EP195 - Eliminating Security Anxiety in Your MSP with Seamus Lennon from ThreatLocker

INTRO

In this episode of the IT Experts Podcast, we help you eliminate security anxiety with the guys at ThreatLocker.

Welcome to the IT Experts Podcast, the only podcast to help MSPs scale to 1,000,000, and if already there get to five and go faster at the end of the day, isn't it all about building a business that works for you rather than you for it? I hope you enjoy the show.

IAN

So, good morning, good afternoon, good evening. Welcome to the IT Experts podcast. Today we've got a really special show ThreatLocker have sponsored this show, which is absolutely incredible. And we're going to be helping you understand how to overcome the anxiety of security in your MSP and many people talk about what's the security we need, what stack do we need the multi-level. That which can be an absolute minefield, and most of you know I'm not technical, so for me it's even worse. But today we' got Seamus Lennon from ThreatLocker who's s going to come and help. All those myths help reduce the anxiety and help understand, you know, #1 how ThreatLocker can overcome some of these theories, but also theories and the challenges, but also how we can really understand the state of security. That's coming at us, what we need to be prepared for and how we can overcome that. So shameless welcome to the show this morning.

SEAMUS

Thanks, Ian. Thanks for having me on. So just look at the background on Seamus Lennon on the VP of OPS. Logger in the main we are a zero trust endpoint security solution. So we have applied zero trust architecture environments to stop any attacks in those environments.

IAN

Excellent stuff. Just tell us a little bit about whereabouts, are you guys based?

SEAMUS

Yeah. So we're based here in Dublin, in the EMEA Officer headquarters is based in Florida. So we've got about 45 here based on there, which is growing and growing. And we opened up the office here just over a year ago. And the company itself is going over eight years now in Florida. That boy is over there. We we've got a, Oklahoma. But now my last count is over 300 anyway, so we are growing and certainly the time goes by.

IAN

And that sounds like some pretty rapid growth. How many partners are you now working with in the UK and Ireland?

SEAMUS

That's hard to say. How many partners in the UK and more, more boys we, we've got over 50,000 businesses that we work with.

IAN

Brilliant stuff. Now look, cyber security, it's one of these things that whenever you go to a show, there's more security vendors now than there is any other types of vendors, whether it be, you know, PSA's or trying to help you grow the business, anything else that you've got kind of like going on. So it's a massive growth area that we can see that in in the size of your business yourself. 2024, you know, I think we've recovered from the good old pandemic and we've had a couple of years have been quite interesting. All the bad guys have been busy there sitting in their little dark dungeons or their ivory towers, whichever way they want to cut their cake and they're out there now running really, really successful, professional organised crime to get to the MSPs end clients right. What are you seeing that's changed in the last year? In particular, that MSPs need to take notice to, there's a lot of noise out there. There's a, as I said, there's a lot of products, but what's the thing, if you were running an MSP right now, what would be the things that you want to make sure that you've got covered off to help?

SEAMUS

You sleep at night or the two that you want to call it off. Like I come from an MSP background so –

IAN

And then.

SEAMUS

Understand the worries that MSP have for protecting their clients. Traditionally it is about, you know, encryption and encryption is for risk. Taking down the systems downtime for our client to view of the server offline for like 10 hours, that's going to cost the business. It’s not about encryption anymore, it's about data and it's about data exfiltration and it's not good ransomware and unfortunately that's where it all revolves around. But if you look even at 2024, June 2024 has been a 47 about 48% increase in ransomware tax. Since this time last year. Wow, you know, so that increase of ransomware tax, you know in terms of the cloud disclose renting our tax and discount transformer tax, we don't have any own disclosed.

IAN

Yeah.

SEAMUS

It's not. Not many people want to make and put their hand up and say I've been a victim of a random attack. No, but the take the tablet, all of those taxes, 92% of those attacks all involve data exfiltration. So long gone is the point of just encryption and holding your phone lines for encryption. If you've got data and any sort of sensitive data, which pretty much everybody has to. Yes. Yeah, it's about protecting that data.

