Mastering the Fundamentals - Stephen Semmelroth - Channel Security Secrets - Episode #5 - Channel Security Secrets

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Lou Rabon (00:01):
Welcome to Channel Security Secrets. I'm Lou Raban.
On this show, we expose theuntold secrets and critical
insights from the people shapingthe future of cybersecurity
sales in the trusted adviserchannel. If you're looking to up
your game around sellingsecurity, stick around. Channel
Security Secrets is brought toyou by Cyber Defense Group on a
mission to shift cybersecurityfrom reactive to resilient.

(00:38):
I'm really excited to speak to with today's guest.
He's a cybersecurity leader, goto market coach, published
author, and US army veteran. Asa global ambassador on the
Council for Responsible AI, heis shaping the ethical future of
AI and cybersecurity. He's aformer army ranger who led cyber
teams and infantry platoons inAfghanistan and now acts as a

(00:58):
lifetime member of the MCPA orMilitary Cyber Professionals
Association. He's currently vicepresident of cloud resilience at
Avant Communications.
Stefan Semmelroth, welcome tothe show.

Stephen Semmelroth (01:09):
Thanks, Lou. Glad to be here. It's always
weird kind of, you know, hearingthe stuff that you've done in
the past. I introduced myself asStefan.

Lou Rabon (01:17):
Yeah. Well, we know that you're humble, but you're
you're also a badass. So as oneof the first guests on this
podcast, I am very, very honoredto have you here, and I can't
wait because we're gonna have agreat conversation. And with
that, I'm gonna just jump rightinto it. This is channel
security secrets.
So I wanna hear what is thebiggest secret to your success,

(01:41):
which is very deep in thechannel.

Usually, we talk about success in terms of
knowledge, skills, and eitherabilities or behaviors. And so
I'd say probably the first perpart is the foundation knowledge
of kind of what's going on inthe industry and tech and cyber.
I can give a big shout out to,like, my mentors when I was in
the military, the education thatwe had in the military, and, you

(02:07):
know, the the the books thatwere written, steal this
computer book versions one,three, and four from years and
years and years ago. Books like,hackers, the heroes of the
computer revolution. You know,we're going way back here.
A lot of those knowledgefundamentals. And then the
skills were developed fromcoaches and mentors like Kim

(02:32):
Baker when I was at Stratacoreand the amount of investment
that he put in me personally tobuild that skill. But I would
say, as those are kind of likethe foundations of the pyramid,
the the top of the pyramid, Ithink, is has been the, ability
to translate highly technicalcontent and roadblocks into

(02:58):
meaningful stories that non techexecutives can use to take an
action. And, it's been tough todo that, but and you do have to
have that that, you know,fundamental attack. At least I
had to have that to to get tothat point.
But the knowledge, the skills,and then the abilities, I

(03:19):
oftentimes see myself as a coachor translator more than I do
almost anything else.

Lou Rabon (03:23):
Yeah. Big tell you are that for sure, and everyone
knows who you are in the channelwhen it comes to security
because of that. You alsomentioned this book that I gotta

Oh, yeah.

Lou Rabon (03:35):
Yep. Knowing above and below the line, and and you
mentioned so, obviously, booksand reading are really
important, and and following theprinciples in that book. I
haven't cracked it yet, but, youknow, what can you tell me about
this? Yeah. I got it based onyour recommendation, and it's
that's why it's sitting on mydesk because it's next in the

(03:57):
queue.
You think that there's somesecrets in there that that
people can use?

Yeah. Yeah. So so when I was a trusted
adviser, at Stratacore beforecoming to Avant, a shout out to
Dom Singer who who kinda sat medown, and he goes, Stefan, you
need to read this book. This isthe next book on on your list of
professional development. And,you know, when when he said that

(04:27):
you know, first off, I'll I'lllisten to mentors like Dom.
But when Dom said that, I kindasat back and went, another sales
book. I'm only reading thisbecause you asked me to read it
or told me to read it moreemphatically. And then I was I
was doing some drywall work atthe the last house that we had.

(04:49):
And I'm doing drywall, and I'mpainting, and I'm listening to
the book, on audio, probably attwo x because I'm painting, I
can actually, you know, kind offocus. And as he got more into
it, as as Skip Miller got moreinto the the content, I went,
oh, man.
And I I sat down. I took my youknow, the the latex gloves off

(05:14):
that I was using because I waspainting and making a big old
mess. And I hopped on Amazon andordered the book and print copy,
which for me is at least at thatpoint in my life was a big
litmus test of, okay. This isthis is good, and I gotta spend
some more time onto it. And, youknow, it's it's right here in
it's in my quick grab book areabecause I I recommend it so

(05:36):
much.
But, you've got, like therethere's perceived quality of fit
type things. I've got, you know,notes all over this book. And, I
think for me, the reason that,when Skitt Miller wrote this,
that it resonated so well is,for me, it translated the

(05:56):
fundamentals of leadership andchange management that I learned
in the military to the corporateworld and did it so simply that
it was really easy for me tolatch onto. And this has been
sort of kind of like one ofthose guiding as myths as I
build out training for theindustry that I try to focus a

(06:20):
pretty substantial amount of ourtraining wrapped around this
book in particular. I think itdoes a really great job of
modeling the sales process, thevalue prop, and figuring out who
it is that we're really talkingto on the other side of the
table when we support trustedadvisers out with their clients

(06:40):
in the field.

Lou Rabon (06:41):
Good stuff. So basically, you know, the biggest
secret would be one is,obviously, you know, providing
information, providing value.The other is, you know, reading
the right books. So this thisbook in particular, I know that
you mentioned, like, speaking todifferent stakeholders,

(07:02):
controlling the tempo of tempoof a sale, jumping around the
org chart. Like, what what canyou tell me about that when a a
security deal is coming in andand, you know, there's some
maneuvering that has to happen?

