ERP089 - State of the channel summer 2022

Security is the area that I just sort of always sigh and go I hate talking about security. But we must, Dave, we must. I hate talking about it because I'm not positive on it as a space. Because I look at it and I go, this is a need because there's a criminal element out there that has gone completely, you know, crazy and is aggressive and has built an incredibly enviable business model. Welcome to Evolved Radio, where we explore the evolution of business and technology. I'm your host Todd Kane. Did you know about stir/shaken? If you're doing voice for your customers, you'd better. The deadline was June 30th. This technology is focused on reducing robo calls and providers have to take action. Are you compliant? The team at OIT Voip has put together resources for you to learn more. Or, for their customers, it's already handled. Want to learn more? Visit OIT.co/MSPradio for resources to help make sure you're covered. Today, on the Evolved Radio podcast, I'm joined by Dave Sobel, host of the Business of Tech. Dave and I talk about the current state of the MSP industry and the economy. Dave has a watchful eye on the trends of the tech industry as a whole and is an outspoken voice in the industry. If you enjoy our discussion today, I'd also encourage you to check out his daily podcast and YouTube content. If you enjoy the show, please consider leaving a rating and review in your favorite podcast app. It really helps to spread awareness and bring more listeners to the show so we can share the message with more of the community. Now, on with the show. Dave, welcome to the podcast. Oh, thanks for having me. this should be a lot of fun. We're going to dip around in several different areas, kind of doing a state of the industry and a state of the sort of the MSP world, so this will be fun. Great place to start, I think, that's on a lot of people's minds and both you and I certainly have some thoughts around this, but the economy is is apparently really bad. But the IT industry seems to be somewhat shielded from it. And I think a lot of us are kind of like there's a lot of wait and see, but it's creating a lot of sort of interesting dynamics around, should we be hiring? Should we be conservative and constricting? There still seems to be a lot of opportunity here. So it's a very mixed bag around what we should be expecting from the economy over probably, you know, the next six months or so at least. Would love your input on this. Yeah, the economy is really weird. I don't necessarily want to say it's bad. That's a better way to put it. Because it's really weird. It's doing it's behaving in ways that we're not used to seeing it and it has inconsistent behavior. For example, if you're in the if you're in the buying market for like home goods, they're on sale. Because a bunch of people over over ordered and now supply is there. Interestingly, so we're we're recording this in July 2022, gas prices are actually starting to come down a little bit. Now, people don't believe that and they don't necessarily feel that right away because inflation in other areas is way up. Food costs are way up, but certain technology costs, smartphones are down. It's weird out there. And so it's really hard to sort of say we know exactly what this is going to look like. Overall inflation, inflationary pressures appear to be a thing. And so for me, what I've been looking at this saying is is like you're going to have to need to get get really close to your customers to understand their markets and the specific impacts they're seeing. I think you're right, like tech is shielded, although big tech/Silicon Valley has been trimming up, right? They're letting people go. That could be just preparation for bad times because that's never a bad thing if you anticipate bad times to get lean going into them. So it's it's weird out there. It's really weird. Yeah, it's uh your your sort of comment on the Silicon Valley approach to this, I found really fascinating. So I watched this video from Craft Ventures and the founders were basically addressing their investor market and the companies that they're investing in. And basically giving them some tips about how you run a business through uh sort of tough financial times. And on its face it seemed like such a strange discussion around like, well, now we should position for profitability, right? Like that's such a strange thing to say to a business. But I guess it's different. Like they they were in this this growth dynamic hype cycle and now they're kind of getting to this place where they're saying like, hey, let's not focus on revenue growth. Let's actually focus on Eda, right? And so that like all of those conversations that we've been having in in our business markets are are now starting to show up in in Silicon Valley. So I found that really fascinating. Yeah, these us small business owners laugh every time this comes around. It's like, oh, you're so cute, you now actually have to think about profit. We've always had to think about profit. Yeah. Like and and that's that's kind of the the bit about it is is that fundamentals are fashionable and classic for a reason. Right? They like any of us who have bootstrapped businesses, do it on our own, are doing it with our own sweat equity. Like we understand the basics of you have to make money for this to be a real thing. So I kind of laugh when I see these people, oh, I'm not so focused on revenue anymore. Now I'm focused on profit. It's like, join the reality of those of us that run small businesses. It's why I like what we do. That's not to say that I don't understand the dynamics of bigger companies and I don't appreciate them for what they are. And by the way, they generate a different kind of value. Right. But for those of us in small to mid-sized companies, like this is the way we do business. The moment you put that investor money in, that's when things change, and I get all that. Those of us running basic businesses, you always need to be laser focused on that. Know right now that my big concern is more around what might happen to a small business kind of surprisingly. Right. I