seems to be more business. So tell us, how did you really get into you know whether it's sales, whether it's business and marketing? Yeah. Was it all through Connectwise or

Andrew Morgan  5:59  
no? You know, one of my first jobs, or I think it was my first job, Corey, was literally knocking on doors and doing 100 dials a day for the payroll company ADP.

Corey Nachreiner  6:12  
Yeah,

Andrew Morgan  6:12  
and it was

Corey Nachreiner  6:15  
real sales.

Andrew Morgan  6:15  
Real sales. Yeah, I mean, I mean, I think there's a lot of companies in the channel today that really do have that methodology or mentality. Certainly not going out and banging on doors, but but boy, you know, hammering the phones-it's an art, and it's not easy. But it taught me a lot, and you know, going from there, I did get my my tech hat on. I the first PC payrolls ADP had was on OS two.

Corey Nachreiner  6:53  
Oh wow!

Andrew Morgan  6:55  
That that obviously yeah that they they were supposed to beat you know Windows, but it didn't work out that way.

Corey Nachreiner  7:02  
Do you remember using it for a brief time?

Andrew Morgan  7:04  
Yeah. So I put in some of the first PC payrolls. I got sent out to Detroit. I almost, I almost got killed, but literally. Yeah, I had a break. That's

Corey Nachreiner  7:15  
a story. Yeah.

Andrew Morgan  7:16  
Yeah. You want to hear a little? Yes. So when I got out there, they said, "Hey, whatever you do when you drive into downtown Detroit, make sure you look at the overpasses. And I'm like, why? They're like, oh, well, people are throwing bricks into people's windshields, and about nine people have been killed so far this year.

Corey Nachreiner  7:35  
That's crazy. Yeah,

Andrew Morgan  7:36  
this was in the late '80s. I was one of the recipients. Luckily enough, inertia. the brick went over the vehicle, but I was covered in glass. But I but I was fortunate to to survive that fun experience. Did you make it to

Corey Nachreiner  7:54  
the sales car where you were going?

Andrew Morgan  7:55  
I had to turn around that get another van, but eventually I did. Yeah,

Corey Nachreiner  8:01  
I'm glad you survived. Nice to have you. So obviously, it sounds like you've been part of the MSP community for at least three decades with Connectwise and other jobs. So my question is, how do you think the MSP, the managed service provider who does IT services for sure, how how they have evolved into the role of cybersecurity and in in a difference compared to MSSPs who focus only on it.

Andrew Morgan  8:26  
Yeah, yeah, yeah. So let's talk about MSP. First of all, I have to say I'm incredibly. I want to say these proud. I think like when I look back around 2016, and MSPs. When I started talking to them about you know frameworks and and you literally get blank stares from not everybody, but a lot of people are like what NIST CSF what

Corey Nachreiner  8:54  
yeah

Andrew Morgan  8:54  
and you know MSPs have really in 10 years, I'm. I think in a lot of ways, truncated 25 years of cybersecurity. Now, again, your mileage will vary based on MSP maturity, and I'm trying to stay focused on each piece of the question. I think what one of the things that private equity has done for the MSP space. If there is a positive, the infusion of equity has allowed MSPs that have gotten it to probably evolve more than they would have without it.

Corey Nachreiner  9:34  
Yeah.

Andrew Morgan  9:35  
Right. When you can, you know, when you have capital, right, you can focus and bring in roles that in 2016 you didn't have security analysts in MSP. It was unheard of. We didn't have a CSO in an MSP. That was unheard of, right? A cloud, you know, detection engineer, unheard of. So. The evolution has been pretty, in my opinion, pretty profound in a short period of time. The other thing it's done is you look at you know some MSPs today doing compliance services. It's pretty, again, remarkable where we were 10 years ago and where we are today. Is Envia MSP able to do that? Absolutely not. That is there are there are haves and unfortunately there are have-nots. But I would say you know Gary Pika, a very close friend, and he's awesome. He built True Methods and and you know he used to talk about a rising tide floats all boats, right? And you are seeing you know this evolution of hey MSPs that started you know providing different and better layers of security. You know we use overused term defense in depth, but doing things they hadn't done previously. I mean, and you can even see it in good or bad. I'm going to give you both sides of the equation. When I started in the space, you had a few tools. You guys have been an amazing firewall vendor. Just celebrated 30 years, right?

Corey Nachreiner  11:17  
Yeah.

