Video: How Omega Systems Puts The Security In MSSP

hey Channel insiders welcome back to channel Insider partner POV I'm your host Katie boso and today I'm joined by Mike Ferman CEO of Omega systems a managed security services provider based out of Pennsylvania USA Mike began leading the company in 2023 with the goal of Shifting Omega from a traditional MSP model to mssp model he explains how this has helped the company stand out and what criteria must be met to truly earn that extra s welcome Mike great to have you thank you Katie it's a pleasure to be here today thank you thank you so much I know that you right now I believe are in the Carolina so it's probably a little bit warmer where you are compared to where I am in Massachusetts right now it is it's sunny and warmer her but it's I think it's cold everywhere up and down the east coast today I'm very excited that I could have you in today and that you weren't snowed out of the interview uh but I'd love to get started by getting to know you Mike as well as Omega systems so first of all tell me about Omega systems I'd love to know how you began you have a really interesting story from your founding you yourself are more of a recent ad uh so I have a lot of questions around just the history of Omega systems as well as your coming onto it talk to me about that sure it's a great story honestly Omega systems was started by a husband and wife team in eastern Pennsylvania back in in the early 2000s like a lot of msps that have grown over the years really started as a more of a Professional Services type uh orientation coming in Consulting on a maybe a build out of a network environment or a server cluster and then reselling the the the hardware and the software that went with it and then providing a little bit of maintenance services but kind of one time in nature and then over over the decade that that followed the founding of the company uh the the company grew or completely organically and began to transition away from onetime project and resale into what we now know as the standard MSP model of recurring Revenue Services Managed IT services managed security um manage compliance Etc and so headquarters today remains uh outside of Reading Pennsylvania and in the eastern part of the state but over the period of last five years in particular we've done four add-on Acquisitions and so we've really grown the company now inorganically and organically uh to where we have uh right around 200 employees now uh in varying parts of the country we have clients across 30 plus states in the United States we have offices in six locations all throughout the Northeast from Massachusetts down to to New Jersey Pennsylvania of course New York Connecticut and really have grown to focus our solution sets on those clients who are in what we would consider consider are highly regulated environments in particular two end markets one around Financial Services a heavy concentration of our uh of our end clients are registered investment advisory firms hedge funds family offices inside the financial services sector and then Healthcare we're seeing a lot of interest and and rise and and um need inside uh varying levels of of call submarkets inside the healthcare vertical as well so those are our top two uh verticals but in general um any firm that is finding themselves in a highly regulated environment could be industrial manufacturing for instance um is a perfect Target for us and where we tend to focus our our attention nowadays some of your leadership team have been there since the beginning they've grown with the company I know your chief officer of operations has been there since 2005 growing with the company so you're talking about people that have been there for a long time and are very invested you yourself have a very rich background in this industry many many years with Cisco you have leadership experience in the sea level and other companies as well 30 uh 30 decades 30 years feels like it feels like it sometimes I'm sure uh but for you why choose to come over to the side of the the managed Services practices what was the the real get for you as far as wanting to join Omega and what opportunities did you see there when the door opened what made you go this is interesting for me it's a a great question because my career path is not straightforward in any way um I don't think I'm terribly unique in that regard but I did I had a wonderful career uh at Cisco 17 years I was I was there uh in varying levels of responsibility all in the network security business group there but I realized in my last few years there in tenure at Cisco that I really had a passion for wanting to run an organization and and wanted you know aspired to be a CEO one day and I was the kind of the joke in the in the family and around Frances I was pretty sure I wasn't going to become the CEO of Cisco so I knew I needed to you take a step in a different direction move to a smaller environment where I could get more leadership experience on the functions that I didn't have as much exposure and responsibility to inside a big company like Cisco where I was really focused on the R&D component and didn't have near as much go to market or uh Financial or HR type of uh background and experience so from Cisco it led me to a Data Center and manage services company called Flex Central which is headquartered in Charlotte North Carolina which is where we live today that's what brought us to the Carolinas and there uh I became the Chief Operating Officer over uh all of our what we call cloud of manage services a very large business where we were hosting private Cloud infrastructure um across the country in fact we had data centers globally that we were hosting infrastructure and and then we were wrapping a set of managed Services very very similar to what an MSP like Omega does and so that experience there gave