Signed

You bought the EDR. You checked every box your insurance renewal asked for. In this Playbook, Max Clark, CEO of ITBroker.com, breaks down why 60% of ransomware victims had a leading EDR product deployed when they got hit, and what the other 40% were doing that they weren't. From the four tools insurance actually requires to the ones nobody budgets for until it's too late, Max walks through the gap between owning a security tool and being protected by one, and the one line item most security budgets are missing entirely.

THE PLAYBOOK

• 00:00 The trigger: the EDR stat insurance doesn't want you thinking about
• 00:41 The mistake: treating insurance's four checkboxes as the finish line
• 04:22 The play, step 1: what security buyers skip past SWG, CASB, and ZTNA
• 09:07 The play, step 2: what actually gets security budget approved, and why ROI is the wrong pitch
• 13:19 The play, step 3: test your backups before you need them
• 14:38 What to watch for next: measuring security by detection and containment speed, not tools bought

RESOURCES MENTIONED

• KnowBe4 — the security awareness training platform Max says most clients end up on anyway
• Okta — referenced as a strong IDP/SSO layer for building real ZTNA entitlement chains
• Microsoft 365 E5 Security — the bundled EDR/security suite Max warns is only as good as the team configuring it
• Target's 2013 HVAC vendor breach — Max's example of the IoT/third-party blind spot most companies don't monitor

ABOUT THE SHOW

Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format — 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript
Click here to view the episode transcript.

Buying Microsoft 365, Google Workspace, or Azure direct feels like the simpler choice, until you need support or get locked out of your own tenant.

In this Playbook, Max Clark breaks down what a Cloud Solution Provider (a CSP) actually does between you and the platform: faster support and escalation, help recovering a locked tenant, engineering and migration support, and access to vendor funding you can't reach on your own, usually at little or no added cost.

If you're deciding whether to buy direct or through a CSP, or renewing that decision without ever having checked it, this one's for you.

The Playbook

• 00:51 What a CSP actually is
• 01:29 Why Microsoft and Google aren't built for support
• 01:55 Where a CSP sits between you and the platform
• 02:24 The vendor funding most buyers never access
• 03:19 The admin account problem most companies ignore
• 04:17 What happens when you get locked out
• 05:14 How a CSP changes your recovery and escalation path
• 06:11 Engineering, migration, and configuration support
• 06:38 Not all CSPs are the same
• 07:03 Tier zero vs. tier one support, explained
• 08:26 End-user support vs. administrative support in practice
• 09:25 Why a CSP rarely costs you anything extra
• 10:17 The bottom line: direct vs. CSP

About Signed
Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript

Which workloads actually belong in public cloud, private cloud, colocation, or bare metal? Jeremy Pease, CEO of Aptum, joins Max Clark to break down how application requirements, infrastructure costs, connectivity, resilience, and scale should determine where your workloads run.

They get into cloud migration and repatriation, why connectivity can cost more than the infrastructure itself, workloads that never needed the scale assumed in the original business case, and a colocation estimate that went from roughly $10,000 a month to $80,000 once the real requirements were modeled.

If you're evaluating a cloud migration, renewal, repatriation, or infrastructure change, this conversation gives you the questions to run before deciding where the next workload belongs.

Before your next migration, renewal, or repatriation decision:
https://www.itbroker.com/blog/cloud-workload-assessment

Jeremy Pease:
https://www.linkedin.com/in/jeremy-pease-a53b972/

Aptum:
https://aptum.com/

More from Signed:
https://www.itbroker.com/podcast

Full Transcript
Click here to view the episode transcript.

You didn't choose your cloud provider. You inherited it, from whoever picked the safe option first and called it a decision. In this Playbook, Max Clark, CEO of ITBroker.com, names what that habit actually costs: three decades of consensus defaults, from the dot com era stack to LAMP to AWS's US East 1, and what the buyers who never questioned any of them paid for it, including the 15 hour outage this past October that took down Snapchat, Venmo, and a foreign government's tax site along with them. One question either ends the habit or exposes that you've never really made this decision at all: compared to what?

