Subscribe
Share
Share
Embed
Evolved Radio Podcast: Interviews with technology experts, industry thought leaders, business leaders and other interesting minds. Exploring the evolution of business and technology.
Todd Kane: Before Josh Hobein ran a
se- cybersecurity practice, he was
slinging wings at Buffalo Wild Wings.
Now he's a manager of cybersecurity and
automation at Centrex IT, a top 100 MSP,
running vCISO services and a five-step
maturity model he built himself to get
companies past the checkbox of security.
He's got a talk called How to Align to
a Framework for People Who Don't Give a
Shit About Frameworks, and that probably
tells you a lot about how he operates.
He's also made the case more than
once that a great MSP and a five-star
restaurant are run the exact same way.
Welcome, Josh
Josh Hohbein: Hey, thanks for having me.
You, you nailed it.
Those are, uh, pretty
Todd Kane: Perfect.
Uh, so that's a great place to start
because, uh, I'm sure many people are
tired of hearing me, uh, throw praise
at "The Bear," not because it's not just
a great show, but I think the parallels
of how you build a world-class team, uh,
how you build culture, and how you build
a culture of discipline are actually
really tightly woven into that show, and
it's part of why I tell people, like, you
gotta watch this for basically the forks
episode, where, one of the characters
goes to this Michelin star restaurant,
and he's all grizzled and doesn't think,
like, any of this is, is relevant to him.
I'll post the, the link to the video
maybe in, the, the show notes here.
But it's a great encapsulation, I
think, of the fact that discipline has
to be something that you choose, and
it bothers me a lot in organizations
when people say, "We have a great
culture," then they complain about
the people that are doing things
that don't contribute to the culture.
And I get why this happens, but it
also bothers me 'cause I feel like
this is within your control, right?
Like, youâ¦
Dis- uh, culture is d- is, uh, defined
by what you tolerate, and if you
tolerate sort of this inappropriate
behavior or not the culture that
you're trying to foster in an
organization, it's kind of on you, right?
So I'd love toâ¦
your thoughts on this.
I think we're, we're fairly
tightly aligned on you wanna
build the Michelin star MSP.
So totally, let's, let's do it.
Let's go.
Josh Hohbein: Yeah.
love it.
Um, and also, man, I, I love The Bear.
I mean, I, uh, was itâ¦
It's, I think it's episode
seven in season one.
It's, like, the super short one
where they go through the kitchen
rush, the printer keeps going off,
someone gets stabbed and all that.
It's like, oh, isâ¦
That is the, that is the
frantic, like, rush scene.
Um, but yeah, I've either been in
restaurants or IT my entire life, you
know, more time spent on the IT side.
But, you know, growing up, that was my
first job, and then, uh, spent a lot of
time, um, you know, at the, at Buffalo
Wild Wings, not just slinging wings,
but I mean, I was, uh, front of house
manager, kitchen manager, assistant
general manager, interim general manager,
regional, went to different stores,
you know, new store opening team.
So I did a, a lot of it.
And it comes out, uh, there's so
much that, um, I took away from that
and apply to the MSP even today,
and it, there's so much crossover.
Uh, it's one of my favorite talks
to give as well, but, like, we're
still in the service industry.
I mean, the S in MSP is service.
We're a managed service provider.
So you take all of those things that are
taught in hospitality over relationship
building and taking care of your guests
or your client or your customer, whatever
you wanna call them, um, there's so many
of those skills that, that carry over.
And, uh, you know, one of the examples
I give is even just, you know, the,
you take the, the person at the host
stand, uh, that they're not, they're
not just sitting there on their
phone, like ignoring you, right?
If they take the time to note down,
you know, your stuff and, you know,
"Hey, there's, uh, a table over there,"
like you're waiting for somebody.
"Cool.
Let me, you know, sit you
there facing the window.
You know, is there anything I can get you,
you, you know, to, to drink or anything?"
Or, you know, "Sorry
we're, we're, we're busy.
Like we're bussing off tables.
Can I get you a water?"
Just something a little bit over, right?
Um, you put that person on tier
one helpdesk, give them a headset.
They don't know anything about tech,
but they get a call, somebody's upset.
They're still able to ground the
situation to understand, "Hey,
I'm, you know, I'm really sorry.
Um, this is upsetting.
I will, you know, do what I can.
We'll note it," et cetera.
They're, they're doing something.
They're making sure that they're
heard, and just like in the
restaurant, they can't fix the issue.
They're not the ones bussing
the table, most likely.
They're not the ones, you know, serving.
But like they're still trying to help,
uh, do what they can within their power.
So you take that mindset of service
first, and you train that to everybody.
I mean, it's, uh, your tier one, your
projects, your service desk, and you
just, you, again, go off that service
first, the building the relationship.
Because if you think about how there's
so many restaurants out there, and
we'll just throw BDubs as the example.
How many places can you go to get
wings, drink beer, and watch sports?
Todd Kane: throw a rock at a,
any strip mall basically, right?
Yeah
Josh Hohbein: Yeah.
Right?
And if, let's take it to IT, how
many places can you go to get
your computers fixed, uh, right?
It's, there's so many.
Um, so what sets it apart?
And it's that relationship.
You go to a certain bar, let's say
BDubs, because the bartenders know you.
They might, you know, talk crap with
you when your sports team is playing
and, and, uh, but they have that
connection and they take care of you,
might go a little bit above and beyond.
But that relationship and that
service is why you go back.
There's nothing special about BDubs.
I mean, you know, their
sauces are pretty good.
Asian Zing's awesome, but like that,
the service is what's the difference.
