The ART of Security Summit: Strategic Risk Management for CISOs | Mike Arrowsmith, NinjaOne - Transferring Risk

Clips
More from The ART of Security Summit: Strategic Risk Management for CISOs

Michael Arrowsmith

Chief Trust Officer

NinjaOne

play_circle_outline NinjaOne announced new capabilities for vulnerability management and patching workflows

play_circle_outline Enhancing Security Posture with NinjaOne: Importance of Partnering with MSPs and MSSPs

play_circle_outline NinjaOne's customer service, single platform solution, and backup capabilities for MSPs

Info

Mike Arrowsmith, NinjaOne - Transferring Risk

Michael Arrowsmith

Chief Trust Officer NinjaOne

search

Jackie McGuire

>> Welcome back to The ART of Security Summit. I'm Jackie McGuire, practice lead and principal analyst for security at theCUBE. We have gotten to our transfer segment, so today we're going to be talking about transferring risk. We did a survey at RSA last year in conjunction with ETR that showed that for the vast majority of small and mid-sized businesses, they actually prefer to in-house security entirely. It's a bit counterintuitive given that smaller businesses usually have less resources, so we want to explore what transferring risk actually looks like, how it's done effectively, and then what the unique risks for managed security services providers and service providers are when they accept that risk. Joining me again is a familiar face. Mike Arrowsmith is the Chief Trust Officer for NinjaOne. NinjaOne is unique in that they service both individual customers as well as those service providers.

Jackie McGuire

So Mike is going to talk to us a little bit about the unique needs and how to effectively partner with service providers. But first I actually wanted to talk about an announcement that NinjaOne just made because I think it kind of shows what we're talking about right here. So Mike, NinjaOne just announced new capabilities that unify vulnerability management and patching workflows, and these are some of the kind of most basic things associated with security practices, but they are some of the things that smaller and less, more resource strapped teams struggle with. Can you tell us a little bit about the new capabilities and how they're going to help teams to better manage their security posture?

Michael Arrowsmith

>> Absolutely. Thank you, Jackie, again, for having me today. I'm really excited today at Ninja to be able to announce a new product functionality around vulnerability. So today in our current offering, we integrate with all the major brands of cybersecurity scanners for vulnerabilities, so the Tenables, the Qualys, the Rapid7s of the world. What we have done in this latest version of if we opened up our software integration to accept essentially a CSV import for our customers that may not have one of the big three, or maybe they have more of an isolated scanner or maybe an older scanner or whatever flavor that they might have to allow them that ease of transition from identifying what vulnerabilities are, what CVS or CVE scores they might be, and then actually connecting that to what I would consider is the easy button for NinjaOne to be able to apply those patches against those specific nodes or endpoints. That's the number one functionality that we've introduced within this product is really fixated and focused on those customers that are looking for a world-in-class, best-of-class experience for mitigating those vulnerabilities and reducing the overall exposure to what those vulnerabilities may pertain to their environments.

Jackie McGuire

>> That's fantastic, and that's something that'll probably be useful to both your individual customers as I imagine, as well as your service providers because they also have to deal with a whole smorgasbord of vulnerabilities and patches and updates for all of their customers as well.

Michael Arrowsmith

>> Absolutely agree. I think the core of the essence of the product is really for the smaller customers that are, maybe to your point earlier, they're these smaller organizations that might not have a dedicated cybersecurity function. Maybe they have a bunch of ITs, or maybe they are an MSP providing these types of services, or an MSSP to their customer base and really trying to streamline that for all of those customers, especially those that may have these legacy tools or these other types of vulnerability scanners that they want to still leverage, they still want to be able to be able to project some mode of confidence to their board, to their leadership teams, or to their customers. So we're really excited about this feature. We believe it not only will help individual organizations, it will help MSPs. It will help MSPs at any size and scale, and that's really the way we think about these particular products. We want to help as many customers as possible reduce their risk and ultimately improve their customer experience.

