.png)
The InfoTech Podcast
Interviews with MSP industry leaders about the intersection of business and technology.
The InfoTech Podcast
Greg Johnson - Webcheck Security
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
In this episode, Greg Johnson, CEO of Webcheck Security, shares insights on building a cybersecurity company focused on community, client relationships, and profitability. We explore how human-led services, strategic pricing, and AI tools are shaping the future of cybersecurity.
Greg Johnson:
And welcome to another episode of the InfoTech Podcast. I'm your host, Jimmy Huber, and this podcast explores the intersection of business and technology. And today we've got a little bit of both for you. My guest is the CEO and founder of Web Check Security. He's the co-author of the book Testing and Securing Web Applications and the host of the Vistas podcast. Greg Johnson, welcome to the podcast.
SPEAKER_01Hey, thanks, Jimmy. It's uh an honor to be here. Um you are an awesome guy. I'm glad we were able to uh become acquainted and hope we can uh work together along into the future.
SPEAKER_00Yeah, well, I appreciate that. Uh that's definitely right back at you. Um I've really enjoyed getting to know you here this past couple of talks that we've had. And I think our our audience, who's you know, primarily small business owners in the tech industry, um, I think it's really appropriate to have somebody of your caliber on because your perspective, I think, is is really unique in that um you not only are uh in the web, the the cybersecurity in the web space, but you've got some some bona fides that not a whole lot of other people have, in that um you're one that I've learned that wants to give back to your community in education. I mean, you've you've written a book and have a podcast to create content and develop a community inside the cyber world and not just fix things for people, which is also good, but um, you're adding layers to it. So um before you get into all that, I would love for you to just kind of give a little bit about your background, you know, how you founded WebCheck and kind of what brought you to be able to get into all these things. Sure.
SPEAKER_01First, maybe some personal stuff. I am first of and foremost a husband to my wife of uh 42 and a half years, brother. Wow. And uh it it it it is, but you know, she's a she's a special and patient woman. I'm also uh we're grandparents to seven children, and now that we're empty nesters, we're adventurers. So back last December we climbed Mount Kilimanjaro, the tallest freestanding mountain in the world, not taller than Everest and the Himalayas, but they're not freestanding, they're part of a system, the Himalayas, right? But uh Kilimanjaro's 19,341 feet. Um we've climbed Mount Pinatubo, the mountain that blew and created a crater lake in uh the Philippines back in uh in 96 that happened, and and then Kelly and I climbed it, I think it was uh 2023 we did that. And the reason we were there is because I sang for a while with um and and this is not bragging, but it was just a unique, unique set of circumstances and opportunities. But I sang with the world famous uh tabernacle choir on Temple Square. Um Wow. And uh so we were there in the Philippines uh doing a concert and we had some free time and were able to uh uh you know take off and and and do that. So anyway, that's that's uh a little bit about the personal stuff. I I won't dwell too much on that, but um you know, I uh I've I've always been in the business development end, and a lot of these cyber companies, assurance companies that do SOC2s and pen testing, some of the things that that we do, uh you know, their uh their founder is uh CPA or uh a technical auditor. I come to life with something a little bit different, sales, basically. And in my role formerly uh in Novell, if anybody even remembers who that wonderful company was and Word Perfect Corporation, and and then uh I won't bore you with my entire career, but um I ended up in in the cyber area uh providing solutions to clients um in the frameworks of PCI, ISO 27001, SOC2, and just general good cyber hygiene. And what I observed, Jimmy, is that most of these clients, including my former employers, delivered some of these services badly. And the ones we competed against, uh some of the biggies that you've heard of before, Coalfire and Mandy and Ernst Young and Price Waterhouse Cooper's and some of the big audit firms and cyber assurance firms, they also delivered those services badly. And so in 2018, I I vowed to start an organization that was based on a better CX in cybersecurity, meaning the customer experience, and have a scenario where, for example, if you're doing a pen test, which is a highly technical endeavor, and uh and you've got a technical guy with a propeller head that's uh loves to