And most of us, we should all be able
to fix computers and troubleshoot
issues, so what makes us special?
is that service
Todd Kane: it's, it always reminds
me of the, I think it's a Maya
Angelou quote of, uh, "People won't
remember f- what you did, they'll
remember how you made them feel."
Uh, and I think that's so on
point with service, right?
Like, it is about the experience.
Because I always tell people, like,
the expectation is, is that you're
a f- if you're an IT company,
you can fix IT stuff, right?
Like, that's, that's the base.
That's, that's not, um, you know,
what you're trying to achieve and
what people will measure you by.
It's whether or not you can create
a high-quality experience where they
feel like someone actually cared about
the experience that you're having.
Like, uh, and to some degree, like, this
is tricky too, 'cause I also don't want
sort of the r- the, the memorized scripts,
uh, when you call into a call center and
they're like, "I'm so sorry to hear that.
That must be really frustrating for you."
It's like, you don't really care, right?
So there needs to be,
like, built-in empathy.
It's not just following
the scripts necessarily.
But it does make a difference if you
feel like someone, uh, recognizes
like, "Oh man, that's terrible.
Like I'm, I'm, uhâ¦
You must be pretty stressed out
'cause you can't print these invoices
'cause your printer's broken, and
you need to get these things out by
the end of the day, or like, like
people are gonna be really upset."
Like, that matters.
Like, okay, this person actually
understands the predicament I'm in, right?
Like, service and, and the
experience matters a lot more
than people really qualify for
Josh Hohbein: But yeah, I
mean, you, you really said it.
It's like, um, one of the things that,
uh, I think Pax8 Beyond, uh, Halo star--
uh, Halo, the ITSM platform, introduced,
uh, on the main stage something called
XLA, which is experience level agreement.
And funnily enough, that's
actually something we've been using
internally at our MSP for a while.
When we get a new prospect, and we
have the little pitch deck, um, we say
basically, you know, SLA or like takeâ¦
you know, solving tickets,
that's table stakes.
Like, we really care
about your experience.
And there's different
ways of measuring it.
It is a little bit of a marketing
term, I'll give it that.
But again, taking back, right?
Like, you're in the, the restaurant,
you have ten minutes to get those wings
out, and maybe it takes you 13 or 14.
Like, yes, you've technically breached
an SLA, but it can feel like forever.
If you're starving, I mean, it comes
out in nine minutes, you see all the
other tables getting their food, and
you're just sitting there starving.
That could feel like an eternity.
And you complain, and it's like,
"Well, ticket time is nine minutes."
Like we, we delivered
what we said we would.
But clearly, you know, they didn't
care what about the experience.
And same thing, like if our SLA is
twenty-four, forty-eight hours, but you
know, again, the printer is what controls
the, the checks and, um, you don't assign
that, that criticalness to it, um, then
it's like, well, you know, we're notâ¦
We're, we're meeting our SLA, but
like, but there was frustrations.
Maybe, maybe it wasn't
even a printer thing.
Maybe it was like a s- a simple, you
know, a, a fix, but they had to call three
times in about it or something like that.
Um, and you're meeting all of your,
your service level agreement, but
like, what is the experience like?
And to me, that's, that's a little bit
more important, um, and, and something
more that should-- you should focus on
Todd Kane: So how do you drive
that behavior in the teams, right?
'Cause like what I, what I was talking
about is like, uh, in The Bear, you
know, they take this ragtag group of
misfits and turn them into, you know,
a Michelin star restaurant, right?
And like the, the process of
doing that is interesting.
And one, like maybe like I
guess in s- in the, in that
case, some people leave, right?
And some people will need to leave
because they're just not on board
for, for creating that experience
and being disciplined in the way that
it takes to, to be excellent, right?
Like what does it take in, in
the, within the teams that you've
seen, and what do you drive as
behaviors of expectation, right?
Of like, "I need you guys to care
about this, and not just sort of
pretend that you do, but actually do."
It's easier when you hire like a
tier one and you, you maybe source
them from, uh, retail or hospitality
where they've, they, they have
more of that as a, as a pre-wiring.
Uh, but, you know, what are your thoughts
on sort of, uh, establishing that within
a team, either by, you know, improving
people's, uh, delivery and their
capabilities, or rotating out and finding
the people that, that can do that for you?
Josh Hohbein: Yeah.
Well, first it starts with the
top, you know, the leadership
of, of setting the standard.
And part of that, you know, too is, is,
like, being there, uh, being accountable,
showing that, like, you know, even
in a leadership position, even when
I was a manager at the restaurant,
I wasn't beneath bussing tables if
that's what needed to be done, right?
So showing that you're, you're there
to achieve the same goal, and you
kinda, you know, you have their back.
But then also, like, "Hey, we
have high expectations, um, here,
and there's a reason for them."
So, you know, if you are the one whoâ¦
You are the one who's setting
the tone, um, you know, to, to
q- uh, think about Letter, uh,
Todd Kane: See?
I was, that's exactly what threwâ¦
Set the tone.
Yeah.
Josh Hohbein: right?
Right?
Like that's-- You gotta do that.
So it, it's gotta start from the top.
Uh, because if you're not setting
the tone, then it's not going to
translate well, and you can sit,
and you can tell them that all that.
But, like, you gotta, you gotta
lead and show it, and take care of
the employees, be there for them.
Um, and you know, again, it's, it
sounds simple, but, like, doing
the basics right is what it takes.
And once you've done that, then you
can really see, um, get them, you know,
the buy-in, um, having the ownership.
You know, it does also help, and I
understand that not every MSP can
offer this, but we are also an ESOP.
Uh, so each of the employees
does have ownership in the MSP,
so it's not just the paycheck.
Like, if we grow, then
everyone, uh, succeeds.
We're all on the same team.