Jackie McGuire

>> Awesome. That's exciting. That was announced on the 22nd, so that'll be one of the big buzzes at RSA, I'm sure. This is actually probably a good segue. The last step that we're going to talk about today is the transfer portion of the risk journey, and usually with individual organizations, when we talk about transferring risk, we're typically talking about cyber risk insurance, so something that transfers the cost of if a risk actually happens to someone else. But in this case, we're actually going to talk about being a service provider because another way to transfer risk is to use a service provider, but you also service a lot of managed service providers and managed security service providers, and they're in the business of accepting risk, and in this day and age, there's a lot of risk to accept. So I was wondering if you could just start by talking about maybe some of the differences between the needs of managed services providers and security services providers and your individual customers and the reason that they use NinjaOne.

Michael Arrowsmith

>> Yeah, great question. I think where we see the most level of success for NinjaOne today is in the MSP and MSSP world. When we think about transferring risk, we're talking about the service providers that are effectively servicing our local doctor's office, our government facilities, our small businesses, you name it. They range from size of two or three people to hundreds if not thousands of individuals. And when we think about transferring of risk, it is solely around that end point is where Ninja can help these MSPs and MSSPs try to eliminate, reduce or effectively mitigate some of that transferred risk by those organizations. And we come back to this idea of what kind of risk they may have. It really comes down to the data that those specific organizations may have. Doctor offices are going to have EPHI, they're going to have electronic protected healthcare information about all of their patients within those organizations. Government entities may have individual data on me, my social security number, my driver's license number, my address, things that are of a sensitive nature. That is the main culprit behind that transferable of that risk and why those organizations look to transfer that is they may not be staffed internally to be able to facilitate whatever might be regulatory required, maybe just best practices from a cyber perspective. Maybe they're a small mom and shop coffee place that just has a lot of credit card data or just personnel customer data. And so by leveraging these MSPs, they can transfer that risk to them and ultimately depend on that MSP to do the due diligence, do the general hygiene of those endpoints in that environment from a day in and day out. We see Ninja being the predominant choice chosen by these specific MSPs because we offer a best in class customer service. As we kind of highlighted in the previous segment, we have a 97 plus percent customer satisfaction score with all of our customers. We offer a singular platform, as cliche as it might sound, to have a single pane of glass, that is the solution that we provide to our customers. We don't care what type of device you might have, whether it's a Linux system, a Windows system, a Mac system, we can help manage all of them. We provide not only a robust patching product that allows our customers to be able to easily apply patches, we can provide just a general administration applying other types of packages, applying remote access, privileged access to those specific endpoints. We also provide backup solutions. So we start to expand on the capabilities that those same MSPs and MSSPs may be providing to those organizations and provide them a singular tool that can enable them to invest less in the actual technology and more in the interfacing the people, the surrounding support stacks that they may need to continue that high velocity or best in class service that they themselves come to expect from their customers. So Ninja is really well suited to be able to continue to grow into that space, and as we push into what we call mid-market or further into enterprise IT, we're going to see more and more adoption from our customers, but also new prospects, new folks that are becoming aware of what Ninja can do. We truly do believe we have the best solution in class today.

Jackie McGuire

>> Yeah, I think it's interesting. I don't know that I had fully really thought about the customer service speed and satisfaction piece of it, but if you are a service provider yourself, your ability to provide good customer in response times to your customers is entirely dependent on your vendor's ability to provide good customer service to you. So that's a great point in that your fates are kind of tied together with these service providers in that their service is only as good as your product and service.

Michael Arrowsmith

>> I totally agree. One of the things I think, I've been traveling all over the world, one thing that you often will hear about Americans, but in general is we are incredibly polite as a culture, and it's that politeness that kind of plays out and our expectation is we want to go fast, especially here in the Silicon Valley. We have this play hard play tough kind of mentality, but give everything that you got as part of being a service provider. And it's that same mentality that we're playing out with our customers. We want to give world-class service quickly, fast, responsive answers that are complete and to the point as effective as possible so that our customers cannot worry about the technology stack, but what they need to do to service their customer.

Jackie McGuire

>> I grew up in New England, so I would disagree that we're very polite.

Michael Arrowsmith

>> I love it. I love it.

Jackie McGuire

>> Yeah. I actually, I took my family back and we were at a four-way stop sign and the guy to our right didn't go when he should have, and the lady behind him rolled the window down and dropped some F-bombs, and I was like, "Well, kids, this is where I grew up. Now you know why I have to be nice when I go to California."

Michael Arrowsmith

>> It happens. And I'm certainly, I probably have been that same guy in that same car at one point or two in my life. But in general, I do agree.

