Latest / You've Been Heard / 404- I.T. Doesn't Just Fix Computers w/Josh Tanner

Transcript

404- I.T. Doesn't Just Fix Computers w/Josh Tanner · You've Been Heard

0:10
Speaker A: Welcome everyone back to youo've Been Heard. We've got Josh Tanner on here today. We're supposed to talk about cybersecurity. I actually had a bunch of things come up lately that I would, I would love to ask your opinion on. But before we do that, how did you get into this wild world that changes so slowly and called technology? What was your first computer? What were you playing around with? Like, how. How'd this happen?
0:30
Speaker B: Yeah, first computer built with my brother. That's Bond back in the Fry's Electronics days. Black Friday, Thursday night. We stay up all night into the morning, waiting outside a line of Fry's Electronics. It's two in the morning, three in the morning, trying to get there as early as possible just to get the next graphics card or motherboard, whatever it was that came out that year. And one year we had put all of our monies together to really buckle down and make a pretty proficient machine. And that was the year I think the very first Call of Duty ever came out. Or maybe it was Medal of Honor. Maybe that's what it was. I can't remember.
1:15
Speaker A: That was great. All right, man. So then what happened? How did you get to where you are today? I like on your kind of LinkedIn resume, you're like various IT roles. Was that actually the company? That would be funny if that was the company. No, various IT roles would be great.
1:29
Speaker B: I did a few different things for U Haul Corporate here in Arizona. One of them, I was kind of doing more sort of a technical role. Not necessarily like a help desk type role, but more on the advertising technology side for a bit there. And then I had a good friend of mine who was a developer there and really, really liked what he was doing and liked work he was doing. And so I googled my way into software development and worked as a software developer over there as well for a time. And then what do you feel about
2:04
Speaker A: software development right now? I've. I've daily arguments going back and forth with friends that are dev guys, some are on the AI will significantly put them out of a job. And some are like, nah. And it's like it's screwing up so bad. You should see all the mistakes it makes on a daily basis.
2:23
Speaker B: That's a really good question.
2:24
Speaker A: I. I'm on the 80% will be gone in. In 18 months.
2:29
Speaker B: Yeah, I don't know about that. And I. And I'll tell you why. Well, let me first say this one. The development world has changed significantly since when I was in it and where it's at today. And that's, I mean, that's only, I don't know, 12 years ago or whatever, 10 years ago. And it's crazy how much it's changed, how much it's shifted. I'm taking on the kind of the DevOps side at our company now and kind of having to go through all of this and relearn some processes and things like that and cicd and all that kind of stuff and work out how this is going to work and make sense in our company today. To answer your question, what's the impact of AI? I mean, there's no doubt AI has made developers significantly more productive.
3:18
Speaker A: What about non developers just making stuff?
3:21
Speaker B: Well, and that's the other key to this. It's made developers more productive, but it's made non developers like, they can do stuff now, right? They can do stuff, but they don't necessarily know what they're doing. But they don't need to know because it does it for them. And at the end, to map it
3:37
Speaker A: out, I mean, you have to do a good job. You have to like draw an outline, you have to make like a plan, all this type of stuff, truly.
3:43
Speaker B: And that's where I think, like having the developer background, like if you have that framework of like, this is how you engineer a project, right? You don't have to go through and do all of that now. Now you can sit there and prompt. This is the project I'm trying to build. Here's the steps I want to build. Write me a prompt. And then you prompt that prompt like you just go through until you finally get to a highly detailed like that you're actually going to use in like a lovable AI or something like that.
4:13
Speaker A: When I say 80%, I mean like 80% of the classic kind of like, we're going to build an app and code this out and we're going to hire a team and it's going to take six months and it's going to cost us $80,000.
4:26
Speaker B: That's going to go away. Okay.
4:28
Speaker A: It's just like, because now I've seen, yeah, like my producer Greg, like he built us an app like over the weekend and I was like, there's no way there's gonna be problems. It's gonna work. Once we pressure test, it's gonna break. But just a few minor things and we're good. Now onto more important subjects. We're supposed to talk about cybersecurity as a business enabler and not a blocker or cost center. And your experience growing up since the Building the computer days with your brother and moving into it. How has the landscape changed over time as far as sea level executives and business leaders understanding it and giving them a legitimate seat at the executive roundtable and actually respecting and hearing their input?
5:16
Speaker B: Yeah, that's a good question. I think that we're in the middle of seeing kind of a big change. I don't know that I would say it's a hundred percent changed. I think that most C level people that I've interacted with see it as a cost center. And as much as I attempt to explain that every bit of what I do impacts every single department in this company in some way, shape or form, it's kind of like, yeah, that makes sense, ha ha. But can you fix my computer still? And there's very little, I think there's been, not enough, I'll say that, not enough of a trust created between a lot of the other C suite and it to and a lot of it's at the fault of it. They don't want it coming and speaking a bunch of technical jargon and making no sense and telling them we need to spend this money.
6:16
Speaker A: Agreed.
