Round Two…

How does one go about building a community in the cyber wild? It starts with networking and connecting with like-minded individuals in the industry. 

In our latest “Fireside Chat,” Ostra Founder and CEO Michael Kennedy chats with Evan Francen, CEO of SecurityStudio, and Frank Gurnee, SecurityStudio’s Channel Director, on the topics of AI and Cybersecurity Marketing. 

There’s lots of great information in the wisdom of these industry thought leaders, from their views on AI to thoughts on the importance of authenticity and honesty in marketing. Listen in and learn from the best on how to build a community in today’s cyber wild. 

AI and Technology 

The conversation begins with AI (artificial intelligence) and its impact on technology. While AI is still in its infancy, tools like Chat GPT have made this powerful technology available to anyone with a computer or a laptop. 

Our panel discusses both the upside and shortcomings of AI in output accuracy and whether it can (or should) integrate into automated processes in information technology and cybersecurity. 

Marketing and Community Building 

The discussion then shifts to marketing and community building. Michael and Evan devote a lot of time to the key elements that form the basis of any technology solution’s marketing strategy. 

Both cite honesty and relational sales methods focused on solving clients’ issues and/or providing quantitative value as the core properties of a sound marketing ethos. 

View The Entire Conversation 

Click on the video link below to watch the entire video chat or scroll down to read the full transcript. 

Resources:

Video Transcript

Frank Gurnee (00:25):

So thanks for joining us again today, guys. We are excited. A lot of what we’re gonna be talking about today was based on your feedback from the last fireside chat we had. So with that, I want to introduce our my esteemed co-hosts here. So first and foremost, we have Michael Kennedy, who’s known as Kennedy. So Michael Kennedy runs Ostra, and Ostra is a managed Security-as-a-Service company. And so done a ton of amazing things in the industry. Been around a long time. As you can see, we all have the gray hair, and we’re just talking about our ages here. So their beards are a little longer than mine though, so I, I gotta catch up guys. So Michael Kennedy, and we’ll call you Kennedy, going forward here. How are you doing today?

Michael Kennedy (01:13):

I’m good, thank you. Thanks for having me. A little, a little cooler here in the office with a big fire back there, but then if I, I have a bright light shining on top of me, so you might get a little bit of that every once in a while, but

Frank Gurnee (01:24):

Yeah, we’ll have to figure out the name. Is it still fireside chat during the summer, right? What the change?

Michael Kennedy (01:29):

Yeah,

Frank Gurnee (01:31):

So also we have Evan Francen. So Evan is the, well, you’re the CEO of SecurityStudio. You are the founder of FRSecure. And just kind of changed spots there as, as CEO to step down, but still a integral part of the whole thing. And man, Evan Francen’s been doing amazing things in this industry for many, many years. And and we’re really excited to have you on as well. Evan, how are you doing today?

Evan Francen (02:01):

Doing well. I’m in Mexico. Looks, it’s good. Yeah.

Michael Kennedy (02:05):

Looks beautiful behind you.

Evan Francen (02:07):

Yeah, it’s good.

Frank Gurnee (02:09):

Yeah, look at those flowers, man. That’s awesome.

Evan Francen (02:11):

Yeah, my wife does those. She did the other ones too. So many flowers. Flowers and throw pillows.

Frank Gurnee (02:18):

Yeah. Love that. <Laugh>.

Evan Francen (02:21):

Not digging the throw pillows, flowers.

Frank Gurnee (02:23):

Well, awesome guys. So, you know, what we heard a lot in the last fireside chat was you know, guys are, are really wondering or wanting to pick your brains around things in the sales and marketing side of things. So we’re gonna get into a little bit of that today. But anybody have any opening remarks? Anything you guys have been seeing out there? Anything you want to talk about that’s kind of hit in 2024 where we kind of jump into those things?

Evan Francen (02:53):

That’s an open, that’s such an open-ended question, right? Yeah.

Evan Francen (02:57):

I don’t know. I was talking to a professor friend of mine this morning from the University of Minnesota, Master’s or whatever, and he got me started on AI and that, that led to a whole long discussion. Yeah, I mean, you could take this anywhere. I don’t even know where to start.

Frank Gurnee (03:19):

Yeah, well, what what Elon just just turned on a new link, so we heard that Right. And we heard obviously AI, man, that’s, that’s kind of going crazy these days, so you’re right. What impacts do you think some of that stuff’s gonna have this year?

Evan Francen (03:36):

Well, it’s like anything, you know, there’s nothing wrong with the tool. It’s are you using the tool? Right. You know it’s about being responsible with the tool. You know, there’s nothing wrong with a table saw, you know, but I wouldn’t give a table saw to a toddler, you know, so I wouldn’t get Yeah. AI is the same way, you know it. So what I use AI for, other than, you know, stuff that other people probably shouldn’t, but is you know, create ideas a lot. I’ll use AI. You know, I’m working on the latest curriculum for securing complex environments. And so I asked, you know, just work with Chat GPT to give me some ideas on what I can create for an exercise for this course. You know, stuff like that. And I was talking to a friend about bias and, and people don’t, and an un an irresponsible way to use AI is to, is to not be discerning with the input, with the output, to not understand where it comes from.

Evan Francen (04:44):

One of the things my father taught me as a child that was, thank God, was always considered the source. And so people, you know, will argue that, well, AI is not biased or whatever. But, so I, I did a demonstration where I asked AI to, if God exists, you know, let’s see the bias. And when you ask a yes no question, and this is a tip for anybody, when you ask a yes no question, the only unbiased response, valid responses are yes, no, I don’t know. Anything else is bias. And so, you know, this long discussion with AI before you finally get to a point where, and it’s talking about its beliefs, and I didn’t ask you about your beliefs. I mean it all the way to the point where it finally admitted it didn’t know. But I think somebody who’s not discerning and doesn’t think critically would’ve taken the first answer that AI would’ve given it, given them and just gone with it, you know? Yeah. And so that led to a whole discussion to this morning about, you know, where AI is going and what I think it’s gonna do to us.

Frank Gurnee (05:54):

Yeah, I think that’s a good point. The source, right? I mean, I mean, because it’s trained, so it’s trained on something from something. And, you know, how accurate was that information that it was fed? You know, what was it provided? That sort of thing. So that makes, makes a ton of sense. Yeah. As far as something that should be a concern to everyone, right? Because especially as you lean more and more on the validity, the information, you know, the, the, is, is this true? Is this not? Or, or you’re just blindly sending it out, right. Which I think a lot of people are using it for content and things like that, that you know, could essentially be completely wrong at the end of the day. And so, you know, that’s put out there and lives on Google and everywhere else as the truth, as fact, and it very well may not be. Yeah.

Evan Francen (06:42):

So go ask AI if God exists and, and play around with it. That’s one of, that’s one of the great questions because us as humans, you know, still debate that all the time, right? Yeah. Belief, belief in faith. But it’s, it is a yes no question. And so the, it’s yes, no, or I don’t know. And anything, you know, beyond that, and the same use, the same thing when you’re talking with people with humans,

Frank Gurnee (07:05):

Prospects, right.

Evan Francen (07:05):

You know, identify, you know, the places where there’s bias and, and then you get to choose which one to do with it. ’cause There’s nothing necessarily wrong with bias, but what’s wrong is bias, ignorance, where you ignore the fact that there is bias. Yeah.

Michael Kennedy (07:20):

Or the, the false narratives. Yep.

Frank Gurnee (07:22):

Yeah. And I, you know, so what’s interesting about this topic, and, and we’re just kind of, kind of talking here, is you know, I, we go to these shows, we go to events, we’re hearing lots about cybersecurity. And man, the buzzword in the industry is AI. I mean, every cybersecurity solution out there is touting some type of AI. We AI this, we AI that, right? So is that just a buzzword or is that, is it truly something that they’re building into these platforms that is good for cybersecurity or I know I know your, your guys take Kennedy as, as people, right? A lot of, a lot of eyes on, on things. So, you know, what’s, what is the difference there? And, and, you know, how would you guys differentiate those two things when we hear this buzzword about AI and cybersecurity so much?

Evan Francen (08:12):

You get to go

Michael Kennedy (08:13):

First, I think. I think I do. Oh, I think there’s a couple per, so it, it got overused in the beginning, especially last, I would say before the Chat GPT and all the different LLM models. Everybody was in AI, AI, AI. And when you look, when you would peel that back, it never really, there wasn’t really anything true, like in, and, you know, as AI stands for and differentiated intelligence, right? So what the way that we look at it is, and why, where we wanna apply it or apply it, is around patterns, noise reduction kind of more of the data analytics, automation, running scripts and putting scripts together, and then automating those scripts to have it look at to help us reduce the noise for our SOC team. I, I, I think that like what Evan was talking about with the Chat GPT and, and how people use it is really going to be where we see some of that, that differentiator of, are they using it for as a tagline, or are they actually trying to use it for a specific initiative?

Michael Kennedy (09:34):

And I think a lot of companies started with it as a tagline and to machine learning and AI, and really but most of it is, is kind of in that, that l lms, the, the language models, the putting, you know, Chat GPT on top of it. But for us it’s, I it’s gonna be probably, it’s gonna be a and it’s, I dunno, it’s like all of those, I think about it is operationally. So IUI use it, I use Chat GPT, you know, to figure out what kind of I itinerary, I want to go on a trip, you know, going down to Mexico, what do I want to do? What are the things that I can do? I look at it to talk about if I, if I’m struggling to write something, then use it as an outline. And it’s the same with the way we as an organization try to use those tools of it’s only as good as the information you put in. And it’s not, it’s not I don’t, I don’t know, I I don’t call it intelligence because it doesn’t, it’s not sentient to me. So I, I call it you know, a bunch of automation scripts that scroll through everything and then help you decide on different parameters that are set. So

Frank Gurnee (10:56):

Yeah, it seems like, it seems like that, you know, AI, at least in my mindset, when all of these vendors, you know, tout AI, it, to me, it, it, it’s almost like, I think of it like, like that’s doing the analyzing or it’s looking at things and it’s, it’s a person which, you know, both, both Ostra and Security Studio, I think think of their services as professional services with people. And people are doing the analyzing and asking the questions and doing all of those things where, you know, it seems like a lot of vendors out there are, you know, again, touting this, this AI type of thing, which makes me think of like a person almost sitting there analyzing or doing these things, which, you know, maybe it’s a misconception. Maybe it’s, we’re just thinking of it wrong. But that’s, that’s how I envision it. Is that how you guys see it as well? Like from a marketing standpoint, what they’re essentially doing?

Michael Kennedy (11:55):

Yeah. And then also from a, well, the way I look at it is, oh, sorry, I’m gonna keep talking. It’s

Evan Francen (12:01):

Operation mean What they’re doing is they’re doing their job, man. Their job is to sell. Yeah, yeah, yeah. And so, yeah.

Michael Kennedy (12:06):

Oh, you almost can’t

Evan Francen (12:07):

Blame them for, you almost can’t blame them for doing it.

Michael Kennedy (12:10):

Yeah.

Evan Francen (12:11):

But it’s, you know, it goes back to the buyer beware too, right? Why would I buy something if I don’t know how to use it, if I don’t know how to use it properly? So why would I even give two craps about AI if I don’t understand how AI would actually benefit me? Right? So, you know, it’s not only do you have to deal with the bias in any AI, any AI, every single AI ever will have bias. ’cause It was written by human beings, right. The, the algorithm. And the second thing about AI that, that I think we often overlook is the, the number of bugs. Mm. That in AI, right? On average, seven to 10 errors per KLOC. A KLOC is a thousand, a thousand lines of code. My truck that I just bought, I was telling you guys about today, has 150 million lines of code in it.

Frank Gurnee (12:58):

Yeah.

Evan Francen (12:59):

You know, and so a security guy like me being a weirdo like me, which, you know, it’s sad that it’s weird ’cause it shouldn’t be weird, is I’m thinking through as I’m driving this truck, like, what happens if the accelerator sticks? What happens if, you know, I don’t know what all the things that these, that the code controls, but I’m trying to think of things that I, I’m gonna do when it goes sideways.

Frank Gurnee (13:24):

Yeah. No longer. Is it just a, you know, a cable that attaches to a, a carburetor and you go, right. Yeah. Especially

Evan Francen (13:31):

Especially something like with AI, when you sell it early on, like they were doing in, in the marketing, that should tell you that there’s a, a rush to production. (Yeah.) Right. There’s a rush to get it out. Well, when you do that, you cut corners. So if in fact it is AI, which it probably isn’t, but let’s say, you know, benefit of the doubt it is AI it’s probably buggy as hell,

Michael Kennedy (13:54):

Right?

Frank Gurnee (13:56):

Yeah.

Evan Francen (13:57):

I don’t like buggy, I don’t like buggy stuff on my network.

Michael Kennedy (14:01):

No.

Frank Gurnee (14:02):

Yeah. It’s something, you know, we combat a lot in the risk management side of things is the automated tools, the AI kind of thing, you know, people out there, oh, you know, you just run this on the network and you have a risk assessment done. And the reality is like, you know, I’m, I’m, I always kind of bring it up, like that’s all well and good. It might tell you there’s a backup on your network, but does it tell you how often it’s backed up when the last time you tested it? No automated tool can tell you that. So you have to ask questions, you have to have that professional approach and talk to people. And I imagine that’s the same, you know, when we talk about AI. So no, that’s fantastic. So down the marketing road, guys, like, you know, one of the things that came up in the last call we had you know, a lot of these businesses want more help in, in marketing and understanding in, in sales and all that good stuff. And you guys have both built, built, successful businesses. And so with that you know, what, what do you guys think are some things you’ve learned over the years marketing your businesses, maybe some failures, some things that you’ve run into that, you know, lessons learned, if anything. Do you guys have any of those? So I don’t, why don’t we start with Kennedy?

Michael Kennedy (15:20):

Oh, I got lots of them. The two or three things that hit the top of my mind is honesty and authenticity is, is the first one. When we are authentic, we go in and we’re transparent in our conversation and, and, and what we’re talking about then then, like our internally, we, if we don’t, we don’t lie. We don’t have to remember the lie, because it’s a lot easier to remember the, the honest truth. The, the other side of it too is I think where we, where we’ve struggled in the past is understanding who our buyer is in the business instead of, you know, we, we talk about, I’ve been in tech industry for quite a while, and where I’ll always end up going is very technical. Start talking about the packets and the widgets and, you know, the, the network design and the security tools.

Michael Kennedy (16:15):

Instead of and like Evan talked about, I think last time, it, it really, it’s pulling that back and it’s understanding the business drivers, understanding the business initiatives. How is that bus, where does security fit into their business plan? And then looking at it in that way, look, working with them as a a business entity rather than someone that’s just, just buying a widget. (Yeah.) And, and when we can, when we can get into that more of that thought leadership and that conversation with them around their business, then we seem to, we do better in that marketing and that, that stream, we get more adoption, we get more interest as well.