Jackie McGuire

>> Yeah, I think I've softened as I've gotten older. So that actually is a good segue into one of the questions that I had, and this is a little bit more theoretical, but I had referenced this survey we did at RSA last year that showed that the smaller a customer is, the more likely they are to have a strong preference for in-house management of security. I don't think that's the right choice for most organizations obviously, because you just can't do it yourself with a team of four or five 24 hours a day. And I think a lot of it comes down to either not knowing how to select a service provider, feeling like it's more of an outsourcing security than actually partnering with somebody or not really knowing how to hold them accountable for the work they do. You're a Chief Trust Officer, so I think a lot of this comes down to trust. So theoretically speaking, what do you think are some of the things that we can do to build more trust between MSPs and the security leaders who really should be using them?

Michael Arrowsmith

>> Phenomenal question. I get asked this often. So I think that, a couple of things on this. Number one is knowing the pain points about your customer, what motivates them is key to any successful mission. Trying to understand what is the burden behind that customer? What are their objectives? What are their milestones that they're trying to hit? And specifically what types of services that they're looking for MSPs to be able to engage on is fundamentally number one. MSPs typically charge based on a number of devices, systems, users, number of applications. So it's instinctive to want to dig into more of those use cases on how that customer is really fundamentally wired for these sets of services. It's actually been funny. It's one of the same things that I've leveraged in the past lives, past career opportunities where I've leveraged MSSPs to provide some functional sets of services to me. Another big thing for organizations is to really iterate it on is setting realistic expectations. There's a lot of conversations, a lot of good things to be had by having internal cybersecurity. Don't get me wrong, I always will be a preferable or maybe lean correctly towards keeping it internal as much or as maybe even both as an idea. And there is just so much value that I think you get by shifting further and further and further left closer to the business, closer to your critical workloads and having cybersecurity folks embedded into those sets of services. Cybersecurity folks are not cheap. It is incredibly difficult, incredibly competitive to acquire top tier talent. Beyond that, this is the area where MSPs can really, I think, distinguish themselves against what smaller organizations or even sometimes the larger organizations can accomplish. You can keep a really small nucleus of high profile, highly skilled individuals that can do a lot in a very quick and short amount of time for customers. And when we think about incident response, our focus, when we have a breach, when we have a cybersecurity incident, how we got breached, how we were popped, how that malware or whatever might've happened is the least of our concerns. It's really about containing it, trying try to contain the damage that may be going on, whether it's an impact to an operational service, maybe financially driven, maybe it's a ransomware. How do we recover? How do we get to a place where whatever happened, we can spend our time and go through the various rabbit holes on how that particular attack is performed on us is really where the MSP can help tremendously in that containment. By having a subset of skills by that high level discipline that it's almost, think of it as that old-fashioned tiger team that you can bring into the organization, quickly start tearing down various silos, processes that may be obscure or unclear, and get to the source of where that particular containment has to be. That's the two biggest things in my opinion, that MSPs and organizations can really, I think, set themselves up for a wonderful experience with MSPs. Oftentimes, I have seen some MSPs in the past not do their due diligence, offer a set of generic services, and unfortunately it's those types of services, those types of MSPs that tend to maybe jade or maybe form a bias from everybody else that maybe have used those MSPs in the past. And I just want to be clear, there are so many good MSSPs and MSPs out there that can provide tremendous, tremendous value to any size of the organization. Just have to set expectations appropriately.

Jackie McGuire

>> Yeah, absolutely. And I think that's a really good point is that if you're managing your own security and you wait until you have a breach, you try to respond to it yourself, you figure out it's beyond your five or 10 person team's capabilities, then you reach out to an incident response firm, then they get engaged. So that is an insane amount of delay between issue and resolution, and the amount of lateral movement and damage in that period can be extreme. So I think that's a really good thing to point out. Mike, thank you so much for joining me twice today. I really appreciate that. I want to give a quick shout out to your activities at RSA again, because it's coming up quickly. So I know you had mentioned a Blazers and Bourbon event, which are you doing women's blazers too? Can I come?

Michael Arrowsmith

>> I've been told it is agnostic, so please, women, ladies, men, please come join us. I would absolutely love to see everybody and anyone.

Jackie McGuire

>> Yeah. Awesome. I will try to stop by if my feet aren't fully blistered by then.