Um, but if you can't go the ESOP
route, you know, there, there should be
some, some level of, of ownership and
pride in- involved with that as well.
But Yeah, number one definitely starts
with the top, um, and, you know, leading
that way, having what we, we call, you
know, internally the culture of care.
Um, and, uh, it's, you know,
built into our mission statement.
We're constantly doing, um, you
know, focus recognition, recognizing
those, um, jumping in, you know,
whenever there's an issue on here.
I mean, it doesn't matter
what position people are in.
We have different departments.
I mean, we're all here to
help each other out and figure
out how to solve the problem.
Um, you know, again, the accountability,
uh, we're not trying to, to point fingers
or anything on anybody if someone fails.
We're all like, "Hey, what
can we all do better?"
So you really have to build that team
mindset, and it doesn't happen overnight.
But again, youâ¦
Yeah, I, I, uh, with the, the sake of
repeating myself, but, like, you lead
that style and you get them on board
and you get them to buy in, um, and
you hold them accountable and, like,
we still-- We have a great group.
We have a lot of fun, but at the same
time, high-performing, high expectations.
If somebody doesn't meet that, um, then
you do have to, unfortunately, um, if
they, if they don't meet the, the culture,
the fit, um, that we're looking for,
that they don't meet the expectations,
um, you do have to let people go.
I mean, obviously it's not just
overnight, but if there's ev- you
do everything in your power to, to
give them all the chances to succeed.
You know, what can we do differently?
How can we accommodate?
What, uh, on my end, what can, what
can I do to, to fix this issue?
But if you've exhausted those
resources, then you don't have a choice.
You-- They have to go
somewhere where they might be a
Todd Kane: Yeah, I often describe
that as, uh, it ultimately
becomes their choice, right?
Like, you do everything in your power
to extend your hand and pull them
up to what you need them to, to grow
into, and if they choose not to take
your hand, that's not your fault.
Like, that was their
choice to make, right?
Um, I, I, I wannaâ¦
I, I'll maybe tell you a story,
'cause something I noted in, in,
uh, in your work history in, in your
LinkedIn profile is, like, you were
in IT, then went to a restaurant,
like scaled up in that restaurant.
Like you said, like you're, you're in m-
management and, like, regional management,
so pretty high up in, in as far as
sort of restaurant, uh, hierarchy goes.
Then you went back into IT.
And I had kind of a similar
experience, and I'm, I wanna get
sort of, uh, your, your take on this.
Um, I actually, I worked in
IT like before, uh, before
I graduated high school.
I had my own consulting company,
and then I went and did like a, a
work practicum for this oil company.
And there was a few things, like at
one point I felt like I should go
get a job with people my age, right?
Like, uh, maybe this would be
good for me socially was part
of the calculus of doing this.
Like, I was, I was in between this,
this practicum, uh, and another job.
So in the summer I'm like, "You know what?
I'm just gonna get a, go
get a restaurant job."
Uh, and honestly, it was one of
the hardest jobs I've ever had.
And when the guy like agreed to
hire me, 'cause he was like, "You're
overqualified for this," like,
"why are you applying for this?"
And I kinda gave him like
what I was looking for, right?
And he's like, "Um, okay.
But don't screw me and just disappear
one day and not come in for your shift."
I was like, "Uh, okay.
Yeah, no worries."
And then, uh, it was
really, really difficult.
Next time I got a, like a job offer from
a corporate job, I was like, "Look, sorry
dude, I'm not gonna come in for my shift."
And like to this day, I sometimes
feel bad for that guy, where
he was like, "I knew it.
That guy was not gonna
come in for his shift."
Um, but that was sort of my story
of like going into, into restaurant
and then coming back to IT.
Uh, w- w- did you have anything
similar or like what was, what was the
journey of IT to restaurants and back?
Josh Hohbein: Yeah, it
kind of happened, Stan.
So, um, short and story, you know,
the first MSP, um, we had ⦠My
wife and I had our second child,
so at that point, our daycare
bill was more than our mortgage.
So we had to make the decision
that, like, we were losing
money if my wife was working.
So, um, we made the decision
for her to stay home.
And, um, my- one of my best friends, uh,
his name is Norm, uh, he was the actual,
the regional manager for that franchise.
So I was like, "Hey, man, can Iâ¦
I just, I need some extra money.
Can I just wait some tables, you
know, serve, bartend, et cetera?"
And, uh, he's like, "Oh,
yeah, come on board."
I get to boss you around.
"Sure, let's do it."
So it was just a part-time job for a while
because I, I needed to pay the bills.
My wife wasn't working.
Um, we had two kids here.
So, um, that ended up, um, having
some, uh, kind of a falling out
with the person who has made
the IT manager at the first MSP.
Uh, he kinda started micromanaging,
and although I was working two
jobs, I was still, you know, highest
billable hours, all that stuff.
I wasn't slacking whatsoever.
But, um, we had a little falling out over
some control issues he had after hours.
And, um, I was venting to my friend at,
at the time about this, and Norm's like,
"Why don't you just come work for me?
I'll give you a raise.
I'll pay you more than you were making at
the MSP, and you can just be a manager."
And I was like, "Cool, let's do it."
So went that route and then,
um, you know, proved myself.
This definitely wasn'tâ¦
You know, I'm, uh, I'm, I'm pretty humble,
but I'll, I'll say here, just like for
any of the naysayers, this wasn't a
Todd Kane: Yeah
Josh Hohbein: hire.
Like, I, I worked my, my butt off, uh,
to, to move up, uh, and, uh, you know, go
through the ranks of being in management.
And, um Eventually, it did get to
a point where, like, you're the
GM and all of that stuff, and, and
I mean, I saw this with Norm too.
