How to Tell If Your MDR Provider Will Actually Stop an Attack

You're paying an MDR provider to protect you. Most of them will alert you and wait for someone else to act. This conversation names the one question that tells you which one you actually bought. Know the answer before it's 2am and someone's waiting on you to decide.

You signed a contract for managed detection and response. You assumed that meant somebody would step in and stop an attack while it was happening. For a lot of MDR providers, what you actually bought is guided remediation. They find the incident, tell your team what to do, and hand it back to you to execute. That distinction is the entire reason you're paying for this instead of running it yourself, and most buyers don't find out which one they signed for until they're the one on the call at 2am being asked what to do next.

Miles Lowry, Senior Territory Manager at eSentire, has sold cybersecurity from every seat in the market, VAR, Nutanix, Rubrik, and eSentire, and he walks through the one question that exposes the gap before you sign. This conversation also covers where the same blind spot shows up everywhere else in a typical MDR evaluation. Buyers send RFPs to eighteen vendors and get eighteen generic capability dumps back instead of a real fit assessment. Rules of engagement quietly change depending on whether the compromised machine belongs to your CEO or your help desk.

It also gets into DLP requests that get approved without anyone defining what they're actually trying to stop, and security licensing already sitting in your Microsoft contract that almost nobody has turned on. The buyers with the best MDR outcomes never send a broad RFP at all. Miles names the one question he says he'd ask first if he were sitting on the buyer's side of the table.

Know the answer before it's 2am and someone's waiting on you to decide.

Want the exact test to run against your own contract? Read the full breakdown: How to Tell If Your Managed Cybersecurity Provider Will Actually Respond During an Attack.

Find Your Situation
Ten real moments from this conversation. Find the one that's actually happening to you right now, and jump straight there.

• Your CISO or security lead has been in the seat under two years, and you're not sure if that's a coincidence. → 21:44
• You sent an RFP to eighteen vendors, and now you're buried in decks that all say the same thing. → 26:35
• You can't get the budget to build the security program you're actually expected to deliver, and you know it. → 31:14
• You've never checked whether a breach on your watch creates personal liability for you, not just the company. → 40:53
• A vendor asked how much data you generate before you'd even deployed anything to measure it. → 42:36
• You've never actually asked your MDR provider whether they act on their own or call you first. → 55:31
• Nobody on your team could name, right now, who gets called first if your CEO's laptop gets hit tonight. → 57:25
• Someone asked for a DLP tool and you're not sure anyone can say what it's actually supposed to stop. → 1:10:43
• You've never tested whether your MDR provider can actually act without you, or whether you'd only find out during the incident. → 1:18:16
• You're paying for Microsoft E5 and you have no idea if the security features in it are actually turned on. → 1:25:53

What We Get Into

• 26:35 Who is actually answering the RFP you think you wrote
• 31:14 Why CISOs use a vendor to share the blame when something goes wrong
• 40:53 Why most CISOs at one conference had personal liability insurance
• 42:36 Why "how much data do you have" is a trick question
• 55:31 The real MDR test: alert versus response
• 57:25 Your CEO's laptop, and who's actually authorized to isolate it
• 1:00:46 Who belongs in the room on the buyer's side and almost never is
• 1:10:43 The DLP request nobody asked for and nobody can explain
• 1:18:16 The one question to ask before you sign
• 1:25:53 Paying for Microsoft E5 security licensing you never turned on

What We Mentioned

• eSentire
• CrowdStrike (Falcon Complete)
• Sentinel One
• Fortinet
• Palo Alto Cortex
• Microsoft Defender, Sentinel, and Entra
• Nutanix
• Rubrik
• Veeam
• Gartner
• NIST CSF
• Log4j
• Tenable

About Miles Lowry
Miles Lowry is Senior Territory Manager at eSentire, where he works directly with security leaders on managed detection and response. He's spent 14 years in enterprise technology sales, moving through VAR, Nutanix, Rubrik, and now eSentire, giving him a rare, direct view into where buyers get MDR wrong before they ever sign.
LinkedIn: https://www.linkedin.com/in/cloud-ai-expert/
Company: https://esentire.com

About Signed
Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly.
Listen: itbroker.com/podcast

About Signed
The IT market is built for sellers, not buyers.

Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised.

New episodes weekly. An ITBroker.com podcast.

Full Transcript

Creators and Guests

Host

Max Clark

Founder & CEO of ITBroker.com

What is Signed?

The IT market is built for sellers, not buyers.

That's why 80% of tech buyers regret their last major purchase. Deals take longer than they should. Teams get locked into platforms that don't fit, contracts they can't escape, and vendors they wouldn't choose again. The pitches, demos, and analyst reports are built to close deals, not help buyers make the right one.

Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, talks with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals — the ones who can explain what actually determined whether the deal worked.

Plus weekly Playbooks breaking down the moments that matter most: renewals, M&A, compliance mandates, office moves, budget cuts, and the specific plays that separate buyers who get it right from those who regret it.

If you're responsible for choosing, negotiating, or living with the consequences of enterprise technology, this show is for you.

New episodes weekly. An ITBroker.com podcast.

Miles Lowry (00:00)
That's the rules of engagement. And that is a big part of that conversation we talk about is we can take these and we commit to. By the way, we understand you have a CEO. We understand you may have a production server. That can never go offline. Your CEO is not okay with us isolating a system. So having the processes, we call it orchestration, response orchestration. And we're very flexible. Good organizations like us are, where in the CEO, we've marked your CEO, we know that's your production server. We're gonna actually gonna call our contact down the escalation and say, your CEO.

Miles Lowry (00:30)
Has been breached. This is the situation. You're gonna get this call in 30 seconds or less down the call tree. What do you want us to do? Right?

Max Clark (00:37)
imagine

Max Clark (00:37)
that, you know, you're like twenty three in the help desk and for whatever reason you're on this like chain and like you're you're by the way your your CEO is infected with ransomware and what do you want us to do about it? Right.

Max Clark (00:57)
This is actually fun for me because usually I have people on that are like si sales marketing leadership, executive founder, right? And they're very disconnected from the actual process. Yeah. Yeah. And when we were talking about this originally, I was like, man, I gotta do this with Miles, right? Because you're very much in the process. Day to day. And you're in the process for a long time. So, you know, I was spying on your LinkedIn, so 14 years technology, so var, Nutanix, Rubrik, any Centaire. And y you know

Max Clark (01:27)
It's something where all these things are probably more similar than dissimilar to a certain degree. But what you know, along that, like what what do you learn and how does emotion change for the VAR versus you know, like a new tan you know, Nutanix or Rubrik or like selling a software solution? Right. You know, and some of it's like you know, do it yourself versus done for, you you get into those different models. And now

Max Clark (01:54)
you e centai very much managed, right? So like very big barbell between the two. So how how does it change between the different

Miles Lowry (02:01)
It's

Miles Lowry (02:01)
a it's a big evolution, honestly. When I started on the VAR side, which is really where I started

Miles Lowry (02:06)
It in that time it was much more box pushing, right? The services side of it was providing services for installation. there wasn't a lot of subscription, right? Adobe came out with the subscription model and that kind of changed everything. But prior to that, Smartnet was the biggest subscription out there with Cisco, right? Yep. That was a large part of my job as a VAR was rolling rolling through these enormous Smartnet reports for my customers. but as a VAR you also focus a lot more on the relationship, which is something I has

Miles Lowry (02:36)
has benefited me a lot as I've moved into the manufacturer role is I spent a decade learning how to build relationships because when you're a VAR it's not so much the motion of you know selling the service, selling this and moving on, which is very much what manufacturer reps do. Right? They'll sell you, they pass you on to an account team and they're out of it. But when you're a VAR, it's a long-term relationship. you're trying to build this relationship so you can garner more business. but

Miles Lowry (03:05)
As I moved over from the bar and kind of evolved into that, was right around the time I moved over to Nutanix where subscription was becoming a very common thing. Services, you know, everything is software as a subscription. Actually, when I started at Nutanix, it was hardware. We were nodes, right? It was the hyperscale infrastructure, and we're gonna have a two U node, and it was about the hardware. The software was always the key, right? That's always what enabled it. But people bought hardware, and in that phase, which unfortunately was during COVID, I was working healthcare.

Miles Lowry (03:35)
not the best vertical to be in during COVID.

Miles Lowry (03:40)
What was interesting is we had a big flurry of virtualization, as you can imagine. So everybody had to get workers remote, but after that, for hospitals, it became no spending. Nobody really understood what was gonna happen and what budgets looked like. But that also really started leading to a lot more of the services and subscription sales and Nutanix during that phase kind of moved from a hardware to as a commodity. And it's not just Nutanix. I think we saw this across the entire, you know, the Dells, the HPs. Hardware's a commodity.

Miles Lowry (04:10)
Now we're selling software and we're gonna sell it as a subscription. and that was a as a seller that was interesting because we had gone in and been pushing hardware and now we're trying to educate our clients and move them over that hump because nobody wants a subscription, right? We've all been trained through life in general, leases, whatever it is, everything, your cell phone, everything's a subscription now. But prior, you know, decade ago, people hated subscriptions, right? And we had the legacy clients that held on to perpetual licensing for as long as

Miles Lowry (04:40)
they possibly could. And you're just like, buddy, you you don't get any features anymore. You get to keep this perpetual licensee, but all of these next gen features are in the subscription. So that was really the biggest evolutionary change during that phase for me was learning how to have the service in a subscription conversation with a client.

Max Clark (05:01)
Seven I mean is I I it's so funny. I mean I was similar start, network engineer for VAR. I mean now I didn't know what I we didn't call ourselves a VAR back then. You were a computer consultant, right? Exactly. So now it's like, you know, we were like a VAR MSP. Right. But the model was the same thing. It was like you go out and you sell a box and then you sell the time to install the box. And really they were selling like a me to go out and install the box, right? Like I was I was like, okay, this is the guy that's gonna go make this box work now. And

Max Clark (05:29)
You and then they you play around with all these different business models and like how you sell time, but but effectively we were selling you know, we were selling hardware to sell time. Yeah. you know, and but but there was also like like always friction inside of the var motion, even to today in the MSPs where I try to explain to people where like

Max Clark (05:48)
You know, based on your size and based on your authorizations, like you are a fill in the blank shop. You know, you say smartnet, like you are a Cisco shop or you're a Juniper shop, and like you can't really you you can't be all things, you know, and and then you know, that was for me in the dot like Dell was emerging, you know, and so Dell was the devil, you know, 'cause we couldn't sell Dell, you and like it'd a co tout the company line. Like Dell Dell's horrible, you know, don't buy Dell. Right. Right. And

Max Clark (06:13)
You learn a lot in that span. I mean, you were also I mean, seven years at a VAR is a is a long tenure in in sa I mean, it's just in anybody in general. Seven years is a long time. Yeah. But you also have a different like viewpoint, right? So being in a reseller seat versus being in a vendor seat, you know. Reseller and VAR, y you know, you're you're building a relationship with a customer and then you're trying to build a solution and then maybe you have multiple options for that solution that you take to them, versus like yeah, Nutanix 'cause like

Max Clark (06:42)
were Nutanix.

Miles Lowry (06:43)
This is what I got.

Max Clark (06:43)
How d how does that process change and and what did you see in that with like interacting with the customer? Because you you also have that now, right? Like you know, selling MDR services, they're looking at other options.

Miles Lowry (06:54)
Absolutely. And you know, that's one of the more interesting pieces is as a VAR, I bring multiple technologies to the table. I'm your consultant. you know, ultimately a VAR, typically, if you have the relationship, you're gonna win, right? No matter what. it's bringing the right solutions and that's where the trust comes from, right as a VAR, is bringing the right solutions to the customer. Now moving to the vendor side, the Nutanix is rubrics, you when you come into these conversations, your whole goal is to differentiate your solution. And it is an interesting evolution.

Miles Lowry (07:25)
Or a conversation as a as a seller coming from the VAR because a lot of these are customers. As an example, I have sold Nutanix, Rubrik, and ECENTIRE to a set of dozen plus customers, right? Right, right, right. So it's really coming in and understanding, building the trust, but also understanding your solution doesn't do everything, right? When you're a VAR, I'm sorry, when you're a manufacturer, a vendor, you are not the end all be all. And if you come in and you present yourself, which I see my competition do all the time, they come in, we do everything.

Miles Lowry (07:55)
When I come into clients and we're talking MDR especially, we're very clear what we don't know. We do not do that. And it is so important to say that I was on a call just yesterday where the individual is an extremely intelligent analyst. And he was testing Hanan, who you know, my engineer and I, and asking, do we do this? Hanan are we don't do that. It's like I didn't think anybody would, but you know, I had to ask. So it really is a conversation when you're a var of understanding your technology set. If as a seller, even if you're not a technical seller, you need to understand where you fit.

Miles Lowry (08:25)
with a client and what your capabilities are, but more importantly what you don't do.

Max Clark (08:29)
So

Max Clark (08:34)
I'm I'm gonna ask this out of order then. So

Max Clark (08:40)
I want to talk about the cybersecurity sales cycle a little bit more in detail later. But but when you're on an initial call with somebody, what's the first thing you're trying to size up and understand?

Miles Lowry (08:52)
Mm-hmm.

Max Clark (08:53)
And let me put a little context in this. I had a I had a I have a buddy and we were just talking about like mistrust and in in the sales cycle. And and we were being a little more crass about it, but basically but it distilled down to like, you know, everybody's lying.

