Latest / Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance / From Upwork to 100-Person Consultancy: How Subscriptions Fueled Growth | Taylor Hersom

Transcript

From Upwork to 100-Person Consultancy: How Subscriptions Fueled Growth | Taylor Hersom · Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

• 0:00
  Dejan Kosutic: Welcome to Secure and Simple Podcast. In this podcast, we demystify cybersecurity governance compliance with various standards and regulations and other topics that are of interest for consultants, CISOs and other cybersecurity professionals. Hello. I'm Dejan Kosutic, the CEO at Advisera and the host of Secure and Simple Podcast. Today, my guest is Taylor Hersom, and he he was the founder and CEO of Eden Data Consultancy company that provides compliance services including SOC two, ISO 27,001, CMMC, and others. And his consultancy actually turned out to be a very big success. So it's... In 2025, a company called River Own purchased Eden from Taylor, and Taylor is now a managing director at River Own. So in today's podcast, you'll learn what are the main trends and business models in consulting industry and how the things are changing because of AI.
• 0:56
  So welcome to the show, Taylor.
• 0:58
  Taylor Hersom: Thank you so much for having me. Awesome intro. I appreciate it so much.
• 1:02
  Dejan Kosutic: Great to have you here. So tell me, how actually did this work out for you? So you started working on Upwork, right? This is a job site for people that don't know. So how did you actually move from Upwork as a freelancer to, let's say, a successful consultancy?
• 1:20
  Taylor Hersom: Yeah, I never had started a company on my bingo card. I've always been a wantrepreneur, but never had done anything that I started. And then I got into Eden Data kind of out of necessity. I was a chief security officer for a consulting firm, and I quit my job, had these interviews lined up thinking I was on top of the world. And then, that was the week before COVID hit.
• 1:46
  And so I had just proposed to my now wife. We had bought a house. All these things had happened. And, all my interviews, they all said, Hey, we're not hiring right now. The world has gone upside down.
• 1:56
  And so I panicked a little bit and I started doing a little research and I found upwork.com. And on Upwork, there were all these companies posting saying, Hey, I need help with SOC two, or I need help filling out this security questionnaire, or any number of things. And so I gamified Upwork a little bit to where I was doing the easy jobs for cheap and then asking for five star reviews. And then I was slowly able to start raising my rates and actually testing our subscription model, which still gets used to this day at Eden Data. And it just became a huge success.
• 2:30
  Upwork took off. I had too many clients. I couldn't manage them. So I had to Google how to start an LLC and started Eden Data in 2021.
• 2:39
  Dejan Kosutic: So, you saying that this... Okay, there were obviously a couple of success factors for your business, but are you saying that this subscription based model is, let's say, at the center of your success?
• 2:52
  Taylor Hersom: I would say it played a pivotal role for sure. I did it initially, like between us girls out of laziness. I was thinking that I didn't know too much about how to track time and material effectively, especially when I started scaling my team. And so I said, Well, how can I get some reassurance and some predictability in my revenue? Let me test out the subscription model.
• 3:15
  And so what I would do on Upwork, if you're familiar with the platform, allows you to put in a project rate or it allows you to put in an hourly rate. It does not give you any other option. And so I would put in this really high hourly rate, but then I would put in the notes, Hey, just ping me. I have a subscription offering, which allows you to have more predictability the monthly retainer. And what was crazy is I didn't know if anyone would bite and everybody was going for that.
• 3:41
  So it became very popular to do a subscription knowing that the services that I was offering typically went indefinite. I would also use it in a, I would bid on a project, do an hourly rate and then convince them through my work, Hey, I have a subscription retainer. Let me stick around and just continue to manage this for you.
• 4:00
  Dejan Kosutic: Okay. And if I understood well, basically the same principle. I mean, this subscription model is still active today, right? In your current, let's say, work. So essentially, you didn't change the model, so to say.
• 4:12
  Taylor Hersom: Right. So we have expanded the model for sure. And we do projects now, but the subscription model is far and above our most lucrative, for lack of a better term, model. And it was one of the things that attracted buyers too. So that's an important note to make.