me the um the options then to look at opportunities like Omega and when that opportunity opened up for me in the in the summer of 2023 I got really excited about it because here was a company that had been built really really well over a couple different decades um great job by the husband and wife who built the foundation of that uh that company over the first couple of decades then they brought on a partner in fingon Partners which was our first private Equity partner that came on in 2021 they then helped us do that add-on strategy I mentioned earlier where we added on four companies in the last four years and it became a uh it became clear to me when I looked at the opportunity to come to Omega that um the MSP Market is very large we estimate there's over a 100,000 msps like Omega in the United States alone probably north of 400,000 globally um and so you have a very very fragmented Market but also a high growth market and when you have those two combinations together um that is right for consolidation in the market and consolidation in a healthy way I saw a huge opportunity to come to Omega and Lead Omega through a high growth High consolidation sort of Market that we expect to see in the next five to to 10 years and that presents a very exciting challenge because so much of my time at Cisco was focused on going out and doing m&a I was part of or ultim timately the executive responsible for over 13 Acquisitions that we did varying sizes from tuck in Acquisitions of five to seven people all the way to billion dollar companies that you know had hundreds of people um attached to them and so I didn't plan it this way but it was almost like all that experience that I had between Flex Central and Cisco prepared me perfectly for the role and the journey ahead for us here at Omega it's a great fit I love to hear that always good to hear how happy you are when you make that decision and you land you are now not to mention the exciting opportunities that you saw going in as far as what attracted you to be a part of Omega but the ones where you said these could be tweet updated and so forth something that you did that was a big priority for you coming in was to really lead the charge in transitioning from an MSP only model to an mssp at Omega for those who don't know MSP managed services provider mssb managed security services provider with that said Mike why was that important for you where was the priority in that for you and what was that transition like did it take a while or did you feel you had the building blocks in place to make that happen you're well you're right Katie that it was a number one priority for me to to Really amplify our abilities in the security space and lucky for me when I got here that Foundation had already been built Omega was already providing what we call Smart secure uh which you could consider to be sort of a baseline SEC managed security offering more around managed firewall managed intrusion prevention devices managed endpoints but much more from a configuration management firmware and software updates so keeping keeping the lights on which sounds nominal but it's an extremely critical function from a security posture perspective but there was an opportunity to do something next level which really starts to separate your traditional MSP where you can become legitimately uh entitled to say you're an mssp as well and that's around what we would term manage detection response and building a true 24x7 security operations center where we've got people we call you know eyes on glass where we have we have people around the clock watching our systems for events that tell us that there's uh an active exploitation underway in one of our customers networks and not just being able to detect and report on that but to be to be able to roll up your sleeves and actually investigate side by side with the client bring on their their cyber insurance company um as a part of U the investigation remediation of the attack and work jointly between the three of us to isolate contain and ultimately remediate and attack and that's kind of Next Level from an MSP perspective and it really starts to to differentiate um you know I talked about 100,000 plus of us out there you start getting into a much much smaller group of companies in our space that can legitimately claim to be msps and msps at the same time now you did mention to me when we first spoke that you're now winning deals solely for being an mssp that it is the the fastest growing part of your portfolio can you talk to me a little bit more about why that has stood out so so quickly I'd love to be able to kind of round out and give a real example of why it's something that you've seen is so sought after by your Market segment well I mentioned earlier that our our primary focus is on highly regulated end markets so these are Financial Services healthc care uh regulated Industrials um legal firms Etc and and there is and has been an ongoing phenomenon in all of these and markets where the the Regulatory Compliance standards um continue to be increasingly complex and more difficult to understand and and obtain and and retain your certification on an annual basis and these customers need help they need help understanding what it is they need to do not just and and they're transitioning from a point in time where they just wanted to check a box to be tall enough to ride the compliance ride so to speak and now they're realizing that the compliance standards are there for a real purpose and that's to protect themselves as a company and their end customers as well and so they're interested in making sure they can connect the dots between why they're doing something and how it impacts their business and their end customers and they need help understanding and connecting those dots from somebody like Omega that's all by itself is enough reason to to