The Playbook

• 00:27 Why "nobody gets fired for buying IBM" still runs every enterprise tech decision, and the gap between safe for your career and right for your company
• 01:28 The mistake: the consensus default isn't neutral, it's the product the market is built to sell you
• 03:05 Proof from history: the safe choice and the weird choice have traded places twice before this one
• 04:37 Today's default: AWS, US East 1, and what the October 2025 outage actually cost the buyers who never questioned it
• 06:32 The play, step 1: the average cost structure you guarantee yourself by matching every competitor's stack
• 08:00 The play, step 2: the cloud flexibility trap, committed spend agreements, and what cockroach mode actually protects
• 08:57 The play, step 3: a16z, 37signals, and Netflix chose three different answers, on purpose
• 13:51 What to watch for next: this isn't anti-cloud, it's anti-default, and why cloud transformation mandates quietly die around month 12
• 15:00 The buyer's job: ask "compared to what?" on every consequential decision

Resources Mentioned

• Andreessen Horowitz, "The Cost of the Cloud: A Trillion Dollar Paradox" (Sarah Wang & Martin Casado, 2021)
• 37signals / DHH's public cloud exit writeup (Basecamp, HEY)
• Netflix Open Connect
• Dropbox's pre-IPO infrastructure buildout
• AWS US East 1 outage, October 2025
• Further reading: Most of Your Infrastructure Can Be Standard. Some of It Shouldn't Be. — the six-part decision filter for identifying which infrastructure choices actually deserve a comparison against the default, built directly from this episode

About the Show
Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today’s Playbook is one you’re facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript
Click here to view the episode transcript.

Approving a technology invoice is not the same as validating it. Tommi Ellis, Channel Director at Intratem, joins Max Clark to explain how companies can tell whether anyone is actually checking telecom and technology bills against contracts, inventory, services, and real usage.

They get into roughly $4,000 a month found sitting unnoticed on a 270-line wireless account, larger audits recovering as much as $1.2 million annually, canceled services that continue getting billed, and why the first invoice after a new contract or service change deserves immediate scrutiny.

They also break down why technology expense management often falls between IT and finance, what happens when years of vendor knowledge leave with one employee, and how a strong contract can quietly stop being a good deal when nobody checks what happens after signature.

Run the six-point technology invoice audit:
https://www.itbroker.com/blog/technology-invoice-audit

Tommi Ellis:
https://www.linkedin.com/in/tommi-ellis-3a92b0112

Intratem:
https://intratem.com/

More from Signed:
https://www.itbroker.com/podcast

Full Transcript
Click here to view the episode transcript.

You're paying an MDR provider to protect you. Most of them will alert you and wait for someone else to act. This conversation names the one question that tells you which one you actually bought. Know the answer before it's 2am and someone's waiting on you to decide.

You signed a contract for managed detection and response. You assumed that meant somebody would step in and stop an attack while it was happening. For a lot of MDR providers, what you actually bought is guided remediation. They find the incident, tell your team what to do, and hand it back to you to execute. That distinction is the entire reason you're paying for this instead of running it yourself, and most buyers don't find out which one they signed for until they're the one on the call at 2am being asked what to do next.

Miles Lowry, Senior Territory Manager at eSentire, has sold cybersecurity from every seat in the market, VAR, Nutanix, Rubrik, and eSentire, and he walks through the one question that exposes the gap before you sign. This conversation also covers where the same blind spot shows up everywhere else in a typical MDR evaluation. Buyers send RFPs to eighteen vendors and get eighteen generic capability dumps back instead of a real fit assessment. Rules of engagement quietly change depending on whether the compromised machine belongs to your CEO or your help desk.

It also gets into DLP requests that get approved without anyone defining what they're actually trying to stop, and security licensing already sitting in your Microsoft contract that almost nobody has turned on. The buyers with the best MDR outcomes never send a broad RFP at all. Miles names the one question he says he'd ask first if he were sitting on the buyer's side of the table.

Know the answer before it's 2am and someone's waiting on you to decide.

Want the exact test to run against your own contract? Read the full breakdown: How to Tell If Your Managed Cybersecurity Provider Will Actually Respond During an Attack.

Find Your Situation
Ten real moments from this conversation. Find the one that's actually happening to you right now, and jump straight there.

