Ep 254 | N-able CEO Advises MSPs on Upcoming Challenges; MDR vs MSP; Tightening Credit Markets Create Choices for MSP Channel

Two of these elements are tied together, the N-able story and the tightening credit markets. One, the tightening credit markets is actually an examination or an example of some of the discussion that took place last week at the N-able Partner Summit, Empower, I think they call it, that happened in Prague. And if you were lucky enough to be able to go, hopefully you had a great time, got to see the city. But this was a theme that we've been playing with and I've personally been thinking about it for a lot for the last couple of years. And it's kind of nice to hear other people say the same thing or say a similar thing that kind of supports or comes to the same conclusion as something that you might think.

And I was watching a video and it was a snippet from the – I think it was the keynote from the Empower, the N-able Partner Summit in Prague. And their CEO, John Pagliuca, was talking about kind of headwinds, and security, compliance, economic headwinds, and how if you simply adjust your position, they stop becoming headwinds and they become tailwinds. They become things that support you, not hinder you. And that was the video clip. And when I saw that video clip, I immediately started writing notes for this segment because I knew I wanted to talk about it.

And we've covered other executives from ConnectWise, we've talked to executive CEO of Kaseya in the past and I thought it was good to pay kind of equal attention to the folks over at N-able with whom we've had a fantastic working relationship for almost since the day they were founded. We've been interacting with that group. They do have the privilege, or I don't know what you want to call it, but they've been out there the longest in terms of being an MSP specific software platform. They were out there and then came very quickly. ConnectWise and Kaseya in short order, although they were kind of playing different roles. Not anything like what they look like today. But we've been tracking and interacting with the N-able community and the MSPs that have been part of that community obviously for many years. I mean, at least over 20 years.

And so when I saw this video, I said, okay, this is something really cool, I got to talk about it. And this gets down to a really simple concept, which is the shift that MSPs have been sensing over the last five years. Some of you may say, "Oh, I know what he's talking about. That's the MSP to MSSP shift." No, it's not what I'm talking about. I don't even think that that's – I've been very clear. I don't even think that that's a legitimate thing. It has something to do with what I'm going to talk about. But it's not important whether you consider yourself an MSSP or an MSP. I think that that's largely marketing fluff.

N-able CEO articulating the fact that an MSP could look at rising inflation. I don't care where you are. I don't know if they have inflation in Prague, in the Czech Republic. They certainly have economic difficulties in Europe, they have them in the US. In Canada. In Brazil. They don't always correlate to one another. But it's not like we're all separated by great distances here. Physically we are, but we track each other and there are a lot of similarities between different governments and different economies throughout the world.

And especially when you're talking about a particular profession like managed services, you see a ton of similarity. And so when he's talking about and mentions security, compliance, the economy in general, and I think what he's talking about when he says the economy – challenges. Things like headwinds of inflation, headwinds of maybe rising unemployment, headwinds of lowering GDP, stock market fluctuation, bank closures, these are all elements that contribute to the economy. They influence the economy, they are outputs of the economy and they can have real significant impacts on the MSPs and their customers.

And I think what N-able CEO was saying was... Stop looking at these things as your problems and start looking at them as problems that you can solve for your customers. And if you are an MSP that can see all of those elements and not look at them like... "Here's another framework that I have to be compliant with" or "Here is another bank failure that's going to cause me to have to deal with a customer that can no longer gain credit." We're going to talk about the credit tightening at the end of the show. All of those things are interrelated and they all can be weighing down on the shoulders of an MSP organization.

But if you stop looking at it like it's a problem, and you start looking at it like these are opportunities for my MSP business, my MSP practice to assist a customer with all of these problems or maybe one or two of these problems, that is the difference between you being stuck in a – I'll call it – a reactive mindset in a reactive business model compared to you being proactive and actually being able to speak intelligently and solve problems that matter to your customers.

Now, some of you may be thinking, "Well Charles, what are you talking about? We're technologists, we're geeks, we're IT people. We don't speak finance, we don't speak in compliance, we don't speak in security, we don't speak in regulation. We don't speak in tightening credit markets. That's someone else's job." Yeah, it is. But you're the trusted advisor, isn't that what you've said? When's the last time you heard someone differentiate when they said, "I'm my customer's trusted advisor." Did they say, "We're the trusted IT advisor?" I've never heard that. I've never heard trusted advisor being qualified by the term. It never and I don't think that it's a mistake.