Frank Gurnee (16:59):

Yeah. I think that’s a good point, Kennedy, because the, the idea that we’re all kind of tech minded, right? And we, we love the tech side of things. We love everything we’re doing, and we tend to, if we’re the ones in charge of marketing, right? We’re, we’re usually like trying to drive the conversation around the tech and the, the high tech stuff and thinking about our product or our solution and what we do instead of thinking about the customer, what their needs are, who they are, do they even care about the tech, right? All of those things. And I think that’s, that’s one place where a lot of businesses, you know, have a, have the wrong focus or, or have bad, you know, spend money on bad marketing around the tech side of things sometimes. So That’s a good point.

Michael Kennedy (17:46):

I was gonna say, I was gonna say even to check a box too. (Yeah.) And they, they think they need an EDR, so they go buy an EDR, and then they, like we were talking about, they don’t, they don’t know what to do with it. Yeah. And now they have, and, and then they, it’s not configured, it’s not patched, it’s not updated, you know? Anyway, so, sorry, I’ll Yeah,

Frank Gurnee (18:04):

No, no, that, that totally makes sense. How about you, Evan? Any, anything that that comes to mind as far as failures in marketing or, you know, lessons learned things that you’ve done in the past with, with the couple companies that you have?

Evan Francen (18:17):

Yeah. Well, I’m not one, I mean, recognizing my own strengths and weaknesses. I mean, I’m not, I’m not a marketing guy.

Frank Gurnee (18:24):

Yeah.

Evan Francen (18:25):

You know, so, and it, it is funny ’cause when, when I started Security Studio, I, I had a call with Stu Sjouwerman KnowBe4, he’s the guy who started KnowBe4, people who don’t know. And I asked him, look, man, you’ve had so much success before. Where should I spend my next dollar? You know, gimme some advice. And he said, without hesitation, he said, marketing. I was like, marketing, what the hell would I spend money on marketing? That doesn’t make any damn sense to me. So I didn’t, and I think, you know, on, you know, I like, I know better than just do. I’m gonna do what I do <laugh>. And so that was one, what it reminded me is that there is value in marketing for sure. Right? And so then how do you create the right boundaries? And I think FRSecure, you know, on that side, they’ve done a fantastic job at marketing, you know, and they’ve grown enough to have a dedicated marketing team.

Evan Francen (19:22):

Same thing, you know, at, at Security Studio. And I think if you’re, if you’re a mission driven organization, it’s easier to market. (Yeah.) (Sure.) Because there’s things that we will never do. And if I find out about it I don’t know. I never had to, I don’t know what I would do, but it would be bad. And so you never lie to a customer. You never take advantage of a customer, right? (Yeah.) So there’s, there should be value in your service or in your product that you don’t need to exaggerate, that you don’t need to lie, you don’t need to take advantage. I’m, you know, this, this entire industry, the entire information security industry is a service industry. This is not a product industry. And so, keep that in mind when you’re selling products. If nobody knows how to use your damn product, or if it takes five people to, you know, to, to manage your product, weigh that against the value you’re getting out of the product.

Evan Francen (20:17):

I mean, go through this logical thought process because it, you’ll never, you’re never gonna be able to solve the people problem with technology. (Mm-Hmm.) (Yeah.) You won’t be able to solve AI won’t be able to solve it with any kind of spam filtering any other crap you’re putting, putting in place. You know, this is really a, a life issue. So from a marketing standpoint, it’s just tell people the truth. And we found that it only takes three things. I like simple, right? Don’t overcomplicate crap. It takes three things to get a customer trust, credibility, and likability. That’s it.

Frank Gurnee (20:51):

Right?

Evan Francen (20:52):

If they trust you, you’re credible and you’re not a jerk, chances are pretty good. You’re gonna get them as a customer.

Frank Gurnee (20:59):

Yeah. There, you know, there’s a few things that come to mind too in this conversation for me specifically around the business angle and, and marketing. You know, first and foremost, like you said, it’s, it’s, it’s not our wheelhouse, right? As business owners out there, as you know, tech-minded guys, you know, though, though, we’d love to do everything in the business, it’s probably something that we should either bring someone in or hire out to do. The second thing…

Evan Francen (21:29):

I don’t wanna do meetings. No meetings.

Frank Gurnee (21:30):

Yeah. (Right?) Yeah. I mean, and, and, you know, so many, so many business owners get caught up in the, in the little details because again, we’re, we’re tech-minded and focused. The color right? Or the (Right.) Or this you know, font or whatever. But that’s not getting your message out there. And the longer you sit on stew on that kind of stuff, the, the, you know, you’re not going very far while you’re doing that. But you know, another thing. So, so there’s that. Get outta your, get outta your own way, you know, hire someone to do it. The other failure I’ve seen a lot in business is you know, going out and hiring the wrong people and based on on promises, we’re gonna get you this many leads. We’re going to buy this date, have this, right, these, these promises of, of marketing and leads and, you know, generating X amount of business.

Frank Gurnee (22:21):

And you guys, I’m sure have run into this over time in both of the businesses where you’ve sank money into something and it just didn’t come to fruition. And of course, there’s no guarantees, right? They might tell you (Right.) there are, but so you, you really have to be careful there. I’d I’d say, you know, from that, that side, you know, going out and, and doing your research and making sure that, you know, you’re, you’re talking to people who can refer that, you know, a company to you that that’s gonna do a good job for you, I think is, is really important. The last thing I wanna mention, I’ll let you guys both comment on, on these, these things. But the last thing that I wanted to mention was just in that same kind of realm of things, the going out and spending that money and doing that is all well and good.

Frank Gurnee (23:12):

But there is not a guarantee, at the end of the day, you’re, you’re not gonna be guaranteed new business. So where you can almost guarantee business, especially in the MSP world, is your existing customer base. They’re the ones that are gonna refer 90 plus percent of your new business. So go back out to those guys and take care of your existing customers. It’s easy for MSPs to jump, always be looking for the next customer, but there’s so much that you can do with the existing ones. And especially as we build into this cybersecurity realm of things, that’s an area where you really can go back out to those existing customers and, and educate them on what’s going on out in the world. So…

Evan Francen (23:56):

Well, and I can promise (Any takes on that?) I can promise you, I can promise to any customer, and I can promise to any friend. I can promise to anybody that I’ll tell you the truth (Right.) (Mm-Hmm.) you know, and so value the truth, you know, the, you know, that’s why mission is so important to me. It keeps me honest. You know, if you focus on the mission, you’ll make money. If you focus on the money, you won’t make the mission. It’s that simple. And so, and you, you know, you live in a place like this, you know, it’s paradise and, you know, just bought a truck, you know, I mean, money’s not really a, it’s never been a focus for me either, but, but the, the coolest thing about it is I go to bed every single night knowing I never took advantage of somebody.

Evan Francen (24:36):

I didn’t sell them something they didn’t need. I didn’t lie to them to, to get them to buy some service that they didn’t need. I mean, and if I did, it was unintentional, and I need to know about it. You know what I mean? And that’s an open invitation to anybody at any time, because it goes against what I’m trying to be, you know, in the, in this, in this world. So you can always do that. You can always tell people the truth. You know, there’s always times when, yeah, can you do this one thing? No, I can’t do that. Or can I do this one thing? I think I can do, do it, but I’ve never done it before. You know, people love that. I’ve never had a project ever taken from me. I don’t do projects anymore, which is, well, I do projects, but, you know, weird shit.

Evan Francen (25:19):

The but it’s cool because I’ve never had a customer not take me up on that offer before when I was just honest. Like, I was asked to do an FDA validation. Have you guys ever done an FDA validation? Who the hell would ever want to do an FDA validation? But I was asked to do an FDA validation. I was like, so I read about it, I was like, I think I can do it, but I’ve never done it before. And they hired us, you know, and I think I did all right, you know, they still do business with us. But, you know, it’s stuff like that where I think we have to put up this facade like we’re something that we’re not in order to get customers, you know, we focus so much on our competition without realizing that 80% of the market ain’t even doing shit.

Evan Francen (25:58):

So rather than focusing on the competition and trying to beat them out all the time, why don’t you focus on yourself, be the best you can be, market that, and then then you’re not intimidated by your competition, right? Because I’m not competing against you. What I’m trying to do is partner with you so that we can go get the 80% that’s not doing anything, rather than fighting over the 20% that is. So, you know, I think so much of marketing is just, you know, trying to one up each other and it’s all, it’s all bullshit.

Frank Gurnee (26:26):

Yeah. Yeah. That makes sense. That makes a ton of sense. So yeah, with that, I mean, I think, you know, one of the things, so we talked about failures and, and things you shouldn’t do. And I think Evan, your advice to, to someone from a marketing perspective would be to tell the truth. So that, (Always.) that makes, you know, that makes a ton of sense. And I think you absolutely should.

Evan Francen (26:49):

And just to clarify on that too, really quick. ’cause There’s two types of lies. There’s lies of commission and there’s lies of omission. A lie of commission is something that I told you that was outright untrue, right? And then there’s lies of omission. That’s me not telling you something that I should have told you.

Frank Gurnee (27:06):

Yeah.

Evan Francen (27:07):

And so it’s on both sides, the commission, I have the lies of commission, I have like zero patience for. None. (Right.) And you get fired for that. You know, it’s, it’s our number one core value you can’t compromise ever. And then the second one, the lies of omission, I’m a little less of a hard ass on that one, you know? ‘Cause I do that to my wife. I mean, she would’ve left me on that stuff. But, but the lies of commission and, and it, and it’s, so you have to live it out. It has to be part of your being. Like I told I’ll give you an for example. Oscar, Oscar Minks over at FRSecure, he asked if I could run this query for him of on this database right? To get a whole bunch of data for reporting and whatever.

Evan Francen (27:50):

And I told him, yeah, for sure. And then he checked in like a week later, he is like, so, you know, where’s it coming? I’m like, I sent the email off to the developers, you know, I’ll I’ll check in again. And, and then I realized this went on for like a couple weeks. And then I realized on Sunday that I never actually sent the damn email to the developers. And so I called him up on Sunday night. I’m like, dude, I never sent the email. It’s like, oh, that’s all right. And I’m like, yeah, but I gave you the impression that I did. You know, and in my opinion, that’s a lie of omission. I need to come clean on that shit. So, but I mean, you have to have that, that fabric of integrity, I think. And, and if you, unless you want to be, unless you’re in this business to just take advantage of people and make a shitload of money which makes you a target for people like me, which is fine too. I mean, I’m probably not gonna do anything, you know, outright, but I don’t know how you can sleep well at night knowing that you just took somebody’s money and you didn’t provide any value. Value that was commensurate with that money. So,

Frank Gurnee (28:56):

Yeah. Yeah.

Evan Francen (28:57):

It’s gotta start at the top, man.

Frank Gurnee (28:58):

No, that’s great advice. And, and Kennedy, you know, thinking about, you know, our audience here, MSPs, IT business owners, cybersecurity consulting firms, you know, when, when we’re talking about for them going out and marketing to businesses, you know, what advice would you have to, to those guys? As far as, from a business standpoint, from a business owner, like, you know, getting out of their own way kind of thing. What, what, what’s your advice?

Michael Kennedy (29:24):

I mean, honestly, everything we’ve talked about, you know. Tell the truth. Getting out and doing QBRs, understanding the business, asking the questions of, you know, where is the business going? Where are they growing, what new systems they’re buying and, and then working, you know, do they have a compliance, really, they’re trying to win a contract for compliance. So I, I, I always kind of look at this, you know, you talk about the mission before money. I also kind of think of it as, you know, we talk about like servant leadership. It’s also kind of, we’re here to serve our, our customers or our partners and then their, their customers. So that that end business user or that client that gets the emails that does the day to day, that’s the one I’m trying to take care of. And if we, when we go in with that mindset and our, and our partners, MSP partners that have that same kind of mindset of they’re there to help make it easier for that business to do their job you know, really that’s when that net net revenue, net revenue retention just skyrockets, when you carry that mission, mission in.

Michael Kennedy (30:39):

So I mean, it’s, it seems like it should be common sense. I mean, again, going back to telling the truth, you know, I, I don’t, I don’t have to remember the lies. ’cause The truth is reality. So, so…

Frank Gurnee (30:55):

Yeah, I think you’re a hundred percent right. And, and it’s, it’s believing in what you do is, is such a big part of this, right? I mean, like, there’s no gimmicks. You don’t, you don’t have to rely on, on all of that. If one, you’re telling the truth and you truly believe in what you’re doing, if you understand that this is a necessary thing that, that every business owner has to look at, should be doing, should be dealing with, then I think it’s really easy at that point to, to, you know, have people believe you because you know, you, you truly believe yourself, right? It’s just not just something you’re selling. So that’s, that’s, that’s great. I think the last thing on marketing really is, you know, I wanted to hit on was, you know, do you guys think that there’s like specific target markets?

Frank Gurnee (31:41):

These guys should be hitting MSPs who’ve dealt with small businesses for so long or, you know, are we thinking of it wrong? And it really is an opportunity for every business out there. Like, cybersecurity to me is something that is necessary for all businesses. But you know, a lot of people are saying, no, it’s compliance, but it’s this, it’s that. Right? So, but to me, it’s, there isn’t a business out there. I don’t care if it’s the smallest business, the who, you know, it could be the coffee shop down the street. The threat is the same. So to me, that’s, that’s how I think. What do, what do you guys think about that?

Michael Kennedy (32:18):

Yeah. My kid would love to stick a rubber ducky in your POS machine at the coffee shop. You know, so Yes.

Evan Francen (32:26):

Hold on, lemme make a note of that.

Michael Kennedy (32:29):

Oh, yeah. We gotta lock some stuff up. So I, I, all business needs what the, the problem that I see in the news and, and the cybersecurity in, you know, that is that we get the noise is the big ones. MGM Tar, you know, somebody was just talking about Target again the other day. All of these big organizations that have a data breach. I’m not talking about my dentist who had a data breach that now all my pi, PHI data is now out, out for sale. It has been out for sale for a while, but it’s out for sale. And then there was a ransomware that he couldn’t recover from, and now he had to shut down. So we don’t hear about the hundreds or thousands of businesses, small businesses that close every day. We only hear about the big noisy you know, the, the big tech executives sitting in front of Congress.

Michael Kennedy (33:27):

And, and we don’t, we don’t see those small businesses. So I, I think it’s a, sometimes it’s a disservice that people are have the awareness. They think they’re, they’re, they’re too small. They don’t have anything that’s gonna be compromised. But one, you know, 15 minutes. I mean, probably most of the people on this webinar in 15 minutes could probably own five or 10 businesses in this office park and, you know, an ACH transfer, and then they have to shut down. So I don’t know where I was going with my rant…

Frank Gurnee (33:59):

I mean, this, this kind of rolls into sales a bit. Yeah. It rolls into sales a bit. Yeah, Evan, when, you know, when thinking about this and thinking about those smaller businesses who really need cybersecurity help, but are not convinced or don’t believe that it can happen to them, right? Yeah. They, you could tell ’em all day long, Hey, you need to be worried about this stuff. How, how do, how do you convince them or get them to understand that this is something that they absolutely need and should be part of, you know, just your normal tech package or, you know, whatever your offer, your offering is. How do, how do you convince those people that this is a real thing?

