"AI was never built to replace us. It was built to enhance us. Let it do the heavy lifting and free yourself to do other things."

Who They Brought In

Chris Nurse is a Principal Consultant at ISOutsource with close to three decades in technology. He started when computers still took up entire rooms and has spent the last 15 to 20 years working on large-scale projects from both the consulting and delivery side. His previous clients were enterprise-level organizations running 20,000 to 100,000 servers, and his work has spanned banking, insurance, legal, medical, and manufacturing across the US and globally. He is currently deep in the AI automation space, helping organizations figure out how to eliminate repetitive work, right-size their technology spending, and build the governance structures that make both possible. He is also the person who saved a 25,000-user corporation $2.5 million in Microsoft licensing in a single assessment and grew a consulting department from 3 people and $3,000 in monthly revenue to 47 people and over $20 million.

What Got Loud

• A task that used to take Chris 45 minutes to an hour now takes five minutes because he built an AI automation tool for it. That is the whole AI argument in one sentence
• Most organizations are paying for the same AI tool four times simultaneously because nobody did the groundwork before employees started adopting on their own
• Chris's licensing assessment for a 25,000-user Microsoft environment saved them $2.5 million. The culprit: hundreds of unused licenses and duplicate tools nobody had audited in years
• Why data is now the competitive differentiator, not the product or the service. Everyone can build the building. The question is what data you bring to the table about how you will build it
• The data seepage problem: personal devices connecting to corporate environments are moving data in ways nobody is tracking, and most of it is completely unintentional

The Rundown

Chris's framing on AI resistance is the most practical in the series. His position is not that AI is inevitable and people need to get over it. His position is that AI was designed as a tool for humans, not a replacement for them, and the fear goes away the moment you experience what it actually does to your workload. He built an automation tool for his own client reporting process. What used to take 45 minutes to an hour now takes five minutes. He did not build it to reduce headcount. He built it so he could spend that recovered time on things he actually wants to do. That reframe, from threat to multiplier, is the one that lands with people who are stuck in fear.

The AI licensing conversation is where Chris gets direct about something most organizations are quietly ignoring. Companies are not managing their AI tool adoption. Employees see something that works and start using it without any governance in place. The result is organizations running Microsoft Copilot, ChatGPT, Claude, and one or two other platforms simultaneously, paying full licensing costs across all of them, for work that one properly configured tool could handle. Chris's audit framework makes it visible. He builds into a client's licensing stack and asks the question nobody has asked: when was the last time this user touched this product? The answer is almost always damning. A 25,000-user Microsoft environment turned out to be carrying hundreds of untouched licenses and duplicate tool subscriptions that had been running for years. One assessment. $2.5 million saved.

The data protection framework Chris uses is structured but accessible. He describes it as a castle. The moat, the turrets, the drawbridge, the guards inside. What he is actually describing is a layered approach that starts with understanding where data lives and who touches it, adds data loss prevention to monitor what moves and where, and wraps it in a business continuity plan so that when something goes wrong, the organization does not stop operating. His pointed observation: most companies do not care about disaster recovery because it sits on the balance sheet as a liability, not an asset. It costs money with no visible return. Until it is the only thing standing between continued operations and a catastrophic shutdown. By then it is too late to care.

The change management piece is what Chris circles back to throughout the episode. He has walked into manufacturing facilities where employees have been running the same processes for 50 years and have zero appetite for anything new. He describes wearing them down through persistence, patience, and repetition. He frames security not as an IT issue but as a business survival issue. If CMMC compliance is required to keep government contracts and you refuse to implement MFA because it feels like too much, you are making a business decision that ends the company. Chris puts it plainly: pick your poison.

Real Talk

Every organization has back work that never gets done because the people who would do it are buried in repetitive tasks. AI does not take the job. It clears the queue so the job gets better. That is the conversation worth having.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

"The door is heavy to remind you of the importance of what you're trying to protect. That's what I've taken for my whole career."

