From the Kitchen Rush to Cyber Risk: Lessons in Leadership and Service - ERP140

This file was generated by Descript Todd Kane: Before Josh Hobein ran a se- cybersecurity practice, he was slinging wings at Buffalo Wild Wings. Now he's a manager of cybersecurity and automation at Centrex IT, a top 100 MSP, running vCISO services and a five-step maturity model he built himself to get companies past the checkbox of security. He's got a talk called How to Align to a Framework for People Who Don't Give a Shit About Frameworks, and that probably tells you a lot about how he operates. He's also made the case more than once that a great MSP and a five-star restaurant are run the exact same way. Welcome, Josh Josh Hohbein: Hey, thanks for having me. You, you nailed it. Those are, uh, pretty Todd Kane: Perfect. Uh, so that's a great place to start because, uh, I'm sure many people are tired of hearing me, uh, throw praise at "The Bear," not because it's not just a great show, but I think the parallels of how you build a world-class team, uh, how you build culture, and how you build a culture of discipline are actually really tightly woven into that show, and it's part of why I tell people, like, you gotta watch this for basically the forks episode, where, one of the characters goes to this Michelin star restaurant, and he's all grizzled and doesn't think, like, any of this is, is relevant to him. I'll post the, the link to the video maybe in, the, the show notes here. But it's a great encapsulation, I think, of the fact that discipline has to be something that you choose, and it bothers me a lot in organizations when people say, "We have a great culture," then they complain about the people that are doing things that don't contribute to the culture. And I get why this happens, but it also bothers me 'cause I feel like this is within your control, right? Like, you… Dis- uh, culture is d- is, uh, defined by what you tolerate, and if you tolerate sort of this inappropriate behavior or not the culture that you're trying to foster in an organization, it's kind of on you, right? So I'd love to… your thoughts on this. I think we're, we're fairly tightly aligned on you wanna build the Michelin star MSP. So totally, let's, let's do it. Let's go. Josh Hohbein: Yeah. love it. Um, and also, man, I, I love The Bear. I mean, I, uh, was it… It's, I think it's episode seven in season one. It's, like, the super short one where they go through the kitchen rush, the printer keeps going off, someone gets stabbed and all that. It's like, oh, is… That is the, that is the frantic, like, rush scene. Um, but yeah, I've either been in restaurants or IT my entire life, you know, more time spent on the IT side. But, you know, growing up, that was my first job, and then, uh, spent a lot of time, um, you know, at the, at Buffalo Wild Wings, not just slinging wings, but I mean, I was, uh, front of house manager, kitchen manager, assistant general manager, interim general manager, regional, went to different stores, you know, new store opening team. So I did a, a lot of it. And it comes out, uh, there's so much that, um, I took away from that and apply to the MSP even today, and it, there's so much crossover. Uh, it's one of my favorite talks to give as well, but, like, we're still in the service industry. I mean, the S in MSP is service. We're a managed service provider. So you take all of those things that are taught in hospitality over relationship building and taking care of your guests or your client or your customer, whatever you wanna call them, um, there's so many of those skills that, that carry over. And, uh, you know, one of the examples I give is even just, you know, the, you take the, the person at the host stand, uh, that they're not, they're not just sitting there on their phone, like ignoring you, right? If they take the time to note down, you know, your stuff and, you know, "Hey, there's, uh, a table over there," like you're waiting for somebody. "Cool. Let me, you know, sit you there facing the window. You know, is there anything I can get you, you, you know, to, to drink or anything?" Or, you know, "Sorry we're, we're, we're busy. Like we're bussing off tables. Can I get you a water?" Just something a little bit over, right? Um, you put that person on tier one helpdesk, give them a headset. They don't know anything about tech, but they get a call, somebody's upset. They're still able to ground the situation to understand, "Hey, I'm, you know, I'm really sorry. Um, this is upsetting. I will, you know, do what I can. We'll note it," et cetera. They're, they're doing something. They're making sure that they're heard, and just like in the restaurant, they can't fix the issue. They're not the ones bussing the table, most likely. They're not the ones, you know, serving. But like they're still trying to help, uh, do what they can within their power. So you take that mindset of service first, and you train that to everybody. I mean, it's, uh, your tier one, your projects, your service desk, and you just, you, again, go off that service first, the building the relationship. Because if you think about how there's so many restaurants out there, and we'll just throw BDubs as the example. How many places can you go to get wings, drink beer, and watch sports? Todd Kane: throw a rock at a, any strip mall basically, right? Yeah Josh Hohbein: Yeah. Right? And if, let's take it to IT, how many places can you go to get your computers fixed, uh, right? It's, there's so many. Um, so what sets it apart? And it's that relationship. You go to a certain bar, let's say BDubs, because the bartenders know you. They might, you know, talk crap with you when your sports team is playing and, and, uh, but they have that connection and they take care of you, might go a little bit above and beyond. But that relationship and that service is why you go back. There's nothing special about BDubs. I mean, you know, their sauces are pretty good. Asian Zing's awesome, but like that, the service is what's the difference. And most of us, we should all be able to fix computers and troubleshoot issues, so what makes us special? is that service Todd Kane: it's, it always reminds me of the, I think it's a Maya Angelou quote of, uh, "People won't