Evan Francen (34:40):

Well, it starts with a relationship. You know, I mean, information security is a relational, it’s a people thing, right? And so we track a lot, you know, like time-to-close and, you know, all these metrics and numbers, and it kind of doesn’t matter. You know what I mean? It shouldn’t, I mean, I understand that, you know, to make business, you know, to make money, you need to track that stuff and make sure, you know, you know, make it smaller, whatever they do. That’s obviously not my strong suit either. But the it’s establishing a relationship, you know, over the years there’s been so many companies that said no to us upfront for whatever reason. And, but we maintain the relationship and they came back later and did the right thing. You know? So I think from an MSP standpoint, if you’re newer to the cybersecurity industry, meaning you’re offering services or products that you haven’t offered before, one; have the confidence to know that whatever you’re selling provides value to them.

Evan Francen (35:42):

Right? Because that’s gonna help you defend where you’re coming from, right? And so, and if you have problems defining where those values come, that’s why people like us are here. You know, ask me, I’m not gonna steal your customer. I got too much work to do already. You know what I mean? I would love to help you serve the customer. What I don’t want you ever to do is to serve the customer wrong. I don’t want you to ever take advantage of a customer, because that’s more mess that I have to clean up later. Plus, I hate seeing people get taken advantage of, you know? So when you talk about the market to approach whatever market you feel comfortable, every single business, everywhere that’s ever existed needs a risk assessment. Start with that. Right? And that should point you in the direction of what other investments you need to make,

Evan Francen (36:25):

if you’re confused about that or have a trusted you know, relationship with somebody like, like Mike, that can be like, ’cause Mike’s never gonna sell you anything you don’t need. If he doesn’t have a product to sell you, he’s still gonna have the relationship point you in the right direction. And if there’s a need later on, he is gonna, you’re gonna come back to him. You know, those are the kinda relationships you need to have. What, one of the things I would never, ever do is ever buy a product from anybody who is trying to sell me something that doesn’t know me, right? So if you’re, if you, if I get a cold email or a phone call and you’re trying to sell me some, I was gonna mention a whole bunch of company names, but I’m not gonna do that. No.

Evan Francen (37:06):

You need to know yourself well enough to know what you want, to know what you need without a vendor telling you what you know, you know, what you want, what you need. Right? Right. And if you don’t know what you want or what you need, that’s where you need to spend your time right now. Yeah. Because it’s your business. It’s not my business. If, if your business goes under, it’ll break my heart, but I’m still doing fine. You know what I mean? And so we oversaw self fear, but, and what I’ve been going a lot more lately is trying to sell value, right? We’ve always in, in our industry being, ’cause information security is a risk thing. And risk is always based on a negative consequence. So it’s always a loss prevention sort of discussion. But now that we’ve been doing it wrong for so long, I think it’s a great opportunity for me to create actual value to actually add something to your bottom line.

Evan Francen (37:56):

And one, for instance would be to do an asset inventory, start with the hardware assets. Let’s find all the hardware assets that you’re not using anymore, that you don’t need anymore. Let’s get rid of ’em. We just saved you money doing that. And from a risk perspective, from a CISO perspective, we just reduced the tax surface. Those are systems I don’t have to patch anymore. I don’t have to maintain anymore. I don’t have to worry about ’em anymore, and then go to software, do the same damn thing, right? And you’ll find that in a 12 month period, if you’re just engaging with a, with a, a new customer, mid-size customer, you might be able to save them tens of thousands of dollars, maybe hundreds of thousands of dollars just in those two things where I’ve now added to your bottom line. You know, because the language of business, we talk about that crap a lot. The language of business, according to Warren Buffet, who knows, like business stuff is accounting. So start communicating to them on how you’re going to make them more money.

Frank Gurnee (38:52):

Yeah. A lot of us in the managed service world use that with with communications, telecom agents and things like that. We would bring someone in and let them quote out and look at the existing telecom network, communication network and in doing that, typically pay for our managed services because they were on old antiquated T1s and things like that, all this kind of crazy stuff, right? And they’d come in, they’d say, we can put all this new high-speed stuff in, and you’re gonna save X amount of money. And we’d say, well, right there, paid for our managed services. There you go. Right? So in the same, in the same respect going in and doing asset inventory and things like that…

Evan Francen (39:34):

I was talking to another business leader who was, you know, complaining about sales last year or whatever. He says, ’cause they cut information and security budgets across the board. And I’m like, hell yeah. It’s like, what do you mean? I go, that’s less money that they’re misspending. You know what I mean? If you, if you can’t, if you don’t understand how, I mean there’s so many classic examples, and I keep going back to like the SolarWinds breach, right? This super sophisticated attack, which it was pretty cool, could have been mitigated with a firewall. Chances are really good every one of your MSP customers has a firewall. So is it being used properly? Right. And it’s not ingress, it’s ingress and egress. Right? It’s both ways. So there’s a great opportunity right there. I could, and there’s something I could use for marketing as an example.

Evan Francen (40:23):

Everybody heard of the SolarWinds attack, right? Did you know that the SolarWinds attack was mitigated by the IRS? And this is all public information because they had egress filtering properly in place. We wanna do the same thing for you. And the reason why I wanna do the same thing for you is present the same kind of attack, but also maybe identify some command and control, maybe a place where you, you know, we can do some threat hunting with that information. Whatever. It’s just a prudent thing to do, but you already have the tool, why not use it right.?You know?

Frank Gurnee (40:54):

Yeah. I think the biggest sales opportunity right now for MSPs is to go and create that next QBR. Go out to that customer that you have today and talk about what you’re doing. Do a risk assessment. You know, use our core assessment or whatever you have. If you have a spreadsheet, use it. Whatever you gotta use, do a risk assessment. Right? And that opens the door to the cybersecurity conversation, which funny enough, most, most of the customers think you’re handling this for them. So you have to like, you have to communicate to them that you aren’t. And in your next QBR, you could do that. You could say, Hey, we’re gonna come out, we’re gonna do a risk assessment for your business. It’s just part of our, you know, new thing that we’re doing or whatever. Go out there, do it. And then sit down with that customer and say, here, you know, there’s some things we haven’t done for you, and this is fairly new stuff, but you’re hearing about these things, breaches all this stuff in the news. It’s real, it’s here and now we can provide a solution that covers you for that. It’s not something we’ve covered before. And it only costs you this much more to add it to your solution. By doing that, not only have you notified them, it’s not something you cover, maybe you get additional revenue, but on top of that, you cover your ass, right? Because…

Evan Francen (42:09):

Well, not only are you not doing that for your customer, you can’t do that for your customer. (Yeah.) The people who are ultimately responsible for information security in that organization is the customer. (Right.) So have that discussion with them. How am I responsible for this? What information should I know on a regular basis? And that’s how I serve you. Right? I mean, any business that, I mean, you know, financial risks, you know, compliance risks, you know, legal risks, you know, all these other things, why wouldn’t, you know your information security risks. It’s just another risk. And (Absolutely.) You know, the MSPs that are good at serving their customers understand that and help their businesses.

Frank Gurnee (42:46):

Yeah. Did you have something to add?

Michael Kennedy (42:48):

I was gonna say, I think it’s how you approach it too, with them, right? You don’t going in with them and saying, how, how do you, how do one of the things that like we like to do in the QBR is, how is your organization with security awareness training? Are they, do you think they’re doing pretty well? How do you feel that they’re doing, getting them to kind of think about it and buy in versus us coming in and saying, you guys are failing at phishing. You have all this stuff. You’ve gotten a couple of BBCs lately. You really need to get security awareness training because you guys kinda suck. Instead of taking that tack, I mean, that’s honest, it’s truthful, but..at the same time it….

Evan Francen (43:27):

Well, but it goes back back to the relationship too, doesn’t it? I mean, because some

Michael Kennedy (43:29):

Relationship Yep.

Evan Francen (43:31):

Because some of those customers, I do have that kind of relationship where I can just come right out and tell you, you suck. But some, some don’t. You know?

Frank Gurnee (43:38):

Yeah. But then at the end of the day, if you can give them the data, so for instance, like with Teams or with with S2ME, you can send out the, you know, those, those assessments to the employees and then all of a sudden you have the data to say, look, yeah, we’re not doing so well here as you can see, you know, we sent this out to the, to the folks in the, in the organization. And so, you know, what we think would be a good plan would be to get you on some security awareness training, which would, you know, help, you know, potentially cover those, those issues that we’re seeing

Frank Gurnee (44:09):

rather than less, rather than obviously taking that other approach, which is like, you guys just suck and, you know, we know you’re not doing this.

Evan Francen (44:13):

We’re supposed to be deifying people. Right?

Frank Gurnee (44:15):

Right. Exactly.

Michael Kennedy (44:16):

You de-suck. I guess, I guess what I was trying to say is, is I want them to, I want ask ’em the question in a way that they’re thinking about it. Rather than listening to me just tell them that they need to give security awareness training. I want them to, I want to ask them in a way that says, what do you, how do you guys think this is going? And, and I want to get their feedback. ’cause Then I also, I hear different things too. They, if I’m just selling in that widget of security awareness training or, or getting ’em onto it, but I don’t get the feedback that they all hate it. It’s cumbersome. If they got it tweaked a little bit, they would do better. Or they’re, they’re afraid and, and because they think they’re gonna be policed and get in trouble for it. So…

Frank Gurnee (44:56):

Yeah, I think one of the biggest, biggest failures, I think one of the biggest failures we have as kind of tech-minded people going in and trying to sell things is exactly that. We’re trying to sell a thing to somebody. (Yeah.) So instead of selling the thing, we should be talking to them about how we’re gonna help them, what we’re gonna do. (Correct.) You know, what, what is it that it’s not the tech, it’s not this EDR solution or XDR or SOC or whatever, or you know. This type of protection. They don’t care about the thing. So your solution stack of what you put together is not correct. The thing you’re selling, you’re selling them the, this mindset, this idea, this protection, this, this peace of mind. Right? That’s what we’re, we’re providing to them and selling to…

Evan Francen (45:40):

Focus on the Mission and you make money,

Frank Gurnee (45:42):

What’s that?

Evan Francen (45:43):

That’s focus on the mission and you make money.

Frank Gurnee (45:45):

Yeah, exactly. And yeah, so that’s, those are great. Alright. So cool. Just thinking about, you know, sales and, and things like that I think a lot of people get caught up in not understanding how to get educated, what to do, this is all new. Would you guys say it’s a good idea for them to lean on their vendors that are providing these services and solutions to help them? I know for us, we help beyond even what people understand or know. So things like sales trainings and talking to them about, you know, their solution and their stack and pricing it and all these things that you wouldn’t think would come from a vendor. Is that, I, I know with Ostra you guys do a lot of similar stuff as well. Do you think that these guys should be leaning on their vendors to help educate them on all this stuff?

Michael Kennedy (46:39):

I do. I think it’s you for sure. You have to lean on your vendors, talk to other vendors you know, get involved in different cybersecurity type events, attend stuff like this, where you can hear people talk about different products or, you know, solutions in, in our cyber industry. The, the more it’s kind of going goes back to it, and I think you had it, you were talking about the more you know, you know, it’s like those, those PSAs. Yeah. And, and, and be able to, because I think for me, the biggest problem is making sure you don’t the Kool-Aid. So, you know, I’m never going to ask you to and go out and take a picture or video of you. You know, that honesty, that authenticity, that, that kind of transparency. That’s what you wanna look for in these vendors. And when you go have those conversations with them, pay attention to that and, and, and judge for yourself go with, you know, like what I do, I always go with my gut.

Michael Kennedy (47:46):

I listen to it. If it feels squeamish, then I’m not gonna carry forth and then I’ll validate with that vendor. But lean on them to kind of help you understand the tool and the product. Understand. And they’re not gonna know your customers like you do though, right? I mean, that’s, that, that’s really, they’re not gonna know how to communicate into the industry or the, the market that you sell into. That’s your sweet spot. That’s why you’re successful as an MSP in there. But definitely leverage them to help you, you know, kind of convey that messaging why this product or the services is important for them. Like security assessment. You two would be, if, if I needed to talk to somebody about why they should do a security assessment, I would pull you two into a conversation and say, “here…”

Frank Gurnee (48:34):

Yeah. Yeah. I think you know, it’s, it’s, it really comes down to understanding as you choose your vendors and as you kind of get in bed with the vendor and you understand (wait a second, what?) if they’re focused on just them, it’s, it’s not a good relationship. Right. If if the vendors…

Evan Francen (48:49):

We’re supposed to get in bed with them?

Frank Gurnee (48:50):

What’s that?

Michael Kennedy (48:52):

We’re supposed to get in bed with them?

Frank Gurnee (48:53):

<Laugh>. Yeah. Yeah.

Michael Kennedy (48:55):

A a twin size bad.

Frank Gurnee (48:56):

You don’t, Evan, come on. What, where,

Michael Kennedy (48:59):

Well,

Frank Gurnee (48:59):

I thought that was a thing that you, you did.

Evan Francen (49:01):

That’s another thing I I haven’t been doing right then. Put that on the list.

Frank Gurnee (49:04):

Right, right. You gotta, you gotta try it. Yeah. It’s pretty good.

Evan Francen (49:08):

I gotta tell my wife.

Frank Gurnee (49:09):

No the, you know, the, the idea of like the vendors, if, if all they want to know is how many of my thing are you gonna sell? You know, I’ll help you sell my thing. They’re not interested in your business. They’re not interested in seeing you grow. It’s really, every time I get on a call with, with any of our partners, it’s really about me understanding how to make their business successful. And, you know, some of that’s gonna kind of involve our solution or our product and sometimes it doesn’t and that’s okay. You know, I’ll have that conversation with someone to help them as best as I can with the, you know, 25 plus years of knowledge in this industry. Right. So, and I’m sure you guys are the same way,

Michael Kennedy (49:48):

Right? It goes back to that kind of survey side that’s…

Evan Francen (49:52):

I don’t know, (unintelligible) I haven’t been sleeping with the vendors

Michael Kennedy (49:54):

<Laugh>. No.

Frank Gurnee (49:56):

Right.

Michael Kennedy (49:57):

That would be kind of funny though. But it goes, it, it goes back to that kind of, that that survey side of, you know, the mission before money really, it, it, that’s, that’s it.