IAN

Yeah, and it's, you know, and we know this is about protecting the MSP, but also because the MSPs are hot topics and the hot targets, which is why you know when you start thinking here all these little rumbles going on with the government about accreditation and certification for MSPs when they're holding this information, you know we all know that MSP at a hot target and MSPs focus on their own security. And then they've also got this whole thing where they've got this whole sales thing to do, where they've now got to try and protect their end clients as well. And one thing that we hear a lot and I think you might hear this a lot as well and I know that you've overcome this in many ways in the way that you guys operate is shiny ball syndrome, right? Go to an event, get on the webinar before you know it, you've got 5 or 10 new security products because I've bought more, I'm more, I'm safer. So I'm really, really in a great place, they don't implement them, they don't. When I mean when I say they don't implement them, they don't use them for the full capability. They don't connect them all together. And then before too long and it happens in our peer group here at the growth hub, they're sitting there going, oh, do you not get this to do that? No, I didn't know. I did that. And you not get this to do that? No, I didn't know, did this. And I know John came up to us, John and me, your guy. One of our tech tribe meetups and he said, look, that just doesn't happen with us because yeah, we help you implement it. Do you want to just explain a little bit about how you don't kind of leave the shiny ball hanging when you when you sign up and you client?

SEAMUS

Yeah. Yeah, so I'd say going from that background of the VP, we had implemented ThreatLocker and I was so impressed with it. You know, I'm trying to kill it. And now the VP of OPS for the trial locker. It's... But that's how what it was and the implementation on the process of the trilogy was completely different to most security solutions are most MSP solutions will say because most MSP solutions. You pay for the product, you pay for your license, and you may pay for a bit of training and that's it. It's left up to you and how you implement that. And look, everybody's busy these days, think it's sort of half implemented, half not implemented. Which got like we basically have a journey with each of our partners, and that journey never ends. So basically every single client gets appointed solution engineer as an assigned solution engineer. It's my job to help you guys implement ThreatLocker to its fullest capacity, not just doing this tiny little bit of the phone, which is the Shorty bit where your daughter. Did all the rest of the solution did it no matter what you're secured and that really never ends. I know we were talking earlier about some of your members that that we have. I've been working with him for the past three years on monthly calls. Yes. The solutions implemented, but we still removed because we did one hour a month every month just to make sure the exciting being the product financing will not implemented or implemented in the world.

IAN

Yeah, my vendors are there, you know, to help and support the network and they're there to help them grow their own businesses as well. But when we work at, you know, I'm going to say it's a lower level, but I don't mean it like that. You know, more of a, a personal level, more tactical level with our clients. If we turn around to our clients and said he's had to grow your MSP, he's had to get it to a million. Here's the book crack on. I'll see you later. It's not going to work. You know, you're going to need to implement it. I get a bit flabbergasted sometimes when you hear that certain people who have implemented certain PSAs or certain RMM tools, and then you then have to go and get a consultant to come in and pay extra to make the, you know, to fill the car, a petrol or pump the tires up. And it was just like it. It's like this doesn't kind of like work. And when, you know, when I heard about the fact that you guys are doing that, I thought that was a, you know, a really good thing, because I suppose that's in your best interest. Isn't it because it is, it's bit no brainer really isn't.

SEAMUS

It, yeah, no. Internally, everybody's person is interested in the Airbus interested. Yeah. Locker. Because look, we ensure that no clients are over here. But and from there. Yeah. And the only way we can do that is to implement it the product and the solution fit to its own and have everything in a secured state on top of the solution engineers like we're back with a 24/7.

IAN

Yeah.

SEAMUS

Oh, service and the guys are amazing. Ask any, any, any members of the MSP ground that have, they'll tell you the response time less than 60 seconds. The majority of the time. So we're always there to help, but we never leave our partners to joy to be.

