You bought the platform. You renewed the contract. And 80% of your breach risk is coming from the one thing the platform wasn't built to catch.
Craig Patterson spent years inside the channel ecosystem that sits between what security vendors ship and what enterprise buyers actually receive — and he's unusually direct about where those two things don't match.
In this conversation: the Microsoft "free SIEM" that isn't free once you turn it on, the insider threat blind spot baked into nearly every consolidated platform, and the AI agent problem your security team is about to inherit whether they're ready or not.
If your renewal is coming up and your confidence in your coverage hasn't kept pace with your spend — this is the episode.
One of these is probably on your roadmap right now.
- You already pay for Microsoft E5. Why did turning on Sentinel increase your security bill?
The "free SIEM" pitch ends at the demo. The bill arrives after you turn it on → - Your EDR, MFA, and SIEM are working exactly as designed. So why do credential-based breaches still succeed?
The attacker didn't break in. They logged in → - Your AI agents now have credentials, permissions, and access to business systems. Are they being monitored like employees?
Most organizations have governance for people. Almost none have governance for AI identities → - Every security vendor has AI in the deck. Which ones can prove it works outside the demo?
Most can't answer it. That's the answer →
WHAT WE GET INTO
10:30 — What you stop seeing when you consolidate security vendors
18:30 — How to prove security value without relying on tool counts
22:00 — The breach vector responsible for most incidents
29:00 — The four types of insider threats
34:00 — Why AI agents should be treated like insiders
38:00 — Finance bot #7 just accessed source code. Would you know?
43:00 — How AI reduces alert investigations from 60 minutes to 5
47:00 — The one question that exposes AI marketing hype
51:00 — Why every organization still needs a SIEM
53:00 — The CFO conversation: justifying security spend
01:08:00 — Why leading with cost savings is the wrong security strategy
WHAT WE MENTIONED
- ExaBeam — exabeam.com
- LogRhythm (merged with ExaBeam, 2024)
- MITRE ATT&CK Framework — the attacker playbook ExaBeam's Outcomes Navigator maps against
- ExaBeam Outcomes Navigator — security posture measurement mapped to MITRE framework
- ExaBeam Nova — AI engine for SOC analysts; reduces alert correlation from 60 minutes to 5
- ExaBeam UEBA — User and Entity Behavior Analytics
- ExaBeam Agent Behavior Analytics (ABA) — behavior profiling for AI agents deployed inside your organization
- Sherpa — ExaBeam's AI-powered partner enablement and virtual coaching tool
- Microsoft E5 / Defender / Sentinel stack
- Equifax breach — Craig's reference point for catastrophic data exfiltration: ~$600–700M in damage
ABOUT CRAIG PATTERSON
Craig Patterson is the Global Ecosystem Chief at ExaBeam, where he rebuilt the company's entire partner ecosystem following the ExaBeam/LogRhythm merger — unifying two different channel programs across 3,000 partners and six continents.
Before ExaBeam, Craig built and led channel organizations at multiple enterprise security companies. He's worth listening to because he sits at the intersection of what security vendors are building and what enterprise buyers are actually receiving — and he's unusually honest about where those two things don't match.
- LinkedIn:https://www.linkedin.com/in/globalchannel
- Company: exabeam.com
ABOUT SIGNED
The IT market is built for sellers, not buyers.
Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised.
New episodes weekly. An ITBroker.com podcast.
Full Transcript
Click here to view the episode transcript.