to want them to invest more in security and need help from Omega but then you have the increasing um threat uh that's out there um it used to be even just three to five years ago you could legitimately as a small medium business which is our primary focus uh in terms of you know we're in that 50 to 500 sort of user range is kind of our ideal profile for a customer many of those customers could kind of stick their head in the sand a couple years ago and say I'm not a Target I don't need to worry about this I'm just going to do the bare minimum I'm going to buy the firewalls I'm going to pay somebody like Omega to manage those on a 24x7 basis and I'm good I don't need to worry too much more about it that has radically changed in the last three years where nobody is is free to to you know to to take a a pass on the on the threat exposure and to be a target from a ransomware attack they're realizing that they need to do more than just the basic what we call Smart secure that's foundational and then you need to add on to it that manage detection and response capability and so you're seeing this this this combination of need uh really amplify between the the hurdles and complexities of the compliance requirements our customers are under combined with the with the rising threat um that is a real threat to their business and their customers really makes the demand there like it hasn't been in the past and that's what's allowing us to to create opportunities with our customers on the kind of I call it going in the security door versus coming in the Managed IT door and it used to be be that as an MSP you had to win your business coming through that Managed IT door first you get you know management of the servers and the network and the and the and and the um the uh endpoints uh laptops Etc you win that trust and respect to the customer and then you get to to have the privilege of getting some of their or all of their security business now you're coming you're able to come in with a more advanced capability like Omega and you basically can be that mssp even if they already have another MSS or MSP inside um you can come in that security door and the ability for you then to create trust and credibility is is like no other when you when you're keeping the keys to the you know to the security Kingdom if you will on that and we're finding that we can enter in that security door and then win the rest of the Managed IT business quite easily once we establish ourselves as a trusted security servic provider in there as well I'd like to talk a little bit more about compliance as you mentioned another big priority for Omega and I've noticed more and more across the industry compliance becoming much more hand inhand with cyber security as like it's not an either or anymore you have to absolutely do it knowing that you're in regulated Industries I imagine that that wasn't too difficult of a conversation to have but generally in the shift across the industry how are you seeing that people are are taking it more seriously on the customer side talk to me a bit more about the shift and how that's being accepted right and I alluded to this a little bit earlier in that there's the Mind shift that's happening with our customers from compliance being a check the box uh you know oh my gosh 3 months from now I've gotta you know I've got to be across the other line of my annual certification so I better get started it sort of was like doing your taxes you know like oh my gosh like you go to have it done by April 15th it was sort of that that mindset and customers in the conversations now are realizing that this is a 24x7 thing for them on on you know an ongoing basis versus just a a one time a year sort of event that they've got to ramp up for and then come back down to and that's where smart comply from Omega is a perfect fit that's that's been AIT a little bit of an educational effort over the last 12 to 18 months but it's becoming more understood and and and accepted now that this is a recruiting Revenue Service that where we come in and we establish a baseline of your compliance um capabilities against the standards whatever they may be for you if you're in healthcare or legal or financial services and then on a continuous basis we are we are scanning the uh the devices for for data that connects to certain compliance requirements and making sure that on a day in and day out basis you are maintaining that posture for uh for meeting or exceeding your compliance hurdles and then when that annual date comes it's just another day so because you've been doing it on a regular basis every day and that is a that is a Monumental shift from even just 24 months ago in the way many of our customers looked at compliance like they get it now they understand that this is something that um that they have to invest in on a regular basis and they're looking for providers like Omega who have built a solution like our smart compli solution that that fits that 24 by7 you know 365 day a year Viewpoint it's also so much less stressful to be able to know that a it's a system in place to make sure you're attacking this every day or every week on a regular basis to make sure you're doing what you need to be doing so like like when you said that time comes it's not like taxes where you go oh where's all of my receipts ever uh it's also good to know as far as where you're able to build in a solution that makes it easy on them because you're right it isn't something that they can focus on the businesses that you're serving have their own jobs to do and their own businesses to run and they need to rely on you to say what exactly do you need from us and how can we make this easy on you one of the benefits of engaging with an MSP like like Omega in this is that you as a customer do this once a year for your particular business and you know you know what works