Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 176: Corey White, CEO @ Cyvatar: how to create a compelling cybersecurity product for SMBs

Transcript

176: Corey White, CEO @ Cyvatar: how to create a compelling cybersecurity product for SMBs · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

0:32
SPEAKER_00: We are all in for a real treat on the podcast today when we talk about the SMB cybersecurity market, what it takes to go after that market, what their drivers are, the way they're thinking about it or not thinking about it, all with someone who knows this inside out as you're working in this space for 20 years, and that's Corey White, the CEO and founder at Cybertar.
1:04
SPEAKER_00: Welcome to the Sales Bluebird Podcast, where we help cybersecurity companies grow sales faster.
1:11
SPEAKER_00: Whether you're a seller, marketer, leader, or founder, we give you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or ten about building great cybersecurity companies.
1:23
SPEAKER_00: I am your host, Andrew Monahan.
1:25
SPEAKER_00: Our guest today is Corey White, CEO and founder at Cybertar.
1:30
SPEAKER_00: Corey, welcome to Sales Bluebird.
1:32
SPEAKER_01: Andrew, pleasure to be on.
1:34
SPEAKER_01: Thanks for having me.
1:35
SPEAKER_00: This is great.
1:36
SPEAKER_00: I'm looking forward to this conversation, Corey.
1:38
SPEAKER_00: You are in a super interesting part of the cybersecurity market, tackling it in a unique way.
1:44
SPEAKER_00: So I'm keen to learn all about that.
1:47
SPEAKER_00: And before we get into that though, let's talk about the real Corey White.
1:51
SPEAKER_00: I've got a list of questions here, Corey.
1:53
SPEAKER_00: Why don't you give me three random numbers between one and thirty five, and I'll read out the questions.
1:58
SPEAKER_01: Okay.
1:59
SPEAKER_01: 7, 17, 11.
2:02
SPEAKER_00: I'll do 7, 11, 17 in order.
2:04
SPEAKER_00: 7.
2:05
SPEAKER_00: Favorite action movie.
2:07
SPEAKER_01: Whew.
2:07
SPEAKER_01: Uh favorite action movie.
2:09
SPEAKER_01: Can't say I have a favorite one.
2:11
SPEAKER_01: I will say just because my wife and kids, we watched Indiana Jones over the weekend.
2:14
SPEAKER_01: So reintroducing that to them, uh, they just had a blast.
2:18
SPEAKER_01: They loved it.
2:18
SPEAKER_01: So that's my favorite one now.
2:20
SPEAKER_00: That's such a classic, isn't it?
2:21
SPEAKER_00: I mean, it's just everything you want.
2:23
SPEAKER_00: It's got drama, it's got humor, it's got cliffhangers here and there.
2:27
SPEAKER_00: It's a great movie.
2:28
SPEAKER_00: All right.
2:28
SPEAKER_00: Number 11, his favorite season.
2:31
SPEAKER_01: Uh, I live in Southern California, so there's not many seasons.
2:34
SPEAKER_01: Um season.
2:37
SPEAKER_01: No season.
2:38
SPEAKER_01: Um summer.
2:39
SPEAKER_01: Yeah, because it's mostly summer here.
2:40
SPEAKER_01: Yeah.
2:41
SPEAKER_00: Mostly summer here all year round.
2:43
SPEAKER_00: Yeah, I bet.
2:44
SPEAKER_00: Um, and then 17, tricked out Jeep or German car with all the gadgets?
2:50
SPEAKER_01: Gadgets, I gotta have the gadgets.
2:52
SPEAKER_01: Yeah, for sure.
2:53
SPEAKER_01: I'm a tech guy, so give me the gadgets.
2:55
SPEAKER_00: Yeah, I guess that's right, right?
2:57
SPEAKER_00: Uh why should I not be surprised?
2:59
SPEAKER_00: All right.
2:59
SPEAKER_00: How did you first make money as a kid, Corey?
3:02
SPEAKER_01: Okay.
3:02
SPEAKER_01: First making money as a kid.
3:04
SPEAKER_01: I absolutely hated my dad because he had his own construction company.
3:08
SPEAKER_01: And so uh all the other kids were playing in the neighborhood and scraping shingles off of a roof and you know, doing you know, sheetrock and everything.
3:19
SPEAKER_01: But it taught me a work ethic.
3:21
SPEAKER_01: And now, like anything around the house, I pretty much can do.
3:24
SPEAKER_01: I don't do it now because I'm too busy, but it was really a great foundation just working with my dad.
3:29
SPEAKER_01: I got to spend quality time with him, and so it was the greatest thing ever, even though I hated it at the time.
3:35
SPEAKER_00: And what was your first real job out of college?
3:38
SPEAKER_01: Uh, first real job out of college, it was um August 24th, 1995.
3:45
SPEAKER_01: That's I know that date because that's the date that Windows 95 came out, and I was supporting Windows 95 the day it came out.
3:53
SPEAKER_01: So I get to tell people that that say they're Web3 experts and they're learning Web3.
3:58
SPEAKER_01: I was like, well, I was here the day Web 1 came out, when Internet Export 1.0 and the first operating system when the IP stack came out.
4:07
SPEAKER_01: That was my first job.
4:08
SPEAKER_00: I remember those days as well.
4:09
SPEAKER_00: I remember sitting in my hallway in the house I was renting with a phone line from my laptop, which was very heavy and big, into the socket in the wall, trying to try this thing called the internet at the time.
4:23
SPEAKER_00: And uh, you know, it was slow, it kept dropping, it was a pretty horrible experience.
4:27
SPEAKER_00: But I do distinctly remember that period, just sitting there going, I don't know what to make of this, but I know it's different.
4:33
unknown: Yeah.
4:34
SPEAKER_00: So since then, you've built a career in cybersecurity, you were a security consultant for a long time.
4:40
SPEAKER_00: You you ran the West Coast for Founestone, and then when Funestone came under McAfee, you joined McAfee for a while.
4:46
SPEAKER_00: You spent uh almost seven years at Silence, where you ended up being the chief customer experience officer.
4:52
SPEAKER_00: And three and a half years ago, you founded Cyvatar.
4:56
SPEAKER_00: Do you remember the first customer you ever won, a real customer, not a not a friendly or a trial or whatever, but a real paying customer, your first customer at Cyvatar?
5:05
SPEAKER_01: Oh, absolutely.
5:06
SPEAKER_01: Yeah, and they're still a customer to this day.
5:08
SPEAKER_01: So, yeah, and they fall into two different categories.