So when we when we go back, I think one of
those fundamentals that most ofthe people in sales in this
channel have learned is thatfinding the compelling events
and then translating that into aplan is often the key to change
management. I think that salesis often the key to change
management. Right? Like, what isit we're going to change? How is

(07:37):
the world chain I'll throw alittle Andy Raskin on it.
How has the world changed todaysuch that you must do something
or change yourself? And one ofthe thesises of of Skip Miller's
book is that when we go back tothe basics, especially for
salespeople, the things thatthey learned as like a BDR, they

(07:58):
resonate and they worksextraordinarily well. So we talk
about, like, a security dealgoing from identification and
qualification and thenmaintaining that urgency to get
to close. Right? Often, one ofthe things one of those
fundamentals that I pulled backout of Skip Miller's book was

(08:19):
building a visual timeline forclients.
And I think a lot of salespeoplehave gotten away from some of
those fundamentals. I think it'sreally easy to focus on, like,
feature, function, capability,differentiator, where the
people, the talent are locatedthat you're bringing in to solve
the problem. But building thattimeline is a visual

(08:43):
representation of urgency.

Lou Rabon (08:46):
And

I didn't I as we as we kinda started, you
know, talking through andteaching timelines in our events
across the country around theworld, I did not anticipate the
number of senior late stagecareer sellers that would come
up after, like, keynotes orafter presentations and say

(09:09):
things like, oh my gosh. I'vestrayed so far away from my
fundamentals. I've I've reallyinvested into the art of
selling, and I forgot thescience of selling. And it's so
important to blend both.

Lou Rabon (09:21):
So that timeline that you're talking about, visual
timeline, you mean specifically,like, here's when kickoff is,
here's how the project's goingto go, here's, you know, here's
roughly where you will be in xamount of time, six, twelve
months after doing this stuff.That that's what you're talking
about?

Absolutely. Yep. So, let's see if I can find
an actual timeline here. Skipcalls it the iDate, which is the
implementation date, and that'swhen the go live really has to
happen. And so we've kind ofadapted it for channel sales and
for security a little bit more.

(10:01):
But if the client has anincumbent right now, what we've
been really doing and looking atand training on is the two
primary dates of when do theyhave to give notice to the
incumbent, and then when istheir implementation date.
Because sometimes thenotification date to the

(10:22):
incumbent is the key thing thatmoves us along. So they might
have to have a ninety daynotification clause in there.

Lou Rabon (10:30):
Mhmm. Mhmm.

Or sometimes it's the implementation date,
like, you know, driven byprivate equity change or a
merger and acquisition orsomething. And so often, we go
from there to backwardsplanning. And if we don't have,
like, a meaningful driver, maybeit's greenfield and something
the client wants to do, thenusually the tactic that we take
is we start looking at theproject timeline itself. What

(10:52):
are the other projects andpriorities that exist? Where
does it fit in that?
Where will the clients peoplehave the capacity to even do a
project, whether it's softwarebased or more consulting based
because there's so manydifferent layers to this. And
then we use those opportunitywindows, those change windows as
kind of the driver to workbackwards from. And, that

(11:13):
process then you know, we've runkind of this timeline process
now. We'll say dozens and dozensof times, maybe a 100 times. I
don't know.
I haven't I haven't tracked thisspecifically. But when we've run
those timelines, a good portionof the time of the the
opportunities when we're helpingclients work through this, The

(11:36):
conversation starts off with,oh, my renewal's not until, you
know, a year from now. And thenby the time we look at change
windows and implementation dateand notice date, we work
backwards, etcetera. By the endof a call, they're sitting there
going, oh my gosh. I'm threeweeks behind in my process.

Lou Rabon (11:53):
Mhmm. Yeah. So so having that visual tool to to
give them a timeline, that's agreat sales sales tool, and that
helps close deals. In any case,it doesn't matter whether it's
security or not.

Because it's not my urgency. It's the
client's urgency.

Lou Rabon (12:10):
And pain. Right? It's all about the pain. Or you know,
whether it's immediate orfuture. What about the number
one piece of advice specificallyaround security?
There's a lot of TAs that aretrying to sell security. We come
across it a lot. That's that'sreally the reason that we
started this podcast too,because so many people want to

(12:31):
get into selling security as atrusted adviser in the channel.
What what kind of advice can yougive to the TAs that have never
sold security before?

Yeah. It's so much easier than they think.
It's so much easier than theythink. And when I sit down with
a trusted adviser that wants toget into selling security, one
of the first questions we ask iswhat is your key differentiator
right now? What's your keydifferentiator?
What's your value prop? What areyou really good at selling?
What's the base of clients thatyou have today, and what have

(13:03):
you sold into that base? Becausethe add ons are the next best
thing to do. So if you talk to aclient or a trusted adviser,
you've talked to a trustedadviser that has sold
connectivity for the lastfifteen years, really difficult
for them to go from connectivityinto managed detection and
response.

Lou Rabon (13:23):
Mhmm. Right? Technically, yes.

Yep. It could be. So then we'll start
with, okay. Well, what aboutzero trust network access? Or
even easier than that, DDoS.
If you're selling circuits, sellDDoS. Why? Because if they start
with that, it's basically someobjection handling and not much
more. And it gets the trustedadviser repetitions at something

(13:51):
that's just outside of theircomfort zone and not too far out
of their comfort zone. And thenthey start getting reps of
going, oh, you know what?
I can do security. I've got thiscapacity to do security. You go,
okay. What's next after that? Ifthey're cloud, then we say,
Great.
Cloud. Well, maybe how are yougonna govern the cloud? Or what

(14:12):
about backup and disasterrecovery? Probably the easiest
add on. And then you'remessaging when as a trusted
adviser, when you have thesestarting conversations with your
clients, you're telling themthat they that you do security.
Next thing you know, they'recoming to you for, all of the
fractional CSO or therestructure of their system. You

(14:34):
start to be more indispensableto your clients, and you're
starting to upsell cross sellinto more things, and you're
really helping them get to thatnext phase or move that next
needle or get to the nextmilestone or get to that next
summit along the ridgeline oftheir journey.

Lou Rabon (14:49):
Yeah. Great advice. How do you, address the fear of
the deeper conversation? Becausethat's what we see a lot too,
right? It's like, well, I wantto talk about security, but I
don't know enough about it.
And I'm afraid that they'regoing to just start talking, you
know, like even backup anddisaster recovery, business

(15:10):
continuity, things like that.Like, if they've never sold that
before and they just put out abuzzword or two, I I've we we've
gotten a lot of pushback like,well, we don't understand it, so
we need to understand it first.