IAN

Yeah. Honest and I'm curious as well because you've got. You know, there's obviously lots of different APIs that sit in between all the text stack that we have for. The clients do you also advise clients if because I know that you know Threatlocker doesn't do everything, does it? You know it does it, it does a certain things which is going to cover on off in a minute. But do you help them to identify if there's any issues with other products that you're trying to connect it with or if they may not be set up. I don't know. You're not there to do the whole stack. But do you, do you go to that level of ohh hang on a minute. You might not be connecting with the PSA properly or the this.

SEAMUS

Yeah.

IAN

Or whatever. Do you go to that level?

SEAMUS

We do sometimes, as well depends on the client and how in depth we are in their environment. We won alongside a lot of other security solutions as well. So we can use those to our benefits as well. And so instead of that layered approach as well when it when it comes to the environment because a lot of people will get on Oh well I have this solution so everything needs to work with this solution. Now this is what I'm doing. Well, we just sit on up the solutions and say look with this is what we're doing in, in the fourth things now. So we do that sort realistic view of the environment and what they're doing and where we can sit in the whole times of trial locker is if you think about traditional security solutions for endpoints, yeah, it's antivirus and what's it there to do, look for known threats stop and block those known threats ransomware attacks is not about, you know.

IAN

Yeah.

SEAMUS

Malicious software anymore. Like I can use genuine software, the software to make your data encrypt your whole environment. Yeah, and not reach your software, you know, 7-Zip PowerShell and any desk phone, remote access can encrypt all your machines and it connects very early data. I haven't written malware for that. I'll just use the software that's available. So again.

IAN

You're scaring me now, yeah.

SEAMUS

It's about allowing what you need to allow, and then only allow that in the environment and blocking the everything else. So if you take them on that concept, if we're blocking everything that we don't need to run in the environment and there's part of trade lock, our solution is application allow this which does exactly that. We're not constantly looking for every new malware. That's great that every single day, every minute of every day because we're just blocking everything so.

IAN

Yeah.

SEAMUS

So the good, the good, the bad, and the ugly as I like to speak.

IAN

So MSPs got himself a nice little shiny stack. He's all happy because all the little lights are flickering and all the little things are all nice and green and everything like. How do they know that their security stack is working? What are some of the key things that that every MSP on this podcast should be listening to say? These are the basics. This is the Janet and the John because yeah, whenever we've had these conversations in the growth hub before, depending on the size of your MSP, depending on the complexity of your MSP and also depending on the types of clients you've got in your MSP depends on how much of an ear you put to the speaker. On cyber security, isn't it? You know, some of the little guys will go. You know what? I'm busy enough as it is. I ain't got time for this. Some of the medium sized guys might say, do you know what my clients, they're not. They're not a big threat. I'm kind of cool with it. How does an MSP know that their stacks working?

SEAMUS

Yes, and see, that's the only thing. The only time you'll know when you starts working is when something goes wrong? When it goes wrong. Not if it goes wrong, it's when it goes wrong and just come back. Like I remember well, 10 years ago, we had a client ourselves here in Orange. Then we had a full security stock in place, everything was there. We didn't have tried out the line.

IAN

Yes. No.

SEAMUS

And this particular client got hit months where they were down for 22 hours, where they did a recovery and the first thing that we said to ourselves is let's hope the backup with Walker that help and stop hope. And as an MSP it's always you're here because it's your responsibility and to have all of the implementation of the tools working, yes, you have a successful backup, we will store that client. Four weeks later, same thing happened again at the same club. Now we had the best security we could have at the time. We had everything else in place. It turns out one of the secrets like to click on links on absolutely everything and that's how they got round from her voice over and he asked me at the time the owner asked me the time, he said, what times? How do I stop this? And I was like, I'm sorry, but the only answer I have right now is the fact that that's the only thing I can say because the point is no solutions. Prepare that we could implement and that would stop this and that's the thing we even referred to speak to a point there, then yesterday. And he said the best thing they try first, and go to bed and I sleep and I and I don't worry about anything and that's it.