• 4:30
  Dejan Kosutic: Okay. Now, how does this work with the subscription based model, right? I mean, most consultancies are used to charge per hour or let's say per job or something like that, but how does this work when you have this kind of a subscription?
• 4:44
  Taylor Hersom: Yeah, so the way that I worked on this was there's things that in the security space that you add value by actively doing. So that's the actual work. That's the building the policies, writing the controls, getting through the audit. And then there's also the benefit that is passive. And what that means is a lot of these companies, especially early stage software companies, they need an appointed CISO, they need an appointed compliance officer, they need someone that can answer questionnaires on command.
• 5:14
  And so I played with the value proposition quite a bit, And I also calculated out what my average range of hours would be on a given customer each month. And that's how I used Upwork as my test bed and was able to kind of backtrack into a rate that would make sense for various customers. As we have expanded, we've certainly refined that much better. And it's still principally the same of how many hours are we putting towards this and also what is passive benefit that we're bringing by just being there. But we have, a little bit more, data points that we're using to be able to come up with a rate.
• 5:54
  And the last thing I'll say is I also... On Upwork, it was inherently a lot of software companies, and the software industry is very much trained on subscription model. And so I literally just copied websites and said, okay, this software company, Jira, has three packages. I'm gonna put three packages on my website. And it just accidentally worked out.
• 6:17
  Dejan Kosutic: Okay. And I just wonder, so basically, let's say that the company wants to implement ISO 27,001. So, do you typically include all the consulting work into it, like, you know, writing policies, procedures, doing the risk assessments, don't know, training people, leading them through the whole project, preparation before certification? Do you include all of these things or some things are still excluded from the package?
• 6:40
  Taylor Hersom: All of that is included. So the way that we would scope it is say, what is your mission? Are you trying to get through an audit? Are you trying to derisk your company? Is it something else?
• 6:50
  And then we would define that as our North Star. And I would calculate out how long that will take, how many hours, that sort of thing, and come up with a rate accordingly. The beauty of it is is you use ISO 27,001 as an example. Compliance is very much a loop and not a line, meaning that you are building it, then you're implementing it, you are getting through the audit, and then that process restarts. So ISO has a three year cycle, but there's always something you need to do every single year, including getting through the audit.
• 7:20
  One of the things I accidentally got right is saying, where are the pain points for a customer? And one of them is just talking to auditors. Nobody likes to talk to freaking auditors. So I said, let's just take that off your plate and let's manage that process in its entirety. And you can be kind of involved in as little as much as you want, Mr.
• 7:40
  And Mrs. Customer. And that was a really big value add value proposition for the customer.
• 7:46
  Dejan Kosutic: Okay. But is typically out of the scope of your service? So, you do what not want to do for a customer?
• 7:57
  Taylor Hersom: This is great this is certainly a learning lesson that I had over the years is I initially started by making the proposal pretty broad. So I'd say, I'll take over all of your compliance and I'll take over all your security as VC. And I'd charge accordingly. Basically, I'd have a cheaper package if it was just compliance and I'd have a more expensive package if it was security and compliance. The issue that you just pointed to is that there are definitely things that I certainly don't wanna do or that take too much time.
• 8:26
  And unfortunately, thankfully, a lot of customers just kind of took our service at face value and didn't really try to test the bounds of it too much. Usually, the requests were simple, but we certainly had our fair share of customers that would ask for all these crazy things that took a long time. Security questionnaires, that's one example. I used to say, We'll just do all your security questionnaires. Well, that's great if you're a customer that gets one or two a month.
• 8:51
  But the first time we signed one that was getting 20 a month, I realized that I had screwed up. And so now as we've expanded, we certainly put in the scope of work, we get very detailed with our scope of work because it takes me less effort to do that than it will down the line of trying to ask for more money or getting fired by a customer because we're not doing what they expect. And so our scope of work, thankfully, because of the customer bases we serve and because of the nature of security and compliance, a lot of it is 80% the same from a high level point of view. And then you only have to customize that remaining 20%. Some don't get security questionnaires.
