Jason Beard

People really need to see both sides of this 'discussion'. As someone that has work to do, it's a pain in the bottom, and distracting as a squirrel on LSD playing with fire. As someone that has a fantastic product to sell (TRaViS ASM), I need to make my numbers. I've been talking a lot lately about sales with some different people at different levels in different industries. Here's the common denominator. Sales isn't about selling. Yes, that's correct. I said it. Good sales is about building relationships. Getting to know people, getting to know what they need, and if you have a solution that can meet that need, educating them about it. Do your homework, and have your ducks in a row. BUT...It should never be about forcing a product on someone. It should not be about a one-time transaction. Guess what? You may move to another organization, and you may have a product that does fit their needs. Will they take your call? THAT is the way to look at being a salesperson. Build relationships. Talk to people, and don't ASK for anything. GIVE advice, insights, valuable perspectives. In case you missed it, people share experiences. Both good and bad. I've referred business to people that I didn't do business with -it just wasn't a good match, and we both recognized it. But they were professional and pleasant, and when someone asked me, I was happy to refer. My advice? Be a decent human being. Don't be deceptive. Don't throw out Flavor Of the Month "alphabet soup" acronyms. Just be nice. "Business Development" is a much more appropriate title for what you should be doing. NOT AI+LinkedIn. Tell me I'm wrong. #sales #sanity #tasers #travis

30

15 Comments

A few years back, I abandoned my (almost 10-year-old) blog and deleted all the content. I wanted to focus on building Cloudpress, and with the pace of technology, a lot of the content was getting stale anyway. However, over the past couple of years, I have had to solve a lot of interesting technical problems, and I think others can benefit from me sharing my thoughts and how I solved these problems. So, today marks a reboot of my blog. Here's the first blog post of hopefully many to come (I have a full content calendar of blog post ideas ready to go) https://lnkd.in/g8gffGg3

3

I’ll be the bad guy now. And I ain’t too proud. The newly proposed HIPAA changes mean nothing. Removing 'addressable' specifications is overdue. Adding compliance timelines, not bad. New encryption rules for ePHI at rest and in transit... Already required? They want thorough risk assessments... 64.308(a)(1) already demands it. They say we need written security policies... 164.316(b) already demands it. They propose routine evaluations of controls. But 164.308(a)(8) has required that since cavemen. Let me tell you what’s really missing! Real enforcement and real consequences. Without that, these proposals mean zero. HHS is disorganized, rehashing the same old ideas. OCR needs to bring stronger penalties or step aside. Right now, it’s just more guidelines with no teeth. That leaves patient data wide open to threats. It’s like locking the front door. But leaving the windows open. Guidelines... Rule updates... Changes nothing. If the agency won’t crack down, why should anyone care? Which has been proven. Until then, these proposals are just noise. 𝗣.𝗦. 𝗗𝗼 𝘆𝗼𝘂 𝘁𝗵𝗶𝗻𝗸 𝘁𝗵𝗲 𝗻𝗲𝘄 𝗰𝗵𝗮𝗻𝗴𝗲𝘀 𝗮𝗿𝗲 𝗲𝗻𝗼𝘂𝗴𝗵? If you're a trailblazer ready to tackle HIPAA: ↳ 𝗗𝗠 me to talk strategy

36

19 Comments

I often get asked “where do I start with TX-RAMP?” Companies know they need it - they’re told they do. But it’s not easy to know where to start. Here’s what you need to know 👇 1️⃣ File for your provisional certification. This will give you 18 months to get the full certification. 2️⃣ Download the TX-RAMP Security Plan Workbook. This serves as your questionnaire and list of necessary controls (117 for Level 1 certification, 223 for Level 2). 3️⃣ Build your program, one control at a time. Once your program is built, you can submit your workbook and other documents to the Texas DIR for their evaluation. No expensive, third party audits necessary! TX-RAMP Certification is a big project, even for companies that have an existing cybersecurity compliance program. There’s a reason they give you 18 months to go from provisional to full certification! Your certification lasts three years, but there are some ongoing reporting requirements to meet. You need to monitor, fix, and report vulnerabilities and breaches to the Texas DIR. More helpful info can be found in the guide below. https://lnkd.in/etitFTkY 