So I go back to the genesis of why this go to
market motion exists in thefirst place. This is the
business of, I got a guy forthat.

Lou Rabon (15:33):
Mhmm. Yeah.

Right?

Lou Rabon (15:35):
Yeah.

And the trusted adviser does not have to
be the technical expert nor theyshould they be in most cases.
And so often, what we traintrusted advisers on is very
simple. You as the trustedadviser do not have to design
and build airplanes. All yougotta do is sell

Lou Rabon (15:55):
seats. Yeah.

Sell tickets. That's it.

Lou Rabon (15:59):
Open the open the airplane door, essentially.

Yeah. Yeah. Exactly. Yeah. Hi.
Welcome to flight 93.

Lou Rabon (16:07):
Right. Right. You know, the the pilots and the the
air whatever hostess orhostesses are are gonna take
care of you. Yeah. Big time.

Absolutely. Like, they don't you don't have
to know how each of those littlefins around, the turbines are
stamped and then pressed andthen soldered and welded. You
don't have no. No. No.
You wanna go from O'Hare to SanFrancisco? Yeah. We've we've got
competitive rates for that, andyou're gonna love the
experience.

Lou Rabon (16:35):
Exactly. Get on board and or, yeah, we'll have a an
agent speak to you about that.The agent being, you know, now
the supplier, like us where wewould we would be able to have
that conversation, navigate it.

No. I've I said something there that I
think I should probably do alittle expansion on if you don't
mind.

Lou Rabon (16:52):
Go for it.

Yeah. Then the next step, I can it's it's
pretty cheekily that I can say,oh, yeah. We're in the prod the
the business if I know a guy.But there's also a really
important other distinction hereis that when trusted advisers
look at the buyer personathey're most comfortable with.
If it's a director of IT, well,we're gonna kinda pick those

(17:13):
next security adjacent thingsthat that buyer persona wants.
And what most people areactually scared of is not the
technical discussions. What mostpeople are actually scared of is
the CISO as a buyer persona.

Lou Rabon (17:33):
Oh, yeah.

Because the CISO happens to be a technical
expert, and they're often thesmartest person in the room.
I'll give another shout outhere. Let's see. Do I have the
copy over here? I do.
Christian Espinosa actuallytells in this book here called
the smartest person in the room,my buddy Christian says, hey,
CISOs. Stop being jerks. That'sbasically the thesis of a book,

(17:54):
and it's a great bunch.

Lou Rabon (17:54):
Oh, yeah. I mean, the the the vendor, abuse. There
there's a certain type ofperson, you know, they say you
can tell a person by the waythey treat, you know, help,
hired help or waiters andwaitresses and stuff. You can
also tell a person by the waythey treat a vendor. Right?
And unfortunately, I you know,we've come across this often
where vendors are just like,you're bothering me. You're at

(18:17):
you know, buy me some steakdinners. You you know, you're
just a tool. You know, there'shumans behind this. So I think,
yeah, that's, maybe a little bitof the the trepidation too exist
because people have had trustedadvisers have had that
experience where they've gottenkicked and beat up because
they're, you know, they'resalespeople.
They're going out. They'reasking for something. And these

(18:38):
people sometimes that are in theposition of making decisions
take advantage of that. Nodoubt.

Now let's talk some dollars real fast. The
biggest security deals are oftensold to the CIO, not the CISO.

Lou Rabon (18:50):
Interesting. Why do you think that is?

So if we look at it, the CISO still most
companies still ownsinfrastructure. Right?

Lou Rabon (19:00):
Mhmm.

So what do they want? They want secure
infrastructure. So if you if wedive deep into that, that the
CSO owns backup and disasterrecovery. They own con sorry.
Hold on.
The CIO owns infrastructure.They own backup and disaster
recovery. They own connectivity,secure connectivity. They own
these really big spend itemsthat often the CISO gets kind of

(19:25):
bolted on at the end.

Lou Rabon (19:26):
Yep. Definitely.

Now we say shift left and do security early
and all this sort of stuff. Inthe end, the CISO still has a
limited scope of what they cando in the organization, and the
CIO still controls it all. Sothe c CIO's budget for backup
and disaster recovery issometimes bigger than the CSO's
entire program budget.

Lou Rabon (19:45):
Yeah. 100%.

Yep. And we look at we look at even
fractional CSO types of things.Most of those can be huge deals
on the order of dozens ofthousands of dollars a month
because you're outsourcing aprogram, and oftentimes, ideal
client means they don't evenhave a CISO or the CISO is more
of a prog program manager andsomebody's still got to come in

(20:09):
and do the work.

Lou Rabon (20:10):
Yep. Exactly. Yeah. So that's it's it's interesting.
I mean, why why should TAs sellsecurity going back to your
original where they're saying,hey, you know, I connectivity,
those deals are really easy.
This stuff that we're talkingabout right now is very can be
complex navigating the C suite.A lot of times they're not even

(20:30):
speaking to the C suite, right?They're speaking to someone in
the IT world. Therefore, we youknow, how how do you talk to TAs
when they're like, I don't evenwanna sell security. It's too
complex.
Like, why why should they do it?

First off, start easy. Start easy. Start
small. Second, if we look atjust pure connectivity sales and
the uplift for DDoS, you'relooking at somewhere between a
412% uplift on the total dealsize. So there's a financial
comp like, you sold 10 things.
Do you wanna sell another one?Yes. For every $10 here, you get

(21:07):
an extra dollar in DDoS. So justthat one little transactional
objection handling, put it onthe purchase order is a great
place to start for a 10% uplift.Like, if your growth is 20 or
30% per year and you can get athird of that just by adding
DDoS, now you need less logos tosell to.

Lou Rabon (21:28):
Yeah. No brainer.