use this kind of an I talk about this. is imagine you're a you're a typical managed services provider, you're doing 1.6 million in revenue, you've got 20 or so staff, right? That's kind of a typical profile. I can do all kinds of different profiles. But say you've got about 50 customers. And they're all in, I don't know, let's go with manufacturing, right? And manufacturing ends up deciding to trim up and get conservative. And every one of your manufacturing customers decides to let go 5% of the workforce. You've just taken a big per user or per device haircut. Like you've just because they're going to trim down their monthly spends with you if you're in any kind of monthly recurring 30-day flexible spend route. You, the service provider, just took a beating because you're going to take that across all your contracts. And that's what I want you to be looking for more than these broad statements about the market. Right. Yeah, and I think that that that's that's similar to sort of the position that I've been suggesting as well. is like, there's no cause for panic, but you need to understand what the potential scenarios look like and do some modeling. Right? Like what does a 5%, 10% and 20% reduction in revenue look like to your bottom line, right? What are some of the costs that you could be more conservative on? Right? And none of this really seems necessary yet, but you're you're better to have these plans to be able to execute them when you need them. Then to panic in the moment and try to figure out what to do, right? Well, and especially so I I use the the adage and this was given to me by uh you know, by a mentor advisor a long time ago. is is you make business decisions ruthlessly and you execute them humanely. So what I want you to be thinking about is is right now is the time to be making sure that you are cutting the costs that make the most sense. And particularly if you do decide you need to make staffing choices, you can make those earlier and be very humane. You can be very generous with the kinds of of severance packages you may offer or the, you know, or the way you help them onto their next opportunity, which is good for everybody. Right? That's good for you. It's good for the people that that your organization. It's good for the people leaving and by the way, it's good for the people staying because they see the way that you treat people. That builds better orgs and it's easier to do that now when you don't necessarily have to. Yeah. But you're planning. Or you may decide, you know, hey, we're going to be conservative on, you know, that infrastructure investment of our own. Or we're going to be really careful and making sure that our war chest is really built up and we've got a bigger buffer and we're going to make sure that we've got more in the bank ready to go. Or we're going to trim up our line of credit right now and make sure that we're ready in the case that we need to. Like all of those decisions you want to make now when you're not panicking. Yeah. You touched on one of the areas that I find really interesting is like, we're not sure if we should be hiring or firing right now, right? Like a lot of people have been struggling to find good talent for a long time. Like it's probably been, you know, even it's gotten certainly worsened through the pandemic and trying to find good talent. But even before that, I mean, we were at like a negative 6% unemployment rate. So there was just nobody that you could you could sort of pick up. Kind of finding good staff was really, really difficult. And now I think people are sort of like, well, should I be hiring or not, right? I tend to be a fan of top grading and it tends to be a bit of a dirty word. Like like it feels, you know, as you said, not a humane approach, but I think it is kind of sensible. Right? Like evaluating your team, understanding who the key performers are and reinforcing those relationships, making sure they feel valued and they're going to stick around if times get tough. And you know, if you hire a couple of extra people and, you know, some of your bottom performers are not working out, you feel some flexibility to let them go, right? So I but what that looks like kind of six months from now, maybe hiring gets easier as, you know, the the war for talent tends to cool off. Who knows, right? Yeah, and I just interviewed a recruiter actually to talk about the recruiting market right now. And his number one guidance was that the number the big thing that candidates are looking for right now is that they haven't been invested enough in their career path. Yeah. So you take a quick pause and you go, wait a second, those are the people we hold on to right now. People are leaving because they're not being invested enough. And this by the way is specific to the MSP market. This was a recruiter that works specifically in the MSP market. And he's he's telling us that the reason he's able to move people to other jobs is their current employers aren't investing in them. Yeah. I think that that's an easier solve than most people think, right? Like this is an area I spend a lot of time in and is managing staff and building out leadership. And I think a lot of owners overthink what that looks like to give them a career path, right? So you've got a decent tier two, a decent tier three tech or someone who's who's shifting more towards the business operations. And they really struggle with, well, I can't promote them because they don't know enough about this and, you know, really struggling with what that career path looks like. And they they think about it too concretely. And I can't promote them to X level or, you know, I can't pay them more than they're currently making in this role, those sorts of things. And it doesn't have to be that concrete. These can be more soft approach, like giving them challenging projects. Like just things to kind of sink their teeth into and grow professionally. That's all they're really looking for. It doesn't mean it has to be a 20% increase. It doesn't have to be a complete role change or taking over a major portion of the business. They generally just need more