6:17
Speaker B: What we have to do is we have to bridge that gap, right? We have to come to our CEO and our CFO and we talk about the bottom line, we talk about revenue, we don't talk about the technical pieces, don't even mention the technical pieces, don't even talk about the tools, don't even talk about implementations and all this kind of stuff. Infrastructure bring up, here's the operation of what we're trying to do, here's the risk that's involved and here's the cost of negating that risk, right? Here's what the risk will cost you in this event. Here's what we've determined to be the cost of remediation or whatever it is, reducing that risk and it impacting here, here's how it impacts revenue, here's how all of those bottom line issues, right, come into play with cybersecurity. Even when you are. When we talk about like budgets and things like that, right, Going through budgets right now, lots of people I'm sure are going through budgets. We're still working through hacking away at it, but rather than talking about the ins and outs of implementing a DLP program, right now I can go to the C suite and say, look, here's the goal of this program, here's what this DLP program is going to do, here's the reduction of risk. It's going to bring, here's how this is going to align with our goals for HIPAA and HITRUST and nist, CFS and all those different things. Here's how long it's going to take, here's what it's going to cost. If we don't do that, here's the potential risk that's involved. You see what I'm saying?
7:57
Speaker A: Yeah. So the question that I wanted to ask you was in. Well, first of all, how many end users do you guys have?
8:05
Speaker B: Right now we're 350, roughly.
8:09
Speaker A: Okay. And so you're like head of IT security, kind of like the whole shebang, Correct, Right. At what point, from a security standpoint? And we have to sell. I mean, selling security, you've got to sell. Like, okay, look, at least in health care you can say it's something like violations and catching people violating these things is up like 350%, something like that. Meaning they're cracking down on things. Security can be hard to sell because it's kind of like selling insurance. It's like, we have to buy this stuff because if we don't do it, we're going to get robbed. And if we don't do this, we're going to get fines and we could look really bad to our customers. We'll lose all our customers. There's not like it's going to help us make more money. Unless you've got a good example of that, I would love to hear it.
9:01
Speaker B: So I think I understand your question a little bit more.
9:04
Speaker A: People care so much about the healthcare data. I wonder how many patients, if you ask the actual patients, like, hey, your patient data was leaked to the public. Ah, well, it's just. It's really like HIPAA's a kind of like a real big crackdown. And I'm wondering why it's so strict there. And this is sounding very ignorant right now. Maybe you can tell me as to why HIPAA is so strong just because it's like sensitive patient data and stuff like that. I don't know. I mean, it used to be paper files back in the day. I come from a family of doctors, so I know what the hospitals are like and I know how much information is kind of just randomly talked about and shared across all kinds of barriers. So that's why I'm. It's just interesting that HIPAA is like one of the biggest enforcers. Most IT leaders don't have an Internet problem. They have a management problem. Multiple locations, multiple providers, more multiple bills, different contracts. We help IT leaders make Internet boring again by consolidating visibility, billing support and monitoring without changing providers or forcing upgrades. If nothing needs fixing, we'll tell you that's vendor neutral advisory. Just go to you've been heard.com and answer the seven questions to simplify, streamline and save.
10:17
Speaker B: So in 2023 this is the last.
10:19
Speaker A: I think it's because someone's getting paid. I mean, I think like it's great, let's find people. Let's find people and make money.
10:24
Speaker B: Collect funds. It's one of the hottest commodities to sell on the dark web. So that's kind of a big piece of it. And I think the biggest reason is it's not necessarily about the health information specifically, but health information has personal information and typically financial information.
10:45
Speaker A: Okay.
10:46
Speaker B: If you can pull phi that contains both personal personal information, health financial information and health information, now you've got kind of the hottest commodity of data. Right. You're not just trying to grab one particular thing. Phi itself is always tied to that data. So it goes for a higher price. On the dark web they can chart ransoms are higher for those types of things. So that's why it's such a hot commodity. 2023, if I'm remembering correctly, the HIPAA journal, I think the average healthcare breach was around $11 million or something like
11:23
Speaker A: that for I guess 2025 here. Average healthcare breach in 2025 was 7.42 million.
11:30
Speaker B: Yeah. So clearly a high cost.
11:36
Speaker A: $408 per stolen record. 2.87 billion change in healthcare attack in 2024. So. So up by quite a bit. Ransomware reality. This is the most shocking one. 67% healthcare orgs hit in 2024. Yeah, 67%.
11:56
Speaker B: So I was thinking about this the other day. Why is it that healthcare orgs are getting hit so hard? I think that there's kind of a trend I've been seeing. Right. So there's this thought of like migrating everything to the cloud. There's better security, I think. I don't know that that's entirely a myth. I think it's pretty accurate. When you move towards a zero trust framework, you've got your identity, access, unlock that kind of a thing. You have a higher likelihood of being more secure in the cloud than you do on prem. Because the on prem is kind of that older technology, everybody's VPN into one thing. If bad actor gets access to the VPN or something like that, they can typically get into a lot more than you want them to. Right. And so if we move towards the cloud. Right. And that's kind of what a lot of smaller mid size modern companies have done. Well, a lot of these healthcare companies, huge healthcare companies, they've been around for a while, they're older, they've got older legacy systems in place, things like that. But you have to think about the OPEX and capex spend as well. Right. We're building infrastructure, buying infrastructure, that's all cap expenditures. Cloud is typically seen as more opex because it's SaaS based, operational, that sort of thing. And so switch in the books.