remember f- what you did, they'll remember how you made them feel." Uh, and I think that's so on point with service, right? Like, it is about the experience. Because I always tell people, like, the expectation is, is that you're a f- if you're an IT company, you can fix IT stuff, right? Like, that's, that's the base. That's, that's not, um, you know, what you're trying to achieve and what people will measure you by. It's whether or not you can create a high-quality experience where they feel like someone actually cared about the experience that you're having. Like, uh, and to some degree, like, this is tricky too, 'cause I also don't want sort of the r- the, the memorized scripts, uh, when you call into a call center and they're like, "I'm so sorry to hear that. That must be really frustrating for you." It's like, you don't really care, right? So there needs to be, like, built-in empathy. It's not just following the scripts necessarily. But it does make a difference if you feel like someone, uh, recognizes like, "Oh man, that's terrible. Like I'm, I'm, uh… You must be pretty stressed out 'cause you can't print these invoices 'cause your printer's broken, and you need to get these things out by the end of the day, or like, like people are gonna be really upset." Like, that matters. Like, okay, this person actually understands the predicament I'm in, right? Like, service and, and the experience matters a lot more than people really qualify for Josh Hohbein: But yeah, I mean, you, you really said it. It's like, um, one of the things that, uh, I think Pax8 Beyond, uh, Halo star-- uh, Halo, the ITSM platform, introduced, uh, on the main stage something called XLA, which is experience level agreement. And funnily enough, that's actually something we've been using internally at our MSP for a while. When we get a new prospect, and we have the little pitch deck, um, we say basically, you know, SLA or like take… you know, solving tickets, that's table stakes. Like, we really care about your experience. And there's different ways of measuring it. It is a little bit of a marketing term, I'll give it that. But again, taking back, right? Like, you're in the, the restaurant, you have ten minutes to get those wings out, and maybe it takes you 13 or 14. Like, yes, you've technically breached an SLA, but it can feel like forever. If you're starving, I mean, it comes out in nine minutes, you see all the other tables getting their food, and you're just sitting there starving. That could feel like an eternity. And you complain, and it's like, "Well, ticket time is nine minutes." Like we, we delivered what we said we would. But clearly, you know, they didn't care what about the experience. And same thing, like if our SLA is twenty-four, forty-eight hours, but you know, again, the printer is what controls the, the checks and, um, you don't assign that, that criticalness to it, um, then it's like, well, you know, we're not… We're, we're meeting our SLA, but like, but there was frustrations. Maybe, maybe it wasn't even a printer thing. Maybe it was like a s- a simple, you know, a, a fix, but they had to call three times in about it or something like that. Um, and you're meeting all of your, your service level agreement, but like, what is the experience like? And to me, that's, that's a little bit more important, um, and, and something more that should-- you should focus on Todd Kane: So how do you drive that behavior in the teams, right? 'Cause like what I, what I was talking about is like, uh, in The Bear, you know, they take this ragtag group of misfits and turn them into, you know, a Michelin star restaurant, right? And like the, the process of doing that is interesting. And one, like maybe like I guess in s- in the, in that case, some people leave, right? And some people will need to leave because they're just not on board for, for creating that experience and being disciplined in the way that it takes to, to be excellent, right? Like what does it take in, in the, within the teams that you've seen, and what do you drive as behaviors of expectation, right? Of like, "I need you guys to care about this, and not just sort of pretend that you do, but actually do." It's easier when you hire like a tier one and you, you maybe source them from, uh, retail or hospitality where they've, they, they have more of that as a, as a pre-wiring. Uh, but, you know, what are your thoughts on sort of, uh, establishing that within a team, either by, you know, improving people's, uh, delivery and their capabilities, or rotating out and finding the people that, that can do that for you? Josh Hohbein: Yeah. Well, first it starts with the top, you know, the leadership of, of setting the standard. And part of that, you know, too is, is, like, being there, uh, being accountable, showing that, like, you know, even in a leadership position, even when I was a manager at the restaurant, I wasn't beneath bussing tables if that's what needed to be done, right? So showing that you're, you're there to achieve the same goal, and you kinda, you know, you have their back. But then also, like, "Hey, we have high expectations, um, here, and there's a reason for them." So, you know, if you are the one who… You are the one who's setting the tone, um, you know, to, to q- uh, think about Letter, uh, Todd Kane: See? I was, that's exactly what threw… Set the tone. Yeah. Josh Hohbein: right? Right? Like that's-- You gotta do that. So it, it's gotta start from the top. Uh, because if you're not setting the tone, then it's not going to translate well, and you can sit, and you can tell them that all that. But, like, you gotta, you gotta lead and show it, and take care of the employees, be there for them. Um, and you know, again, it's, it sounds simple, but, like, doing the basics right is what it takes. And once you've done that, then you can really see, um, get them, you know, the buy-in, um, having the ownership. You know, it does also help, and I understand that not every MSP can offer this, but we are also an ESOP. Uh, so each of the employees does have ownership in the MSP, so it's not just the paycheck. Like, if we grow, then everyone, uh, succeeds. We're all on the same team. Um, but if you can't go the ESOP route, you know, there, there