5:11
SPEAKER_01: One was actually is interesting enough, that's a great question.
5:14
SPEAKER_01: Our first customer was a customer we did incident response for, and then that they about two months later became our first subscription.
5:23
SPEAKER_01: There is still a subscriber today, and that's almost two and a half years later, where they're they're still with us.
5:29
SPEAKER_01: So that was a huge thing.
5:31
SPEAKER_01: I we don't share customer names, but I'll never get the CISO of this company when I was brainstorming with her.
5:37
SPEAKER_01: I was talking about what I'm building, what Salvatore is going to be about, and to learn how to build a great company, you have to listen.
5:44
SPEAKER_01: And so I literally was surveying all my CISO friends, and she said something that stuck with me.
5:49
SPEAKER_01: She said, Well, Corey, you can come here and do our assessment again.
5:53
SPEAKER_01: We time for our yearly security assessment pen tests, you can come and do that.
5:57
SPEAKER_01: And she said, But we hadn't fixed the shit from last year, but you're welcome to come do it again.
6:01
SPEAKER_01: And I was like, that doesn't make any sense.
6:05
SPEAKER_01: And so here I am, as you just mentioned, I'd been doing, you know, security assessments and penetration testing for you know 23 years at that point.
6:12
SPEAKER_01: Why would most of my companies that I've done the assessments for, they hadn't fixed it.
6:16
SPEAKER_01: Frankly, they got worse over the year.
6:18
SPEAKER_01: Why would I start a company and do the same thing over and over again?
6:21
SPEAKER_01: Yeah, at this point, I wanted to figure out how to fix the problem.
6:25
SPEAKER_01: And so that leads into what we do at Cyvatar.
6:28
SPEAKER_00: So let's say that I am a leader of IT at a 750-person company, and I come across Corey somewhere in my life, and I say, Corey, what does Cyvatar do?
6:39
SPEAKER_00: How would you answer that question?
6:41
SPEAKER_01: Yeah, uh, really simply, we're outsourced cybersecurity as a service.
6:45
SPEAKER_01: So instead of you know leading that 750 employee company and trying to figure out how to do, because you said you're an IT person, not a security person, trying to figure out how to do security and hiring you know a bunch of you know vendors or contractors trying to figure out how to do it, you come to us.
7:01
SPEAKER_01: We are experts at endpoint security, getting them into blocking, not detecting and responding, because I think that is ridiculous.
7:08
SPEAKER_01: This is like saying I want to seek out, I don't want anybody to break into my car, okay?
7:11
SPEAKER_01: But I'm not gonna close and lock my door.
7:13
SPEAKER_01: I'm just gonna get an alert when somebody jumps in the front seat.
7:16
SPEAKER_01: That is detect and respond.
7:18
SPEAKER_01: And then but not even the respond part.
7:20
SPEAKER_01: Then, you know, I gotta go and pull this person out of my seat.
7:23
SPEAKER_01: That is the response of getting out.
7:26
SPEAKER_01: How about me close and lock my door so I don't have to um, you know, get an alert or pull somebody out of my car, right?
7:31
SPEAKER_01: That's cybersecurity.
7:32
SPEAKER_01: And so what we do here at Cybertar is let's fix all the low-hanging fruit, do all the basics for a customer.
7:40
SPEAKER_01: And that's what's game-changing.
7:42
SPEAKER_01: You go to anybody else, they're gonna sell you some crappy products that they don't now install and configure.
7:47
SPEAKER_01: It's not gonna be installed or configured properly.
7:49
SPEAKER_01: We sell best of breed, best of class products that we come in and we install, configure, assess, remediate, and get you to maintenance within 90 days or less.
7:56
SPEAKER_01: And then we maintain a clean environment.
7:58
SPEAKER_00: You know, you made light of the fact of uh leaving your car door open, but it'd be nice to know who's in your front seat, right?
8:04
SPEAKER_00: But blocking is not something that's done easily, right?
8:07
SPEAKER_00: It's over the years, people are very scared to block.
8:10
SPEAKER_00: I think it takes a certain experience, a certain expertise you must have to bring to the table to give people the confidence that uh it's okay to start blocking.
8:19
SPEAKER_01: Yeah, absolutely.
8:21
SPEAKER_01: And it used to blow my mind um back in the day, and I'm dating myself, but I installed some of the first IDS systems, right?
8:28
SPEAKER_01: Intrusion detection systems.
8:29
SPEAKER_01: So when you install intrusion detection systems, then everybody was excited, cool, we can see if somebody's you know getting in or hacking in.
8:36
SPEAKER_01: Then what came next?
8:38
SPEAKER_01: IPS, intrusion prevention systems, right?
8:41
SPEAKER_01: And so with IPSs, nobody used the P part.
8:45
SPEAKER_01: Nobody ever got to prevention.
8:47
SPEAKER_01: I know we were macrophaging together, right?
8:48
SPEAKER_01: And we never did that part, right?
8:50
SPEAKER_01: But we sold it and it sounded like a great thing.
8:53
SPEAKER_01: I think the technology at that time wasn't really there.
8:57
SPEAKER_01: There was a lot of risk to blocking at the time.
9:00
SPEAKER_01: And most people, and here's the other key to it, most people did not want to do the tuning that needed to be done.
9:07
SPEAKER_01: And so you have to do the tuning to actually get into blocking of anything, right?
9:11
SPEAKER_01: You just can't flip the switch.
9:13
SPEAKER_01: Yes, you're gonna have some problems if you just block immediately.
9:16
SPEAKER_01: So there's tuning, there's monitoring, there's a whole process to it.
9:20
SPEAKER_01: And this again ties into my background.
9:22
SPEAKER_01: My background is implementations.
9:23
SPEAKER_01: Back in the day, I was actually pretty damn good at firewall implementations and perimeter of security.
9:27
SPEAKER_01: I wouldn't come in and put in a firewall and try to, you know, deny all immediately, right?
9:34
SPEAKER_01: I would log everything, look at what type of traffic's coming in, figure out what ports, what protocols, and then I would uh slowly allow only the traffic that needs to be in.
9:44
SPEAKER_01: And so it's a process behind it, just like anything else.
9:46
SPEAKER_01: And it goes back to, and again, these are all principles in cybersecurity.
9:50
SPEAKER_01: You know, cybersecurity is a process, it is not a product.
9:53
SPEAKER_01: And so we don't, historically as an industry, we've been trying to make it too easy.
9:58
SPEAKER_01: You actually got to do the work.