13:14
Speaker A: It's a big switch in the books. So like in China, depreciation models.
13:18
Speaker B: Exactly. So it's not just a simple like just migrate to the cloud. Well, it's not that simple. The money has to be there and it has to make sense and we can capitalize all of our servers and stuff that we're buying anymore. We now have to move to an operational expense and that's costly, it's more burn affects ebitda. It's all of these different pieces that affect the financial side that we as IT leaders don't often think about. We think we need to secure, which is true, we need to do that. But we have to do it in a way that is helpful and in line with the business. You can't just move to the cloud. It's not just about costs at that point.
14:00
Speaker A: However, at the same time there's a whole another world of telehealth healthcare providers that are new turning up and are able to move pretty nimble and fast by using remote providers. They can span larger areas, they can completely operate in the cloud, have various different, have desktop design, be able to turn things up and turn things down and remote wipe from a security standpoint, but definitely act more nimble than like you said, some of the older players in house.
14:31
Speaker B: Yeah, yeah.
14:33
Speaker A: What, what I wanted to ask you is, is when you're a company of that size, at what point and you have a team of say I don't know how, how big is your team? Three people, four people? Do you have more than that right now?
14:43
Speaker B: It's just me.
14:45
Speaker A: Okay, so there you go. At what point is an MSSP beneficial?
14:52
Speaker B: Well, it's beneficial for me right now because it's just me.
14:55
Speaker A: Right seam SOC training. Yeah, I mean they can literally.
14:59
Speaker B: Yeah, I, I have an MSP and an mssp. I, I onboarded them when I came here and I mean it depends on how you work the contract ultimately. And that's really the difficult thing. A lot of MSPs want to charge a premium for engineering and things like that. So work it out to where you can get a good price for both help desk tasks and managed services and things like that and engineering. Then you get the best of both worlds, right? The only problem is at some point you start to get tired of explaining every nuance of your company to the person doing all of your projects because they don't know your business. They are just.
15:44
Speaker A: They're mixing your business up with other people's businesses every day. Well, they see so many different things
15:48
Speaker B: a hundred percent and it's to be expected, but it's helpful. This is how a lot of mid sized companies get 247 stocks or assist or an MSSP. They've got people that are constantly monitoring things and take is it easier to
16:02
Speaker A: manage an MSP or an mssp? I would think it would be easier to manage the MSSP because there's certain things that are fairly 100% standardized.
16:11
Speaker B: 100%. Once you write up your runbooks and everybody's got their stuff in place, it's pretty simple. Especially if they work with your msp. Right. If you work in tandem, they've got the runbook. This is the situation, this is what happens. They know what they're supposed to do. They whatever quarantine the device, it goes over to the MSP who then works with. Either they have their work workflow of what they do with that particular situation or they work with me back and forth on what happens or what happened or whatever it is. And so we go through discovery and figure all that stuff out. So I will say yeah, MSP is definitely easier to work with and best
16:50
Speaker A: practice to have them two separate. Have the two separate.
16:53
Speaker B: I would have them on separate contracts.
16:56
Speaker A: I mean like separate. Com. And the reason why I say separate companies is because you want one checking the other. You don't want them like checking their own homework, so to speak.
17:03
Speaker B: 100%. Yeah. Well and. And this is there is kind of a conflict of interest and high trust kind of illuminates this between the person auditing your IT operations, right. The security and then the actual person overseeing the operations. There's always kind of been this interesting tension. There seems to be kind of a big movement towards like CIO CISO type role where combining both roles because we can't afford both in the C suite, right. And so let's just pick one. But ultimately that just causes kind of a conflict of interest when you have your IT operations person also seeing the security of the operations they're doing. Right. So you don't have an outside party Looking into the operations, auditing, what's actually happening, saying look, you can't do that because as an operations guy, like if I'm acting in operations, I got stuff to do. This close enough to security, it'll work. Let's just go do it.
18:05
Speaker A: Let's not slow down the process because it's going to annoy me. Correct. So here's the interesting thing because I've just been looking at a lot of these MSSPs lately. One kind of evaluate different ones and I find it interesting how much pricing can vary across the board. But I have kind of my recipe of what should be kind of provided standard from like a sim, right. Sim sock edr whether it be a know before email training, these type of things, honey pots set up and whatever, yearly pen testing these type of things. It's kind of like this like recipe for it and then it's like okay, well what are you using for? I don't know, are you doing crowds drag sentinel one like are we using. There's kind of like a, like an acceptable pattern of like what you guys use for these different things. And yeah, it's interesting that at the end when I look at it I'm kind of like well how are you guys justifying charging $1.47 million over three years? And the other guys that are actually seems like to be doing a little bit more and a little bit more proactive and are providing a little just seem to be doing a lot better for $400,000. Have you noticed that?
19:21
Speaker B: Yeah, I mean honestly just a crazy
19:24
Speaker A: like off the scale, just people throwing out crazy pricing here and there.