Max Clark (09:10)
Right, like the and and the but the observation he made was like everybody's lying, but the customer's the biggest liar. Like y you know, and and it was like when he said it to me it was like I hadn't really thought about it like that before, but then all of a sudden you have this moment you're like, Holy smokes, right? Like like that's an you know, and you can tell which side of the fence he's on, right?

Miles Lowry (09:27)
Yeah,

Miles Lowry (09:27)
he's he's the seller.

Max Clark (09:30)
It was a really interesting

Max Clark (09:31)
kind of thing. So so so that so that kind of begets the question, which is, you know, when you're on when you're when you're with somebody new, like what are you trying to understand and size up with them?

Miles Lowry (09:41)
Yeah, it it's really the first phase of what I do is and you've been on a few calls with me is I don't actually jump right into the conversation of business. I think it's really important to be a person first and foremost, right? they talk to a hundred of me, resellers, bars, whatever it may be, coming in and spending just three to five minutes with some pleasantries is a game changer. It is what I do in normal life anyway. It's what most of us do in normal life. We don't just meet someone and jump right into it. We ask a few questions, get to know them. You'll f

Miles Lowry (10:11)
find some customers are resistant and they want to jump into it. I take the Q well and we jump right into it. But most of the time, if you spend a few minutes, you do a little bit to drop that trust bear or that trust bar, right? You bring their bring their trust bar up with them and you kind of drop their guard a little bit. From there, I typically really want to get into understanding what their challenges are. So if you take the time to build a little bit of a relationship and then start talking about what are their challenges, because you'll find to your buddy's point, they always lie. It is a fact. And it it's

Miles Lowry (10:41)
Them trying to be guarded, right? They don't want to tell you too much because they don't fully trust you yet. If you get to that point, you'll break that barrier down. But they will always tell you their challenges, their pain points. So if you jump in, do a little bit of digging, who are you working with today? What are you doing that's similar? You can get to that and then just ask them like what's not working. It's something that I have talked to a lot of reps about that I don't see a lot of people asking early on. Because if you ask immediately what isn't working for you today, what are the pain points, however you want to phrase it, they will tell you how to do how the direct.

Miles Lowry (11:11)
of the call for yourself and where you need to go. They will guide you along that call.

Max Clark (11:17)
Somebody who's been on the buyer side for a long time.

Max Clark (11:21)
probably the most frustrating part of the process is people immediately put you into like a solution.

Miles Lowry (11:25)
Yeah.

Max Clark (11:25)
Right. And so I think I think that has worked against a lot of people because there's been this like push to like, we have to make the buyer qualify their pain point and like sell themselves into the solution and then we're gonna like, you know, do this thing. And then as as the buyer on that side, you're just like, god, can we just not do this right now? You know, like it like like just not. I just don't wanna do this, right? yeah, yeah. Like I'm talking to you because I think I need to use you, not because I'm like bored. Yeah.

Max Clark (11:50)
No.

Miles Lowry (11:51)
Right.

Miles Lowry (11:53)
Customers that I'll get to and what I kind of classify them as gen one, gen two when we're talking cyber services. And a gen one customer typically does want to talk about a little bit more of their pain points. But to your point, when you're talking to somebody and I typically can gather this through market intel or doing some digging ahead of time who's using a managed cybersecurity service of some sort, you're spot on. I typically can kind of garner out what their pain points are, and in those situations, I'm not gonna spend a bunch of time asking you to tell me a bunch of stuff 'cause you don't wanna hear anything. Right.

Miles Lowry (12:23)
What you want to understand very quickly in that situation is what is my solution? How is what is my service? How is it different and hopefully better than what you're doing today and how is it going to make your life easier?

Max Clark (12:33)
Yeah. I would imagine that if you have a company on the phone that's with a competitor that's talking to you, right? Like there's there's an obvious reason for that. Right.

Miles Lowry (12:43)
If you're smart, you

Miles Lowry (12:44)
you note that, right? Right. There's a reason you've decided to talk to me and you're with a competitor of mine.

Max Clark (12:49)
You know, what's funny for me is like how many times those conversations usually always start off with this implied like, Can you give me a better deal? Like there's always this like underturn of like, I have to go out and shop for a better deal. Yeah. And and there's some cultures that are driven by that. And

Miles Lowry (13:04)
Yes.

Max Clark (13:07)
you know, and you know, that's just the way things are, but like the majority of time it's really interesting how how little that actually drives business. Absolutely.

Miles Lowry (13:15)
And in

Miles Lowry (13:15)
cyber security even more so, I think.

Max Clark (13:17)
Well okay, okay.

Max Clark (13:18)
First tangent of the day then. So let's talk about cybersecurity purchasing.

Max Clark (13:22)
I have for maybe a decade now been asking a variation of this question. Right. And the qu and the variation of the question like the is how do you sell cybersecurity to somebody who's not actively buying cybersecurity? Yeah. Because the the let's say the negative in the space is like, it's a very transactional you know, thing. Like, a buyer shows up and they want to buy EDR, right? Right. And like they're just in the market for EDR and like you're you're doing a terrible job in a sales organization if you're just like sending quotes out and becoming a quote desk.

Max Clark (13:52)
Yeah. But the flip of that is when we look at, you know, structurally how companies evaluate technology, you know, my my

Max Clark (14:03)
favorite four letter words, you know, ROI and TCO. Yeah. Right? Like cybersecurity doesn't have any direct mapping into like it's not a revenue generating activity for a company. So so you know, how how does that shift the dynamic within cybersecurity in terms of like going through that customer cycle? Yeah. You know, and and helping people buy something that they can't go to their CFO and say this is going to make us money.

Miles Lowry (14:25)
Right.

Miles Lowry (14:26)
You know, it's an interesting conversation because a lot of organizations to your point are coming and saying, Hey, I want to save money, right? But when you get into the cyber sales side of it, it's also having the s the right solution. And a lot of organizations that aren't using what I would call best of breed technology today, they're not necessarily looking at cyber. A lot of times one of the ways to have these conversations is resources. So I don't like TCO ROI when it comes to cybersecurity services. I've attempted to put together some spreadsheets and it's

Miles Lowry (14:55)
Arbitrary, right? It's it's it's adding in like what is your employee cost? If you gave me enough data points, I could put something together for you that would make sense. But really, what it comes down to is time back for your employees. And this has been a very good conversation that I have had. And I ask very clearly on the calls to the leader, do you have multiple employees reviewing your logs as an example? And that one question alone, you see their eyes. Some of them will lie and they'll be like, but the eyes give it away every time. And most of them are like, yes, the logs, we just don't even review most of them.

Miles Lowry (15:25)
So resource availability is a really good way to have this conversation because if every company I've worked worked with, I don't care if they have eight, you know, dedicated analysts, they're still doing more than they should be doing, and they can't review everything. You also want to task these people with forward-facing what did you pay them to do in the first place? It certainly wasn't to review logs and to chase down alerts to see if they're real. So having that conversation early on with a business leader, the the IT director, the CISO, those conversations.

Miles Lowry (15:55)
conversations immediately perk them up and they say, okay, now I want to hear a little bit more about what you're talking about because it is a resource conversation. If you're talking ROI, well there is a piece of it that we can find there, right?

Max Clark (16:08)
So my favorite version of that is if you're actually talking with somebody that's like let's say more in the trenches like day to day, is just ask them to show them the folder in their email where they filtered all the logs into. Yeah. And they never look at it. Yes. It's well I mean you you can't even if you're in a full time like

Max Clark (16:26)
I mean industry stats are always crazy because I I find so many people come in and they're like, here's the industry stat around hiring and here's the you know, here's the absorption rate or the amount of job hostings or availability and like all you know, and and it's and it's more like I hate like the FUD cycle, you know, around these things where it's like, you can't hire people and you can't retain them and all these different things, but which is true. But that doesn't really motivate people to do anything.

Miles Lowry (16:51)
No,

Miles Lowry (16:51)
right. It certainly doesn't. it's a combination of and it's kind of a process that I found, right? And it's talking about, you know, sometimes you get into the pain and you don't want to get into it to your point earlier. You gotta be careful. You know, there was a training I did a long time ago about dragging him through the glass, and I was absolutely opposed to this, right? It's yeah I think it was called Challenger X training. right. You've probably heard of It's a no- and I remember going through there's that rubric and I was a fairly senior salesperson at the time.

Miles Lowry (17:21)
So, you know, this is I think geared for younger individuals. But I just remember cracking up because they were they would talk about dragging them through the glass and the paint. And I'm just like, that seems horrific. That does not seem like the best way to build a relationship. However

Miles Lowry (17:36)
Bringing up areas that you know, if you're a senior seller, especially on the cyber side, I know what your pain points are. I don't really need to ask you, because they're pretty much the same across the board. If I understand who you're using, I typically can tell you where there is a gap in what they do and really where you like. So as opposed to asking, it can be very wise to kind of walk through your solution and call those pieces out. The resource piece is important, but you made a really good point. a lot of sellers I've heard talk about the fact that, hey, you can't retain these guys. You they know these things, right? This isn't news to them.

Miles Lowry (18:05)
So as opposed to telling them what they already know, you can kind of take them through the journey, but then at the end, and you have 30 minutes to do this, which is crazy. At the end of this, you need to be presenting them with the other solution. So you have, I usually take about 10 minutes to get through just a few conversational pieces, but then it's really that last 20 minutes of understanding that I understand, they need to understand that I understand what their needs are, what their pain points are, what the outcome they're looking for is, and that I at least have an option that could work. And now we need to invest.

Miles Lowry (18:35)
investigate it further. And if you go too far on that first call, you can basically shut it down there. And if you don't go far enough, it's the same. So I always try to get to a point where we're doing a technical call. Everything in the first call, technical call is going to be the second call.

Max Clark (18:50)
So

Max Clark (18:50)
so I'm I'm laughing about this because I'm trying not to like interject with like every bad sales call I've ever been on in my life, right? Yeah. what what's what's what's what's like wild to me when I'm thinking about a lot right now, and I guess this is this is a better let me let me formulate this question a little better. Like you know, I mentioned that, you know, I have executives, a lot. A lot of senior leadership, a lot of founders, right? But like

Max Clark (19:16)
what are they just completely missing in their own sales cycle? You know, 'cause I mean now you've got an arc, right? You know, var vendor services, you know, man professional services. You know not to like throw shade on a CRO, but like a CRO is probably like two, three levels up in most cases from the organization. And so they, you know, they it's really easy for a company to come out and be like, s you know, sell more, close more, do whatever more. Do it all the time.

Miles Lowry (19:42)
Here's

Miles Lowry (19:42)
a new service. Go sell it. Sell it.

Max Clark (19:44)
Yeah,

Max Clark (19:45)
because so what's the what's the actual like practical disconnect that that happens within all these companies? No, I mean it's true on both sides, right? 'Cause like sales is a very difficult thing to manage and and it requires I mean if the company's not putting pressure on their sales organization, you know, being a technical guy, you'd see like the s the SKOs and like the parties, the sales people going out. And then and then later you understand it's like, that job is really hard and they really do need all these parties. Yeah, like go

Miles Lowry (20:09)
Right. They need some they need some relaxation.

Max Clark (20:13)
Exactly. Like send them to Hawaii.

Miles Lowry (20:19)
It's not even

Miles Lowry (20:19)
a fair trade-off, right? The biggest disconnect I see, and you know, we have a new leader, as you know, a new CEO at our company. So this has been it's a good question for today. I have watched of recent, and I've seen this, I think, historically, is the largest disconnect is the conversation. So you'll get a CRO, maybe your CFO, even all the way up, you know, to sometimes like the VP sales, right? Even on that level.

Miles Lowry (20:43)
They're pushing for you to get all these numbers. Here's these new services. We want you to sell these, but they there's a disconnect in the type of conversation we're having. So a perfect example, we have a really cool autonomous AI pin testing just released a few weeks ago. They want us to sell it to everyone. However, one of the things that sales leadership and all the way up to the CRO often neglect to realize is we have to have data on it, right? We have to have the proper data sheets, the proper sales tools, we'll call it, to go out and have these conversations. So that's the biggest.

Miles Lowry (21:14)
Disconnect I see for newer services. For existing, it comes down to really not understanding how the process works to sell. And this is something I see from the finance side frequently is okay, well, you got your quote out. Why can't we close the deal? Right? Well, there's a lot more to it than that, right? We have you know, especially when you're talking services in cyber in today's world that's such MDR, which I don't love the term, obviously, there's DR everything. we all sound the same, right? Right? You have to differentiate. And

Miles Lowry (21:44)
myself and you know East Entire and Arctic Wolf and Rapid Seven, we all sound very similar. And for a CRO, they come in and they say, well, you know we're a better company. Why haven't you sold this? Well, I know this, but I also have to do the due diligence. I have to take the time to ensure that the client both trusts that this is the right solution, understands, first of all, understands how we differentiate and then trusts that they're making the right decision. CISOs, what's their average tenure now? 18 months? It's it might even be twelve. They

Miles Lowry (22:13)
It it's hilarious. I get on a lot of the time and they are not as up to speed as I am on managed cybersecurity services. So I very gently tell them as you know and as you know, it's kind of this whole conversation, but they're looking for a guide and they're looking for someone who they can bring in who is going to make them look good and they're scared to make the wrong decision.

