Transcript:
Connor Swalm
Welcome to Gone Phishing, a show diving into the cybersecurity threats that surround our highly connected lives. Every human is different. Every person has unique vulnerabilities that expose them to potentially successful social engineering. On this show, we'll discuss human vulnerability and how it relates to unique individuals. I'm Connor Swalm, CEO of Phin Security. And welcome to Gone Phishing everyone.
Welcome back to another episode of Gone Fishing. I'm your host, Connor, the CEO at Phin, and I am joined once again by the jerk in the channel with the large bucket of rocks, also known as the president of CNWR, Jason Slagle. Jason, how are you doing?
Jason Slagle
Good.
Connor Swalm
Honestly, that intro doesn't get any more boring every time I say it.
Jason Slagle
Yeah.
Connor Swalm
If you want to know what that actually means, go listen to the first episode that we did with Jason where we talked about spooky SSO, single sign-on. And yeah, a lot of myths surrounding SSO, apparently.
Connor Swalm
So today we're going to talk about a topic that is the reason I first met you ever. Like the reason someone pointed you out on the interwebs? Yeah, I'm pretty sure it was Kyle Spooner was like, don't mess with that guy. Or maybe it was Riggs. I don't know.
Jason Slagle
It was probably Riggs because knowing where we met, he was there.
Connor Swalm
He probably was. It's the current state of MSP vendors, but just the state of MSP vendors in general. So before we jump into the questions, anything you'd want to say?
Jason Slagle
So over the years, my opinion on this hasn't changed, but it's changed a little bit. I will say the outward state of vendors doesn't always necessarily match the inward state of vendors. And, yeah, I don't know how to fix some of the problems that I'm sure we're going to address. We need people smarter than me to figure this out.
What does that mean? The outward doesn't match the inward. There are companies that I think are actually trying to affect change. I'll pick on ConnectWise for they're better or worse. Right? Like they're a million-pound behemoth and they have a bad rep. But I will say that the people I deal with there on a fairly regular basis, every single one of them cares and is trying to make it better. I just don't think they know how to do it.
Connor Swalm I said you could paint anywhere you wanted on the canvas and you drew a circle around that statement.
Jason Slagle I did.
Connor Swalm
So MSP space has been booming. There's been a lot of vendors added. A lot of new vendors, also a lot of vendors adding new things. But are they providing more value? What are your thoughts on that?
Jason Slagle
Maybe so I'm going to give the answer that makes Ray the most angry of any answer I give. And the answer to that statement is, it depends. There was a recent article that came out that I was quoted in and what I said in that article, I wholeheartedly believe in that. We have a lot of cool innovation happening from MSPs that are turning software vendors, right. But what I will say is, I do not believe that the big players in our industry, they're not adding additional value and they're not innovating. And I will say that matter of factly.
I think that we are at an interesting spot where the MSP markets are very mature at this point. Right? Like we've left the, you know, just build yourself a recurring services agreement and then manually do all these things every month and you're an MSP world to a very mature space. In his updated book, I think covers a lot of this, but a very mature space where we rely 100% on a ton of tools to be able to have the ability to service the number of customers that we end up having to service, right?
So like I've seen over my short five or six year career as an MSP and my 22 year career in IT before that, the number of systems or servers that a single admin is expected to manage go from like three to ten to 100 to. We're running hundreds now, right? It's like I've got a single sysadmin managing 300 and 5400 Linux VMs, right? Like in automation and tools that allowed that to happen. But that maturity has brought with it money, right? And the PE firms in particular, they see, man, this industry is growing like hotcakes. And because it's growing like hotcakes, you tend to see stupid amounts of investment money coming into it.
And anytime you have stupid amounts of investment monies, the amount of money, the cost essentially, or the revenue that a company goes for, that multiplier of EBITDA or revenue, whatever you want to track valuation by those valuations go up. When those valuations go up, people are incentivized to go build things to sell. And I think generally the build to sell model doesn't necessarily serve the end user well. Like, it can solve an immediate problem. But when that sale inevitably happens, it's usually sadness for everyone involved.
Connor Swalm
It's a very opposite, I believe, Simon Sinex, the infinite game. It's like, well, if we're here forever doing this thing, what would we do? And let's do that thing today, then I get that sometimes you can't act like that all the time, but it's still a great thought exercise is providing value forever versus just building for a sale.