Frank Gurnee (50:07):

Yeah. Absolutely. Well, awesome. Did let’s see if we had any questions come in, I’d love to get to those. So we had some in the Q and A here. I

Evan Francen (50:17):

Type your questions. What

Michael Kennedy (50:18):

Up? Amen. Evan

Evan Francen (50:22):

<Crosstalk>.

Frank Gurnee (50:23):

Yeah. So all we

Michael Kennedy (50:24):

Umin Evan.

Evan Francen (50:26):

Amen.

Frank Gurnee (50:27):

So someone mentioned in when we’re talking about AI that they’re already seeing software developers using AI to automatically complete questionnaires for things like PCI, SOC two, et cetera. I mean, that can’t be a good idea. Is it <laugh>? I mean,

Evan Francen (50:43):

Well, I mean, I don’t know. I mean, I don’t know. It’s I don’t know what a, I don’t know what the AI is, you know, how it’s been set up, how it’s, you know, the algorithm, I don’t know. It’s plugged into, you know, so generally no, but you could, you could use it for that.

Frank Gurnee (50:58):

Yeah. Yeah.

Evan Francen (50:59):

Because that would be all, that would be all subjective data inputs. And the good thing about AI for compliance is it’s all, it’s all not subjective, objective. The good thing about a AI is it’s, it should be used for obje objective things. Check boxes. Yes/No questions. Stuff like that.

Michael Kennedy (51:19):

Automation.

Frank Gurnee (51:21):

Yeah. Yeah. And, and in, in automation, I think there, there is a pla there is a place, there’s, there’s things that can, (bags under my eyes) can’t automatically been done, you know, be done.

Michael Kennedy (51:30):

Quit showing off your tattoos.

Frank Gurnee (51:32):

Right?

Evan Francen (51:33):

I have bags under my eyes, Does this look weird?

Frank Gurnee (51:40):

Does look strange. <Laugh>

Evan Francen (51:41):

(unintelligible)

Frank Gurnee (51:43):

So, Jason said amen to whatever Evan is saying right now. That was a little earlier. Or you know, maybe when you’re (Jason, check’s in the mail. I’ll…) talking about getting in bed with vendors…

Evan Francen (51:51):

I need the address.

Frank Gurnee (51:53):

<Laugh> could have been then, you know, when you’re talking about getting into bed with vendors, maybe. Amen to that.

Evan Francen (51:59):

I gotta get clearance on that.

Frank Gurnee (52:01):

So Lyle, ask the question. So for marketing, how would you explain the difference between information security compared to cybersecurity? Since most businesses think of cybersecurity as a tool. So how do you

Evan Francen (52:13):

(unintelligible)

Frank Gurnee (52:14):

Make that difference?

Evan Francen (52:16):

So literally cybersecurity is a subset of information security. So information security covers administrative, physical, and technical control. So the people part of security, the physical part of security and the technical part of security, right. And I use, like if I was going to attack an organization, I would attack the people. I wouldn’t attack your computer. You know, I could, but the return on the investment is much easier just to ask you for a password than it is to crack one. So the administrative controls piece is really important and it doesn’t really matter how great your firewall is if I come and steal your server. So we can’t negate the physical controls as well. And then you’ve got the technical piece and the difference between that and cybersecurity. Cybersecurity, by definition, cyber is over pertaining to computers. It’s technical. So, and if I only now, and that’s why I have to ask a lot. ’cause We don’t speak the same language in this industry. When somebody’s talking to me about cybersecurity, I have to stop them and usually ask, are you talking cybersecurity or information security? And I may ask it that way, or I may ask it a little with a little more tact, but I need to know if we’re talking about the same thing which, you know, usually helps. ’cause If you’re not talking about the same thing, if you’re treating this like, this is a technology problem, then we’ve got a problem.

Frank Gurnee (53:35):

Yeah. And I think everything is getting lumped into that cybersecurity,

Evan Francen (53:38):

Which is fine if you wanna refer to information security as cybersecurity. That’s cool.

Frank Gurnee (53:43):

Or as part of it, right, but…

Evan Francen (53:44):

We just need to be clear.

Frank Gurnee (53:45):

Yeah. Yeah. So, okay. That’s great. If you have any other questions, feel free to jot them really quickly. I know we’re getting to the top of the hour here. What final thoughts do you guys have as far around any of this sales, marketing, AI, any of this stuff?

Evan Francen (54:00):

My final thoughts are, I think Mike is awesome. I really dig him. I look forward to him coming down to see me. And you know, whenever you’re coming and you know, Frank, I think you’re awesome too. That’s all I got. Yeah.

Frank Gurnee (54:14):

I just don’t have as cool of a beard.

Evan Francen (54:16):

You never will.

Michael Kennedy (54:17):

You can work on it. Yeah.

Evan Francen (54:18):

Yeah. No, that’s how you get imposter syndrome. So be careful when you compare yourself to other people. That’s right,

Frank Gurnee (54:23):

<Laugh>.

Michael Kennedy (54:24):

That’s right. Stay away from that.

Frank Gurnee (54:26):

Kennedy, any final thoughts from you?

Michael Kennedy (54:29):

Tell the truth. Yeah, I’m gonna, I’m just, that’s my, that’s, I’m gonna tag that.

Evan Francen (54:34):

You can’t go wrong, man. I mean, sometimes you miss out on things like, yeah. We’ve missed many projects over the years, I’m sure. Where we wouldn’t compromise on that, right? Yeah. We’re not gonna tell the customer something that we’re not going to be able to do. And the competition did. And in that case, we’re not competing anyway. We’re playing different games. So, you know, sometimes it does hurt and you have to be prepared for that. But overall, I think you do get a reputation, which is important, you know, in this industry that you, you, you may not like to hear what I’m gonna say to you, but you know, it’s not gonna be a lie. (Right.) And, you know, I’m gonna be open to, you may not feel like it, but I’ll be open to criticism. I need to be criticized. I need to be held to account.

Evan Francen (55:25):

Like, if I tell you something that I think is the truth, I would never tell you something that I didn’t think was the truth. But if it comes out, turns out that it’s not the truth and you don’t say something to me, you’ve now, not you, you’ve, I, you’ve, you, you need to save me for myself. And you need to save the people that listen to me from me. So tell me when I’m not telling, you know, or challenge if it, even if you think what I’m saying just doesn’t seem right, get clarification either way, the conversation is gonna be awesome because you’re gonna come away smarter. And so am I. So, you know, tell the truth all the time. Don’t be afraid to question the truth. You know, ask your vendors, if a vendor’s ever, you know, really asking you, you know, trying to sell you something, ask them how it’s gonna provide value to your business.

Evan Francen (56:16):

Right? And, and if they say, well, it’s gonna save you from ransomware and billion dollars of losses or whatever, explain to me how that’s gonna do that. And is this my most significant risk? And if they say yes, call bullshit right there because they don’t know you. How the hell would they know that? Only you know that. And if you don’t know that, that’s the damn problem. You know? So I think, and, and that’s how you, that’s how I identify a lot of transactional salespeople. I’m not, I’m done with transactional, you know what I mean? I, I do relational. And so if I ask, if I ask you challenging questions about how your product’s gonna provide value to me, if it is the, where I’m supposed to spend my next information security dollar, show me how that is, ’cause according to my risk assessment that I just did last quarter, your shit’s not on here.

Evan Francen (57:06):

So tell me how it’s gonna solve any of these problems for me. And, you know, so I, you just have to be, I think more discerning. You have to be able to, ’cause at the end of the day, it is your problem. It’s not my problem. Right. It, it’s the same thing at like home, you know, we’re all CEOs of our houses, right? It’s just like little businesses, you know, we have budgets and we take money in and we spend it and just like a little business. And the risks are pretty close to the same. They just scale. And so you’re responsible for information security at your own home, right? The same thing would be at your business. It’s whoever’s at the top. And so you wanna make sure that if you, if you really care about your business, that you’re making good risk decisions. If you’re not sure there are answers to get those answers.

Frank Gurnee (57:55):

Yeah.

Evan Francen (57:56):

So that’s, that’s all I got.

Frank Gurnee (57:58):

Awesome. Guys, you know, really appreciate both of you being on today.

Evan Francen (58:03):

Neuralink. Ohh…

Frank Gurnee (58:04):

Yeah, exactly.

Evan Francen (58:06):

Who’s, who’s a Annie non any, any mouse,

Michael Kennedy (58:10):

Any mouse attendee,

Frank Gurnee (58:11):

Any mouse?

Evan Francen (58:12):

What do I think? What? Will you be (Chicken) getting a Neuralink? No, I will never get an implant.

Frank Gurnee (58:16):

Right?

Michael Kennedy (58:17):

No.

Michael Kennedy (58:17):

I don’t like, yeah. I stay away from IOT as much as possible.

Frank Gurnee (58:21):

Right.

New Speaker (58:21):

You know, if I figured if you put something like that in here, like I have to you have to trust all these developers that they coded some good shit. And I don’t know if you’ve met many developers. There are lots of developers who don’t code good shit.

Frank Gurnee (58:35):

Yeah. Well, that, that may be a,

Michael Kennedy (58:37):

Using Chat GPT

Frank Gurnee (58:39):

The medical industry and medical devices and all that good stuff. So you know, we’ll keep that for, for the next one. Thank you guys so much for, for being on today and, and having this conversation. I think this…

Evan Francen (58:50):

We’re gonna do this again soon, right? This is a podcast. We’re gonna do this.

Frank Gurnee (58:52):

Yeah, yeah, yeah. So we’ll, we’ll continue these. With that, you guys all the attendees should be getting some surveys and, and questionnaires. If you receive that, if you have ideas for more topics you want to hear about, feel free to jot those down on those. So we’d love to hear from you and, and have these formulated. So when we do these, it brings you the most value that we possibly can. Thanks guys again for, for jumping on today, a ton of value. And and thank you everyone for, for showing up and taking your time with us. We really appreciate it.

Evan Francen (59:23):

Can you fly a drone on the next one?

Frank Gurnee (59:24):

What was that?

Evan Francen (59:25):

Can we fly the drone on the next one?

Frank Gurnee (59:27):

Yeah. Yeah, that’d be fun. That’d be fun.

Michael Kennedy (59:28):

Can we live stream it?

Evan Francen (59:29):

Yeah.

New Speaker (59:30):

Yeah, if you guys want to check out Ostra, ostra.net, jump over there. You know, tons of good stuff for MSPs with all this managed service and MSSP stuff. And then if you’re interested in learning more about risk management, feel free to jump over to SecurityStudio.com. We’ll take care of you. Thanks guys. Have a great one.

Evan Francen (59:49):

Thanks.

Michael Kennedy (59:50):

Yeah, you too. Thanks. See ya.

Frank Gurnee (59:51):

Yeah.

We are constantly connected to the digital world. From social media to online shopping to SaaS for business, our personal and company information is stored and shared on a daily basis. Every online interaction exposes us to potential cybersecurity threats, making it necessary for us to be aware and vigilant about protecting our data.

This raises concerns about privacy and security, leaving many wondering who they can trust in the vast cyber landscape.

Two Guys Walk Into a Podcast…

In this “Fireside Chat” with Michael Kennedy (Ostra) and Evan Francen (Security Studio), you’ll gain insights into the latest cybersecurity threats and how businesses can better protect themselves and their customers. 

You’ll also learn about the importance of building a strong security culture within your organization, from training employees to implementing proper protocols.

How Safe Is The Platform?

One of the key players in safeguarding our digital information is the company or platform we are interacting with. It’s important to know who we can trust in this digital wilderness and the measures they take to keep our data safe.

When it comes to online privacy policies, most of us simply click “agree” without reading through the fine print. However, as responsible users, we must take the time to understand where our data is going and how it will be used. This allows us to make informed decisions about the platforms we use and holds companies accountable for their actions.

But how can we trust these policies? With an endless stream of data breaches and hacking scandals, it’s easy to feel like no company or platform is truly secure. However, there are steps that responsible companies take to ensure the safety of their users’ data.

Encryption is one such measure. This is the process of converting information into code to prevent unauthorized access. A reputable company will use robust encryption methods to protect sensitive data such as passwords and credit card information.

 

“Understand what the name of the game is. It’s risk management.”

 

A Data Breach! Now What?

Another essential aspect to consider is how a company handles its data in case of a breach. One way to do this is through regular backups and secure storage systems. In the event of a breach, this allows for quicker recovery and minimizes the impact on user data.

Additionally, responsible companies have dedicated teams and protocols in place to detect and respond to any potential threats or breaches. This includes regular security audits and updates to their systems to stay ahead of any vulnerabilities.

Do Privacy Policies Mean Anything?

Furthermore, companies that value the safety and privacy of their users will have clear and concise privacy policies in place. These policies outline what data is collected, how it is used, and who has access to it. Users must review these policies before agreeing to share their personal information with a company.

Honesty: The Best Policy

Transparency is another important factor when it comes to safeguarding user data. A responsible company will be open about any data collection practices and provide users with options to control what information is shared.

Stay In School, Kids!

Lastly, responsible companies prioritize educating employees on proper data handling procedures and regularly conduct training sessions on cybersecurity best practices. This ensures that all employees are knowledgeable about protecting user data and can identify potential threats or breaches.

Final Thoughts

In conclusion, choosing to share your personal information with a company is a decision that should not be taken lightly. It’s important to do your research and only trust companies that prioritize the security and privacy of their users. 

Remember, you have the right to control who has access to your information and it’s crucial to exercise this right to protect yourself from potential risks. Remember these tips when navigating the digital landscape and always prioritize your online safety.

The brutal reality is that no one is immune to cyber-attacks. Individuals, businesses, and even governments have fallen victim to hackers seeking confidential information or monetary gain. It’s not a matter of ‘if’ your data will be targeted, but ‘when.’

That’s why taking proactive measures to protect your digital identity is absolutely necessary. This can range from simple actions, such as regularly updating your passwords and using multi-factor authentication, to investing in more advanced security software and services.

Resources:

Video Transcript

Frank Gurnee (00:00:26):

Good afternoon everybody, and thank you for joining us today for this fantastic fireside chat or Jungle Chat, as we can see in some of those more white background chat <laugh>. So either way, my name is Frank Gurney. I am the channel director at Security Studio. And we have a lot of really fun stuff we’re gonna be doing today. But I do have a couple a couple knuckleheads here with me. So with that, I’d like to introduce them. So, first and foremost, I have Michael Kennedy on the line, also known as Kennedy. And so Michael Kennedy is recognized as a cybersecurity industry. Trailblazer, he’s a founder of Ostra Cybersecurity is a multi-layered, fully managed security service. Austra’s solution combines Fortune 100 caliber tools, tech, and talent to ensure threats are not only detected and hunted, but also fully remediated for business of all sizes. Previously, Kennedy led, built and scaled security platforms for Fortune five companies before setting out on a mission to protect SMBs Kennedy, good to see you. How are you doing today? Yep.

Michael Kennedy (00:01:30):

Thank you. Thank you. Frank.