Max Clark (22:33)
The the

Max Clark (22:33)
information asymmetry, you know, this is something that we deal with a lot and we try to quantify into like what's the actual problem. When we're looking at and talking with vendors and we're really getting into it, you know, I'll ask questions like, you know, can you define your ICP? Like what's your ICP? You know, can you how do you define it? What's the thermographics? What's the size? What's the geographies? What are the services? You know, there's there's a lot of different like like what's a ideal c you what what does this look like, right? And there's a lot of questions that you you you end up asking just to try to get a vibe.

Max Clark (23:02)
But what I'm really looking for is more like, do you have a clear understanding of the problem space that you're in? Yeah. And what problem are you solving? And and what you're talking about, it's like so often I see this case where it's like we have a solution with no problem. Right. You know? Like we've got this shiny object that now we want to go sell, you know, I'll I'll I'll I'll throw shade on 5G right now. It's like nobody understands what this thing is and why they need it. Right. Right. Right. and in many cases it does you know, so you say like

Max Clark (23:27)
You know, this whole like you know, part of that cycle, you know, I mean the the the tech market is such a seller dominated market, even the analysts are in on it where we have D R and now everybody shoves into Dr and it's like you have E DR, DR, XDR, this, that, you it's like it's like what is it? You know, you mentioned some competitors and I was I was laughing because in my view, you guys are very different from each other.

Miles Lowry (23:50)
We really are. It's you have to take the time to explain that. And that's really the trick. I'm fortunate to work where I work because I do feel like we differentiate ourselves immensely from much of the pack of managed cybersecurity service providers. However, the initial conversation, that thirty minutes we all have to kind of wow them

Miles Lowry (24:10)
We really do sound similar. I have done this long enough that I understand my competition. So I understand in those thirty minutes how to wet their whistle, as they say, to understand that we are different, right? That this is the things that we're gonna do different, and I wanna get you to another call to show you how we're gonna do these different. But

Miles Lowry (24:28)
That's really the biggest challenge because the DR space, whatever DR that they're selling, you know, it's be really XDR and MDR are the two big ones everyone's trying to understand. Most organizations don't even really understand what X DR Right. Yeah, exactly. I mean it it's it's

Miles Lowry (24:45)
You know, it's a data lake, right? Depending on how you classify it, it can be multiple different things. And that's what I talk to clients about. I you'll hear in a lot of my calls, I will call out, we're the leader in managed detection of response, right? We're the authority. However, I don't like the DRs, so we're not going to do XDR, MDR, we're to talk about managed cybersecurity services. And you'll see a lot of clients take a sigh because they don't want to hear about the DRs anymore. So

Max Clark (25:08)
You know, there's cybersecurity, I'll just I'll just generalize this as a heavy inbound motion. Right. So like people have self-qualified to a certain degree that they need some solution, right? And then the question is are they are they shopping the right solution? Are they shopping the right vendor? You know, again we we talk about like y you know, if you're just going to an analyst report and saying, here's you know, eighteen companies I need to go talk to, like you're hosed. Like you you have no chance. But by the time when you get on a phone call with with a company and they and they're you know, so in at that point

Max Clark (25:39)
They've only reached you because they are looking for however they define it, MDR, SOC as a service. What's like the typical entry point in that conversation that they're actually telling you on that first call that they're looking for, right? I mean, how much of that is that we have this current company, we don't like anymore for some reason, or they're going net new, or y you know, or even beyond that. Like what what is that initial like we've now decided that we need to solve this problem and so we're talking to you about it?

Miles Lowry (26:05)
changed

Miles Lowry (26:05)
in just the past five years interestingly. So initially the conversation was around we need help, right? We can't manage this ourselves. The landscape of you know bad actors we'll call it has grown. their ability to protect themselves, so to your point, perceived ability to protect themselves has wavered. And they most of those initial calls we'll call like two or three years ago, 80% of them were we need help. We need somebody to help us manage our cybersecurity program. Right. Oftentimes it would start off

Miles Lowry (26:35)
Off with endpoint, right? Some sort of EDR solution where, hey, we want to have east and west visibility. I just want to ensure that we don't have a business impacting event. Interestingly, we all know MDR took off a few years ago, and now a ton of organizations are using it. So that's where that Gen 2 or the second iteration comes in, where they went with something and it wasn't what they wanted, to your point. They didn't, they went to a Gartner, they pulled a list of 18 companies and they picked one, right? And they realized really quickly okay, well, this isn't what we were.

Miles Lowry (27:04)
looking for. We wanted more of this, we wanted more of that. So these conversations now have turned into a bit of I know what I'm looking for, but I also want to pay less. Right. And that's right.

Max Clark (27:15)
Always pay less.

Miles Lowry (27:16)
So now it is a dollar conversation. And even though I can differentiate ECENTIR in terms of our level of response, our speed, these different things, it's still coming down to okay, well they were doing okay with us. We really like what you do, but not that much more

Max Clark (27:31)
I I've always been fascinated with that biopsychology of like what I have doesn't work. Right. So I can you fix it and pay and it

Miles Lowry (27:38)
It's it's baffling.

Max Clark (27:40)
it's so how you know, in that sense, right, you have like this self diagnosis, right? And and not to like again, you know, people that are running a business or operating, supporting a business, you know, if you're transacting a service once every three years.

Max Clark (27:53)
The amount of change in that service or that technology, the category, whatever you want to call it, in six months is so radical that like you have no chance of keeping up with it. So this isn't even like people are smart or not smart or or good or not good. It's just not at all.

Miles Lowry (28:11)
That'll confuse you more actually.

Max Clark (28:13)
So so like what percentage, like how often are what they telling you that they want actually end up being what they really need and what they end up getting in the in a in a in a good set, you know, good world?

Miles Lowry (28:23)
You know, so the clients that had gone with another vendor of Managed Cyber are tend to be very much more in tune with exactly what they want, right? They had a piece of a service. Right. Those, you know, I'd I'd say that's probably only about forty percent of the buyers or initial calls that we have today are we know exactly what can you do this, right? They pretty much have an idea of the

Miles Lowry (28:47)
Exactly. So that's pretty straightforward. Now the other sixty, we'll call it fifty, sixty percent, they actually don't know what they're looking for. And that's really one of the more fun parts of what I do is helping them to understand, you know, they'll come to me and I take it all in. You're gonna tell me all these things that you absolutely need and that you want, and I'm gonna take it in, I'm gonna tell you we're gonna get start working on some budgetary numbers, we're gonna go. However, the second phase of this is now let's get into the technical conversation. The first call is you're telling me what I you want, I'm telling you that we can do these things if we can. And then

Miles Lowry (29:17)
Second call is where I'm going to change your mind. And we're going to show you what you actually need. and it's it's one of those where we work together. And if you are kind in your conversation and you're you take the time to really show a client what they need, they'll tell you this, right? Yeah, they'll agree with you immediately. And a lot of times I'm actually saving them money more often than not because they're coming to me and they want everything under the sun. And I'm going to recommend, especially if you're a younger organization and your security posture, let's not.

Miles Lowry (29:47)
Do everything. You can't do this. It's too much right now. We can manage big pieces of this, but this is what will protect you today, and this is how we'll grow with you. And when you have that conversation about a partnership and you can convince a client that you're going to help grow their maturity as a security posture, those are the really good conversations where you will change their direction in terms of what they thought they wanted to buy. And they'll help you do it and they'll be happy about it because one, they're saving money, they're buying what they need today. You can clearly articulate the outcome of exactly what you're doing.

Miles Lowry (30:17)
and you're giving them a path to grow as they see fit at a speed that is comfortable for them as opposed to a lot of c bundled solutions, they throw everything at the customer and they only onboard two or three of those solutions in the first six months to a year and you just paid for six months or a year of a service you're not using. Yeah. So

Max Clark (30:35)
What's

Max Clark (30:35)
what's driving purchasing now? I mean, how much of this is cyber insurance, board mandate, peer incident, news, y ex you know, compliance?

Miles Lowry (30:44)
Compliance is probably the biggest that we're seeing, right? the compliances are becoming more strict. So there is anything you look at healthcare, you look at finance, any of those industries are highly regulated. We're seeing on the manufacturing side there's much more stringent regulations. So that's been the biggest driver in the past six to twelve months. Prior to that, I think it was fear. a lot of it was ransomware. we're seeing the news, we're seeing these companies go down. Your friend works at a company and they were hit with ransomware and then you looked and I don't know are we protected or

Miles Lowry (31:14)
Or not. So I think that conversation around CISO tenure was really impactful too. A lot of, I did a lot of conferences with CISOs, and they are all trying to pass the buck to a provider because they're responsible at the end of the day if there's a breach. If they can bring in a provider and they can check the boxes and get their leadership to sign off on it, if something goes wrong, then maybe they're not quite as liable. So I think there was a big piece of it that was more fear driven around the in cybersecurity.

Miles Lowry (31:44)
Security insurance paid a piece of this because the insurance companies were coming and telling you you have to fill out these checklists of all these things you need to do.

Max Clark (31:51)
By the way,

Max Clark (31:54)
those checklists were both used for underwriting your policy cost, but they're also used to deny claims. So the reality of that

Miles Lowry (32:02)
Exactly.

Max Clark (32:05)
I think has been very interesting for people to start to understand.

Miles Lowry (32:08)
Yeah, yeah.

Max Clark (32:10)
the I've I've talked with more than one

Max Clark (32:15)
you know, security leader. And you know, if based on the organization side, you know, they would maybe have like director of security, sec ops, CISO title, like you go up and down. And what's fascinating me is how many when you get to know them really well, kind of have this there's like this undercurrent of like my job, like I'm here to be fired. Yeah. Like almost. Like like I'm an expensive fall person. Right. Because they'll n they can never get the budget that they need to actually implement the program that they want to to hit the objective that people

Miles Lowry (32:44)
Yes.

Max Clark (32:46)
So how does

Max Clark (32:46)
that change the I mean that changes a bunch of stuff, right? Because it the the the first one, I guess let's talk about a little bit is is like okay, here's a big pet peefe of mine, right? RFPs. Yeah. Well, what's

Miles Lowry (32:59)
Yes.

Max Clark (33:02)
fascinating me about the RFP process is this idea that gets pushed on people that like I can control the outcomes if I can run a better buying process. Right. And so what does that tell you to do? That tells you to go get a bunch of people, form a committee.

Max Clark (33:14)
Write an RFP, distribute the RFP, score the answers of the RFP, and then decide what vendor to go to. And I go to immediately like, what's even in your RFP? Who

Miles Lowry (33:23)
Exactly.

Max Clark (33:24)
wrote the questions for your RFP? Right. How are you weighting the answers to these questions? Does this stuff even apply to your business in the first place with your technology stack? How does a buyer run a better process to evaluate this stuff that gives them a higher likelihood of success?

Miles Lowry (33:41)
Yeah, that's a really interesting comment. So we do a lot of RFPs, begrudgingly. but as you can imagine, that's a big part of what we do. And more often than not, I love your comment about what the questions are. Do they relate to what they do not most of the time. I am pretty convinced that of recent AI is writing the vast majority of RPS.

Max Clark (34:01)
Okay.

Miles Lowry (34:02)
I'm very convinced of that if I'm being honest with you. I use AI frequently as well, not to do RFPs, but I can you can tell when A these are A and they

Miles Lowry (34:10)
What's interesting is I was working on one just this week and it's due next Friday and we we did a question and answer. They don't I'm positive an AI wrote this. Half of the questions in there do not pertain to their environment. They're a Microsoft shop. No. Right. So they just don't pertain. So we asked questions and they negated those questions and their responses. But more often than not, an RFP causes confusion. So what I have found is the it's the the organizations that are have the best buying process aren't doing this with a committee. They don't have a lar large

Miles Lowry (34:40)
Group, what they've done is if they're talking cybersecurity, which is where we're at, it's going to be the business leader and their resources. They're going to have a conversation about what do we not have today? And they typically know these. what are the their internal gaps that they have? Then it's a matter of what often happens is talking to their peers. Do we know anybody that's using this service, right? If not, eCentaire is a big referral organization. We don't do the best job marketing, as you know, and we don't do advertising at airports or any of that. But

Miles Lowry (35:10)
We have enormous referral rate. So a lot of these organizations that have really nailed down their buy-in process are concise in understanding what their gaps are today and not coming in with an RFP that's grand, because if I reply to an RFP, I'm going to put in everything that we do. I'm not going to focus in on where your gaps are today. So the buyers that come to us, and these are quick sales cycles for a seller often, they come in and they say, Hey, I have a gap. I need someone to monitor my endpoint, and I'd like to do some log. These are the

Miles Lowry (35:40)
The two areas. We're gonna do a a scoping call with them. We're gonna do a consultative call to talk about what we do and see if we can identify other gaps. But if you focus on what they tell you that they're looking for, you fill those gaps, those are quick sales cycles, and that's a great buying process for the customer because it's not a lot of back and forth. Customers hate RFPs as well. I am baffled why they do these because it's a it's so much of a process for them that they don't want to really go through.

Max Clark (36:06)
I I mean this goes back

Max Clark (36:07)
to the whole R O I T C O thing. Yeah. Right. Because they they're convinced that you have to go out and you have to quote three people. So now you have to create a process to go out and quote three people. Yeah. So that way you can demonstrate that you asked the right questions and got the right quote back and you're like, this isn't getting you the outcome that you actually think you want, right? And I mean, you know, specific in cyber, right? Like the cyber landscape, it is such a mess, right? Because you have you have a bunch of different things swirling around. You have the industry trying to figure out how to

Max Clark (36:35)
qualify a journey, a s a maturity model, right? And so we see all these different maturity models that come up and like, you know, and every single one of them is just change.