Jason Slagle
Well, and it's really interesting to see that. And the average tenure of the CEO, right. It used to be people would become CEO of Ford, right. I'm a pick on them, right. And they'd be CEO for like 25, 30 years. The average tenure of CEOs now is what, two to four years at most? They tend to take to go back to my nerd roots. They use a greedy algorithm. They take the locally optimized choice in all cases. Like, what can I do to pump the stock up now to benefit myself in this exact moment, knowing that problem, that's going to create four years down the road, this can be an ex guys problem.
Connor Swalm
Yeah, there's a lot of, well, if I don't do this, my competitors are going to do it. So I have to in order to stay relevant as well. I've heard that sentiment echoed a lot by other people that I'm friends with that work at vendors or own other vendors as well.
Jason Slagle
In the MSP space in particular. We're seeing that now, right? I'm seeing the big three now because it was four, and now two of them got smashed together to become an evil superpower. They are buying companies that I don't think they actually would normally buy just to stop their competitors from buying them. I don't know. When you have a lot of money, I guess that's what you start doing. Everything looks good to buy.
So I have a good friend of mine that used to work in baseball. He was the director of baseball operations for the Tigers. And he called baseball like a giant board game where he's got, like, he gets given monopoly money. It's money that's not his money. And his goal is to assemble with the money he has the most advantageous team of things, which happen to be people. And that is the meta, essentially, of baseball.
There's a meta in the MSP industry of if you have money and you can make a strategic purchase of a young company that is probably going to make something of themselves and then become a competitor to a product you already own later because they're out innovating you or they're going to be snatched up by a competitor of yours once they get a little bit more mature and are again going to become a competitor, you can buy them now and just like you don't even care if the company continues to exist, you can buy them just to remove that as an option down the road in the future. It's a pretty terrible place to live in, honestly.
Connor Swalm
It's a world where the end user gets screwed in both ways. Not only are they paying more to use the big vendors tools because, well, they made that money through profit most likely, but also you're then deprived of the innovation that smaller entrant would have created given enough time. Yeah, it's a hard place to because sometimes those checks start looking very appetizing.
Jason Slagle
Yeah, they do. I mean, we have a mutual good friend that exited to a company that made me very sad. And at some point or another, the money is really hard to turn down.
Connor Swalm
I guess we've gotten away from the MSP vendors and into what does it look like to actually sell your company? But one thing I want to focus on is a lot of our partners at Fin and a lot of partners that I talk with, that I've just been friends with for quite some time find it hard to identify the good from the bad. I don't want to say the good from the bad. The great from the average is how I'll put that. Just because they all say the same things, they all look the same, nobody's going to come out right and say, yeah, I'm garbage. Please don't work with all of it. Nobody says that. So what are some tips that you order? Some ways that you evaluate vendors, or what are some ways that other people can actually figure out? Are they working with somebody who be good for them?
Jason Slagle
Okay, I have a number of tips or things I can give here, right. The one is find out about contract terms. I have concerns about companies that want to lock you into three year auto renewing contracts. Right. Because if you can compete, I realize the ROI and I realize the reasons they do it, and I realize all the valuation reasons that people do that. Right. However, they don't have to be auto renewing and they can be a year and they don't impact your valuation as a vendor all that much when you have an evergreen contract, especially with a short renewal time.
What that tells me is you're concerned with keeping me forever, whether or not you plan to actually continue to deliver and build value on your product. Another big one that I use a lot of times. So I make ROI based decisions almost always these days. Right. And I've already made the purchasing decision, usually when I'm talking to somebody. But when I do talk to somebody new, my goal is to immediately get them off of their scripted demo. Immediately. I will push and I will poke and I will go whatever direction that I can in that demo to take them to an area of the program they do not want me to see because they're in ancient history.
I worked with a company called Indicative, which eventually got bought by somebody. Which eventually got bought by CA. It was a monitoring tool and the demo was amazing. It was like epic. The best monitoring tool I've ever seen. As it turns out, I'm pretty sure the budget on the demo was higher than the budget for development of the entire product. So understand when you're taking a demo of a product that curated demo is the best you will ever see that product work. It will never work that good in your own usage because a lot of work went into making that demo look flawless. So if there's hiccups in the demo, you're definitely going to have hiccups when you go to use a product. And then, yeah, just get people off demos, get them off the script.
Connor Swalm
When I did demos, one thing I always appreciated is somebody saying, so, of course you're going to tell me your shit doesn't stink, but what don't you do? Well, what do people not like? And I always loved going right into that because it was always the quickest way to fix it, either address it head on or try to understand how I should change the way things work. But a lot of people won't ever ask that question because they feel like they'll never get a real answer. And the reality is, most of the time you won't get a real answer. But you could smell it, you know, when you're not getting a real answer.