19:28
Speaker B: Yeah.
19:29
Speaker A: And I'm trying to figure out what, why and I sometimes I just can't see why someone would be charging more. And the only thing I can think of is like well it's their infrastructure because they're hosting it in Azure.
19:38
Speaker B: That could be the case. It just depends. Right. So one of the problems that I've seen with the MSP which I think does translate and has kind of moved over to the mssp. It's this idea of tooling. Okay. So when you bring on an msp, most of the time it's your MSP is dealing with somebody within the company that doesn't typically have an IT background, doesn't have enterprise experience, doesn't have operational, all of that kind of stuff. The MSP's coming as a one stop shop. We'll fix all your IT problems. And they did that by throwing a bunch of tools at it that they own. Right. And Then everything seems to be moving somewhat smoothly and then you guys grow or something happens and you want to separate from the MSP and they're like, sounds good, see you later, bye. They go away and all of your stuff is gone, broken.
20:36
Speaker A: Because it's their proprietary stuff, it's their
20:39
Speaker B: tooling, it's their stuff. Right? And so MSPs have acted not simply as a service company, but as a reseller. And I think that's where the problem lies. So if you can separate your resellers, right, go buy your Microsoft license from a resale, buy your services from a service provider. That way if you're no longer happy with the services and all your tools and resources don't go away, you just go hire somebody else to make sure
21:09
Speaker A: there are tools and services that are easily transferable.
21:12
Speaker B: Exactly, exactly. So I've seen in the MSP space and I think that it translates into the security space. And it's super simple to scare everybody into. This is what you need and you need this and AI is going to do this. And then they can rack up the price because now they can.
21:30
Speaker A: How are you using AI? Is there any AI security, any AI security things that have been helpful?
21:36
Speaker B: No, not really. We're investigating, so we're a Microsoft shop. We use Sentinel and XDR and Defender for cloud and all that stuff. We're investigating the security Copilot because they just released security copilot to E5 licenses and things like that. So we're starting to dig into that to see what's helpful, to see where this can fit into workflows, how it can fix workflows. I don't know yet. I don't have an answer for either. But it seems somewhat promising in some ways and cumbersome in other ways. And like it's. We're. Microsoft's figuring it out as we're figuring it out.
22:17
Speaker A: Yes, Classic. What does the top down management ask for AI in your organization? Is there a hey, what's our AI strategy?
22:26
Speaker B: Yeah, so is it like, hey, I
22:28
Speaker A: need our AI strategy on my desk by Monday, or is it like, hey, what are we doing? What's going on? Or is it they're just saying that we are doing it?
22:35
Speaker B: I think like every IT person, their CEO came to them and said, look, I went to some meeting and met with these VCs and these other CEOs and look at all this cool stuff that they say that they're doing or that they spend a bunch of money on or that I can do. And they come and they ask, hey, look, we need AI initiatives. Right? We need this. Okay? So let's think about what is every department, what are some workflows that they're doing that are repetitive? Right. And these are the things that I think every CEO is starting to think about and see as AI is the solution to the repetitive. The problem with that is that solution has existed long before AI because we call that automation. Yep. I think what AI is doing is it's enlightened CEOs and high level people to the concept of automation. Hey, are we automating things? Whereas like, it's not AI, it's just automation. Yeah. We should be spending more time looking at repetitive workflows, designing automation for those things to make our staff more productive. Or Maybe there are FTEs we don't have to hire anymore. Whatever it is, because we've automated that particular process, it's not necessarily AI. Right. In all cases, in some cases there's some AI involved. But I think to answer your question, how are we using it? We're not really because what it's done is it's opened up. Oh, here's the areas where we could go automate. Right. We don't really have a use case for AI yet because we have groundwork to cover from the start, if that makes sense. We're not quite there to even start to use AI. I mean, we've got Enterprise Copilot enabled for some of our users. We've got some 365 copilot users as well.
24:36
Speaker A: There's no agentic, there's no agent agents running.
24:39
Speaker B: There's nothing like that. We don't have a use case for it at the moment because every use case we have is just a simple automation that needs to be built out.
24:49
Speaker A: You had mentioned something about data. I mean, obviously everyone knows that the first step is we have to clean up data significantly. What are the significant steps to doing that in any organization?
25:00
Speaker B: You start small, be smart, start real with like pick one high risk area and like think of an old company.
25:09
Speaker A: I'm just thinking of like what would be a high risk data area?
25:12
Speaker B: Dhi. Right. Let's just start a high risk data area. Phi. Let's say you have a referral system. Okay. So we want to use a company or we want to build a process or something like that where we take our phi and we want our therapists. We're in the behavioral health realm. Right. So in the behavioral health realm, they have their patients that they want to refer to someone else. So we want to send their phi into a Referral system that then matches them up with a particular doctor or something like that and then sends that phi to their system, wherever they're storing that data.
25:58
Speaker A: In other words, their file, their healthcare file, basically.