The MSPs who enjoy that position of trust, it transcends technical. It does. And N-able CEO understands that. He understands that it's not just technical. He understands that when you are an MSP and your customer brings you a cybersecurity insurance form for you to fill out, that is not a problem for you, that's a problem for your customer. The customer is just saying, "I don't understand it, I need some help. Who am I going to go to?" And they're not going to their lawyer, they're not going to their accountant, they're not going to their I don't know who else they would call, but they're not going to any of those people, they're not going to any of those professions. They're going to their MSP and saying, "Could you help me with this? I know you're not an insurance expert but there's some technical questions in this and they impact our business in a real significant way. Can you help me?" If you're an MSP that says, "I can absolutely help you. And by the way, once I go through this questionnaire, I'd like to talk to you about making some changes to how you approach risk and security." That's a really different outcome and a really different relationship and a really different level of trust compared to the company that says, "I don't think I can help you with that insurance cyber form. I can't answer that or if I do, I don't want to do it. I can't be troubled with it. It's not something I really deal with. Why don't you go handle it yourself or I'll give you the name of somebody else who can help you with that." Does that raise or lower your trusted advisor status? Seriously? Maybe it doesn't ruin it but does it advance it? I don't think so. Especially if it's something that you should understand. You should understand your customer's IT environment and all the questions that come from let's say that example of a cyber insurance form questionnaire should be things that you could help them with and explain to them why they're being asked and try to translate and do some good for that customer.

That is one of many examples of turning a headwind into a tailwind and that is the business change, the business metamorphosis, in the MSP profession that we are seeing right now.

Just like we saw 20 years ago when we saw the VAR to MSP, the reactive to proactive shift. By the way, the company N-able was one of the first companies to really tackle that business challenge. It wasn't a technical one. It wasn't a question of you have to figure out how to deploy a software agent onto a customer's device. That wasn't the problem. The problem was how do you sell an ongoing managed IT service? How do you actually manage IT using these new technologies that companies like N-able were building compared to the legacy business model, which had been around for decades of just waiting for something to break and then making a profit fixing it? It was a business shift that took place. Companies like N-able, and there was many others, I mean, Autotask figured it out. ConnectWise figured it out, Kaseya figured it out. A lot of the early-stage MSP platform companies today, some of them aren't around anymore, but those companies should ring a bell to a lot of you, understood fundamentally that you had to get the provider to shift, to pivot, from their old way of doing things, the break-fix way, and pivot to the proactive managed services way, in order to be taking advantage of where the customers wanted that relationship to go.

And we're in another inflection point today, which is the customers are coming to their MSPs saying, "I already trust you, but I have some new things that I am struggling with." And those new things are the tailwinds that N-able CEO was mentioning. Those headwinds, the economy, inflation, lack of credit, credit tightening, compliance challenges, compliance concerns, security concerns, data privacy concerns, intellectual property concerns, all relevant things that now they don't sound like, "Are you backing up my data? Or can you manage my printer? Or can you install antivirus on my employee laptops?" Right? Those are technical questions. They're not asking those anymore. Not that they're not relevant anymore, they still are. But the questions now have evolved and the customer is asking you, the MSP, "Can you evolve with my demands, my pressures, my challenges? Can you help me?" And if you can, if you can make that pivot, I don't think it's a huge pivot. I think it's a subtle change in how you go about messaging your services, maybe a little bit of pricing, maybe adding some tools that you didn't have before, certainly developing some skill sets or amplifying or upskilling your internal skill sets. All things that are completely achievable. I think the break-fix to proactive managed services shift was so violent and massive that compared to what we're going on and seeing today, it's insignificant. What we are doing today, it's very subtle, in my opinion. You already did the hard work. If you're anything even approaching 50% or greater of revenue in managed services, you've done the hard work. You put in the hard work to make that economic change a reality. Now, it's the subtlety of taking what you've already built and doing what N-able CEO suggested. Stop looking at all these other things that aren't necessarily IT things.