Who They Brought In

James Gorman is the Fractional CISO and CTO at Hard2Hack, and the author of two books: "Security in the Age of AI Agents: A Practitioner's Journey from Cold War Crypto to Autonomous Threats" and "The IT Leader's Guide to Cybersecurity Programs: From Basics to AI." His path into cybersecurity started 40 years ago when he reported aboard a Navy ship as a freshly minted cryptographic technician, responsible for the fleet-wide encryption keys that secured communications across an entire naval operation. From there he learned TCP/IP in 1988 when the Navy deployed an encrypted satellite network running at 115kbps, got out in 1992 when DARPA net was becoming the internet, was recruited by GE to help open their systems to this new thing, started one of the first ISPs in 1994, and has spent the decades since doing fractional CISO work across SaaS startups, healthcare organizations, government contractors, and mid-market manufacturers. He has helped approximately 30 companies build or rebuild their security programs, and he brings the kind of practitioner perspective that most compliance documentation specifically does not.

What Got Loud

• The heavy door story: the reason a crypto locker door is that heavy is not just security. It is a physical reminder of the weight of what you are protecting. James has carried that framework for 40 years
• CMMC being delayed does not change your legal obligation. You are still required to self-attest, still required to meet NIST 800-171, and still exposed to contract penalties if you get breached and it was your fault
• McKinsey built an internal AI trained on all 57,000 employees' work history and left 18 API endpoints with no authentication. A researcher got in through SQL injection in under three hours and could have exported everything
• A $500 million ISO 27001-certified manufacturer opened their entire Active Directory to fix a VPN issue, forgot to close it, and got ransomware dropped through a print service account using an easy-to-guess password. While ISO 27001 certified.
• Why presenting cybersecurity as a math problem is the only way to get a CEO or CFO to actually engage with it. 96% of small and mid-sized businesses that suffer a severe cyberattack are out of business within four years

The Rundown

James's entry framework has not changed since a chief petty officer named Chief Smith asked him why he thought that door was so heavy. The answer is not that the door is heavy because the stuff inside is important. The answer is that the door is heavy to make you feel the importance every time you touch it. James has applied that to every engagement since. What are you trying to protect? Sales records are one level of heaviness. Healthcare data is another. Government contractor CUI is heavier still. Water treatment terminals, where lives are at stake, are something else entirely. The framework for everything that follows, the architecture, the controls, the budget conversation, starts with that question. And most organizations have never seriously answered it.

The compliance versus security conversation is where James is most direct. His position is that a compliance checkbox has never once made a company secure. He walked into a company processing billions of dollars a year in transactions and found their disaster recovery policy sitting on a shelf in the server room. Nobody knew it existed. He watched another company click through security awareness training modules and call it done for the year. He has seen SOC 2 audit firms issuing boilerplate reports where no controls were tested. His line is consistent throughout the episode: by being genuinely secure, compliance follows on its own. The reverse has never worked.

The McKinsey story is the AI security argument in one incident. McKinsey built an internal LLM trained on the entire work history of their organization, including client deliverables, strategy documents, and consulting processes for 57,000 employees. A researcher built an AI tool to probe it from the outside. He got in through a single API endpoint with no authentication requirement using SQL injection, a technique documented for decades. Once inside he could have exfiltrated hundreds of thousands of documents and, more critically, could have manipulated the prompts that drive McKinsey's consulting recommendations. A tweaked prompt on a buy-sell decision could redirect billions in client capital. McKinsey's CISO responded correctly. But the point James makes is the quiet one underneath: he may not have been the first person in.

The manufacturer story runs a parallel track. ISO 27001 certified, policies documented, controls in place on paper. IT opens Active Directory to the full VPN during a troubleshooting session and never closes it. Service accounts pick up the exposure. Ransomware comes through a print service account using a password that was basically the company name with a number and an exclamation point. Shipping shuts down. $15 million in losses in two days. Cyber insurance covers $5 million. The other $10 million is on the company. And six months after James is brought in for incident response, the same executives who were writing any check necessary start asking whether they can cut the security budget.

Real Talk

If you cannot answer the question of what you are actually protecting and why it matters, you do not have a security program. You have a policy document and a hope. Start with the door.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

"I asked them at least 15 times over the years: are we sure we still want to do this? And they kept saying yes. So here we go."

Who They Brought In

Danielle Palmer is the Senior Operations Manager at Fraym, a geospatial analytics company based in Arlington, Virginia with a fully remote global team spanning Canada, Ireland, Germany, and beyond. Fraym works with clients like the Gates Foundation on gender equity and economic development in Africa, and with the federal government including the National Geospatial Agency on defense-related analytics. The company is approaching its tenth year and has grown from delivering PowerPoint decks to building interactive, manipulable data dashboards at a global scale. Danielle came to Fraym from over a decade at Apple in technical support, with no cybersecurity background and no compliance experience. She has spent the last three-plus years inside one of the messiest, most instructive CMMC journeys a small company can have, and she is still standing.