Andrew Morgan  11:18  
You had firewall, some email security, and an endpoint and an yeah and an antivirus. I mean, so your tool stack was your PSA, your RMM, and a few tools. I mean, the average MSP today is around 60 tools.

Corey Nachreiner  11:34  
Yeah.

Andrew Morgan  11:35  
Now, does it mean everybody can wield every one of them effectively? Not necessarily, but tactically, the tactical part of cybersecurity has evolved tremendously. Then you get into I think the more nuancing, right? The advisory services. Can you do compliancy work? VCO work, like, and so so that that's where I see the evolution, and then you know the difference between MSP and MSSP. Interestingly, you know I think when we started hearing the term with the extra S in in our industry, it was like oh my gosh, they're so an MSP MSSP. You know gosh I want to be that. A lot of MSSPs are on the margin, Corey, and you probably know this

Corey Nachreiner  12:24  
with security services. Yeah,

Andrew Morgan  12:26  
that and or a big VAR.

Corey Nachreiner  12:28  
Yeah,

Andrew Morgan  12:28  
I mean, if you look at, no offense, but if you look at the Optives of the world, right, a huge portion of their businesses resell. Yeah, right. Do they have good pen testing teams, absolutely they do. Do they have good socks? Yes, but you know, today an MSP, you know, take a Thrive as an example. You know, Audie Batista, their SVP of security operations. I mean, they run a world-class security operation with I think is up to about 100 people in in their soc. So there are MSPs that are really come a long way doing world class work. So that I don't does that help a little bit to that question? Yeah,

Corey Nachreiner  13:16  
I'm curious too, and this is a kind of a new question. I I have my bias here. Yeah, is there money in it? Because you mentioned there used to be in the VAR industry 60 points in hardware. That that doesn't exist now. I feel like MSP VARs integrators have moved to MSSP because you know the products that they used to sell will make them some money. But there's other than software, there's not a huge margin, and the services are where MSPs can really build profit, really can get their EBIT up there. And I've seen that in the types of services that are growing among MSPs, cybersecurity ones are that that have a big profit. Have you seen that? Are you seeing are MSPs looking at cybersecurity as a new service profit center that's increasing their EBITDA, or do they see it as a cost that they still haven't figured out yet?

Andrew Morgan  14:07  
It's it's a it's an excellent question. I think it's it's literally a double-edged sword, Cortney, if you think about it. Meaning, if you've been a mature, profitable MSP, and the ones that coming out of the pandemic, when really cybersecurity services, I mean, took off like a hockey stick.

Corey Nachreiner  14:28  
Yeah,

Andrew Morgan  14:28  
they were they were certainly trending upward. But two things happened coming out of that. Obviously, the threat activity went through the roof, as we all know. But the security services, MSPs, in a matter of 24 months, many of them that were mature ran ran well, worked really ran good businesses. They they had the money that was dropping to the bottom line to build good security practices and start to. Figure it out, and you saw MSPs that back before the pandemic, you'd be like, "Oh, you're charging $160 a seat. That's amazing. Well, two only four months after the pandemic, you were seeing 270, 300. It's not uncommon to see those price points now. So, are people making money? Yeah, if they're mature, well-run businesses, and again, the PE money speaks for itself. Private equity doesn't invest

Corey Nachreiner  15:31  
if

Andrew Morgan  15:32  
there's money to be made, and they're

Corey Nachreiner  15:34  
looking for EBITDA.

Andrew Morgan  15:35  
Yeah, and well-run MSPs, like there's a few businesses that private equity really loves, they love pest control. Why? It's recession proof. It throws a lot of points to the bottom line. On the margin, MSPs recession proof, right? And what's happening because of the labor markets? You're seeing MSPs go up market higher than like when I

Corey Nachreiner  16:04  
mid market

Andrew Morgan  16:04  
when I started exactly when I started 25 to 70 like if you were like oh we have a lot of 75 employee companies you're like whoa you're I mean Thrive I'll come back to them just using an example right they play in the 500 to 5000 employee space, mainly co-managed. You're you're well-run, mature MSP. Not uncommon to have companies 250, 300, 400, 500 employees. Like I'm thinking of Steve Fradkin of Intiva, right? That there are really

Corey Nachreiner  16:39  
private equity. There's a lot of M and A going on with MSPs. On and on, yeah. I mean, like New Charters here right now, right? Absolutely, F12. Yeah, F12.