should be some, some level of, of ownership and pride in- involved with that as well. But Yeah, number one definitely starts with the top, um, and, you know, leading that way, having what we, we call, you know, internally the culture of care. Um, and, uh, it's, you know, built into our mission statement. We're constantly doing, um, you know, focus recognition, recognizing those, um, jumping in, you know, whenever there's an issue on here. I mean, it doesn't matter what position people are in. We have different departments. I mean, we're all here to help each other out and figure out how to solve the problem. Um, you know, again, the accountability, uh, we're not trying to, to point fingers or anything on anybody if someone fails. We're all like, "Hey, what can we all do better?" So you really have to build that team mindset, and it doesn't happen overnight. But again, you… Yeah, I, I, uh, with the, the sake of repeating myself, but, like, you lead that style and you get them on board and you get them to buy in, um, and you hold them accountable and, like, we still-- We have a great group. We have a lot of fun, but at the same time, high-performing, high expectations. If somebody doesn't meet that, um, then you do have to, unfortunately, um, if they, if they don't meet the, the culture, the fit, um, that we're looking for, that they don't meet the expectations, um, you do have to let people go. I mean, obviously it's not just overnight, but if there's ev- you do everything in your power to, to give them all the chances to succeed. You know, what can we do differently? How can we accommodate? What, uh, on my end, what can, what can I do to, to fix this issue? But if you've exhausted those resources, then you don't have a choice. You-- They have to go somewhere where they might be a Todd Kane: Yeah, I often describe that as, uh, it ultimately becomes their choice, right? Like, you do everything in your power to extend your hand and pull them up to what you need them to, to grow into, and if they choose not to take your hand, that's not your fault. Like, that was their choice to make, right? Um, I, I, I wanna… I, I'll maybe tell you a story, 'cause something I noted in, in, uh, in your work history in, in your LinkedIn profile is, like, you were in IT, then went to a restaurant, like scaled up in that restaurant. Like you said, like you're, you're in m- management and, like, regional management, so pretty high up in, in as far as sort of restaurant, uh, hierarchy goes. Then you went back into IT. And I had kind of a similar experience, and I'm, I wanna get sort of, uh, your, your take on this. Um, I actually, I worked in IT like before, uh, before I graduated high school. I had my own consulting company, and then I went and did like a, a work practicum for this oil company. And there was a few things, like at one point I felt like I should go get a job with people my age, right? Like, uh, maybe this would be good for me socially was part of the calculus of doing this. Like, I was, I was in between this, this practicum, uh, and another job. So in the summer I'm like, "You know what? I'm just gonna get a, go get a restaurant job." Uh, and honestly, it was one of the hardest jobs I've ever had. And when the guy like agreed to hire me, 'cause he was like, "You're overqualified for this," like, "why are you applying for this?" And I kinda gave him like what I was looking for, right? And he's like, "Um, okay. But don't screw me and just disappear one day and not come in for your shift." I was like, "Uh, okay. Yeah, no worries." And then, uh, it was really, really difficult. Next time I got a, like a job offer from a corporate job, I was like, "Look, sorry dude, I'm not gonna come in for my shift." And like to this day, I sometimes feel bad for that guy, where he was like, "I knew it. That guy was not gonna come in for his shift." Um, but that was sort of my story of like going into, into restaurant and then coming back to IT. Uh, w- w- did you have anything similar or like what was, what was the journey of IT to restaurants and back? Josh Hohbein: Yeah, it kind of happened, Stan. So, um, short and story, you know, the first MSP, um, we had … My wife and I had our second child, so at that point, our daycare bill was more than our mortgage. So we had to make the decision that, like, we were losing money if my wife was working. So, um, we made the decision for her to stay home. And, um, my- one of my best friends, uh, his name is Norm, uh, he was the actual, the regional manager for that franchise. So I was like, "Hey, man, can I… I just, I need some extra money. Can I just wait some tables, you know, serve, bartend, et cetera?" And, uh, he's like, "Oh, yeah, come on board." I get to boss you around. "Sure, let's do it." So it was just a part-time job for a while because I, I needed to pay the bills. My wife wasn't working. Um, we had two kids here. So, um, that ended up, um, having some, uh, kind of a falling out with the person who has made the IT manager at the first MSP. Uh, he kinda started micromanaging, and although I was working two jobs, I was still, you know, highest billable hours, all that stuff. I wasn't slacking whatsoever. But, um, we had a little falling out over some control issues he had after hours. And, um, I was venting to my friend at, at the time about this, and Norm's like, "Why don't you just come work for me? I'll give you a raise. I'll pay you more than you were making at the MSP, and you can just be a manager." And I was like, "Cool, let's do it." So went that route and then, um, you know, proved myself. This definitely wasn't… You know, I'm, uh, I'm, I'm pretty humble, but I'll, I'll say here, just like for any of the naysayers, this wasn't a Todd Kane: Yeah Josh Hohbein: hire. Like, I, I worked my, my butt off, uh, to, to move up, uh, and, uh, you know, go through the ranks of being in management. And, um Eventually, it did get to a point where, like, you're the GM and all of that stuff, and, and I mean, I saw this with Norm too. Like, we didn't have, we didn't have days off. We didn't have time off. Um, you know, I wanted to see my family. Like, uh, I learned, you know, if I wanted some time, like I really had to, I had to train my management staff at the restaurant. Like, I had to make them GM level, uh, teach them. Um, you know, I, I couldn't, like, I had to make playbooks for everything of like, you know, this is what you do when this goes down, all of these things, binders and binders of, of SOP and playbooks, which Todd Kane: Sounds familiar, right? Yeah Josh Hohbein: You know, same thing. But, um, you know, teaching them how I would deal with it, don't just give them the answer. You know, walk them through it, kind of teach them critical thinking skills, all of those. Um, and as I did that, then I was able to spend a little bit more time on the business rather than in the business. 