What Got Loud

• What it actually looks like to navigate CMMC as a team of one with no security background, no predecessor documentation, and a scope that keeps shifting under you
• Fraym's original MSP got acquired mid-journey, decided not to pursue CMMC, and employed non-US-based technicians. Danielle had to pivot immediately or stay stuck
• Why being entirely cloud-based with a 75/25 Mac-PC split makes Fraym nearly impossible for most consultants to work with, and how that narrows the vendor pool fast
• CMMC scope is not a document. It is a living argument. Google was in scope, then it was not. Workstations were in scope, then they were not. The line keeps moving
• Two leadership changes in one year, including a CEO departure and the loss of the primary security officer, forced a full reassignment of admin responsibilities with no roadmap

The Rundown

Danielle's CMMC story starts in January 2022 when she was hired specifically for her Mac technical experience and handed an additional task on day one: figure out whether Fraym needed to comply with CMMC, what that would require, and how to get there. She had never heard of CMMC. She had no security background. What she did have was the technical instincts from a decade at Apple and the operational discipline to start asking the right questions even when nobody could give her straight answers.

The first major problem was scope. Fraym is not a traditional enterprise. They are entirely cloud-based with no on-premise servers. Their product runs on AWS. Their storage moved from Dropbox to Box. Their team runs 75 percent Mac and 25 percent PC, and they are global. Most CMMC consultants are built for Microsoft-heavy, on-premise environments and simply do not know what to do when faced with a setup like Fraym's. "Very few people were familiar with our setup," Danielle says. "Some people are just absolutely only Microsoft and that's all they know. So they're just not going to be able to work with us." Finding a thought partner who could actually see their environment clearly took longer than it should have.

The MSP transition is where the episode gets operational. Fraym's original MSP was pursuing CMMC. Then they were acquired by a larger organization that decided not to pursue it and employed non-US-based technicians. Both of those facts made them immediately incompatible with what Fraym needed. The pivot had to happen fast, right as their contract was expiring. What made it harder is that the acquired MSP had not documented what they had done. The technician who had set up most of Fraym's systems was gone. Danielle describes the transition as archaeology. "They were finding tools on our computers from the old MSP, installed and not even known about." Cyberlynx came in through a conference introduction from Matt Connor and has been the right fit since.

The scope conversation is the one that anyone navigating CMMC for a non-traditional organization will recognize immediately. Is Google in scope because contract information arrives via email? It was, then it was not. Are workstations in scope? That answer moved too. FCI, Federal Contract Information, sounds clear until someone describes all their quality data as FCI and it is not. Danielle is direct about what this costs: "I've been on version 22.5 of my documentation." The DoD keeps moving and the organizations following it have to move with it, often mid-implementation.

The personnel piece is what takes this episode beyond a standard compliance story. Two leadership changes in rapid succession, including a CEO departure and the exit of the person who had effectively been the security officer, forced Danielle to restructure the entire approval and implementation chain with no overlap and no documentation handoff. She is now the implementer. The VP of finance is the approver. Neither role was designed for this. Her honest take: "I'm a team of one. There is no other team with me. And that's not enough for division of admin responsibilities."

Real Talk

If your CMMC journey is messy, inconsistent, and more expensive than anyone told you it would be, Danielle's experience is not a warning. It is a map. The companies that make it through are the ones who stay in the room and keep asking the question even when the answer keeps changing.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

"Every business owner who hires an MSP should ask one question: what are you doing to protect me from your own tools?"

Who They Brought In

Anthony Gerasch and Ryan Carter run Unique Computing Solutions out of the Chicagoland area, an MSP Anthony founded in January 1997 that is approaching its 30th year in business. Anthony started as a programmer and moved into managed services around 2003. Ryan has been with the company for close to a decade. Together they built a security-first operation before leading with security was the standard, and they have the CMMC journey and the decade-long SOCSoter partnership to back it up. They also co-host the Business Owners IT Podcast, which gives them a second channel for educating the clients their direct work reaches. Between them they cover the full stack: Anthony on operations, tooling, and the business of running a clean MSP, and Ryan on compliance, frameworks, and the gap between what companies think their security looks like and what it actually is.