Like, we didn't have,
we didn't have days off.
We didn't have time off.
Um, you know, I wanted to see my family.
Like, uh, I learned, you know,
if I wanted some time, like I
really had to, I had to train my
management staff at the restaurant.
Like, I had to make them
GM level, uh, teach them.
Um, you know, I, I couldn't, like, I
had to make playbooks for everything
of like, you know, this is what
you do when this goes down, all of
these things, binders and binders
of, of SOP and playbooks, which
Todd Kane: Sounds familiar, right?
Yeah
Josh Hohbein: You know, same thing.
But, um, you know, teaching
them how I would deal with it,
don't just give them the answer.
You know, walk them through
it, kind of teach them critical
thinking skills, all of those.
Um, and as I did that, then I was able
to spend a little bit more time on the
business rather than in the business.
'Cause again, I'm trying to grow sales.
I'm trying to build partnerships
with hotels and things like that, um,
which, hey, again, sounds familiar to
leading your team on the inside, right?
Especially if you're smaller and
you're the owner-led operations.
But it did get to a point where I
was like, "Hey, I really enjoy this.
I'm good at it, but, like, I need a
little bit more consistent schedule."
Like, I don't wanna do
close opens anymore.
Um, and in the world of cybersecurity,
I mean, you do have incidences.
It happens, but it's, you
know, it's not every week.
Um, and I still liked IT.
I ultimately, I just like helping people,
um, and, uh, serving people, and if it
happens to do, you know, with IT or,
or restaurant, like I, I love doing it.
So, um, went back in the MSP
just so I could have a little bit
more of a consistent schedule.
But I mean, it gave me a new perspective
on everything because now I just
came back, you know, uh, from all
my time up to there, I was in tech.
It was the tech role and all of
the technical skills, and I'm still
learning technical skills today.
But now coming back, I have all of
this business management experience.
Like, not only do I, uh, not only
do I understand, like, how to
actually manage the people and the
relationships and the soft skills,
but all of the back-of-house stuff.
Um, and that's like your cost of goods,
the marketing, the finance, all of
those things that go into it, um, making
business decisions, um, you know, all
of the things that it takes to, to run a
business combined with technical skill.
And you, you see things in a
different light, and you're
able to, to do, you knowâ¦
Um, I was able to, to kinda grow a
little bit of a side department at
that MSP I went, which then eventually
led me here, um, as they were looking
for someone, uh, Centrix was looking
for someone to build out their
security, and I was like, "Perfect.
I- this is what I do.
I love doing it."
Um, so without that restaurant management
experience, I mean, I, I don't know.
You know, I'd probably still be in tech,
but I don't think I'd be in the position.
So it's, it's invaluable, um,
what I learned and how I'm able
to, to approach that to MSPs.
Todd Kane: that's amazing.
Uh, so all right, so we'll,
we'll switch a bit to security.
I, I mean, I could go on about
the, the, the culture piece and
team building and stuff like that.
That's the stuff I
absolutely nerd out on, so.
But we will move on.
Uh, uh, I like your framing, and I
think this is important and especially
practical for, you know, uh, some of
the, like, the owner-led, uh, MSPs
or, you know, the, the, the, the folks
that are kind of in Death Valley, the
1 to 5 million in ARR, uh, aboutâ¦
Like they, uh, they know the
importance of having a NIST framework
or, you know, util- utilizing some
of these, these, uh, frameworks.
But these are difficult conversations to
have with non-technical business owners.
So, and this sounds like something
that, that you're, you're pretty keen
about, um, given your, your, uh, your
talk, uh, that I noted in the top here,
how to align frameworks for people who
don't give a shit about frameworks.
Uh, I think a lot of people find
themselves in that position of like,
this is an important discussion to have
with a business owner that doesn't know
what I'm talking about and does not see
the value of what I'm talking about.
Um, you know, I had a, a guy that I
was, I was talking to earlier this week,
and he was, he was struggling with this
conversation of, of, uh, you know, when
I try to have these conversations with
the c- with the clients, they feel like
I'm just trying to squeeze more money
out of them by selling them stuff, right?
Uh, what's, what would be your kind
of advice on, on how do you slide
into these conversations in a way that
feels accessible for business owners?
Josh Hohbein: Yeah.
One, one of the things that I've always
kind of prided myself on is, is tryingâ¦
A- and it's a good skill to
have, of like how do you explain
tech to a non-technical person?
And it becomes even more crucial when
you're talking cyber and compliance.
You know, like, 'cause
again, you're theâ¦
I mean, like my title says, their
clients don't give a shit about that.
They're hiring you because
you, they want you to keep them
safe and keep their stuff on.
So the idea that came behind
this framework is let's look at
like, again, doing basics right.
Um, it was one of the things that I
taught in the B-Dubs kitchen as well
is like, dude, we're not a Michelin,
we're not a fine restaurant, but
like if you care and put some effort
and you do the basics right, you
can have a pretty good meal, man.
You get those wings out of like hot and
fresh out of the fryer and, and do these
sauces like it's, it's pretty good.
Now if somebody wants like a
specialized burger or something,
they're not coming here.
But like you can get like the
burgers there again, when cooked
right, are, are better than they
should be, better than normal.
So how do we translate that to frameworks?
So I took cyber insurance requirements,
you know, the, the forms that we
see, like they're asking kind of
the same questions, as well as
CIS and just other best standards.
And, um, if you're familiar with CIS, if
you are a framework nerd, they do have
what are called implementation groups.
So it's their logical grouping of,
hey, do these first IG1, then IG2, then
Todd Kane: This is why I like CIS
over NIST personally, is I feel
like it's, it's more programmatic of
like, this is where you start versus
like this giant spreadsheet of stuff
that you need to get through, right?