'Cause again, I'm trying to grow sales. I'm trying to build partnerships with hotels and things like that, um, which, hey, again, sounds familiar to leading your team on the inside, right? Especially if you're smaller and you're the owner-led operations. But it did get to a point where I was like, "Hey, I really enjoy this. I'm good at it, but, like, I need a little bit more consistent schedule." Like, I don't wanna do close opens anymore. Um, and in the world of cybersecurity, I mean, you do have incidences. It happens, but it's, you know, it's not every week. Um, and I still liked IT. I ultimately, I just like helping people, um, and, uh, serving people, and if it happens to do, you know, with IT or, or restaurant, like I, I love doing it. So, um, went back in the MSP just so I could have a little bit more of a consistent schedule. But I mean, it gave me a new perspective on everything because now I just came back, you know, uh, from all my time up to there, I was in tech. It was the tech role and all of the technical skills, and I'm still learning technical skills today. But now coming back, I have all of this business management experience. Like, not only do I, uh, not only do I understand, like, how to actually manage the people and the relationships and the soft skills, but all of the back-of-house stuff. Um, and that's like your cost of goods, the marketing, the finance, all of those things that go into it, um, making business decisions, um, you know, all of the things that it takes to, to run a business combined with technical skill. And you, you see things in a different light, and you're able to, to do, you know… Um, I was able to, to kinda grow a little bit of a side department at that MSP I went, which then eventually led me here, um, as they were looking for someone, uh, Centrix was looking for someone to build out their security, and I was like, "Perfect. I- this is what I do. I love doing it." Um, so without that restaurant management experience, I mean, I, I don't know. You know, I'd probably still be in tech, but I don't think I'd be in the position. So it's, it's invaluable, um, what I learned and how I'm able to, to approach that to MSPs. Todd Kane: that's amazing. Uh, so all right, so we'll, we'll switch a bit to security. I, I mean, I could go on about the, the, the culture piece and team building and stuff like that. That's the stuff I absolutely nerd out on, so. But we will move on. Uh, uh, I like your framing, and I think this is important and especially practical for, you know, uh, some of the, like, the owner-led, uh, MSPs or, you know, the, the, the, the folks that are kind of in Death Valley, the 1 to 5 million in ARR, uh, about… Like they, uh, they know the importance of having a NIST framework or, you know, util- utilizing some of these, these, uh, frameworks. But these are difficult conversations to have with non-technical business owners. So, and this sounds like something that, that you're, you're pretty keen about, um, given your, your, uh, your talk, uh, that I noted in the top here, how to align frameworks for people who don't give a shit about frameworks. Uh, I think a lot of people find themselves in that position of like, this is an important discussion to have with a business owner that doesn't know what I'm talking about and does not see the value of what I'm talking about. Um, you know, I had a, a guy that I was, I was talking to earlier this week, and he was, he was struggling with this conversation of, of, uh, you know, when I try to have these conversations with the c- with the clients, they feel like I'm just trying to squeeze more money out of them by selling them stuff, right? Uh, what's, what would be your kind of advice on, on how do you slide into these conversations in a way that feels accessible for business owners? Josh Hohbein: Yeah. One, one of the things that I've always kind of prided myself on is, is trying… A- and it's a good skill to have, of like how do you explain tech to a non-technical person? And it becomes even more crucial when you're talking cyber and compliance. You know, like, 'cause again, you're the… I mean, like my title says, their clients don't give a shit about that. They're hiring you because you, they want you to keep them safe and keep their stuff on. So the idea that came behind this framework is let's look at like, again, doing basics right. Um, it was one of the things that I taught in the B-Dubs kitchen as well is like, dude, we're not a Michelin, we're not a fine restaurant, but like if you care and put some effort and you do the basics right, you can have a pretty good meal, man. You get those wings out of like hot and fresh out of the fryer and, and do these sauces like it's, it's pretty good. Now if somebody wants like a specialized burger or something, they're not coming here. But like you can get like the burgers there again, when cooked right, are, are better than they should be, better than normal. So how do we translate that to frameworks? So I took cyber insurance requirements, you know, the, the forms that we see, like they're asking kind of the same questions, as well as CIS and just other best standards. And, um, if you're familiar with CIS, if you are a framework nerd, they do have what are called implementation groups. So it's their logical grouping of, hey, do these first IG1, then IG2, then Todd Kane: This is why I like CIS over NIST personally, is I feel like it's, it's more programmatic of like, this is where you start versus like this giant spreadsheet of stuff that you need to get through, right? Josh Hohbein: Yeah, 100%. And it's, it's a