solve problems and disassemble things. That's essentially what pen testing is, right? That's what a hacker does. And they get in and find ways, but but we vowed that we would only hire people that like people, that talk to people, right? Not a burrito eating guy at 3 a.m. in the garage, you know, with a hoodie over, but somebody that's uh that's going to uh meet the client so that we always introduce the engineers. What no matter what engagement it is, we do some cloud service um review, security architecture review. We might do an ISO 27001 or CMMC or a FedRAM preparatory audit, but regardless of that, they get to have a relationship with that former CISO, and I'll explain that in a minute, or the pen tester, as it were. And that just wasn't happening in my former organizations, right? They didn't want to talk to clients. But the idea is at the end of the day, is our client better? And and if no, how can we help you to be better? And so we we formed Web Check Security with uh the thought that it would provide a better cyber CX, good processes from scoping to delivery to remediation testing, um, uh, through to the end where we have an advisory session with the client and then offer ongoing hand holding, and we call that FISA or fractional cheap information security services. So that that's kind of what uh what happened in 2018 and how how we roll at at Web Check Security and fast forward to uh to um to now, several years later. We uh we're we've been very grateful to have pen tested great companies like Arctic Wolf and Ad Lumen and and uh many, many others, and we have great partners uh in in the community like uh uh MicroRage of of Arizona and and and many other MSP and MSSPs all across the country um that resell our our services. And it we're just having fun uh and having a good time, and and uh that's that's a little bit about uh kind of at a high 60,000-foot view of who we are and how we started and and and what we do.
SPEAKER_00Yeah, that's uh that's fantastic because I think that's a rare thing to find employees that are technical enough to do the job well, but also have the soft skills to converse and develop relationships with clients. I know, at least at InfoTech, like we spend quite a bit more time, I think, in the hiring process to vet out those culture pieces and make sure that people have a heart to serve others first, and then we discover and figure out you know their technical chops. So it sounds like similar at Web Check that you do value the relationship and the and the client first and then also back it up with with the the acumen. Would that be accurate?
SPEAKER_01Yeah, we do. And I I like to get on the uh a Zoom call. You know, it's not just my head of um uh CICEL services or FICO services, our fractional auditing uh or or information security officer services, or we I we don't just hire a pen tester and we Nate's our head of of Red Team Services, they don't just go off and hire people. I want to talk to them first. I want to see that they've got um kind of that people quotient or at least are articulate and and and will will look good, whether it's a board or just the IT guy that's very technical and wants to know what are the things that he needs to fix in order to be better at the end of the day. And that's so that's important. The other thing is when you hire the right people, you got the right people on the bus. You know, usually they know other good people, and when we want to expand, you know, we just go out and say, we don't need to do the indeed thing or whatever, we just go out and say, who do you know that that wants to you know come on board? And and we usually get a number of good um good folks to interview.
SPEAKER_00Yeah, I completely agree with that. Yeah, good people know good people. Um and and building that culture, I think, is is key not only for retention, but also I think customers see through um a lot of the fakeness that I think is prevalent in our society these days, and they want genuine. They want people that actually like what they're doing and and want to connect. Um what do you see? I mean, you're you're a big community guy, I feel like. Like we've talked about this several times, even prepping for this recording, that um it's it's not just about the customers or the industry, but it's about developing a community inside the cyber world. Talk about that a little bit because I think a lot of times people, you know, you're the dentist that sees all the cavities, right? Like people don't generally engage with a cyber uh company unless there's a giant problem. And you know, you come in and fix the problem, and then you know, you move on, right? It seems like to me though that you're you're trying to do a little bit more than that, maybe. Um can you talk about that a little bit and how that differentiates you in the industry? Sure.