Yep. When we look at cloud and and and backup
and disaster recovery and someof those other categories, those
are some of the easiest upsellsin channel. And, again, the
dollars just make sense.Somewhere on the order of, call
it, 10 to 15% of an uplift ontowhat you're already doing and
really, really good at right nowand focused on objection

(21:50):
handling. Yeah.
Pretty pretty easy. Puresecurity? Now I'm gonna go I'm
gonna answer this for you too.For pure security, one of the
things that we're finding is thetrusted advisers that do have
those reps. Right?
They've got those repetitions.They've done those training.
They've really gotten to knowmaybe just a couple key vendors
that have picked one line itemthat matches their base. Like,

(22:13):
if you're in the mid market orlower enterprise, like
fractional CSO or outsourcingconsulting, that program's a
really, really, really good fit.If that's your base, they match
so well.
It's something that allows youto go back to your base and
allows you to talk aboutoutcomes in the business and
makes you sticky across theorganization. So oftentimes, it

(22:37):
selling security is a part ofthe journey. It's not the
destination, and it unlocks allthese other doors because it
touches everything else thatyou're already doing. And it
really messages, I'm an adviserbecause I'm helping you think
about the things that areimportant to you, mister and
miss Klein.

Lou Rabon (22:52):
Yeah. And building trust. I mean, that's that's one
thing that we speak about aswell as yeah. We the deal, if
you're going to do data center,if you're used to doing data
center as a TA, multimilliondollar deal, you're gonna get a
nice, you know, commission checkfrom that. And it's not that
complex.
You need well, you know, howmuch capacity, etcetera. Where
in the world? Okay. Here's theyou know, get the three quotes,

(23:14):
etcetera. Much easier thansometimes a complex security
sale, but that's one timetransactional.
Okay. Maybe they sign a threeyear deal, and you're done.
However, what the trust thatgets built by successfully
delivering, you know, goodsecurity program or good
security outcomes is is reallythat that builds onto all the

(23:36):
other things that you're talkingabout, the stickiness, the
saying, oh, wow. You did such agood job introducing me for
security, and we're we're we'recranking on that now. Can you
show me more data center?
Can you show me more bandwidthor voice, whatever? You know?
So, yeah, I think that's that'sbeen our experience too. But
sometimes it's hard to to toexplain that.

Well, I think it it is hard to explain
it, and that's kind of whyoftentimes we go back to when we
talk to trusted adviser and wehelp them pick the play. Right?
Because it's not most trustedadvisers are not ready to fully
whole hog sell security.

Lou Rabon (24:16):
Right.

But when we sit back and look at their base
and pick the security play thatmatches their base, now instead
of having to learn all ofsecurity, may they learn one
segment of it and start thereand build those reps. Right? So,
like, the the difference betweena Fortune 100 financial client

(24:39):
is very different than a midmarket manufacturing company.

Lou Rabon (24:43):
Oh, yeah. So what does

your base do? What do they want? What's
your buyer persona? What's thatnext phase? Maybe it's managed
detection and response.
Maybe it's, MSSP. Maybe it's,some sort of consulting layer on
top of that. Maybe it's havingsomebody come in and kind of
retool all of your securityfunctions on top of some of your

(25:07):
other systems where you've got acost advantage. So now you can
share that costing acrossmultiple programs. Like that
like, these just what this onethread that matches your base.
Let's start there.

Lou Rabon (25:21):
Yeah. And are you seeing a lot, with a different
like, it used to be health careand finance, but now different
verticals, different industriesthat are now taking security a
bit more seriously?

Yeah. Absolutely. And I think,
generative AI is reallyemphasizing what we already knew
in the industry. And I say thatbecause, Expedia does a good job
promoting what they call thefive AI truths. And their number
five is that employees arealready using AI.

(25:57):
It's kinda like the shadow AIproblem, which is it's just a
rebranded version of what wecall the shadow IT program, you
know, a decade ago. Right? Yep.So when we dig into it, the the
fear of AI is that a company'ssuperpower, their data, their

(26:17):
intellectual property, is beingsiphoned out of their company.
That's a very valid fear.
So what we say is like, okay.Great. How do we put some
controls around that and do itin a meaningful way, put some
governance bolted onto it? So,like, who's allowed to do what,
where, when, why, how? Gee.
That sounds an awful lot like asecurity program, doesn't it,

(26:38):
Lou?

Lou Rabon (26:38):
Yeah. Oh, big time. And everyone to your point, it's
every industry. It's not thatthat's not just a health care
finance issue. And,traditionally, it's been because
they've been the ones that havebeen, you know, the higher
highest regulated.
Right? But now I don't I thinkthat no one can dodge the
bullet. I you just you saw aboutthe SharePoint, you know,

(26:59):
vulnerability that was justreleased. It it's stuff like
that. And that hits legacycompanies because it's legacy
companies that are, or legacyorganizations that are hosting
SharePoint on prem.
Like, who the hell is doingthat? A lot. A lot of companies.

Yeah. The addressable market for on prem
is still extraordinary.

Lou Rabon (27:20):
Huge. And it's almost always done, you know, kludge
together without propersegmentation and things like
that. So, yeah. You you so youwould agree. Yeah.
It it's getting it's expandingbeyond the traditional
industries where, yeah, we'redefinitely seeing gaming, man a
lot of manufacturing, which hasOT issues as well, and yeah.

We're seeing AI, generative AI specifically,
being the compelling eventthat's causing companies to go
relook their strategy foreverything, especially security
because there's so much fearabout losing their own
superpower.

Lou Rabon (27:57):
Yeah. Yeah. It's funny. We had a a discussion
with it was actually arecruiter, last week. I was
speaking to someone, they werelike, wow.
AI this. And what is, you know,like, how can someone get an AI
security? I said, again, to yourpoint about the basics in
selling, the basics in security,it's like, where is your data?
AI security is data securitybecause to your point, the IP

(28:20):
could be going out the doorbecause you don't have the
proper controls to know whenyour data is going through the
door. So it's funny how it allcomes down to back to basics.
Right?

Yep. It it's going back to the basics,
whether it's a sales process orsecurity process or AI, it's the
same problem just reskinned.