Josh Hohbein: Yeah, 100%.
And it's, it's a little bit more like
hands-on tactical versus like kinda
theoretical and, and open-ended.
So the idea was to take CIS
with the cyber and then kind
of combine it and simplify it.
So, um, what I did is took a
five-stage maturity model, I
mean, nothing groundbreaking.
But I applied, like on the back
end CIS controls, but on the front
end it was just simplified words.
So, you know, MFA, there's a whole
bunch of controls that that means.
Um, so in level one, again, we're
looking for like, hey, what is the
base minimum that you need that cyber
insurance is gonna ask you for that
proves that you're not negligent?
And it is your, you know, cyber
awareness training, your EDR, MDR,
MFA, you know, uh, offsite backups, uh,
a security officer, for example, you
know, someone who, you know, is like,
"Hey, I'm, I'm the security officer for
the client," an external email notice.
You know, nothing groundbreaking, but
like those are steps, and they're easy to
check off, um, easy to, to explain, right?
Um, and included in most of our w- what
your MSP package should be offering.
But then in like in level two,
um, we get into tenant hardening,
so like Microsoft and Google.
Uh, you can really explain like we
need to harden, like it's not secure
by default, risks, all of that.
But i- if you try to explain all
of the CIS controls that you're
meeting, like, hey, in order to
meet, you know, all, all of these
various 20-some, like then that itâ¦
They don't care about that.
But it's very easy to
say tenant hardening.
Uh, and again, show them on the map.
You get the little like kinda dopamine
like check marks as they can see,
hey, when they come into you as an
MSP, these are the controls they have.
And you basically, you take
the, the maturity model, and you
show which controls they have.
Um, and then, hey, by partnering with you,
we cover, you know, quite a bit of these.
But these will require a project,
but you at least know where you
are today, where you need to be.
Um, a- and you know, we say like a full
level three, any client through any
vertical should be able to get there.
Um, that is a high level of maturity
with the idea being if you ever need
to go to like actual regulatory, like
a s- if you need a specialized burger,
it's pretty easy to crosswalk here.
You have the, you have the,
the base, high level of base
maturity that we can expand on.
Um, but really we're just trying to cover
the basics, do the basics right, build
that great groundwork, secure everything,
build some policies, build some
governance, build some security culture
within the client, give them empowerment
and ownership, lead by education.
And it just starts with the just trying
to simplify that framework and showing
again, you know, cool, then every quarter
we m- make another, make more progress
on that, get more green check marks.
Um, and again, they see where they
were, um, a- and then what is left
so that you have that whole roadmap
Todd Kane: Yeah, that progression,
visible progression I think is really
meaningful for people, especially if they
don't really know what they're doing.
Like they get that dopamine hit of
like, "Oh, okay, we're, we're improving
at, at the very least," right?
I think that's, that's
an important factor.
Um, I guess like, uh, one of the other
pieces of this is like having these
conversations with non-technical people.
Uh, I had this person on the podcast,
um, a couple years ago, and I went
into this conversation expecting a
different answer than I got, and I
was like, "All right, so you know,
FUD, fear, uncertainty, and doubt.
It's an effective sales tool for
security, but maybe this isn't the
best place to sort of lean on."
And the answer was is like,
"No, FUD's great," right?
Because it, it is, it, it makes
it more visceral for, for people.
Like there has to be kind of a
fear around, uh, around things that
they don't necessarily understand.
I was like, "Huh, okay.
Not exactly what I, I sort of
expected as an answer for this."
What, what's your feeling on sort of F-
to FUD or to not to FUD as far as, uh,
you know, positioning and potentially
selling security for non-technical people?
Josh Hohbein: Yeah.
There's-- I, I think
there's a layer to it.
Um, so I'd be remiss to say if, if
I didn't, but what really annoys
me, uh, and this is kinda where, you
know, another one of the things that
I, I get, like, passionate about,
is when you strictly rely on fear.
Um, so, um, um, let's use
the dark web, for example.
Um, there's so many-- There's different
dark web scanners out there, but if I
have your domain, I can just give you a
dark web scan and then, you know, "Todd,
like, you have 200 hits on the dark web.
This is likeâ¦
Y- I mean, you're in trouble.
Like, you, you need me to
save your, your business.
Like, look what is out there.
Do you want more of it out there?"
Like, you scare you a little bit.
But, um, you can use it as,
as an education tool, right?
So something scary like that, um, how
I approach it is, you know, "Hey, Todd.
You, you do have, you know, quite a bit
on the dark web, but here's a secret.
Like, almost everybody's on there.
You know, it's, it's not-- It doesn't
really mean much that you're on there,
but here's what we can learn from it.
Your information is out there.
You have passwords in plain text,
and by looking at what was captured,
you might not have the best password
policy, as you see people are using
the name of your business or, you
know, go Padres or whatever the sports
team would be, um, or summer 2026.
So we need to have a conversation
around some better password hygiene.
Maybe look at password managers."
The other side with this is, again,
these are out there, so if you reuse
those passwords, sure, you might not care
that your-- the place you bought your
college textbooks from got compromised,
but if you're reusing those passwords,
well, now I can get into your Facebook,
to your, your email account, your
bank account, all of those things.
So really y-you're-- That almost likeâ¦
And what's funny is you lead by that
education, and you guide them on that
journey, and I've had some clients say
that that's like they've been more scared
now because they're like, "Oh, oh my God.
I, I do that.
Like, I need to, you know, do
this, take this action more."
Todd Kane: 'Cause they
understand it more, right?
Josh Hohbein: justâ¦
Yeah, th-they understand it, right?
So it's not just the whole fear thing.