What Got Loud

• The one question every business owner should ask their MSP and almost never does: what are you doing to protect me from your own tools
• Anthony's Active Directory walk-through: the moment a client says we are fine, he opens the directory and starts asking who each user is, and the answers are always bad
• A one-man electrician shop let a stranger into his Microsoft 365 in exchange for a free website build. What happened next is the clearest possible argument for not skipping the basics
• AI governance does not exist yet and companies are using 14 different AI agents in a single meeting with zero policy around any of them
• Why AI for compliance is an 80% solution at best, and the 20% it cannot do is the part that gets you in court

The Rundown

Anthony's security-first position is not a tagline. It is a condition of being a client. If a business does not have the basic security stack in place, Unique Computing Solutions does not bring them on. He is direct about why: an MSP that is not secure does not just put itself at risk, it puts every client it touches at risk. His analogy is as clean as it gets. A bad doctor can kill someone. A bad MSP can do serious damage at scale and most business owners have no idea. The question he wants every business owner to be asking before they sign with an MSP is not what can you do for me. It is what are you doing to make sure your access to my systems cannot be turned against me.

The identity conversation is where the episode gets granular. Ryan walks through what it actually looks like when a company says they are good and he opens Active Directory. Former employees still active. Accounts renamed instead of disabled. Five domain admins including Jennifer, who left. No one knows why she had domain admin rights in the first place. The companies that are most confident tend to have the most exposure, and the small ones are not exempt. Five users can have just as much wrong as five hundred. The reason is always the same: nobody is watching and nobody knows what right looks like. Anthony's fix is a baseline. If you do not know what your environment is supposed to look like, you will never catch a deviation. And a deviation is exactly how a breach starts.

The electrician story is the episode in a single anecdote. A one-man shop was offered a free website in exchange for access to his Microsoft 365. He said yes. The attacker used his account to register impersonation domains using his credit card, assigned Exchange licenses to themselves, and started sending phishing emails impersonating major companies. The victim had no idea until he was locked out of his own account. Anthony's team recovered his access through an old account that had never been cleaned up. The point is not just that it happened. It is that it happens because Microsoft 365 is handed to people who do not know what securing it actually requires. Out of the box the security score starts at around 40 percent and the target is 70. Most small businesses buy it for email and stop there.

The AI governance discussion is where Anthony and Ryan agree most sharply. Every meeting Anthony joins has AI agents attending from every participant's company, all different brands, all different configurations, with no organizational policy governing any of it. Ryan's position on AI for compliance is consistent with what Melissa sees from the SOCSoter side: it is an 80 percent solution and the 20 percent it cannot handle is the nuanced, business-specific piece that compliance actually requires. An AI tool will search your email and return answers it thinks are correct. If you do not know what the correct answer actually is, you will submit a compliance document with errors and not know it until something goes wrong.

Real Talk

If you have not walked through your own Active Directory recently and asked who every user is and whether their access level makes sense, do that before your next client meeting. The most confident organizations are almost always the most exposed.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

"Everything that was wrong last week is still wrong this week. The difference is now you get to see it."

Who They Brought In

Nathan Case is the CTO of TPO Group, a security and policy firm whose partners include some of the most credentialed names in the industry: a former CSO of Azure, a chief lawyer from Cisco, and the person who wrote the cybersecurity policy for the United States. Nate's own path started in the mid-90s writing C-sharp and experimenting with early internet protocols, moved into facial recognition software in 1998 and 1999, then shifted toward encryption work for the Department of Energy and hardware pentesting on firewalls. He helped build the data centers that became AWS US West and US East, spent years doing incident response and security architecture across government and private sector clients, and still codes today. He is also faculty at an AI institution and brings a rare combination of builder, breaker, and responder to every conversation he enters.