Lou Rabon (28:44):
Yeah. Big time. So so last question on the TA front.
You know, what a TA wants to getramped quickly, in selling
security, what's your advice?And before you answer, I I will
interject that.
Yvonne, I know has a lot of, youknow, we we sponsor some of
these elevates, obviously, andstuff. So I'm assuming that's

(29:04):
gonna be one of the ways. Yeah?

Oh, yeah. Absolutely. So make sure you
come to the Avant Special ForcesSummit this September.

Lou Rabon (29:12):
Mhmm.

So we we've built a substantial amount of
content to try to make thiseasy. So everything from
everything from how do you gotell your clients that you play
in the space to targeting andprospecting and trying to

(29:34):
understand some of the storiesthat are out there. So we have
case studies about, like, theConti ransomware group that's
been now been disbanded, andit's kind of repop its head up
in different ways. We've gotthese stories that exist about
what the threat model lookslike, and then we've got the
here's how to go sell it. And wealso if you're more technical,

(29:55):
we've got those things aroundlike, gee, what the hell are all
these stupid acronyms?
Which ones do I need to payattention to? And I often say
that acronyms are a distractionbecause there's 800,000,000
acronyms in this space, and eachof those are worth a dollar. So
do you want a dollar, or do youwanna go transform your clients

(30:18):
in a more meaningful way whereoutcomes are aligned with
capturing revenue? Which I stolefrom you, by the way.

Lou Rabon (30:25):
Yeah. You didn't steal anything. I I love it.
It's the way the whole industryis going, but, yeah, you know,
I'm all about the outcomes.

But but it's but it's but it's super relevant
here. Right? Like, the acronymsare often a distraction
distraction for change. And theoutcomes are keep the business
up and running, prevent againstthe bad guys, whether they're in
a different country or youremployees, and keep the business
up and running. Wait.
That's two of the top threethings. Weird. But it's it's

(30:57):
that's that's the fundamental.Right? We're not trying to get,
you know, a PAM solution, a ZTNAsolution, and a DDoS solution,
and blah blah blah blah blahblah.
What we're trying to do is keepcompanies with the ability to go
to market and win. Give them theposture they need to win over
and over and over again andadapt in a way that allows them
to fight Porter's five forcesinstead of fighting Conti

(31:19):
ransomware groups and theirequivalents.

Lou Rabon (31:21):
Exactly. And that's where the ROI, which I know
we've we we both are bigproponents of that security is
an investment. It's not a costcenter. So I think those are the
conversations I can, move theneedle. And then, yeah, when
when if a TA wants to get up andrunning quickly other than
reading, you know, and and goingonline and seeing, the vendors

(31:43):
will confuse the hell hell outof you to your point.
I I remember one time you askedme, well, all these acronyms
just around zero trust. And I Ikinda fudge it because I thought
they were all the same thing.And then you educated me that
there's actually even more thatI didn't even know about. And
so, yeah, I think going tovendors probably not necessarily
the best if especially ifthey're trying to sell a silver

(32:05):
bullet, but going to a, youknow, a partner, like a bond to
be being able to to understandmore about, you know, how do you
get past the noise?

Can I riff on that for just a second? I'm
gonna take kind of a slightlyposing view. Yeah. Yep. Six
years ago in the channel space,the vast majority of vendors did
not know how to positionsecurity in general.
In fact, many many of thevendors in this space were
companies that bolted onsecurity to their own offerings.

(32:38):
They weren't necessarilysecurity companies.

Lou Rabon (32:40):
Right.

I will say over the the last the last six
years, being able to watch theindustry get better and better
and better, I would say that asit just does a litmus test, many
of the vendors are substantiallybetter at talking about their
ideal client profile. Like likethat like, no BS. This is what

(33:05):
we're good at, and this is whatwe do. Here's how you can go
find business with us. Mhmm.
They're, in general,significantly better, and I
think we've passed thatinflection point about three
years ago where, you know,myself and and you and other
advocates in the industry havereally been pushing to find the

(33:29):
signal through the noise. AndI'm not saying go blindly trust
every supplier in the ecosystem.Right? What I will say is at
least the content is better. Ithink we're probably out of the
tunnel, and we're starting to tobe out.
Like, we made it through thetunnel. We can see the light.
We're outside, and now we're alljust trying to figure out which
direction do we go now thatwe're out of the tunnel.

Lou Rabon (33:50):
Yeah. That's a good point. It's those
differentiators too, beingeverything to everyone. I mean,
I've made this analogy beforewhere it's like, we don't wanna
be the cheesecake factory ofsecurity. We wanna be the In N
Out.
Like, you're gonna come for aburger. You're never gonna see a
chicken burrito on an in and outmenu or at least, you know, not
not for the foreseeable future.And, the same same with the

(34:13):
security providers. Definitelyfor us, that's our goal where we
would say, hey. We'll do this.
We'll do a pen test. We'll dothese these projects. And we're
saying, we're the securityprogram company. That's why
you're coming to us. And so eachvendor saying, hey, you know,
there's MDR vendors that we'redoing fractional CSAVC.
So they're shedding that now orthey, you know, most of them
should be because they'resaying, okay. This is our core

(34:35):
competency. I I think it's a afallacy to think, yeah, we can
capture all this stuff, and it'sgonna be land and expand. We've
learned the hard way that it'sbetter to just, you know,
differentiate and andconcentrate on what you're good
at. So I think it's good to seethat.

Well, and everybody has their own scope
and scale. Right? So, like, foryou guys, that absolutely makes
sense. Yeah. But there are somethere are some vendors out there
that can do a substantial amountof things that their clients
need, and that's why trustedadvisers come to us to help
shepherd them which directionthey want to

Lou Rabon (35:06):
go. That's right.

Like, just because just because Lou can do
pen test doesn't mean you shoulddo just a pen test unless
there's maybe follow onopportunity and more of a
meaningful outcomes drivenmonthly type OpEx spend.

Lou Rabon (35:18):
Voila. Yep. Exactly. So how do you how do you feel
that security in the channel isevolving? Already, you've
brought us kind of on a journey.
Where where where do you thinkit's going? Is it is it going to
continue to differentiate wherevendors are gonna, really kinda
hone in on the things thatthey're good at?