Miles Lowry (36:46)
And they change.

Max Clark (36:47)
Well they change and somebody comes out with a new one and it's all it's all like the discussion cycle. But you know, the problem that I have with all these maturity models is there's no there's no way to really quantify what your what your quote protection or security level is in any of the models. And if you say like, okay

Max Clark (37:03)
you know, I want to be a, you know, seven on a scale of one to ten. Right. What does that mean and how much does that cost me? Right. And like, where does the NSA land and where does Wells Fargo land? And like, okay, I wanna like two steps below Wells Fargo. So if there's seven, I wanna be a five point two. What does that mean? Right. So like all the maturity models fall short for me in that regard. then you have a you have this tool sprawl that's crazy, right? So all the tool vendors then are pushing for TAM expansion by going into different categories.

Max Clark (37:31)
And then you talk to you talk to a company and the company's like, We have fifty seven thousand tools and we want to consolidate into a single vendor because we have too much tool sprawl and we can't manage it. And you're like, Well, that's not really a good idea for you either, because this vendor that's telling you they can do all these things really sucks at everything that they're talking about.

Miles Lowry (37:47)
Yeah, exactly. If they can do that much every time.

Max Clark (37:52)
Yeah.

Miles Lowry (37:53)
Well to your to your comment on the the multiple tools and just the consolidation, a lot of organizations out there, that's one of the biggest reasons they come to us. And one of the success that we've had at eCentire is that we're clear about what we don't do. And, you know, I liked your comment about the maturity models. A lot of times customers ask us to put in our portal, how do you rate us? What's our security rating?

Miles Lowry (38:16)
We had we had that in there. We removed it because it's not real. And I really appreciated that because we had a graph in there that mapped your you have this endpoint coverage and you have this. And because of all of this and the metrics that we built, you rate a nine point one. Right? And we removed it. It lasted for about six months and we realized that there was no real metrics to tie it to.

Max Clark (38:37)
What I do

Max Clark (38:38)
like for organizations is when there is even if they haven't matured to the point where they're they're chasing a framework, if you give them a like NIST, right? You just you you you just like you guys should be NIST CSF. Like start with CSF, NIST eight hundred, whatever it is, right? Like

Max Clark (38:57)
And then you actually can get into this thing where it's like, okay, you know, here's the stuff that everybody knows you should have that you probably don't have yet. And like here's the actual framework alignment that you have that you don't have. And now you can have this in your report that goes back and filters through the organization and says, we are deficient in these areas and we know it and we've made And I mean, this was also a hard part for me when, you know, starting my career, I was like

Max Clark (39:20)
You spend all this time building DR plans because I was an earthquake country, right? And then nobody actually buys them. And and and so actually this is a good question for you, right? Because what I realized in that process was what I was actually doing was creating information to give to the decision makers. In this case, the board. Right. And the board had a fiduciary duty to re to review it.

Max Clark (39:45)
And then make a decision on it, right? And almost all the times a decision was it's too expensive. We're not gonna do it. It doesn't fit our risk profile, right? Yeah. Cyber is very much the same way, right? Where you have to create information and give it to the decision maker. And the decision maker has to measure risk and say, it's worth it to for us to spend this money to per to reduce our risk in a perceptional way basis, right? Or

Miles Lowry (40:08)
Absolutely.

Max Clark (40:09)
it's becoming industry norms for us to do these sorts of things. And if we don't and we have an issue.

Max Clark (40:15)
Are we creating risk because we didn't follow industry norms that are known and accepted at this point? You don't have backup, you don't have EDR, you don't have, you know, SEG, right? How is that changing the conversation for you? Because, you know, it it feels like we are a heartbeat away from that liability conversation shifting significantly of like you are not doing your fiduciary duty to the company because you didn't have this thing in place.

Miles Lowry (40:39)
Yeah. That's actually when I was talking earlier about compliance being the biggest driver over the past year, that's one of the biggest conversations we have. You have to be careful as a seller because you don't want to just throw that in their face, right? Especially as a business leader.

Max Clark (40:51)
Nobody responds well to that, right?

Miles Lowry (40:52)
Exactly.

Miles Lowry (40:53)
But calling out the fact that there is liability. I I did a a CISO conference I think it was about a year or so ago, and the CIO of seven eleven was there and he had an entire group of CIOs. I was one of the panel speakers, so I was sitting on the side, and he asks everybody who here who's a CIO or CISO has personal liability insurance? Seventy percent of the people raised their hand. Wow. Right.

Max Clark (41:17)
So outside of the company they've gone out and tells you.

Miles Lowry (41:19)
Yeah. Personal because

Miles Lowry (41:21)
it does. And to your point, it's not just industry norm that's driving it. That's a big piece of it, right? But it's the compliance and the risk comes from litigation. This is very real. PII now organizations, you in California I believe you have twenty four hours to report to these the

Miles Lowry (41:38)
the state essentially, right? Nobody does it I'm sure. But as this starts to mature and programs especially around compliance start to mature, organizations are gonna be fined, right? This is going to be real dollars that they're paying out.

Max Clark (41:52)
the thing

Max Clark (41:52)
that's funny about the finging for me, it's kinda like Again, I mean, over the last decade, right, it's been a how do you prevent the pain cycle?

Max Clark (42:05)
You know, 'cause like w we're very like pain reactive. Like, we've had this event

Miles Lowry (42:10)
Right.

Max Clark (42:10)
and then now we're gonna do something about it. Right. And like how do you how do you short circuit that? And I just I just I look at it like it's almost like collective scar tissue. Right. Like that. You you know, you need enough collective scar tissue before you're like, okay, we're gonna we're the other thing that really makes me is really I I let me let me talk smack about your sales process for a second. Yes, because I have to. And this actually isn't specific to you, right? Yeah. The the the main issue that I see a lot, especially with a

Max Clark (42:36)
First time buyer into MDR is they always get tripped up the same point. And you all ask the same question, which is how much data do you have? Right. Right. And I understand that because you're sizing the SIM and how much is feeding into the SIM, which is a hard cost for you in this thing. Right. But there's not a single customer on the planet that can answer that question if they don't already have a SIM deployed.

Miles Lowry (42:58)
A hundred percent. And that is something that so we don't my team, I don't ask that question anymore. And I did. I was a culprit of that question of can you tell me, you know, based on you may not know this, but do you have any idea what your per gig per day ingest is? Nobody really knows.

Max Clark (43:12)
How

Max Clark (43:12)
many workstations do you have? Nobody has the answer to that question.

Miles Lowry (43:14)
Right.

Miles Lowry (43:15)
What's interesting is that's shifting. So we actually have shifted that over the past six months to unlimited. And you're seeing this across the board. So as opposed to having it was a scoping issue. It was beyond a scoping issue, it was also the flexibility that the market's going to is being able to provide an unlimited SIM. The big value to the customers, and I think why organizations are doing this, is they can't nobody knows the data.

Max Clark (43:37)
Okay, but I can be cynical on this one for a second because how much of that is market pressure from Microsoft giving Sentinel away to anybody on E five?

Miles Lowry (43:44)
Right, right. And a lot of it's market pressure, a lot of it's market pressure from other organizations. A a lot as you know, a lot of the MDR providers out there leveraged a sim in the middle, right? They weren't really doing anything in terms of SOAR orchestration or XDR. so they were giving away SIM for free. So the organizations that were actually putting value to the SIM, meaning not man in the middle, not bringing the data in and just pushing it out, but normalizing it, correlating it against other signals, that's costly. Right. So to be able to do that, you know, what I think

Miles Lowry (44:14)
they found in the market some really interesting stuff I was reading is most organizations when they pay for a per gig per day subscription they actually 80% of them aren't using it. of course 20% overutilize. Same metric same metrics work at eCentire. So I've seen this not just with us, but I'm seeing this across the board. Organizations are removing the per gig per day. Microsoft's a big piece of this on the Azure Sentinel side and Palo Alto Cortex is another big driver on that.

Max Clark (44:38)
I

Max Clark (44:39)
it was good for Microsoft, of course. I mean it it changes the cost equation a lot. Right. And also MDR vendors that are supporting Microsoft security stack, it's like it takes away a big cost component for you in a quoting cycle. It's like I don't care how much data you have because it's going to Microsoft anyways. Like that's your bill problem. I don't see that it's it's the you know, and I should I should point this out, right? Because in my view

Max Clark (45:08)
MDR is incredibly inexpensive. You know, like I

Miles Lowry (45:11)
I would agree. What you are getting.

Max Clark (45:14)
I mean even if you're even if you're bundling the EDR license, which is pretty common in most cases now, even if you're bundling the EDR in with the MDR service.

Max Clark (45:23)
It is extremely inexpensive to go out and acquire MDR services. And I don't and then and this is like I for me, it's like the first thing that I have to overcome in this conversation is this perception that it's gonna be really expensive. And you're like, it's gonna be really cheap. Yeah. You know, when you really break it down, it's very inexpensive to deploy this.

Miles Lowry (45:41)
Per

Miles Lowry (45:41)
user. What's interesting is you know, we do differentiate ourselves well. And one of the funniest comments I get towards the end of the very first call. So that's the informational call is this sounds this is amazing, but this sounds really expensive, right? So it's a joke. I've cut it off now, and as I'm going through, I let him know, hey, I know this is sounds really expensive, just so you know. but we're very comparable to the cotton market. So you have to call out. You don't have to give them a price that's it'd be silly to do on a first call, you don't have the data, but you have

Miles Lowry (46:11)
to call out to the buyer, the the customer on the phone that you're aware that their perception is that this is going to be expensive. And by the way, it's not. But if you don't call that out, to your point, that's one of the biggest questions we get is, this just won't be affordable for someone our size.

Max Clark (46:25)
So outside of only talking to you, let's talk about a like a a buyer that runs this process well. Yeah. Right. Yeah. What what is a good process now for a buyer to run? 'Cause you know, running an AI generated you know, RFP that's gonna you know you're gonna just run it an AI generated response, right? Like that's not a good process. So so what does a good process look like for a buyer?

Miles Lowry (46:48)
Typically the buyers that have the easiest time working with us and tend to have the better processes, what they've done is they understand internally what's not working for them ahead of time. There you made a comment earlier about buying to solve a problem that doesn't exist, right? That is not the right way to come into a lot of the RFPs we see are we're mandated to have managed services. AI put together something that makes it so we have managed services, right? Or I'm going to ask a company to come in and provide MDR without understanding where their gaps are today. So the buyers

Miles Lowry (47:18)
That understand, I don't, they don't even need to understand MDR, but I don't need all of these managed cybersecurity services. Today I have a gap and I need someone to manage my endpoints, and I'd like someone to do managed vulnerability scans for me, understanding that those are the gaps. We're going to talk about more services. We're likely going to uncover maybe a dark web monitoring, other things that we can do. But the buyers that come in and they understand, hey, these are the gaps, this is what I want to solve for, and are able to articulate that or maybe not tell us right out of the gates, but understand that's a better buying cycle for them.

Max Clark (47:50)
So invert it, so outside of using AI to generate RFPs, like what's a common mistake people are doing in this process?

Miles Lowry (47:56)
the

Miles Lowry (47:56)
biggest mistake I see is coming in and you kinda hit it earlier, bringing in going to Gartner, picking a list of what are the top ones. We typically fall into that, bringing us all to a 30 minute call and saying, present what you do to me. Right? And we get those a lot. Come in and we're not gonna tell you anything. We just want you to tell us everything you do. And we wanna know everything you do. And that is a giant mistake for a buyer because you've never really gotten to understand what each of those specific manufacturers can do for your use case. Instead you've brought them in.

Miles Lowry (48:26)
and you'd have them just potty mouth everything they do, just boo, here's everything we do. And it's hard to really understand where does that fit for what I'm doing. Maybe you get lucky and I call out the right thing and that's something that you think of, but most of the time it's data dumping, it's too much information. The client walks away from the call like, whoa, that's a lot of stuff. So that's the biggest mistake I see is not understanding what the intent of the call is in the first place.

Max Clark (48:53)
I I I mean, I just I I don't know to laugh or just feel bad because I mean we we are hundreds of hours deep into a category or with a or with vendors. I mean, forget the category, like like category time, but then like like hundreds of hours deep in with vendors before you're like, Okay, yeah, I know what these what this company does. You know, and where they actually fit. And you know, and like in every every category there's vendors that are really good at different places. It's not like one size fits all. No. I wish it was, it would make my job.

Max Clark (49:23)
a lot easier. But like I would what do you see people overweight like like obsessing about that really doesn't matter at the end of the day?

Max Clark (49:34)
This show exists because of what we do at itbroker.com. If you're in the middle of a real tech decision right now, new technology, vendor selection, a contract that doesn't feel right, an MA event that just landed on your lap, and so on, we help buyers like you get it right. Independent strategy, sourcing, and contract negotiation. No kickbacks, no sales quotas, just someone in your corner. Schedule a call at itbroker.com. Back to the episode.

Miles Lowry (50:00)
control.

Max Clark (50:01)
Control.

Max Clark (50:01)
Control.