What Got Loud

• The cybersecurity apocalypse people are afraid of already happened. It happened 35 years ago when basic hygiene got abandoned. AI just turned the lights on
• Why nation states are no longer targeting just governments and enterprises. Small companies are now in the blast radius and AI is what made that scale possible
• A defense contractor was using Social Security numbers as the primary ID in a grill ordering app at a facility near the Pentagon. Nate found it during a database migration
• Why AI for incident response is a trap: your attacker's AI is going to talk to your AI, and cheaper is not a strategy
• The logistics company that did not know its crown jewels were the shipping routes for dangerous chemicals that could be weaponized. That is what attackers actually want

The Rundown

Nate's framing for where AI sits in the security conversation right now is the sharpest in the series so far. His argument is not that AI creates new threats. It is that AI illuminates the threats that were already there. The map was always that big. You just could not see the edges. "There were bad things that were coming to get you last week," he says, "but now you can see them." For a lot of organizations that means the news is bad. The work ahead is significant. But at least now you know what the number is. The FUD era of security selling, where fear was the product because nobody could quantify the actual exposure, is over. AI makes the negative space visible for the first time.

The nation state conversation is where the episode gets uncomfortable fast. Nate is working on a paper about unrestricted warfare, specifically what it looks like when nation states target civilian entities with no rules of engagement. What he is seeing in incident response right now is that scale has removed the friction. AI and cloud infrastructure make it trivially easy for attackers to go after everybody at once. The small logistics company, the water treatment facility, the five-person critical infrastructure team. "If you're the unlucky deer and you stumble in the forest and everybody else is running a little faster than you, you're the one that gets jumped on." The answer is not panic. It is the basics: MFA, endpoint protection, zero trust. Not because they solve everything but because they remove the easy targets from the herd.

The crown jewels story is one of the most instructive moments in the episode. A logistics company brought Nate in for incident response and did not think of themselves as a high-value target. They moved chemicals. What they did not fully reckon with was that they held the logistics data for those chemicals across the entire planet, including chemicals that could be used in weapons development. The attackers were not after money. They were after the map of where those materials move and who controls the routes. Nate's point is that most companies have no idea what their actual crown jewels are, and the attacker has usually already figured it out before the company has.

The AI and human labor debate comes up toward the end and Nate does not hedge. AI is exceptional at synthesizing vast amounts of data. It is not good at understanding second and third order impacts, at creative problem-solving inside a unique business context, or at knowing when to turn over the next rock in an incident investigation. "I've done a couple incidents over my lifetime," he says, where the key insight came from thinking like the attacker, asking a question nobody had asked yet, and following a thread that no automated tool would have surfaced. A bank that laid off 20,000 people and then discovered its AI token costs were lower than those salaries is the cautionary tale he drops at the end. The humans are still the answer. The question is what you are giving them to work with.

Real Talk

If you do not know where your sensitive data lives, how it moves, and who would want it, you cannot protect it. Ask the stupid questions now. The attacker already has.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit SOCSoter.com.

"It's not like I'm afraid of commitment. I want to earn your business every single month, not one month a year."

Who They Brought In

Matt Connor is the CEO and Founder of Cyberlynx, an MSP he started sixteen years ago in Lexington, Virginia, after a stint on Wall Street that, by his own admission, cost him a lot of money. He built the company from the ground up under the name Your IT Department, grew it into a thriving managed services operation, and rebranded to Cyberlynx as the business moved deeper into cybersecurity. Today Cyberlynx runs both an MSP arm and a value-added reseller side, serving clients ranging from small businesses to some of the largest companies in the world. He is also the host of The Cyber Business Podcast, where he covers cybersecurity, IT, and the business of running an MSP.

What Got Loud

• Why Matt deliberately does not want to grow his MSP and why that counterintuitive decision has made it more profitable, not less
• The physician model for MSP client relationships: why asking the right questions earns more trust than delivering the right answers
• Cyberlynx has never lost a client to "you guys suck" in sixteen years. Matt explains exactly how that happens on a month-to-month contract
• The sweet spot for SOCSoter deployments: why companies between 200 and 500 employees are where the tool fits best and why going bigger gets complicated fast
• Why AI is not replacing your level one tech. It is turning them into a level three and if your MSP is not using it for everything, you are already behind

The Rundown

Matt's philosophy on MSP client relationships comes down to one analogy he keeps returning to throughout the episode: the physician. When you go to a doctor who skips the questions and writes the prescription in thirty seconds, you leave uneasy even if the prescription was right. The same thing happens when an MSP pitches a security stack without walking the client through why. The bedside manner is not filler. It is the whole trust-building exercise. "They don't know enough," Matt says about clients, "and those that do know some, they may have ChatGPT, they may have Googled it. So they've got some stuff. Cool. Just like going to the doctor." His point is that MSPs who treat every client touchpoint as a sales opportunity are doing the opposite of building trust. The ones who occasionally say "you don't actually need that" are the ones who keep clients for sixteen years.