SPEAKER_01I I mean I years ago, I was just finishing college at Brigham Young University, and I read a book that kind of impacted my life. It didn't change my life, but it impacted, it resonated with who I am, and it was a book called Raving Fans, and it talked about Marriott and the Marriott way, and Marriott was kind of on top back in the day. I don't know so much anymore, but um you you you had this concept where instead of just delivering a business service, why not create raving fans? And how do you do that, right? And I like people, I like serving people. So when I talk to them, Jimmy, if you know, if it if you and I are entering into an agreement and I'm gonna provide infotech solutions with with services, I like to end the call by saying, we look forward to serving you, because that's what it's all about. We we like to go the extra mile. Um community-wise, I always feel like giving back is something that's that's important. And so, you know, we're we're still pretty lean. I remember back in the day, my first year, 2018, um, we had maybe 18K in revenue, just a couple of contracts, and away we went. And then within uh a year, we had 259 K in revenue, and then we went to half a million, and then a million, and then and then we hit two million, and you know, and and it just you know it it it it goes on, and we're still pretty lean. We're not where we want to be yet, but um, you know, we'll occasionally give to organizations like Promise to Live, which is about uh um suicide prevention, and uh that resonates with uh with me and my family as we've had mental illness in in our family, and it's important. Um but but beyond that, it's I think there's kind of a an overall mentality. If somebody comes to me and says, Hey, I've lost my job, uh, and or young people that you know are in the young adult uh area that are, you know, I've finished a cyber degree or I'm finishing a cyber degree, but I don't know what to do. Can you talk to me? I love mentoring people like that. I I love talking to them, I love connecting people. Um just the other day, a fellow that I don't know except for a LinkedIn connection and a you know secondary connection through somebody else lost his job. I care about that. And uh so I like to I introduced him to another CISO that I know at a great company, in fact, Filevine, um, which is a wonderful company, and um and and at least to have a chat. And and if he's not hiring, he probably knows somebody who is. So I love making those connections. I feel like it comes back to you in the end, you know, right? Karma comes back. And so that's that's how we try to run run our company. You know, if we if we screw up or a customer's not happy, um, and everybody makes mistakes, right? Then you make it right. You know, what what will make you happy at the end of the day, Mr. Customer? And so that's uh that's how we try to operate our business.
SPEAKER_00Yeah. Well, it's definitely working. I mean, those numbers are that's almost an exponential curve, it seems like. And I I know there's a lot of demand in your industry, but I've got to believe that um your culture and and those connections and that relationship building is a huge part of that. Um I think a lot of times people chase, you know, you just keep saying you're lean. A lot of times people chase top line and they don't realize that top line means nothing. It's about the bottom line and making sure that your company is is healthy so that you can, you know, pay well, you can hire the right people, you can deliver good service. I mean, that at the end of the day, I think sometimes that gets lost and people just chase growth for growth's sake. Um so can you talk about that? I mean, starting at you know five figures and jumping to over two million in a relatively short amount of time is no small feat. So what what do you contribute that to?
SPEAKER_01Yeah, well, uh Apropos, good segue, because that's been the focus of the past year is net profit. And and and I'll and I'll and I'll tell you why. First first of all, um when I when I started this business, I had some pretty good mentors, uh, and I'll mention I'll call him out by name. Um uh Scott Price, who's the CEO of uh Align, um I went in and served as his um VP of business development for just uh about two and a half, maybe, maybe three years. And he had some great systems and great processes and was spending a lot of money on uh Google Pay-Per-Click. And uh he was very good at at chasing uh top line revenue. Now, in fairness, um he was much further down the path, uh, much more capitalized uh than my little what started as a boutique consultancy, and I realized, wow, this thing can can really go. And and in COVID, so here's here was the catalyst, and then I'll get to the answering the actual question. The catalyst was COVID in 2020. So I had a kind of a dual stream. Web check security was functioning uh but mostly serving um uh an MDR company, which just got sold uh uh the other day, and I had an agreement with the CEO, they were um outsourcing pen tests, and I said, dude, I have some engineers that are amazing. They're OSCP and blah, blah, blah, certified. They talk to people, they're smart, I can do this for you for half the price you're paying some of these other Yahoos, and with double the quality. And so for a couple years, um I was able to sell pen tests, i.e., web check security, um, and uh through this other company along with their MDR services, uh, which is the managed detection response. And so that that kind of served as the catalyst, and that and of course, along the way we we started branching out and adding um audit services and some of the other fractional services. But in 2020, he had to lay me off, as well as my second in command, Jeff, who's my business partner. He owns 25% and is our COO and runs the operations because they were losing customers. COVID sucked for a lot of businesses. Yeah. Not for ours, though. I looked at my wife and said, Look, you know, we're gonna hit we're gonna hit half a million this year. Let's let's do this. And she said, Okay. I would feel more comfortable if you brought Jeff on, because Jeff's a a good level head, love the guy. One of the best decisions I I ever