IAN

So they weren't targeted. It was just unfortunate that that clicky, happy Claire, other names are available. Yeah, it was out there, just like, inviting them in.

SEAMUS

Ohh yeah. Yeah. So yeah. And that's just so again you know it's one of those things we have the best security stack that we thought at the time but it clearly wasn't working.

IAN

All my, all my room.

SEAMUS

Yeah, definitely wasn't working.

IAN

Just a question on that, then what do you do to, so you know the system comes along, install it all in lovely stuff. You're then doing the on boarding with the business owner and everything like that. What do you do to provide any type of security or where? Because we know that the number one, that the number one problem for any security is the hand that goes near the mouse that clicks near the thing. They shouldn't be clicking on, right? So it's all, it's all the human intervention isn't.

SEAMUS

Yes.

IAN

And what do you do to help educate not only your clients, but your clients, teams and maybe your clients, your clients, clients. Yeah. What have you got there to, to help the human side of this.

SEAMUS

Yeah. So when it comes to the like, we've got a full university around not only our product, but why we have that product and what it actually does and how to implement that product –

IAN

OK.

SEAMUS

to go back to that hand that wants to click on absolutely everything and I said previously we do application allow listening book application allow listening has been around for years and that actors know this as well and that's the –

IAN

Yes.

SEAMUS

More when they'll go in, they'll use PowerShell because it's only every single Windows device, and I can use PowerShell to pretty much do absolutely Anti – I can exfiltrate data, encrypt the machines. I can do everything with that one application that's allowed to run in the environment. Now what we apply to all of the applications we do allow the one is something that we call –

IAN

Right.

SEAMUS

Referencing, in other words, you can run PowerShell, but this is all you can do. You can can't access my data. You can't access the Internet. You can't go off to the right stream and write keys in there. You can only do what you're just to do. Take it like Microsoft Office, one of our default policies is to block into my interaction with PowerShell and command prompt, and she's not the most weaponizable applications. So if that hand is around Python on links within Outlook that's calling on a batch script or PowerShell file or whatever, it may be, it's simply blocked and denied. We have identified that in what we call a lawyer. Which is a log of absolutely everything that happens on every single device and using our telemetry we can come back to our clients and say, look, we've seen this in this. And you may want to, you know, go and have a chat, maybe offer some sort of security awareness training for that client as well in that environment. So we help on that sort of scope as well.

IAN

So not only are you provided the system that gives, I'm going to be blatant. The flashy little lights for the MSP to go, hey, hang on a minute, red, amber green. What's going on here? Are you also monitoring that back at your, dates to, say, hang on a minute, there's some activity going on in, in my environment that I don't think looks right or there's something happening over here or there. So you have you kind of got the MSPs back off the back.

SEAMUS

Yeah. So that's a great question because we recently just launched their, and our service. So and with all the primary that we're going on and every endpoint and we see basically everything, these rights moves are delete today and network traffic applications executing, we pretty much see anything on top of that we offer an MDR service which basically monitors the environments as well. So please see something happen in one of your clients environments. Basically what we do is we'll notify it, we'll flag it, we'll ring the MSP directly within usually within 60 seconds up to a minute. The note for the client to say hey, look, we're saying maybe cats running on somebody's environment, you probably want to, you know, how do you want to proceed with this? And we can actually do a mediation as well to a certain extent. If we see when the likes of maybe got going on a on an engines device for one of our MPs, we can automatically lock the lock out that machine, stopping anything on the work from happening in the environment. So we have all that out tailored on top of our solution as well.

IAN

Excellent stuff. So you're you're covering offers as well as making sure because monitoring I was, we did a podcast a little while ago with Mark Taylor from Coors where they're providing the socks service. And you know, who's saying it's all about the monitoring, it's all about the monitoring. But you know, the words that we hear, the money repeating what we hear is, I've got a business to run here. I've got issues going on. I've got tickets coming out of my head. I will be doing monitoring, but I'll be doing monitoring that I will do when I get around to it. Yeah, and it'll be running in the background that it might be once a week or it might be once, you know. But whereas you're saying that you're checking in on that, you know, a little bit more, a little bit in the background.