Stop looking at them as challenges. Stop looking at them as problems that your customers have, that you have no relevancy in that conversation and start being relevant and start offering solutions and start becoming the go-to company that your customers want. That I think is the message that he was trying to deliver and I think it's a good one. It's something that we wholeheartedly support and I think that many of the other platforms also feel the same way.

And if you want to boil it down and synthesize it to you have to be an MSP and shift to an MSSP, fine. I think that that's oversimplification. I think it's fluff marketing, but fine. But I don't care if you call yourself an MSP or an MSSP. If you want to take that advice and be relevant and capitalize on it and make it a tailwind, you have to be conversant in these types of issues and you have to have a go-to-market strategy. You have to have solutions that you can sell. Now, maybe all of them won't be a managed service, maybe they will. But I could see if a handful of these are really useful project ongoing services that maybe not technically a managed service, maybe it's a virtual CIO service, virtual CISO service, I don't know. I've seen a lot of different types of applications of this.

But the point is that you're taking novel problems, impacting your customers today and saying, I'm going to take that on and I'm going to respond and I'm going to deliver the solution instead of shifting it over to somebody who doesn't understand the problem, doesn't have the same relationship that I have with my customer, and will most likely just ruin things for the customer and maybe even for me, the MSP. Again, it's easy for me to say it, it's easy. It's a simple adjustment. Simple adjustment. But I do think that that's true. I think that it's compared to what we went through 20 years ago, it's nowhere close folks. This is achievable. You can do it. Even the smallest MSPs can do this and can take meaningful real steps towards compliance, security, risk, data protection, data privacy, all those things. The economy, helping customers with those challenges and doing so through the lens of the managed services business model. Those things are very real possibilities and very real outcomes should you decide to take them. More on that in the final segment.

But I kind of want to take on another topic, which is this whole MDR versus MSP debates. Not the right word, but emerging trend I'm going to call it, and it is an emerging trend because we see a ton of companies, I'm not going to call them MSPs, a ton of companies who are focusing to the exclusion of anything else, in some cases MDR, managed endpoint, managed detection and response of endpoint devices. And you may be saying, "Charles, what's the big deal?

Come on, my MSP practice is doing MDR. We have a great MDR relationship with an MDR vendor. It's working out great. We're selling it as a managed service. It's awesome. You got a problem with MDR?" No, I don't have a problem with MDR. I have a problem when a company presents itself and says "We're doing MDR and that's it and nothing else." Then, I really start to pay attention and to dig further. Because I'm thinking to myself that's really hyper-focused.

For that type of a company to say that they have that skill set to be able to offer managed detection and response for endpoints, and they, at least according to the website, they don't say that they do anything else. They don't do managed services, they don't do IT support, they don't have a help desk, none of those kind of typical managed services things.

So if you're in my shoes, you start to become curious and say, "Well, who is this company, really? So one of the first questions I ask to myself, "Are you an MSP?" Now, if they are an MSP, they're clearly not wanting to say that they're an MSP on their website. And most of the companies don't actually say that. Most of the companies know enough to not represent themselves as an MSP when they are in fact not. And if you're wondering how we know this, well when companies apply for membership, this is part of the vetting process that we go through. So we learn an incredible amount about that company. We learn an incredible amount about the industry as a whole when we see members apply. And most of them, for the vast majority of them, are legitimate MSPs.

But we've been getting more and more over the last few years of these types of kind of cybersecurity companies and they're cybersecurity exclusive. And you're thinking, "Why is that bad?" Well, it's not necessarily bad, but it does beg the question, well what are they really? If they're not an MSP, And I think that the ones that are just really hyper-focused on MDR, that's all they do, and that's all they really list on their website and that's what they're leading with, maybe they say they do consulting, like cybersecurity consulting, that might be a secondary solution, but they lead with – the front page of the website says MDR. "It's what we do. We're in the MDR business."