• 9:30
  It depends on who you're selling to. Some want SOC two, some want ISO. Also expanded out to I think we've now touched about 55 different frameworks since inception. So we help customers with all sorts of frameworks that go beyond just SOC two and ISO.
• 9:44
  Dejan Kosutic: That's really a great range of standards that you're covering. Okay, now why do you think that this kind of an offering appeals to customers? Why do you think that you have such a great success?
• 9:58
  Taylor Hersom: It's a few reasons. And of course, I'm incredibly biased, but we do get customer feedback and I've really refined it as we've gone. But it's a few reasons. One, the security industry is pretty burned out, right? As a security professional or a compliance professional, it's a high stakes position, and you also are always fighting for budget.
• 10:19
  You're always looked at as a cost center. People get really burned out comparative to other industries. And so with that comes turnover. You're always getting your security people poached. There's an incredible shortage of cybersecurity professionals.
• 10:32
  With a vendor, they'll always take your money. So there's consistency in our service that we're always going to be there. We have customers today that I signed back on Upwork. And so, five years later, it's pretty incredible to see that kind of loyalty. So, that's one reason.
• 10:48
  I would say that the other is a peace of mind, like just having someone that is responsible for security and compliance. Oftentimes, this falls on leadership. This falls on the IT person. This falls on somebody that is not hired to do compliance or security, especially with early stage companies. And so, being able to take that off their plate, being able to do it well, we've never had a qualified audit, we've never had a failed audit, we've had a tremendous success run with that.
• 11:15
  I think that those are the two biggest levers that we've been able to pull that make our service sticky.
• 11:21
  Dejan Kosutic: Yeah, but I would say that all of the things that you mentioned is basically our VCSO service, right? To basically hire someone to be, let's say, a fractional fractional CISO CISO or or VCSO and handle security, know, handle security through outsourcing. But I mean, it's not, let's say, something that distinguishes you. So at least from my point of view, because what I see is that you have this consultancy part, meaning where you initially implement a standard that you put that part under subscription, which is not very common, right? So, I would like to understand, you know, why do you think that customers would prefer this kind of, let's say, approach from a consultant?
• 12:04
  I understand, you know, later when they get certified that they want to hire a CISO and pay a certain, let's say, don't know, plat B for, I don't know, per But in the initial stage, when they need to hire a consultant to actually do the job, why do you think that this subscription model is attractive?
• 12:24
  Taylor Hersom: Yeah, it's a solid question. There's a few reasons beyond what I had stated that I think make it attractive. And one of them is the predictability. So, you have predictability with a full time employee, but the problem is if you try to go hire a CISO, you are typically either A, if you're going for a VC, so you're getting variable rates. It's unpredictable.
• 12:45
  You don't know how many hours they're gonna charge. You can put a cap, but typically the average VC so is doing a lot of strategy work and not so much hands on keyboard. And then the second issue is just that the... If you're going and hiring a full time CISO, they're incredibly expensive and not to mention benefits and all the complexities that come with having full time staff. So I think that's an attractive element.
• 13:08
  The other thing is, and I failed to mention this before, I realize I'm kind of sharing the secret sauce, but it's not secret because it's on our website. I don't know why more companies don't do this, but we have sold our service not as your VC, so we sell it as your external security team, your external compliance team. We give that team mentality, and that's important for a couple reasons. One is that oftentimes when you hire a consultant, it's very much a bench of someone that you're talking to. They're siloed.
• 13:36
  That's the only person you interact with. And secondly, when that person goes out on vacation or they quit or whatever happens, then you're kind of left high and dry. And so we really combated that early on by building it out to where every customer actually interacts with multiple people on our team. We have multiple team members at different levels, including your VC, so including compliance. And I think that that's quite attractive to the average clientele that doesn't necessarily see security as a full time position.
• 14:07
  Dejan Kosutic: Okay. I mean, it makes sense. And understand I you fully the argument that you're making, I can understand that this is really attractive, but how come, I mean, that other consultancies are not doing this? There may be, I don't know, 1% of consultants in total that are, you know, going this way, but you know, why so little?