• Your CISO or security lead has been in the seat under two years, and you're not sure if that's a coincidence. → 21:44
• You sent an RFP to eighteen vendors, and now you're buried in decks that all say the same thing. → 26:35
• You can't get the budget to build the security program you're actually expected to deliver, and you know it. → 31:14
• You've never checked whether a breach on your watch creates personal liability for you, not just the company. → 40:53
• A vendor asked how much data you generate before you'd even deployed anything to measure it. → 42:36
• You've never actually asked your MDR provider whether they act on their own or call you first. → 55:31
• Nobody on your team could name, right now, who gets called first if your CEO's laptop gets hit tonight. → 57:25
• Someone asked for a DLP tool and you're not sure anyone can say what it's actually supposed to stop. → 1:10:43
• You've never tested whether your MDR provider can actually act without you, or whether you'd only find out during the incident. → 1:18:16
• You're paying for Microsoft E5 and you have no idea if the security features in it are actually turned on. → 1:25:53

What We Get Into

• 26:35 Who is actually answering the RFP you think you wrote
• 31:14 Why CISOs use a vendor to share the blame when something goes wrong
• 40:53 Why most CISOs at one conference had personal liability insurance
• 42:36 Why "how much data do you have" is a trick question
• 55:31 The real MDR test: alert versus response
• 57:25 Your CEO's laptop, and who's actually authorized to isolate it
• 1:00:46 Who belongs in the room on the buyer's side and almost never is
• 1:10:43 The DLP request nobody asked for and nobody can explain
• 1:18:16 The one question to ask before you sign
• 1:25:53 Paying for Microsoft E5 security licensing you never turned on

What We Mentioned

• eSentire
• CrowdStrike (Falcon Complete)
• Sentinel One
• Fortinet
• Palo Alto Cortex
• Microsoft Defender, Sentinel, and Entra
• Nutanix
• Rubrik
• Veeam
• Gartner
• NIST CSF
• Log4j
• Tenable

About Miles Lowry
Miles Lowry is Senior Territory Manager at eSentire, where he works directly with security leaders on managed detection and response. He's spent 14 years in enterprise technology sales, moving through VAR, Nutanix, Rubrik, and now eSentire, giving him a rare, direct view into where buyers get MDR wrong before they ever sign.
LinkedIn: https://www.linkedin.com/in/cloud-ai-expert/
Company: https://esentire.com

About Signed
Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly.
Listen: itbroker.com/podcast

About Signed
The IT market is built for sellers, not buyers.

Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised.

New episodes weekly. An ITBroker.com podcast.

Full Transcript
Click here to view the episode transcript.

A VP spent weeks building a plan to cut an eight figure cloud bill. He walked into one meeting with engineering. Three words killed it: not my KPI. The bill lands on whoever gets handed the mandate to cut it, but the authority to actually change it sits with someone else entirely, usually engineering, whose time is already spoken for by other priorities. A FinOps platform will find you the free money, orphaned resources, idle instances, the stuff nobody has to defend. It won't touch the savings that require someone to decide engineering's time is worth spending on this instead of shipping.

Run this before you spend a dollar on another cloud cost initiative

• Name the owner of the cost. Whoever's name is on the number when it climbs, that's accountability.
• Name the owner of the fix. Whoever controls the roadmap and the sprint, that's authority.
• Check if they're the same person. If yes, you have a real cost cutting project. If no, "not my KPI" is already on its way.
• Check if the cost is tied to margin, not just revenue. A product can bring in real revenue and still be a bad bet once its true cost is on the table. Revenue won't show you that. Margin will.
• Check if that picture reaches the executive team. Visibility only moves the decision if it lands with the people who can reprioritize across teams.

If items one and two name different people, and item five has no answer, you're looking at an org chart gap. No FinOps platform touches that. Map who actually holds the authority before you spend the next dollar. The full checklist, plus the question most teams skip, is here.

You can buy the platform. If the wrong person still owns the decision, the bill doesn't move, and now you've paid for the privilege of watching it not move.

The Playbook

• 01:29 The trigger and why it matters
• 02:54 The mistake most buyers make
• 05:19 The play, step 1
• 05:48 The play, step 2
• 06:17 The play, step 3
• 07:13 What to watch for next

Resources mentioned

• FinOps platforms, the cost visibility tools that surface idle and orphaned cloud resources
• Cost tagging systems, deployed across cloud and data center infrastructure to compare spend apples to apples

About the show
Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript
Click here to view the episode transcript.

Every vendor stretches the truth somewhere in your sales process, and most buyers respond to all of it the same way, forgiving everything or torching a good deal over nothing. In this Playbook, Max Clark sorts vendor lies into three categories, a harmless stretch, one rep's invented promise, and a lie the whole company stands behind, and gives a different response for each. Then he turns the mirror on buyers, the shopped quote, the invented deadline, the fake executive sponsorship, because buyers run the same three plays back. Keep guessing which lie you just caught, or put someone neutral in the room who ends the guessing entirely. That's the only fix that actually works.