Andrew Morgan  16:47  
Kel, you know Kelvin Engen. He's here. Like well-run MSPs are doing really well, more than ever. Again, the the not so nice part about this is the separation. Corey, has never been greater. Meaning, the ones that are maturing

Corey Nachreiner  17:07  
is very far away from yeah,

Andrew Morgan  17:09  
yeah. The ones that are mature, like I was, I had dinner last night with Calvin Engen, and we were talking about like the maturity of his operation, the culture. They are pulling farther and farther away from other organizations. So, yeah.

Corey Nachreiner  17:28  
So speaking of that, just I don't know if you have raw numbers, but from your gut, we're talking about maybe the ones that have true security services versus the ones that are far away. What do you think the split is? Is it is it 5050 or is it more 20% have really got this true profitable MSP business and 80% are still trying to make the VAR tracks? I

Andrew Morgan  17:50  
think you nailed it. Like I still think we're in an 8020 world. To be honest, I think organizations like yours have been able to do Corey that offer MDR services. It's allowed, you know, the 80% at least, if they're, you know, have their pulse on what they should be doing, especially, you know, at the network and endpoint now, and what you're doing on ZTNA, right? These services are allowing them to do things they wouldn't be able to do

Corey Nachreiner  18:20  
otherwise.

Andrew Morgan  18:20  
Otherwise, they wouldn't be able to. How is a million or $2 million MSP going to set up a security operations center?

Corey Nachreiner  18:27  
Yeah, I agree.

Andrew Morgan  18:28  
Never going to happen.

Corey Nachreiner  18:30  
By the way, we we came to that conclusion simply because we were the product company. We make a great endpoint detection response thing, and we were like, we're making this for MSPs because they're going to provide the service, but we found out what you told us. We we have our our Calvins and our NCTs that may be able to run their own SOC, but we found that okay, they like the endpoint protect the EDR, but they don't have a SOC. They don't have the capital to make it, which is why the Huntresses, the Arctic Wolves existed, and why we got into the MDR service, so that makes sense.

Andrew Morgan  19:01  
Yeah, yeah, and it's it's smart. Look, it's smart for you guys if you think about it. Think, and I'll give the analogy to your question to the MSP, right? Why did you guys do it? Well, they're already using one of our services and products, and this is a lesson for MSPs, in my opinion, on selling.

Corey Nachreiner  19:17  
Yeah,

Andrew Morgan  19:18  
if someone's already paying you $1, it's way easier to get another dollar, right? And another dollar, right? Because they go, wow, they did a great job on my, you know, infrastructure, network infrastructure, and you know, IDS, IPS, that kind of thing. Oh, they're doing this. They got Panda now. All of a sudden, that's a great endpoint. EDR, I like that. Oh, they're doing this. MSPs also sales has changed so dramatically. We went from you know, you can have any solution you want as long as it's my all-in model, right? Buyer indecision as. Never been greater in any industry, not just ours. There's more decision makers than ever before, right? If you look at the research from the book called The Jolt Effect by Matthew Dixon, who is part of the work coming from the Challenger sale with Brent Adamson, they took all of the recordings coming out of the pandemic, you know, 1000s of recording, and analyze them with ML, AI, whatever you want to call it. But what they found was companies or sellers, the best sellers, right, are de-risking the sale and trying instead of trying to get, I want to get everything from you, Corey. You're going to switch your MSP and everything about it to me. What they're finding is the best sellers go, "Hey, people don't want to be wrong more than getting out of the pain. It's and so when they find out, okay, how do I de-risk this? How do I make things easier for you to get started, so I solve solve something, and then now that I'm you trust me and I'm doing a good job for you, right? I can eventually get the whole piece of the pie. So if you're struggling with a deal, let's say you got three deals in the pipeline, and these sales cycles keep going longer and longer and longer. Take one of them. Take the one that you out of the ones that you could risk the most on, and try it. And and you'd be I think pretty surprised when that's

Corey Nachreiner  21:31  
the easy win. Do it. Do it well. Show them that you have to. And really, I think that the code word here is whether it's a vendor to MSP or MSP customer. It's all about trust in this. If you're doing a service for somebody, you do it well, and they trust you. They will. That trust is what really builds the relationship more than every other product. But that will get the additional dollar shares later.

Andrew Morgan  21:53  
Didn't SaaS teach us this?

Corey Nachreiner  21:55  
Absolutely.

Andrew Morgan  21:55  
Like when you sign up for a SaaS solution, do you let's say there's one for $50, $300, and $1,000. Do you how many times do you sign up for the 1,001st?