• 14:26
  Taylor Hersom: It blows my mind that the subscription model hasn't become more attractive. I have theories, but I certainly don't have all the answers. I think one of them is people get intimidated by it. They don't know how to make their margin and to have consistent margin with the subscription rate. It's much easier for charging an hourly or a project and capping your hours and all of those things.
• 14:48
  I think that it's intimidating. So that's one big reason. And then secondly, think that people, honestly, they try to look at what everybody else is doing and then do that. And if the one thing I got right with Eden Data was I try to look at what everyone else is doing. I came from Deloitte, for example, and I try to look at Deloitte and see what they did well and then see what they not did well.
• 15:11
  And for those things that they did not do well, I try to do the polar opposite. So if, unfortunately, the Eden Data domain no longer exists, but we had, you go look at the average consulting firm and it's like blues and grays and whites and a guy in a business suit holding a digital globe or something cheesy like that. And the branding and marketing was all the same. We had neon, we had bright pink, bright We went all out with our marketing to make it look like an attractive tech company. We even used phrases like, I bought the domain for guardyourprivates.com, and we would do swag that had guard your privates and things like that, like just getting creative.
• 15:50
  Kind of a long winded way of answering your simple question, which is people like to go with the norm and they're afraid to defy the norm. Think that that plays a large role in why people are intimidated by dipping their toes in the subscription waters.
• 16:05
  Dejan Kosutic: Okay. But, you know, having experience with this subscription based model, is it... Would you say that the whole consulting industry should turn towards subscription based charges or is subscription based model only applicable for certain kinds of services or for certain kinds of clients, let's say?
• 16:27
  Taylor Hersom: I certainly don't think that it's going to solve everything. Is it the right service for... Or is it the right pricing model for every service? I don't think so. I think that what is going to go away largely is time and materials.
• 16:42
  And I think that what will happen instead is that it's going to be things like subscription and it's going to be things like project. So, this is going to cost a $100,000. Here's your range of hours. We'll have it done by this month. Like that kind of thing is still going to be very pertinent because you still have customers coming to you that have a specific task.
• 17:05
  My subscription rate, that's being sold to customers that think they need services indefinitely. And one of the important delineations to make is that we were only doing three month minimum subscriptions. And the reason for that is I was very confident that, Hey, you're gonna need me at month four, at month twenty. And so I rather sell you on value rather than trap you in a contract. I think that that model is gonna continue to work.
• 17:30
  And then I also think that there's gonna be a time and a place for a project.
• 17:34
  Dejan Kosutic: So basically, if I understood well, the main criteria when choosing subscription based or let's say project based is how long the client will need you, right? If this is closer to longer than a subscription based actually works better, right?
• 17:50
  Taylor Hersom: Exactly. Yeah. As long as there are things that you're doing that add value for the customer every month. And I know that statement seems obvious, but I didn't get this right in the beginning. I would do a lot of the work upfront and we'd get them through SOC two.
• 18:04
  And then we're sitting there twiddling our thumbs for a few months and really the customer would realize quickly, hey, y'all aren't really doing anything, I don't think I need you. You have to really be strategic about the services that you're offering and how you're offering them over the course of a twelve month period, let's say. And in my particular case, compliance is indefinite and you have to keep doing it and you should also keep expanding. So when these new regulations come out and these new standards, we're the first ones to educate our customers on why they need it. That also helped.
• 18:32
  Dejan Kosutic: Okay, makes sense. Makes sense. Yeah. Okay, if understood well in your subscription model, you basically have the monthly rate, which is exactly the same on the first month or I don't know on the fiftieth month. So basically it's always the same, right?
• 18:47
  The same monthly rate throughout the, let's say, period, correct?
• 18:52
  Taylor Hersom: As long as the scope doesn't change. So if it's you hired me to do SOC two readiness and management, it's always going to be the same. We do adjust year over year for inflation, but otherwise it's largely the same rate. But if you want to add ISO 27,001 or you suddenly need to expand into Europe and need to add GDPR, those then we revisit the scope and we adjust the numbers accordingly.