and what doesn't we're doing it for hundreds or thousands of customers and and so we have the ability to aggregate all the lessons learned and best practices that we see happening be able to sit in a consultative way with our customers to help them be better at what they do uh in preparation and ongoing you know work to maintain and exceed their compliance standards and that's a that's a huge benefit that people don't necessarily recognize until you go through an engagement with with a service provider like Omega I want to turn back to the title of mssp because I have noticed in my conversations with other managed service providers even ones that I would probably categorize as an mssp but they say no we Outsource our sock to a vendor like sofos so we're not taking on that title which I think is incredibly Noble because there is a low barrier to entry or a bar to meet it's very non-descript have you noticed that in the industry where you're you're meeting people who are calling themselves msps and in your whether out loud or in your head you're going I wouldn't categorize you as that and just talk to me a little bit about that level of confusion that you've seen and and your thoughts on how it's affecting the industry as a whole it's a really good point you bring up Katie and there's definitely let's call a blurring of the lines in the industry right now every MSP no matter how you know what size they are in terms of capability set or customer base um knows that they need to show up and provide security capabilities for their customers and so if you think about it the last thing you're going to do is a smaller MSP is is just bow out of that you're going to you're going to do what you can to to participate in that and because you want to stay relevant from the Managed IT component and so thankfully for them there are there are different products vendors out there that will allow you to resell their sock capabilities their detection and response and investigative capabilities through to to your end customers and so um folks in the security space have really done a good job packaging up these call them pass through service capabilities that the smaller msps can sell effectively to their customers and that can be confusing for for the End customer because we get in front of the customer and we all advertise uh a lot of the same capabilities we're 24 by7 we have a sock you know we do we do um threat mitigation we can do investigation for you right Mr customer we you know we do all these things and and if you're not an educated enough customer you're not going to be able to know to ask the questions well do you have your own Security operation Center how many people do you have in your stock is it staff 24x7 where are those resources located do you have cissps on your staff for example how many do you have how many uh investigations have you done in the last 12 months how many uh you know how many times have you worked with a cyber insurance carrier in in the investigation and Remediation of attack and if you don't know enough to ask these questions as a as a buyer you're going to be at risk quite honestly because you're going to buy based upon you know what's on the outside versus what's on the inside um and so we definitely have you know a division where there's um there's a set of msps who who are out marketing themselves as security service providers and they do deliver security services but they're not delivering it themselves with their own people uh it may not be 24 by7 may not be State Side resources which can be important for customers in a highly regulated End Market uh and so we do have to go through an education process with our customers to explain why we're different how we're different and and to help them know the right questions to to question in front of other vendors that might be talking to I appreciate that a lot in speaking to the to the clients specifically on that and the questions that you would put out there for them to ask on that note are there any other questions that you would tell customers to ask right off the bat you want to know whether it's being delivered by that vendor's people or not that's the very first most important question you want to know who is it exactly that's watching and reacting to the events is it is it your people Mr or Mrs MSP then you you you want to understand the credibility and capabilities of the staff that you're you're hiring we focus so much on the technology in this space and probably to a fault uh msps will Market too much sometimes the underlying technology that they're using customers will be attracted by the you know the shiny object of which vendor which platform you're using and we often forget it this is a very human capital based work that we do and so as a customer making sure you understand what the capabilities and credibilities and you know credentials are of the people you're hiring especially for your your crown jewels securing your environment is really important so understanding not just how many people and where they're located but what certifications do they have uh cissps on staff I think is very important you don't have to have 20 of them U but you should have at least one or two on your staff um and you should have experience that you can point to where you've actually done an active investigation of a real attack with a customer and ideally have worked with a cyber insurance provider during that investigation work because when the actual event happens it's it's too late to go figure all these things out you need to know that in the middle of the night when something goes bump that you've got the right you know not just underlying technology capability powering the service but the right people that you've chosen I know that you love case studies uh that's important for you to differentiate yourself as a business to show