made. And and so he came on board and started helping me sell and and develop partners and the rest is history. Well, so you have this hockey stick growth, and that often happens to businesses that that operate a good service, and we do. We have a good product, we have a good service, and very rarely do we get a customer that says, we didn't didn't like it. You know, and sometimes you get weird personality things, but it's it's rare. 99% of all our customers renew the next year or they come back. So as we've hit this uh this growth curve, all of a sudden, the last two years have been kind of interesting and tough. We're still growing, but instead of a hundred percent growth curve, it's kind of slowed to twenty percent, ten percent this year. This year's been a little weird with war and with AI, and we'll talk about that uh that later. So the good news is we're still growing. But in all of that, and in trying to figure out where to spend our money, and boy, we've blown money on trade shows, we've blown money on pay-per-click when um uh you really need to be spending at a certain clip level in order to make that work properly in the B2B space. Um, you know, we we started to realize that let's focus our efforts on some of the things that we know are going to provide an ROI. Um, for example, some of our VARs, they may charge us $2,500, $5,000, or $10,000 to come and present at their conferences, but they invite us and their reps sell our services, right? And that is a slam dunk ROI versus going to a trade show, paying for the airfare, spending $10,000 for just a 10 by 10 booth, sometimes $20, right? And larger ones, if I we were to do it at Black Hat, which we're going to as attendees in the next uh in the next week, you know, it'd probably be 40K for a 10x10 booth. Not doing that, right? Because you talk to a lot of people that say a lot of fun things, oh, we need you guys, and then you never hear if they ghost you, right? Yeah. That's kind of the trip. So we got smarter. But anyway, to answer your question, we uh were very lucky. Um, you know, I I believe in inspiration and God-directed things, and occasionally you get hit over the head. And I met a guy, um, QuickBros Accounting. He had a great team. We were looking to, we'd hired uh someone that was running the books at a law firm. We thought it was perfect, it just wasn't working out. We'd we'd hired and outsourced another firm that that's that was big in Utah, and it just wasn't working out. And then we found our current CFO and his team, and it's an outsourced team, but they've been wonderful. And one of the things that he started to uh preach when he came on is guys, you gotta get your net profit up. You know, you gotta get your EBITDA up, especially if you ever hope to, you know, sell this company or whatever. Uh it's got to look a little better. And the good news is we've been profitable for years. We're still profitable, but you want to get that in a decent double-digit, you know, not uh 10% is not great sometimes. So we've been looking at our services and trimming, and we even had to let a project manager go because we found that uh he was outsourcing some of the stuff and we were paying the outsource guy more than we were paying him. So you know, unfortunately, and there were other issues uh as well. But we we've looked at our expenses uh very uh much more carefully, and I'm not a real careful guy. I I like to spend money, but you know, as as as I brought Jeff in more on paper, uh more formally, you know, and and I've created more visibility and opened up the company, which originally was my baby, right? And that's that's hard to kind of open up your bank account. I've reduced my salary, I've uh, you know, and and and we've um we've actually gotten to the point where our profitability has increased. Um and then the other thing we did, and this is important before I forget, so sorry I'm kind of blathering on here. No, go for it. This is great. But we've we've got algorithms and calculators that we use um to calculate our deals. And in fact, our uh intrepid uh vice president of sales has created a SOW generator, a statement of work generator that not only prices things, but he's taken a calculator I built to gauge the profitability of every engagement. So, in other words, you know, I I've said, look, if we can be 50% or 60% GP, so your gross profit. Meaning you'd you take out his commissions and approximately what we're paying our practitioner, and then any referral commissions for any partners that that are not reselling on their own paper. So there's some MSPs that will come to us and say, hey, here's this client, we just want 20, 20% or whatever. And we say, great, close the deal, and then we cut them a check. So after all that, what's the gross profit on that engagement, right? Yeah. And we don't do it unless it's over or in between 30 to 30 percent plus or 35 percent. So we we we've set standards and bars and we've we're using technology to make sure that things are priced right. Are we actually making money on this deal? And that's something that didn't happen for you know the first five and a half years of of our existence. Um so it it's it's important to understand how much you're making on your engagements. Are you charging enough? And and that's the other thing. You know, over the years we started out as quality affordable, you know, penetration testing. And I thought that's not the message we want to give. We're we're top-notch. And you don't undersell yourself, sure. No, I never describe web check security without saying we're a world-class penetration testing and cyber advisory services firm. World class. And you know, so we're not gonna be the cheapest bargain basement. So over time, our prices have gone up, but we're still very competitive. So anyway, so hopefully that answers uh your question. We've had to really hone in on our profitability and jettison things that aren't making sense. We jettisoned our pay-per-click program because we're we were basically breaking even. We were spending several thousand dollars a month. It just wasn't quite enough. Really needed to be spending about $10,000 a month. And at our revenue level, doesn't make sense.