26:02
Speaker B: So I would just start small, start with the flow, right? What's the data? Who is the owner of the data, what's the business process? Even map out the business process. What's the purpose of the business process itself. Don't even start with the, like the security pieces and the IT operations. Like what is the actual business process? Where is the data created, where is it used? Not just where it's stored, but trace the flow of what people actually impact the data, who touches the data and then put it, I don't know, make it simple. Put it on like a single page, make it simple. Those get the stakeholders involved that are all involved. Make sure everybody understands this is the flow of data. Right. I have kind of a. So minimal fields owner. What's the purpose?
26:53
Speaker A: That would be a hard one too. Like guys, we need to do this. There has to be like almost like a data cleanup committee.
27:00
Speaker B: No, and that's what I mean. Like you, it's too difficult because a lot of times when we go to clean up data, it's too late. Right. We're already so messy that we have to start so, so small and so simple to get anywhere because it's too overwhelming, it's too much to try and take the whole thing. Right. So you have to start super small.
27:24
Speaker A: And in the healthcare world, what are the top three things that you just wish that was different about executive management and the hierarchy of healthcare when it comes to technology? Like what do you wish they could hear and know about technology? Because I think healthcare has some of the largest strides to be made and yet sometimes we have some of the biggest breakthroughs in technology, but then we have some of the most antiquated, siloed technology all at the same time somehow working together?
27:57
Speaker B: Yeah.
27:57
Speaker A: From executive management standpoint, like what would you want them to really hear loud and clear if they could hear?
28:02
Speaker B: That's a good question. I think I would want to say like there's a better way. Like you have your old systems, you have everything tied to your old systems and that's why we have to do 19 different logins to get connect into your pin and blah blah, blah. And we've got to use this VDI and this thing and random, all of these different things. Like there's a better way. But the problem is that doesn't necessarily matter because the, at the End of the day, like the bottom line is what matters. And if I can't present a case to where unless there's like an end of service kind of coming up on your entire infrastructure and like this is going away and we're not going to have like, it's like if you can
28:51
Speaker A: just imagine even just walking around any healthcare organization. To me what I see is I see wires and silos and I see wireless devices and you can imagine an entire facility being mapped from even, just like a wi fi standpoint. I mean it's really like just even a hospital alone is very, very, very complicated and I see endless silos. I had just imagined the department of IT there. I don't know, hospitals to me seem like the place that has the department of it. Not this like this separate entity that kind of hides out in an area of the building somewhere. I don't know if that's correct, but that's kind of what I imagine when I think of hospitals because I'm still seeing Nortel phone systems on the wall and I see wires sticking on my desk. But then we know that 91 1's flowing very smooth. We know that ambulances are coming and going and then there's all these just providers that are kind of just here and there. There's got to be in a major efficiency gain somewhere. And that's. It just seems to be this ghost of it floating around somehow. At least in the healthcare world. I think when it comes to hardcore business, manufacturing, logistics, other companies that have very strong, like a kind of very strong manufacturing a widget or doing something, it's different. But healthcare is this very interesting entity.
30:10
Speaker B: I wonder if it's because I don't know that it. And technology is often a part of the long term strategy. And so I would say like that I guess I tell healthcare leaders like, look, that would be helpful to you in the long run. Not just from like you want to innovate healthcare and things like that. There's certain things that we just can't do with the technology that we have. But if you're unwilling to adjust the business model to make some of the technology work, whether that's moving to the cloud or replacing some of the infrastructure and moving that to the cloud, whatever it is, if there's a way that we can adjust some of this to bring us into the modern world, it
31:00
Speaker A: might not even be infrastructure. It might be like from a medical standpoint, it might be like think of what goes on in a lot of medical industry. There's a lot of training that goes on. There's a lot of kind of like this awareness and customer experience that's very, very important. Whereas I think from patient forward standpoint, I think it could take that stance and enter into the conversation a lot easier from that avenue than anywhere else. Whereas I imagine there's a lot of things like that where it could get involved just communicating with different departments, taking into their own hands and kind of just walking around and almost like meet and greet and finding out how it could make a difference in the organization. I think from that standpoint it could go pretty far in healthcare.
31:43
Speaker B: Yeah.
31:43
Speaker A: I mean as opposed to the broken old infrastructure that's probably going to be remain ancient for a while until you've made a bigger enough impact. They're like, we'll give you whatever you want.
31:55
Speaker B: I don't know if that's like for the IT guys that can sit there and slug it out and they make it work like it's almost kind of fun, right?
32:03
Speaker A: For sure.
32:05
Speaker B: I remember this. I worked for a higher ed company and we would build nursing sites all over the country and we would do a lot of them in. They were educational sites specifically for training nurses and things like that. A lot of them were in hospitals. And so we go into these hospitals and build out the simulation rooms and all that kind of stuff. So I was overseeing a lot of the IT build stuff, the infrastructure, low voltage, all that kind of stuff. And we would never utilize like the hospital circuits, we would never utilize any of their WI fi. We never like we. It was just too much of a hassle to try to integrate into their stuff. So we're going to bring our own circuit, we're going to bring our own network, we're going to set up our own network. We're going to have everything network, all those different things. It was just too much of a hassle to deal with all of the like you're saying the infrastructure. But what's interesting, I remember multiple occasions trying to work with the IT team. Like they just weren't fun to work with. They were just kind of like we want to exist in our dark hole doing our things and bringing people like
33:18
Speaker A: they don't under the stairs. Yeah, exactly, exactly.
