Video: How To Navigate IT Management For Cannabis

hey Channel insiders welcome to channel Insider partner POV I'm Katie boso and today I'm interviewing Don caer CEO of third element an MSP focused on it Solutions and cyber security catering to verticals like municipal government law firms and cannabis we dig into the challenges of securing and serving this inconsist consistently regulated industry as well as Don's approach to education as a value ad and not a scare tactic welcome Don hey thanks for having me thank you so much for being on we're here to talk all about you we're here to talk all about third element so why don't we start out with the description of your business you are an MSP that is highly focused on it support and cyber security so talk to me a little bit about how long you've been in the market and what it is that you do and who you serve Don so we have been around since 2005 which is a long time in the MSP World in fact I don't even think the word MSP existed back then no so we were we were you know a standard it provider back in the day right oh my gosh like all the things that you do as a service provider it's like the perception of the client sometimes drives where your business goes and again because we came out so early we came out as a Consulting Group so we consulted on anything that was technology related at that point so literally if it plugged into the wall wall I think that's where the perception of the client thought that we did everything and that's kind of where things started and then we got a little bit more focused especially as security became more Forefront we actually started as a physical security group and moved yeah I know right so we were a subsidiary of a of a physical security group originally and we spun out into what we are now but uh we were security focused have always been security focused which is a little bit different from everybody else when they started out with like we do break fix and we do this kind of thing and now we have to add in security and we're like we've been there for a while uh so yes we were always focused on that yes we've always been focused on clients that I think are probably labeled as more higher risk than others are we do a lot of work in the uh law enforcement government area especially in the local area we do a lot of work for legal and it's a lot of the folks that focus in on very specific legal aspects of things and it's usually uh injury or workers compensation or things that uh you know pii and Hippa and things that along those lines that that touches and then we also do a lot of work in the Cannabis industry which is like the weirdest three things to focus on are we talking uh recreational or are we talking medicinal because they both depends on the state oh really okay yeah so what is that like for you having to being able to serve that yeah it's so itd it's weird and it's interesting to be fair a lot of us that that do what we do we're puzzle solvers at heart right so it's the okay we're applying it to a to a thing whether it's you know manufacturing cultivation retail what whatever variety that you have in that that cannabis World there it's you know just applying it to it but it's the puzzle piece of it is of you know what regulations are surrounding it for this particular uh area and then the state and then at the federal level what does this all look like what can we touch what can't we touch how does this look for us when we're talking about money you know how things move in in the money world because that's all federally regulated how are they running their business what does that look like so there's all kinds of little intricacies that go into it and most of them have very specialized attorneys tax attorneys that kind of thing that they'd help them navigate those Waters very well and have helped us navigate those Waters very well as well and for those who are watching I I keep in mind that our audience can be based anywhere for those who are watching here in the US when it comes to cannabis otherwise known as marijuana it is very state by state from a federal level it's illegal from state by state it's either legal for medicinal purposes some states like the one I'm in Massachusetts allow it for recreational purposes so you could buy it it's taxed and if you're like that sounds messy it is it's a is very messy we don't even know how to keep up with it sometimes here well what's strange even even with our banking uh we had we had bought a secondary property at one point and one of the questions coming down through was do you do business with any marijuana Industries and we're like yes but we it's you know it's business to business business kind of thing and they're like nope we can't have you on our bank and they literally gave us 30 days to get out of their Bank you can imagine trying to move all of your banking in 30 days like it's nearly impossible we don't do business with them anymore going back to the the cyber security aspect of it when it comes to that industry what are we talking is it like any other business uh that you you deal with with law with legal or do you find that they're often attacked more by Foreign adversaries is it ransomwares it just give me an idea of when it comes to the risk what do you see as a pattern they're a Target the same way that anything else is from a security aspect the bigger risk for them is in the physical security because of the the cash that they have to carry so the the average you know stop and Rob kind of thing like the convenience store isn't the easy easiest thing anymore it's actually the marijuana places because because the amount of cash exactly so for the amount of cash that they have on hand so from the business aspect it's the IP around the product that they're protecting like that's the s mushy Center for them as far as that goes that's the the IP the way that they're producing cultivating getting um the actual molecules to go in the right direction to create different things let's put it that way I think that's really where the things that they want to protect the most as far as that goes but everything else is the same you know you want to make sure that you protect your people you want to make sure that they're doing security awareness training because it only takes one person saying yes to something to get access to something else to get access to something else and then they're in your IP so much to consider there and definitely it's it sounds familiar it sounds familiar as far as any other business that would be regulated or one that you would commonly hear in most shops so interesting to hear about the differences and the regulations there that you have to consider with that I want to move on to talk about the educational aspect that you are so passionate about when it comes to your LinkedIn lives the videos that you create the podcasts that you host you're very passionate about both educating clients and educating your colleagues which I think is really important in this industry that can often be considered there's there's gatekeeping going on I think that happens because people are worried about giving up to their competition so I love the fact that you go in there and you're a voice of reason for the community with that said I was actually listening to a live stream on LinkedIn this morning a replay of it that you did with data stream cyber Insurance about disaster preparedness and business continuity one thing that you said that struck me was you said that cyber security and compliance can actually make a customer's businesses more valuable and I