SPEAKER_00Sure. Sure. Yeah. I mean, you there's so many things to hit on there. Um, and I I think I realize why we get along so well is that I I can relate with almost every single thing you said. I also like the visionary and the big picture sales guy. And I've had to hire key people and my staff that compliment me, that are more detail-oriented, that do the processes, the procedures, you know. And yeah, I think uh you're not alone in that there's a lot of business leaders that just want to grow their business and sell things, and they don't necessarily look at the bottom line as closely as they can. Um and a lot of times that can catch up to you. If you're looking at lagging indicators, you know, it's hard to fix problems in the rear. You have to really focus on that and make sure that your pricing's right. And I love what you said that, you know, changing your messaging and understanding, you know, what you're worth, I think is huge because you get in this spiral, I think, sometimes that if you don't price yourself accordingly, thinking you're affordable and you want to help people, you tend to attract a maybe a different type of clientele that wants to take advantage of that. And they sometimes, at least in our experience, those have not been great fits for us. And as we've raised prices, you know, in the managed service space, we get people that value us more and they don't care about they don't care about the price, but that that is not the sticking point for them. They look more at the value. And it sounds like you've been maybe on that similar journey where it's it's trying to dial that in to make sure that that you are aligned with your customers. Yeah, absolutely.
SPEAKER_01And and things are changing, right? This has been a pivotal year, I think. And you know, as I talk to other CEOs and my my colleagues, and um there's there's um two things happening right now. There's the reality of AI, and there's the Kool-Aid surrounding AI.
SPEAKER_00Does that make sense? Yeah, right. Yeah.
SPEAKER_01And what you're seeing right now is a lot of companies, their messaging is hey, human-led, because people are getting tired of talking to bots. Um, people are getting tired of getting let down by a so so-called automated solution. And and even though there's these amazing things like mythos going out and finding XYZ or breaking out of a container and into another system, yeah, that's gonna continue to happen. But the reality is you you you can't, you've got to have the the the driver at Belmont. You know, you you've gotta have the uh the know-how and the knowledge to properly deploy and implement and interpret. And and that's that's never gonna go away. I'll give you an analogy to that. Have you ever driven a NASCAR, Jimmy?
SPEAKER_00No. No, I can't say that I have.