33:24
Speaker B: And I think that like in the modern like mid market sector there's kind of been this push towards collaboration and everybody working together and all that kind of supports forced a lot of IT people to get out there and go make friends and go network and all that kind of stuff. But in the hospitals, like no, you are literally pushed to the darkest, dankest corners of the hospital that you think people work down here, like, this is crazy.
33:51
Speaker A: We don't want to move.
33:52
Speaker B: So that's kind of the same people, like they don't want to work with them, but also like they're really giving them opportunities. So it kind of goes back and forth, you know what I mean?
34:01
Speaker A: So it does still exist. Yeah. Is there any universal best practices, Speaking of the old days, are there any universally accepted best practices that you think are actually damaging?
34:12
Speaker B: I don't know about that.
34:13
Speaker A: Okay, fine. Is there a myth, Is there a myth about it that you should be wish the entire industry.
34:18
Speaker B: Oh, yeah. A friend of mine and I have kind of been talking about this a little bit back and forth, but I think that Soc 2 has kind of been universally accepted as a best practice in a lot of our industries and things like that. I think it's kind of outdated.
34:36
Speaker A: And so we're not SOC2 compliant, but it's outdated.
34:41
Speaker B: Well, it's. We're not SOC2, but everybody wants SOC2 compliance. And so what I mean is SOC2 shouldn't be the compliance rule. It's outdated. It's not keeping up with the times. It's managed by the big four and their playbooks and all that kind of stuff. And so it's back to people having money. Yeah, it's exactly what it's kind of becomes. Become less about. Right. That's not the security piece, it's the auditors. Right. They're not held accountable. They're not held accountable for the outcomes, essentially. Right. They're held accountable that you are doing what you say you're doing. But
35:19
Speaker A: okay, so from a security standpoint, doing your job as a security guy or hiring the right people, is it important to check the boxes first or should we be checking the boxes and also actually be secure? That's kind of the argument there, right?
35:31
Speaker B: Yeah.
35:34
Speaker A: Depending on the type of organization you work in, you're going to have to be like, we have to be compliant here or we're going to get sued or whatever. Can you please check the boxes? And you might say, well, how about we actually also be secure at the same time?
35:46
Speaker B: Right. No, a hundred percent. There's the checking the boxes. And I took a screenshot of this nine months ago to show you that we were doing this, but that, that doesn't give me real assurance that's still happening or that you continued to do it for nine months. Right. There's no practical evidence that you are actually doing what you say you're doing. Does that make sense?
36:10
Speaker A: Yeah, it's like Gartner Magic quadrant. We sent in the upper right hand quadrant of Gartner. Roger quadrant. At a certain period of time when they printed this piece of paper.
36:19
Speaker B: And I think there was a time where this was a super helpful framework and all those things. But the times are shifting. So much so that having more up to date, potentially even live data, is a bit more helpful than just kind of the. The past playbooks. And the way that we've done SOC2 and the way that we've done.
36:40
Speaker A: I think you mentioned a term which I think should be entered into the dictionary of IT terms, compliance theatrics. Can you speak about compliance theatrics for a moment?
36:50
Speaker B: So there's like the theatrics of showing. Like there's a level of showing. Right. I'm acting. We are pretending that we are compliant in every way because we are checking the boxes. But what is the purpose of compliance? The point of compliance is to reduce risk. How do we reduce the risk? By securing. Right. All of the compliance pieces are part of our security measures. We're doing the compliance stuff so that we can be secure, so that we can reduce risk and create trust with our partners we work with, create trust with our patients. This is really the cybersecurity as a business enhancer. Right here is the. We're creating a more secure environment that's not just acting like we're more secure. We're actively doing it and we're carrying like, we have to do the compliance thing. We have to get the certification or the attestation or whatever it is. We've got to do that because our partners are asking for it. We need the piece of paper that says we're doing it. But ultimately it's more important that our security program is actually being secure. Right. So it's one thing to be like, look, I'm high trust R2 certified. Look how cool we are. That's great. But what does your security program look like? I mean, that framework in particular is pretty robust, so it probably looks pretty good. But like, if we're just focused on checking the boxes and not creating a program, then we're not being a business enabler. We're not continually creating the trust with our patients. We're not preventing downtime. Breaches are downtime. It costs money. Not just money in ransomware or lawsuits or whatever it is, but it's also downtime and revenue. From just an operational standpoint, if we're preventing that downtime, we're protecting the business. We're protecting patient care. We're increasing partner and payer trust right within our organizations where we can speed up innovations through more clear guardrails. Right. With the compliance frameworks and stuff, we've got clear guard rails. But we understand what we're doing from a security perspective where we know we're secure. We want to bring AI into the infrastructure. We know exactly where our data sits, we know exactly what we're doing, we know exactly what our security program looks like. Sure, let's bring AI in right here and let it sit right here and then we'll continue to. You see what I'm saying? Like, it starts to speed up certain innovation processes where we're not having to backpedal and go, well, let me make sure that all of this stuff is secure before we go. We do this one thing. No, no, no, we've already got that on lock. Let's go. Let's do this.