Miles Lowry (50:02)
when it comes to managed cyber, you're paying someone to manage it. So one of the biggest headbutting we get, and this is more with mature organizations that have a cyber program that's not working, frankly. That's why they're talking to a managed cybersecurity provider, but they get caught, and it's oftentimes, you know, there's a leader who's put a lot of weight on one of their employees who's doing a lot of the work, and he does, he or she does not want to give up their control. They don't understand that they're not giving up control, by the way. They're relinquishing responsibility in certain areas so they can work on other tasks.

Miles Lowry (50:32)
But it's this can be in any level. It can be the leader, it can be one of the admins, it can be an analyst. Understanding that you can't have control of a complete control and visibility even to your entire security program and have efficacy. It does not work. You're you're one, you're ten, you're not a large enough group to do so.

Max Clark (50:50)
Okay, let's talk that for a second, because part of that response comes from bad vendor experiences. Right. So the natural tendency if you've come through a bad vendor experience or bad, you know, whether that was you were buying a box and doing it yourself or you were in some kind of managed environment, is you're like, okay, so now I need control of this so that way I don't have a bad outcome the second time around. Because even if they go squirrely on me, I can still manage it myself. Right. I mean, that's a pretty natural response to the situation. You know, of course you're like

Max Clark (51:20)
You had a bad experience with a with a boyfriend or girlfriend so now you're gonna assume the next one's gonna be the bad experience. It's like what what's the constant in that that you have to change? You have to change yourself, right? Like what are you what are you selecting for? Right. boy if I learned that young it would

Miles Lowry (51:33)
I

Miles Lowry (51:33)
was about to say the same thing.

Max Clark (51:35)
Saved me a lot

Max Clark (51:36)
of aggravation. the but but that but that's a really common thing, right? Where it's like, I wanna be able to co manage is how we say it.

Miles Lowry (51:46)
We even talk

Miles Lowry (51:47)
about ours is a co managed solution, which it is to some extent. But how much

Max Clark (51:51)
Like,

Miles Lowry (51:52)
That's

Miles Lowry (51:52)
the joke, is they really don't. So you've seen our portal. We have enhanced it even more to where you can go down and dig into the hypothesis that the agentic AI tool did, every action, 70 pages. We show it to people. I doubt anybody's ever gotten there, right? even to the level of you know, when we provide an alert back to a customer, you have to resolve it in the portal. If you don't, it disappears in 30 days. We have a lot of customers that don't resolve anything. We're taking the responses. They never log in. We do on the flip side of that have customers that are more mature and they want, they love

Miles Lowry (52:22)
The dashboarding, they love the visibility. It's a mixed mesh, but the mass vast majority of them get hot and heavy. I want control of everything, right? And we give them a ton of control right out of the gates. And what we find is that they don't do anything with that control. To your point, it is very much they were burnt by a bad boyfriend or girlfriend, and now they want to have a little bit more control to mitigate this heartbreak again, right?

Max Clark (52:45)
So where I've seen people go go wrong is they don't understand like what they're buying and who they're buying it from and who that what that is actually gonna be able to give them. Right. And so you know, maybe I'll talk the most smack at the bottom end is like the MSSP, like var reseller who's selling them tools and maybe some configuration, but

Max Clark (53:09)
You know, I I make it a point, you know, if you're dealing with an MSSP that's under a you know, a a dozen engineers, like like y they just don't have the time. Like it's not it's it you know, they can have really good people, but you just you can't you can't be there. But then you start working up the stack and you find people in the MDR space specifically that'll say, let me actually equate it to outcomes as opposed to the terminology, right? Where it's like you find out when you start digging in that they will take the in the alert.

Max Clark (53:38)
Take the incident, you know, give it some enrichment. Yeah. And then basically give it back to the customer. Yeah. Like, okay, now you have to investigate this. Right. You know, so at the very low end, and I and I f I see a huge mismatch in people with what they expect the MDR to actually do for them at

Miles Lowry (53:53)
Yeah.

Max Clark (53:54)
that category. And it's like, of course, it's the cheapest thing on the market.

Miles Lowry (53:58)
Why they bought it.

Max Clark (53:59)
And but it doesn't actually do anything for them when when it comes down to it.

Max Clark (54:04)
Then you you start working up the stack and what I'm always really curious about, interested in, is this like interaction between companies because now as a s as an MDR vendor, you know, if you look at it like holistically big picture, what's the perception or what's the goal? The goal is like I've hired this company to go out and protect me. Right. Right. Which means if something happens, they have to fix it.

Miles Lowry (54:27)
Yes.

Max Clark (54:28)
So

Max Clark (54:28)
But this makes a really interesting line with an MDR of like the response, right? Because it is manage detection and response is the category. Right. But even in security teams internally inside of organizations, a lot of time the security team isn't doing the response. Like it's being pushed back to IT. How how I mean I'm gonna in two parts. Like how do you as a vendor, but also how does the the customer, the buyer, manage that interaction between the two and actually

Max Clark (54:55)
Well, outside of asking the obvious questions, like what are you really doing for me? But like understand what the responsibilities still are.

Miles Lowry (55:01)
That's the biggest differentiator that's out there today is the evolution of the MSSP to a true big R, because the response, managed detection, and response. The most important piece for clients, and they'll tell you this, is the response. Of course they want to be managed. Of course they want you to detect it, but ultimately we need you to protect us, right? We are paying you to come in and take a response on our behalf. There are a lot of variants in what a response looks like. I talk this is one of the biggest things I talk to customers about early, early on.

Miles Lowry (55:31)
Because this is what they want as a response. If you're paying a cybersecurity provider to protect you, they must protect you. They must take the response. And what we see as guided remediation is the number one type of response. That is, we will enrich your data. We're gonna send it back to you. We're gonna help you, by the way, but you need to get online. You need to get into your system. We're gonna be on the phone with you, but we're gonna walk you through this. And that is certainly better than having no assistance whatsoever. But when you're paying someone to do MDR response, you want them to respond. And there are organizations.

Miles Lowry (56:01)
like ours as well that do this, but we take the response. We're not going to call the client. And when you tell a customer this, this is my best line in my initial presentation is you know, we're not going to call you, we're not going to email you. We're going to go in, we're going to take a response. After we've protected you, we'll call, email, tell you, so on.

Max Clark (56:18)
Okay. So the natural risk that comes with this on both sides becomes what the action is, how far you can go with that action, right? and and how you know, because you know, you want you've you have very little time, right, when you actually get the event to not have a catastrophic outcome. Yeah. Right.

Miles Lowry (56:40)
Fifteen, twenty minutes max.

Max Clark (56:41)
Right. So but then within that, now you've got the second thing of it, which is like

Max Clark (56:46)
You know, I'll just create a hypothetical person scenario. You know, you've got the CRO whose, you know, machine right is ground zero because of something. And, you know, if the response is quarantine that device off the network, which is pretty common for a lot of responses, it's like, okay, we've we've severed this machine so it can't infect other stuff, right? Not that we've cleaned it, but like we've

Miles Lowry (57:10)
Just isolated.

Max Clark (57:11)
we've isolated it, right? So like so like I think like

Max Clark (57:13)
Like bare minimum for most places, it's like we've isolated, we've quarantined, and now you can go your IT team. Yeah. You're gonna have a pissed off person. Like, why isn't my computer working? yeah. Right? Especially if they don't know why their computer isn't working.

Miles Lowry (57:25)
Exactly. You know? Exactly. That's the rules of engagement. And that is a big part of that conversation we talk about is we can take these in, we commit to. By the way, we understand you have a CEO. We understand you may have a production server. That can never go offline. Your CEO is not okay with us isolating a system. So having the processes, we call it orchestration, response orchestration. And we're very flexible. Good organizations like us are where in the CEO, we've marked your CEO, we know that's your production server. We're actually gonna call our contact down the escalation.

Miles Lowry (57:55)
And say your CEO has been breached. This is the situation. You're gonna get this call in 30 seconds or less down the call tree. What do you want us to do? Right. So in that situation

Max Clark (58:05)
Poor IT guy getting that. Or gal, right? Or gal IT person getting that. Can you imagine that? You know, you're like twenty-three in the help desk and for whatever reason you're on this like chain and like you're you're by the way your your CEO's infected with ransomware and what do you want us do about it?

Miles Lowry (58:19)
Right. And

Miles Lowry (58:20)
that's one of those conversations that it's funny when we have these interestingly, the vast majority of our conversations, and you've seen some of these, it's with a business it's a security leader, right? It's usually not the underleans or the workers underneath that are on these calls. So when you're talking to them, it's your machine. Like, you know, what do you want us to do with you're the CIO. Right. So we understand and they get that and they always think you can see they think about that and they're like, okay, that's good.

Miles Lowry (58:45)
what that action looks like when that happens, and fortunately I haven't had that situation happen. That's really really where, you know, the rubber meets the road. But, you know, that's where the rules of engagement are so important. But most importantly, having the ability to do so, right? And that's kind of where that delineation comes. Maybe we won't isolate your CEO because he's going to lose his mind if we do, but we could, right? We have that ability to protect you.

Max Clark (59:10)
This this kind of goes into we were talking about this a little bit earlier, but it's like, you know, somebody signs signs a contract, they start start going through deployment, they're six months in. You know, what are people discovering at that mark that they should have surfaced in an evaluation process, right? Because the evaluations aren't perfect. So there's always like there's always now the good ones are like the surprise like this is great. Yeah. That's not usually the case.

Miles Lowry (59:36)
Not not always the case, yeah. I'd say with our industry or our services in particular, it comes down to and this is why I was talking earlier about the the sim side of it, it's typically sources, right? we're very fine-tuned on endpoint, it's very straightforward. How many endpoints do you have? Very simple. network type protections are also very straightforward. Vulnerabilities at scans, pin testing, it always comes down to the biggest variants or oftentimes it ends up in a in a beginning as a negative, saying, Okay, well, we have all these

Miles Lowry (01:00:06)
Sources, you've scoped me for X amount of gigs per day. I want to bring in more sources. It's more, it's going to cost more. That's where I think this shift to unlimited and nothing is unlimited, as you very well know, has really changed that game because we have had a lot of clients historically who we do scope accurately, but they want to bring more stuff in. They see the value of a sim, they see the dashboarding, and they're like, by the way, we have this whole server farm over here, or we have these applications we want to bring in, and we don't want to pay you more, right? So that was that's probably from our service side. That was the

Miles Lowry (01:00:36)
biggest gotcha six months in is they're they're happy actually with the service. We like what this is doing, but we want to bring more in and we don't want to pay you for it. Right. Right.

Max Clark (01:00:46)
Who should be in the room on the buyer's side that usually isn't?

Miles Lowry (01:00:49)
Procurement.

Miles Lowry (01:00:51)
For contracting purposes, right? Understanding also the neat thing about procurement is they understand compliance and regulatory. So typically your purchasing director has a good grasp, and if not, they'll have a compliance person. But most of the time, actually the purchasing director, the higher level purchasing. And I see really mature processes, they bring them. So the companies that do have these mature processes and that move through these more quickly and more concisely, they do bring the purchasing director to a call. That's

Max Clark (01:01:18)
That connotates a much

Max Clark (01:01:19)
a lar let's say a thousand person plus company.

Miles Lowry (01:01:22)
Usually right. Yeah.

Max Clark (01:01:23)
So you've got a lot of this I mean, if you look at it in terms of like total employment count, you know, let's go not go to the var you know, small end of the S and B, but like if you say that like two hundred to a thousand person size, two you know, it's like the one hundred to five hundred band and the five hundred to a thousand band, yeah. You your average like five t you know, s four, five, six hundred person company yeah isn't running a procurement process.

Miles Lowry (01:01:43)
They have one person wearing multiple hats and that happens to be one of them. In those cases, it's really bringing in the stakeholders. Oftentimes the security leader starts this conversation because they don't want their team to fully understand or maybe they don't, you know, w know where it's gonna go, right? Oftentimes people think of managed cyber as potentially reducing jobs, which is not the case, as we very well know.

Max Clark (01:02:05)
I

Max Clark (01:02:05)
have never seen managed services displace jobs. Thank you. So

Miles Lowry (01:02:09)
It it doesn't happen. Yeah. We are coming in because you didn't have enough people in the first place, right? We're not taking anybody's jobs. We're actually freeing them up to go do what you hired them to do in the first place. So one of the groups when it's managed cyber that should be brought in frequently are your analysts. If you don't have an analyst, your IT team. Who are we going to be talking to on a day-to-day basis? Who's going to be managing this? The biggest mistake I see, and it causes an onboarding friction, and we've been able to overcome it, is a CIO, a VP comes and they buy our services. They do the whole process on their own.

Miles Lowry (01:02:39)
Maybe they bring in one other individual, but we walk through the whole process and then we're like, hey, IT team, hey analysts, I'm Miles, and this is our engineering team, and we're gonna onboard a new managed cybersecurity service that you know nothing about. Right. And what I've done to mitigate this, because this happens more frequently, is we just start with fresh with the team. Instead of doing a full onboarding call and say, put this all in, we actually reintroduce them. So I actually do a disco call over for their team and introduce them to what they're going to now be working with. But that has happened.

Miles Lowry (01:03:09)
more times than not and I had to learn that the hard way of showing up and there's an entire team ready to onboard supposedly but they don't even know what we're doing. So that's one of the bigger misses that I see smaller three to five hundred up to a thousand customer clients doing is having only their business leaders understanding what they're acquiring.

Max Clark (01:03:28)
So what does a buyer's team like composition tell you about the cycle you're you're in, right? Like I mean how else are you gonna phrase that, right? Like I maybe but I can say like how does a buyer's team like how the who's on the buyer's team tell you how the deal's gonna go? Yeah.