The month-to-month contract model is where Matt genuinely diverges from most of the industry. He does not believe in locking clients in. His position is that the moment you sign a three-year agreement, the incentive to earn the relationship every day quietly disappears. He has watched it happen on both sides. The energy that builds through the sales process evaporates the moment the ink dries and the account gets filed away until renewal. "You can cash those checks for three years," he says, "but at the end, you know, you're probably going to be looking for a new partner." Cyberlynx has retained every original client from sixteen years ago. Two were lost to acquisitions. Zero to dissatisfaction.

On the question of where SOCSoter fits in the market, Matt is precise. The sweet spot is companies between 200 and 500 employees who have not yet hired a CISO or CIO. They have budget, they trust their MSP completely, and they are not running procurement through a committee. Once you get into the 500 to 2,000 employee range, more decision makers enter, more competition shows up, and the buying behavior shifts toward name-brand recognition. "Nobody's ever been fired for buying Cisco" is the enterprise logic Matt is describing, and it is the wall that makes the mid-market so important to own well before organizations scale past it.

The AI conversation is where Matt gets direct about what he thinks MSPs are still getting wrong. He is not worried about AI replacing people. He watched Amazon lay off 30,000 employees and then rehire because they overcorrected. His take is that AI is not a headcount replacement. It is a capability multiplier. A level one helpdesk tech using AI to troubleshoot is solving problems at a level three rate. "Supervision is so much faster and easier than creation," he says, and that reframe applies to every support ticket, every client email, and every security alert that comes through the queue.

Real Talk

If your retention strategy depends on contract length instead of relationship quality, Matt's sixteen-year track record is the argument against you. Month-to-month is not a risk. It is the accountability structure that keeps you sharp.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

"For me, healthcare is the center of all 16 critical infrastructures. Because if you can fix healthcare, you can fix everything else."

Who They Brought In

Janine Medina is the Director of Operations at SOCSoter, and she might have the most varied path to cybersecurity of anyone in this series. She started in tech twenty years ago as an administrative assistant at a nursing home for nuns, moved into industrial control systems managing building infrastructure, then spent years doing clinical informatics across most of the hospitals in New York. She built electronic medical record workflows for surgical oncology, navigated the Meaningful Use era in healthcare IT, worked in banking and finance, consulted for the government on healthcare cybersecurity, and spent time in the medical device manufacturing space focused on regulatory compliance across the 16 critical infrastructures. She joined SOCSoter as Director of Operations and now functions as the connective tissue between sales, marketing, tech, and cybersecurity. Her job, in her own words, is to make one hand understand what the other is doing.

What Got Loud

• Why MSPs telling their healthcare clients they are HIPAA compliant with just an antivirus and a firewall is not just wrong, it is putting those clients on a federal breach list they do not know exists
• HIPAA 2.0 is already being drafted and it is not just about privacy anymore. It is about your full cybersecurity stack, your devices, your redundancy, and whether you can survive an incident
• The Three Little Pigs framework for explaining MSP security posture to clients who do not speak cyber. Straw, sticks, or brick. Most organizations think they have brick
• What happens to your healthcare data, your house deed, and your financial accounts when you die and nobody is watching
• Why healthcare is the Rosetta Stone for all of cybersecurity and the industry that gets attacked most because of it

The Rundown

Janine's entry point into the episode is a framework she arrived at the morning of the recording. She calls it the Three Little Pigs model and it is exactly what it sounds like. A company with no real protection is a house of straw. Add some tools without cohesion and you have sticks. A properly architected security posture is brick. The big bad wolf, automated, fast-moving, and indifferent to your business size, can level the first two. The third one makes him work. It is a blunt and effective way to explain to any client why tooling without architecture is not security.

The HIPAA conversation is where Janine gets direct. She is watching MSPs tell their dental and optometry clients they are HIPAA compliant while running nothing more than basic endpoint protection and a firewall. Those clients are not compliant. They just do not know it yet. When something goes wrong they end up on the HHS Office of Inspector General breach list, facing per-record fines, billing disruption, and reputational damage that is very hard to recover from. Janine's position is that the MSPs doing this are not being malicious. They just have not read the regulation. "Talk to me," she says, "or just read the regulation."