stopped and thought about it because that was the first time I ever heard anybody put a positive spin on that side of it if you can believe it it's usually a doom and gloom kind of conversation of the downtime the data loss you could lose your business so when it comes to that approach has that been a more successful approach to customer education than the opposite side of it what has it been like in your experience I don't believe in fud I don't like that fear uncertainty and doubt thing like I think that's ridiculous and I the people that push it it's aout it's a turnoff for me me I think I've been handled that way on repeat uh whether it's because of who I am the the gender that I am whatever that is like when you go to buy a car I had to like take my husband with me because it didn't go well uh especially early on so I tend to spin it the other way and explaining to them especially the folks that have a valued business right government's a little bit different than you're talking about you know protecting things appropriately because you don't want to have to con you know explain to your residents or constituents or whatever that you had an issue that's how you lose your job uh so and that's where the fear uncertainty and doubt kicks in but that's that's fact you know we want to make sure that that doesn't happen but on the on the side of valuation right if you're looking to do an exit if you're looking to put value into your business protecting it is one of the best ways to build value whether it's protecting it from you know ransomware or protecting it from an Insider or protecting it from an outsider You're Building value into that particular business and then if you can tell people that hey we've been insured we've been insured for years this is you know who our insurance company is we you know we do all of these things we're taking all these boxes if you're going to sell or get valuated or going for money or anything like that those are extremely valuable points to be able to add in to talk about you're going to get the money that you're looking for if you're looking for you know private Equity or VC or anything like that for funding you know if anybody else is looking to buy your business to be able to say Well they're actually in really good spot I'm not going to have to invest gobs of money to turn this thing around you're literally putting I I don't even know what the valuation would be on that but it's got to be a force multiplier of like two or three I would think absolutely and I would imagine that it also makes you it becomes a waterfall effect right you when your your compliant cyber insurance companies will trust you more when you do education within your business more than once a year at Cyber insurance companies will trust you more it just becomes an easier thing to get more accolades after that and build trust not just within the your end user base but within the companies that you need to keep your business going legally and professionally 100% but I mean even looking at Acquisitions from where we're sitting right now you and when you start asking them about you know how are you running cyber security what does that look like for you and they're like oh we don't really do that we're still doing time and material and you're like okay that's a lot of money I'm going to have to put into that business or you know when you're vetting another vendor or you make maybe you're you know partnering with a marketing company and you're like great how do you run your security and they're like what do you mean okay not doing business with you yeah yeah that's important to consider too I mean when you're when you're talking to new customers or potentially even talking to Partners to cross partner in the space What are some of those red flags that pop out to you immediately aside from what are you talking about when you say cyber insurance or compliance exactly and I know when we were looking at uh partnering with a marketing company one of the questions that I had asked was how are you protecting me as we're you know moving data around and they're like what do you mean oh no I'm like I shouldn't have to tell you this like I I shouldn't like if you're not running any type of you know security posture inside of your own organization and she's like well we do contractors and I'm like no I'm all done I can't take that risk no no at that point you could say do you need my business do you need me to come and protect you it sounds like you me I did I did and they're like oh no no we're fine I'm like okay what is the biggest challenge when it comes to talking to your customers about cyber security and compliance is it is it a cost for them is it just not understanding when it when it comes just explaining to them what they need to be safe are do you ever have the same conversation over and over I think there's business maturity types of things that you run into right some people have a really good business maturity they have business Acumen they they are forward thinking they're they're Visionary people you know that kind of thing they're super easy to deal with because you can tell them you know these are facts I'm laying them out on the table I don't care who you use whether it's us somebody else I don't care but these are the things that you actually just need to do to be generally compliant to be business in this day and age um and whether you're you know following a framework that you have you know regulated by the government on you or whether you're following a framework just to stay safer doesn't necessarily make you 100% safe but chances are it's going to make you safer so that's a great way to to start that but the ones that are small and think that it won't happen to them because they're too small don't understand that they're simply a Payday it's not about size they're just a Payday Target is all it is and chances are the smaller ones I can if I can get 10 small ones to make my day as a hacker I don't need to go after the harder big one just because it's not in the headlines doesn't mean it's not happening 100% criminals are criminals some of them are a little smarter than others but one thing I have learned from from my clients is that criminals are generally not smart people they're going to follow the path of least resistance so if you are the path of least resistance you're going to be the target they go after it's a numbers game they will find you % going on from there Don education is something that you are very passionate about as I said earlier but I also mean that in the sense of educating your clients with either gamification or with some sort of tabletop setup some way of making it fun for you when you talk about education within your customers environments what do you like to go to is there anything that you recommend for them to be able to keep up on their their internal education for cyber security or is there a method that you choose to use or even just how often do you recommend doing it every I recommend security awareness training 100% you should always do that with your clients like no doubt about that uh should you do more than that 100% you should do more than that most people don't want to most people want to do a once andone security awareness training for the year which okay but we all know that the fact is that 90% of those people don't remember that training there's only 10% of them that'll even remember pieces of that training throughout the year and we know that your people 90% of the time are the ones that start that breef reach so this isn't correlation this is