Michael Arrowsmith

>> It's a lot of walking.

Jackie McGuire

>> Yeah. All right everybody, thank you so much. This is Jackie McGuire, practice leading principal analyst for theCUBE for The ART of Security Summit. We will be back in just a few minutes with some more information about transferring risk. Thank you.

Mike Arrowsmith, NinjaOne - Transferring Risk

search

Jackie McGuire

>> Welcome back to The ART of Security Summit. I'm Jackie McGuire, practice lead and principal analyst for security at theCUBE. We have gotten to our transfer segment, so today we're going to be talking about transferring risk. We did a survey at RSA last year in conjunction with ETR that showed that for the vast majority of small and mid-sized businesses, they actually prefer to in-house security entirely. It's a bit counterintuitive given that smaller businesses usually have less resources, so we want to explore what transferring risk actually looks like, how it's done effectively, and then what the unique risks for managed security services providers and service providers are when they accept that risk. Joining me again is a familiar face. Mike Arrowsmith is the Chief Trust Officer for NinjaOne. NinjaOne is unique in that they service both individual customers as well as those service providers.

Jackie McGuire

So Mike is going to talk to us a little bit about the unique needs and how to effectively partner with service providers. But first I actually wanted to talk about an announcement that NinjaOne just made because I think it kind of shows what we're talking about right here. So Mike, NinjaOne just announced new capabilities that unify vulnerability management and patching workflows, and these are some of the kind of most basic things associated with security practices, but they are some of the things that smaller and less, more resource strapped teams struggle with. Can you tell us a little bit about the new capabilities and how they're going to help teams to better manage their security posture?

Michael Arrowsmith

>> Absolutely. Thank you, Jackie, again, for having me today. I'm really excited today at Ninja to be able to announce a new product functionality around vulnerability. So today in our current offering, we integrate with all the major brands of cybersecurity scanners for vulnerabilities, so the Tenables, the Qualys, the Rapid7s of the world. What we have done in this latest version of if we opened up our software integration to accept essentially a CSV import for our customers that may not have one of the big three, or maybe they have more of an isolated scanner or maybe an older scanner or whatever flavor that they might have to allow them that ease of transition from identifying what vulnerabilities are, what CVS or CVE scores they might be, and then actually connecting that to what I would consider is the easy button for NinjaOne to be able to apply those patches against those specific nodes or endpoints. That's the number one functionality that we've introduced within this product is really fixated and focused on those customers that are looking for a world-in-class, best-of-class experience for mitigating those vulnerabilities and reducing the overall exposure to what those vulnerabilities may pertain to their environments.

Jackie McGuire

>> That's fantastic, and that's something that'll probably be useful to both your individual customers as I imagine, as well as your service providers because they also have to deal with a whole smorgasbord of vulnerabilities and patches and updates for all of their customers as well.

Michael Arrowsmith

>> Absolutely agree. I think the core of the essence of the product is really for the smaller customers that are, maybe to your point earlier, they're these smaller organizations that might not have a dedicated cybersecurity function. Maybe they have a bunch of ITs, or maybe they are an MSP providing these types of services, or an MSSP to their customer base and really trying to streamline that for all of those customers, especially those that may have these legacy tools or these other types of vulnerability scanners that they want to still leverage, they still want to be able to be able to project some mode of confidence to their board, to their leadership teams, or to their customers. So we're really excited about this feature. We believe it not only will help individual organizations, it will help MSPs. It will help MSPs at any size and scale, and that's really the way we think about these particular products. We want to help as many customers as possible reduce their risk and ultimately improve their customer experience.

Jackie McGuire

>> Awesome. That's exciting. That was announced on the 22nd, so that'll be one of the big buzzes at RSA, I'm sure. This is actually probably a good segue. The last step that we're going to talk about today is the transfer portion of the risk journey, and usually with individual organizations, when we talk about transferring risk, we're typically talking about cyber risk insurance, so something that transfers the cost of if a risk actually happens to someone else. But in this case, we're actually going to talk about being a service provider because another way to transfer risk is to use a service provider, but you also service a lot of managed service providers and managed security service providers, and they're in the business of accepting risk, and in this day and age, there's a lot of risk to accept. So I was wondering if you could just start by talking about maybe some of the differences between the needs of managed services providers and security services providers and your individual customers and the reason that they use NinjaOne.