Question one, are you delivering that service yourself? Most likely not. Why do I say that? Because if you were a competent, mature managed service provider organization, and you had the ability to deliver managed detection and response, you would sure as hell be saying that to anybody and everybody you could, because that's a very mature service offering to hide, to just have and say, "We don't do managed services, but we do MDR, we do all these other things, but we don't do it." But you know what I'm saying? You would talk about it, you would mention it on your website, it would be part of your menu of deliverables, of your service, deliverables that you have on the website. You'd talk about it, these companies don't. Why aren't they talking about it? That's so darn curious to me. I don't think they're MSPs.

So I ask why are they actually representing themselves as being capable of delivering an MDR solution when they're not likely an MSP? What else is there? So I think, and I think... I got it! These are companies reselling another MDR vendor's solution. Of course, it makes the perfect sense, right? Think about it, MDR vendor goes out and says, 'Would you like to be in the cybersecurity business? Sure, why not? I mean, everybody else is getting into the cybersecurity business over the last three years. It's the number one thing in town it seems like. You can't go two steps without seeing something around cybersecurity these days. So it stands to reason that cybersecurity vendors who offer MDR solutions go to a company and say, 'Would you like to resell MDR?' I don't think they even know enough to say, 'Well, but I'm not an MSP.' I think they're actually just going out there saying, 'We're an MDR provider.' Reseller, really? Agent, probably more accurate. Provider? Likely not. Not even close. I don't even think that they have the capacity, a lot of these companies, to be delivering that type of service, or even to meaningfully – They could probably sell it. They could probably message it to a certain extent. But could they actually interact with, let's say, tickets and do some of the technical changes, let's call it even a tier-one level of service? Could they do that? Based on the websites that we're seeing, I would say probably no.

And so it strikes me, we've got a growing community of non-MSPs who are out there saying, 'We deliver, we can offer manage detection and response.' And mind you, this is in stark contrast to the same MSPs who also are – the vast majority of MSPs I know – have been already embracing MDR-EDR style solutions and have been putting that out there for their customers. But they're real MSPs. These MDR providers are not really providers. They're resellers or agents. So you could see why the confusion is there, the potential for massive confusion is there. Now, I'm not going to say that anyone is doing something improperly, or that they should maybe change their marketing or go-to-market strategy. I'm not going to say that. But I am bringing it to everyone's attention because the last thing that I would want to be party to is helping cover up things that are creating confusion and chaos in the market. And I know some of you are saying, 'Well what confusion, what chaos are you talking about?' I guarantee you there is confusion from customers who interact with these MDR shops who think mistakenly that that MDR company is actually capable of delivering managed services when they're not. And it would not be good for any MSP globally for that type of mentality, that type of situation to grow and get out of control. It's good for us to talk about this out loud and just let customers know that these types of companies exist and to be fully aware that they're not an MSP.

So it begs the question, why would I, as an end user, want to engage with an MDR provider? See what I did there? With an MDR reseller, compared to an MSP?"

Well, there's probably a few scenarios. If I'm an end user and I have a fully baked, fully fleshed out internal IT department and they can do all this stuff, they could do the tier one stuff, but they really need a good MDR solution, then maybe coming across one of these resellers or agents is good, and they could just buy a bunch of licenses from that reseller and that's it.

All right, that's one use case. But for everybody else in the planet who doesn't have a full-time IT staff that is capable of doing all that, you're probably going to be more than likely wanting to work with or already working with an MSP. Why would you go to that MDR reseller? I can't think of a reason why. I would want my MSP to do that. Right? Makes sense? You'd want your MSP to be, number one, aware that you're actually using an MDR. You would want them to at least have, if not sold it to you, if not have made the recommendation or the introduction to the MDR vendor. At the least, you would want your MSP to be aware of the fact that you're going ahead with a purchase and that it's going to impact the MSP's job. I mean, that's, that, that's common sense, right? It's not like it's a print driver showing up on the network that has minimal impact. It's not an invasive agent, but it's an agent that can accumulate and ingest a ton of data. It's going to have an impact on the other types of RMM technologies and other monitoring tools that the MSP uses. Of course, you're going to want your MSP to be aware of it.