causation in this case so if you're looking at it from the the business owner standpoint should you you know train your people every single month 100% you should train your people every single month should you get it in small bites absolutely one little piece at a time here's something that we're going to focus on this month here's something we're going to focus on next month and we're going to go back over those things in various detail month after month after month till it sticks because it doesn't always stick for an adult the first time through sometimes you have to see it three or four times in order for it to truly stick truly be understood and what people don't understand that the really sophisticated Bad actors or threat actors will go out they will look at your company they will look at LinkedIn they will look at anything that they can get for information ahead of time and they're going to pick their targets and they're going to do it carefully so if they're looking at you know age demographics or things along those lines they're going to figure out well you know maybe there's a demographic you know over here maybe there's a demographic over here those ones you usually will hit a little more often they're going to pick those they're going to Target those specifically so you have to really start to think like a threat actor as a business owner and the people that you want to protect the most again it's that whole like what are we protecting what data are we protecting who has access to it what does that look like who would be my targets and all of that and how do we make sure that they are trained appropriately so that that doesn't happen especially in the age of AI where anyone could make very quickly a scamming email or a link something that looks very legitimate and be able to send it to you it no longer is about the spelling arrows and the kind of like strange things about it that you can't quite put your finger on they can bypass that it's become a lot easier to fool people because of things like AI speaking of which I I did bring up AI I know that it's something where you're building guardrails around it for your clients so that you don't say you can't use it but you have to consider what you're using it for can you walk me through that conversation of how that's going with your clients right now has anybody come to you and said well we want to put co-pilot on everything in our government office and have you had to talk to them about why that's not okay yeah we've had we've had both sides of the house right we've had the government folks we've had uh some legal folks we've had a couple other people come in and say look we either really like this idea or we really hate it and don't ever want to see talk about it anything again which totally fine I get that you know aspect of it as well but the folks that are interested in it are typically interested in it one for mostly the right reasons and how can we use this to make ourselves more efficient so that's a great conversation starter on the efficiency piece like great here's what we need to consider for all of that it's not going to make everyone more efficient it's going to make your highly skilled people more efficient so who's highly skilled in your organization what are they doing what are some of the tasks around you know AI that maybe we could you know use to make them more efficient and then once we have that conversation framed a little bit then it's great now what are we protecting what are we protecting from the AI you know like oh wait what you mean we have to protect things from the AI well you have IP you have you know personal information you have all of this stuff that you don't want AI to get access to so then we talk to them about data loss prevention and categorizing all of their data and and things along those lines and once they kind of get it then it's oh so all we have to do is form these little silos within our business and we can tell AI what it can and can't touch that's really what it boils down to and then you create a policy of what you can and can't use AI for and make sure that other people understand in your organization that they can't just go out and use you know chat gbt or Claud or or whatever that's out there for random things for the business and what things they can use it for because you're going to have to tell them they can use it for some things but where where data leaking is happening that can't be a thing so I think once they get that the light bulb comes on and then you have very deep and good convers ations about protecting the data it's not about AI anymore it's about protecting the data which is an overarching theme anyway right you want to protect your data from external threats internal threats AI threats speaking of just thinking about your educational side and your side of making sure that you're keeping people safe is that something you're seeing in more less mature msps right now maybe newer ones who are kind of coming up in the age of AI and they're using it for ways that you have to say hey you got to cut that out right now I actually heard somebody tell me that they were using AI to format their documentation for another product and like literally it was at a conference and we all just like held our breath for a moment and it was one of those those moments of oh my I can't believe that just happened and then we like did you sanitize the data first before you entered it into chat GPT and they're like there was enough of a pause like you knew they didn't and they're like oh yeah yeah of course we did I'm like okay so yes to answer your question I think there's there's convenience convenience trumps a lot of things convenience and swiftness can trumps a lot of things in an MSP because we just don't have a lot of time for things and we're not thinking on our feet one as Leaders as uh people that are managing other people or as the people that are running the tickets right we're not thinking about the information that we're putting into any type of AI whether it's a large language model or anything else like is it being used to train it is it going somewhere is it staying within a particular system what does that look like like we have uh we have something that we use for process documentation internally that actually has AI built into it but it doesn't go anywhere it's just a piece it's not training anything doesn't go anywhere it's only used inside of this particular thing so can we put specific data for our organization in there about our processes and the things that it touches yes because it's not trading a model it's not going anywhere outside of that particular instance but it's the thing that you know if you're putting it directly into a large language model then it's being used to train other people and that information is going to be available for other people to pull there is plenty more to hear from Don cizer come back on Tuesday for part two thank you so much to Don for joining me today and thanks to you for watching or listening you can check out every episode of Channel Insider partner POV on Channel insider.com or on youtube.com/ Chanel inssider newws and trends you can also listen to us as a podcast wherever you listen to podcasts don't forget to like subscribe and follow to never miss an episode and if you'd like to come connect with us on social media @ Channel Insider on LinkedIn and X or me at Katie boso on both platforms as well once again I'm Katie boso and I'll see you next time I

This transcript was generated automatically from the video's captions and may contain errors.