SEAMUS

In the background.

IAN

More frequently, which is, which is absolutely brilliant.

SEAMUS

Yeah. Well, and that's probably the focus of where Turlock comes in and in terms of the MSP is like we have a full, that's what we call cyber heroes, you know, a full Cyber Hero team supportive book on your behalf. So you know, even if let's say the implement application allows us and something gets blocked from 1:00, clients they need access to it. It's, you know, 2:00 AM in the morning for you guys. You guys don't walk 24/7 or your plants will work 24/7. Well, our team do. They can approve that request based on a given condition and say okay, well this user can have access to that or if they tried to install something that doesn't look right and you know remote access to or and whatever it may be, we can just that to the MSP and say look, yeah this coming for a request, we don't think we should allow what you think and that's it as well on top of that then the Edo and the or responding to all that telemetry, we gather we're months from that again 24/7 as well and it is a man's month from situation. So it's not a you're in there that's making decisions. We're basically looking at all of this and we're flagging down on anything that maybe indicators are compromised in accordance of worms.

IAN

Seamus, I was listening to one of the guys this week just talking about actual Geo restriction, which I thought was really cool. So you can then actually restrict in you know it from a locational point of view, who can actually access ThreatLocker and other applications. Is that something that you've always done or is that something that's new?

SEAMUS

It is actually something that we've always done. So your restriction is something that we could do for particularly for admins. So realistically we want to restrict access to travelogue to only the people that need that that access. But they'll go that way before that that only those people can access it from the MSP’s office and that's it. That's single location. So the, you know, there's nobody out there. That could potentially access it anywhere. In fact, if you actually look at the Health Center with the entire locker, it'll show you the login locations on a map as to where the logging in. So if there's any failed logins in in the drive logger, it will also show you there as well.

IAN

Well, there's something going on out in the Bahamas. Some might have an MSP in the Bahamas is not begrudging. Anybody have an MSP in the Bahamas, part of the fact that we're a bit jealous, but but cool, talk to me about the sales opportunity using Threatlocker and how some of your clients have used this. So we've talked about how to protect you know, your own MSP tand protect your clients and understand and have this say exactly.

SEAMUS

That's it.

IAN

You know the pane of glass where you can see what's going on, how have some people used it really well to either retain existing clients or to do like a bit of an opt out, upsell type of thing with existing clients or even with new clients? How does this product works in that space?

SEAMUS

Yes, yes, I'm trying to work with sales and depends on you know the clients of clients. Obviously I was here in the UK and sober essentials was the biggest thing that that cannot reasonable, you know having a certificate. Obviously we meet the demand for cyber essentials because you know we do application allows we are an Edo. We also have an elevation control which is a pan solution, which removes local admin rights from a machine doesn't allow to use it to have admin rights. We can elevate applications individually without elevate the user. So for any of those clients that have legacy applications out there and there's still a lot out there that require admin rights to run and that's the reason why a whole company has admin rights where you can remove and say, okay, with just this application, you're going with those rights that enhances the security of the environment. And look that was secured to clients these days is not that difficult. I seem not that difficult in that you cannot go to the dog on the street and say the word ransomware and they don't say you know what that is. Yeah, everybody knows. What it is and sound security slow too. 10 years ago, nobody really cared about security. You know, that way Internet wasn't at the forefront. It's, you know, it's productivity. It's up time. I want everything walking. Yeah. Now people are saying yes, I want everything walking. I want productivity. I want my your time. What I want to be safe as well. And I want everything to be to be secure. I don't want downtime. And I definitely don't want the data to be lost. So and that's not a sense with clients and selling it. It makes it easier. It is an easier, well, no. How you differentiate security solutions? Is that that's the thing. It's like you know. Oh well, we have an antivirus already. You know it's not good enough. And it's killing that gap you're saying? Well, okay, well, antivirus is great for things that are bad or malicious. But, you know, tractors aren't using malicious tools anymore. They're using basically everything. Feels bad deals and go to our grandma once, once, understand. That it's very easy for them to adopt that sort of situation of awareness, of security and it eases in that sort of sales process as well.