9:59
SPEAKER_01: And what I've done over my years is built processes around getting customers to a blocking or a secured state.
10:05
SPEAKER_00: And who is your target market right now?
10:08
SPEAKER_01: We focused on the uh SMB market because when you think about it, a few things angles to it.
10:13
SPEAKER_01: Number one, this is the obvious one that nobody talks about, an SMB cannot afford to get hacked.
10:19
SPEAKER_01: And what I mean by that, they can't afford to just detect and respond.
10:23
SPEAKER_01: A large organization, yeah, they can have a sock and they can detect and respond, they can take it.
10:30
SPEAKER_01: But if an SMB gets hit by, say, a big ransomware, and then their company ends up having to pay the ransom or they can't pay the ransom and then they go out of business, that's hugely, hugely impactful.
10:42
SPEAKER_01: So if they decide, all right, we're gonna only detect and respond, then when people say, Oh, we're gonna detect and respond across our whole SMB, and I say, Oh, so you're okay getting hacked, and you're gonna be, when you get hacked, you're gonna be able to respond to it and clean that up.
10:57
SPEAKER_01: And they're like, No, we're not okay getting hacked.
11:00
SPEAKER_01: I'm like, well, then why are you detecting and responding?
11:02
SPEAKER_01: Yeah, so again, tie it back to whether it be a car or a house, I'm not okay detecting and responding at my house.
11:08
SPEAKER_01: Because I'm not okay with somebody coming into my house where my wife and kids are at.
11:12
SPEAKER_01: Okay?
11:13
SPEAKER_01: So I don't detect and respond at their house.
11:15
SPEAKER_01: I don't know anybody that detects and responds at their house, okay?
11:18
SPEAKER_01: Because I have a ring camera, I have an alarm system, but detecting and responding means my front door is open, my windows are open, everything is open, okay?
11:27
SPEAKER_01: And when somebody comes in, my ring camera is gonna pick it up.
11:30
SPEAKER_01: I got eight cameras around my house, right?
11:32
SPEAKER_01: Okay, um, it's gonna pick it up and my alarm's gonna alert.
11:36
SPEAKER_01: No, it sounds ridiculous when we say it that way, but we do that in our companies.
11:40
SPEAKER_01: SMBs cannot afford that.
11:42
SPEAKER_01: The other piece, which is really important with SMBs, is that SMBs don't have CISOs historically, okay?
11:48
SPEAKER_01: And I don't think they should.
11:50
SPEAKER_01: The minute they spend you know$300,000, whatever its CISO costs, and then that person they gotta go and they gotta hire their team, then they still have to buy the products.
11:59
SPEAKER_01: By the time you do all that, by the time you hire the CISO, you spent more money than you would spend on Cybertar.
12:05
SPEAKER_01: Okay.
12:05
SPEAKER_01: And we're gonna bring in the best of great products, talented people to install, configure, assess, remediate, get you into maintenance in 90 days or less, and then maintain that.
12:13
SPEAKER_01: It just makes sense.
12:14
SPEAKER_00: So for the SMBs you're picking up as customers, you know, they they've done not very much, let's say, for a while.
12:20
SPEAKER_00: What's the driver for them to want to do something different, want to take it more seriously?
12:25
SPEAKER_01: Well, yeah, it's a great question.
12:27
SPEAKER_01: So I kind of watch those drivers pretty closely.
12:29
SPEAKER_01: You know, the world has changed, and one of the big drivers is cybersecurity insurance.
12:34
SPEAKER_01: Okay.
12:34
SPEAKER_01: And when you think about cybersecurity insurance, the cybersecurity insurance vendors, they are not giving out insurance if you don't have the basics in place.
12:43
SPEAKER_01: And then you have to be blocking.
12:45
SPEAKER_01: If you just say, oh, we're just monitoring for alerts, okay, that means you're gonna get hacked.
12:49
SPEAKER_01: And they figured that out.
12:50
SPEAKER_01: And so they need you to have multi-factor authentication.
12:53
SPEAKER_01: They need to have a vulnerability management program, meaning you're scanning, patching, remediating vulnerabilities, not just scanning and getting alerts.
13:00
SPEAKER_01: Hey, Andrew, you got a bunch of vulnerabilities to fix that you're never gonna fix.
13:03
SPEAKER_01: Like, that's ridiculous.
13:05
SPEAKER_01: And so cybersecurity insurance is really driving it.
13:08
SPEAKER_01: And that's what, in my opinion, is gonna change the cybersecurity industry as a whole from this monitoring, detect, and response mentality.
13:15
SPEAKER_01: So that's gonna be a big change here.
13:17
SPEAKER_00: So do they come to you with a sheet of paper saying, I need to do all this because it told me on my policy?
13:23
SPEAKER_00: Is it as simple as that, or is there more to it?
13:25
SPEAKER_01: It's more to it.
13:26
SPEAKER_01: There's a few challenges here, right?
13:28
SPEAKER_01: When the insurance companies or SOC2 compliance, not even PCI 4.0, is requiring continuous cybersecurity, right?
13:37
SPEAKER_01: Um, so all these things are really pushing these small to medium-sized companies to do better.
13:41
SPEAKER_01: And what we're hearing is pretty interesting.
13:43
SPEAKER_01: When I talk to companies and I ask, do you need to be just compliant or do you want to be secure at the same time?
13:50
SPEAKER_01: It used to be literally just three, four years ago, people would say, Oh, we just need to check the box.
13:55
SPEAKER_01: Now they've been educated because of insurance and all the things and all the hacks that are happening out there, that check the box doesn't work.
14:03
SPEAKER_01: Okay.
14:04
SPEAKER_01: And so now they actually want to be compliant and secure at the same time, which that means that you have to go and do the remediation and the continuous remediation and the maintenance of it, which we do.
14:16
SPEAKER_01: So I'm super excited because the world is angling toward our business model.
14:21
SPEAKER_01: And so that's why we grew 500% last year.
14:23
SPEAKER_01: Um so that's why there's so much growth and opportunity for us in this market.
14:27
SPEAKER_00: But I can imagine you know any given SMB is a high-profile attack target for the really sophisticated attackers.
14:35
SPEAKER_00: What is it that's that's driving from that standpoint?
14:37
SPEAKER_01: Yeah, yeah.
14:38
SPEAKER_01: So as you know, I've done a ton of incident response over my career as well.
14:44
SPEAKER_01: So let me break down it's it's two types of incidents in the simple layman's terms.
14:48
SPEAKER_01: One type is nation-state threat actors, okay?