Corey Nachreiner  22:06  
Probably not right away. Yeah, I think almost

Andrew Morgan  22:08  
nobody does, right? You you go for here. Oh wow, they I do like these this organization. They do provide great customer service. They are providing value to my organization. Oh, do you want to take the next step? And and Sass has taught us a lot about buyer mentality and buyers how they make decisions today. I don't want to make a bad decision anymore. That's more important to me than anything. I don't want to be that person in the organization that everybody points to and go, you made a switch MSPs. We were we were better off the way we were. We switched everything over. No, people want to go. Wow, let me see how you operate. Let me can you let me do this governance project, this compliance project, this whatever project. Gain their trust, move forward. It'll be there. You can gain

Corey Nachreiner  23:02  
it, etc. Awesome. One of the things that I thought about when you were talking about MDR is talking about MSP maturity in security specifically. What do you think are the MSPs' biggest gaps? And I thought of it because obviously, manage SOG. The first thing you might do as a service is 24/7 management of security, and a lot of them don't have the the capital to create a SOC. Are are there any other gaps besides that that UC MSPs have?

Andrew Morgan  23:30  
I'd say the biggest gap, and we, by the way, I'll give you a shameless plug. We created an accredited security leadership course, three days, taught by an amazing guy, right?

Corey Nachreiner  23:42  
Yeah,

Andrew Morgan  23:44  
it's it's it's not at our event, but we do it around the country called the yeah Certified Cybersecurity Leadership Stratus or CCLS.

Corey Nachreiner  23:52  
Cool.

Andrew Morgan  23:53  
The biggest problem or gap isn't knowing more isn't about technology and understanding cybersecurity. It's communication. If there's a one thing I tell every MSP to do is to understand how executives make decisions, specifically the CFO, because if I can't translate, right? Pretend you normally speak English, and I'm going to tell you you can only speak Spanish. Stop speaking tech. Stop speaking risk about you know this control and this policy and this gap. They don't care. They want to understand how is going to impact me from achieving my number one goal and objective this year in the business

Corey Nachreiner  24:44  
to the CFO. Yeah, keeping all of that safe.

Andrew Morgan  24:49  
Right, my my biggest customers. How is it going to impact, for example, the CFO to say, hey, my number one initiative was to grow. This new division, and it's going to cost me this much money. That's what the CEO is driving for. Why in the heck am I going to reallocate any capital to you? Oh well, you you remember when I asked the CRO to come in the room, and he told me that his deals are getting slowed down because of these big security questionnaires. Yeah, we. If we do this trust center for you, here's how I can grease the skids of revenue in your organization. So,

Corey Nachreiner  25:28  
and I might be able to increase revenue because now we're trusted and it goes away.

Andrew Morgan  25:33  
Yeah. So get away. If they're like coming back to your question, it's not more tech. It's not more on you know another certification necessarily. It's how do I learn to communicate in the language of the business to get capital allocated,

Corey Nachreiner  25:48  
not risk management. When you said no risk management, it was more about technical risk management. Because to me, I do think risk management is part of the language, but it's business risk management. It's we want revenue, and we're doing this to make revenue. These things could be a threat to revenue or a threat to profit. And for this tiny amount of money, we can ensure that we keep this amount. So it's it's yeah. Thank you for that business language.

Andrew Morgan  26:12  
Thank you for the clarity. Yeah, absolutely. I'm not saying don't talk about risk to the business. I'm saying if it's like, oh well, we notice this gap in these CVEs and these acronym soup that you and I can talk about, and every MSP watching this. Oh, that feels good. They don't. They don't care. Doesn't

Corey Nachreiner  26:34  
care about that

Andrew Morgan  26:34  
at all.

Corey Nachreiner  26:35  
Yeah. So speaking of risk management and whether or not our customers are spending money on security. The question is essentially: Are MSPs doing enough to secure themselves? So I just kind of an uncomfortable question, but I believe MSPs themselves are a target because you know you earlier said you're really proud of the community. I kind of am too. We we focus on small to be in business to the mid-market, bigger ones, and it's clear that MSPs, those companies don't have IT. MSPs are the IT and the security of those companies. Threat actors have started to notice this. So an MSP, almost like a big enterprise, becomes an aggregator. If if I can get into an MSP organization who has remote IT management of everything? I suddenly don't just have one company's endpoints or system management software. I have everything. Do you think MSPs are doing the same for themselves, or they obviously have their mission of growing revenue and providing IT services? Are they focusing security on themselves as much.