Yeah. So I think at a macro level, if we
look at you know, we go back andlook at a funding perspective.
The vast majority of companiesthat are in the security
landscape, like if you look atthe Optiv cybersecurity map or
some of those other landscapemaps that are out there, I think
we're going to see a substantialnumber of AI security startups,

(35:59):
which are going to tackle AIsecurity in a number of
different ways, but I thinkthat's just one quadrant of that
map. I think the rest of thatmap will actually consolidate.
There'll be winners and losers,and we'll see fewer options
across all of those differentareas of that giant grid of all
the other landscape that are outthere.

(36:20):
And we're seeing that we'reseeing that with those
consolidations. I thinkconsolidation will be the name
of the game, and I think thatthe majority of those
acquisitions will actually be toround out one company's base and
offerings for things that areadjacent that make sense. So,
like, on the data security side,like data discovery, data

(36:41):
classification companies are nowstarting to merge into really
DPSMs, data posture securitymanagement, as, like, again, who
can touch what, where, when,why, and how, and can you audit
it and maybe even block some ofit if required? I think we're
gonna see those a lot of thatconsolidation happening in the
space, and it'll be fun towatch.

Lou Rabon (36:58):
Oh, yeah. And, yeah, basically, everything will be
owned by Palo Alto soon. So

Well, they did make a early bet on APIs and
bought a bunch of companies andcontinue to bond by a bunch of
companies that are API driven.But I also, I also think that,
while they move fast, theirability to charge a premium on
all of those companies that theybought is turning many clients
away because they don't wannapay the premium.

Lou Rabon (37:25):
Yeah. And also the it's it's kind of the Mac fee
model from fifteen years ago,which is buy you know, acquire
everything and then poorlyintegrate it. Give a promise of,
you know, one single pane ofglass, the elusive single pane
of glass, and then don't executeon that. And, you know, I think
that there there's gonna be alot of growing pains there.

(37:46):
Maybe in the new technologyworld we live in and with a
little bit of AI and ML, youknow, sprinkled on top, Maybe
they can come close to achievingit, but I think it's definitely
the Palo Alto acquire everythingand integrate it.
It's it's a lot harder than thanexpected. And look at Google, if
if you wanna see what whatthey've done with some of the

(38:07):
the acquisitions. We'll see howWizz goes, but I think
consolidation to buy, mindsharing to kill competition, you
know, it may their jury's stillout if that's a good thing or
not. We'll see.

I I don't know, but I I think that the in
general, the map will actuallybe smaller, especially because,
a lot of those venture backedcompanies are at the end of
their cycle, and they're lookingfor some sort of an exit.

Lou Rabon (38:35):
Big time.

And their investors are demanding an ROI.
And so we're gonna continue tosee these layoffs at the product
vendors. I'm specifically rightnow, I'm talking about, like,
the product vendor ecosystem,not the service provider
ecosystem. Right. But we'regonna continue to see layoffs as
they get closer and closer tothose exits, so their their
price to earnings will gohigher.

Lou Rabon (38:54):
Yeah. Final question I'm gonna transition to more
about Stefan. Uh-oh. Whatexcites you about the future?

Oh, man. There's there's a few things to
to kinda tackle this. I do likeI I do tend to like a market
that that shifts and changes alot frequently.

Lou Rabon (39:20):
Yeah. It suits your personality?

Yeah. Yeah.

Lou Rabon (39:24):
Yep. Yep. I think anyone in cyber in in security,
it's like constant learning.We're we're kind of addicted to
constantly learning autodidacts.

Yep. Yeah. Oh, for sure. Right? And, like,
the more chaos in the industry,the more opportunity there is.

Lou Rabon (39:41):
Yep. A 100%.

So it's it's fun to watch that. It's and it's
also fun to be at a distributorwhere, we can also sort of shape
that sometimes

Lou Rabon (39:49):
Yeah.

And be a part of it, and figure out, you
know, when when thoseconsolidations happen or m and
a, etcetera, like those changes,how do you message that and turn
that into an opportunity sopeople can capture the
opportunity there? I think it'sit's a blast. It's super, super
fun. I also some you know, Ihave I have cloud as well. And

(40:15):
so the uncertainty that Broadcomand VMware are injecting into
the market is substantial.
And so watching kind of watchingthe market shift and we talked
about on prem. So watching themarket shift from, like, on prem

(40:36):
and hyperscalers towards thatmiddle of, like, the colo and
infrastructure as a service andeven those hyperscaler, like,
partners that are out there.Watching the kind of the client
base compress towards the middleof that evolution change has
really interesting. I think thatclients in general, companies

(41:00):
not even think. I'm watchingthis happen in real time, you
know, working with TrustedAdvisors clients out in the
field at our Battle Labs atHavant in Chicago and and
Houston Dallas.
Dallas. Watching clients realizeand rethink their entire cloud

(41:20):
strategy is happening because ofgenerative AI right now.

Lou Rabon (41:25):
Do you mean because the the data centers are getting
they're they're expandingrapidly and compute is getting
cheaper, or do you mean peopleare asking ChatGPT more?

Well, all of the above. But as we dig into
it, like, boards are askingtheir CIOs and CTOs, what are
you building that's going tochange the game? And that
question like, they got theyhave to find a really
interesting way to answer it,and there's two things that they
need to do for slowing themdown. Number one is how do they

(41:59):
find the funds to buildsomething that will change the
game? And that means probablymoving out of a colo or moving
off of a hyperscaler becausethey didn't refactor their
workloads.
Right. And as there as thatcomes up, the second thing
that's slowing them down is someof this uncertainty around
virtualization in the market.And so when you tie price

(42:21):
compression and a need to tounlock dollars along with this,
I gotta go build some AI stuff,that's part of why we're seeing
this compression towards themiddle of, like, the Colo, IaaS,
and Hyperscaler, like, partnersthat are out there. And so
they're trying to find thedollars to make the investments
to do this stuff, and it allhappens because the board wants
to know what they're buildingwith AI to change the game.

Lou Rabon (42:44):
Yeah. And Broadcom just completely destroyed
VMware, and, you know, I thatthat strategy is very confusing
to me, but I don't wanna go toodeep into that.