HIPAA 2.0 raises the stakes further. The incoming framework is not just about data privacy. It extends to medical devices, security perimeters, redundant systems, and incident response timeframes. The Joint Commission is developing a cyber readiness accreditation for hospitals on top of that. Janine's read is that the smaller independent practices, dentists, optometrists, private clinics, are the most exposed because they have no hospital system infrastructure behind them and no clear roadmap for what compliance is supposed to look like at their scale.

One of the sharper moments in the episode comes when Janine reframes the entire cybersecurity communication problem through language. Healthcare and cybersecurity already share a vocabulary. A virus behaves the same way whether it is biological or digital. It enters a system, duplicates, spreads. Her argument is that if the industry just started using that shared language, the normalization of security conversations in healthcare settings would move significantly faster. "If we just had better conversations of what a virus is, it's almost the same thing. Everybody will understand each other."

The episode closes on something most security conversations skip entirely: what happens to your data after you die. House deeds are being signed over to strangers who read obituaries and file fraudulent paperwork. Loans are being taken out against properties. Medical records sit in systems for seven years after your last visit with no one actively protecting them on your behalf. Janine's point is not to induce panic. It is that survivability, the protection of your data and your assets across your entire life, is a cybersecurity conversation the industry has not started having loudly enough yet.

Real Talk

If you are an MSP and you have ever told a healthcare client they are HIPAA compliant without a thorough controls review, this episode is worth your time before the next audit finds that out for you. HIPAA 2.0 is coming and it will not be optional.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

"If you can't reach us, it doesn't mean we're ignoring you. It might mean all hands are on deck for a major incident. And honestly? If it were your company we were fighting for, you'd want every one of us on that call."

Who They Brought In

Angie Broadwater is SOCSoter's SOC Manager, and she got here the hard way. A career in the spa industry, a pandemic, a husband who has been in cybersecurity since age 16, and a decision to go back to school at West Virginia University for her MBA while simultaneously earning three cybersecurity certifications including the CEH. She came in as a SOC analyst and operational admin. Two and a half years later, she runs the team. She also participated in the NATO Locked Shields exercise alongside the Department of Defense, CISA, and the National Guard. Not your typical career path. That's the point.

What Got Loud

Ticket volume swings from hundreds to thousands depending on the day, and Angie is still in the queue herself Bad actors are now using Axios user agents for bot activity and scripting, and when the SOC sees it, it is 99.9% always malicious Free personal VPNs are not protecting your company. They share infrastructure with the same threat actors trying to get in AI is being positioned in the industry as a tier one SOC analyst. Angie has thoughts on that. If your admin password is "admin," this episode is specifically for you Compliance and security are not the same thing, and checking the box is not the same as being protected

The Rundown

Angie didn't come up through a traditional IT pipeline, and she makes no apologies for it. The skills she built in the spa industry translated more than people might expect: managing operations, staying calm under pressure, handling a lot of moving pieces at once. When COVID shut everything down, she made a decision. Get the MBA, get the certifications, get into cybersecurity. Three certs later, including passing the Certified Ethical Hacker on her first attempt with great scores, she landed at SOCSoter and has not slowed down since.

The day-to-day inside a 24/7 SOC is not what most people picture. Angie describes it as looking for a needle in a haystack where there might not even be a needle. The team handles hundreds to thousands of tickets on any given day across priority, general, maintenance, and help queues. Patch Tuesday means more volume. Weekends mean maintenance windows. And through all of it, Angie is still in the queue herself, still running vulnerability scans, still fielding calls. The SOC manager who stays in the work is a different kind of manager.

Two things Angie flagged that every MSP and IT team should hear. First, on VPNs: free personal VPNs share IP infrastructure with known malicious actors. The SOC catches logins coming from IPs flagged for malicious activity thousands of times over, and those same IPs belong to the free VPN pools your users think are protecting them. The data being transmitted through those VPNs, including usernames and passwords, can be intercepted. Business VPNs cost more. The breach they prevent costs more than that. Second, on speed: when a bad actor gets into a cloud environment, they are not browsing around. They are running automated scripts that can read hundreds of emails, exfiltrate files, and set up persistence in under ten minutes. Every minute SOCSoter cannot reach someone to authorize a block is another minute of access. Give the SOC the permissions it needs to act fast.