Jason Slagle
Yeah, it's the equivalent of the universal interview question. Tell me about some of your weaknesses. Like, oh, I guess I care too much. That's a BS answer and everyone knows it. Right? It's not necessarily about the answer to the question, it's about your reaction when I ask it and then reading the subtle body language and other hints in it when you do it.
Connor Swalm
I always ask, when's the last time somebody was pissed at you and how did you handle it?
Jason Slagle
That's a good one.
Connor Swalm
That's way more indicative of how someone's going to treat you and others. And then the second question I always ask is, yeah, work's great, and I really hope you enjoy your time here. I'm hoping you're only applying because you want to work here. However, what do you do outside of work? This is this much of your life. What do you do with the rest of it? I want to know who you are.
Jason Slagle
Yeah. We ask that you got to be careful because that's somewhat protected in some places now, so people can get cranky like, oh, what's the matter to you? But, yeah, we usually try to. It's the same thing we talked about, I think before we came on, were talking about hiring and culture and other things like that.
In the end, I consider the relationships I have with the good vendors that I appreciate and use to be similar to the relationship I have with my employees. And I want a cultural fit with my vendors. I appreciate you guys because I can just go into your Slack channel and hassle the crap out of you and good naturedly rib you and the meme flow and all the things. So we're a good cultural fit for one another. That's the case with a lot of other vendors that I actually use really well.
Connor Swalm
You go. What were you about to say?
Jason Slagle
I have the final piece of it when you ask me, because it's my third one of these I've recorded over the last little bit. So when you ask me my final piece of advice, I have a good one.
Connor Swalm
Okay. No, I was going to ask, so what are some other ways folks can actually identify? So it's make sure you get people off the canned demo. A piece of advice I've always given is go ask the community, especially if you're an MSP. It's like people don't shit on vendors that are actually good. Largely, I would say largely, there's always the bad apple. But if you talk to a lot of your friends and a lot of the folks in your industry aren't saying good things, it's probably for a reason.
Jason Slagle
Yeah. Go look at Glassdoor on how they treat their employees.
Connor Swalm
Right on how they treat their employees.
Jason Slagle
Yeah. Go look at how it is to work there. Right. If a place is treating their employees poorly, then they're almost certainly going to be treating their customers poorly. And even if they're not. It means that I'm going to go through 14 different salespeople and support people aren't going to stick around long enough to actually be good at it.
Connor Swalm
I really like your perspective of when you're working with a vendor, specifically with how typically ingrained they have to be in your business and clients business. This is like one of my employees. I want to be able to access them in a certain capacity, I want to treat them a certain way, and I want them to have the same level of respect for me. But a lot of people, a lot. Don't think about it like that. You said you had the thing for the last thought. So for anyone who's listening, who wants to learn a little bit more, or you have one piece of advice for them, what is it? What's that one piece?
Jason Slagle
When you build your contracts with your vendors, if they force you into anything other than a month to month contract, add an exit clause on sale. If they sell, you have the right to notify or you have the right to cancel within 90 days of notification of a sale. Right. I am starting to write that into anything I do going forward. If they require a contract, because the evil empire has bought enough of my things, enough of my products that I use, and I just generally don't want to do business with them. So I'm starting to write that clause in the contracts and if they won't, that's probably a red flag.
Connor Swalm
Yeah, because, well, that means everyone's interested in selling at some point, but that means that they think it would be detrimental to their.
Jason Slagle
When some of the vendors in our space are hiding acquisitions because they know they're going to impact the earn out of the company they're buying because it's going to negatively impact their sales and it's going to negatively impact their retention. Then we have a problem.
Connor Swalm
There's a few that I think I know are like that. Just a few.
Jason Slagle
Awesome.
Connor Swalm Well, thanks for joining us. This was a blast, as always. Your candor and your honesty, however spiky people feel, is refreshing at some points.
Jason Slagle
Thank you.
Connor Swalm
You at least got that for me.
If anyone's interested in reaching out to Jason or saying hey, on LinkedIn, we'll put all of his content information everywhere you can find him in the show notes. So feel free to reach out.
Jason Slagle
All right, see you all next time.
Connor Swalm
Thanks so much for tuning in to gone fishing.
If you want to find out more about high quality security awareness training campaigns, how to launch them in ways that actually engage employees to change their habits. Then check us out. Phin security at Phinsec.io. That's P H I N S E C . IO or click all of the wonderful links in our show notes. Thanks for fishing with me today and we'll see you next time.