14:51
SPEAKER_01: Nation-state threat actors, they're gonna get in, okay?
14:54
SPEAKER_01: I've dealt with a bunch of them, okay?
14:56
SPEAKER_01: They're gonna eventually get in, but they aren't targeting SMBs, okay?
15:00
SPEAKER_01: Now the second type is a drive-by.
15:03
SPEAKER_01: I want to call it a drive-by hack because think about it.
15:07
SPEAKER_01: If I'm driving down the street, if I look at all the houses in your house, you have your garage up.
15:13
SPEAKER_01: I can see what kind of car you have, what kind of kids' bikes, and all stuff's in the garage, your side gates open, your side window is open as well.
15:20
SPEAKER_01: When it's dark, whose house am I gonna break into?
15:24
SPEAKER_01: Right?
15:24
SPEAKER_01: You know, and so that's the low-hanging fruit.
15:26
SPEAKER_01: You are the low-hanging fruit.
15:27
SPEAKER_01: So it's the drive by hack.
15:28
SPEAKER_01: So when you're being scanned on the internet every two seconds, if you haven't done the latest patches, if you're not using multi-factor authentication, and it's all it's like literally hundreds and hundreds of thousands of phishing emails that come out every single day.
15:42
SPEAKER_01: So if you don't have any controls around that, and you somebody clicks, it downloads malware, and then it executes on that system because you're only detecting and responding, you are screwed.
15:53
SPEAKER_01: You are low-hanging fruit.
15:54
SPEAKER_00: But if let's continue your analogy though, Corey.
15:56
SPEAKER_00: So uh, you know, if I left my windows open and my garage door open, they might not be that impressed with what they see inside.
16:03
SPEAKER_00: They might not want to say, oh yeah, I'm gonna spend a whole ton of time just going after you know a MacBook Pro and a 20-year-old mountain bike, right?
16:11
SPEAKER_00: The guy down the road who's got the 80-inch screen and the the Tesla and uh some$8,000 mountain bike, I'm gonna go after his house.
16:18
SPEAKER_00: So why even spend any time on SMBs?
16:21
SPEAKER_01: Yeah, so it's a few things going on.
16:23
SPEAKER_01: A lot of companies, um, and you know, both of us are sold into large enterprise, a lot of companies, you know, five security security vendors don't target SMBs because they can't make a lot of money off of them.
16:33
SPEAKER_01: And so clearly the products aren't made for SMBs.
16:36
SPEAKER_01: And it's interesting, as we start bringing best of breed products to the SMB market, a lot of the vendors, like their pricing ranges were like, okay, yeah, you're one through 500.
16:46
SPEAKER_01: I saw one was like one through 750, all the same price.
16:49
SPEAKER_01: So if you got 10 employees, you're paying the 500 price, which was ridiculous, right?
16:54
SPEAKER_01: So it's very, very hard to you know target that market.
16:58
SPEAKER_01: And we had to work with those vendors to get that the pricing to where it actually worked for SMBs.
17:03
SPEAKER_01: But here's the deal: when you're outsourcing cybersecurity to an SMB and they got make up a number, they got 50 employees, right?
17:10
SPEAKER_01: But those 50 employees, they need SOC2.
17:13
SPEAKER_01: They need, you know, we get them prepared for, but they need SOC2 and they need cybersecurity insurance, and they say they one of their customers is the DOD, and they maybe see MMC is coming down the road, right?
17:24
SPEAKER_01: So they need enterprise grade cybersecurity.
17:27
SPEAKER_01: They only have 50 employees.
17:29
SPEAKER_01: When it comes to our solutions, we can sell them a full vulnerability management program, we can sell them endpoint protection, multi-factor authentication, IT asset management, email security, incident response management.
17:40
SPEAKER_01: So literally the whole portfolio gets sold to them.
17:43
SPEAKER_01: And so effectively, we have a big deal out of a 50-person company.
17:47
SPEAKER_01: And we are still cheaper than them hiring one to three FCEs.
17:52
SPEAKER_00: Oh, yeah, I can imagine.
17:53
SPEAKER_00: I mean, so you talked there about you know the insurance requirements coming through.
17:57
SPEAKER_00: If they're trying to do business with big companies or the government, there's there's requirements they have to meet for that.
18:02
SPEAKER_00: Where's ransomware come into things for the SMB?
18:05
SPEAKER_00: Is that a driver or not?
18:07
SPEAKER_01: Oh, 100%.
18:08
SPEAKER_01: And I'll give you a couple reasons.
18:10
SPEAKER_01: Number one, I know ransomware is a big driver because when I first started in cybersecurity, nobody, when I say, hey, I do security, they didn't call it cybersecurity, I said I do security.
18:19
SPEAKER_01: And then literally people are like, oh, you're a security guard.
18:22
SPEAKER_01: I'm like, no, what?
18:24
SPEAKER_01: Like internet security or something, right?
18:26
SPEAKER_01: Now when I say I do cybersecurity, people off the street, oh my God, that is so cool.
18:32
SPEAKER_01: And I ask, well, how do you even know what this is?
18:34
SPEAKER_01: And they're like, well, ransomware, all the hackers, oh, it's really gotten cybersecurity to be mainstream.
18:40
SPEAKER_01: And so ransomware, it's estimated every single day.
18:44
SPEAKER_01: There's between 250 to 500 attacks every single day.
18:47
SPEAKER_01: The reason why they don't know the exact number is because nobody reports them.
18:52
SPEAKER_01: People are afraid to report and say that they got hacked.
18:55
SPEAKER_01: They just try to either deal with it on their own or whatever, because they don't want it to be all over the news that they got hacked.
19:01
SPEAKER_01: So that's why you know cybersecurity is a known thing for SMBs.
19:06
SPEAKER_01: They're the easiest, low-hanging fruit because they have no security.
19:10
SPEAKER_01: Literally, one of our early customers they came to us and said, I always knew that we needed cybersecurity.
19:15
SPEAKER_01: I just thought we couldn't afford it.
19:17
SPEAKER_01: And so when they saw how we price it, then they were like, yeah, they signed it really within a couple days.
19:23
SPEAKER_01: So we've made it cost effective as well.
19:26
SPEAKER_01: And that was, again, one of the early challenges to figure out how to do that.
19:29
SPEAKER_00: And and how do you deliver this, Corey, in Cybertar?
19:33
SPEAKER_00: Is it uh managed service?
19:34
SPEAKER_00: Is it reselling or some variation in between?