of a challenge and feel like they're growing in some way, right? Yeah, well, exactly. Don't overthink this so much. And by the way, sit down and talk to them. And if you think about it, you know, if you're if you're doing, you know, 7 to 10% increases on people's pay over time, you will keep up and out pace and let them grow with you. And they that that's the comp portion of it. But then you can you're exactly right, like invest in them in projects and pushing them to get get into new opportunities and new experiences. And just keep settling in on the, well, you'd be perfectly happy going out and hiring that expensive person. And know you're going to be spending what 20% on the hiring fees for that. Why don't you spend that money instead on the people you've got? Yeah. Like if you're going to go recruit, spend that money on the people you've got and make them into what you need. Because by the way, they'll also then know your org and not have to learn the new ways and all your processes. And they will continue to that's the kind of people that want to stay with you and will grow with you when you give them the opportunity. You're exactly right, it doesn't have to mean like ownership stakes. They can just naturally mean like them feeling ownership of their work. Yeah. Yeah, yeah, it's uh it's not as hard as we tend to sort of balloon these things in our head when we're running this those businesses, right? Most things are not as hard as we think they are. That's too true, too true. I think and also like a really great area to probably spend and focus some staff in your team is cyber security. It's an ever present thing and certainly over the last two years has become just a mountain of an issue for all MSPs. And I think across the board, unless you're running like an MSSP or, you know, some type of more cyber focused IT organization. MSPs tend to be underskilled in this area and, you know, I I advocate that that's not necessarily a bad thing. Like don't create an MSSP overnight or, you know, start to tell people that you have this sophisticated security offering just because you have a tool. Like the tools are useful, but cyber security generally looks more like governance than it does look like like infrastructure. So the skill sets are not necessarily applicable, but that doesn't mean that you can't spend the time and, you know, the the capital to invest in your team to develop some of those skill sets. Because the need for this type of capability and that governance model is going to grow exponentially in our industry. Well, totally. I mean, and security is the area that I just sort of always sigh and go I hate talking about security. But we must, Dave, we must. I hate talking about it because I'm not positive on it as a space. Because I look at it and I go, this is a need because there's a criminal element out there that has gone completely, you know, crazy and is aggressive and has built an incredibly enviable business model. Being a ransomware operator is like an awesome business if not for being illegal. Other than threat of prosecution and extradition, you know, it might be great. Well, and you're having to like some of those things up until just recently, those weren't necessarily even threats. Right? Like you could operate in countries under complete cover of those countries. You know, now maybe less so, but still not free and clear. Like it's a kind of awesome business model. Uh and thus I look I look and I say, you know, I take most organizations and I think about the things that they want to spend money on. And I and cyber security is like the one thing that doesn't drive revenue. It just generally doesn't. It can protect revenue. I get that. Right. But you know, but that that falls into I I use a my good, better, best model for for thinking about where you where your services impact. Good being like you're an expense and that you you've you're just making sure that things are going. And that's good, right? Like it's you've got to be there, we need it. It's okay. Better is the idea of impacting cost of goods sold. Can I make a reduction in the amount of money you spend to deliver on your revenue promises? And best is if I can help you drive revenue. Like if I can directly help my customers drive revenue, that's the best kind of IT services. I struggle to get I to get security out of good. And in a way, like it's not even like good because it doesn't even do as much as keeping the lights on. Like it keeps bad guys from stealing my profit. Like, why do I need that? Isn't that what the police do? If you think about it in a physical sense, it's like, isn't that what the police do? Well, no, not really, right? Because we've this crazy wild west situation. So I want to make sure that we're we talk very sensibly about IT security spend. Because you've got to do it, but I'm not comfortable necessarily touting it as this amazing thing. And I I get really kind of upset when I listen to vendors talk about the IT security opportunity. It's like, do we really like spending our customers money this way? I don't like it. I don't like spending their money this way. I'm not saying I won't do it. I'm not saying it's not important. I'm just saying, I'm not going to embrace it as this great opportunity when I'd rather spend their money on things that drive revenue. Now I've got to protect their revenue. I've got to make sure that they can, you know, stay in business. Like, but let's let's be realistic about this. And to your point, I think you also need to be very realistic about your own capabilities. Because, you know, it is much more about making sure that you're, you know, as you said, governance compliance than it is about a bunch of tools being in place and ready to go. Because when the insurance company or the lawyers come seeking, they're not going to care about that stuff. They're going to be asking, well, how did you do this process? Not what tool you had. Right. Yeah, show me the show me the SOP, not the tool that you use is probably the conversation. I think that's a really apt description of it. And I agree, like, like I would way more gladly spend money on