Run this the next time a vendor claim doesn't sit right

1. Creative embellishment. The provider is stretching into a category they do not quite fit, out in the open. Calling a router with a config page "SD WAN" is the pattern. Costs you nothing to see through. Note it, move on.
2. One rep's invention. A specific promise nobody at the company authorized. "I text the CEO directly" is the tell. This is a person problem, not a company problem. Get a different rep, do not walk from the vendor over it.
3. Institutional fiction. The whole sales org repeats the same claim with a straight face, and leadership blessed it. When the dishonesty is the official story, that is the provider you cut.

Now run your own last vendor call through the same three buckets, from the vendor's side of the table. Telling three competitors they're each the front runner, that's your version of Bucket 1. Inventing a deadline that doesn't exist to force urgency, that's Bucket 2. Claiming executive sponsorship that doesn't exist because your whole team has quietly agreed to say it, that's Bucket 3.

Keep guessing which lie you just caught, or put someone neutral in the room who ends the guessing entirely. That's the only fix that actually works.

The Playbook

• 01:07 The trigger and why it matters
• 02:47 The mistake most buyers make
• 03:16 The play, step 1
• 03:46 The play, step 2
• 04:14 The play, step 3
• 04:31 What to watch for next

Resources mentioned

SD WAN, the capability category vendors most often mislabel
Public company 10-K filings, used to fact check inflated market share claims
AWS cloud spend, used as the scale comparison that exposes a fake top-customer claim

About the show
Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript
Click here to view the episode transcript.

Your security tool says you're protected. Most of the time nothing is lying to you on purpose. It's just reporting what it was configured to report, whether or not anyone ever checked if that setup was correct in the first place. 

Zach Stewart, CISO and Director of IT at Steno, spends this conversation walking through exactly where that gap hides, and it's not only the tool. There's the BAA that only protects you if you configured it correctly, and most companies never click the button. The SOC 2 stamp that tells you someone ran a pen test, not that you're secure. An MDR service marketed as round the clock remediation that turns out to only detect, and a maturity score that gets handed to a board and answers a question nobody in the room actually asked. 

It also covers the buying side of all of this: what it actually looks like to evaluate a vendor without falling for the slide deck, why nobody wants to buy secure web gateway until it's already saved them, and the exact moment a customer contract forces corporate owned devices with no plan in place. 

Go find out right now if your tool, and everything else you're trusting, is actually telling you the truth. 

Where to Start

• You're evaluating a new vendor and you're tired of getting a slide deck instead of the actual tool. → Jump to [49:20]
• A vendor passed every checkbox on paper, but something still feels off. → Jump to [1:17:36]
• You just got a SOC 2 report from a new vendor and you're not sure what it actually tells you. → Jump to [1:05:18]
• Your BAA says you're HIPAA compliant, and you've never checked whether the tool is actually configured for it. → Jump to [1:08:35]
• You're being sold on an MDR service, and you don't know if there's a real person on the other end at 2am. → Jump to [1:33:14]
• You need the rest of leadership to take a risk seriously before it becomes an incident, not after. → Jump to [1:56:38]
• Your security budget looks fine on the spreadsheet, but nobody's checked if it's enough for what it's supposed to protect. → Jump to [2:03:09]
• Your continuity plan treats an outage and a breach as the same problem. They're not, and that's costing you. → Jump to [2:06:30]
• A customer just told you their contract requires corporate owned devices, and you don't have a plan for that yet. → Jump to [2:22:28]
• You're bringing a maturity score into your next board meeting, and you already know it's not going to land. → Jump to [2:28:39]
• You're about to consolidate onto one security platform, and you haven't worked out what you'd be giving up to do it. → Jump to [2:39:50]
• You rolled out passkeys, and you're still not sure if you actually replaced your passwords or just added a step. → Jump to [2:48:24]
• Nobody at your company can tell you what percentage of your applications actually sit behind single sign on. → Jump to [2:57:47]
• You've read a breach postmortem and thought, any one thing on this list would have stopped it. You don't know if that's true for you too. → Jump to [3:07:02]