19:37
SPEAKER_01: Oh yeah, we had to create a new category in cybersecurity.
19:41
SPEAKER_01: What I realized is that I looked at every single kind of model and I'll quickly zoom through them.
19:47
SPEAKER_01: But if I'm an SMB, if I buy a product, even if it's the best product out there, I still got to install and configure and manage it and everything else.
19:53
SPEAKER_01: So buying a product, even if you buy the best one, doesn't get you know secure.
19:57
SPEAKER_01: Then services, if I did a penetration test security assessment, one, you have to still remediate the vulnerabilities, which most companies don't do.
20:04
SPEAKER_01: But then two, every single company that I talk to, they're dynamic.
20:08
SPEAKER_01: They change every single day, especially with cloud infrastructure, and about 50 new vulnerabilities come out every single day.
20:14
SPEAKER_01: So regular services company make no sense at all.
20:17
SPEAKER_01: And then you got the MSSPs, they're doing MDRs, XDRs, and all that.
20:21
SPEAKER_01: So again, we talked about that.
20:23
SPEAKER_01: They're not even trying to stop the attack.
20:24
SPEAKER_01: Then you have VARs, value added resellers, they make their money off of margin.
20:29
SPEAKER_01: So if you know graphicproduct.com says, hey, we're gonna give you 40 points of margin, an amazing product says, hey, we're gonna give you 20, guess which one of our is gonna sell?
20:39
SPEAKER_01: I mean, I get it, right?
20:40
SPEAKER_01: That's how they make the money.
20:42
SPEAKER_01: But that doesn't help the actual customer be secure.
20:45
SPEAKER_01: And then you have the staff shortages and cybersecurity expertise.
20:48
SPEAKER_01: The all those are those are your choices to try to secure yourself.
20:52
SPEAKER_01: So you're not gonna actually be secure in either any one of those boxes.
20:56
SPEAKER_01: So what we had to do is take the best of all of those, create a new category, cybersecurity as a service, to where we're a bit of an MSSP, we're a bit of a services company, we have a platform that automates this and has full reporting.
21:09
SPEAKER_01: So we've taken the best of all those, and we are VAR.
21:12
SPEAKER_01: We are VAR and kind of potentially even staff, you can see us that way.
21:15
SPEAKER_01: But it's all subscription-based, and we've made it really, really simple for um SMBs to go to us and subscribe online.
21:23
SPEAKER_01: They can actually pay online and choose what solutions they need.
21:26
SPEAKER_01: That was the goal.
21:27
SPEAKER_01: We had to create a new category and reinvent the whole cybersecurity industry.
21:32
SPEAKER_00: That's interesting.
21:32
SPEAKER_00: Because I remember back in the day, one of the criticisms of MSSPs was they were good at delivering technology, but they didn't really have the people to back it up, right?
21:41
SPEAKER_00: To your point, if you're doing detection and response, you kind of need to have the people uh and experience to know what they're doing and somehow do that at scale uh for lots and lots of customers at a time.
21:52
SPEAKER_00: It sounds like that's the bit that you've cracked.
21:55
SPEAKER_01: Yeah, yeah, absolutely.
21:56
SPEAKER_01: There's a few things there that are interesting.
21:59
SPEAKER_01: So in cybersecurity, we probably have some egos because I've been going to Black Hat DEF CON for a very long time.
22:07
SPEAKER_01: But my realization is hacking penetration tests doesn't actually get the end customer secure.
22:14
SPEAKER_01: Because if I we go and do even the best pen tests um out there and show them how they would get you know compromised, that S and B doesn't have anybody in-house to go through and fix it.
22:23
SPEAKER_01: They don't understand how to re resolve those issues.
22:26
SPEAKER_01: And if they did have somebody, then they don't have enough time to you know maintain a clean, secure environment.
22:32
SPEAKER_01: On a continuous basis.
22:33
SPEAKER_01: So doing a penetration test actually doesn't help them almost at all.
22:37
SPEAKER_01: Okay.
22:38
SPEAKER_01: But I've been a penetration tester.
22:40
SPEAKER_01: Hacking is fun.
22:42
SPEAKER_01: Okay.
22:42
SPEAKER_01: I've been a malware analyst and looked at malware.
22:45
SPEAKER_01: It's fun.
22:45
SPEAKER_01: And I've been an incident responder.
22:47
SPEAKER_01: It is fun.
22:48
SPEAKER_01: I'll tell you what is not usually fun, and hopefully my team doesn't hear this, is remediation, installing a patch, fixing a vulnerability, right?
22:58
SPEAKER_01: That's not typically fun.
23:00
SPEAKER_01: So we don't have a lot of competition because you know what we're doing is kind of ugly.
23:05
SPEAKER_01: We've made it pretty, we've automated it in a platform, beautiful reporting, where you can kind of click a button and you know remediate a whole customer or all of our customers at once.
23:14
SPEAKER_01: And you know, we've automated all that via API.
23:17
SPEAKER_01: But at the end of the day, you know, historically, it's not fun to be the remediation guy or the patching guy.
23:23
SPEAKER_01: It's not a glorious job.
23:25
SPEAKER_00: So that might be fun for you, Corey, but I'll tell you, fun for me is selling stuff, uh, going and engaging with prospects and understanding what they're trying to achieve and uh going through the process and winning at the end.
23:37
SPEAKER_00: One of the things about targeting SMB, of course, is notoriously hard to do from a direct sales standpoint.
23:43
SPEAKER_00: I'm wondering how you're thinking about your go-to-market team and building out a sales team.
23:47
SPEAKER_01: Yeah, it's an interesting challenge because with SMBs, the challenge is education.
23:52
SPEAKER_01: Because you know, I was talking to one over the weekend that called me up, and I won't say the vendor, but they said, hey, this MSP is trying to install this something antivirus, right?
24:03
SPEAKER_01: That question was, should we use this?
24:05
SPEAKER_01: And I was like, no, that's crap.
24:07
SPEAKER_01: There's no way that you can actually stop the attack.
24:09
SPEAKER_01: You can't get into blocking with it.
24:11
SPEAKER_01: What we would sell you is something that can actually block the malware from executing.
24:15
SPEAKER_01: And the person's like, yeah, that's what we want.
24:17
SPEAKER_01: Why would they try to sell this?
24:19
SPEAKER_01: Well, because that's what they're reselling and that's what gets them their margin, right?
24:23
SPEAKER_01: But it doesn't mean it's the best product out there.
24:26
SPEAKER_01: And so we had to educate them on those gaps.