digital transformation. Because most industries are far behind on that trend and I think there's a ton of latent opportunity to do the better and the best approach around increasing their revenue or saving them money. Versus that that that cyber security infrastructure spend. But at the same time, I think like there are good reasons that this will become inevitable, right? So the big ones that stand out to me are just simply some people not being able to renew cyber insurance because they're below sort of the standards of what would be approved. And I've I've seen this be an issue for, you know, clients that like they're the underwriters are just like, sorry, you know, we we can't renew your cyber security insurance because you're a risk. So I think there's some of those basic fundamentals of just like general cyber hygiene that are incredibly critical. Like tools will help, but generally it's just sort of an approach to IT, I think is more sensible. Doesn't actually cost a lot of money. It's more just about building out process and documentation to be able to demonstrate to the insurers. And eventually, the regulators, right? And that's the other half of this that I know you've been quite vocal about. That the regulation of the IT industry will come slowly, right? I agree with people that this is probably a 10-year trend, but it is absolutely starting. And you've sort of put some focus on this as well, that especially in in some regions of the US where laws are actually starting to show up on the books. You want to talk a bit about that as well? Yeah, I so two years ago, the summer of 2020, I covered what happened in Louisiana with their passing of uh an essentially an MSP registration bill. Where if you're dealing with the public sector in the state, you've got to register with the state, with the Secretary of State's office. Well, here we are, two summers later and I just reported on the Secretary of State and his chief information officer essentially doing a press tour talking about how great their law is. Talking about the fact that it's made an impact and that they're now know who they're working with and they literally called out, we are utilizing this law. And who who did they do it to? They went on tour with the other secretaries of state. The National Association of Secretary of States was the place they did it. And the reason I highlight this is is the, look, politicians are in the PR game just as much as everybody else and they want to tout their successes. They think they've got a winner here. I think they're probably right. And then, you know, so so what ends up happening? Well, they're going out and telling their colleagues, this one's a winner. Well, anybody smart's going to go, well, maybe we should do that too. Like like and so this is how it happens. Like a lot of this stuff is collaboration. The same way that in the IT industry, we're all collaborating with one another. Well, it happens with politicians too. And they're going to see regulations that work. They're going to want to do something with them. Well, that's what's happening here. And you're exactly right, it's going to happen over time. And I I continue to focus on this idea of in the typical IT company, IT services org, MSP, IT solution provider, whatever you want to call yourself. Who's in charge of making sure that you're tracking all the laws and all the regulations? That's an actual job. Yeah. Is it a full-time job? Well, that we could have that whole debate. But it is most definitely a role. And somebody better own it and be in charge of it and make sure it's implemented because if you're not, well, then it's happening to you. Yeah. So I have two thoughts on this. One, I'll sort of say quickly that just to sort of reiterate that idea of like, you know, there's a lot of organizations that deal with medical clients and there's hippo regulations there. And they're they barely know what the hippo regulations are and they're they're their client offices will not listen to them about the hippo regulations, right? Like no, all all of my staff need to be able to log on to this Windows XP machine without a password, right? So this is a long road for a lot of people, I think, is is sort of my first point. The other is a bit of pushback around this. Like isn't there some degree of of this is generally a good idea and the implementation is is sort of where this will be judged as around its quality. Because there does need to be some standards of of uh not necessarily certification or or qualification, but you know, separating the good MSPs from the bad. And I think we the industry tends to suffer from the expectations and and the the negative stories that get created by someone who just did not take good care. In managing their client or their own infrastructure for that matter. And it creates a bit of a black eye for the people that are running a well-run cyber focused organizations. So, you know, how do we separate the good from the bad without some type of regulation or certification for MSPs in the industry around us? Well, let me be clear. I'm very pro some industry certification that then gets enforced with regulation. I think this is a good idea and I've advocated it for for a while. And I've got several videos and thought pieces on this saying like, I think the industry needs to own this. Let me tell you the why I think this, because I'm in the business of making money. is and and I can tell you that those industries that have embraced this outperform. Right. Let's go look at lawyers. That's exactly the area. Right? They created the bar and the bar certification because you couldn't tell one lawyer from another. And they self-regulate that policy and then it's enforced through regulation. The lawyers write it themselves. And what do they also do? They charge more. Like and then you also see this in CPAs, you see it in doctors. Like that is how the process is done. The industry regulates itself at some level. You know, doctors pass, you know, the medical the medical boards, that's regulated by doctors and managed and enforced then by regulation. I think this model works for us and I for us