11

A new ICS/OT vulnerability? PATCH NOW! Wait... scratch that... Reverse it. Vulnerability management is VERY different in the ICS/OT world. In the IT world, a new patch comes out and it's off to the races! - We're patching servers. - We're rebooting servers. - We're patching workstations. - We're rebooting workstations. - We're patching everything we can get our hands on. You get the idea. In ICS/OT, just because a new vulnerability is announced, it does not mean we have to patch right away. We might not even have an option to patch a system until the next maintenance window. In six months. Or a year. If ever. When that new ICS/OT vulnerability is announced, we still have to take action though. It's just a different action than in IT. When a new ICS/OT vulnerability is announced: 1. Determine if it affects your environment. This is why having a current asset register is essential. 2. If the vulnerability exists in your environment, perform a risk assessment. Consider questions including, but not limited to: -> Which systems are impacted? -> Where do the impacted systems live? -> Do compensating controls exist to reduce the risk? -> Does the vulnerability put lives/physical safety at risk? -> Could the vulnerability affect the operations of the facility? -> What would be the impact if the vulnerability was exploited? NOTE: When assessing risk, get all of the right people in the room to help make an informed decision. Engineering, operations, maintenance, cyber security, etc. 3. Based on the risk assessment, and the owners risk tolerance: -> Do you need to take action? -> If so, how soon? IT and OT can have MANY similarities. But IT and OT can also be VERY different. Vulnerability management is one of the ways where they are very different. And each requires a different approach to maintain secure, and SAFE, environment. (Repost for your network if you like it ♻️) P.S. Do you work in IT or OT vulnerability management?

13

What's the significance of $1M ARR for your vCISO revenue line? I've seen well established MSPs launch a vCISO program, yet struggle to hit the magic 7 figure number for this revenue stream. It's usually because they're: 🚫 Expecting one person to run the program and drive BD 🚫 Not integrating the service properly with clients 🚫 Viewing revenue generation in a silo I want you to do it differently: 🟢 Build scalable systems that enable teamwork and margins 🟢 Position value with ultimate purpose to 🤯 clients 🟢 2x and 3x MRR for adjacent cyber services Bottom line? That $1M ARR mark for vCISO is the tip of the spear to the next level of revenue in your MSP. And it's the secret weapon I'm helping forward-thinking MSPs build. So if you want to get your vCISO blueprint, scale this service past $1M ARR, and supercharge all other facets of your cyber revenue... Drop a comment or DM with the word "Supercharge." or head here next: 👇 https://lnkd.in/dV2xyx9j

15

10 Comments

Recently, I heard about a company that launched a product designed to replace CISOs, referring to the CISO as a “dying breed.” I disagree. There’s no question that technology plays a critical role in how companies assess and manage risk. But the idea that technology can replace a CISO underestimates what this role, at its best, does for an organization. The responsibilities of a CISO might seem straightforward on the surface. Protect systems. Prevent breaches. Manage cybersecurity. In reality, the role is about so much more than technology. A CISO’s value lies in their ability to influence and lead: 🎯 Building partnerships across IT, HR, Legal, and Compliance to align security with business strategy 🎯 Developing champions within teams who can advocate for cybersecurity initiatives in their own departments 🎯 Empowering security teams with the communication and leadership skills to amplify their impact 🎯 Creating a culture of security across the organization – one where employees take ownership of cyber hygiene, not because they have to, but because they see its importance These aren’t technical requirements. They’re human ones. The best CISOs are influencers and enterprise leaders. They are translators of risk, advocates for change, and educators of teams. The intangibles matter most. Cybersecurity isn’t just a technical issue. It’s a leadership imperative.