IAN

Yeah, we talk a lot about education of our clients. You can't, you know, no one should be going out there and selling ThreatLocker. That's the major sit up and stare, isn't it? What they should be telling is the benefit the business benefits of what the record does and helps that client. You know that you don't sell the tech, you sell the outcome the business solution. Do you help your customers to understand how to do that or understand the business benefits of what it does so that that conversation becomes easier.

SEAMUS

We can even o one before then we can actually do demonstrations for our customers. Brilliant as well. You know, when it comes to demonstrating try like I've never sold that like in my life. Never once sold it. I don't sell Trello. I just showed the value of what it does and that's it. It sells itself.

IAN

Brilliant stuff. Seamus. So what's next for ThreatLocker? You know, these businesses like yourselves are moving innovation at a rapid rate, and arts. Is there anything exciting coming up that we need?

SEAMUS

To know about because always something exciting coming up with our like our we're a company that has evolved quickly and expand very, very fast and there's always new products and new solutions coming out. We are launching something as well, really soon as well. So it's very interesting. So it's one of those solutions. That if you've been with us from the beginning, you will see the amount of change that we've gone through and additions to your product. We're not stagnant. We definitely do grow and grow and grow quickly. So keep watching and keep an eye out for the changes.

IAN

Keep an eye out for the change. This lovely stuff, just before we wrap up. What's your top tips for any MSP here? Just to help them reduce their anxiety around their security stack, reduce their anxiety around, you know, sleeping at night, getting some ransomware. What's the top things everyone needs to be doing.

SEAMUS

Security solutions, security stack should be a lured solution, simple as that. You've got the solutions in place that you know and trust are going to stop ransomware attacks anybody getting into the environment, it's very easy to just relax, switch off, enjoy the weekend, not have to worry about that phone call at 2:00 AM or 3:00 AM, promise up team to say does an attack on the way though and having that layered approach in your environment is definitely where you need to be.

IAN

Fantastic, Seamus. How can people get in contact with the if you want to learn a little bit about ThreatLocker, what you do, how you help, how you can offer them, we're going to put all the information into the show notes anyway on this podcast episode. Yeah. How do they keep up to date with those innovations and connect with yourself or Donna.

SEAMUS

Yeah, you're tapping your phone is on linkedin.com as well. You can reach out to myself. Just on LinkedIn, if you have any questions or anything needs to know anything further, please drop us a message on. Yeah, we can share everything.

IAN

Brilliant stuff. Well, look, thanks very much for coming on the show today. Really enjoyed our chat. I love the fact that every time I get that little bit more technical and I get that little bit more information, which is so dangerous for the position that I'm in, cause I will always say I'm not a technical person and then I'll come out with this little stat that you mentioned and they think I am. But anyway, look. Wishing you guys all the very best of success through the rest of this year and upwards and beyond growing at a massive rate, great product, our clients are loving it. We're hearing some great things about it. So thanks again for today's show. You look after yourselves and we'll catch up with you soon. Take Care now.

SEAMUS

Thank you.

OUTRO

And just before you go. And if you're curious about how this episode links with the ability to scale your MSP to a million or all of your already there, accelerate to five, then one invite you to come and take the MSP marketing quiz and in just three minutes you're going to get a 300 and seat for you scan of your business where you can identify the one or two tactics that help you find more time engaging new people help generate movies in the world. It's really simple. Just click on the link in the show notes and if you have enjoyed this episode, we'd love to get some feedback from you by means of a rating review on Spotify or iTunes or your podcast platform, your choice. We really appreciate every single one of them. Now you can go and enjoy the rest of your day and we'll look forward to catching up and connecting with you soon.