little bit more like hands-on tactical versus like kinda theoretical and, and open-ended. So the idea was to take CIS with the cyber and then kind of combine it and simplify it. So, um, what I did is took a five-stage maturity model, I mean, nothing groundbreaking. But I applied, like on the back end CIS controls, but on the front end it was just simplified words. So, you know, MFA, there's a whole bunch of controls that that means. Um, so in level one, again, we're looking for like, hey, what is the base minimum that you need that cyber insurance is gonna ask you for that proves that you're not negligent? And it is your, you know, cyber awareness training, your EDR, MDR, MFA, you know, uh, offsite backups, uh, a security officer, for example, you know, someone who, you know, is like, "Hey, I'm, I'm the security officer for the client," an external email notice. You know, nothing groundbreaking, but like those are steps, and they're easy to check off, um, easy to, to explain, right? Um, and included in most of our w- what your MSP package should be offering. But then in like in level two, um, we get into tenant hardening, so like Microsoft and Google. Uh, you can really explain like we need to harden, like it's not secure by default, risks, all of that. But i- if you try to explain all of the CIS controls that you're meeting, like, hey, in order to meet, you know, all, all of these various 20-some, like then that it… They don't care about that. But it's very easy to say tenant hardening. Uh, and again, show them on the map. You get the little like kinda dopamine like check marks as they can see, hey, when they come into you as an MSP, these are the controls they have. And you basically, you take the, the maturity model, and you show which controls they have. Um, and then, hey, by partnering with you, we cover, you know, quite a bit of these. But these will require a project, but you at least know where you are today, where you need to be. Um, a- and you know, we say like a full level three, any client through any vertical should be able to get there. Um, that is a high level of maturity with the idea being if you ever need to go to like actual regulatory, like a s- if you need a specialized burger, it's pretty easy to crosswalk here. You have the, you have the, the base, high level of base maturity that we can expand on. Um, but really we're just trying to cover the basics, do the basics right, build that great groundwork, secure everything, build some policies, build some governance, build some security culture within the client, give them empowerment and ownership, lead by education. And it just starts with the just trying to simplify that framework and showing again, you know, cool, then every quarter we m- make another, make more progress on that, get more green check marks. Um, and again, they see where they were, um, a- and then what is left so that you have that whole roadmap Todd Kane: Yeah, that progression, visible progression I think is really meaningful for people, especially if they don't really know what they're doing. Like they get that dopamine hit of like, "Oh, okay, we're, we're improving at, at the very least," right? I think that's, that's an important factor. Um, I guess like, uh, one of the other pieces of this is like having these conversations with non-technical people. Uh, I had this person on the podcast, um, a couple years ago, and I went into this conversation expecting a different answer than I got, and I was like, "All right, so you know, FUD, fear, uncertainty, and doubt. It's an effective sales tool for security, but maybe this isn't the best place to sort of lean on." And the answer was is like, "No, FUD's great," right? Because it, it is, it, it makes it more visceral for, for people. Like there has to be kind of a fear around, uh, around things that they don't necessarily understand. I was like, "Huh, okay. Not exactly what I, I sort of expected as an answer for this." What, what's your feeling on sort of F- to FUD or to not to FUD as far as, uh, you know, positioning and potentially selling security for non-technical people? Josh Hohbein: Yeah. There's-- I, I think there's a layer to it. Um, so I'd be remiss to say if, if I didn't, but what really annoys me, uh, and this is kinda where, you know, another one of the things that I, I get, like, passionate about, is when you strictly rely on fear. Um, so, um, um, let's use the dark web, for example. Um, there's so many-- There's different dark web scanners out there, but if I have your domain, I can just give you a dark web scan and then, you know, "Todd, like, you have 200 hits on the dark web. This is like… Y- I mean, you're in trouble. Like, you, you need me to save your, your business. Like, look what is out there. Do you want more of it out there?" Like, you scare you a little bit. But, um, you can use it as, as an education tool, right? So something scary like that, um, how I approach it is, you know, "Hey, Todd. You, you do have, you know, quite a bit on the dark web, but here's a secret. Like, almost everybody's on there. You know, it's, it's not-- It doesn't really mean much that you're on there, but here's what we can learn from it. Your information is out there. You have passwords in plain text, and by looking at what was captured, you might not have the best password policy, as you see people are using the name of your business or, you know, go Padres or whatever the sports team would be, um, or summer 2026. So we need to have a conversation around some better password hygiene. Maybe look at password managers." The other side with this is, again, these are out there, so if you reuse those passwords, sure, you might not care that your-- the place you bought your college textbooks from got compromised, but if you're reusing those passwords, well, now I can get into your Facebook, to your, your email account, your bank account, all of those things. So really y-you're-- That almost like… And what's funny is you lead by that education, and you guide them on that journey, and I've had some clients say that that's like they've been more scared now because they're like, "Oh, oh my God. I, I do that. Like, I need to, you know, do this, take this action more." Todd Kane: 'Cause they understand