as an industry. And I'm very much for it. Why? Because I think we'll make more money. Those of us that invest in this will do better. Like and I I say this because I'm look at it and say the other industries that have done it have done it. We can do that too. We've been saying for years, we want to be at the table, right? We want to be a business leader. We want to be just as important as the CFO. Well, here's a way to do it, but you got to prove it. Because remember from the other from the customer buying perspective, how do they know the difference from your marketing materials? Right. There's no way to tell. And by the way, most of most IT service providers, your marketing materials are garbage. So it's not actually really doing a great job of it. You know, how do you convey that value? Like there is a way to do this and I think it's that. Yeah. That's I think that's really smart sort of borrowing from other professional industries essentially in and that same model. So, I think that that makes a ton of sense. So maybe some more lobbying efforts. I know Carl Palcheck has been sort of dipping into this area. He needs maybe some more people behind him and and the enforcing those lobbying efforts so that we can contribute to what these laws eventually look like, right? So that we can help to write them so that they're they're in service to the industry, not not counter to what we're trying to accomplish here, right? Exactly. And again, this is all just, you know, there there are several people that could play on this. You know, Comtia could have done this. They have clearly not expressed an interest in in this area as much. They also don't necessarily agree with my premise. Cool, right? Uh then you could somebody like MSP Alliance, well, has been doing this for a while, but I don't it doesn't it doesn't seem to have gotten enough traction. I don't understand. Uh you're exactly right, the National Society of the IT Solution providers, Carl Paulcheck founded it. But to be fair, he's put together a board. They're working very hard on this on this. That seems to be a nice grassroot effort to get this started. I think somebody will do this. Uh they seem to be the group that that is pushing hardest to get there, but they've started most recently. I would encourage any solution provider to think about this solution and how they think this will play out. And by the way, if you think I'm wrong, like don't get involved. Just down the road, don't come complaining that you that it happened to you. Rather than happened with you. Of course, yeah. Like uh be vocal, right? If you feel differently, we're happy to talk about this stuff. Like you and I kind of spout off and talk about these things. Not because I won't put words in your mouth, speaking for myself, I speak my mind and this is what I think about it. But I'm I'm very open to to like people's input. If I need to change my opinion, I will do that under more evidence, right? So it's an evolving field. Right, and things change, right? I take the data that I've got, this is the landscape and here and I give you my analysis, right? I look at this and I say my analysis is this. I see the trends, I see the costs, particularly because of IT security. I see the cost of this happening. One of the ways I think this will get played out is I think insurance companies are just going to put together standards. Right? Because they're just not in the in the business of just paying out as much money as possible. So they're going to put together standards. It would be really nice if somebody from industry worked with them. But they'll do it regardless because they're going to they're going to solve this problem. So it's going to it's going to happen. Yeah. That's kind of one of the interesting industry trends that I've seen as well. Is the the insurance companies are now like the tool companies are building insurance models and insurance underwriter subscriber underneath that. So basically check all these boxes in the tool, you have good cyber hygiene, now we can ensure you. And I think that makes a lot more sense because the insurance industry is so behind on this. They cannot tell the difference between a high risk and a low risk MSP or a high risk and a low risk organization other than just sort of some general tick boxes and these these questionnaires that we have to fill out all the time, right? This is one of my 2022 predictions actually. I was say that I I called it that there was going to be entrance into the market that were putting their money where their mouth was. That a combination of insurance plus software made sense to me. That if because, you know, the I I always get angry at the piece of software on my desk that says you are safe, but has that comes with no actual guarantees. I will not call out the vendor. But I have a piece of technology that runs there that tells me every morning I am safe, but there's no actual guarantee. But if you can take the technology that's constantly looking and looking for a certain set of conditions and then couple that with insurance, that makes sense to me. Because it's both kind of the process and there's value there. So I I see that happening and it's happening over the course of this year. Yeah, right on. All right, Dave, well, uh we'll put some a lot of links in the show notes here to to point people to to some of these topics and they can get involved. And I'll link to your podcast and your YouTube page as well. Lots of places to reach out to you, so if people feel differently, they can reach out and tell us. Please, the the discussion is part of it, by the way. And I I talk I talk these ideas out because I don't necessarily think there is one answer. This is an industry that likes looking for the answer. But more often than not, there are lots of ways to get there. And I think it's the discussion that's the most important bit. And I encourage everybody like go chart your path, run your plan and prove it through business success. Yeah, awesome. Well, I appreciate you engaging in the discussion, Dave. Thanks for coming on. Thanks for having me. This has been a great fun. Okay, take care.