39:41
Speaker A: What is the ask from innovation standpoint? What are the general asks that you guess on a daily basis? I would also love to know who's going to the compliance theater to begin with. Like, who's causing the compliance theater? Is it vendors or is it executives that just need to say that we're in compliant? Like, that's kind of interesting. Just this idea of compliance theater. Like, who wants to go to the compliance theater anyways? But, like, who doesn't want to just actually be secure? So there's gotta be someone out there that's just like into acting.
40:09
Speaker B: Right?
40:10
Speaker A: Acting across compliance versus the actual fun of really digging in and being secure. Because otherwise security is really not that fun. I think it would be pretty boring that it was just theatrics all the time. It'd be pretty lame. So that's why I'm wondering who goes to the compliance theater to begin with. But aside from that, what kind of innovative asks are you getting in your role right now?
40:31
Speaker B: Yeah, right now it's mostly data. Type of asks, like, I mean, AI was one. Can we integrate AI do all these things with AI? Ultimately, the answer is not really, but here's what we can do with automation.
40:47
Speaker A: What are you thinking you're going to do? Like, from an it, like, what's your organization's kind of like mission to begin with? And how is technology going to support that mission?
40:56
Speaker B: So we integrate behavioral health into primary care doctor's offices. Okay, so ultimately, what that does quite a few different things. One, our model, it's called the CLCM model, this is our care model, has been tested against A bunch of other care models. And we are producing the best results from a care perspective. So our patients are receiving the best care. So that's one good thing. Two, it integrates behavioral health into primary care doctor's offices. So think about it from this perspective. You want to get some mental health help, Right. Most of the time you have to go find a doctor. You date them. You go back and forth. Do I like this guy? Let me try this one out. You have all that. Well, you already have a primary care doctor that you've done that with. Right. So now I can go see my primary care doctor. I trust him, I know him. He's got a therapist in his office that our model shares what we go through in our sessions there with the primary care doctor. So the primary care doctor now sees the full picture, not just your physical side, but also the mental health side. Right. So he's got the full picture happening there. The other benefit is he's your primary care doctor. Now your regular old insurance covers mental health because he's the primary care. The mental health is in your primary care practice.
42:24
Speaker A: The other benefit, you've integrated in there.
42:26
Speaker B: Correct, Correct. And the other side to this is over medication. Under medication. Right. We are a highly medicated society and a lot of that has come from primary care doctors over prescribing things or under prescribing things because they aren't the experts in that particular field, but they have patients that need help that come to them for help. And so what this also helps is reduce the over prescribing of medication or even the under prescribing in some scenarios of medication so that we can come alongside the primary care doctors and give the patient the best care that we could possibly give.
43:03
Speaker A: Are you guys placing providers in the doctor's office also?
43:08
Speaker B: Yeah. So we're basically like a staffing company. That's probably a good way to think of it. Okay, so we hire the therapists and then we send them to the providers. So we partner with large health organizations and we send our therapists to go into their primary care doctor's offices.
43:26
Speaker A: Okay, totally makes sense. And I'm just wondering. So obviously this goes hand in hand with technology, and I have no clue how much you guys outsource as far as finding people or what technology you have your hands on, but I would imagine that there's a lot to be done there as far as matching up providers. Well. Or what's your growth model?
43:44
Speaker B: Yeah, so we're kind of working through that right now. We just finished our series B funding. We partnered with Goldman Sachs as our new venture capitalist partner and brought in a good chunk of change to help us grow. Part of that is really kind of honing in on our sales strategy. And I think this year our focus is going to be kind of expanding within the markets that we're in currently. And then how do we also get into new markets so that we can expand into new states, things like that? We're in five states right now. So how does technology come alongside and help the sales process? I mean, I have my own thoughts about that, but we are in the middle of discussing that right now. Right. Salesforce, all those different technological tools, how does all that stuff come into play?
44:35
Speaker A: What's the basic sales model? Is it like, hey, go to a doctor's office, how do we get in? Or I mean, how do. Obviously not doctor's office or care or other care facilities.
44:44
Speaker B: Is it.
44:45
Speaker A: Do we want to place more staff members inside other primary care facilities?
44:50
Speaker B: Is that like, the goal? Potentially, We've kind of exhausted a lot of that, especially in Arizona, where we're headquartered in quite a few of our states. We've kind of hit the max capacity. But the interesting telehealth.
45:03
Speaker A: Any telehealth stuff,
45:06
Speaker B: I believe that we're looking into some of that. But their model is we want to be, like, in person for as we possibly can be. We do help telehealth on our EBH side. So EBH is the psychiatric practice that we have. So we have evolved MD and then EBH is the psychiatric side. So we do a bit more telehealth on that side. We're. We're growing that business right now. So we're expanding all of that, figuring all of the pieces out there. So we're getting there.