it more, right? Josh Hohbein: just… Yeah, th-they understand it, right? So it's not just the whole fear thing. Same thing with, like, external scans. I mean, one of the things that annoys me is, like, as part as like, like, an external vulnerability scan absolutely required. I'm not saying it's not. But then like that's not the only thing you need to do. And sometimes you, like, scan a website, and it's like, "Cool. I don't host my website. I pay someone else to do it." So you've encountered something of the hosting provider. Yeah, sure, they should fix it, but, like, y- you can't just go with fear. There has to be, um, maybe some level of fear, but it also has to come with some education and, you know, how I can help you, uh, get through this. Todd Kane: I like that framing of like there's, there's still a component of fear, but not coming from the place of I-- only I can save you. I think that that's a really dangerous positioning and just it doesn't really establish a lot of trust. I'm a huge fan of like education-based sales. I think it j- it just seems to work. Like it certainly works in a technical industry, but I think broadly it just elicits more trust, right? Like that people are like, "Oh, okay, like you've, you've helped me to understand this. Now I have a better qualification of the problem. Like can you help me with this as well?" It draws them in rather than like you need me, right? I think that's a much, much better positioning Josh Hohbein: Yeah, absolutely. And again, it goes to there are still quite a few places and people who deal sub by that fear. So if you take the time to explain it and explain maybe why they're afraid, then it, it does go a long way. You're like, "Hey, you're the first person to, that explained it to me this way, so, like, let's, you know, let's work together on it." Heck, when we do… Like, one of the things I do is the assessments. Um, I align to that framework, just like I say, um, show them the business risk and all of this, and I literally, you know, say, "Hey, we would love to, to partner with you to fix it. Here's our budgetary roadmap. But, like, at the end of the day, this is yours. If you wanna take care of it internally, you know what you need to do. Um, if you wanna look for a different provider, you can hand them this, and this is the blueprint." So, um, again, you're building that trust, and more often than not, they will go with you. But leading by education is for sure the, the much better way rather than just the s- the scare tactic. Speaker: Tired of fighting the MSP fires alone? The Opsleader Pro group connects service delivery professionals who understand your daily challenges. From KPIs and workflows to career planning and team management, Opsleader Pro has systems for you to use. Join operations leaders from successful MSPs who are sharing real solutions for managing client expectations, optimizing service delivery, and making your service delivery team as effective as possible. Opsleader Pro, 'cause your service desk deserves more than just survival mode. Visit opsleader.co. That's O-P-S leader dot C-O to apply to join the public community. Todd Kane: Yeah, you, you've mentioned a couple of times your compliance and, uh, insurance, and this is one that I think is really powerful, um, is letting people know, like, here are the minimum requirements in order to have cybersecurity insurance. And it's kind of shocking. Maybe it shouldn't be, but it still kind of is. Like, the number of times I ask people… I was, uh, talking to someone recently, I'm like, "Does this client have cybersecurity insurance?" And the account manager was like, "Uh, hmm, I feel like I should know that." And I'm like, "Yeah, you probably should," right? And, like, I wasn't critical 'cause, like, th- I think this is all over the place, but, like, that's the type of conversation that we should be thinking about with people is, like, is do they have cybersecurity insurance? That's a basic. Like, let's go do that. And by the way, in order for you to get cybersecurity insurance, you're gonna need to do these for- 14 things. And although, also, by the way, in order to get paid out if you actually have a breach, we also have to have these 14 things in place, right? Like, it's, it's again, kind of servicing them. I'm not telling you you need a bunch of fancy security stuff just because, like, it's good for me. Like, there is actual, a practical benefit to this. And it is frustrating that you can go through that conversation, get to the end of it, and the business owner is like, "Meh, whatever, I'll take my chances." You're like, "Ugh, okay, you're gonna be really pissed about this if you ever get breached," like I can tell you. But, you know, ultimately, you can't make that decision for them. What, what's your sort of thought on, like, positioning this as a sort of a requirement for insurance and utilizing that as a, a, as a sort of a sales vehicle? Josh Hohbein: Yeah, that's kinda what we say with the maturity model is like, you know, level one gets you out of the negligent threshold. You know, we'll cover the things that you're- you'd be on the insurance. But, like, the other side too is as good as, you know, we try to be at security, like, there's not gonna be anything that, that is Todd Kane: Yep. Nothing's 100%. Josh Hohbein: through. Um, nothing's 100%. So that last bit of risk, we need to transfer it, and that's where cyber insurance comes in. Um, the other side of that, I mean, shout out to, you know, we're in the IR game here, uh, of, of tabletops as you put them through that, that pain and things like that. And you can try to sit and talk and, and make them feel it. Um, you can do a tabletop and really kind of, you know, push them to the limit on that. But ultimately, I mean, it's their business, their decision. Um, and if there is a business that's too risky, then you can walk away. You have that option. Um, you know, understanding smaller MSPs might not have that fortune. You know, you are trying to, to take all the revenue you can get when you're starting out. So it is a good sign of maturity and growth when you can tell a client no or walk away. Uh, it's a good feeling. But ultimately, that's something you wanna strive to get for, uh, get, get