Frank Gurnee (00:01:32):

Also, on the line, we have Evan Francen. So if you don’t know who Evan Francen is, he is the CEO of Security Studio. He’s the co-founder and CEO of FR Secure as well. He’s an expert level security consulting, which is an expert level security and consulting company. And Evan has over 30 years, 30 years only. Don’t look that old to me, Evan. But a practical experience in information security and is a well-known thought leader and specializes in the industry. He founded Security Studio in 2017, and co-created the software’s key capabilities, including the S two score. Evan is continually working on the mission of fixing a broken information security industry and advising, high profile profile cybersecurity breaches to developing the first ever vcso training program. So, with all that he is also an author of a very cool book called unsecurity. And with that, how are you doing, Evan?

Evan Francen (00:02:29):

Good to see. Good. Yeah, you can just call me security guy. I’m cool

Frank Gurnee (00:02:31):

With that security guy. Very, very cool. So with that, we’re gonna get started here. Mike, do

Evan Francen (00:02:36):

You have a, do you have a pipe right now?

Michael Kennedy (00:02:39):

No, no. It’s my glasses. Oh, okay. Frank wanted me to thought, wanted me

Evan Francen (00:02:43):

Put up a pipe. I’m like, man, I You went all out, brother. Yeah,

Frank Gurnee (00:02:45):

See, I, I, yeah, we did, we did discuss that. We thought the pipe would be a nice touch, you know, next to the fire, but

Michael Kennedy (00:02:52):

Yeah, this fire is gonna get hot, so we better get this going and get it over with because no marketing’s idea around a fireside chat, but it’s already like 75, 80 degrees here, so it’s gonna get hot. Can

Evan Francen (00:03:04):

Imagine how much we were talking about that, about this fireside chat thing. And so I took a lighter and I was like, I could start a fire too, but this is my wife’s garden, so I think that wouldn’t,

Michael Kennedy (00:03:15):

Yeah, that’s smart. No.

Frank Gurnee (00:03:17):

Well, excellent guys. We so we really wanted to create this around being more of a video podcast style, just so you guys know what the format’s like no slides, no you know, no craziness here. We’re just gonna be three dudes talking and really it’s about you guys today. So with that, you know, I wanted to start you guys with kind of a year in review. I mean, I know 2023 is just about at an end here. We’re all kind of getting ready for the holiday season, and there’s been a lot that’s been going on out there as far as security is concerned. You know, there’s been a number of high profile breaches this year. I mean, a few that affected me personally the MGM Breach 23, and me, LastPass, there’s been a ton of ’em. And a lot of these large companies have large budgets. You know, we hear a lot from our MSP and IT partners that their customers think it’s never gonna happen to them. Right. And I’m just wondering what you guys are thinking about one, how do MSPs or IT companies or anybody deal with that mentality of, you know, it’s not gonna happen to me. And, you know, what do you think about all these breaches as well? Let’s start with Kennedy. What do you think?

Michael Kennedy (00:04:37):

So from an, from an MSP standpoint, I, the first thing that comes to my mind always is SolarWinds and how, you know, in that supply chain as an MSP, how do you ensure that you’re being protected? And, and then protecting your customers, you know, ’cause those are, those are the, that’s the end goal is to protect those customers. And are you protecting yourself and providing the right tools to protect those customers. So I really think that’s created a lot of change in the thinking that, you know, people are looking at the supply chain differently. The other side of it too is like, from that customer standpoint, you get a lot of that apathy in, in clients and customers that, oh, we don’t have any data. It’s not gonna happen to me, but you, you see, you know, business email compromise is just crazy right now. And, and we’re seeing more and more of these like, high profile companies being attacked and targeted. But there are probably five times the 10 times that of these small businesses that don’t have to report that are being, having breaches or having to pay and getting ransom.

Michael Kennedy (00:05:59):

I don’t know, I if I, if there’s a, like a right answer of trying to convey that message. Mm-Hmm. <Affirmative>. But it, you know, it comes back to like, what we always talk about is the education. We need to educate ’em. We need to bring ’em into speed into the place. We don’t wanna take ’em all the way to the paranoia, like where I live, but we wanna, you know, bring them up closer to that and that, and that awareness side of things. So and I think, you know, and I think later we’ll move, talk about it too, of like risk assessment and you know, bring it to a customer’s attention and being honest about it and authentic about here’s the products, here’s the solutions you have, this is what you need to implement. Right? And otherwise it’s out of our hand.

Frank Gurnee (00:06:45):

So yeah, having that conversation with the, with the customer in some way, shape or form Mm-Hmm. <Affirmative> and how to start that obviously is, is a big one. But at the same time, I think you made a good point there of like, you know, we see all these news stories, we heard about those big breaches that I just mentioned, including SolarWinds, that, that you said hit the MSP world. But at the same time, you, you don’t hear about the small businesses, right? I mean, that’s the, the thousands that are getting hit every day that are having issues. Those are, those are the ones that even though they’re not hearing about it, it’s a huge issue for them. They just don’t realize it. Right. And so, I, I totally get that. And Evan, any thoughts on this? This subject?

Evan Francen (00:07:24):

Yeah. Well, I mean, sadly, 2023, it’s a lot of, it’s the same old, same old, you know what I mean? It’s for a long people that have been in this industry for a while, it’s you know, that’s just, we’ve made progress. You know, I hate to be negative all the time because I think that’s one of the things that ends up, you know, shooting ourselves in the foot, is we’re trying to help people. Positives, you know, I think it’s, it’s front and center more mm-Hmm. <Affirmative>, we’re starting to see, I think, more of a move towards accountability. We still have a long ways to go. The bad things are, you know, I think pe not enough people still take it seriously. There’s a lot of ignorance still, you know, in our industry, even amongst our own clan. You know, you talk about, you know, basic fundamental things.

Evan Francen (00:08:13):

You talked about the solar winds breach. You know, I, I grew up early in my career, I was a network guy. You know, I was a big Cisco, you know, and I can’t ever imagine putting in a firewall without using it properly, right? I mean, a firewall, it’s not just ingress, right? It’s egress. That’s the reason why we’ve got inbound and outbound rules on firewalls. And so I’ve always, and life was simpler then, right? I mean, it was easier for me to control traffic flows on a network because I didn’t have so many traffic flows. Right? But, you know, so until we get, there’s just, until we get the fundamentals, it doesn’t matter. It, it really doesn’t, you can continue. You almost keep, it’s like you keep pushing the ball further and further away from you, right? The more and more technology you continue to adopt without using it properly.

Evan Francen (00:09:06):

And if you don’t know how to use it properly, that’s fine. We all start there, right? But you need to learn how to use it properly, otherwise people suffer for it. And today, you know, with that lack of accountability, I’m not sure too many people feel the pain. You know, it’s more of a shared pain, right? If I have a breach, I gotta send a letter, but I get so many letters anyway. Nobody really is gonna hold you accountable for it. Yeah. Well, those things will continue to just kind of mass up and there’s going to be a day when we’re all going to have to pay for it. Yeah. Or you’re gonna have to pay for it, you know yourself. So we’re trying to get out ahead of that, but until people slow down a little bit, I think we’re still gonna be chasing.

Frank Gurnee (00:09:46):

Yeah, that’s a good point. Evan. And I, I, you know, one of the other things that that came to mind while you’re, you’re talking about that is that I know you’ve been really close and, and had a lot of information around kind of government compliancies and things that they’re building in the government to help <laugh>, right? Help Mm-Hmm. <Affirmative> you know, this whole cybersecurity threat thing. And have you, are you hearing about things that are gonna drive compliancy or drive specific things that small businesses are gonna have to do? No matter what Is that, is that coming down the pipe?

Evan Francen (00:10:25):

Yeah, I mean, it, it will, I mean, either you choose to do it or you get forced to do it. And one of them is a hell of a lot less painful. Mm-Hmm. <affirmative>. Right? I like to use the analogy of like, and one of them is checking the box, which I doesn’t do it anyway, right? You’ve got the letter of the law and the intent of the law. It was like, you know, I’ve raised five kids and they all lived, I think they’re all still alive. And it was a difference between, it was a difference between me telling them to clean the room and them actually wanting to clean the room.

Frank Gurnee (00:10:56):

Yeah.

Evan Francen (00:10:57):

One was actually clean, the other one wasn’t. Right. You picked up stuff, but, you know, I, I look under your bed or, you know, look in the closet somewhere. So it’s the same kind of just human nature, I think, until people actually want to do this, and they won’t want to do this unless they see an advantage to it or there’s pain associated with it. And right now we’re still kind of in this gray area where I don’t see the advantage.

Frank Gurnee (00:11:23):

Yeah.

Evan Francen (00:11:24):

Or I don’t feel the pain. Yeah.

Frank Gurnee (00:11:25):

And that, you know, I, and I think in the MSP world, and as more MSPs start to go down the cyber road just like, you know, their managed service offerings that they had for so long, they built out their stack of services. That was, it was non-negotiable. It’s part of a managed service agreement is to have these pieces in place. And I think that’s what we’re gonna start to see as well, is like every customer of a, a managed service provider or any other cybersecurity consultant or anyone has to have these pieces in place in order for them to be able to provide service to them. And I think that’s, that’s a way you kind of get a handle on these things, if that makes sense.

Evan Francen (00:12:04):

What, I’d love to see us to sell more. Like, I would be thinking the same thing. If you came to me as an MSP and you wanted to sell me security services, or you wanted to do an assessment of my business, whatever, if I don’t see the advantage in it, if I don’t see what’s in it for me, then I’m not gonna do it. I’ve got other stuff to do. I’ve gotta grow my business. I’ve got, you know, bottom line I’ve gotta deal with. So us as security people, it’d be a lot better to, for us to approach that way. What’s in it for you? Well, what’s in it for you is a more efficient business. What’s in it for you is, you know, all chances are pretty good. We’re going to be able to remove a whole bunch of software that you’re paying for that you’re not actually using that’ll improve your bottom line. So taking that approach as opposed to kind of the fear tactics. ’cause Everybody, you know, they’re, they’re deaf to it. Yeah. That would be too.

Michael Kennedy (00:12:59):

Yeah. Yeah. And they have the insurance, the insurance that they think they have. And Yeah, we right though we have, we have to get it some normalization in it, and we have to do, I mean, and you kind of touched on it too, we have to share the same languages when we talk about this and, and not, not go in with this, the fearmongering and, you know, predatory sales tactics towards people. It’s the education and it’s showing ’em where the ROI and the importance of doing this to, to the business. Like, you always talk about it too, avin about, you know, knowing, understanding their business so that you can talk to them in their business language versus coming in and saying, you need security tool because it’s ’cause you do. Right. So,

Frank Gurnee (00:13:47):

Yeah. And then you know that you speak, you speak well, sorry, Evan to the stand, you know, standardization, I think that was the normalization, right? That you’re

Michael Kennedy (00:13:55):

Talking about. Yeah. Yep.

Frank Gurnee (00:13:56):

Standardizing the practice around the things that are doing. And this just as I was saying, really is the way that managed service providers built their businesses because it was, you had an RM tool, you had a PSA, you had Yeah. A backup and disaster recovery device. You had antivirus tool. You know, you had all these things that you, you had in there and it was a standard way of doing business. So it’s gotta go that route as well. Sorry, go ahead Evan.

Evan Francen (00:14:20):

No, I was just agreeing with you guys. The actually, I forgot what I was gonna say.

Frank Gurnee (00:14:26):

Oh, no worries. What do you guys think that that 2024 is gonna look like? Do you guys think it’s just more of the same, do you think with all this AI stuff that’s gonna be something Skynet, is that coming in <laugh>? I dunno. You know, what do you think? No,

Michael Kennedy (00:14:39):

Not, not, not yet. I don’t think we’re ready for, I think maybe about three years is when we’ll have Skynet. Okay. But I I I think it’s gonna be continuation of the same. Yeah. I think that, I think there’s a huge desire for an easy button and, and, and really just, you know, when you talk about AI really kind of look at the ease and the sophistication of the attacks, they’re, they’re shifting and they can really write a very very telling email or business email <inaudible> phishing or, or phishing with, with like a chat GBTE and, and shoot it out. So I think there’s gonna be, it’s easier to have access for people to, to do those attacks. And, but I think, you know, there, there’s also a lot of businesses and MSPs that we’re kind of talking to, are really looking for more of that kind of that easy, you know, ability to reduce the noise or reduce what they’re kind of looking at.

Michael Kennedy (00:15:47):

You know, we’re, we’re still I don’t, I don’t know. I I, there’s a lot of times too, I think about we’re still trying to find our way after Covid and how we interact with people and how we kind of had that shift and that mentality. And now we’re virtual, we’re not virtual remote users, not remote users. Cloud versus not cloud. And there’s this kind of, we’re in this like this, this, I don’t know, Meyer, what are we, where are we going? Or what are we doing? But I, but what I see a lot of is that it’s, people are looking for something that, that it’s like this easy. And, and I don’t know if that’s part of it. You know, we really some influx in what the, the ease of grocery shopping, the ease, and I want something, I just click a button and then I have it delivered here. Yeah. And I think I, go ahead. Yeah,

Frank Gurnee (00:16:40):

That’s a good point. And and Evan, you know, this is funny because it, it fits right into kind of what we, we talk about a lot, but I feel like in cybersecurity in general, you know, if you’re doing consulting and you’re doing services, there just isn’t an easy button. And even though every vendor out there wants to build that <laugh>, the reality is in risk and in, you know, figuring all this stuff out. You just, you, you can’t throw something on the network and it’s gonna do it. Right? No, I mean, you, you have to, you have to get your feet dirty. And I think one of the things I learned from you, Evan, a while back, is, you know, we sell hard work a lot of times. What are, what are your thoughts around this concept of an easy button around cyber risk and cyber in general?

Evan Francen (00:17:25):

Well, I mean, I think longer term, I think for, for businesses that actually want to be around, you know, long term, you know, you gotta think beyond one year anyway. Mm-Hmm. <affirmative>, I would wanna put my pos my business in a position to have competitive advantage right. In the marketplace. The, when I look at the way I can integrate information security into my business and actually enable my mission, make more money, top line and bottom line ideally you’d see a lot more planning. I, ’cause there’s gonna be a day when the people that didn’t plan for this are the ones that are gonna be not to use scare tactics. Yeah. But it’s, it’s just, it’s logic. Yeah. It’s just logic. And so when the compliance comes, you can’t wait for the government on anything. So waiting for the government to tell you what to do or to provide services for you, good luck with that.