24:29
SPEAKER_01: And so also the other thing what we educate them on, and literally this is in our sales deck.
24:34
SPEAKER_01: If you look at the Verizon data breach report, the number one way that companies are compromised, and I'll give you the top four that they've broken down, is number one, is customers do not have multi-factor authentication.
24:47
SPEAKER_01: Okay, compromise credentials.
24:49
SPEAKER_01: And it's obvious, right?
24:50
SPEAKER_01: You would think everybody has it today, but that's the number one thing.
24:53
SPEAKER_01: So you would think all the security vendors and everybody we focus on, hey, let's make sure you have these things.
24:58
SPEAKER_01: So multi-factor authentication, phishing is number two, number three is exploiting your vulnerabilities, and number four is botnets malware.
25:06
SPEAKER_01: Okay.
25:06
SPEAKER_01: And so that if I were S and B, I'd be doing those four things.
25:10
SPEAKER_01: I'd do doing preventive controls to stop those four things.
25:13
SPEAKER_01: I mean, that's what Savitar does.
25:15
SPEAKER_01: We focus on stopping those four things, how you would most likely get compromised.
25:18
SPEAKER_01: And all those are methods that are used to eventually get ransomware um installed into a system.
25:24
SPEAKER_01: So we focus on that.
25:25
SPEAKER_01: Once we educate uh ASNB on those things, then they're like, oh, well then why would I go to X vendor?
25:31
SPEAKER_01: They're not going to stop the four things that are going to get us hacked.
25:34
SPEAKER_01: And so then that's how we end up winning.
25:37
SPEAKER_00: So you have to uh hire a sales team and a marketing team that is in the mode of education first.
25:43
SPEAKER_00: And that puts a stress is not the right word, but it puts uh an onus on you to really train them and make sure that they're able to be educators and not just salespeople.
25:52
SPEAKER_01: Yeah.
25:53
SPEAKER_01: You know, then every single uh week, I'm trying to get what's in my head into their heads so that they can have those conversations.
26:00
SPEAKER_01: Like literally later today, you know, I'm with my sales team and we're walking through understanding that education process to customers.
26:08
SPEAKER_01: Because one the more the more that they can educate, then the better.
26:11
SPEAKER_01: Even our marketing, our email blasts, our um, you know, educational.
26:16
SPEAKER_01: We kind of make them funny and interesting, but they're they're educational, and we're taking real-world uh hacks that are happening out there and then putting that in into the context of if you did these basic things, then this would not have happened.
26:29
SPEAKER_01: But the industry, cybersecurity industry isn't selling you these things.
26:33
SPEAKER_01: It's a mismatch, right?
26:35
SPEAKER_00: Well, I think it's uh kind of to your point before, it's not as sexy uh talking about doing the fundamentals well, but it's where the biggest impact's gonna be.
26:43
SPEAKER_01: Yeah.
26:44
SPEAKER_00: Yeah, I can see that.
26:45
SPEAKER_00: And as you're thinking about growing the sales team, uh you think about channels as well.
26:50
SPEAKER_00: You talked about different types of channels, but uh do you want to be 100% direct or do you want to do a channel model as well?
26:56
SPEAKER_01: Well, yeah, I thought about that.
26:58
SPEAKER_01: In my opinion, the channel is antiquated, it is an old model.
27:03
SPEAKER_01: Eventually, I think we'll go away.
27:05
SPEAKER_01: Here's why.
27:05
SPEAKER_01: I mean, back in the day, it was really, really needed because when you needed people to go and install and configure, literally rack and stack these solutions that were sold, and using a channel partner um that was really critical.
27:19
SPEAKER_01: But on top of that, if you're a new company, it would give you a lot more reach out there into you expanding your sales team.
27:25
SPEAKER_01: I totally get that.
27:26
SPEAKER_01: But you know, there are a few challenges with the channel model, meaning that I worked closely with as well as you know, chief customer officer, and it's interesting.
27:33
SPEAKER_01: I at Silence I had insight into what was actually happening.
27:38
SPEAKER_01: So when we would sell the product by itself, then the customer didn't know how to get to a preventative state.
27:46
SPEAKER_01: They didn't know how to go through malware, clean everything up.
27:49
SPEAKER_01: So typically we would sell it product plus the services, and then they would actually get an amazing outcome.
27:55
SPEAKER_01: But then when you do that, then the channel's not happy because they want to do those services.
28:00
SPEAKER_01: But they didn't know how to get to the amazing outcome in most cases.
28:03
SPEAKER_01: And so if you let the channel partner go and implement it, then they would not fully implement it, something would be wrong, and then any customer that bought it, they don't go to that channel partner when they're pissed, they go back to the vendor.
28:16
SPEAKER_01: Okay.
28:17
SPEAKER_01: And so it causes a lot of problems for vendors.
28:20
SPEAKER_01: Number one, they have to go and use the channel for the reach, but then they also still have to have their customers happy.
28:26
SPEAKER_01: So they have to manage that whole process.
28:29
SPEAKER_01: So what we did here at Savitar, because we are a bar, okay?
28:32
SPEAKER_01: So we couldn't go out to another bar to resell us.
28:35
SPEAKER_01: Plus, here's the big thing with SBs your pricing is gonna go up.
28:40
SPEAKER_01: And you just say you gotta pump it up at least 40% to pay for the bar, okay?
28:45
SPEAKER_01: The telepartment, right, that's reselling you.
28:47
SPEAKER_01: So then you just price yourself out of reach for SMB problem, okay?
28:52
SPEAKER_01: So what we did is we built a referral program.
28:56
SPEAKER_01: And the referral program, I wanted to come up with a sexy name for it, and it is anonymous.
29:01
SPEAKER_01: So the people that actually do the referrals in most cases, they're anonymous.
29:04
SPEAKER_01: We don't blast and advertise them or anything like that, but it's called the side hustle, okay?
29:09
SPEAKER_00: Let me just understand this.
29:10
SPEAKER_00: So you've got people who their customers or whatever already, but who doesn't know who they are?
29:16
SPEAKER_00: I don't understand that.
29:17
SPEAKER_01: So some of our um side hustle referral partners, they're pretty well-known CISOs, okay?
29:22
SPEAKER_01: But a lot of people go to CISOs and ask, hey, how do I secure my program?
29:27
SPEAKER_01: Any tips?
29:27
SPEAKER_01: Who should what products should I use?
29:29
SPEAKER_01: And they're like, oh, talk to Savitar.
29:31
SPEAKER_01: Okay.