like hey these are real people who utilize us can you share a success story with me in which Omega systems was able to help a customer either be more secure or just generally be able to get business done better I sure can we uh in fact on our on our website today we have a wonderful case study that we did with triple A of Pennsylvania I think there's 27 clubs they call them across the United States the tripa of Pennsylvania is one of the top 10 clubs in the US very large footprint and people don't realize it it's more than just Roadside Assistance or helping get directions to where you're going you they do a lot of financial services for their for their end customers they uh they provide Insurance products for their customers and so they fall under that highly regulated in Market category you know that we tend to focus on they've been a customer with us since 2021 uh they had a change of leadership um come in um with new CIO named Hector Lopez uh who I've had a chance to meet in person he and his team are wonderful they realized that they were only using us for uh kind of ad hoc uh it support it really wasn't a full-time managed Services capability and in the ensuing time together they've quite honestly bought just about everything from us uh because we've built such a a great relationship uh where uh you know they trust us and and we enjoy working with them it's one of those true kind of win-win moments uh between a vendor and a and a an End customer where you build that partnership that we all talk about a lot but you don't necessarily always see as much of it in reality we've been able to work with them on their compliance offering with smart comply we've recently installed and and um rolled out smart guard our manage detection and response capability and triaa Pennsylvania is an interesting case study for us as well and that that's a co-managed environment which you you start to see as you as you get to be a bigger MSP and and and um start to work with bigger customers they're not always looking just to Outsource absolutely everything to a third party like Omega they are looking for somebody to come in and truly be a partner where they do some and we do the rest and we have a a way in which we we can hand off tickets back and forth and have a seamless kind of endtoend um methodology to where their customers and their internal employees don't see you know the fact that there's two pieces coming together every day uh to to provide effective it management and Security Management for the for the Enterprise and so we're real thrilled to to have them as a as a long-standing customer and uh and and really excited that Hector sat down and did a great case study for us that you can find on the website we're we're really excited about that relationship the proliferation of AI knowing that you work with regulated Industries who are all also human beings probably poking at this new technology going what can we do with it shiny new object how has that impacted your business and the way that you're advising your clients right now are you telling them stay away or are you making exceptions how does that look it's a great question and it's all over the news of course every day you can't you can't miss it for the vast majority of our customers AI is still in its infancy and should be still in its infan infancy uh for them in terms of adoption in their Enterprise we are uh our approach with our customers is first to be our own guinea pig inside Omega and so um Ben turch our our coo and Rick mutzel our manager of technology are sort of leading the charge right now to assess and Implement AI capabilities to to the internal Omega capabilities we're running co-pilot for example inside our environment um we are looking at various AI related tools to help us be better at our ticket uh responses in terms of speed to response accuracy of response for our customers self-service capabilities that AI can produce for tickets we might have to get a human to engage with a customer we can now do through Ai and so our approach always is to um is to be learning on our own and then taking those learnings and then sitting down with with customers and Advising them on what they can and maybe shouldn't do um with the technology co-pilot's a great example of that most of our customers have started to play around I think that was the word you use or poke around with it and if they're not careful they may not realize that a lot of these implementations are sending data very sensitive data off to a third party Cloud that may or may not um be in line with your security and compliance standards inside the company and so we're right now in a major education mode to for customers to understand how important AI can be for their business but how important it has to be for them to maintain strict compliance uh standards and so helping them in a consultative way sit down and and understand what they're trying to do with AI and then share our lessons learned from being the the guinea pigs first to make it you know work in a way that's good for their business outcomes but doesn't violate any of their security compliance regulations that they have to keep up you talked about being the guinea pig and talked about Lessons Learned uh and obviously we know that AI when you're putting things into a large language model it's taken that data everywhere so you have to be careful but you talk about those Lessons Learned are there any tips that you would tell people just in general across the board whether they're using co-pilot whether they're using chat gbt something like that is there anything they can do to stay safe any tips that you would give them to just be aware of how they're using these these AI tools they really need to you know step back and understand what data they're feeding the the the large language models and where that data is going