Michael Arrowsmith

>> Yeah, great question. I think where we see the most level of success for NinjaOne today is in the MSP and MSSP world. When we think about transferring risk, we're talking about the service providers that are effectively servicing our local doctor's office, our government facilities, our small businesses, you name it. They range from size of two or three people to hundreds if not thousands of individuals. And when we think about transferring of risk, it is solely around that end point is where Ninja can help these MSPs and MSSPs try to eliminate, reduce or effectively mitigate some of that transferred risk by those organizations. And we come back to this idea of what kind of risk they may have. It really comes down to the data that those specific organizations may have. Doctor offices are going to have EPHI, they're going to have electronic protected healthcare information about all of their patients within those organizations. Government entities may have individual data on me, my social security number, my driver's license number, my address, things that are of a sensitive nature. That is the main culprit behind that transferable of that risk and why those organizations look to transfer that is they may not be staffed internally to be able to facilitate whatever might be regulatory required, maybe just best practices from a cyber perspective. Maybe they're a small mom and shop coffee place that just has a lot of credit card data or just personnel customer data. And so by leveraging these MSPs, they can transfer that risk to them and ultimately depend on that MSP to do the due diligence, do the general hygiene of those endpoints in that environment from a day in and day out. We see Ninja being the predominant choice chosen by these specific MSPs because we offer a best in class customer service. As we kind of highlighted in the previous segment, we have a 97 plus percent customer satisfaction score with all of our customers. We offer a singular platform, as cliche as it might sound, to have a single pane of glass, that is the solution that we provide to our customers. We don't care what type of device you might have, whether it's a Linux system, a Windows system, a Mac system, we can help manage all of them. We provide not only a robust patching product that allows our customers to be able to easily apply patches, we can provide just a general administration applying other types of packages, applying remote access, privileged access to those specific endpoints. We also provide backup solutions. So we start to expand on the capabilities that those same MSPs and MSSPs may be providing to those organizations and provide them a singular tool that can enable them to invest less in the actual technology and more in the interfacing the people, the surrounding support stacks that they may need to continue that high velocity or best in class service that they themselves come to expect from their customers. So Ninja is really well suited to be able to continue to grow into that space, and as we push into what we call mid-market or further into enterprise IT, we're going to see more and more adoption from our customers, but also new prospects, new folks that are becoming aware of what Ninja can do. We truly do believe we have the best solution in class today.

Jackie McGuire

>> Yeah, I think it's interesting. I don't know that I had fully really thought about the customer service speed and satisfaction piece of it, but if you are a service provider yourself, your ability to provide good customer in response times to your customers is entirely dependent on your vendor's ability to provide good customer service to you. So that's a great point in that your fates are kind of tied together with these service providers in that their service is only as good as your product and service.

Michael Arrowsmith

>> I totally agree. One of the things I think, I've been traveling all over the world, one thing that you often will hear about Americans, but in general is we are incredibly polite as a culture, and it's that politeness that kind of plays out and our expectation is we want to go fast, especially here in the Silicon Valley. We have this play hard play tough kind of mentality, but give everything that you got as part of being a service provider. And it's that same mentality that we're playing out with our customers. We want to give world-class service quickly, fast, responsive answers that are complete and to the point as effective as possible so that our customers cannot worry about the technology stack, but what they need to do to service their customer.

Jackie McGuire

>> I grew up in New England, so I would disagree that we're very polite.

Michael Arrowsmith

>> I love it. I love it.

Jackie McGuire

>> Yeah. I actually, I took my family back and we were at a four-way stop sign and the guy to our right didn't go when he should have, and the lady behind him rolled the window down and dropped some F-bombs, and I was like, "Well, kids, this is where I grew up. Now you know why I have to be nice when I go to California."

Michael Arrowsmith

>> It happens. And I'm certainly, I probably have been that same guy in that same car at one point or two in my life. But in general, I do agree.