Evan Francen (00:18:19):

I mean, it’s, it’s, again, it’s not gonna provide you the competitive advantage. So in 2024, I think you’re gonna see a lot more of this us trying to find ourselves out thing. And I think there are people in our industry that already know the answers, but you’ve got other powerful people in our industry that kind of don’t want the answers to be known. Right? Right. I mean, if I was going to, you can’t do informa, for instance. I can’t do information security without doing a risk assessment period. Now, the question is, you can do a crappy risk assessment or a good risk assessment. That’s up to you. The right type of risk assessment would be one that would be actionable, that would give me something to do afterwards to improve or manage my risk. It would put risk into perspective. The easiest people to take advantage of from an attacker’s point of view, whether you’re a red teamer or a blue teamer, is to take advantage of ignorance. You know, the people that aren’t paying attention are the easiest targets. Mm-Hmm. <affirmative>, you know, and I think there’ll be a time when the people that are doing it right will get tired of paying for the people that aren’t doing it. Right.

Evan Francen (00:19:26):

You know, why would I, why should I have to pay more in insurance rates? Why should I have to pay more bank fees when I’m a responsible, you know, I’m responsible to the technology I’m using. My, my account didn’t get hacked, so why am I paying for the people that whose accounts did get hacked?

Frank Gurnee (00:19:45):

It’s, it is interesting you brought up insurance too, because I feel like that’s another area where we’re already seeing this, these huge changes, right. In the way that the insurance companies kind of,

Evan Francen (00:19:55):

And that’s the frustrating part. We, we told them this. Yeah. I mean, that’s the frustrating, your nine question questionnaire is not going to be enough to underwr insurance. You’re checking, you’re checking the box. Yeah. And so that, that mentality, and again, people aren’t gonna change unless they see an advantage in it for them, or they feel the pain from it. There’s a great question here from an anonymous attendee. Do we think CISOs facing jail time will have no impact? What about the SEC reporting requirements? And I wanted to address that because the one who’s ultimately responsible for information security in any organization isn’t the ciso. It’s not the ciso, the one who’s ultimately responsible for information security at any organization is who’s ever the top of the list. So the CEO, the board, if there is a board, but it’s not the ciso. So I think what, what what’s gonna happen with the CISO piece is who the hell wants to be a ciso?

Michael Kennedy (00:20:50):

Right?

Evan Francen (00:20:51):

I’m not gonna be a CISO be, and if you want me to be ultimately responsible for information security, then gimme the checkbook.

Michael Kennedy (00:20:57):

Right.

Evan Francen (00:20:58):

But you won’t gimme the checkbook. So, you know, that’s a catch 22. The SEC thing, it’ll be like any other compliance we had. HIPAA did the same thing. GLBA did the same thing. I mean, on and on. We just keep repeating the same mistake. So what will happen with the SEC is people will do the minimum necessary to get compliant and then call themselves good. But until, you know, until you hold a board, if you hold a board of directors responsible for information security at a public company, you’re gonna see some changes.

Frank Gurnee (00:21:28):

Yeah. The, the problem with, with all of that, that you’re saying though, you know, just meeting compliance is you’re not doing the best security for your company at that point, right?

Michael Kennedy (00:21:36):

No, no. You’re checking a box. And when you, and when something does happen, and what the problem is is you’ve kind of brushed that under the rug already. You’ve not done the security assessment, you’re not aware, you’re not implementing the plans against those things. Yeah. And what I was saying

Evan Francen (00:21:50):

In our industry too, if we had, like, if you don’t do these three things, whatever those three things are, make two, maybe one, if you don’t do this one thing, you’re negligent. And just pick one thing. You know, we don’t have to argue about it in our industry about, well, it should be this, it should be that. Just pick one who caress

Michael Kennedy (00:22:08):

Long as inventory forward asset inventory <laugh>.

Evan Francen (00:22:12):

I could get on board with that one.

Michael Kennedy (00:22:13):

<Laugh>,

Frank Gurnee (00:22:14):

<Laugh>

Michael Kennedy (00:22:16):

What, what I was saying, go ahead. I, yeah, I wanna say, when I was saying easy button, I wasn’t referring to like an easy button. I got security or an easy button. It’s what I think what pe what I feel like is, and you kind of touched on it, is the industry has been sold a specific product and a specific, like this will take care of it. No more worries. And what the, what I think MSPs and, and clients and the industry’s looking at is like that that’s a false narrative that it wasn’t. Now I ha I’m still getting all these alerts that I gotta go address to you. I thought you were taking care of the alerts. I thought you were doing the remediations. I still had a breach, but I have you and I’ve been paying you, you know, tens of thousands of dollars. And so that’s what I think people are looking at for, is they want to reduce stats based what they thought they got. That they’re really, I I would say 24 p that won’t become more of a focus for organizations.

Frank Gurnee (00:23:12):

Yeah. It is interesting that you, you can’t just throw money at something and it’s, and I’m protected. Right. It just doesn’t work. Right.

Evan Francen (00:23:18):

Well, that’s what I was saying about the ignorance, right? Yeah. ’cause It’s not just the, your traditional bad guys that are the ones taking a, that, that take advantage of <crosstalk>. We have people in our industry, lots of them, lots of the biggest names in our industry who are taking advantage of people by selling them products they don’t need that don’t work, that don’t solve a problem.

Michael Kennedy (00:23:38):

Right.

Evan Francen (00:23:38):

And they’re making millions, billions of dollars from it. You know, and I’m not gonna mention the na, I would love to mention names. Maybe I’ll do that in a d different podcast. Yeah. But one that comes to mind, their tagline is to end cyber risk. What? You can’t.

Michael Kennedy (00:23:55):

No,

Evan Francen (00:23:56):

That’s impossible. So what I would love to see is I would, you know, the FTC has, you know, laws, oh yeah. We have laws against this, you know, this false advertising truth in advertising is a thing. I would love to see us enforce that. But I think the government itself, I think is ignorant enough outside of a few people to be able to do that. Yeah. But we, I thought that me off probably more than anything is when somebody in our industry who comes off as somebody who you can trust, sells you something that you can’t need. That you don’t need. Yeah.

Michael Kennedy (00:24:31):

You don’t need. Yeah. Frank, we better get moving before he starts calling.

Frank Gurnee (00:24:35):

Yeah.

Michael Kennedy (00:24:35):

So we

Frank Gurnee (00:24:36):

Don’t want was gonna say, great. Great. Isn’t

Evan Francen (00:24:38):

My face turning red now? <Laugh>?

Frank Gurnee (00:24:40):

Well, we just, great venture. Last call.

Michael Kennedy (00:24:42):

We did you pick up the phone and started calling the FTC to yell at us? So yeah, that, yeah, that was,

Frank Gurnee (00:24:47):

That’s part of our last call, wasn’t it? <Laugh>? We live next now. Yeah. Guys, our next, our next subject really we wanted to jump into kind of circles of trust, mental health a little bit. You know, so with that, you know, we know that MSPs have a ton of technical knowledge. You know, a lot wanna be seen as the expert. Cybersecurity’s pretty new for most of them. So what advice would you guys have for them to navigate those feelings of kind of stress or anxiety or inadequacy of not always having all the answers when it comes to cyber because it is new as they enter kind of this new, new bus side of business for, you know, that is all new to a lot of them. Any, any thoughts of how to deal with that?

Evan Francen (00:25:34):

I think there’s three things that make an MSP really successful. And I think any consulting company, it’s trust, credibility, and likability. So I think as an MSP, if you focus on those three things and whatever service you’re gonna provide, so if you don’t know the answer to something information security related, it’s okay to say that you’re not necessarily paid to know all the answers. You’re paid to provide all the answers. So relying on, so, you know, relying on a partner, relying, you know, Mike’s, I’ll give you Mike’s phone number. I’ll put it in the chat. You can call Mike anytime. He’ll help you. I won’t because I don’t want to No, I’m, I’m kidding. But

Frank Gurnee (00:26:14):

Yeah, I was gonna say I know, I know you will actually <laugh> Yeah, I was gonna

Michael Kennedy (00:26:17):

Say <laugh>.

Evan Francen (00:26:18):

<Laugh>. Yeah. But you know, I’m correct

Michael Kennedy (00:26:20):

That

Frank Gurnee (00:26:21):

Even if your wife doesn’t want you to, you will

Evan Francen (00:26:23):

<Laugh>. The truth is, I’m 30 some odd years in this industry. Yeah. I don’t have all the answers. I still have to go to people and find out what this is and how this works. And, but what I won’t do is, is, and that’s where I think imposter syndrome comes in, is when you try to act like you’re somebody that you’re not. Correct. Authenticity. You should, should, yeah. Should you should feel uncomfortable doing that because you’re probably doing a disservice to your customer. Right? Right. So playing in that gap, you know, I see on a, you know, Lyle asked a question. You know, I think some MSPs are scared to work with InfoSec companies to do proper risk assessments for their clients. The MSP is too focused on the stack that they’re afraid to do what the risk assessment will find.

Michael Kennedy (00:27:06):

Mm-Hmm. <affirmative>.

Evan Francen (00:27:07):

And we’ve run into this, this is nothing new. We’ve run into this, you know, forever be because we treat it like it’s an IT issue. Right? Right. This is not an IT issue. This is a great opportunity for the MSP. Even if you find that there are some tech things that you didn’t install correctly that maybe they didn’t, they didn’t need them, right? You can continue down the path of just ignorance and, or you can actually address it at some point. And this is a great opportunity for you to elevate it to where it actually belongs, which is with the board, which is with the ceo EO. So anything you find that looks bad at the organization, it’s actually a reflection of them. It’s not a reflection of you. Yeah. So I, I wanna point that out because I think a lot of people struggle with that. Well, what if I find that I did crap wrong forever? Well, you learn from it and, you know, let’s adjust.

Michael Kennedy (00:27:59):

I’ll, I’ll admit something here. I used to when I was a, when I had a little MSP shop myself, I used to configure Windows machines, and I would go in and I would disable updates, Microsoft updates for people, because you don’t need that. And then it’ll suck up your bandwidth and cause problems with your computer and then create more phone calls for me. I mean, it was, again, it was 20 years ago I was doing it, but it, you know, now I would go <laugh> if it, if it had been more recent, I would go back to all of those people and talk to them about it. You touched on like the, and then somebody mentioned transparency. And the question too, that authenticity you to, to have authenticity, you have to know yourself. Mm-Hmm. <Affirmative>, you have to be honest with yourself to be able to be honest and be authentic with other people.

Michael Kennedy (00:28:46):

And, and, and that, you know, everything you said around, if you don’t know, it’s okay not to know. It’s okay not to, you know, it, it’s okay to surround yourself with people that are smarter in the industry and, and, and what, and so that, that, and I didn’t think about it. And it’s interesting from the imposter syndrome too. Why we get sucked into that is because we, we are trying to compare our insides to other people’s outsides. Because I look outside and I see something, or someone, or an MSP or a security vendor, and, you know, I’m, I’m looking at what I internally. And so having that authenticity, knowing that we don’t, I don’t know at all. And then having friends and, and people like you guys to, to talk to about it. So that is the number one that makes a

Frank Gurnee (00:29:40):

Ton of sense. Kennedy. And, and you know, the, it it reminds me, Evan, of, of a couple conversations you and I have had where you’ve been out at events or shows, and there’s a bunch of guys who are just full of themselves, <laugh>, right. Who know everything. Right. And, and just being in those situations and feeling like that inadequacy, like maybe you don’t know as much as those guys do, but, but do they really, at the end of the day, they’re just posturing, right? I mean, they’re just, they’re, they’re just trying to show off in front of everybody else. So I don’t think that that’s,

Evan Francen (00:30:13):

We do a lot of posturing. And I think Yeah. And it’s, it’s never a question of intelligence either. I think I’ve been, I’ve had CEO many, you know, CEOs over the years, you know, who say they feel stupid or, you know, I’m asking a stupid question. It’s like, this isn’t an intelligence thing. It’s just a learning thing. Right? Yeah. Right. A lot of the things that I’ve learned over the years have nothing to do with how smart I am. They just happened to be things I was part of. I was there, I got my kicked. It hurt. You know what I mean? Mm-Hmm. <affirmative>. And I wanna save other people from going through that, that same thing. Right? So yeah, the same will happen with MSPs When you’re first starting out anything, it’s gonna feel uncomfortable. It’s gonna feel very mechanical. You’re gonna have to, what I tell a lot of people who start in this industry is where you lack credibility. Borrow somebody else’s.

Frank Gurnee (00:31:08):

Yeah.

Evan Francen (00:31:08):

So an an example that would be like I’ve, maybe I’ve never done an assessment before, or I’ve never, I’ve never been a bcso before. And so I’m gonna take what I learned from somebody who’s been a vcso for many years, and I’m gonna say what they say and do what they say, not trying to be them, but to borrow their credibility. And so then when I get challenged, which is the part I think where a lot of us feel threatened, you know, really uncomfortable. ’cause What happens if a customer asks me, well, why did you ask me that question? Why? Why is this so important? Mm-Hmm. <affirmative>, you can, that’s when you can borrow credibility. Well, ’cause, you know, according to this thing that I read from Mike Kennedy, it said, these reasons are why it’s important. Right? Yeah. So that’s a way you get away with, you know, not having that experience, you know, steal somebody else’s experience.

Frank Gurnee (00:32:01):

Yeah. It’s interesting that we see, like, I see this a ton on the, the kind of partner side of things. Like, you might get an MSP or IT company who’s really interested in doing all this stuff and like going down this path, but then they’re, they don’t have their employee buy-in. And that can be an issue. And you guys are both business owners. So I, you know, this wasn’t on our, our list of things to talk about, but I think it, it’s important because you are both business owners. You both understand this. Like, you guys go to things and you get excited and you find something that you think will really help your business and help you grow in the future. How, how do you guys get that buy-in from your employees? Or, or even make that decision, Hey, you’re gonna go down this path, right? That, is that something you guys wanna Yeah. Talk about a little bit.

Michael Kennedy (00:32:47):

Yeah. Berating ’em until they accept it doesn’t really, doesn’t work. <Laugh>

Frank Gurnee (00:32:50):

Doesn’t work.

Evan Francen (00:32:52):

Physical threats, no

Michael Kennedy (00:32:53):

Physical threats. You know, I think I, you know, for me, I, I, I’m a very collaborative person and, and, and, and I’m a, and I’m an overthinker. I think of butt thinking. And so when I see that type of stuff, or I hear those commentary, then it, for me, it’s coming, bringing it back to the, to the organization and saying, Hey what do you guys think about this? Look at this product. And then challenge when they, and if they don’t, then challenging ’em. Why aren’t they looking at that product and, and validating against, or, or or a, a show to go to, or a marketing exercise or anything along those lines of, you know, how, how do, how do we challenge and work together as an organization to propel us forward? Because, you know, I, I am, you know, there’s a, there’s a, you can’t really see it, but there’s a, a, a framed squirrel picture back there that my aunt gave me. ’cause I, squirrel and shiny objects are horrible for me. And so I’ll have a new shiny object every afternoon. And, and so I, I have to rely on the, the people that I work with to ensure that we validate that and, and we go through it. And getting that buy-in is, is really important. But also

Frank Gurnee (00:34:09):

Helping them to see that vision of where you see the company going next. Right. Because I think sometimes we can throw things at, at, you know, employees and people and, and say, Hey, here, here, we want this done. But without giving them that vision of, look, here’s where we’re taking the business over time, context

Michael Kennedy (00:34:25):

Behind it. Yeah. How

Frank Gurnee (00:34:25):

That’s gonna really make it make it happen might be important. Any thoughts there, Evan?