that's probably the most obvious part that I think people are beginning to understand but then there's that next question that we we are always coaching our customers with is and make sure you understand what your employees can do with the with the analysis that the AI tool is creating because whatever you feed it will be part of a response that it spits back out to a user and so you don't want like an hourly employee in the mail room being able to log in and ask questions about the CEO's salary and have it come back right because if you're not careful you fed it all of these records to to be smarter so that you can manage your business better and if you don't tie down who can ask what and what data it can you know spit back out you're going to risk um having some pretty embarrassing moments uh inside the company that you that you really want to avoid it could be you know medical records that you might be maintaining on behalf of of your customers or your or your internal employees it could be financial data like salaries bonuses Etc because whatever gets fed into that tool is going to be ready for it to come back with a response if you don't tie down the controls as to who can do what yes and an embarrassing experience is the least of your worries of having corre uh correct very great points there and thank you for sharing Mike as we approach the the end of our time together today I am curious and always try to ask what vendors or Distributors out there in the channel are really helping to support you right now if you feel comfortable giving any of them a shout out I do um we're we're really excited to partner with enable in two areas uh they have built I think a great rmm that we make use of on a on a 24x7 basis but they they also recently purchased a security company called ad Lumen and and that is that is helping power our uh our 24x7 sock capability and we're we're really really thrilled with that technology and that partnership with enable and so we um we we look really favorable upon that relationship and look to continue to extend that in the future we talked about AI but what tech Tech Trends are you following right now it doesn't have to be AI it could be something much much Le less sexy and in the headlines so talk to me about what you're following and what's keeping you interested or very aware of what's going on yeah you know there's this is not sexy and it's not new but it's something that that is so important for us to pay attention to and it's um we have a we have a motto inside Omega that our job is to build solutions to meet the customer wherever they are on on their hybrid It Journey and very simply what we what we refer to on around this hybrid It Journey is that every single one of our customers is is is on this path from Days of old where everything was sitting inside the four walls of their facility all the server infrastructure all the network infrastructure all the application infrastructure and now there're somewhere between those good old days when you could touch it and feel it all in front of you to where it's spread across multiple SAS providers multiple public Cloud providers maybe some in private Cloud maybe some in collocation maybe I'm still on premise and it's this splattering if you will of all of the applications and Associated Network and and server infrastructure that is spread across so many different providers and that introduces so much complexity to for the customer in terms of cost Management in terms of Security Management in terms of vendor management and so we're constantly watching the evolving trends of of call it hybrid it and educating our customers on what makes sense to move where and when so that they're making smart calculated choices not throwing absolutely everything into public cloud and realizing that you know they they've get a they get a bill the next month that's three or four times you know what they expected um making very you know um educated um decisions as to what goes where when is it time to to not renew that on premise application license and move to assass infrastructure and what am I giving up in terms of controls from a security and compliance perspective in doing that again that's not sexy but it's like that's day in the life of a CIO especially in a small medium business and and so we're very closely watching those evolving Trends as as customers are trying to navigate where they are on that journey and looking for somebody like Omega to partner with them at every step along the way well for those who are listening and would like to learn more about partnering with Omega or more about being a client of yours where can they go to find out more information and and talk to some of your team website's the greatest place to go omegas systems corp.com is a is a great resource uh you can chat with with one of our um marketing or salespeople to learn more information you can submit your contact info and you can take as much time as you want to learn about all the various offerings that we have for you Mike this has been such a pleasure getting to speak with you today and I just so greatly appreciate your time likewise it's been a great time together thank you for all of your interest in Omega thank you so much to Mike for joining us and thanks to you at home for watching watching or listening you can watch every episode of Channel Insider partner POV on Channel insider.com or on YouTube at youtube.com/ Channel inssider newws and Trends you can also listen to us as a podcast wherever you get your podcast from don't forget to like subscribe and follow to never miss an episode and come connect with us on social media @ Channel Insider on LinkedIn and X or with me at Katie boso once again I'm your host Katie boso so and I'll see you next time

This transcript was generated automatically from the video's captions and may contain errors.