Andrew Morgan  27:42  
Well, we've known for probably a decade now that threat actors are targeting MSPs, right? There's been countless attacks on them. I think MSPs are certainly far greater aware that they are a target-rich environment, and you know we talk about supply chain risk, right? We're arguably the number one supply chain risk to our customers because of you know command and control, right?

Corey Nachreiner  28:11  
Admin to many things,

Andrew Morgan  28:12  
yeah, for sure. And and so I that the awareness to MSPs, I think, is I I'm confident that if if they don't know that, then I'm really concerned. Go buy a pest control business. But if you don't know that you're an an A target for a threat actor, are they doing enough? Again, I'll steal an Arnie Bellini term, right? He used to, you know, talk about the shoemakers' kids, right? Go out, go without shoes. Unfortunately, again, this is where private equity and having money, or or being a even if it's not private equity, this is where a well-run, well-capitalized MSP makes a difference because if you're a well run, well capitalized MSP, more than likely I'm going to bet security and governance in your own organization is top of mind, and whether it's a fractional or full time resource, somebody's focused on protecting you, right? Because you are the number one risk to your entire operation, and so are they doing enough? I I think again it depends. I hate to be that's a lawyer statement, right? It depends, but it really does. Immaturity. I I yeah on the maturity, I think you know the amount of RMM abuse continues to grow. You you read about it in the research over and over. The living off the land attacks continue because again, if you're not whitelisting. Things properly, like you could have a remote

Corey Nachreiner  30:03  
pandemic made. I mean, MSPs have to remote manage their customers so they have that access. But if they're not guarding their credentials enough, they can come to vector in

Andrew Morgan  30:13  
for sure. And I'll just say one last thing, and something you guys know well is, you know, it blows my mind, you know, the VPN attacks, as an example, still right. You'll have a you'll have a something released a zero day, and you know Shodan results show that there's still

Corey Nachreiner  30:36  
tons and tons

Andrew Morgan  30:37  
78,000 unpatched systems. Like you don't think the threat actors are using Shodan or an equivalent to see that your management interface is running this version and it's so I scratch my head on that sometimes I work with a lot of the incident response firms in terms of either there are speakers at Write a Boom or I get to talk to them about incidents. Obviously, they can't tell me which MSP they're they're working on right now. But yeah, unfortunately, it still happens. But I think we're way better than we were. Yeah, way way better. I

Corey Nachreiner  31:15  
would say just in technology knowledge, MSPs know way more than the end users. You mentioned incidents, though, so you've probably seen how some MSPs prepare and respond to real-world incidents. What separates an organization, an MSP that responds well to those, versus one that kind of unravels when they have their first customer that maybe has ransomware or something?

Andrew Morgan  31:39  
Yeah, I mean, you know, the the trite answer, the simple answer is, oh, you know, do tabletop exercises, have a policy. I mean, that's the easy answer. I I think there's more to it than that because you know, during an incident, your nerves get rattled, and

Corey Nachreiner  32:01  
what you have to fight in order to handle it properly.

Andrew Morgan  32:04  
Exactly. the The companies that I've seen execute well, I'll give you tell of two scenarios. Ones that almost burned and went to you know to ashes because of a compromise. They come out so if they make it, they come out so resilient, and you know this will never happen to me again, and build just incredible businesses. Now that's not everybody, but preparing, you know certainly you know the basics apply, right? Do you have good cyber, good basic cyber insurance policy? I should say basic. Do you have a good cyber insurance policy? Do you have good you know incident response planning? Do you really? And probably one of the most important pieces of this, Corey, is the people. Who's going to be the quarterback if something bad happens, the CEO who maybe is a very emotional human being. Let's just say that may not be the right person leading this.

Corey Nachreiner  33:10  
We usually call it the war chief. Who who's the right war chief?

Andrew Morgan  33:13  
Who's the right war chief? And what happens if the war chief's on vacation?

Corey Nachreiner  33:17  
Yeah,

Andrew Morgan  33:18  
Clark Harshberger, who he's no longer, but he was director of incident response for CrowdStrike that we had on the cyber call. He said something I'll never forget. He's like, "Look, I've run hundreds of major incidences, and I can tell you in every one of them, no one pulls out the incident response plan. It's true, right? But what he said is the basics: run, have an ace, you know, something that's not digital. Have your call tree, right? And and yeah, really understand the comms plan, the comms strategy. Who are we going to call? How are we gonna, you know, let the team know? What are we gonna say to customers? Though those things probably matter. What would you say, and would we not say?