SPEAKER_01I have. Uh I was very fortunate. I was working as a national sales trainer back in when was it, 2002, for uh a franchise or that had these franchises across the country country in the logistics industry. And we had this kind of uh you know, top gun presidents club thing one year, and I got to arrange it and and uh we ended up going to um um Richard Petty's um NASCAR place in Orlando, and they had a small track. Um it was one of those things where you take some classes, you know, so that you know what you're doing, and they put you, they let you get in the car by yourself if you want, and actually drive it, and they put you behind a pace car, and then they come in and critique you and tell you what uh you need to do better, and then the second time they kind of turn you loose. You st you're still behind the pace car, so you don't completely freak out, but oh my gosh, dude. You ever watch ESPN and you go, race car driving? That's not a sport, you know. You flip it to football, and there's this athleticism. Well, I quickly learned that my wrist got tired after like the first the first turn, and and I'm uh and I'm a weightlifter, right? And uh I I recognize that just you know the the body, the awareness, um, the quick reaction timing. I went, these guys are athletes, no question about it. Sure. They're in shape, um, they're in hot fire retardant suits, which we had to wear, the helmets between the reaction time, uh, the the the wrist strength, the endurance, they've got to be in top-notch condition. And and I realized it's a sport. Well, AI is the NASCAR, right? And it's gonna change things, but you still gotta have the driver, or it's just not gonna mean much, right?
SPEAKER_00Yeah. Yeah, we we've talked about this in other episodes too, and it it seems like the theme, at least if I would dilute down the current AI space, is you don't want AI to be your thought leader, you want it to be your thought partner. And a lot of companies, I think, are trying to cut costs and s and you know get rid of positions because AI is gonna save the world. You know, they're gonna save all this money, it's gonna be you can do more with less. And I got to believe that a better approach would be to learn what you can do with your current team and and use AI as a tool, right? You're not shrinking and abdicating, but you're just you're using it as a leverage. But like you said, it's human-led. I completely agree that um people people want genuine. Uh you mentioned going to events. I think that's the future of at least marketing in our space, is people want that face-to-face connection. They don't want a bot or some deep fake thing that where you have to get through layers of AI before you actually get to the human. Like, how many IVRs do we have now that's just endless press this, press that? It's like, no, just give me a human. You know, uh there's a certain breaking point, I think, that there's a law of diminishing returns. And it's kind of finding that thread and and and you know, putting that together. So what are you guys doing at WebCheck? I guess I assume you're using AI tools. Uh what do you see currently as the way to kind of navigate that?
SPEAKER_01And that's a multifaceted answer too. And it's funny because uh a year, year and a half ago, we were struggling. Where do we fit with all this? And automated pen testing tools had been coming out. They've been coming out for years. You know, you look at Horizon, you look at Ridge, Ridgebot, you look at uh Vonahie that got bought by Casea, which is big in the MSP community community. But invariably, and these are all great, great tools. There's there's Osult Pintera and Simulate and and a number of others, but our our engineers would look at them and go, meh, you know. And you know, one of them said, I use 38 tools when I do my pen testing. So is it a force multiplier? Well, sometimes. Sometimes they get an automated tool and and they they go off. But we realized that there needed to be the correct messaging and that sometimes in a cyber or a budget constrained environment, um, or in um uh constant um what you call CTEM, continuous threat uh uh exposure management, or pen test as a service, PTAS, you you do need to have an automated technology. And now that AI's there, and we'll talk about the difference between agentic and just built upon AI and and some of the differences, but um that AI's there, you've got better tools. Now, so let me just pause for a minute and back up and say, so we we realize that we need to message that, hey, we understand this and we're on board and we can do it. But here's the reality, right? If you're budget constrained, let me uh let me give you uh uh a little bit of an automated service with with a NASCAR driver to review it and help you through the curves, right? Or we'll just give you the NASCAR driver and he'll use 38 tools and he'll test your web apps and your infrastructure and your mobile apps and your Wi-Fi and your cloud services, internal, external, and and we'll really find the stuff. It's gonna cost you a little bit more. And they will use some AI to do that, right? They'll start one process and they'll work on another and they'll run a fuzzer on a web app. But but the reality is it's it it is more time intensive. Now, as AI gets better, these guys are able to do more with less time, and that's that's that's great. But there's still the reality of the human-led quotient. But there's also