• 19:18
  Dejan Kosutic: Okay, understood. Now the question is, I assume that when you start working with the clients, I assume that in the first, let's say, two or three or four months, you have the biggest effort that you have to invest into a client, right? Because you have to write the documents, have to train the client and so on and so forth. So... But you said that the client can also cancel the subscription after three months, if I understood well.
• 19:43
  Taylor Hersom: Absolutely.
• 19:43
  Dejan Kosutic: So are you then in the risk in this first three months where you actually have to work the most and basic, I assume that actually this flat monthly fee doesn't actually cover your costs.
• 19:55
  Taylor Hersom: So those are great questions. To touch those in order, you are absolutely right that we put a lot of effort into the first few months. Not only is it the work itself, it's also learning the customer environment. What we focused on and obsessed about is how can we deliver so much value and customer service experience? Those two things are very different, and I think that they get consolidated a lot.
• 20:19
  How can we make sure that those are, we knocked it out of the park so that the customer wants to keep us around? The other thing that we are confident in is that the way that we build our security program, we were not trying to be the bargain bin offering. We were building comprehensive security programs. We want to make sure that someone is staying secure online and passing their audits. And so because of that, it inherently creates a lot of work for ongoing maintenance.
• 20:45
  And so we knew that the average customer wasn't gonna wanna do that. But in terms of the cancellation process, we absolutely were taking that risk on in the front end. I certainly don't think that the solution is necessarily like, I think it worked for us, but it certainly stressed me out along the way because you are creating this environment that someone could take advantage in the front end and get rid of you on the back end. We factored that in. But to answer your last point, I also factored in to make sure we were profitable from day one.
• 21:22
  I mean, we were a bootstrapped company. To make sure I was the sole founder. And so it was coming out of my pocket. It was my liability on the line. And so I wanted to make sure we were making money from month one and building a model that allowed for that.
• 21:38
  Dejan Kosutic: Okay. Now, once you start to scale this whole model, because I assume you scale it quite a lot since you sell the company. Now, once you start to scale, I assume that you have to hire lots of, I don't know, consultants, you have to train them and so on. So, which kind of problems did you see when you started to scale?
• 22:02
  Taylor Hersom: Oh, goodness. How long do we have here? No, I'm just kidding. There were quite a few problems as we continue to scale. One of them was naturally as a small business going to a large business for perspective.
• 22:17
  Went, we were 2021 is when we started, we sold in 2025. We scaled almost 100 people by that time and it was all bootstrapped along the way. And it was that that creates problems that inherently don't exist at the early stages. One of those problems is things like just building a culture and HR and making sure you're passing, like that you're adhering to HR laws and all of those sorts of things. I was managing that.
• 22:42
  That was really hard to scale with and it required new tooling. It required me to hire for HR. Those are things I never dreamed of when I started eating. The other thing was how do you track utilization and make sure that you're profitable per employee? It was easy when it was my time and that of a few people on the team and we just kind of had a sort of like a profit sharing model.
• 23:08
  It quickly got out of hand to where we had to build a very comprehensive framework to be able to not only serve our customers, track our margins, but also be able to adapt in the security world, which is very agile and you have new frameworks popping up, you have new requests from customers. How do we keep up with all of that? That was really hard. Building trainings, building a framework and being able to go sell something and know that I can deliver it. It was easy when it was just me and my dog.
• 23:40
  But as we continued to scale, it was much harder to keep up with. So those are just a few of the areas. The list goes on and on, but those were areas that stood out in my mind.
• 23:51
  Dejan Kosutic: Yeah. Mean, certainly, but where did you source the people? I mean, how did you get so many, I would say, high quality people, consultants that work for you?
• 24:02
  Taylor Hersom: This is gonna sound so obvious and cheesy, but the culture is what did it. So it was a snowball effect. Got lucky in the beginning of hiring a few great people. I hired folks that I worked with at Deloitte. I had people from my network that just naturally I was able to bring in.