Same thing with, like, external scans.
I mean, one of the things that
annoys me is, like, as part as like,
like, an external vulnerability
scan absolutely required.
I'm not saying it's not.
But then like that's not the
only thing you need to do.
And sometimes you, like, scan a
website, and it's like, "Cool.
I don't host my website.
I pay someone else to do it."
So you've encountered something
of the hosting provider.
Yeah, sure, they should fix it, but,
like, y- you can't just go with fear.
There has to be, um, maybe some level
of fear, but it also has to come with
some education and, you know, how I
can help you, uh, get through this.
Todd Kane: I like that framing of like
there's, there's still a component
of fear, but not coming from the
place of I-- only I can save you.
I think that that's a really dangerous
positioning and just it doesn't
really establish a lot of trust.
I'm a huge fan of like
education-based sales.
I think it j- it just seems to work.
Like it certainly works in a technical
industry, but I think broadly it
just elicits more trust, right?
Like that people are like,
"Oh, okay, like you've, you've
helped me to understand this.
Now I have a better
qualification of the problem.
Like can you help me with this as well?"
It draws them in rather than
like you need me, right?
I think that's a much,
much better positioning
Josh Hohbein: Yeah, absolutely.
And again, it goes to there are
still quite a few places and
people who deal sub by that fear.
So if you take the time to explain it
and explain maybe why they're afraid,
then it, it does go a long way.
You're like, "Hey, you're the first
person to, that explained it to
me this way, so, like, let's, you
know, let's work together on it."
Heck, when we doâ¦
Like, one of the things
I do is the assessments.
Um, I align to that framework, just
like I say, um, show them the business
risk and all of this, and I literally,
you know, say, "Hey, we would love
to, to partner with you to fix it.
Here's our budgetary roadmap.
But, like, at the end of
the day, this is yours.
If you wanna take care of it internally,
you know what you need to do.
Um, if you wanna look for a
different provider, you can hand them
this, and this is the blueprint."
So, um, again, you're building
that trust, and more often than
not, they will go with you.
But leading by education is for
sure the, the much better way rather
than just the s- the scare tactic.
Speaker: Tired of fighting
the MSP fires alone?
The Opsleader Pro group connects
service delivery professionals who
understand your daily challenges.
From KPIs and workflows to career
planning and team management, Opsleader
Pro has systems for you to use.
Join operations leaders from successful
MSPs who are sharing real solutions for
managing client expectations, optimizing
service delivery, and making your service
delivery team as effective as possible.
Opsleader Pro, 'cause your service desk
deserves more than just survival mode.
Visit opsleader.co.
That's O-P-S leader dot C-O to
apply to join the public community.
Todd Kane: Yeah, you, you've mentioned
a couple of times your compliance
and, uh, insurance, and this is one
that I think is really powerful, um,
is letting people know, like, here
are the minimum requirements in order
to have cybersecurity insurance.
And it's kind of shocking.
Maybe it shouldn't be,
but it still kind of is.
Like, the number of times I ask peopleâ¦
I was, uh, talking to someone
recently, I'm like, "Does this
client have cybersecurity insurance?"
And the account manager was like, "Uh,
hmm, I feel like I should know that."
And I'm like, "Yeah, you
probably should," right?
And, like, I wasn't critical 'cause,
like, th- I think this is all over
the place, but, like, that's the type
of conversation that we should be
thinking about with people is, like, is
do they have cybersecurity insurance?
That's a basic.
Like, let's go do that.
And by the way, in order for you to
get cybersecurity insurance, you're
gonna need to do these for- 14 things.
And although, also, by the way, in
order to get paid out if you actually
have a breach, we also have to have
these 14 things in place, right?
Like, it's, it's again,
kind of servicing them.
I'm not telling you you need a
bunch of fancy security stuff just
because, like, it's good for me.
Like, there is actual, a
practical benefit to this.
And it is frustrating that you can go
through that conversation, get to the end
of it, and the business owner is like,
"Meh, whatever, I'll take my chances."
You're like, "Ugh, okay, you're gonna
be really pissed about this if you ever
get breached," like I can tell you.
But, you know, ultimately, you
can't make that decision for them.
What, what's your sort of thought
on, like, positioning this as
a sort of a requirement for
insurance and utilizing that as a,
a, as a sort of a sales vehicle?
Josh Hohbein: Yeah, that's kinda
what we say with the maturity model
is like, you know, level one gets
you out of the negligent threshold.
You know, we'll cover the things that
you're- you'd be on the insurance.
But, like, the other side too is
as good as, you know, we try to
be at security, like, there's not
gonna be anything that, that is
Todd Kane: Yep.
Nothing's 100%.
Josh Hohbein: through.
Um, nothing's 100%.
So that last bit of risk, we
need to transfer it, and that's
where cyber insurance comes in.
Um, the other side of that, I mean,
shout out to, you know, we're in the
IR game here, uh, of, of tabletops
as you put them through that,
that pain and things like that.
And you can try to sit and talk
and, and make them feel it.
Um, you can do a tabletop and
really kind of, you know, push
them to the limit on that.
But ultimately, I mean, it's
their business, their decision.
Um, and if there is a business that's
too risky, then you can walk away.
You have that option.
Um, you know, understanding smaller
MSPs might not have that fortune.
You know, you are trying to,
to take all the revenue you can
get when you're starting out.
So it is a good sign of maturity
and growth when you can tell
a client no or walk away.
Uh, it's a good feeling.
But ultimately, that's something you wanna
strive to get for, uh, get, get towards.
Um, 'cause if they are, aren't to, to
take that risk, then it's like, "Hey, Iâ¦
You are too big of a risk for me to
manage, um, and, and I have to walk away."