towards. Um, 'cause if they are, aren't to, to take that risk, then it's like, "Hey, I… You are too big of a risk for me to manage, um, and, and I have to walk away." Todd Kane: What about, uh, sort of a middle ground? Like, do you think it's practical to have them sign a waiver of, like, I've advised you that, like, these things need to be met, uh, and you've chosen not to. Like, this is a budgetary decision. You're taking on the risk. I can have nothing to do with this, basically. Is, like, I, I think there's, there's sort of a sense of safety in having that, but I don't know really how enforceable that would be if, if, if something bad happens, right? But to your point, like, people are trying to win as much business as they can kind of scrape together if they're smaller, right? Josh Hohbein: Yeah, for sure. And I know it's something that we've covered at IR Games too. Um, we've had, uh, uh, Bradley Gross, um, who's a well-known MSP lawyer say the same thing of like, "You can, you can do it, but it might not, you know, be like this ironclad, you know, thing in court." Like, and, and, um, we're, we're pretty litigious here in, in, uh, the United States of America, so, you know, anyone can sue anyone for almost anything. Um, so… But it does, it does kind of create, like, a little bit of, like, the psychology of like, "Oh, you know, oh crap, like I need to sign this." Um, so it can definitely be a tactic. I'm not saying don't do it, but I'd also warn, like, it… Just because it's there, it doesn't mean it's gonna, you know… And I'm not a lawyer, um, Todd Kane: Sure. Josh Hohbein: at all, Todd Kane: Yep. Josh Hohbein: ask Brad those questions. But it, it might not at the end of the day actually matter if something does happen and something's signed. Um, but, uh, again, it is still good. Uh, it, it, you could use it as kind of a latched, last-ditch effort or something of that nature. But, uh, definitely check with your attorney if whatever you're having them sign would actually be enforceable or upholdable in Todd Kane: Yeah. And I think it is just, it's good to have a qualification of like what are the minimum requirements that I'm willing to sort of take on from a risk perspective in order to have a client? I think you have to like have to have an objective sort of rational discussion with yourself and your team around those things of like, I've seen a lot of organizations are like MFA on every account is mandatory, like no questions whatsoever, basically, right? Like, and if you're not cool with that, then we can't do business together. Uh, and that's, like that's tricky, right? For, for, for smaller organizations. You've got like the dentist's office where they're like still using shared accounts to log into the clinic, uh, computers, right? Like they're not gonna go for that. So it, it becomes tricky. I get it. Yeah. Um, you mentioned, Josh Hohbein: Yeah, I mean our, our, let's say our, our base minimums, it's like you build it into your package. So that way you don't have to have the conversation. Like, uh, uh this is provided. But the other side when it comes to security, it's like y- the security versus convenience, you can't just be the department of no. Understanding where it comes from. What is like the reasoning behind it? Like again, education. Listen. Why… If they're using shared accounts, like what's the business reason behind it? Uh, m- is it something, "Oh, we've always done it this way." But like again, do they only have a certain amount of time? Dig into a little bit. And is there a compromise that we can do? Like is there compensating controls that we can, that we can show, um, that way they're still able to do their business function while maybe not meeting everything to the letter. Again, that's the whole point of, uh, of these things of we're not enforcing a very specific control. We're just saying, you know, MDR, uh, MFA, tenant hardening, um, because it does give the leeway to still have the business, uh, function as it needs to while meeting the, controls that we need to on the back Todd Kane: Yep, yep. Um, so you mentioned, uh, tabletops. I'm a huge fan of tabletops, not just because they're fun, but they're also incredibly instructive, right? Like, the number of times I've run an MSP through a tabletop and been, and the, the recognition on their face of like, "Oh my God, we don't have any documentation for this. We should probably build this," right? Like, that's sort of the insight that I love gleaning from people of like, yeah, like I, I've thought about this at some point, or maybe I haven't for that matter, but like we are absolutely behind the ball, and that's a great time to determine those things are, are open gaps that you need to fill rather than getting into an emergency and everyone's just running around with their hair on fire 'cause they, they have no playbook to pull from. Um, what are your thoughts on sort of the, uh, the, the, the best ways to run successful tabletops and sort of general scenarios you like to pull, pull people through? Josh Hohbein: Yeah, and this is again, I'll shout out to irgame.ai, um, with Bob Miller. Uh, I've been partnering with him for like two-ish years. I've ran quite a few tabletops, and the reason, uh, for that is I've also done, you know, before IR Game, like my own tabletops and things, and a lot of them are like the tactical part of it, of like, okay, you know, which machines are we gonna restore? Or we might read off the incident response, or we get this alert, you know, what do we do? And, and not that that stuff isn't important, but the business owners and the executives and like the people who need this IR game, like they don't really… Like it doesn't land with them quite a bit. So where we try to go and, and exactly like that, the whole concept of, of The tabletop they need is around business decisions and things that go into it. If you've ever been in an incident, like there's so… Again, you still have to do the tactical, the technical of it, but that's such a small Todd Kane: Yeah Josh Hohbein: You know, if I'm, I'm gonna make up a mis- if I'm gonna make up a percentage, I would say it's 80 is the, the business decisions you have to make around the personnel, what to do, who to