• 24:21
  And I certainly didn't get it right every time, but I had some pretty critical folks out of the gates that I had a good feeling about. And because I had built a profitable company, I knew exactly like how many contracts I needed to sell to be able to afford the next person and the next person and the next person. So with that, it then became a snowball effect. I obsessed over treating my employees as well as my clients. And so if we had a client that was a jerk, we'd fire them.
• 24:48
  That was giving away money, that was a hard thing to do, but it was so worth it. If we had a toxic employee, we fired them. We focused on like the way that I tracked utilization was just revenue per head count. And so I was able to see, okay, Bob Smith makes this amount of money for the company and this is how much he costs. As long as those things look right, then I'm not gonna say, Bob Smith, you need to tell me how you spend every hour.
• 25:16
  I didn't have people tracking hour by hour. I had them broken down by customer and revenue. And so things like that, I think really went a long way. And then the last thing would be just making a brand that's exciting. I obsessed over social media.
• 25:31
  I obsessed over partnerships. We were trying to get our name out there. We had the neon everywhere. We just tried to make it cool and hip. Those are probably the same word, the same thing.
• 25:42
  But that's kind of a few of the areas that I just think worked well.
• 25:46
  Dejan Kosutic: Great. It's very interesting. Yeah.
• 25:49
  Okay. You mentioned this KPI of what revenue per employee. Did you use use? I mean, what were your other KPIs that were the most important?
• 25:59
  Taylor Hersom: Yeah, so customer satisfaction was one of them. We had a process to where I was personally checking in with customers every single month and then taking that feedback and applying that to basically the success or failure of the individual employee. And then we we were tracking our traditional gross margin, EBITDA, all of that fun stuff. But beyond that, like as it relates to the customer, we had our costs figured out because most of your cost is just your headcount. And so I didn't have a big software cost.
• 26:31
  We were using Asana. We were using a couple of project management tools. But beyond that, was like, how much is your Google Workspace license cost? And so I didn't have to get overly complicated with it. The only other thing I would track is basically with that revenue per head count, I knew how to bonus my people based on how much revenue they were bringing in.
• 26:50
  So that was really helpful to see. If you had someone that was just really crushing it, then I was able to reward with, I guess it's easy as the founder to basically put all that money back in your own pocket, but I chose not to do that. I wasn't taking money out of the company. I just focused on how do I build something great and the money came. So those are just a few areas.
• 27:14
  Dejan Kosutic: Okay, great. Okay, let's switch a little bit to AI. And obviously, is changing a lot and it's changing, especially consulting. So, how do you see that consulting business will change? Actually, will it exist anymore in the next, let's say, five to ten years?
• 27:33
  Taylor Hersom: I certainly think it'll exist. I'll take that backwards. I know there's a lot of fear mongering going on in the AI space, and I do think that there are certain fields of study that are going to be severely impacted. I am of the camp that there are going to be new roles created, and I can give some examples from the security space. With security, I think that a SOC analyst, someone that's at a security operations center and they're monitoring for alerts coming in, think that position's a little dead in the water.
• 28:05
  However, there is now this new type of role that is being created, which is how can I build an AI driven SOC center? How can I build the processes to be able to effectively have a SOC that is plugged into all of my source systems and be able to monitor those accordingly, make sure that my LLM is not doing false positives or false negatives? That's just one example of many. And so I do think that AI is gonna disrupt every single consulting field there is, but I don't think it's gonna replace every single consulting field that there is. I believe that it is going to put a bigger emphasis on value over time, value instead of time.
• 28:50
  And so what I mean by that is we talked about time and materials already. That is kind of incentivizing you to take as long as possible because you need to make certain amount of money. And customers are starting to see through that, and they want to be able to see value instead. So if you can deliver a tremendous amount of value, they're willing to pay for that value, right? And that's why you have AI firms right now that are coming in and just telling customers how to use AI more effectively.
• 29:16
  And they're making money hand over fist. They are charging exorbitant rates and it's because it's hot and it's sought after and it's hard to find that talent. So AI is, I think, going to largely kill that time and materials model. And I think it's also going to require consulting firms to be incentivized to figure out ways to deliver value beyond just man hours. And that's the last point I'll make, which is I I believe that companies...