29:32
SPEAKER_01: And so they get 20%.
29:34
SPEAKER_01: And then some of them are just people off the street.
29:36
SPEAKER_01: We even have some people that are salespeople at other companies that refer over uh people.
29:42
SPEAKER_01: So this it's not in our best interest to go and blast out everybody that you know does referrals.
29:48
SPEAKER_01: And we've got about 150 worldwide and growing.
29:51
SPEAKER_00: Oh, so it's the fact that you don't advertise who these people are, they're they're just friends of the company basically, really like what you're doing and want to see you succeed.
29:59
SPEAKER_00: So they as they get asked questions, whatever, they just say go taught this Corey assignmentar.
30:03
SPEAKER_01: Yeah, or simply, Andrew, they want the 20%.
30:09
SPEAKER_01: So we got one that you know sent us over some early, you know, big deals, and he used it you know on the down payment for his house.
30:16
SPEAKER_01: It's quite lucrative if you look at that 20%.
30:19
SPEAKER_01: But it it's cheaper than me paying a bar 40%.
30:22
SPEAKER_00: Got it, for sure.
30:23
SPEAKER_00: So that's working for you right now.
30:25
SPEAKER_00: What else is working in terms of getting a pipeline for the team?
30:29
SPEAKER_01: What is working is just getting the education out there and leveraging social media quite a bit.
30:35
SPEAKER_01: We leverage that.
30:35
SPEAKER_01: There's not a lot of money to use social media, that's why we love it.
30:38
SPEAKER_01: And so we actually got a lot of responses from even just Facebook ads, believe it or not.
30:44
SPEAKER_01: Because it ends up being that's where some of the SMBs end up being.
30:48
SPEAKER_01: But that that actually has worked really well.
30:50
SPEAKER_01: Um, so with Roll Network, Facebook ads, social media in general, I do a lot of public speaking.
30:57
SPEAKER_01: So speaking and getting the word out, and then so when I travel, I speak.
31:01
SPEAKER_01: That's worked really well.
31:02
SPEAKER_01: So, you know, various things, but it's been trial and error for sure to figure out the best mix.
31:06
SPEAKER_01: But uh I think we got a good go forward, and also we've narrowed down that ICP to uh 1,000 and below and just have been focused on that.
31:14
SPEAKER_00: Well, I love that you're doing the speaking, Corey, because uh, you know, I'll give you my thoughts on this.
31:18
SPEAKER_00: One is, and I don't mean it's blow smoke, but you're very articulate, right?
31:22
SPEAKER_00: You're very when you talk, people listen.
31:24
SPEAKER_00: And part of that is because of who you are, but part of it is because you got the experience and the knowledge to back it up, right?
31:29
SPEAKER_00: But the bit that a lot of people miss, I think, in cybersecurity is you're not afraid to speak your mind.
31:35
SPEAKER_00: Some people will come on or talk about their company and they're they're dodging some of the questions.
31:39
SPEAKER_00: They don't want to offend people and things like that.
31:42
SPEAKER_00: I think these days, you know, you have to do what you're doing.
31:44
SPEAKER_00: You go out there and you'd be very direct.
31:46
SPEAKER_00: You know, this over here is not working for you, and here's why, and it's probably gonna die, right?
31:51
SPEAKER_00: And this other way is the way to go.
31:53
SPEAKER_00: And I really hope the people listening to this take inspiration from how you've engaged in this podcast to say, look, I've got some, I've learned some things along the way, and they're hard truths to talk about, but this is what I believe.
32:05
SPEAKER_00: And I think you'll get a you must get a lot of traction from people who just latch onto that.
32:09
SPEAKER_01: Well, well, thank you for saying that.
32:11
SPEAKER_01: But I gotta say, I learned by failing.
32:14
SPEAKER_01: I've failed at all these things before, right?
32:17
SPEAKER_01: I've done use bars and and and partners, and I've done penetration testing, I've installed IDS, IPS.
32:24
SPEAKER_01: These are all the failures that turns into success.
32:26
SPEAKER_01: What's the lesson from it?
32:27
SPEAKER_01: So that's how I got here.
32:29
SPEAKER_01: And so that's how I can speak so confidently about it because I do know what works because I had to figure out what didn't work first.
32:35
SPEAKER_00: So, Corey, what's the big vision for Cybertar over the next uh two or three years?
32:39
SPEAKER_01: Uh the big vision is really simple.
32:40
SPEAKER_01: If I look at cybersecurity industry and the way we've been doing things, we've been doing it wrong for a very long time.
32:46
SPEAKER_01: Um, so it doesn't make sense.
32:48
SPEAKER_01: Literally, I I when I first started, it was about 4,000 companies in cybersecurity.
32:52
SPEAKER_01: I just heard that we're we're about 6,000 cybersecurity companies.
32:56
SPEAKER_01: So 6,000 cybersecurity companies, about 150 billion invested in and growing of the size of the industry.
33:03
SPEAKER_01: Then on top of that, the number of successful attacks are increasing year over year, uh, about 15%.
33:10
SPEAKER_01: Ransomware, you know, last year grew 25%, 25%.
33:14
SPEAKER_01: Uh it was um most hacks were you know variations, but ultimately ended in ransomware.
33:19
SPEAKER_01: So if there are more companies, there's more being spent in it, but the number of successful attacks are increasing year over year, something's not adding up here, right?
33:31
SPEAKER_00: Something's broken.
33:32
SPEAKER_01: Yeah, something is broken.
33:34
SPEAKER_01: So we have to figure out what is broken, and I feel like Savitar is heading in the right direction and focusing on remediation and actually you know preventing these attacks from happening and getting on the the right side of things.
33:48
SPEAKER_01: And frankly, we need to see more companies you know doing what we're doing.
33:52
SPEAKER_01: This is the future of cybersecurity, which you know I actually own the trademark for that.
33:57
SPEAKER_01: Like we literally are, that's one of my taglines, the future of cybersecurity.
34:00
SPEAKER_01: So we have to head in this direction.
34:03
SPEAKER_01: I'll give one quick analogy, just an insurance analogy.
34:06
SPEAKER_01: I did a talk on this about six months ago, but I researched it and I didn't really think about it.
34:10
SPEAKER_01: But take the auto industry and insurance, right?
34:14
SPEAKER_01: When I was a kid, my mom when I was coming home from the hospital, she was holding me in her arms the whole time.
34:20
SPEAKER_01: She didn't have a seatbelt on, and I was not in the car seat.
34:23
SPEAKER_01: Okay.