contact, regulation, all of those things. and that's the, the important part of like making them feel that. Um, so we center it around those of like, what decisions are you making? The clock is ticking. You're in the hot seat. Uh, your employees, your board is making these demands. Your clients are making these demands. Like, do you… You know? And if you don't have a process in place, if you haven't done a tabletop, if you don't have policies, uh, if you've never been through this, like you're going to fumble and fail. You know? It's like football, you play it on Sunday, right? And the guys are, the, the guys at the pro level, like for the most part, you Todd Kane: Like every day. Josh Hohbein: on Sunday. They wouldn't be in that position if they didn't practice all of this. So as you do more of these and as you practice and you have the policies, you're gonna be able to respond to 'em much better. Um, and I try to make it a little like personable too and kinda role play a little bit is, you know, "Hey, you're, you're a sales guy, so this incident right now, like you're, you're the sales manager. Um, this incident, like your salespeople are based off of commission, and their paycheck is commission. And the sales guys, they didn't cause this incident. They didn't do anything wrong. They have mouths to feed, they have a mortgage to pay, and now like when are they gonna get their commission back up? Like you've lost 40% of your business. That directly comes out of their paycheck. How are you keeping your salespeople? They're gonna come to your office and say, 'Hey, I didn't cause this. Todd Kane: Why am I suffering? Josh Hohbein: bought a, a new house, a new car. Like what are you, the sales manager, like what are you doing for me? 'Cause if you can't, then I'm leaving.'" And like putting you in that position, making you make a, like what is your decision? Um, and you're like, "Oh, well I don't wanna be in that." I'm like, "Nobody does, so that's why we do these. Let's think about it. Let's have the procedures in place, um, the, the, the policies and at least the experience of going through these. Um, and hopefully it never happens." I, I've been through incidences. They suck. Todd Kane: Yeah, for everybody Josh Hohbein: PTSD with them is real, so you know, learn, learn from the people who've gone through 'em Todd Kane: Yep. Josh Hohbein: don't have one yourself. But if you do, you're gonna be a hell of a lot better prepared Todd Kane: I, I think it's true. It's so counterintuitive that the business decisions matter more than the technical. Like, there's sort of the basic stuff that is really important to, to sort of weigh upon people is like, don't start fixing the situation when there's an incident. That feels counterinu- intuitive too, but the techs need to know that. Like, don't start stepping on evidence. Just secure it, contain it, and then leave it. And then the, everything else is business decisions. Like, are we calling the insurance company? Are we calling our PR company, right? Like, all of those things need to be understood, and that's the playbook you pull from. So yeah, it's, it's, it's counterintuitive and really important to, to not be, you know, faced with the Super Bowl on your first day on Sunday, right? So basically, right? Josh Hohbein: Yeah. Yeah, that's 100% it. And again, it goes, you know, the restaurant, like prepare for that incident like all the time, right? Like the rush, that's your boom, that's the incident. But like you're preparing. I mean, people are coming in early to do prep work, so you're prepared. Um, you are practicing your skills, your organizational skills when it's dead, so that way when it's busy you're- you've- you have that experience, that knowledge to go on. Like again, even if you've never worked in a restaurant, like you probably are like, "Okay, I can write on a pad, I can grab plates, you know, I can, you know, bring tacos to this table." Go be like, do you think you could handle a rush? I mean, you've worked in the restaurant. It, Todd Kane: It's brutal. It is really brutal Josh Hohbein: you've ex- you know… Like sure, you'd be able to fumble your way through it, but it's gonna suck. It's gonna suck a lot. Or you can experience it, be prepared, learn from it, and then again, when it, hopefully it never happens, but if it does, you're gonna be in a much better Todd Kane: Yep. Practice makes progress, right? I, I guess to that point, uh, this has been awesome, uh, Josh, really loved ha- the conversation. Um, as a practical takeaway, you know, for the MSP owners or service managers listening, what is sort of the, the, the first thing that you would have them work on next Monday morning to improve their cybersecurity, or I would say maybe their cultural posture in their organization? Josh Hohbein: Yeah. Um, I, you know, I'm a big fan of, of, of just the simplified. So align to a framework if you're not already. If you need one, um, you know, look me up. I can-- I'm more than happy to get you the simplified framework. And then look at your, your stack. Um, does the services that you offer, both tools and, you know, projects or just how you deliver the service, is it, you know, enough for securing the client, bringing them on, so you can identify gaps that you might have? Or, you know, if you don't have gaps, perfect, now you have a framework that, that can, you know, back up what you're offering. And on the service side of things, it is, it's soft skills. Um, ple- you know, focus on those, on building the trust, the building the relationship, the, the give a damn factor. Um, a-and it's weird to say, but, like, again, doing basics right, doing the little things right, and just showing up makes such a huge difference that, I, I mean, it's, it's gonna help you tenfold Todd Kane: Like, uh, the, the old John Wooden adage of tie your shoes correctly, right? Josh Hohbein: Yeah, that's it. It's, it's, it's the basics, man, but there's, there's a lot of people with untied shoes, Todd Kane: That's right. Yeah. Cool. Well, this has been great. Appreciate it, Josh. We'll, uh, link to you on LinkedIn and to IR Game as well if, if people wanna check that out and, uh, continue the conversation. Appreciate your time Josh Hohbein: Yeah, thanks for having me on