• 29:43
  We're already seeing it on our end. Companies are putting pressure on their vendors to figure out how to use AI to be more effective without charging more money. And that is going to continue to expand. And the thing that's getting kinda crazy is that even a year ago, not everybody was really keeping up with AI, even in the business world. Now, a lot of people know enough to be dangerous, including the customer that you're selling to.
• 30:09
  They may not have it all figured out and know the best LLMs and whatnot, but they know capabilities. And so there's gonna be more pressure. There's more customers that are generating. They're saying, Oh, I just got this quote from Eden Data. Let me put it in ChatGPT and see if there are any issues with it.
• 30:23
  Like, you now have a legal review on your side. It's kind of wild, but those are a few of the areas that are disrupting consulting.
• 30:32
  Dejan Kosutic: I mean, like you mentioned, this example also with, I don't know, security questionnaires, right? You can resolve this now very easily through AI. But my question here is really, if you're a founder of a consultancy, how do you actually know what part of, let's say, service is bringing in the most value? So to focus on that and which parts of your consultants simply, I mean, parts of your consultancy business does not make sense anymore because of AI. So how to recognize, you know, what will bring in more value, meaning what will be more, let's say, interesting for our customers versus something that AI can take over?
• 31:14
  Taylor Hersom: This is gonna seem like maybe a fairly obvious answer, but I've known this for years and I still struggle with doing it. And it's asking for feedback from your customers, going and having live interactions with your customers and figuring out what is it that's causing the most pain and suffering for them in your domain of focus. So for security, going and meeting with people that you have already been serving, I would start with your tenured customers. This is not trying to go and find that new customers and sell them on something that you're not doing today. It's talking to the customers that you already have a relationship with and asking them candidly about your service, about the things that they're working on that are causing a lot of pain and suffering.
• 31:55
  Because that pain and suffering, there's always gonna be an opportunity to solve for that. That's not going away. People's jobs are actively changing because of AI, and it's creating new problems and obstacles for them. Those are things that you can be solving. So consulting is such a wide term and this will really depend on the domain that you have an expertise in, but there's a lot of information out there in terms of pain areas that you can solve.
• 32:22
  And so I would start there. And then the other thing is just understanding that a lot of the strategy work today, like how do I, I'll take a rudimentary example. There's a control in SOC two that's user access review. You gotta do user access review. A customer doesn't need to pay me hundreds of dollars to help them understand what that control means.
• 32:44
  They can copy that control and put it in ChatGPT, and they can get a very comprehensive review on that. So suddenly, that strategic knowledge that I've had for years that used to be valuable, not really valuable anymore. So how do I shift that to something like, how can I create an automation for that control using AI to reduce the amount of man hours that go to it? So that's just a random example.
• 33:09
  Dejan Kosutic: Well, definitely, I agree with you. I mean, many consultants will probably go in this direction of helping clients on how to use AI to automate things, even in security or compliance domain. I also see another, let's say, opportunity for consultants and this is really change management, Because this is essentially about people. How do you explain to employees in the company that they have to change something? Have to change their processor or whatever.
• 33:36
  So this is something that a machine will not be able to do. This is really a human work. That's part of business transformation is also, I think, a big, big opportunity out there.
• 33:47
  Taylor Hersom: Absolutely.
• 33:49
  Dejan Kosutic: Okay. With this view of, let's say, future of AIs, what do you think? How should consultants educate themselves? So what kind of capabilities do they need to build for this future world with AI?
• 34:08
  Taylor Hersom: This is one thing I love about the current state of the world is when, like even back when I was in college, everything had to be, Hey, you got to go to college to learn anything meaningful. Now we have this great thing called YouTube University and beyond where you can figure out a tremendous amount of things about security, compliance, and AI. But for AI, it's particularly important because there are no courses in college on this topic.