So why? Why all these MDR resellers out there propping up all of a sudden? I can only attribute that to the vendors pushing those types of solutions out there and being indiscriminate in their use of MSPs and non-MSPs alike. Maybe this becomes no problem at all down the road. Maybe it does. It's creating confusion for me, and I've said this a lot. If I'm getting confused about who that type of company is, are they an MSP, are they a non-MSP? Are they an MDR vendor? Channel partner? That's not a good thing. Anything that creates more confusion, more question, yeah, it does create more potential for chaos, more potential for bad than good. And that I'm not in favor of. I think the more clear we can be, the better and this is not making things anything close to clear. We'll keep an eye on it, but I'd love your thoughts on that topic.

And I hope I made – just one last comment – I hope I made myself abundantly clear that I am not anti-MDR. In fact, MDR is part of the MSP Verify standard. MSPs need to have MDR solutions. SOC as a service, SIM as a service. Those types of things need to be part of your MSP practice. Period. I'm the most pro-MDR person you could find, but what I am also is a proponent of being very clear about what you do as an organization, as a company. And so MSPs should, if they're not, they should be definitely using and embracing MDR, if not as a service, then at least using it internally on their own networks, bare minimum. Using it internally.

A question, by the way, I would be really curious to ask these MDR resellers is are they using MDR in their internal networks? I would wager a fair amount of money that most of them do not. So again, MSPs definitely ought to be using MDR. Non-MSPs – Really, that's the question. What is the role of the non-MSP in a managed detection and response world? Is there a role for them to play? If so, what is that role? I don't know if I have a really good answer, to be honest. It's not like it's a router or a switch or hub or something simple that can be resold on somebody's website. It's a lot more complex and involved than that. Hence my scrutiny. The questions I ask – makes you wonder.

Finally, alright, tightening credit markets presenting an interesting choice for the MSP channel. Kind of tying off the knot, if you will, of the N-able CEO making the comment about headwinds being turned into tailwinds. We've been talking a lot about pending recession, pending soft landing, whatever you want to call it, right? The US Fed is actively trying to shrink the monetary supply, get inflation under control, and figure out policy for our monetary system that will make the economy operate better than it has been over the last couple of years. Again applying the same principle we talked about at the beginning of the show, turning that headwind into a tailwind, how can you do it? How can an MSP do that?

And again, for those of you who are saying, "Well, Charles, I have no idea what monetary policy is. I'm just a simple MSP. All we do is provide good technical IT services to our customers, and that's all you can ask of us." Hold on. You're selling yourself short if that's how you feel. Alright, let's suppose you have no idea what I just said about monetary policy. Let's state it this way... The bank failures that we've seen in the United States boil down to one thing – credit. The ability for an organization to access credit to borrow money is becoming more difficult. Makes sense, right? Easy concept.

If you accept that as real and likely to continue, then you have this fallout or this scenario likely to occur. Your customers at some point are going to come to you and say, "Hey, we're sitting on a whole bunch of really old pre-pandemic stuff that it's not working anymore. Maybe it's servers, maybe it's infrastructure, maybe it's laptops from all the people who are now working from home who now have to come back into the office. Or we have to buy whole new desktops because we sold all the desktops at the beginning of the pandemic to buy the laptops that we had to give out to all the people who are working from home. The point is, we're coming up on a refresh cycle. We always do – every three, four, five years, depending on your MSP business, it's typically going to fall within that cycle.

And so if this is one of those years where you have customers that are facing a refresh cycle involving hardware and software or anything that's going to be kind of a capital expenditure, they're going to need one of two things. They're going to need cash or they're going to need credit. One of those two has to be present for them to effectuate that refresh. With me so far? What's the MSP to do? They're not a bank. They're not a leasing agent. Some of you are, but not a lot. The most of you don't get involved in leasing. What's an MSP to do? Well, there's actually quite a lot you could be doing. Again, we're going to turn a headwind into a tailwind.

You could be going to your vendors, you could be going to your distributors, and you could be working out solutions that work through how you are going to take to market over, let's say, a 6, 12-month, or greater period.

And I'm talking about, let's say, now, through some period in 2024, where, depending on who you talk to, we could experience either a recession or at least a very, very soft landing, or maybe a hard landing where there's some tightening of the economy.