Miles Lowry (01:03:42)
That's a great question, and

Miles Lowry (01:03:43)
it's something I focus on very heavily. So if I'm talking to an analyst calls and that's who I'm talking to, I know this is a long buyer cycle because I have to work up and get buy-in from the top more often than not. Exactly. And I need to help them to do so. Interestingly, coming, you when I was at Nutanix and Rubrik, Nutanix, it's IT director, if I'm lucky. most of the time at Rubrik it's a backup admin, right? You never get to the CIO. It's so difficult to get to that level. ECENTIRE, I talk primarily to CIOs, CISOs, VPs of security. They're the ones. So these

Max Clark (01:04:14)
That's fascinating, right? Because you you're st it it's still both like who owns the risk, right? But just like the perception of risk and the value of the risk. Yeah. You know, there's just no love to back up ever, right? I

Miles Lowry (01:04:23)
I

Miles Lowry (01:04:24)
loved Rubrik, right? Great company to work at. I think it's a phenomenal mutable backup. Great product. But nobody wants to talk it was hilarious. So we were talking ransomware remediation.

Miles Lowry (01:04:35)
I would go in and talk to business leaders. If I got lucky enough to get to like a VP of security, they'd be like, Miles, I love what Rubrik does. It's backup. I want somebody to actually prevent the cybersecurity threat in the first place. That's what led me to eCentire. Right. And I just kept knocking my head and it's like, we just can't talk about backup as the same as ransomware recovery.

Max Clark (01:04:57)
So I talk about I

Max Clark (01:04:57)
I ask this question a lot. It's like, are you investing in prevention or are you re investing in detection and remediation? Right. Like 'cause like a lot of these tools like aren't really prevention tools. They're all like Right. You know, and like nowadays

Miles Lowry (01:05:08)
Visibility remediation.

Max Clark (01:05:10)
we talk about dwell time, it's more about like how fast can you identify that you've been breached just to limit your potential exposure and like spot on like recovery window, right? Yeah. And because nobody really is in the market going out there saying like

Max Clark (01:05:24)
you s sassy. Sassy now means everything under the sun, right? But like it's the same it's the same story, you know, it's it's not it's not prevention. You know email gateways are not it's not like you know, like it's a it's a different animal.

Miles Lowry (01:05:36)
It's really one of the evolutions I'm seeing and we've called it secops here at ECENTR with our new autonomous right. Exactly. That's the new thing. And I I hate the term.

Max Clark (01:05:44)
Something DR or something ops.

Miles Lowry (01:05:45)
Yeah, it's some op,

Miles Lowry (01:05:46)
some are. But the idea is really interesting and it's preventative, right? As opposed to waiting. So as an example, one of the things we talk to a lot of clients about is we can go in and we can proactively identify threats or weaknesses in your environment ahead of time. It's been preventative because pen testing is very expensive. Well, that's changing drastically. A lot of prog a lot of organizations don't run vulnerability programs that correlate the data in. Everybody does a vulnerability program, but what do they typically not do? Take that data and

Miles Lowry (01:06:15)
correlate it to their own systems, right? Because it's amazing. We'll do a scan, we do proactive scans every day in clients and we'll see, okay, you have software that has a new IOC. It's not a problem yet, by the way. Nothing's happened. Yeah. But it is a problem. And guess what? If you go deal with this now, no problem.

Max Clark (01:06:31)
The thing that opened my eyes to MVS was Log4J. Yeah, big time. And that was insane to to to like help clients through. Yeah. And just how it was like first off, it was everywhere. Yes. In places that nobody knew it was. Exactly.

Miles Lowry (01:06:48)
Yeah.

Max Clark (01:06:49)
And then like one box be running three versions of it. Right. And then it was just like patch whack-a-mole for like a week. It felt you know, like maybe even longer than the week. I'm like, I think it was my like my my

Miles Lowry (01:06:57)
Yeah.

Max Clark (01:06:59)
but like it was insane.

Max Clark (01:07:01)
insane and and an V S is an underutilized category because T C O R O Iada yada yada but then you have that experience with it and you're like, man, what would this have looked like if this wasn't in place? Yeah. You know, and what would the outcome have been? And

Max Clark (01:07:24)
you know, I can we can we can we can hype actually let me ask you one more question here on this so yeah deal goes sideways after signature you know so really that's probably gonna be like the first six months post signature, right? Yeah. Like it feels like things go good. It's like that's when you really know it's like is What's

Miles Lowry (01:07:40)
Yeah, you're gonna identify it in that first six months.

Max Clark (01:07:42)
almost always true in the sales cycle like that lead to that?

Miles Lowry (01:07:47)
That

Miles Lowry (01:07:47)
led to something it it's I think it's both sides making a mistake there. So one, it is usually a client that didn't ask all the right questions, didn't understand exactly what they were looking for. It's usually a an earlier generation buyer when it comes to managed cybersecurity services, but it's also on the sales side. It means that the sales team didn't do a proper job of understanding the outcome that the client was looking for. Because immediately upon that onboarding, if there's friction, it's because there is a gap.

Max Clark (01:08:20)
Well so I so how much of your job then becomes education versus selling, right? Because

Miles Lowry (01:08:24)
Seventy percent is education

Miles Lowry (01:08:25)
in the beginning. That's my initial calls is really I told you, you know, some nice pleasantries and so on and so forth. But the biggest part and what has led to my success is a lot of people don't realize I'm a seller because I you've kind of seen me go through it. A lot of times I want to just educate you on MDR. I get a lot of partners that bring in it's not a deal for a year, maybe two, right? I just want you to talk to these guys about what is MDR. And that is a big part of I enjoy the conversation, but it's a big part of what I do and it does move clients.

Miles Lowry (01:08:54)
Forward faster when you educate them. Don't sell them. Come in and give them a vast array of what you do, what the other and when they understand that you understand the market, you understand your competition, you understand what they're doing. I may not understand everything you need today because we haven't gone there, but it's very powerful to come in and just provide a very good education of what is going on, especially a lot of the smaller organizations that have a CIO or a CISO, they're not up to speed. You called it out earlier. They are not up to speed on what's going out. That's one of the best ways to build trust.

Miles Lowry (01:09:24)
is show that you know what you're talking about.

Max Clark (01:09:32)
You know, a cybersecurity program is, you know, it's people, it's process, it's technology. Right. And and the technology sprawl, right, when we start talking about categories is expanding, right? So before, you know, like say if you have a really simplistic and you look at cyber insurance, right? Cyber insurance wants security awareness training, a security mail gateway, an E D R you know, maybe you're they're they're pushing you into D R sort of backup, right? And maybe maybe D R is being and now we're seeing insurance carriers talking about the outcome differentials between D R being in place versus not. Like

Max Clark (01:10:02)
If you don't have MDR, you're in a world of pain. If you do have MDR, you're gonna get through it, right?

Max Clark (01:10:11)
But then it's impossible to be an expert and to integrate all these things, but cybersecurity also requires a certain amount of expertise and integration, right? And you and you look at other acronyms like CSPM tools and DSPM tools and DLP tools and like all these different things, data classification tooling, agentic, yada yada yada. Yeah. Like that makes this really messy as well because like the the push from the customer becomes very natural of I need you to do this other thing for me as well because you're my security guy.

Max Clark (01:10:39)
And you're like, I'm sorry I can't do that for you because we don't

Miles Lowry (01:10:41)
We don't do that. Right. Right.

Miles Lowry (01:10:43)
That is one of the biggest jobs of the seller in the beginning of the conversation. So what can make a deal go sideways six months in, that's a big piece of it right there. I need you guys to do DLP. Right. So a lot of people want us to do DLP. I call that out all the time early. We do not do DLP. If you and you you said this early on, and clients respect this. When you come in and you do what you do really well, which ECENTIRE does what it does very well, but we don't do anything outside of that. Right. And if you can

Miles Lowry (01:11:11)
Explain that to a customer. I was on with a customer, the one I was telling you yesterday, who was asking if we do all these. No, we don't. And they understand that because you can't to your earlier point do everything that

Max Clark (01:11:22)
I

Max Clark (01:11:22)
I mean bless them. I I would bet that ninety percent of the people asking for DLP have absolutely no idea what they're really asking for. Except somebody has told them to go out and get DLP. Yeah. And that's and I see that a lot where it's like, and now we see a lot more of it in terms of customer requirements going in where it's like the customer's telling them you gotta check all these boxes before we'll give you money and then they're like, we need a DLP tool. And you're like, Well, what do you need a DLP tool? let's let's let's

Miles Lowry (01:11:42)
I don't know, it says it on the list. No.

Max Clark (01:11:45)
let's call out an analyst here for a second. So one of the funniest things I've ever read

Max Clark (01:11:50)
And was Gartner trying to explain the difference between SSE and SASI, which by the way, they invented both terminologies, right? And now they were trying to explain it. And I'm I'm reading this po this this ar this blog post, I think it was blog post, where they're trying to like unmuddle the water that they've created, right? So Gartner usually leads a lot of these category terminologies. Right. And and now Gartner is basically saying the same thing with MDR. It is so muddled, buyers cannot tell the service from the software, right?

Max Clark (01:12:19)
Thank you, Gardner. Thank you for creating this this mess for

Miles Lowry (01:12:22)
The ones who created it.

Max Clark (01:12:25)
So so now we've got service and software, which, you know, for most MDR vendors, this is a c a a question of scale. You cannot scale if you can't layer you know, tools and and software into it in order to actually give you the efficiency of scale. Right.

Max Clark (01:12:41)
How does a buyer cut through this mess? Because like how much of the evaluation then becomes the people in the process of the MDR versus the underlying technology of what the I mean, some MDRs are out there like, hey, we'll take over your Splunk instance. Right. Right. Right. We do. But when you get into that conversation, now you're making a technology decision more than you're making a people and process decision, probably, right? Is that a bad idea?

Miles Lowry (01:13:03)
It's not a bad idea because I think the evolution of this industry is integrations, open integrations, right? it's one of the things we've been focusing on. you know, I think most of and you have two categories of what I look at MDR providers. You have the manufacturers like the CrowdStrike, the Sentinel ones, Palo Alto's in there. There's some others, Fortinet. They are phenomenal most of the time, either in point companies, networking companies. They're not the best MDR providers, right? And that is where there's a delineation.

Miles Lowry (01:13:33)
And you're also locked in. If I go with a CrowdStrike as an example and they're Falcon Complete and I do their sim and I do their identity, now I am in a CrowdStrike world. A lot of organizations aren't comfortable putting all those eggs in a basket. So what we've seen and we've adjusted our services over the past couple of years is meeting clients where they're at in the market. This is what most clients are looking for today. Now the smaller companies, they want best of breed tools. There's a tool set, right? We gotta get you off of E set and we gotta move you to something better.

Max Clark (01:14:02)
I mean, okay, yeah. Sure, right? You know, like you were running re web root. I'm like, you know, like okay, great, like e you know.

Miles Lowry (01:14:08)
So those guys we gotta get there's a techno there's a technology conversation. Right. But more often than not, the the better conversation to have with an organization is do you like the tools you're using? What are those tools and can we help you manage those tools? Take advantage of the investment you've already made today. That turns into the process and the people and the t the service conversation behind the scenes, which is a lot easier than now having to vet a new technology. If you're using CrowdStrike and I come in and try to say you need to be Sentinel.

Miles Lowry (01:14:38)
which we would not do, obviously, but now we have to vet Central One. Now we have to vet a technology and a process.

Max Clark (01:14:44)
So okay, this

Max Clark (01:14:45)
is actually really interesting to talk about, right? Because there's this idea of best and breed, right? We have to run we have to run the best and breed. And you're like, what does it actually mean? It's like you have the best b branding, you're at the top right of the quadrant. Like what is what is and why are you at the top right of the quadrant? Does it even apply to you? I think this is the other thing that's really fascinating. When you ask people what in your organization actually matches the criteria that puts a vendor in the different parts of these quadrants, can you tell me the answer? They can't have no idea. Right?

Max Clark (01:15:14)
You don't have a global footprint? Does that matter to you? Right? Like no? Right. So now the other pro so I I've for a long time it's like, okay, what's the R and D that's being invested in the product?

Miles Lowry (01:15:25)
Right.

Max Clark (01:15:25)
That's a good thing and it's a really bad thing because companies with a lot of R and D money, they're also focused on TAM expansion. And TAM expansion means that they have to go out and acquire, you know, new product, new channel, new customer segment, new, you know, new, new, new, and they also want to go out and get a bigger slice of the pie. Right. Fortinet wants a bigger slice of the pie. Palo wants a bigger slice of the pie. And like so they're spending a ton of money on R and D, which you would think is good because it means they're investing in their product, but then it's like is that money actually going where you want it to go and where you care about?

Miles Lowry (01:15:55)
How

Miles Lowry (01:15:55)
mature are these products that they come out with? That's the biggest gap. I we see this constantly. Fortinet's a big one. CrowdStrike, we work very closely, as you know, with Sentinel One. They are releasing modules, as they call them, security modules. Very un unfunctional. The vast majority of them are too immature. To your point, they have initiatives to get out. They all want to be a complete security provider. So we're gonna place and and they will get better. These tools will get better over time. These are large organizations that will develop these tools, but

Miles Lowry (01:16:25)
I don't think a lot of organizations, we get a lot of customers who come in and they've bought everything under the sun from a CrowdStrike or a Palo and they're like, help us, right? None of this actually does exactly what we want to do. And we're s kind of stuck in some situations. A client can be stuck because you've made this enormous investment, a three-year contract with CrowdStrike, and you realize that even though they're CrowdStrike and they're the best of breed, yeah, the modules underneath that, what they do really well, which is the endpoint, aren't all together. You see that with Palo and their extra cortex.