Angie closed with practical recommendations that sound simple and still get skipped constantly. Patch and actually remediate vulnerabilities, not just scan for them. Run phishing training because even security professionals get fooled now. Back up your data offsite, not just locally and not just with snapshots. Change default admin credentials. And communicate with your SOC when anything in your environment changes, because the team is not clairvoyant.

Real Talk

Compliance checks boxes. Security protects your business. Angie knows the difference because she lives in both worlds every day. The controls that feel pointless often matter more than the ones that feel obvious, and the ones that feel obvious, like not using "admin" as your admin password, still need to be said out loud apparently. Work with your SOC like a partner, not a vendor. The ones who call the most are usually the ones who care the most.

Catch It

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If you want to know whether your security setup would pass the Angie test, let's find out together. Visit socsoter.com.

"Two to three high alerts a day, some weeks. And when they get in? Eight minutes. In eight minutes, a threat actor read over 200 emails, uploaded malicious files to SharePoint, set up a malicious survey, downloaded from OneDrive, and added a malicious app to the tenant."

Who They Brought In:

Isaac Anderson is SOCSoter's Technical Account Manager, five years in and probably the person on the team who has touched more customer environments than anyone else. He sits at the intersection of the SOC, engineering, account management, and the clients themselves. If something goes wrong in a customer's environment, Isaac is in the room. He also designed SOCSoter's reporting. Left brain, right brain. Don't sleep on him.

What Got Loud:

• Attacks are up roughly 10x since Isaac started, and that's his conservative estimate

• The Nigerian Prince email is dead. AI-crafted spear phishing now targets CEOs with flawless English for under $1,000 in tools

• Microsoft's built-in "risky sign-in detection" is, in Isaac's words, almost worse than useless

• Four specific things most companies aren't doing in Microsoft 365, and why not having them is basically leaving the door open

• Every industry is a target. Isaac's wife works at a printing company. They got hit too.

• 60% of small and mid-sized businesses that take a ransomware hit end up closing. Full stop.

The Rundown:

Five years ago, SOCSoter's alert volume was manageable. Today Isaac is fielding two to three high alerts a day, some weeks. The driver isn't mystery. It's math. AI has made it cheap, fast, and easy to launch sophisticated attacks at scale. The old tells are gone. Broken English, weird logos, obvious spoofing. Threat actors have moved past all of it. Spear phishing targeting C-suite executives now runs on tools that cost a few hundred dollars, tops. The return on investment for attackers is enormous. The risk of getting caught is minimal.

The conversation zeroed in on Microsoft 365 because that's where most of the damage is happening. Isaac made a point worth writing down: Microsoft does a great job reassuring you their product is safe. They do a poor job making sure you actually understand your own responsibilities in managing it. The gap between those two things is where breaches live. Most of what Isaac's team sees comes down to improperly configured conditional access policies.

Four fixes cover the majority of incidents: block unmonitored devices from accessing your 365 environment, enforce MFA globally without exceptions, set up geo-filtering, and require frequent re-authentication. None of this is exotic. All of it gets skipped constantly.

Then Isaac described a real incident. Eight minutes of access on a compromised admin credential. In that window, the threat actor read 200+ emails, uploaded malicious files to SharePoint, set up a phishing survey using Microsoft's own tools, downloaded files from OneDrive, and added a malicious application to the tenant. All scripted. All automated. SOCSoter's engineering team had a full incident report ready within 30 minutes. Soon that drops to under a minute. That remediation, the walkthrough, the cleanup, the follow-up, is included in the service. No extra charge. Melissa closed with something that doesn't get said enough: SOCSoter is not clairvoyant. If your environment changes, new firewall, new VPN policy, new anything, you have to communicate it. Security is a partnership. The SOC can only protect what it can see.

Real Talk:

Microsoft 365 is where your business lives. It's also where attackers are spending most of their time. The four things Isaac laid out, unmonitored device access, MFA enforcement, geo-filtering, and forced re-authentication, aren't advanced. They're table stakes. If you don't have them in place, you're not saving money. You're just deferring a very expensive conversation.

Catch It:

Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If your Microsoft 365 environment hasn't been reviewed lately, let's fix that before someone else does it for you. Visit SOCSoter.com