Todd Kane: What about, uh,
sort of a middle ground?
Like, do you think it's practical to
have them sign a waiver of, like, I've
advised you that, like, these things need
to be met, uh, and you've chosen not to.
Like, this is a budgetary decision.
You're taking on the risk.
I can have nothing to
do with this, basically.
Is, like, I, I think there's, there's
sort of a sense of safety in having
that, but I don't know really how
enforceable that would be if, if,
if something bad happens, right?
But to your point, like, people are
trying to win as much business as
they can kind of scrape together
if they're smaller, right?
Josh Hohbein: Yeah, for sure.
And I know it's something that
we've covered at IR Games too.
Um, we've had, uh, uh, Bradley Gross,
um, who's a well-known MSP lawyer say the
same thing of like, "You can, you can do
it, but it might not, you know, be like
this ironclad, you know, thing in court."
Like, and, and, um, we're, we're pretty
litigious here in, in, uh, the United
States of America, so, you know, anyone
can sue anyone for almost anything.
Um, soâ¦
But it does, it does kind of create,
like, a little bit of, like, the
psychology of like, "Oh, you know,
oh crap, like I need to sign this."
Um, so it can definitely be a tactic.
I'm not saying don't do it,
but I'd also warn, like, itâ¦
Just because it's there, it doesn't
mean it's gonna, you knowâ¦
And I'm not a lawyer, um,
Todd Kane: Sure.
Josh Hohbein: at all,
Todd Kane: Yep.
Josh Hohbein: ask Brad those questions.
But it, it might not at the end of
the day actually matter if something
does happen and something's signed.
Um, but, uh, again, it is still good.
Uh, it, it, you could use it as
kind of a latched, last-ditch
effort or something of that nature.
But, uh, definitely check with
your attorney if whatever you're
having them sign would actually
be enforceable or upholdable in
Todd Kane: Yeah.
And I think it is just, it's good
to have a qualification of like what
are the minimum requirements that I'm
willing to sort of take on from a risk
perspective in order to have a client?
I think you have to like have to have
an objective sort of rational discussion
with yourself and your team around
those things of like, I've seen a
lot of organizations are like MFA on
every account is mandatory, like no
questions whatsoever, basically, right?
Like, and if you're not cool with that,
then we can't do business together.
Uh, and that's, like that's tricky, right?
For, for, for smaller organizations.
You've got like the dentist's
office where they're like still
using shared accounts to log into
the clinic, uh, computers, right?
Like they're not gonna go for that.
So it, it becomes tricky.
I get it.
Yeah.
Um, you mentioned,
Josh Hohbein: Yeah, I mean our, our,
let's say our, our base minimums, it's
like you build it into your package.
So that way you don't have
to have the conversation.
Like, uh, uh this is provided.
But the other side when it comes
to security, it's like y- the
security versus convenience, you
can't just be the department of no.
Understanding where it comes from.
What is like the reasoning behind it?
Like again, education.
Listen.
Whyâ¦
If they're using shared accounts, like
what's the business reason behind it?
Uh, m- is it something, "Oh,
we've always done it this way."
But like again, do they only
have a certain amount of time?
Dig into a little bit.
And is there a compromise that we can do?
Like is there compensating controls
that we can, that we can show, um,
that way they're still able to do
their business function while maybe
not meeting everything to the letter.
Again, that's the whole point of,
uh, of these things of we're not
enforcing a very specific control.
We're just saying, you know, MDR, uh, MFA,
tenant hardening, um, because it does give
the leeway to still have the business,
uh, function as it needs to while meeting
the, controls that we need to on the back
Todd Kane: Yep, yep.
Um, so you mentioned, uh, tabletops.
I'm a huge fan of tabletops, not
just because they're fun, but they're
also incredibly instructive, right?
Like, the number of times I've run
an MSP through a tabletop and been,
and the, the recognition on their
face of like, "Oh my God, we don't
have any documentation for this.
We should probably build this," right?
Like, that's sort of the insight that I
love gleaning from people of like, yeah,
like I, I've thought about this at some
point, or maybe I haven't for that matter,
but like we are absolutely behind the
ball, and that's a great time to determine
those things are, are open gaps that you
need to fill rather than getting into
an emergency and everyone's just running
around with their hair on fire 'cause
they, they have no playbook to pull from.
Um, what are your thoughts on sort
of the, uh, the, the, the best
ways to run successful tabletops
and sort of general scenarios you
like to pull, pull people through?
Josh Hohbein: Yeah, and this is
again, I'll shout out to irgame.ai,
um, with Bob Miller.
Uh, I've been partnering with
him for like two-ish years.
I've ran quite a few tabletops, and
the reason, uh, for that is I've also
done, you know, before IR Game, like
my own tabletops and things, and a
lot of them are like the tactical
part of it, of like, okay, you know,
which machines are we gonna restore?
Or we might read off the
incident response, or we get this
alert, you know, what do we do?
And, and not that that stuff isn't
important, but the business owners and the
executives and like the people who need
this IR game, like they don't reallyâ¦
Like it doesn't land
with them quite a bit.
So where we try to go and, and exactly
like that, the whole concept of, of The
tabletop they need is around business
decisions and things that go into it.
If you've ever been in an
incident, like there's soâ¦
Again, you still have to do
the tactical, the technical
of it, but that's such a small
Todd Kane: Yeah
Josh Hohbein: You know, if I'm, I'm gonna
make up a mis- if I'm gonna make up a
percentage, I would say it's 80 is the,
the business decisions you have to make
around the personnel, what to do, who to
contact, regulation, all of those things.
and that's the, the important part
of like making them feel that.
Um, so we center it around those of
like, what decisions are you making?
The clock is ticking.