Max Clark (01:16:54)
Acquisition bolt ons

Max Clark (01:16:55)
are terrible. The man, you just triggered a thought. I know if we'll go down that rabbit hole just yet.

Max Clark (01:17:07)
MDRs, MSSP, SOC as a service, XDR, everything now has ADI, the title. Right. Agentic

Miles Lowry (01:17:16)
Yeah.

Max Clark (01:17:16)
has to be this before it was machine learning. if if if you're in an eval cycle and you can only ask one question, right? Because ultimately now every single one of these companies is basically telling you that they can all they're the best. Yeah. Right? We're the best. Right. Every press release, the leading blah blah blah, you know, company.

Miles Lowry (01:17:35)
We're

Miles Lowry (01:17:35)
the best, the authorite.

Max Clark (01:17:36)
You know. So now

Max Clark (01:17:37)
you're on the other side of the table and you get to ask one question. Yeah.

Miles Lowry (01:17:42)
That's a tough one. I I think I would have to

Miles Lowry (01:17:46)
Phrase it around the response, right? I think that's the most important thing. If I'm the customer, everything you do, I need it to validate. But at the end of the day, what is the most important thing for me? And I think that for most clients, the most important thing is that if it's two o'clock in the morning, they're on vacation, it's a weekend, that somebody is going to protect my organization, right? And that I don't know how to phrase that question exactly, but that's the question I think more organizations need to focus on. They get caught in the minutiae of how we do this and does this work.

Miles Lowry (01:18:16)
work this way, but aren't you paying an organization to come in and ultimately protect you from a business impacting event? Right. So that's one of the questions, if I could ask one, and it maybe how, right, get into some detail there. But that's one of the biggest questions I think organizations need to focus on is what does your response look like? And can you take the response without us?

Max Clark (01:18:38)
I've been installing firewalls since the beginning of time. Yeah. I mean at this point I'm the old guy, right? Right.

Max Clark (01:18:47)
things that cracks me up still to this day is like, we have D packet inspection on our firewall. We have unified threat analytics or you know management or exchange firewalls. Yeah, exchange firewalls and like I I will tell you that every single one of these things I've ever seen deployed, that box gets checked, it runs for a little while, they realize the firewall gets slow, they uncheck the box. Yes. Right? Yes. But that so that leads me into like the the the this like foundational here. So so best in breed point solutions where people are trying to do it yourself and bringing these things in, what's always missing to me becomes

Max Clark (01:19:17)
the volume of data and the ability to give you know specific isolated heuristics around abnormalities, right? Because what you're looking for is is I I what I love about you know I hate I hate term clout, right? But what I when when you start talking about going to a service provider that has scale, right, it's like, what amount of

Max Clark (01:19:39)
of stuff are you seeing, can you see a pattern before it hits me? Yes. Like I value that. And

Miles Lowry (01:19:44)
Absolutely.

Max Clark (01:19:45)
the other side of it is then can you also tell me on a case by case basis what's abnormal for me? You know?

Miles Lowry (01:19:51)
Yes.

Miles Lowry (01:19:52)
That's the baselining and that's the visibility. So the second if I could lead a client into asking questions, response, the second is visibility, right? Having some level, not just some level, having deep visibility into what is going on in my environment and then correlating that data. That is the real value, and this is taking out where you bring in like a CrowdStrike or an MDR manufacturer, this is sub sort of what you lose, which is that ability to correlate data, to understand a baseline.

Miles Lowry (01:20:21)
Of behavioral expectations versus anomalous behavior, right? And that's a real value. And again, I don't want to get into the XDR, but call it the ability to pull in a ton of data into a platform that is running a level of AI, a gentic AI. But the goal is to really understand what is anomalous, right? And this is the delta or the differentiator that I'm seeing out there is a lot of organizations are saying AI is the end-all be-all. Well, pull it in, it's going to find the abnormality, and then it's going to go do something. Well, what's hilarious is

Miles Lowry (01:20:51)
we leverage, we have, you know, work with Anthropic. We have all these use cases out there.

Miles Lowry (01:20:55)
nine this is nine, I think it probably probably seven out of ten times the AI response is incomplete. So we use AI within five minutes, it tells our analyst, but there's a human, every single time. It tells it what it thinks it should do. It'll say isolate an endpoint, suspend a user account, MFA author well, half the time it's wrong. Yep. Right? And that's the funny part. It did all of the what it should do. Level one, level two investigation, present all the data, do what would take an analyst twenty minutes in two. Awesome.

Miles Lowry (01:21:23)
Don't let it make a decision. Right. And that's really it's it's baffling.

Max Clark (01:21:28)
my goodness. Yeah, they call it hallucinations. Yes. And what's

Miles Lowry (01:21:32)
Did constant hallucinations.

Max Clark (01:21:35)
what's really funny and fascinating for me, using deploying, to you know, securing whatever AI is like

Max Clark (01:21:44)
Even l knowing like knowing the subject matter I'm dealing with and like getting into an argument and my favorite line that comes back is like, you're right. That was wrong. And then it gives you another wrong answer and you're like you're like and and when do I say

Miles Lowry (01:21:57)
Are

Miles Lowry (01:21:57)
you kidding me? I knew I ran to kick it

Max Clark (01:22:02)
I'm I'm I think I'm gonna skip this and see what we have for time here. But I'm I'm really curious about this because we kinda we kinda like segued into into rubric, rubric for a heartbeat, right? Yeah. And I'm I'm kinda I'm fascinated about this because so now you're selling MDR, right? Which is detection and response. And the response is remediation for most people, right? It's like something happened, how do I fix it? Yeah.

Max Clark (01:22:28)
and that that like it's like okay there's this thing now that I have to get rid of, but then it's also like how do I protect it, right? Right. But you get to a certain point where the response is like, okay, let's go f to your backups and recover your backups. How often are you having backup conversations with your customers now as a security vendor?

Miles Lowry (01:22:45)
It's interesting. So we don't typically have I'm unique in that aspect because I come from a world of backup. So I bring it up early, but I do a really good job of delineating between the two, right? Backups are mandatory. You must have backup. I'm just going to make the assumption that you understand that and you have backup.

Max Clark (01:23:03)
my mom had a fun phrase that she used to say all the time about assuming things. It's not

Miles Lowry (01:23:06)
No, I know. I that

Max Clark (01:23:07)
PG thirteen.

Miles Lowry (01:23:08)
And

Miles Lowry (01:23:08)
I I joke when I say I assume, but I will say that to a customer. I'll say, Well, I assume you have your backup and if they roll their eyes or something, I'll pause. I'll be like, Well, what are you doing for backup? because that's not something we do, but we are a security partner, right? And that's one of the neat things about eSentire is we are if you don't have MFA, so we're gonna tell you to do it. We're not gonna sell it to you. We'll help you reach out to your vendor or whatever you need us there, but we want you to put that in place. I have come across some back some organizations that didn't have backup. whether it's Rubrik and the smaller side, these are usually small.

Miles Lowry (01:23:38)
Is not usually the best fit, but something like a Veeam or you know something along those lines, they'll ask me, Hey, well, who do you recommend? And I, you know, it's interesting because I eCentire, not the backup provider, but that is a conversation that we have, but you have to be careful on the MDR side or the managed cyber side. You have to delineate yourself, you have to pull yourself away from the backup because you do not want to get in that pigeonhole of being like a backup. We're preventative versus you have to make sure you separate those two because earlier as I was

Miles Lowry (01:24:08)
mentioning if you fall into that backup category, you're not gonna w work your way up the chain. They're not gonna understand. They're not gonna look at you as proactive or preventative, but more so this is what happens when we break the glass.

Max Clark (01:24:22)
okay. Let me let me ask you I'm gonna I'm gonna formulate two smart questions. I like it. Okay. a friend of mine in the space made the observation that when companies move from the business editions of of three sixty five and workspace, they go to the enterprise edition, right? They get a lot more functionality. But the other thing that they get is they got a lot of check boxes where they can check or uncheck the boxes. And the problem becomes that they don't understand what the check boxes are there.

Max Clark (01:24:51)
Right. So now, you know, y you know, when you look at the Microsoft suite, you know a thousand plus configuration options that you can make. Right. And and and very you know very specific skill sets then within all of those different products. You talk about like if

Miles Lowry (01:25:07)
Absolutely.

Max Clark (01:25:09)
the customer doesn't have FA, you're gonna tell go out and get an FA. For most people, you know

Max Clark (01:25:14)
eighty plus percent of the market's running Microsoft, right? That means Entra. Exactly. Right? Which pushes them into SSO. And this is not a service that you guys are managing for people.

Miles Lowry (01:25:23)
We

Miles Lowry (01:25:23)
we don't manage it but we do do the hardening of it. So it's interesting. This has been a so we're a big Microsoft partner, obviously. One of the biggest pain points that I come across and I work with a lot of this is usually interestingly, healthcare and state and local government. They have the entitlements to E five almost across the board, A five, G five, whatever it may be. Right. But they're running something else. It could be a crowd strike, it could be SOFOS, you name it, right? So there's an easy conversation to have there about taking advantage of. Now I identified this at MESAC, which is the big conference for a state.

Miles Lowry (01:25:53)
Local government. Five years ago in Tahoe, I was doing a Microsoft presentation. ECENTIRE had become a newer Microsoft partner. And I just asked the room who here has, and these are all cities and state, and these are all their IT leaders, who here has Microsoft E5 licensing? Almost everyone raised their hand. Who here is using Microsoft Defender? Two people raised their hand. So I realized immediately, well, there is an opportunity. Now, what the biggest gap, which I identified was is to your point, the checkboxes, the configuration, the

Miles Lowry (01:26:22)
Hardening of the environment. It is complex. It is confusing. Organizations don't feel that they have the expertise to deploy the suite of Microsoft Defender, you know, endpoint, O365, Identity, Cloud Apps, Azure Sentinel. How do we deploy this? Is one of their biggest concerns. So one of the things that eCentire has done is we do all of that for them. You must put the agents on your systems. And you'll see this from the Blue Voyance, is another one that does this. There's a company on to new. There's not a lot of us that do this, but those of us that do are excelling in the Microsoft space because.

Miles Lowry (01:26:52)
Because once you get the system, the agents on, we're gonna check all those boxes for you. We have an onboarding process and we don't do it for you, we do it with you. Most clients probably don't pay attention and care. But the ones that do, we walk them through and we explain these are why these are checked. This is the reason for this. This is an identity. Maybe you have an email team. Let's bring them to the call and show them why we do this. So that is a big change or big differentiator. Organizations that don't do that and are trying to sell Microsoft, you will see the teams immediately just shy away and they'll say, we'll just stick.

Miles Lowry (01:27:22)
with crowd, we can't manage this. We don't know how to configure it.

Max Clark (01:27:26)
'Cause it in some cases, you know, you run because this is where you run into this interesting like line conversation of like where is the line that you're managing, right? 'Cause if you're going through and you're configuring entre for somebody, you know, you're you're that's like you're blurring into like the MSSP space, right? But

Miles Lowry (01:27:39)
Dangerous space, yeah.

Max Clark (01:27:41)
the other side is is like

Max Clark (01:27:43)
There's a var, there's a there's an S S P, there's an MSP, there's an MSP in place already that's also telling the customer like, we can configure this for you. Right. You know, and you know, not to say like universally they they can't, but like you know, that that skills like level is so extreme between the two of them. Mm-hmm. and this is why, you know, I've become a big proponent of like a C S Pm tools for a lot of people. Just

Miles Lowry (01:28:05)
Yeah.

Max Clark (01:28:06)
because it's like, look, you can just point it at your thing and it's just gonna tell you what's there. Exactly. And like, do you know that it's there or not? Like

Max Clark (01:28:13)
Did you make this as a conscious decision or is this just some default or was this something that's changed?

Miles Lowry (01:28:17)
Right, right.

Max Clark (01:28:18)
change management on these things are crazy. It's you know, you know, so if like if you're going through and you're configuring, you know, MFA and you're helping people with an oncha deployment, you know, or defender, right? Yeah. I mean, thank you, Microsoft, for making this thing so confusing, right? Because in Defender for endpoint versus defender for this versus defender for that versus you know right.

Miles Lowry (01:28:36)
Yes, exactly.

Max Clark (01:28:39)
that's also not like a one time set it and forget it activity.

Miles Lowry (01:28:42)
No, it requires care and feeding and also as the organization changes, do we need to make changes to that, right? And that's still a gap even at eCenter. I don't think anybody honestly could say that they're on top of that. That is a partnership with a a client, right? That is having the relationship with the client team when there is change in the organization, that they can articulate that to the their team on our side and say, Hey, we've made changes. One of the things that we do do, which helps with this, and I think any good organization does an architecture review, right?

Miles Lowry (01:29:12)
So we perform a yearly architecture review at the annual, each year we'll do one of those and we'll take a look. We do CSPM with Tenable, right? you have to be subscribed, but we're not gonna do it obviously for free. but we do prefer if our clients have, you know, an MVS, CSPM. We do a CNAP service if you're running in the cloud. Let's take a look. but we do find that it gets stale. And I think all organiz anyone who says this isn't true is just lying. Is after two or three years, and I have found this because I've been here now five years.