Corey Nachreiner  34:09  
Certain lawyers on retainer, having forensics on retainer, so it's ready to go.

Andrew Morgan  34:15  
The the comms are are arguably the most important thing because that's where you can really screw things up.

Corey Nachreiner  34:21  
Cool. For time's sake, let's transition a little to AI. So AI has been dominating the cybersecurity conversation. What is generally changing because of AI in the MSP versus what's mostly high? Could be cybersecurity or innovation or just AI usage in general.

Andrew Morgan  34:38  
Yeah, I'm going to give you my. This is again my opinion. Maybe people might go, "You're full of it, but this is my on what I'm seeing. All right, as I said, the MSPs that will run well, I'll just take this through kind of a chronology that will run well, doing well heading into the pandemic. The ones that came. Out of the pandemic, running well, implementing a strong cybersecurity practice, moved into also compliance practices. Right, we're the first to adopt automation.

Corey Nachreiner  35:13  
Yeah,

Andrew Morgan  35:13  
I'll use a. Let me just drop a name. Roost.

Corey Nachreiner  35:16  
Okay.

Andrew Morgan  35:16  
Right, not to be tool, but like we're the first to go. How do we automate in our business, right? Are also the ones that have gotten that right and are doing really, you know, let's say groundbreaking, but things that are you know evolving their business at a rapid, more rapid pace. Oh, by the way, are also the first ones in AI, right? Because you have to have that distinction. AI is a lot of time is the hammer looking for the nail. The ones that understand, you know what, mr. Customer, we did this and we found out that actually outsourcing this business process outsourcing was the right answer. Oh, we we thought it was AI. No, automation actually was the right answer. Oh, you know what? Yes, this is a good use case for agentics, but let's talk about how you feel this will impact again the business, right? What kind of things do you care about from a data perspective that could have a material impact on the business? Should things go wrong, right? What do we want to accomplish in the business? How is it going to enable the business? But there is that clear delineation of maturity doing it in their MSP first, building a service around it because they've already done the work internally. In each step, the I just walk through. Those are that's what I'm seeing. The

Corey Nachreiner  36:55  
high level easy answer is those that are actually leaning into new technology first, not necessarily to operationalize it, but making sure I'm going to be the first to learn new technology, including trying it myself and making mistakes and having successes, are the ones that have the right advice to tell clients. Here's where it works well. Here's where it doesn't work.

Andrew Morgan  37:18  
Yeah, and and here's the here's the here's a painful statement: Why sales matters so much in MSPs? Because if you are running a well-organized sales department in an MSP, and you have revenue coming in and dropping EBITDA, right? You can do things others can't. If you're, you can invest. If you're an MSP still working off referrals, relative to a well-run, well-organized MSP that has discipline around sales and sales methodology, and and are achieving objectives day in day out on those those goals, that I don't care what technology we're talking about, they have a huge advantage because they, as you said, they can invest, they can they can try things, they can fail.

Corey Nachreiner  38:14  
If

Andrew Morgan  38:15  
you only have this much money, right?

Corey Nachreiner  38:18  
You're limited.

Andrew Morgan  38:19  
Yeah, you can't fail.

Corey Nachreiner  38:21  
I think every company, you know, like even us at WatchGuard, if we're having good quarters and good revenue, we get to try new things. If we have bad quarters, we have to wait a little. So makes perfect sense. Transitioning a little to the cybersecurity, and this is more kind of for fun. What do you think MSP should be thinking about as far as AI, both from an attacker and defender's perspective.

Andrew Morgan  38:44  
Okay, from an attackers and defenders perspective, you know, let's talk first again internally first. The MSPs that are again understanding AI from a cybersecurity perspective are looking at it from you know, are they able to triage things in a more effective manner? I gotta believe. Correct me if I'm wrong. That's one of your.

Corey Nachreiner  39:09  
We definitely have done that in our soc and MDR team is an AI based, and it's the only way we can scale with the size of the the MSPSMB market.