• 34:36
  Look at how many LLM versions that just ChatGPT, that OpenAI has released thus far. It is rapidly changing. So the best information is nerdy professionals helping nerdy professionals. And so I think that the first thing to focus on is taking your domain, whatever you specialize and going and learning about AI as it relates to that field. That's going to give those kind of moments where you can figure out where people are needing help, where you can add efficiencies in your business.
• 35:10
  Another thing is the strategy of what I did when starting Eden still rings true, which is Upwork was a fantastic resource for understanding exactly what a company needs. Companies are going on there and they're posting their exact needs, their exact problems, and some of them are describing it in great detail. Like that is such a great test study. And Upwork is just one of many of those kinds of freelancer websites. So I would encourage folks to shine their flashlight there as well.
• 35:39
  The last thing I'll say is that talk to your employees. If you're at the point where you have staff, talk to them about their day to day functions. And the reason for that is two reasons. One, identifying efficiencies that you can create. And then two, identifying pain points that your employees are going through that makes their job, I guess for lack of a better term, more miserable and see if you can solve those with AI.
• 36:03
  And you would be so surprised if you were solving some of the problems that your employees are either sharing or not sharing without being pressed on it, then you are creating a better culture, you're making a better experience for your employees and you're encouraging tenure. So those are some areas that I would certainly focus on.
• 36:23
  Dejan Kosutic: Okay, great. Okay, so to wrap it up for today, so are there any other, let's say, things that you think founders of consultancies or CEOs of consultancies should focus on beyond what you already mentioned?
• 36:37
  Taylor Hersom: Yes. One area that has really come up a lot, I get the great honor of being able to talk to founders and give advice and such these days. And one thing that I keep seeing is that someone went to college for something or they started their career in something. And so they say, Okay, well, that's my skill set. So I'm going to go sell that.
• 36:57
  And the problem is that probably what you learned and what you became good at is no longer needed as much as it was back then. And so you got these consultants that are going and spinning up firms where they're offering a service that nobody wants. So let's start by making sure that the service that you are offering is what the customer needs. And in my particular case, when I started going on Upwork, like I came from Deloitte and a consulting firm that was working with commercial and enterprise clients. And on Upwork, it was very much startups.
• 37:31
  It was software companies. It was VC backed instead of bootstrapped. It was that not public, know, those types of things. Frankly, I didn't have a lot of the skill sets needed. I had the baseline that I had learned from my years at Deloitte, but I was in IT audit in Deloitte.
• 37:46
  I was auditing healthcare companies on the West Coast. And so, I had to kind of teach myself the skills of building SOC two and CMMC and all these random things that came up. So I encourage people to take that information and use it as an encouraging point, which is that you don't have to have it all figured out. You just need to figure out what the problem is and then backtrack into how to solve it. So that would be the number one piece of advice I would give.
• 38:12
  Dejan Kosutic: Okay, great. So thank you for this insights, Taylor. It's been a pleasure talking to you today.
• 38:18
  Taylor Hersom: Thank you so much for letting me nerd out on a topic that I love. And congrats to everything that you've accomplished. I appreciate this platform so much.
• 38:27
  Dejan Kosutic: Yeah, great. Thanks again, Taylor. And thank you everyone for listening or watching this podcast and see you again in two weeks time in our new episode of Secure and Simple Podcast. Thanks for making it this far in today's episode of Secure and Simple Podcast. Here's some useful info for consultants and other professionals who do cybersecurity governance and compliance for a living.
• 38:49
  On Advisera website, can check out various tools that can help your business. For example, Conformio software enables you to streamline and scale ISO 27,001 implementation and maintenance for your clients. White label documentation toolkits for NIS2, DORA, ISO 27,001 and other ISO standards enable you to create all the required documents for your clients. Accredited Lead auditor and Lead implementer courses for various standards and frameworks enable you to show your expertise to potential clients. And a learning management system called Company Training Academy with numerous videos for NIS2, DORA, ISO 27,001 and other frameworks enable you to organize training and awareness programs for your clients workforce.
• 39:37
  Check out the links in the description below for more information. If you like this podcast please give it a thumbs up, it helps us with better ranking and I would also appreciate if you share it with your colleagues. That's it for today, stay safe!