Evan Francen (00:34:31):

Yeah. I mean, it, it, it, some people are good leaders, some people aren’t. You know, I think it it comes, there’s a couple things I think are really important. You know, one is, you know, do, do your employees trust you? Do they think that you’re credible? Hmm. You’re not an. So it’s the trust, credibility, and likability piece that still, you know, applies

Michael Kennedy (00:34:55):

Authenticity, authentic. Yeah.

Evan Francen (00:34:56):

But at the end of the day, everybody, everywhere is always, whether it’s out, out in front of your mentality or it’s subconscious, everybody’s always wondering what’s in it for me?

Frank Gurnee (00:35:08):

Yeah.

Evan Francen (00:35:09):

So being able to paint the picture of how this decision benefits you, right. It benefits us corporately, but you specifically, this is how it benefits. And I think the more you can prove those things out, the more you kind of add to your credibility bank account. Yeah. Mm-Hmm. <Affirmative> there are times when you do have to spend your political capital where you just need to overrule something for whatever reason. Mm-Hmm. <Affirmative>. But I think always being cognizant of how much political capital I have in my account, and, you know, trying to add to that.

Frank Gurnee (00:35:44):

Yeah.

Evan Francen (00:35:44):

It’s a big deal.

Frank Gurnee (00:35:45):

Well, both you, both of you guys are really huge on education and educating folks. And it shows in austra and security studios, onboarding of new partners. It’s really about taking them through a path of education to get them up to speed and, you know, to a whole nother level, really at the end of the day of, of even becoming the CISOs for our side. And, and you guys take them through a huge education path on the Ostra side. Where does that passion come from for, for you guys? I mean, what’s, what’s the idea or thought or mindset around educating?

Evan Francen (00:36:26):

I’d rather you do the work than me.

Frank Gurnee (00:36:28):

<Laugh>.

Michael Kennedy (00:36:30):

I was gonna say, I mean, very self I hate saying this, but selfishly from an operational standpoint, then in a process and communication, all of that, it’s, it comes back to the more that we communicate, the more that we educate, the more that with the time that we spend with you going through what we do, what you do, how we develop synergies together, you know, maintains the healthiness of our relationship and operationally long term, it it reduces all that back and forth noise. You know, we’re, so there’s that piece of it. But then also the other side of it is too, that, you know, what we kind of talked a a little bit earlier about, of getting to a place where we have the common language, we share the same values, we share the same messaging around what we’re trying to accomplish in this industry. And if we can align in that during that education process, getting the feedback from those partners to say, you know, that’s not gonna work with my clients. And if you did it this way, it would work. Having that feedback loop is, is critical so that we can adjust as well. But really it’s, it come, it comes back to just such a, a, a synergistic operational side. When, when we’re all happy and headed in the same direction, we’re all super happy. So, yeah.

Evan Francen (00:38:08):

I, I agree. And it’s, it’s a big mission. You know what I mean? My mission isn’t about me. You know, it’s not about how much money I can make. It’s not about, it’s just not about me. Right. The mission is about us. It’s about this industry and everybody who’s affected by it. And I think the more you can teach, the more you can empower, the more you can benefit, you know, personally with a career, you know, maybe a new career. What I don’t want you to, I think part of the education motivation too, is to, to stop you from doing it wrong. Mm-Hmm. <affirmative>. Because this is, you know, and I’ve said it a million times, this is not a product industry. This is a service industry that’s dominated by products. Totally different. Right? So because people are the biggest risk, right? Yeah. They’re the ones who cause most of the issues.

Evan Francen (00:39:03):

What, and it’s not the end user clicking on buttons that I’m talking about. It’s the developers developing crappy code. You know, why do I have to patch all the time? If you didn’t have bugs, you probably wouldn’t have to patch all the time. <Laugh>. You know, I mean, they’re not, you’re not patching for new features. Those are called upgrades. Yeah. Right? And so, you know, it’s, it’s us corporately as people, we have to do better than this. There will, we will pay the price. And so I think, you know, giving it your all try and to empower people, you know, to consult other people. Well, yeah. And then also being open to criticism. ’cause I don’t have all the answers. We already talked about that. And so if I’m teaching this way and you’re like, yeah, but that doesn’t work. Being open to that criticism, you’re not attacking me personally.

Evan Francen (00:39:45):

You’re attacking the way I’m doing something, right? Yeah. And so being open you know, well, you know, you’re, I benefitted tremendously from this industry. I’m live in, I live in Mexico, I live in this. I don’t want any more money. I want other people to benefit, right. By doing good security. So if you can live out a good example that you can do security correctly and to make money, they’re not mutually exclusive. But the thing is, if you focus on the mission, you’ll make money. If you focus on the money, you won’t make the mission. So totally different. So going out there and selling people products that they don’t need, going out there and giving them crappy advice because you were afraid to say that you didn’t know the answer. Things like that, you know, oftentimes that’s putting money or ego ahead of the mission and people suffer for it.

Frank Gurnee (00:40:34):

Yeah, for sure. No, that’s great. And you know, and I think it all goes back to what we were talking about earlier, which is standardizing the way that all of these things are done. ’cause If there’s no standardization around the services that CISOs or MSPs or anybody provides, then you’re just kind of, everybody’s doing something differently, right? Which doesn’t serve anyone at the end of the end of

Evan Francen (00:40:55):

The day. There’s a good question. Another good question. Look at that. Yeah. Marketing thing.

Frank Gurnee (00:41:00):

<Laugh>, we have a good question. Let’s take a look at questions.

Evan Francen (00:41:03):

What does good marketing look like? Pretty pictures,

Frank Gurnee (00:41:07):

<Laugh>

Evan Francen (00:41:07):

Colors.

Frank Gurnee (00:41:09):

Yeah. That makes, I would

Michael Kennedy (00:41:10):

Say if you, if you’re following LinkedIn, I would say not empty Bowes

Evan Francen (00:41:14):

Headphone cases. Oh God.

Frank Gurnee (00:41:16):

<Laugh>.

Evan Francen (00:41:17):

<Laugh>. Alright guys. But that’s the thing. But that’s the thing. If you, if you had a product that was actually as good as a lot of these people say is they would be rushing down your door to come by from you. Yeah. But the thing is, you don’t have that product. You may say you do, but again, anybody with discernment knows well enough that you don’t. And so I think what good marketing is, is it’s honest, it’s transparent. And in all of that, what’s in it for me as a buyer, right? How would I benefit from this? How would I benefit from your service? How would I benefit from your product? And don’t make up some. Like truly. And I can hold you calm to that. That would be good marketing. ’cause Then I would buy it and I’d be like, oh my God, everything you said, yeah, you did. Right. And I’m, I’m gonna go tell the masses about this. That

Frank Gurnee (00:42:09):

Actually leads us into our, our next conversation point, which is, you know, there’s all these vendors out there that are, that are jumping on the cybersecurity bandwagon. You know, they’re all talking, but it, it feels like there’s a lot of misinformation going on out there. How do MSPs know what to believe? I mean, what would you guys say? How, how do you, how do they know?

Evan Francen (00:42:30):

Well, I love that that first que I think it’s tied to that first question that Jason posed, you know, in the chat. Mm-Hmm. <affirmative>, yeah. Understanding the basics of what information security actually is. Mm-Hmm. <affirmative>. Right? That’s what keeps you safe from buying the crap. You know, because you think, if you think about it, like, what I’d rather mis, I’d rather not spend a dollar on information security than misspend a dollar on information security. Because at least one, I’m not ignorant enough to believe that I’m actually protecting myself. I’m not living in a false sense of security. And I didn’t away that dollar. Right? So when you, what are the fundamentals of information security One, understand what the name of the game is. It’s risk management. Risk management, not risk elimination. Impossible. So anybody who ever tells you that they can end cyber risk, it’s.

Evan Francen (00:43:22):

You can’t, right? So it’s risk management. Well, what would I need to do in order to manage risk? One, I would need to understand it. I would need to diagnose it, right? Like I take a car to a an auto mechanic. They run diagnostics before they start pulling out the wrenches and tearing your car apart. The same thing with information security. So before I’m going to manage something, I have to understand it. So that would require a risk assessment, right? And so risk, we overuse that word a lot. It’s likelihood of something bad happening. And the impact, if it did, it’s not vulnerabilities that’s different. It’s not threats that’s different. It’s when a threat compromises a vulnerability, that’s when you have a risk. So I think understanding those basics. And then if you did a good risk assessment, I think then you build a roadmap. You did. ’cause Part of the management is assessing it, then making decisions. What are we gonna do? Yeah. There are these 10 risks that are unacceptable. They’re just too much for us. Right? Let’s do something about them, and then that will lead to your budget. So it’s all tied in nicely together, but it’s all work, you know, it’s simple and people get confused, but simple must mean easy. No different things.

Michael Kennedy (00:44:39):

Yeah. Right.

Evan Francen (00:44:40):

So that’s, that’s how you do it.

Frank Gurnee (00:44:42):

Well, I know we’re, we’re at the, our 45 minutes here guys. And I, I, do you guys have a, a little extra time? We can, we can spend here if, if you on the call coming

Evan Francen (00:44:52):

Into drone flying time, but whatever,

Frank Gurnee (00:44:53):

Right. If those of you on the call here can, can stay a few, few more. We have a few more questions we can go through. And of course I’d like to get through your questions as well. But all of this subject, you know, that we’re talking about really, you know, speaks to this, this mindset or idea of guarantees. And I’ve heard this from a number of cybersecurity companies out there, vendors touting a hundred percent ransomware protection, or, you know, something of this nature. I mean,

Evan Francen (00:45:21):

Crowdstrike

Frank Gurnee (00:45:23):

Possible. I mean, I, I can’t see how it would be,

Evan Francen (00:45:28):

Are they watching this

Michael Kennedy (00:45:29):

Cross? No, we can’t. Yeah, a hundred percent of the time. Nobody’s a hundred percent. That’s all you gotta think about. Yeah. Nobody’s a hundred percent. It’s all a bunch of, and that, that goes back to your previous question around, you know, how do you, you know, wade through this noise? Yeah. And, you know, just don’t trust vendors who say like that. I mean, ’cause and, and to Evan’s point about risk assessment of like, there’s no, nobody’s a hundred percent. It’s just not, it’s not possible. I mean, there’s just no way. And well, I, and

Evan Francen (00:46:07):

If, and if that’s what your goal is, if you’re actually driving towards that, yeah. You’re going to fail. Yes. And you’re going to be disappointed. So just, you’re just setting yourself up for failure right out of the gate.

Michael Kennedy (00:46:17):

Right.

Evan Francen (00:46:18):

It’s the goal isn’t even to prevent all breaches. Correct. That’s not the goal. You can’t do it. Nobody can do it. It doesn’t matter. No ai, nothing. It’s impossible. We’ve seen it forever. Right? So take it from somebody who’s been in this industry and seen this same crap recycle over and over again. Oh

Michael Kennedy (00:46:35):

Yeah. Yeah.

Evan Francen (00:46:36):

So if I know I can’t prevent all bad things from happening, then I should have something in place to detect it and then respond to it.

Michael Kennedy (00:46:42):

Correct.

Evan Francen (00:46:43):

This is all very logical business

Michael Kennedy (00:46:46):

Mitigate. Yep.

Evan Francen (00:46:48):

And you know, so, and if you don’t, and if you don’t have expertise in those areas, then find somebody that you can trust who does, has ex does have expertise. Somebody who’s not going. Like if you said to, to me, like I’ve, I’ve heard like invisible processes, you know, I was in a meeting and I was asking them, oh, this is a really cool technology. Can you tell me how it actually works? And they said, well, you know, it went on to something. I’m like, okay, I’m still not getting that. Explain to that more. Well, it’s invisible processes. I’m like, what? There’s no such thing as an invisible process. <Laugh>

Michael Kennedy (00:47:25):

What? Un what about protecting unknown threats?

Evan Francen (00:47:30):

Yeah. I don’t know.

Frank Gurnee (00:47:32):

Yeah. Unknown <laugh>.

Evan Francen (00:47:34):

I don’t know how you do it, but,

Frank Gurnee (00:47:35):

Yeah. Interesting. No, I mean, that all makes sense, guys. And, and you know, it’s just, it’s more of, more of, that’s how you weeded it, weeded out the, you know, those folks and, and you know who you can trust if they’re saying things are creating guarantees. It’s just not correct. Well,

Evan Francen (00:47:53):

And in this, in this industry, as a rule of thumb, I would never buy anything from anybody who told me that I needed to have it. Right? Meaning if it was a salesperson, right? I should already know. Like, it’s the same thing, like at my house, right? So take this. ’cause We used to be two different things, right? Cybersecurity or information security and life, right? They were separate from each other. Like I wasn’t online until I booted up my modem and connected to a OL, right? So they were separate things, but they’re not separate anymore. There’s an intersection between everything I do in daily life and everything I do. Cyber. I mean, they’re just, you can’t separate them anymore. Mm-Hmm. <Affirmative>. So the same risks, the same concepts of risk apply, right? So if you were going to guarantee me that I’m never going to get hacked, can you guarantee me that I will never get in a car accident?

Evan Francen (00:48:42):

Can you guarantee me that I’ll never trip going down the stairs? Can you guarantee me that I’ll never have a heart attack? Can you guarantee me I’ll ever have any of these things? No, you can’t because that’s life, right? So what we do is we do things to manage that, right? Mm-Hmm. <Affirmative>, I manage the risk of me having a heart attack by maybe not smoking, watching my weight getting exercise, if that risk is important enough to me, right? And the same thing with cyber. There’s some risks that maybe just aren’t important enough to you, but what’s not acceptable and it’s not defensible, is to be ignorant to just not know, not care, play my, you know, like, play. You’d have better chances at MGM where they lost your information.

Michael Kennedy (00:49:23):

Mm-Hmm. <Affirmative>. Yep. Exactly. Well,

Frank Gurnee (00:49:25):

That’s great. You know, I wanted to get one more question out before we kind of get to the q and A here. And you know, that’s it. If, if you two were MSPs today, you know, handling networks for small businesses you know, what would you be focused on doing in your business in 2024? Like what, how to help these guys and, and what would be those next steps for you? Any thoughts?

