Cybersecurity is inherently complicated. It\u2019s not an easy job, and it\u2019s a never-ending one as well. There\u2019s unfortunately no such thing as \u201ccompletely secure\u201d. There\u2019s \u201cmore secure\u201d and \u201cbehaving securely\u201d, but you\u2019ll never finish the game. Cybersecurity is a constant cycle of challenge and response.<\/p>\n
Many businesses can only make their cybersecurity<\/a> as strong as their budget and human resources constraints allow. This can be frustrating for people working in the field. To us, it\u2019s obvious that we\u2014IT providers, security analysts, CSOs, etc.\u2014should do everything necessary to ensure our organizations are as secure as possible.<\/p>\n At some point, however, we have to understand that the concept of \u201ceverything necessary\u201d is an endless pursuit. You have to prioritize<\/a>. As security providers, we need to be able to choose which initiatives and investments will have the greatest return. This is true not only for the security protocols and procedures we put in place internally, but delivering managed cybersecurity solutions<\/a> to customers as well.<\/p>\n It\u2019s no secret that demand for cybersecurity services is skyrocketing. Managed service providers (MSPs) and managed security service providers (MSSPs) are shooting themselves in the foot if they\u2019re not focused on growing in the current market. But it\u2019s also no secret that the labour market is tight<\/a>. Highly trained and educated cybersecurity workers are expensive, and even entry-level tech employees are hard to find and retain<\/a>.<\/p>\n So for MSPs and MSSPs trying to grow their business, the options can seem limited. You can try to hire more people, which costs time and money, or you can try to become more efficient with the resources you have, which comes with its own set of challenges. Which is the better path?<\/p>\n The answer is neither, and both ?.<\/p>\n People can’t have every skill set. This is something MSPs need to recognize when it comes to cybersecurity. Your people most likely wear a few different hats with regards to their roles and responsibilities. If your budget is strapped, think about how you can be efficient with the money you have. Can you be creative and still provide a great return<\/a>?<\/p>\n When I talk to MSPs and MSSPs, a lot of the conversation is around how to do more with the same amount of people. For a company that provides services, outsourcing and automation might seem like an oversimplified response, but we\u2019ve had a lot of success when we present this in a realistic and constructive way. We\u2019ll ask, “What roles are you having trouble staffing?” as well as “What do the people working for you now like most? Where are they more valuable?”<\/p>\n The idea is: focus your attention, resources and manpower on your existing services that are profitable and appreciated by clients, and then find alternative solutions (be it outsourcing or automation<\/a>) for other projects you want to accomplish. Hone in on the high-value, client-facing activities, and fill in the gaps for the less-exciting (but nevertheless important) stuff.<\/p>\n Standardizing and automating as many operations as possible can help MSPs create a formulaic revenue model based on customer profiles with similar needs. Organizing the services you provide around specific verticals or target markets will also help implement a rinse-and-repeat strategy<\/a> for your business that will increase your monthly recurring revenue<\/a>.<\/p>\n There are solutions out there that can help you deliver cybersecurity while maximizing your current staff capacity and continuing to add value for clients. Some Sherweb partners have been able to double the number of clients they could manage with the same number of staff. It\u2019s not magic, it\u2019s simply outsourcing time and labour-intensive activities like alert monitoring<\/a>, incident response management and SOC activities. This gives you more time to focus on new projects that make your MSP business more profitable<\/a>.<\/p>\n Remember: you don\u2019t need to say yes to everything. Sherweb partners that have seen the most success in the cybersecurity realm are the ones that say no. That sounds crazy, saying you\u2019ll have more business by declining business, but we\u2019ve seen it over and over again. Building out a standardized stack for security automation<\/a> as well as a standardized procedure by leveraging PSA or RMM will give you a dependable practice with consistent results.<\/p>\n The MSPs and MSSPs we work with that grow the fastest are the ones who present a succinct offering. They say, \u201cI’m replacing your firewalls and router\u2014 your network equipment. Here’s my antivirus software. Here’s my EDR software.\u201d It has to be standard. Once you have that, you can go above and beyond with special projects to your heart\u2019s delight.<\/p>\n Becoming more efficient with the resources available to us is a much more reliable path to success than trying to solve the labour crisis by ourselves. However, while automation, standardization and outsourcing will help address your capacity requirements and ability to scale, you\u2019ll never be able to ignore the HR side of things<\/a> completely.<\/p>\n We know that the number of cyberthreats increase every day and incidences of successful cybersecurity penetrations<\/a> continues to accelerate. The damage done per successful security breach is also increasing, despite the fact that we have more security tools at our disposal than ever before. And yet, fewer qualified humans are available to fill positions in the field. The cybersecurity talent supply is significantly lagging behind rapidly growing demand.<\/p>\n If you\u2019re currently trying to find experienced cybersecurity talent with specific knowledge of the role you need filling, you\u2019re probably banging your head against a wall. These people do exist, they\u2019re highly educated and specialized, but you will struggle and compete to win them. If you succeed, they will be incredibly expensive, because supply.<\/p>\n On the other hand, finding personnel willing to perform work such as overnight security monitoring<\/a>, alert response and incident management is also a challenge in the current labour market. There\u2019s no simple fix for this. But that doesn\u2019t mean there aren\u2019t any solutions.<\/p>\n One of the things we’ve done internally is train existing IT employees<\/a> to be cybersecurity specialists. We start by providing targeted training. Later, we assign them tasks assisted by automation and AI. Then, more high-level cybersecurity analysts provide further training on a number of standardized cybersecurity jobs.<\/p>\n Hiring in IT isn\u2019t easy, but it’s still easier than hiring cybersecurity talent specifically.<\/p>\n Another potential solution is grassroots and educational activities that drive people toward STEM subjects. If more people are exposed to the field of cybersecurity, it\u2019s only natural that more people will subsequently consider it as a career option.<\/p>\n Sherweb works with academic institutions to create intern opportunities for students in cybersecurity programs. Collaborating with schools gives us an opportunity to create our own talent pipeline and influence the skills employees come with after they graduate. There\u2019s also the potential for these interns to return to us as full-time employees, bringing our efforts full circle.<\/p>\n Now is the time to capitalize on cybersecurity demand. There\u2019s a lot of business out there for MSPs and MSSPs to take on. Even if you don\u2019t have the capacity right now, you can be more productive with the tools currently at your disposal by standardizing, automating and outsourcing processes wherever you can.<\/p>\n You could also leverage a partner like Sherweb<\/a> to help you make it happen. By offloading menial tasks on our services, you can then reserve your best talent for where they matter most, on the front lines of your business with your customers. Sherweb provides services specifically designed to fill gaps on MSP security teams<\/a>. Some of these roles are simply things nobody wants to do\u2014nobody wants to respond to an alert from a security system on a Sunday night\u2014 but that are crucial just the same. We can also assist with higher-level tasks and business strategy,<\/a> empowering MSP partners to achieve their unique goals.<\/p>\nScaling your security business<\/h2>\n
Short-term solution: Make the most of what you have<\/h2>\n
Standardize and automate where you can<\/h3>\n
Speaking of labour crisis\u2026<\/h3>\n
Don\u2019t shy away from this opportunity<\/h2>\n