Jackie McGuire

>> Yeah, I think I've softened as I've gotten older. So that actually is a good segue into one of the questions that I had, and this is a little bit more theoretical, but I had referenced this survey we did at RSA last year that showed that the smaller a customer is, the more likely they are to have a strong preference for in-house management of security. I don't think that's the right choice for most organizations obviously, because you just can't do it yourself with a team of four or five 24 hours a day. And I think a lot of it comes down to either not knowing how to select a service provider, feeling like it's more of an outsourcing security than actually partnering with somebody or not really knowing how to hold them accountable for the work they do. You're a Chief Trust Officer, so I think a lot of this comes down to trust. So theoretically speaking, what do you think are some of the things that we can do to build more trust between MSPs and the security leaders who really should be using them?

Michael Arrowsmith

>> Phenomenal question. I get asked this often. So I think that, a couple of things on this. Number one is knowing the pain points about your customer, what motivates them is key to any successful mission. Trying to understand what is the burden behind that customer? What are their objectives? What are their milestones that they're trying to hit? And specifically what types of services that they're looking for MSPs to be able to engage on is fundamentally number one. MSPs typically charge based on a number of devices, systems, users, number of applications. So it's instinctive to want to dig into more of those use cases on how that customer is really fundamentally wired for these sets of services. It's actually been funny. It's one of the same things that I've leveraged in the past lives, past career opportunities where I've leveraged MSSPs to provide some functional sets of services to me. Another big thing for organizations is to really iterate it on is setting realistic expectations. There's a lot of conversations, a lot of good things to be had by having internal cybersecurity. Don't get me wrong, I always will be a preferable or maybe lean correctly towards keeping it internal as much or as maybe even both as an idea. And there is just so much value that I think you get by shifting further and further and further left closer to the business, closer to your critical workloads and having cybersecurity folks embedded into those sets of services. Cybersecurity folks are not cheap. It is incredibly difficult, incredibly competitive to acquire top tier talent. Beyond that, this is the area where MSPs can really, I think, distinguish themselves against what smaller organizations or even sometimes the larger organizations can accomplish. You can keep a really small nucleus of high profile, highly skilled individuals that can do a lot in a very quick and short amount of time for customers. And when we think about incident response, our focus, when we have a breach, when we have a cybersecurity incident, how we got breached, how we were popped, how that malware or whatever might've happened is the least of our concerns. It's really about containing it, trying try to contain the damage that may be going on, whether it's an impact to an operational service, maybe financially driven, maybe it's a ransomware. How do we recover? How do we get to a place where whatever happened, we can spend our time and go through the various rabbit holes on how that particular attack is performed on us is really where the MSP can help tremendously in that containment. By having a subset of skills by that high level discipline that it's almost, think of it as that old-fashioned tiger team that you can bring into the organization, quickly start tearing down various silos, processes that may be obscure or unclear, and get to the source of where that particular containment has to be. That's the two biggest things in my opinion, that MSPs and organizations can really, I think, set themselves up for a wonderful experience with MSPs. Oftentimes, I have seen some MSPs in the past not do their due diligence, offer a set of generic services, and unfortunately it's those types of services, those types of MSPs that tend to maybe jade or maybe form a bias from everybody else that maybe have used those MSPs in the past. And I just want to be clear, there are so many good MSSPs and MSPs out there that can provide tremendous, tremendous value to any size of the organization. Just have to set expectations appropriately.

Jackie McGuire

>> Yeah, absolutely. And I think that's a really good point is that if you're managing your own security and you wait until you have a breach, you try to respond to it yourself, you figure out it's beyond your five or 10 person team's capabilities, then you reach out to an incident response firm, then they get engaged. So that is an insane amount of delay between issue and resolution, and the amount of lateral movement and damage in that period can be extreme. So I think that's a really good thing to point out. Mike, thank you so much for joining me twice today. I really appreciate that. I want to give a quick shout out to your activities at RSA again, because it's coming up quickly. So I know you had mentioned a Blazers and Bourbon event, which are you doing women's blazers too? Can I come?

Michael Arrowsmith

>> I've been told it is agnostic, so please, women, ladies, men, please come join us. I would absolutely love to see everybody and anyone.

Jackie McGuire

>> Yeah. Awesome. I will try to stop by if my feet aren't fully blistered by then.

Michael Arrowsmith

>> It's a lot of walking.

Jackie McGuire

>> Yeah. All right everybody, thank you so much. This is Jackie McGuire, practice leading principal analyst for theCUBE for The ART of Security Summit. We will be back in just a few minutes with some more information about transferring risk. Thank you.