using AI to enhance your services. So I mentioned the SAW generator. Who developed that? Well, my VP of sales did. He's not a coder. But I will say this about Peter. He worked at Tesla on the autopilot division. He was a manager over about 90 people. Eventually he kind of he left that because it was that was a hard, harsh culture. He didn't like being in the park on Sunday with his family on a picnic and having a work call and say, You got to come in. You know. Yeah. And unfortunately, nobody wanted to be on the phone calls with him, right? So, you know, eventually I called him up and said, Peter, what are you doing? You know. Anyway, what's cool is that he's that's what you call vibe coding, right? He's developed, he realized he was spending so much time not only mentoring his team, but taking his own deals and creating these statements of work that why can't I create the pricing engine, the profitability engine, and all of the language and just click, click, click, and it pulls it together. And then you do any edits and customization and boom, and it's wonderful. It's almost ready to go. We may actually deploy that to some of our MSP and VAR partners so that so that they can resell our services with ease. So there's that. There's also on the customer service end our one of our project managers, the the new guy, um, or not new guy, but he that the outsource guy I mentioned, that he he was clearly our succession choice. And about uh a year ago he'd uh brought uh some vibe coding up to his manager that he'd been doing. Hey, I wondered how I could make this easier, and I've come up with this, and it kind of got shut down. We didn't know about it, we never heard about it, right? When that that other fellow uh it didn't work out and and and he was gone, we we went to him and and Michael said, Hey, I got this thing, and my partner Jeff said, Where's this been? This is amazing. And so now we're re- re-releasing this internal product called Watchtower, which um will allow um our the clients to log into a portal and see uh graphic visibility and trends and communicate with their tester. And before that's all been more manual. You know, we put them in a Teams channel, it's secure, it's great. They can talk to their tester and purple team, if you will. Um now we'll have this app and it's all vibe coded, right? Yeah, that's just wild. So that's the facet. So so there's the facet of utilizing it in our services as either a force multiplier or a good is better than nothing if best is not available, right? Budgetarily. Two, the vibe coding to make our internal processes better and to enhance customer services. But then three, um you've got this agentic thing coming out where are there tools that are actually going to be that force multiplier? And some of that is developing. And we uh, for example, have been talking to Amazon and uh ThreatBait about some of their uh agentic services. It's still they're still limited, right? Um for example, uh Amazon's agent is really geared towards um cloud service uh and um and and apps, apps in the cloud. That's really the big need for Amazon. That's where they make their money, is people opening containers, spinning up virtual servers, and then running their apps in the Amazon cloud. That's why they've got those big data centers, right? But what about Wi-Fi and what about uh mobile app testing? So you're gonna see different tools uh evolve, and sometimes, and you know, there will be some tools that evolve to hit multiple attack vectors. So, how do we leverage that as a force multiplier? And as I said before, frankly, there's just not a ton of them that can do more than our guys can do in a couple hours. They're so amazing. Yeah, they're out there yet. Sure. So there's kind of the multifaceted thing. We're keeping our eye on um force multiplying technology, and how can we license and use that or develop that ourselves, but without dramatically jacking the price to our customers, you know? Yeah. For example, if you want to license um, and and nothing against Horizon or Ridge, they're great, you know, uh, but it they're very expensive. Same thing with simulator or Penteric, great systems for ongoing uh threat exposure management. Um, but very you know, fifteen, twenty thousand dollars a year um to license a you know medium-sized environment. And uh although that's an unlimited thing, that's a lot of money. And you know, we can for that kind of money, we can do a very thorough quality pen test. So anyway.
SPEAKER_00Yeah. Well, I I love that that you're you're navigating and you're you're finding the sweet spot between what tools and the value that it brings to the client, and then augmenting them with the experts, right? I think that's the key. Um AI, I don't think, will ever fully repl replicate the human intuition. And I think you've you've got that nailed. Um I feel like we've only just skimmed the service here, Greg. We're definitely gonna have to have you back for another episode. But before I let you go, yeah, I I want you to give us an example of somebody maybe who's just getting into the cyberspace. Um, maybe they're you know an up-and-coming leader in the small business world and they're trying to kind of navigate and figure all this out. What's an example or two that you've found here in the last six or twelve months that maybe you can give some advice to them or some tactical, you know, pieces that they can take away from this conversation?