45:40
Speaker A: I would imagine you would definitely be able to find more behavioral health therapists with unique backgrounds and experience. From a telehealth standpoint. Even though there's a benefit to, yes, we want to be in person, but maybe if there's some real specialty case or something like that. I was just thinking off the top of my head.
45:58
Speaker B: Yeah, no, I think that's a good thought.
46:01
Speaker A: I know nothing about your business. I'm only pretending this is. After talking for five minutes, I just wanted to see how we're integrating technology and how is technology leadership brought to the table for these strategic growth conversations. Obviously know about your VC stuff and everything. So you're not a gnome hiding underneath the stairs that they call to unlock the port 57 on our second floor.
46:22
Speaker B: Yeah. Yeah. A lot I want to know is because I ask a lot of questions. Because I want to know because I want to understand the company's strategy and the goals, and I want to understand the business that I'm in. Right. I think that's kind of a key piece for any IT leader is like,
46:44
Speaker A: otherwise you're going to have crazy people coming in and trying to sell them wild stuff that you have to bolt on.
46:48
Speaker B: Well, and. And that's. We have experienced that to a degree
46:52
Speaker A: where I. I can see it now. I can see someone be like, yeah, Salesforce. Like you mentioned Salesforce. And I'm thinking in the me. The first thing I thought in my head was like, well, I think Salesforce is gonna be out of business in three years once AI catches on and everyone's building their own CRM. But.
47:05
Speaker B: Well, and that's the thing. You just have Claude build our own CRM and we're good to go. Like.
47:10
Speaker A: But then we're sticky. No, I know it. We can't leave the MSP then. No, we've come full circle now. We built our own stuff. They cannot leave us.
47:19
Speaker B: That's a really good point because this is kind of a key thing that I see as a problem in my current role and even in other roles that I've had, like this redundant tech where we've got one application that does one thing, but we actually have 10 applications that do one thing because this department didn't want to use that one and this department wanted to use a different one and all. And you don't have. When you don't have like the governance to first of all, keep track of all that and then secondly, lay down the foundation. Like, is this approved by IT Security? Great. Is this approved by the business side? Does this make sense from a business perspective for us to have two tools that do the same? No, that doesn't make sense. We don't want to pay for tool tools that do the same thing. You can either not have your tool or you can learn how to use this tool. Right. And so creating those governance layers within the organization, it takes time because it's a culture shift. At the end of the day, it's people are not.
48:26
Speaker A: Look, we use WhatsApp. The other people use Slack, the other person uses the Zoom Chat thing. This person used teams and we use the Mitel Chat thing. That still works on our soft phone. See, we need to unify. Oh, and we just merged with five other companies that have 16 different other systems.
48:46
Speaker B: Exactly, exactly. So as they call it the shadow. It is real now we got shadow AI too. Cs Shadow AI, which is also real.
48:55
Speaker A: Yeah. Well, this has been a pleasure and I'll give you the last word. If there was one thing that you wanted the executives in healthcare to hear, what would that be?
49:05
Speaker B: Uh, it doesn't just fix computers. Cybersecurity is not just an IT problem anymore. Right. It is a core business function that makes sense. And when we have a breach and we get sued because this data was exposed and all that kind of stuff, they're not coming after me. Right. They're coming after the company. That makes sense. And that's why we ultimately have a responsibility as a company. I mean, even other organizations out there that are auditing these things and all that kind of stuff, they're looking at. Who on your executive leadership team are involved in making decisions about cybersecurity? Who is looking at the risk? That's not you as, as a cybersecurity leader. What executive is actually giving the go ahead on, yes, we'll allow this risk and no, we won't allow that risk. All of those different things need to be documented and put in place not just as a practice, but an actual, like documented practice. We're not just doing it, saying we're doing it, but we're now showing you that we're doing these things and we're showing you that the executives of the company, every executive, is taking a responsible role in the overall cyber security of the business.
50:31
Speaker A: And if I had something to say too, I. It would be like, do you realize how smart these people have to be to understand and run all this stuff? That's really what I'm thinking also at the same time is you want these people in your corner helping you make the right decisions to grow the business.
50:54
Speaker B: At the end of the day.
50:56
Speaker A: Yeah.
50:57
Speaker B: Cybersecurity affects revenue, bottom line. Operational resilience, patient safety is a huge one. Right. That's trust. Right. Regulatory exposure overall. And brand trust. Right. Our brand is super important. We to us, especially with partners. Right. The brand trust is incredibly important, which ultimately brings the long term enterprise value that we would want to have to actually be more marketable and all those different things.
51:28
Speaker A: Yeah, yeah. If you had a very, very bad cyber security attack, we'd be done.
51:32
Speaker B: Yeah.
51:33
Speaker A: You're like, not only are you going to be down, not only is it going to cost you money, it would definitely affect, definitely affect sales. If you had. And if you had anyone else selling against you at the same time, 100%, not the salespeople should be going out there, hey, didn't you know they got ransomware attack they shouldn't be doing. Sure. That's not the way that sounds. John Stanner, thank you very, very much. You've been heard.
51:58
Speaker B: Cool. Thanks, Phil.