155

46 Comments

🚨 CAUTION 🚨 NEVER make an MSP client sign a waiver... Well, never say never. I don't like the idea of making clients who don't take our vCISO recommendations sign a waiver. I think it creates an adversarial dynamic, and that's the last thing we want. That said, there are some edge cases where it might make sense. Check out the clip from one of our recent sessions in the PowerGRYD. During a training on customer segmentation for a GTM motion with current clients, we talk about those special cases where a waiver might be the right course. But use with caution... That's why we provide our members with a relationship health scoring methodology as a guide. Want to learn how to execute this entire GTM motion for your client base to supercharge cyber sales? Drop me a DM with "Special" and learn how to start building a 7-figure revenue line with vCISO services. Or head here next: https://lnkd.in/gaJ7Chm2

32

20 Comments

I'm starting to notice GRC hiring picking up. If you're looking to hire in early 2025, keep in mind that I'm constantly getting referrals for solid GRC candidates I can't place with existing clients. I perform a full screening on folks I talk to so they're vetted and ready to interview. Here are just a few examples of folks I've talked to recently: ✔️ FedRAMP Senior Consultant looking for $120k salary ✔️ PCI QSA, ISO, SOC Manager ✔️ GRC sales from Account Executive to VP-level Also keep in mind the single best way to find you the exact person you need is to go out to the market and find them. There aren't many shortcuts to exceptional talent, but a specialized recruiter is one of them.

56

3 Comments

As more companies do the idiotic thing of replacing quality writers with AI to craft their sales/marketing reach out, it is becoming harder to identify if the services they're offering is of any use as the quality of those messages has deteriorated to the point of communicating nothing. They should at least have someone read them to see if those messages say anything coherent about what it is they offer. Not the way to reach an overly busy CISO. The message you're inadvertently communicating is that you don't value communication. Not a good look.

22

3 Comments

Two things about this headline come to mind. 1.) Chat leaks always worry me. Folks tend to speak a little more off the cuff in chats. This data can often times be 10X more valuable then a bunch of formal emails with no spelling errors and political correctness. Does your org protect these chats like we do email and other more traditional communication methods? 2.) Disney+ is basically national critical infrastructure in our house. This hits close to home. #Disney #cyber #break #slack #databreach #chatlogs

21

2 Comments

We **NEED** accountability for MSPs/MSSPs/IT Providers- I cannot stress to people enough that your stack is not going to save you. When your client gets hacked, not if- and you're standing in court defending your actions because you did EVERYTHING you could do as the professional YOU (the MSP) warranted yourselves to be could have possibly done to proactively protect the client- and the attorney asks you why you never finished IG1 of CIS and you need to google what CIS is.... You're cooked friend. No amount of, "We used <insert leading vendor here> as our EDR" is going to save you. I have so many MSPs asking me the same question: "what X should I buy", but none of them are asking "How do I create a defense in depth strategy that fits my client's risk profile and tolerance, and why does it matter". I agree entirely with Bob Miller. I think we genuinely need a regulatory body to govern MSPs/MSSPs- you're telling me an attorney has to go through 7ish years of school, pass the BAR, and then has to answer to a regulatory committee and abide by specific standards, but Joe Shmo MSSP owner with 37 minutes of YouTube, a free Canva account, and a laptop can nuke an entire business overnight putting dozens out of work and costing the owner millions?

24

14 Comments

A Google Workspace partner means much goes on in the background that you may not know about. Automated reports and investigations into security risks are undertaken. The time you need backups, logs, history, and knowledge is the exact moment you need them. That is the time you will be glad your IT partner is doing what they are doing quietly behind the scenes IT that does its job should be 80% unseen. When there is a problem, the response should be quick, easy to understand and effective. So if you have not thought about IT for a while and everything is working great, take a moment to think about everything going on back of house to make it that way

6

2 Comments