SPEAKER_01Aaron Ross Powell Well, I'm not thinking of an individual as much as individuals that um, for example, young people that finish their cyber degree or maybe middle-aged people that are they've been in IT space and they go, hey, I'd really like to get into cyber, but how do I do that? Right? And the advice I give to some of the young people is, you know, let's talk about what the options are. Do you want to audit against frameworks? Do you want to be a CISO? And we talk about what that means, what it means to be a business leader and have business knowledge, but understand technically enough to manage a team and hold uh an organization accountable to best practices and compliance. It's kind of like I have a brother who worked for Raytheon, right? They make the Tomahawk missile. He was the OSHA EPA health uh scientist guy, so he kept things from blowing up in Tucson, Arizona. Seems important. Yeah. Seems important. CISO does that. They keep things from blowing up uh cyber wise. And you know, buck stops stops there. But but that leads to incident response. There are digital forensics experts, right? And then on the technical side, you know, you've got um you've got uh the science of um encryption, you've got um the science of um uh cyber engineering and um uh secure network design and and now cloud design. So there's uh what I we I we talk about that and I like to say what's your what do you think your propensity is? And you may not know, but let's go down a few uh rabbit holes. Pen testing's one of those, right? Yeah, if you like um the guys tell me because I'm not I'm not the pen tester, I'm just the dumb guy running the business, the smart guys are doing the business, right? And they tell me that the good pen testers like to solve problems. And and and so if that's if that's you and you like to solve problems and go out and get an easy um I say easy, but maybe the certified ethical hacker, and then shoot for something harder, like the OSCP, where it's not a book learning test. You actually have to hack into a lab and uh pivot laterally, and uh they evaluate your writing and all your skills, and that's what makes that certification so good. PNTP is another one. But um uh, you know, so we talk about those, and I would just say you get pick a path, go down it, and as you do, you'll learn about some of the other paths, and eventually you'll you'll find your niche in cybersecurity.
SPEAKER_00Yeah, I love that answer because I don't think people know what they want until they get in and start trying, right? Like that's what I tell our guys, like, hey, there's what infotech needs, but there's also what you personally want for your career. And our goal is to kind of find where that overlaps, right? Um Yeah, I've had several staff that start, you know, in in operations and then move to projects or whatnot. You know, I mean they're they find their way. And I think in site the cyber world, there's there's so many opportunities now, like we talked about. Um, that that's it's a it's a great time to get into the space uh and and take advantage of some of these changes and and launch a career. Greg, what or sales? Yeah, or of course, yeah. Somebody has to be able to talk about it. Exactly.
SPEAKER_01Sales consulting, go out and get a couple of certifications. Uh I I personally have a PCIP, which is your uh payment card industry professional history there, and I won't bore you with that. We're trying to wrap up here, but uh you know, S C A I S P or a CSM or uh uh a general uh cybersecurity certification, learn about it, but then go out and be able to talk intelligently and affiliate with a company that has great products and services. And you can, you know, great sales is just consulting anyway. What do you need? What are the drivers? Here's what we have, if it makes sense, um, here's what I recommend. Uh, and and that's a great career too.
SPEAKER_00Yeah. Yeah, I love that. Um, you mentioned you're you're a connector guy. So what if people are listening to this and they want to reach out to you, maybe? Um you know, we'll put in the show notes your LinkedIn and all that, but what's the best way to get in touch if if they want to get with you, Greg, or or WebCheck in general?
SPEAKER_01You know, probably the uh easiest is to uh just send it to GregGRG at Webcheckscurity.com, or if it's a general sales inquiry, um get in touch at webchecksecurity.com and that my vice president of sales uh sees that as as as well. Uh but love to talk to anybody uh on a personal note or or otherwise. Yeah, awesome.
SPEAKER_00Well, it it has been great having you on. Um hopefully our audience caught something there. I I think I feel like I need to rewind this thing to grab all the tidbits that you went through. But um yeah, we're we'll definitely stay in touch with you, Greg, and hopefully have you on again as as WebCheck continues to grow and and our industry evolves, right? I mean, I feel like it's changing at a such a rapid pace that there's always new stuff to talk about and discuss. So we really appreciate your time today.
SPEAKER_01Well, thanks, Jimmy. Uh you're a great guy, and let's let's do it again. You bet.