Miles Lowry (01:29:42)
Is at that mark, you have to go in and you have to resell the customer. By the way, your company does vastly different things than it did three years ago, guaranteed. and they probably don't know that you do these things. So oftentimes I think customers leave manufactur manufacturers or service providers like ECENTIRE because they know what we did three years ago. They were okay with it. It worked really well. There's been a gap in understanding what you do today, and everyone else is telling them what they do because they're already our customers, so we're not trying to sell them, but everyone

Miles Lowry (01:30:12)
else is and I have found this to be an absolute deficiency in eSyntire's process and I believe everyone's process is we assume our customers know everything we do. Right? And it's just not true.

Max Clark (01:30:25)
Yeah, I I think so okay, the tendency is to try to fix that through like a QBR process. Yeah.

Miles Lowry (01:30:29)
It is.

Max Clark (01:30:30)
But QBR processes devolve really quickly. Exactly. You know, and it turns into like, you had four tickets and we did these resolutions. And and you you

Miles Lowry (01:30:37)
Tell me what happened in this one. Can you go pull that one and

Max Clark (01:30:40)
called in our support organization five times and this is our metrics, you know, and like, you know, we're these are the KPIs that we're tracking for you, so you can report it up to your, you know, your your leadership. And like it's like

Max Clark (01:30:53)
i is the QBR itself even functional? You know, and do you have the right stakeholders on the call with the QBR or is it always like, it's you know, whatever the low j junior analyst has now been like, you know, like

Miles Lowry (01:31:06)
Yeah. It turns into that. The larger organizations, more, you know, call it five thousand or higher that we work with, they're real. Those are real QBRs. They bring the right teams to the call, the right stakeholders, not all of them, but frequently, more often than not. And that's gonna be the business leader. They need to be there. They're the one that holds everyone accountable. You need your analysts there. You need the people that are managing with us your system because it is co-managed, right? So we want all those stakeholders on a call for it to be truly valuable. more often than not, to your point, it devolves.

Miles Lowry (01:31:35)
Over time, and these QBRs turn into one, sometimes they don't even show up, right? Like they just don't show. Or more often than not, it's you know, it's an analyst or a guy or gal, you know, analyst who has now been tasked with basically getting the report. I don't even know if they pay attention, then they just send it up. In that case, let's not do those. And I talk to clients about that. You know, we can just send you a report. We don't want to waste your time if you don't want to do these. The trick is also doing an architecture review. So eCentire changed this about six or seven months ago with technology.

Miles Lowry (01:32:05)
Technical account managers, and this is important because a lot of service providers have C CSMs, right? We had them as Customer success manager is great, but they don't know anything. And what do they have to do? Get on a call, you ask them a question, they have to reschedule a call to bring a technical person. You can achieve you can get rid of that by having the CSM replaced with a technical account manager. So we did that, it's really changed the game. And then the other piece to it that we started doing, and I've been doing this because I like to keep references and clients going for a while, is an architecture review with your engineer.

Miles Lowry (01:32:35)
You can't do this with a CSM. You can't, you need to, who was the team that worked with you guys first? We have historical knowledge of why you chose eCentire, what you look, what your problems were. And we can come in and say, hey, Max, you're gonna love this new autonomous pin testing service. Or by the way, we now bring Microsoft, we run Microsoft Cloud. I know you were looking at, you know, so that's really where just taking the time to reach out every six months, each year, at least once a year, and have the sales team, not an unknown TAM or CSM.

Miles Lowry (01:33:06)
Who has typically come in and given you metrics, right? You're not listening to that person because they're your metrics person. They're the one that just throws nonsense at me. And if that's the one who's presenting you the new services, you're like, So

Max Clark (01:33:18)
Versus versus we're on our seventh account manager then.

Max Clark (01:33:27)
you'd you'd spawn a thought and I had a I had a really good question and I I'm I and I've lost it, right?

Miles Lowry (01:33:33)
però capri

Max Clark (01:33:34)
Well,

Max Clark (01:33:37)
you know, the the problem with all these things, it's like

Max Clark (01:33:42)
I love startups.

Max Clark (01:33:44)
Yeah. You know, I I fell into the dot coms early in my career and it's intoxicating and like I I just I love working with startup. And I've I've noticed like y you know, it's like people are always like, you know, they want to know your your your like headcount bands you work with, like what size? You know, we say like, we work with two hundred plus, right? Well, what's actually I've noticed more than anything else, it's like a technical maturity that kicks in. It's like some point you've gone from the business edition of whatever tool suite you're on and you've gone to the enterprise edition, right? Because you've needed some sophistication, right? You want SSO, you want e discovery, you want

Max Clark (01:34:13)
want this, you have integrations, right? And it's like, and that became my real litmus test. It's like, are you on the enterprise suite or are you still on the knot? And you're like, okay, well, you know, like I don't care if you're 150 people, if you're running enterprise, it's like real stuff is happening here. Yeah. But

Miles Lowry (01:34:26)
Exactly.

Max Clark (01:34:28)
then but then it's really interesting because we talk about this like when does procurement come in? You know, organization over five thousand people, you know, there's there are points where

Max Clark (01:34:36)
You know, the organization shifts from like hiring a bunch of doers to then like who owns it, right? And then that owner, it's like I own risk and I own outcome.

Max Clark (01:34:47)
not doing risk management and outcome deliver you know and and and like and that's like a really interesting evolution point too for companies because it's it's it's so spongy. It's not like, you're five hundred people now that you have this different role, right? Right. And you know, IT is almost universally under you know, resourced, right? And

Miles Lowry (01:35:07)
Constantly, yeah.

Max Clark (01:35:08)
and I it doesn't generate revenue for the business. Like why would you invest in it, right?

Miles Lowry (01:35:12)
Right.

Max Clark (01:35:13)
you know, and I mean with when I was starting I think the ratios were like sixty ish employees per IT headcount. Right. And now you're like, it's two hundred.

Miles Lowry (01:35:21)
Two hundred, three hundred or more in some cases.

Max Clark (01:35:23)
Yeah. And a lot of that's also just because we have better tools. Exactly.

Miles Lowry (01:35:27)
And you can be more efficient, but it, you know, I I still do think that a lot of the organizations get caught up on their resources, right? Their utilization of the resources, and they get confused or at least don't quite understand the value of their own resources, right? And that's one of the areas that if you bring a business leader into the conversation, they typically get this, right?

Miles Lowry (01:35:54)
Exactly. And you you have to help them to understand that. Not everyone does, right? But if you help them to understand that, you know, you hired these guys and gals to do specific tasks. Are they doing these tasks? Is the great first question. Most of the time the answer is no, they're not because they're doing this. I have them doing this. They're running around, they're upset. I've been, you know, I don't like to get into the retention of employees pieces, but unhappy employees that are overworked don't usually have great retention either. It's not always a matter of fact of we can't hire the right people because

Miles Lowry (01:36:23)
Can you retain people? Are you overworking them? Right. And that's a constant everywhere. I don't really care what organization is, but it's something that business leaders need to be aware of. And you're seeing this more so ever than not with analysts and cyber experts, right? They all know that they're in need. These guys and gals, you know, they get their certifications. And as soon as they get certain certifications, they're in the market, right? Period. Because they know they are in the They're employed.

Max Clark (01:36:49)
Yeah.

Max Clark (01:36:50)
Let's let's close us with AI. Let's talk about AI for a moment, right? Yeah. You know, and there's instantaneously this fear of like AI is going to displace all jobs, which I I'm not an

Miles Lowry (01:36:59)
Just not the case.

Max Clark (01:37:01)
AI doomer because I've been doing this for long enough that I just know that's not the case, right? I agree with you.

Miles Lowry (01:37:04)
Agree with

Max Clark (01:37:05)
so what are we actually seeing with AI, right? We're seeing companies positioning AI as product improvements, which in some cases are and in some cases are not, right? Like you can do some things faster, but other things you're just creating more work.

Max Clark (01:37:16)
in security specifically we're seeing lots of additional threat factors now coming from AI. Microsoft just released like one of the biggest patches in the history of Microsoft. So so it's like on one hand it's like AI lets you do more, but then also AI creates more risk and more more, you know, noise. So then it's like now we're using AI to fight AI. yeah. And like that just you know

Miles Lowry (01:37:44)
It's it's

Miles Lowry (01:37:45)
a never ending escalation.

Max Clark (01:37:46)
Right. And so and you still need practitioners who understand what's actually going on to then be able to make decisions, you know, of like what's actually happening inside the organization. Right. So now you can, you know, hopefully like these things r rise kind of equ equally at the same time with each other. But you know, so this is I'm gonna end this here on a on a prediction question with you, which is

Max Clark (01:38:09)
you know, a year from now, and this is always fun to do because you know it dates it dates all these recordings really intense, but like a year from now, what is the AI conversation we're having? And for you like the agentic, like workforce tools, like all that stuff, you know. What is the impact in cybersecurity?

Miles Lowry (01:38:24)
Just the how we use it, right?

Miles Lowry (01:38:28)
Yeah, I mean

Miles Lowry (01:38:28)
I I'm with you. I'm not a doomer. I actually think that from a cyber aspect, what AI has done is pretty fascinating. It's scary and fascinating at the same time. The value that I've seen is the ability to leverage it to speed up an investigation cycle, right? To understand anomalous behavior, that humans don't necessarily put these links together. We will over time, but it does it quickly. The breakdown is earlier as we discussed the hallucination. There are organizations out there that are creating

Miles Lowry (01:38:58)
AI, it's more of SOR orchestration. They leverage AI to do a threat hunt and then they use some sort of SOAR orchestration to take an automated response. The problem with that is AI isn't there yet. I think in a year from now, the conversation, and it's gonna be interesting. I I hope I'm slightly wrong on this, but you look at Glasswing, we were been working around that. You look at the ability to basically create an IOC off of or to create a malicious package off of a newly found IOC with under five to ten minutes now.

Miles Lowry (01:39:28)
Right. That's what we're seeing. We we were able to see that I can weaponize an IOC and deliver that IOC out. We'll call it 30 minutes and actually have a fully built campaign. That is getting smaller. You know, we used to talk about 30, 60, 90 days to patch. It's really 30, 60 minutes, right? So I think the conversation in the future is in a year from now is how are we leveraging AI to fight AI to some extent? And it's it's it's interesting because what does that mean? I don't think

Miles Lowry (01:39:57)
It gets rid of people that the human element is still the key to validate. There will become a point though where, or will there, I believe there will, where the human element isn't as valuable as it is today because AI will be more mature and it will be faster. So I don't think it replaces people. I think there's going to be a human element tied to this, but I do see like an analyst as an example. You look at SOC analysts, and we're seeing this for the first time ever. SOC analysts, they couldn't hire enough. What has gone down in terms, if you look in the market, analysts.

Miles Lowry (01:40:27)
positions. They're not hiring as many analysts now because organizations I think they're falsely doing this by the way, but they think that they can replace humans with AI.

Max Clark (01:40:38)
Well,

Max Clark (01:40:38)
it's it's I equate it more towards like like skilling and upskilling, right? And the and the and the best parallel I can think of that I've seen was you know, manufacturing in SoCal

Max Clark (01:40:54)
The belief is is that manufacturing it doesn't, you know, left Southern California. The reality was it was like un you know, unskilled, when I say unskilled, like a machinist that was running a lathe doing metal work was replaced by a CNC operator, you know, running a CNC you know, running running a C and C machine, right? Right. And and just, you know, I have a I you know, you talk to economists and they'll tell you this, but like in my personal experience with my clients, it's like you see you see

Max Clark (01:41:23)
companies that cannot hire enough CNC operators mm to run their production lines and are and are paying f ridiculous wages right to try to attract talent. And and so you c you can so then it was like, all the machinists are gone. It's like, yeah, all the machinists are gone, but all the C N C people are in, right? And and so I I think about that a lot in the terms of the AI, right? So it's like does the junior does like the really junior analyst go away, it's like it's like okay, but if the really junior analyst hasn't like upskilled to become like

Max Clark (01:41:51)
the senior analyst, you know, that opportun I think there's just gonna be more senior analysts. I agree.

Miles Lowry (01:41:57)
I agree. And that's what I think so interesting on this conversation is I don't know where that is, right? I I love that analogy because you are seeing that. It is a skill conversation. The human piece is still there. It's kind of understanding where do we fit, right? I agree. I think junior analysts, you see it on the managed vulnerability side, pin testers. I think that you're going to see impact, but it's an opportunity because there are going to be upstream, upskill type of opportunities for organiz or for

Miles Lowry (01:42:27)
individuals.

Max Clark (01:42:33)
I I think this is why

Max Clark (01:42:34)
almost everybody I know in technology their fantasy is like going and buying a farm and like going off grid, right?

Miles Lowry (01:42:39)
I'm not alone

Miles Lowry (01:42:40)
there then. Okay, perfect. 'Cause I tried to convince my wife to do that and she's she's not really game at the moment.

Max Clark (01:42:46)
boy.

Max Clark (01:42:46)
Miles, this is fantastic. I could probably go another three hours. Let's not do that. Thank you very much for coming in and doing this.

Miles Lowry (01:42:53)
Absolutely, it's been a pleasure, absolutely, Max.