34:24
SPEAKER_01: I'm like, oh my God, thank God we were not in an accident.
34:26
SPEAKER_01: Like I would have flown out of the window, it would have been over.
34:28
SPEAKER_01: We wouldn't be having this conversation, right?
34:30
SPEAKER_01: I remember in high school when the third brake light came out and the anti-lock brake started becoming a theme.
34:36
SPEAKER_01: And the seatbelt, when it became law, I remember that, right?
34:40
SPEAKER_01: But it was just a waist belt and not a shoulder strap.
34:43
SPEAKER_01: I mean, all these things are preventative controls.
34:46
SPEAKER_01: And in cybersecurity, which is an immature market, we need more preventative controls in place and focusing on them.
34:53
SPEAKER_01: And that's really where the gap is right now.
34:55
SPEAKER_00: Well, listen, Corey, I would love this conversation today, as always.
34:58
SPEAKER_00: Um, if someone wants to get hold of you to keep the conversation going or talk about uh opportunities to join you on the mission, what's the best way to get in touch with you?
35:07
SPEAKER_01: Yeah, absolutely.
35:08
SPEAKER_01: A couple ways.
35:08
SPEAKER_01: Hit us up at uh cybertar.ai, c y v isn'victor, a t-ar.ai, and you know, you can hit us up there.
35:16
SPEAKER_01: You can sign up for free in our platform.
35:18
SPEAKER_01: One of the things that that I've angled on, and again, these are things I failed at.
35:22
SPEAKER_01: I used to charge people a ton of money for assessments and gap analysis, security policies, and risk analysis.
35:28
SPEAKER_01: Guess what is in our premium?
35:29
SPEAKER_01: Free you know, CIS20 gap analysis, free external scanning, free security policies, free risk analysis tool, all that's for free.
35:39
SPEAKER_01: So we don't charge you anything to tell you what is wrong.
35:42
SPEAKER_01: We charge you to actually fix it and maintain it, okay?
35:45
SPEAKER_01: Because there's no industry, like if I use a car analogy again, like if I take my car to mechanic, I need to get my you know, brakes fixed and a tune-up.
35:52
SPEAKER_01: I don't get a detailed document of how I can do it.
35:55
SPEAKER_01: That's the security security assessment with recommendations, right?
35:57
SPEAKER_01: I don't get a detailed document of it and being charge$10,000.
36:01
SPEAKER_01: No, they actually fix it, right?
36:04
SPEAKER_01: They don't charge to tell me what's wrong.
36:06
SPEAKER_01: They actually fix it.
36:07
SPEAKER_01: So we're backwards as an industry.
36:09
SPEAKER_01: So trying to write us as an industry here.
36:11
SPEAKER_01: And of course, you can hit me up on LinkedIn, uh, you know, Corey D.
36:14
SPEAKER_01: White on LinkedIn.
36:15
SPEAKER_01: Yeah, please reach out.
36:17
SPEAKER_01: I'd love to hear from the audience.
36:18
SPEAKER_00: That's great.
36:19
SPEAKER_00: Well, Corey, thanks a lot for joining me and wish you all the best for this year and into next year.
36:22
SPEAKER_01: Okay.
36:23
SPEAKER_01: Thank you, Andrew.
36:24
SPEAKER_00: Well, that for me is one of my favorite episodes of the year with Corey.
36:28
SPEAKER_00: There's someone who knows his stuff inside out.
36:31
SPEAKER_00: He's been working in cybersecurity for over 20 years, well over 20 years, probably 25 years by now.
36:38
SPEAKER_00: Uh, both a practitioner, a leader, now a CEO and founder.
36:42
SPEAKER_00: He just knows this stuff inside and out.
36:45
SPEAKER_00: And importantly for SMBs, I guess he really understands their challenges and what they're all about and what they really truly need, as opposed to what others in the market and in his mind are delivering for them right now.
36:56
SPEAKER_00: For three takeaways for me, the first one would be uh his statement, SMBs can't afford to be hacked.
37:03
SPEAKER_00: I didn't think about this before, right?
37:05
SPEAKER_00: I was asking him about the other side of it, was why would they be hacked, right?
37:09
SPEAKER_00: But at the end of the day, from their standpoint, is they just can't afford it.
37:12
SPEAKER_00: If something bad happens and you're working with a small IT staff, you probably don't even have security people.
37:18
SPEAKER_00: How do you recover from that?
37:19
SPEAKER_00: You don't have the expertise and you don't want to be dropping hundreds of thousands trying to recover from that.
37:24
SPEAKER_00: So the idea that they need to talk to them about not being able to afford to be hacked, and therefore blocking is so important was a new thing for me that I probably should have known, but but didn't really appreciate until we had the conversation.
37:37
SPEAKER_00: The second thing was the drivers are beyond just security, the SMBs have around meeting insurance requirements, but also meeting the requirements of the big companies that they have to do business with, big companies in government as well.
37:50
SPEAKER_00: There's situations there where they want to get the protection and the liability protection from an insurance provider, but they're giving them things to go and do and they must have in place.
38:00
SPEAKER_00: And then, secondly, you've got companies out there that are getting more and more stringent on the types of vendors and third parties that they want to work with.
38:08
SPEAKER_00: And there's an example where what CyberTar can do is really meet both of those drivers really, really well.
38:15
SPEAKER_00: And my third takeaway was the idea of education.
38:18
SPEAKER_00: I think if you are someone at an SMB and maybe you're in IT, you're somewhat knowledgeable, right?
38:24
SPEAKER_00: You've probably got some security experiences over the years.
38:29
SPEAKER_00: You probably know a little bit about it, but you're not a high-flying expert with deep expertise and different aspects of cybersecurity.
38:35
SPEAKER_00: So you might be too easily dragged from one pillar to another post as you look at the market and see all the messages that are out there about what you need and what you don't need and things like that.
38:46
SPEAKER_00: At the end of the day, sometimes just going back to the fundamentals is what's truly important.
38:50
SPEAKER_00: And I thought it was interesting what Corey was saying about the need for him and his team to always think through you know, how do we educate people on the fundamentals they need to be doing before they get dragged off into the shiny object syndrome that our industry is plagued by?
39:04
SPEAKER_00: So those were three takeaways from me.
39:06
SPEAKER_00: I'm sure you got your own ones, but uh, for me that was a treat to talk to Corey again, hear what he's up to with Cyvatar, and I truly wish him and the team all the best there for the rest of this year into 2023.
39:17
SPEAKER_00: Talk to you next time.