Michael Kennedy (00:49:50):

Security assessment. I would go and, and sit down with it every single one of the clients and walk them through security assessment first and foremost. And then, and then take that back. Because then that, that enables me to understand the gaps that I’m not providing them. And it understands the gap, the gaps of what tools or solutions that I need to look at as an MSP to bring in to, to provide them. But sitting in <laugh> this, I would sit down and do an S two assessment, an assessment with these one of these clients, and then identify like what you just said, Evan, what, where’s the risk? And, and then what, what weight do we put against that risk? And then, and then work, build a plan together, partner with that business, and build a plan together and get the remediation done.

Evan Francen (00:50:39):

Yeah. Yeah. I think absolutely. And I, and not missing out, like and I’m learning all the time, you know, I mean, 30 some odd years, and I’m still like, ’cause I was stuck on this thing. I, I was with a bunch of CIOs at a round table and they kept talking about speaking the language of business, speak the language of business, speak the language of business. And I was on this round table and I was the only security guy there. And they asked me, you know, and I wasn’t saying anything. I was just listening. And then they noticed I didn’t say anything. And they’re like, Evan, what do you think? And I, and I didn’t think before I said, what? I said, none of you speak the language of business.

Evan Francen (00:51:16):

And they’re like, what? And they were just blown away. I’m like, yeah. Because all I hear is like, it’s so hard to keep up with the unrealistic technology demands of the business. It’s, you know, we’ve got all these assets, we don’t have enough staff, we don’t have enough budget. And I’m like, none of that speaks to me like you speak the language of business. No. So then the, this is, this was the learning thing. ’cause Then I thought about us, you know, I thought about information security people, and do I speak the language of business? I mean, I’m not gonna beat these guys up and I’m not doing it. And so I, I did research on what the language of business is and the language of business according to what’s his name? Who’s the guy from Omaha?

Michael Kennedy (00:51:56):

Oh, Warren.

Evan Francen (00:51:57):

Warren Buffet. Yeah, Warren. Because he knows a lot about business, you know what I mean? He said the language of business, and this was a quote is accounting. And I was like, son of a. All right. That makes sense. So as an MSP, if I were starting an MSP today, or I was providing consulting services for a small to midsize business, I would approach it as how can I use, how can I provide value to your business and make you more money,

Michael Kennedy (00:52:27):

Right?

Evan Francen (00:52:28):

Either top line. So a competitive advantage in the marketplace depending on what market we’re operating in. You know, some, some places touting security gets you business, right? Or gets you through the third party vetting process faster. Right? Right. Whatever. On the bottom line, if I know complexity is the worst enemy of security, I’m looking for every opportunity possible to simplify this crap. So if I walk into a small to mid-size business and I find I would do an asset inventory, what stuff do we have here? Right? Now that we don’t need, we’re not using anymore legacy hardware software that we’re paying for, that we’re not using. ’cause From a, from a risk management perspective, I just reduced risk quite a bit because those are things I don’t have to configure anymore. I don’t have to secure them anymore. I don’t have to worry about passwords. They’re gone from a business perspective. At the same time, this is the alignment that I’m talking about. At the same time, I just saved my, my small to mid-size business, a couple hundred thousand dollars, which by the way, totally paid for all the risk stuff that we did. So I think always looking for opportunities to show how you provide value to them. I’m gonna get paid either way. If I don’t provide value, I I hope you’d fire me.

Frank Gurnee (00:53:46):

Right. No, those are, we

Michael Kennedy (00:53:48):

Call that, yeah, we call that pro, we call that profit bleed. Reducing profit bleed.

Evan Francen (00:53:53):

Yeah. Yeah. Good. That’s a great, I’ve never heard that term, but I like that.

Frank Gurnee (00:53:57):

Yeah. Yeah. Great points, guys. So I wanna jump in some of the questions here. I know we only have about five minutes till the top of the hour, so we’ll try to go through these quickly. I’m not sure that you guys can recommend any tools or software. Someone asked if if there were any tracking vulnerability tools that you guys would recommend for smaller organizations. Anything that you guys, it’s

Evan Francen (00:54:20):

Not gonna come down to the, it’s not gonna come down to your choice of tool. It’s gonna come down to how you use it.

Frank Gurnee (00:54:25):

Yeah. There’s

Michael Kennedy (00:54:26):

How you, how you, how you

Evan Francen (00:54:28):

Address it. That’s almost a commodity now in our industry. So you’ve got, you know, Nessus, Qualys, rapid seven. I mean, there are a number of players. You

Michael Kennedy (00:54:35):

Open source, you open source ones too that you can set up yourself for free. Yeah.

Evan Francen (00:54:40):

So going down that route, whatever tools you’re researching just learn how to use them. Right.

Frank Gurnee (00:54:47):

Okay. Let’s see here. What do you guys think good cyber marketing looks like? Any messaging that you’ve found that resonated with customers and is honest. So, so marketing for them to their potential customers. Anything that comes to mind that might

Evan Francen (00:55:02):

Resonate? It starts with a beard.

Frank Gurnee (00:55:05):

Good. You need a beard. Everybody needs a beard. We need

Michael Kennedy (00:55:06):

A beard. No, we don’t need a beard. I think it’s, it, it’s the authenticity, right? Yeah. You know, not, we talked about it not having a hundred percent, or not having guarantee the, just the fin the finite we do, you know, we’re, you know, it’s, it’s the, the messaging that comes across is we wanna, we wanna partner, we wanna, how do we help you?

Frank Gurnee (00:55:27):

And I don’t think marketing fear is the way to do it either. That’s just correct.

Michael Kennedy (00:55:31):

Yeah.

Frank Gurnee (00:55:31):

Something that, well,

Evan Francen (00:55:33):

They, they had a saying, they have a saying at FFR Secure, they’ve used for years that if you see Evan panic, it’s time to panic <laugh>. So, I mean, that means that there’s a time for fear, right? There’s a time to be afraid. But, you know, you gotta be really careful. And when you play that card, man, because people are, it, we got taught, that’s a crazy thing about this industry too. We were taught this stuff as like little kids, you know, in nursery rhymes. Remember the boy who cried wolf?

Michael Kennedy (00:56:02):

Mm-Hmm. <affirmative>.

Evan Francen (00:56:04):

I was already taught this. So, you know, are these boys who are crying wolves or men? I guess, I dunno what gender we’re talking, but there would be people that are crying wolf to sell you something and there’s no justification for it. So, you know, continue to ask it, ask the questions.

Frank Gurnee (00:56:22):

No, very good. This is just a statement. So you hit a great point, Evan. Linking the business need to, a personal benefit creates buy-in, we’ve seen this in implementing good cyber practices and linking them to employee’s, personal online shopping, banking activities such as that. So that was a great point from Matt. We had an anonymous attendee. Attendee let us know that Kennedy’s beard routine is, is more intense than his haircare routine. So that’s always good.

Michael Kennedy (00:56:48):

It’s called laziness. Laziness. <laugh>.

Frank Gurnee (00:56:52):

Somebody said the box with lots of exclamation marks. So <laugh>. And then we have from Carrie, absolutely risk management. But what about people management? Get it, people are risk. But any other thoughts on that that you guys can provide?

Evan Francen (00:57:09):

What comes down? I mean, we were taught this in college too. I don’t know if how many people went to college, but psychology 1 0 1, right? They taught you you know, Pavlov, I think it was you know, how to motivate dogs, but people kind of what’s in it for them? What pain do they have if they don’t do it right? So it, it comes down to the same thing. So put it into their language in ways that they can understand. And people are so unique that you can’t, you can’t just generalize, right? Because what works at FR Secure in my company or security studio, my company may not work in your company. I don’t know what motivates, I don’t know what your culture is in your organization. So that’s why can training and awareness program is really limited in its effectiveness. It has to be custom to the people that you’re actually serving so that it resonates with them

Frank Gurnee (00:57:59):

All. Perfect. and I think we hit on this. Lyle’s had just talked about the a hundred percent guarantees and, you know, outside of that, if the market’s flooded with that, how do we educate people on business and risk mitigation? Like if there’s all these guarantees out there going on and people, you know, marketing that way, how do you get guarantee

Evan Francen (00:58:20):

That someday you would die?

Michael Kennedy (00:58:21):

Haven’t watched. Yeah. Have him watched Tommy Boy <inaudible> out parts.

Frank Gurnee (00:58:25):

There you go. <Laugh>

Michael Kennedy (00:58:27):

In a box and slapping hundred percent guarantee on it.

Frank Gurnee (00:58:30):

Yeah. Yeah. Good, good point. I mean, that, that is you know, you’re, you’re just gonna have to combat it with reality, right? Reality. And, and that, that there just is no guarantee. But

Michael Kennedy (00:58:41):

You know, and, and it, and it’s okay. I think the other thing too is we get this like, we ha we have to win the deal. We have to win the deal. We have to win the deal and, and, and, and go through it. It’s okay not to win the deal. It’s okay that we’re not a, like Evan said it a couple of times, it’s okay that we’re not a fit for your business. I dunno how many times I’ve told people that’s it’s okay that, you know, we’re, we’re not gonna work for you. You know, and six months later we get a phone call, it’s like, you, you, we need you. ’cause The path we went didn’t work out for us. And that’s great, but you can’t, we’re not magicians. We’re not, we don’t have, you know, that ability to change people’s minds, right? You can only express and be authentic. And if they, if they don’t onboard, okay, it’s okay.

Evan Francen (00:59:29):

Yeah. There’s plenty of others that do want to get on board. Yeah. I’ve done the same thing with, with executive management that just, you know, they don’t give a and it doesn’t matter. You try all the different angles, try to figure out all the different ways, and they still don’t care. Rather than me continuing to waste my time here and maybe get it over this hump, screw it, I’ll go, I’ll go work for other places where they actually have good management.

Frank Gurnee (00:59:53):

Yeah. Right. So we’re at the top of the hour, guys. There’s, there’s one last question here that I, I’d love to hit and then we’ll we’ll, we’ll get our ending going here. But Jason asked, other than fr secure C-I-S-S-P mentor program, blogs and ostra.net blogs, are there any publications, websites, organizations that are better than others for staying up to date on cybersecurity news and events? Do you guys have any recommendations where these guys can go to check out stuff?

Evan Francen (01:00:20):

I can tell you what I do. I, I I actually don’t go to any news source. I create Google search alerts. So there’s certain things that I’m interested in hearing about on a regular basis. And so with Google you can, you know, set up certain search criteria and then have it email you digest of those things. Mm-Hmm. <Affirmative>. So I get sources like if I’m interested in, you know, counties that have been hacked, you know I’ll do a search with county breach data, whatever, whatever my search criteria are, and then I’ll get updated on those. ’cause Then I can read it without somebody’s interpretation of what it is. Right.

Frank Gurnee (01:01:05):

Tim,

Michael Kennedy (01:01:06):

Any thoughts? I use, I use an app Flipboard and I configure it the same way that Evan talks about. I have different parameters in there for a secure related industry related just world events type stuff. And then I, I go through and I, and read myself. I mean, there, there are a lot of good organizations and a lot of really good people out there that, that publish podcasts, that talk industry related stuff. That, you know, I just, I read through that stuff as it comes too. But yeah, I customize, I do the same thing. Customize

Evan Francen (01:01:41):

And certainly what my friends are doing, you know what I mean? Mm-Hmm. <affirmative> people that are really respecting this industry. So, you know, and I’m not pitching it. I think it’s good, you know, like Hackle Box, my good friend, you know, Oscar, you know, leads that, and I always want to kinda keep up to date on what he’s up to and what he is doing. So. Mm-Hmm. <Affirmative> That’s a good point. You know, Mike, the those podcasts as you make friends, you know, in this industry, follow your friends, see what they’re up to.

Michael Kennedy (01:02:07):

Mm-Hmm. <affirmative>.

Frank Gurnee (01:02:08):

Awesome. Well, guys you know, this has been super informative. We’re, we’re planning to do, you know, a series of these over time. So I think that’d be great. At the end of this, you guys they’re listening. We’ll have a survey, just like to know what it is. Two questions I think or something. So, so let us know what you thought of it and anything that you wanna see in the future or talked about. So feel free to, to fill that out for us at the end. Any final thoughts? Kennedy, I’ll, I’ll start with you. Any final thoughts?

Michael Kennedy (01:02:39):

I’m not sitting in front of a fireplace next time it’s too hot. Too hot.

Frank Gurnee (01:02:42):

Now you’re sitting here dying <laugh>.

Michael Kennedy (01:02:45):

We gotta do one in Mexico. Sitting around a bonfire together. Yeah.

Evan Francen (01:02:49):

Come out with me, man. Yeah, I think, you know, start with protecting what’s most important to you. Yeah. Start with protecting yourself and your family. You know, we talk about business a lot, but at the end of the day, you know, what are your kids doing? You know, because I can recover from, if you hack my bank accounts, which has happened many, many times ’cause it’s just nature of the beast, I can recover from that. What I can’t recover from is you stealing one of my children’s innocence. Yeah.

Michael Kennedy (01:03:20):

Yep.

Evan Francen (01:03:22):

I can’t recover from that stuff. So start there. You know, start with personalizing this, get yourself, get your family secure, and you’ll be, you’ll, you’ll be amazed at how much you learn from doing that, that you can then take to your work. So my, my, it’s the same with like, when I tell, when people ask me, you know, how do I get into, you know, pen testing and I’m like, hack yourself,

Michael Kennedy (01:03:43):

Right?

Evan Francen (01:03:44):

Yeah. What do you mean? Like, hack your house? Like I, you know, and the normal, you know, American House has like 12, 13, 14 devices connected to the network, right. Hack all that crap. Yeah. You’re not gonna go to jail for that and you’ll learn so much. So the same thing. You know, make this personal, protect your family, protect yourself, and see where good things go from there.

Michael Kennedy (01:04:04):

Yeah. Have I, I make my kids read data privacy policies.

Evan Francen (01:04:08):

It’s torture. They

Michael Kennedy (01:04:09):

Want in, they wanna install Snap Snapchat on their thing. Okay. Read the policy and tell me where, what, where your data’s going, and then you can have it. Right. So, nice. That’s awesome. And they, yep. Yep.

Evan Francen (01:04:20):

That’s borderline torture a little bit. It’s

Michael Kennedy (01:04:23):

Close, but they need to know that they do. I want them to have that thinking process. Right. So yeah. Don’t

Frank Gurnee (01:04:29):

That on everything. Right. Oh, great. Great stuff guys. This has been super informative and awesome. Really appreciate your time from both of you. And, and I think that we’ve, we’ve learned a lot today. We went over a little over, but most people have stayed with us, so that’s fantastic. If you guys wanna learn a little bit more, this was not about, you know, our, our solutions or anything like that, but if you’d like to learn more about ostra ostra.net, feel free to jump over there and check those guys out. Mm-Hmm. If you’d like to learn more about Security studios, just security studio.com, check us out and thanks everyone for joining us today. There’s been a great fireside chat getting Kennedy all warmed up there.

Michael Kennedy (01:05:09):

Okay, thank you. Have a

Evan Francen (01:05:10):

Merry Christmas guys.