It's an interesting thing to watch.

Lou Rabon (42:56):
Yep. Yeah. Definitely helps. And and it destroys
obviously, there were a lot ofSMBs that were, you know,
managed service providers, ITcompanies that were relying on
that, and they it really kind ofdestroyed their business model
to a to a certain extent or madethem pivot really hard.

And it's gonna be tough for them. Yeah.
You know, that, like, the, youknow, the the whiplash,
especially for those smallerMSPs and even some of the large
ones that didn't make that listof 15 in North America, boy,
they're they're in a tight placeright now, and they've gotten
till October 31 to come up witha really good plan.

Lou Rabon (43:31):
Yeah. Oh, yeah. Gonna be interest So

And then how do you secure it?

Lou Rabon (43:36):
Voila. Voila. And so so let's transition to you
personally. I mean, listen. Youknow, what got you here?
I can say, you know, you're inChicago, originally from that
area. And West Point, you wentto West Point for undergrad.
First, like, what what made youwanna West Point is amazing, by

(43:56):
the way. And, I I grew up notfar from West Point, so I've got
a, you know, soft spot for thecadets there, that used to tear
the town up, the small town of.

Right. You're from Poughkeepsie. Right?
Newburgh. Newburgh.
Oh, close. Okay.

Lou Rabon (44:12):
Yeah. Yeah. Yeah. So not far from Poughkeepsie. Yeah.
So Newburgh, there there were anumber of places, bars. Yeah.
Really interesting times. But,yeah, the what made you wanna go
army in West Point?

Yeah. So, my grandfather growing up, we'd be
sitting around the table andkind of the the hero culture
that we built in the family thatmy my grandparents on both sides
of the family built was that ourfamily, on both sides of the

(44:47):
family, we do hard things. Butmy grandfather would tell
stories about men and women thatdid incredibly difficult things.
So, like, reading Reader'sDigest excerpts about, like,
Amelia Earhart growing up andCharles Lindbergh and, like,
these other, you know, notablepeople in history that that did

(45:09):
something that everybody elsethought was crazy at the time.
And, know, the resilience ofbeing able to get back up when
things go wrong over and overand over again.
And then I I saw that mygrandfather was a business
owner. My on the other side ofthe family, my family were were
farmers and at one point had,like, a sawmill. And it was go

(45:30):
do tough stuff. What's thehardest thing you can do? Go do
that.
And so I remember this distinctmemory, and I think it was
junior year of high school. Iwas walking down the the the
senior hallway, and they justput all of the college and
university posters all down thehallway. And everybody was kind

(45:51):
of flocking over us in Illinois.So everybody was flocking over
to, like, you know, IllinoisState and Illinois University
and and, University of Chicagoand all all the local ones. You
know, University of Michigan wasup there, and no one was looking
at the one all the way down,which was West Point.
And I was like, well, ifeverybody's doing all this
stuff, it must be easy. So I'llgo take a look at that.

Lou Rabon (46:14):
Ignorance is bliss. Right?

It's Anthony. Yep. And and it was it
was phenomenal a experience. Youknow, the the exposure that I
got to have there to to peopleon, you know, on both sides of
the aisle, congressmen,senators. You know, routinely,

(46:36):
we had, like, astronauts, otherextraordinarily distinguished
people.
And, one of my roles, because Ihad this, you know, closer to
the top of my class, one of myroles was to kind of, shepherd
those people around, and I gotto learn from them while I was
showing them around West Point,explaining some of the history

(46:58):
and kind of being theirexecutive assistant while they
happened to be there. And, youknow, every single one of them,
when I asked them about how theygot to where they are, almost
all of them credited mentors andfamily people. They they almost
all had gratitude towards otherpeople in their life that had

(47:19):
helped them get through reallytough things and overcome
obstacles, and that worked wellfor me there and then just kept
picking the toughest things Icould do for a long time, and
life has given me some amazingsparring partners that have made
me better at fighting this thingcalled life. It's been great.

Lou Rabon (47:41):
Yeah. I mean, we don't have time to go into
deployment and stuff like that,and I I'm sure you have amazing
stories with that. And you aresuch a humble guy, Stefan,
because you have this justabsolutely amazing, you know,
CV. You're you've got two massif I understand correctly, you
have two masters engineering,then you got your MBA. You know?

(48:04):
How how did that happen?

So I had I had broke my back in
Afghanistan, which we'll justgloss over for now. And the army
didn't know if they were goingto keep me or not. I was a
airborne ranger at the time ofthe infantry. Army didn't know
if they were gonna keep me, andI said, well, I better be ready
in case they, you know, youknow, launch me back in the
civilian landscape.

Lou Rabon (48:27):
Right.

And, Illinois had this amazing
veterans program and still docalled the Illinois Veterans
Grant that paid for me to go toschool. And I said, well, I have
an electrical engineeringdegree. I might as well continue
along that road, and get a amaster's of engineering. And,
halfway through it, I realized,that I was never going to be one
of the best in the world at it.And I thought and I had this,

(48:50):
like, this frustration of andand and maybe it was a fear of
if I went to an amazingcorporation and I invented
something that was worldchanging, I would have to rely
on sales and marketing to takethat invention that I made and
go actually change the worldwith it.
And I was unwilling to letsomebody else take

(49:14):
theoretically, unwilling to letsomebody else the success of
something that could be worldchanging that I did build if I
got there, let it live and diein the marketplace. And so I
said, okay. If I'm gonna dothat, what how do I do it?

Lou Rabon (49:27):
Yeah. You think about Nikolai Tesla. You think about
Gutenberg. When you hear thestories of these inventors that
actually didn't reap the profitsof of most of their inventions,
it's it's really, you know,shocking.

And I didn't wanna fall in that that same
pitfall. Right? Like and I'm notgonna compare myself to
Gutenberg and Tesla, butsometimes I got the occasional
good idea.

Lou Rabon (49:53):
So you pivoted to well, you still got your
master's, right, in engineering.