Andrew Morgan  39:17  
Right. So you guys first said, hey, how can we use this? And if you look at the majority of socs and MDR providers, my daughter works for a a fairly big MDR provider. The amount of AI before they start even talking to their customers-that this is going back a year or two-it was all about their business, right? How can they use AI in their business? And when you start to see how AI can be used in your security operations, etc. when someone might say, "Well, we don't have a, you know, we don't have a SOC. We use X. We use WatchGuard. Okay, well, they're all. Certain things, whether it's ticket triaging, whether it's looking at your logs in M365, whatever it is, start to get a handle on it. Why? Because then you'll understand what threat actors are doing. You and I talked about I, I think it was on our podcast that we talked about, for example, you know, evil tokens.

Corey Nachreiner  40:21  
Yeah.

Andrew Morgan  40:22  
Right. If you think about the evil tokens and that phishing as a service, you could appreciate if you read the what Microsoft listed out in this very nice, like really well done blog, their research, the amount of AI that was used in the attack. But what was interesting about it, Corry, is it wasn't anything really novel. It was

Corey Nachreiner  40:45  
just accelerated.

Andrew Morgan  40:46  
That was it. That was it. It was like how could they accelerate the attacks using AI, right? Reconnaissance, you know, identification, exploitation.

Corey Nachreiner  41:00  
Yeah,

Andrew Morgan  41:01  
you know that that's that's what I'm seeing, and and

Corey Nachreiner  41:05  
the flip side is that's what we can use in business too. Anything that's a manual process, but a process you know well. It's a very defined process. Maybe it's something some way you bill as an MSP might be a great positive opportunity to use AI to accelerate that process. So I was going to talk a little bit about you had a fantastic post where you talk about how the frontier models are claiming some doom and gloom about security, also sharing the solution. But I'm going to save that for time's sake at the end that we should make sure to pull out the cyber call, so people can definitely go check your podcast out to learn more about that. So let's kind of switch to like really gut feel, little fast questions that might be general. Looking three to five years ahead, what will separate a successful MSP from those that struggle to keep up?

Andrew Morgan  41:57  
Yeah, we've taught on four. We've we've we've been probably beat this pretty hard already, right? It's the basics still, Corey. It's what why do threat X are successful? Yeah, because they focus on the basics. MSP, how

Corey Nachreiner  42:13  
are basic blockage

Andrew Morgan  42:16  
fundamentals, right? Build the sales engine, get good at sales. Your BC so practice, whether you call it one or not, get good at understanding what it's like from a business. Go interview business executives, CFOs. Understand how they allocate capital. Understand what would cause them to do something different in their business directives, based on risk, right? Grow your business internally first. Don't grab something and go, "I'm going to go sell it, right? Understand it first. Build a methodology, operationalize it, then take it to Market, right,

Corey Nachreiner  43:02  
cool. Second, really quick one. Oh, if I can get back to it. Sorry about that. What? And this can be generic. I mean, we forced the conversation on cybersecurity and AI, but what is the MSB industry not talking about enough right now?

Andrew Morgan  43:18  
Open Weight models,

Corey Nachreiner  43:20  
ah, so AI focused. But yeah, well, tell me a little bit about that. I mean, we I just mentioned frontier models, and obviously a lot of people are using public models.

Andrew Morgan  43:29  
Yeah, I think MSPs need to understand that we think about things from kind of a North American perspective. Our media is North American based, etc. The rest of the world, the adoption of open weight models is actually, I think it's a two to one ratio right now of open weight to frontier. Your customer, I said this on stage with you yesterday. Yeah, I said don't be surprised. I, in fact, like I said, I'll bet anybody, right? Give me a group of MSPs, 300 that sat in the audience, who wants to take me on a bet that in the next six months they're going to hear a customer say, "Hey, by the way, you know all that stuff about our data and wanting to protect it, and I'm really worried about it. Yeah, we bought two NVIDIA DGX Sparks, downloaded Mistral, and set up our own model internally, and we're training off of it.

Corey Nachreiner  44:30  
Now all your data is internal in your control, and you don't have to expose it necessarily externally.

Andrew Morgan  44:36  
Yeah, yeah, yeah. So we're gonna have to, you know, one things about MSPs is we've known for years, is we're constantly having to change. Like you're a dentist, our teeth haven't pretty much evolved too much. Yes, the technology to clean them and do stuff and upsell us and cross sell us. Yeah, that's all certainly changed. Yeah, guards, this, that. You know, plastic. But but we have to evolve constantly, and and I think you know Frontier, and then you know there's a great guy named Keith Hoodlet. He's going to do this session at Write a Boom this year. He runs research at One Password.