You're in the hot seat.
Uh, your employees, your
board is making these demands.
Your clients are making these demands.
Like, do youâ¦
You know?
And if you don't have a process in
place, if you haven't done a tabletop,
if you don't have policies, uh, if
you've never been through this, like
you're going to fumble and fail.
You know?
It's like football, you
play it on Sunday, right?
And the guys are, the, the guys at the
pro level, like for the most part, you
Todd Kane: Like every day.
Josh Hohbein: on Sunday.
They wouldn't be in that position
if they didn't practice all of this.
So as you do more of these and
as you practice and you have the
policies, you're gonna be able
to respond to 'em much better.
Um, and I try to make it a little
like personable too and kinda role
play a little bit is, you know,
"Hey, you're, you're a sales guy,
so this incident right now, like
you're, you're the sales manager.
Um, this incident, like your salespeople
are based off of commission, and
their paycheck is commission.
And the sales guys, they
didn't cause this incident.
They didn't do anything wrong.
They have mouths to feed, they have a
mortgage to pay, and now like when are
they gonna get their commission back up?
Like you've lost 40% of your business.
That directly comes out of their paycheck.
How are you keeping your salespeople?
They're gonna come to your office
and say, 'Hey, I didn't cause this.
Todd Kane: Why am I suffering?
Josh Hohbein: bought a,
a new house, a new car.
Like what are you, the sales manager,
like what are you doing for me?
'Cause if you can't, then I'm leaving.'"
And like putting you in that
position, making you make a,
like what is your decision?
Um, and you're like, "Oh, well
I don't wanna be in that."
I'm like, "Nobody does,
so that's why we do these.
Let's think about it.
Let's have the procedures in place,
um, the, the, the policies and at least
the experience of going through these.
Um, and hopefully it never happens."
I, I've been through incidences.
They suck.
Todd Kane: Yeah, for everybody
Josh Hohbein: PTSD with them is
real, so you know, learn, learn from
the people who've gone through 'em
Todd Kane: Yep.
Josh Hohbein: don't have one yourself.
But if you do, you're gonna be
a hell of a lot better prepared
Todd Kane: I, I think it's true.
It's so counterintuitive that the business
decisions matter more than the technical.
Like, there's sort of the basic stuff that
is really important to, to sort of weigh
upon people is like, don't start fixing
the situation when there's an incident.
That feels counterinu- intuitive
too, but the techs need to know that.
Like, don't start stepping on evidence.
Just secure it, contain
it, and then leave it.
And then the, everything
else is business decisions.
Like, are we calling
the insurance company?
Are we calling our PR company, right?
Like, all of those things need
to be understood, and that's
the playbook you pull from.
So yeah, it's, it's, it's counterintuitive
and really important to, to not be,
you know, faced with the Super Bowl
on your first day on Sunday, right?
So basically, right?
Josh Hohbein: Yeah.
Yeah, that's 100% it.
And again, it goes, you know, the
restaurant, like prepare for that
incident like all the time, right?
Like the rush, that's your
boom, that's the incident.
But like you're preparing.
I mean, people are coming in early
to do prep work, so you're prepared.
Um, you are practicing your skills,
your organizational skills when
it's dead, so that way when it's
busy you're- you've- you have that
experience, that knowledge to go on.
Like again, even if you've never worked
in a restaurant, like you probably
are like, "Okay, I can write on a pad,
I can grab plates, you know, I can,
you know, bring tacos to this table."
Go be like, do you think
you could handle a rush?
I mean, you've worked in the restaurant.
It,
Todd Kane: It's brutal.
It is really brutal
Josh Hohbein: you've ex- you knowâ¦
Like sure, you'd be able to fumble your
way through it, but it's gonna suck.
It's gonna suck a lot.
Or you can experience it, be prepared,
learn from it, and then again, when it,
hopefully it never happens, but if it
does, you're gonna be in a much better
Todd Kane: Yep.
Practice makes progress, right?
I, I guess to that point, uh,
this has been awesome, uh, Josh,
really loved ha- the conversation.
Um, as a practical takeaway, you know,
for the MSP owners or service managers
listening, what is sort of the, the, the
first thing that you would have them work
on next Monday morning to improve their
cybersecurity, or I would say maybe their
cultural posture in their organization?
Josh Hohbein: Yeah.
Um, I, you know, I'm a big fan
of, of, of just the simplified.
So align to a framework
if you're not already.
If you need one, um, you know, look me up.
I can-- I'm more than happy to
get you the simplified framework.
And then look at your, your stack.
Um, does the services that you offer,
both tools and, you know, projects or
just how you deliver the service, is
it, you know, enough for securing the
client, bringing them on, so you can
identify gaps that you might have?
Or, you know, if you don't have
gaps, perfect, now you have a
framework that, that can, you
know, back up what you're offering.
And on the service side of
things, it is, it's soft skills.
Um, ple- you know, focus on those, on
building the trust, the building the
relationship, the, the give a damn factor.
Um, a-and it's weird to say, but, like,
again, doing basics right, doing the
little things right, and just showing up
makes such a huge difference that, I, I
mean, it's, it's gonna help you tenfold
Todd Kane: Like, uh, the, the
old John Wooden adage of tie
your shoes correctly, right?
Josh Hohbein: Yeah, that's it.
It's, it's, it's the basics,
man, but there's, there's a lot
of people with untied shoes,
Todd Kane: That's right.
Yeah.
Cool.
Well, this has been great.
Appreciate it, Josh.
We'll, uh, link to you on LinkedIn
and to IR Game as well if, if
people wanna check that out and,
uh, continue the conversation.
Appreciate your time
Josh Hohbein: Yeah,
thanks for having me on