Oh, we finish what we start. Yeah.
Smell. I was actually I was inthe last semester of the
program, and while I'm applyingfor the MBA actually, I was in
the second to last semester.And, applying for the MBA and,
the University of Illinois MBAprogram, the dean reached out.
He goes, let's get on a call.And he goes, are you gonna do

(50:18):
two masters at the same time? Iwas like, no. No. No.
No. I'm gonna get in now, thenI'll defer a semester. I'll take
thirty days off, and then I'llstart your program from scratch
because you're not gonna takeany of my credits that I've done
anywhere else. So let's go.

Lou Rabon (50:30):
Unbelievable. That is it's really impressive, but not
surprising considering, one Ithink it was last year where you
did two was it two triathlons ortwo marathons or so? What were
you doing, like, in a

Oh, yeah. So I did the Chicago triple
challenge, which was you dothree triathlons in one weekend.
Jesus. So you do this a areally, a short one on Saturday,
and then on Sunday, you're thefirst person in the water, the
first group in the water, forthe Olympic distance, the

(51:04):
international distance. And thenonce you cross the finish line,
you hobble back to the start,and you do a sprint.
Wow. And when you add all of thedistance up, it's not quite a
half it's not quite a halfIronman. So a couple weeks ago,
did a

Lou Rabon (51:20):
half Ironman. Wow. Wow. Yeah. So you're constantly
doing challenging yourself,doing the hard stuff.
And that's in addition to havinga family, young children, and
then immense responsibility forfor growing this security and
cloud portion and AI at Avant.So, I mean, just doesn't end,

(51:43):
man.

I could I could not do this, but for the
fact that my wife lets me. Aw.Right?

Lou Rabon (51:50):
Yeah. Yep. Yeah. And she's got her own. She's
impressive too from from what Iknow.

Oh, yeah. She's an army special operator
nurse and has done all sorts ofcrazy stuff. She worked in the
ER for a while, and now she's ashe's an a nurse practitioner
with a doctorate that works in acardiovascular institute doing
electrocardiology and, like,supporting crazy, like,

(52:15):
pacemaker

Lou Rabon (52:15):
technologies. Unbelievable. And and from what
I understand from nursepractitioners, they actually do
10 times the work that doctorsdo with the same level of
knowledge. So it's a lot of, lotof respect there too. Your your
your kids are going to either beabsolute superhumans or they're
going to be the laziest childrenever because both of their

(52:37):
parents are such high achievers.
They're like, what else do wehave to do? So

Well, that's actually, Anna and I talk,
often. We talk a lot about howwe're going to manufacture
adversity for our children.

Lou Rabon (52:50):
Yeah. Definitely. It's really important. Speaking
of which, in, like, five minutesafter this, I'm gonna be talking
to my son about certainresponsibilities he has during
summer and Go. Making money.

Yeah?

Lou Rabon (53:05):
Really

important. Yeah. Got fam family duty.

Lou Rabon (53:08):
That's right. That's right. So we're almost at time.
I guess, last thing, I knowyou're you're doing scuba diving
as well, which I can't believe.Are you doing that still?
Is that still a high high thingfor you, high priority? Or

I haven't ran a class in a while, but we
still we still get in a fewdives a year, which is which is
absolutely phenomenal. I got thethe scuba helmet behind me over
here. And heck, if I if Iactually liked boats, maybe I
would have gone in the navy. Butsame reason I didn't go on to

(53:47):
tanks. Oops.
But, yeah, no, we still we stillget quite a few dives in a year
and, you know, with my back, I Ican't really sustain teaching
basic courses, but, I try torun, you know, an advanced
course or, or like a mixed airdiving type of thing, about
every year or two just to justto keep the dust off because

(54:08):
that's kind of the retirementplan.

Lou Rabon (54:10):
Nice.

So I I went through all those instructor and
dive master courses in the lateaughts and just keeping it up
and running and trying to staycurrent. So, you know, thirty
years from now, I can ski in thewinter and, you know, teach
skiing and teach teach scoop inthe summer.

Lou Rabon (54:25):
Yeah. Maybe living in The Caribbean will be seeing you
with your own little bar.

Only one? No, bro. I'm I'm gonna take over
the the whole intercontinentalstuff. Yeah.

Lou Rabon (54:37):
Seven, where can people find you? We're gonna
leave a list, but we've gotLinkedIn and, you know, I'll
I'll post your LinkedIn, but,obviously the Avant website,
you've got your own personalwebsite page as well. Any other,
places people can find you?

Yeah. I I do the most these days on, on
LinkedIn and, and through theAvant general channels. I had
been posting a lot more video onLinkedIn, and I found that the
creativity it took me to doLinkedIn was taking away from my
time with my children, thecreative the ability to, you
know, do storytelling at bedtimewith my kiddos. So I've I've
dialed back. But, yeah, mostlyon LinkedIn and through the

(55:16):
Avant channels on goavant.net.
And, in fact, we've got webinarsthat, that I they let you
participate on, about, aboutmonthly. So you can join us
there, and that's where we tryto give the best tips and
tricks, the visibility into themarket, and convert those
stories, what we're seeinghappen into the simple sailing
motion that trusted advisersexpect from us today.

Lou Rabon (55:38):
Amazing. So, Stefan Semmelt, Rolf, thank you so
much.

Thanks, Luke. Glad to be here, and, I
hope this helps someone. And ifit did, please pay it forward.

Lou Rabon (55:47):
Thank you. Yeah. And to for those of you that are
watching and or listening, ifyou learned something today or
laughed, please tell someoneabout this podcast. Thanks
again, Stefan, and we'll see youagain soon.
That's a wrap for this episode of Channel Security
Secrets. Thanks for tuning in.For show notes, guest info, and
more episodes, visit us atchannelsecuritysecrets.com.

(56:10):
Channel Security Secrets issponsored by Cyber Defense
Group. When it comes toprotecting your business, don't
settle for reactive.
Partner with experts who buildresilience from the ground up.

All Episodes

Mastering the Fundamentals - Stephen Semmelroth - Channel Security Secrets - Episode #5

Episode Transcript

Popular Podcasts

Stuff You Should Know

Dateline NBC

The Herd with Colin Cowherd

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}Mastering the Fundamentals - Stephen Semmelroth - Channel Security Secrets - Episode #5