Chapters

•  49:20 Show me the tool, not the slide deck
• 1:05:18 A new vendor says they're secure because of SOC 2. What else to check
• 1:08:35 The HIPAA BAA loophole nobody reads closely enough
• 1:23:29 SSO can cost more than the product it's attached to
• 1:33:14 The real math behind running your own SOC, and where MDR falls short
• 1:40:07 Test your backups. Actually test them
• 1:56:14 Sponsor break
• 2:03:09 The company running its entire security budget at under a dollar per employee
• 2:06:30 Outage risk and breach risk need two different plans
• 2:22:28 When a customer contract forces corporate owned devices
• 2:28:39 Why a one to ten maturity score means nothing to your board
• 2:48:24 Passkeys are useful. Most companies deployed them wrong
• 2:57:47 The SSO coverage gap nobody's counting
• 3:07:02 The breach where almost anything would have stopped it

What We Mentioned

• NIST CSF
• SOC 2 and HIPAA
• PCI, CMMC, and ISO 27001
• Google Workspace OAuth ("Sign in with Google")
• Microsoft Entra, E5/E7 security bundling
• Apple Business Manager and zero touch MDM enrollment

About Zach Stewart 

Zach Stewart is CISO and Director of IT at Steno, where he spends his days doing exactly what this show is about: buying technology in a market built for the people selling it, then fighting to get it funded and adopted inside his own company. Max discloses in the episode that Zach is someone ITBroker.com works with directly, which is part of why he was on the show, no product to pitch, no reason to give a polished answer.

LinkedIn: https://www.linkedin.com/in/zacharykstewart/
Company: https://steno.com

About Signed

Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript
Click here to view the episode transcript.

Your website is no longer read only by people.

Tony Lauro opens this episode with a client whose sequential order numbers let a competitor read their daily volume through a public API. No breach. No alert. Just a number counting up in plain sight.

The same blind spot shows up when a product drop gets sniped by bots in seconds, or when the large language models you're exposing to customers and employees get probed before anyone notices.

Tony has spent 13 years inside Akamai's bot management and API security practice, watching exactly this shift happen. He walks through what replaced the old human-or-machine test, and it comes down to one thing: who decided your defaults, and whether anyone at your company ever checked.

Find the Risk You're Already Dealing With

• Our security team still argues about whether traffic is a real person or a bot. Is that even the right question to be asking anymore? → Jump to [1:00]
• Some of our "customers" completing checkouts or filling out forms might actually be AI agents acting on a real person's behalf. Can our bot rules even tell the difference? → Jump to [3:54]
• We know some of the activity on our platform isn't clean, but cracking down on it would hurt our numbers. How do we actually think through that tradeoff? → Jump to [26:38]
• Our security team and our marketing team have never once talked about brand risk together. Should they be in the same room? → Jump to [29:03]
• Our provider pushes our blocking rules out to the edge before traffic even reaches us. What judgment calls are they making on our behalf without us knowing? → Jump to [36:57]
• We know AI is a risk somehow, but nobody's mapped out where it's actually hitting us. Where would we even start? → Jump to [45:01]
• We just turned on an internal AI tool or chatbot, and I don't know what it's actually watching for. What should it be catching? → Jump to [50:57]
• A security vendor ran a proof of value on us and found something scary in our environment. Is that actually proof their tool works? → Jump to [1:28:57]
• We just signed with a new security vendor and I have no idea what its default settings actually are. Should I be worried? → Jump to [2:04:38]

What We Get Into

• 1:00 Why "human or bot" is the wrong security question now
• 3:54 AI agents that act like your customers, and why bot management needs a third tier
• 26:38 Brand safety versus listing volume: a marketplace's real tradeoff
• 29:03 Cyber fusion: why security and marketing finally have to talk
• 36:57 Pushing your security policy to the edge means trusting your provider's judgment call
• 45:01 The three places AI is actually hitting your business at once
• 50:57 Prompt injection and what a firewall built for AI actually watches for
• 1:28:57 Every proof of value finds something. That's not proof it works.
• 2:04:38 The default is the most important thing you never reviewed

What We Mentioned

• Akamai, bot management and API security
• Akamai's "Firewall for AI," announced at RSA Conference
• Akamai's recent acquisition moving the company into the browser (name unconfirmed, see flag above)
• robots.txt and llm.txt, the standards good bots and crawlers are supposed to honor
• AEO and GEO (answer engine optimization and generative engine optimization)

About the Guest

Tony Lauro, Security Director at Akamai. Thirteen years inside Akamai's bot management and API security practice, working the exact problem this episode covers: telling good traffic from bad without losing customers in the process.

Connect with Tony: Linkedin | Akamai

About Signed

Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom

Full Transcript
Click here to view the episode transcript.