Corey Nachreiner  45:17  
Okay,

Andrew Morgan  45:18  
guy's brilliant. Look him up. He's going to do a session called Frontier and the Next Frontier, and it's on this very topic. Open

Corey Nachreiner  45:25  
models being the next frontier.

Andrew Morgan  45:26  
Yep,

Corey Nachreiner  45:27  
I think it's very powerful. It is the Wild West. My only worry about open models is they don't have to. You have the choice of guardrails. They give you the convenience of the control of your data, but as we're talking about public models breaking their guardrails. Imagine the lack of guardrails. Well,

Andrew Morgan  45:44  
let me give you one thing real quick. I want your take on this. Yeah. Right. Why do you think Nvidia bought Hugging Face?

Corey Nachreiner  45:51  
Well, they have all.

Andrew Morgan  45:54  
Right. I mean, people go get the cheat cheat codes, right? Yeah. And and get the you know all the things that they don't want to set up in their open weight models. I mean, if you're Nvidia and you invested 13 billion to buy that company, you're not thinking that they're putting their chips in a few different places. That's what I'm thinking.

Corey Nachreiner  46:18  
Absolutely. So one more question. You talked a lot. This is a really quick one. You talked a lot about, or actually, I'll skip the maturity one. But what is one cybersecurity assumption that MSP needs to stop believing?

Andrew Morgan  46:33  
Cybersecurity assumption.

Speaker 1  46:36  
Yeah.

Andrew Morgan  46:37  
Well, I think it's it's ubiquitous in MSPs, not just to cybersecurity, but it's about belief. What I mean by that is belief in themselves. Way too many MSPs don't believe things are possible in sales, in growing their businesses, and makes

Corey Nachreiner  47:01  
them maybe not take the step to mature.

Andrew Morgan  47:03  
Yeah, you know, I'll give you a great story. Brian Strong, CEO of 10 Hats. He, I, back in the day, there was this company called Claris Networks. Claris got bought one of the early acquisitions. It was a rocket ship out of Knoxville, Tennessee. Got bought by Tech Links, but he was their best salesperson, and this is in the 2000 879 area. He was back then selling $10,000 a month in MRR, right? He comes into 10 Hats five six years ago, and they're struggling. And he's like, "Look, we're gonna have to sell 10,000 a month to get out of this hole. Now he just is the CEO of the company, and they looked at him like, "What are you crazy? We've never sold more than $2,500 in a given month. Two different belief systems,

Corey Nachreiner  48:02  
yeah.

Andrew Morgan  48:02  
And he said, "We will. I've done it, and we're going to. He's taken that company in five and a half years from 2 million to 20 million organically. So it's it's really about what's in our head more than anything. Believe

Corey Nachreiner  48:18  
what you tell yourself. I think that's great advice. Well, thank you so much. This has been a pleasure, Andrew. Everyone, thanks again for listening today. Thank you, Andrew, for joining us. But before we leave, like, one, where can we find you on social media? And maybe mention the Cybercall podcast, where people can find that.

Andrew Morgan  48:38  
Yeah. So I think there's a few things. One, you were on the cyber call. Yeah, fantastic. Yeah, it was great having you on. You did a fantastic job. And your

Corey Nachreiner  48:47  
guests, the ones that join you regularly, are awesome, awesome people. Oh,

Andrew Morgan  48:51  
thanks. Yeah, every Monday, 1p.m. it's recorded. You can find us on YouTube, LinkedIn. If you follow me on LinkedIn, it's

Corey Nachreiner  48:59  
live, so people can actually ask questions while it's going on. Yep,

Andrew Morgan  49:03  
it's interactive. So the Cyber Call. Then if you go to WriteAboom.com, our conference is coming up in February, february 2 at the MGM. You're going

Corey Nachreiner  49:12  
to be doing some really

Andrew Morgan  49:14  
cool stuff, breakout sessions and workshops. So yeah.

Corey Nachreiner  49:18  
Well, thank you again, Andrew. Thanks for being with us.

Andrew Morgan  49:21  
Thanks for having me, Cora. It was awesome talking to you.

Corey Nachreiner  49:23  
Awesome. As always, if you enjoyed today's episode, don't forget to rate, review, and subscribe. If you have any questions on today's topic or suggestions for future episodes, you can reach Mark on Blue Sky, but you can also reach me at Sec Adept on Blue Sky as well. Mark isn't on the show today, but he's at its mark. You can also reach out to us on Instagram at WatchGuard underscore Technologies. Thanks again for listening, and you'll hear from us again next time.