Maybe the GDP falls, maybe unemployment continues to rise, maybe there's continued turmoil with inflation and all that, who knows what's going to happen?

The point is there's uncertainty. That we can be sure because everybody that you listen to when you turn on the radio or you turn on the TV, they're talking about stuff like, "Yeah, I think we're going to have a recession in the fourth quarter. Yeah, I think we're going to have a soft landing in Q3 or Q4. Yeah, I think it's going to last until the first quarter of 2024."

Who knows? Someone's bound to be right.

What can you do as an MSP?

Start having conversations, start talking about things that you could do to help that customer through a difficult period of time.

Now, if all you think about is, "Did I update their antivirus? Did I update and patch their machines that I back up their data?"

And if that's the only conversation that you're having with your customer, yeah, you're probably not going to have this floating through your mind as a reason to have a conversation with that customer about a potentially soft, really soft, or maybe a full-on recession fourth quarter in 2023. You're going to keep doing what you do.

But a good MSP, a forward-thinking MSP is going to say, "Well, maybe I can take this opportunity to take those few lingering, reactive brake-fix companies that we have under management and turn them into MSP customers."

And maybe this is the time to do that because maybe they don't want to be stuck as an MSP doing a whole bunch of break-fix work during the middle of a recessionary quarter when they've got over 50% of their customers, are managed services customers paying regularly.

They have their IT relatively in good order and it's being managed and it's good, things are good.

But you know that they're not going to take up the vast majority of your resources.

It's the break-fix companies, customers, that they're going to take up the vast majority of your time.

They're going to be the ones calling you on the phone saying, "Hey, the stuff is breaking. I can't print, I can't access the email. Our sales team are out on the road and they can't send the presentations, all that stuff."

You've heard it before.

Have the conversation now. Have a plan.

Start by getting them onto a managed services agreement.

Number one, that's first thing I could think of.

Second, start having planning meetings with them.

"Do you think over the next twelve months you are going to need anything new?"

New server, more software licenses, new laptops, new desktops, printers – I don't know, whatever you sell, whatever you support and manage for your customers, you'll know, are you having those conversations now?

Think about this.

Are you making yourself and your MSP practice relevant to that customer?

When that customer thinks about fourth-quarter planning and beyond in their business, with their CFO or their controller, whoever they're talking to about their budgets and things that are going to make a big difference to them as an organization – again, whatever it is that they do. Either they're thinking about you and your MSP practice as part of that conversation and that resolution, or you are out of sight, out of mind, and you are irrelevant to that conversation.

That, what I just said right there, the first situation is – that's a tailwind. When you're relevant in that economic decision making process with your customer, you've got the wind at your back blowing and pushing you forward.

In the second situation, when you're not part of that conversation, when you're irrelevant to that conversation – that's a tailwind. Because now you are just completely dependent on and responding to a customer making a decision without your guidance, without your input on things like, "Maybe we're going to just keep that hardware in place for another year and oh well, our MSP is going to figure it out. It's five years old. It'll still work another year, right? Of course it's out of warranty. Sure. My MSP doesn't care about being in warranty or not, right?"

Hey, if you're not part of the conversation, you're never going to know. That's what I'm talking about. Turning those headwinds into tailwinds, talking about product refreshes, timing, gaining access to credit, maybe through distributors, maybe through vendors. If you can't do it. Planning through some of that stuff, maybe looking at cloud alternatives. I don't know. There are so many different variations, I can't go through all of them.

But what I'm trying to say is the conversations, the conversation starters that I'm trying to present to all of you are helpful starting points to begin to have meaningful conversations that don't necessarily have anything to do with IT. They have everything to do with the company that you support, having your input and your guidance in helping them with what is ultimately a business decision and a business challenge they're going to face.

Maybe they know that they're facing it now. Maybe. Or maybe they don't know it yet and they haven't even thought about Q4 or beyond for that matter. But that is the choice that the MSP channel has. You either embrace that and start to have conversations that actually make a difference and offer solutions, or you follow the break-fix, the reactive crowd, the remaining few that are left, and say, "We're not going to be taking part of that at all. We're just going to deal with whatever the future brings."

I know which one I would do. Do you?