The pivotal discourse in this episode centers on the critical selection of an IT partner, which Cyber CIC deems the foremost decision an organization must undertake in fortifying its cybersecurity posture. In our conversation, I engage with Carmen Cicalese, the founder of Cyber CIC, who elucidates the intricacies of tailoring cybersecurity solutions to align with the specific decision-making preferences of organizational leaders. We delve into the nuanced interplay between managed service providers and managed security service providers, emphasizing the necessity for small to mid-sized businesses to seek adept partners capable of navigating the complexities of cybersecurity. Carmen's extensive background in military and defense cybersecurity informs his approach, wherein he advocates for a focus on people, processes, and technology over mere technological solutions. This episode serves as a clarion call for mid-market MSP and MSSP founders to reassess their strategies and partnerships in the realm of cybersecurity to ensure comprehensive risk mitigation and sustained growth. The dialogue initiates with a profound exploration of the operational wisdom and strategic insights prevalent in the IT sector, particularly focusing on the journeys of mid-market Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs). The podcast, hosted by Chris Larcade, delves into the intricacies of scaling IT businesses amidst the challenges of revenue growth plateaus. In this enlightening session, Carmen Cicalese, founder of Cyber CIC, shares his extensive experience in cybersecurity consulting, emphasizing a people-centric approach to risk management. He articulates that the foundational decision for organizations lies in selecting the appropriate IT and MSP partner, which subsequently positions them to receive essential cybersecurity services and advisory support. Through a narrative that intertwines personal experiences with professional insights, Carmen elucidates the critical importance of adaptability and expertise in addressing the evolving cybersecurity landscape, thereby offering invaluable lessons for aspiring MSP and MSSP founders.

Links referenced in this episode:

• cybercic.com

Companies mentioned in this episode:

• Synergy Advisory
• Cyber CIC

Welcome to the growth conversations with IT CEOs.

The show is dedicated to unlocking the operational wisdom and real world strategies driving results in the IT sector.

This podcast is proudly brought to you by Synergy Advisory where we help it CEOs Breakthrough the revenue Growth Plateau.

Your host, Chris Larkade sits down with seasoned CEOs and business owners to dissect their journey, explore current challenges and and to share the actionable insights you need to scale your own business.

Get ready to learn from peers who have been there, done that, and are still navigating the landscape.

Let's start the conversation.

I'm Crystal Arcade, a fractional Chief Revenue Officer with Synergy Advisory and your host of the Growth Guild.

I'm joined today by Carmen Chikalis, founder of Cyber cic, based in Harrisburg, Pennsylvania.

Cyber CIC is a cybersecurity consulting company that focuses on people.

They use strategic advisors and fractional CISOs to execute a risk assessment process that best fits a client's leader's decision making preferences and their needs.

Rather than use a single model, Cyber CIC tailors the model to the decision maker's preferences.

Cyber CIC believes the first important cybersecurity decision an organization makes is its choice of IT and MSP partner.

That partner is then best positioned to provide the organization basic cybersecurity services and advisory work moving forward.

Welcome Carmen, and thank you for giving us your time today.

Hey, thanks Chris.

Thanks for having me.

It's great to be here.

So every leader faces unique challenges, but let's start by getting to know your journey a bit.

Can you share a little about your company, its focus, and what inspired you to start the firm?

Sure.

And there was a lot of tactical communication, satellite radio, UHF, VHF.

But by the 90s, of course, this thing called the Internet was getting started and of course it came out of Department of Defense.

So I had a boss who wanted to be on the Internet.

And if your boss wants to be on the Internet, then it's important to you.

So we were connecting at a whopping 9,600 baud, knocking the lights out.

And then from there I went to Fort Meade, had a job with a counterintelligence unit.

And their job was to protect the Army's assets or interests in the defense industrial base.

And they had some interesting capabilities, including the polygraph.

They did lie detection.

They also did technical surveillance, countermeasures which is a long phrase for bug sweeping.

And they also had the Army's first cyber forensics lab.

So I was responsible for maintaining and securing a Novell 4.01 server.

When I wasn't doing that, I was poking around on what they were doing and learning about their mission.

And then after that I went to the National Security Agency and they have of course the signals intelligence and also information assurance side.

Now I was on the information assurance side which is basically their encryption solutions.

These, those two disciplines complement each other because you have to know what the adversary is doing in order how to protect yourself so that they can't do something similar to you and looking on your communications.

Then something called information operations was becoming popular at the time and that's eventually what became known as cyber.

So I transferred out of communications into information operations which is also multi discipline.

So besides cyber operations you have electronic warfare, psychological operations, operational security.

And cyber of course became bigger.

And during the War on terror I deployed a few times around to Afghanistan and Iraq and I was basically throwing the nation's information warfare arsenal at our adversaries in order to keep them off balance.

So it's not just about guns and bullets and missiles.

There's information warfare.

And after that I taught in Norfolk, Virginia at the Joint Forces Staff College.

And then my last assignment was in the Pentagon where I had the IO and cyber portfolio.

And my main effort was to write and manage the Army's Cyberspace Operations strategy where we helped build something called the Cyber Mission Force which each of the services contribute Cyber forces to U.S. cyber Command.

After I retired I started my business and we did mostly consulting to the Department of Defense, Department of War, call it whatever you want on cyberspace and information operations on a big scale, a multidisciplined but b also looking at doctrine and policy and what type of organizations you should have and how should you train them.

We did that for several years and then along I caught a way with of the private side and we started advising a cybersecurity startup.

And so we, we kind of pivoted and started doing cybersecurity only or just those things that are related to small medium sized businesses and, and sled, state, local and education that that switch has been on.

This will be our, our third year more or less where we're, we're just focused on, on that where we've shifted our focus away from the defense.

I believe I said this offline earlier.

Thank you for your service.

That's long dedicated service.

So thank you for that really interesting time.

Throughout you definitely scratched a nerve back in my head of the old dial up modems.

We actually put the phone into the modem, right?

Yeah.

I say that to people and they look at me like what?

Huh?

Yeah, yeah, yeah.

You put the phone into the modem that was attached to the cord.

Okay.

Can you share some of the key milestones that shaped your journey as a leader in the IT space?

You know, in the military there was the Transition was when DARPAnet or the Internet really started to grow.

I mean that was kind of like transition number one.

In your experience, what are some of the other biggest growth barriers for IT firms today?

Yeah, and I think the space is getting very, I'll say interesting and if I want to be more ominous, maybe even threatening, because I think the first important decision a business makes is to choose a great IT partner to get you started on the basics.

But when you look at cybersecurity, there's definitely that overlap with it, but there are some things that are possibly outside their scope depending on the knowledge of the company.

So like you have IT company, an MSP managed service provider and an mssp, the managed services and security provider.

Cybersecurity, people, processes and technology.

When you look at the technology piece, the IT might cover a third of the ocean, an MSP might cover two thirds of the technology ocean, and then the MSSP can boil the ocean almost with, you know, by covering 98% of the technology capabilities.

A lot of these small businesses are becoming discontent with their IT because when it comes to cybersecurity, these small firms only know as much as their people know.

And maybe it's three or four people and you are good to the extent that they can provide you technology support to protect your systems.

But that's limited.

And now you're getting this disconnect because I go back to the boil the ocean metaphor.

You know, there's a temptation amongst technology solution vendors.

I got to sell you something else.

You need this, you need that.

The reality is especially small mid sized companies, you just can't afford everything.

So now it comes in, how do I mitigate the rest of that risk that I can't cover with technology?

So IT companies, most of them are very good at protect and some of identify and some of recover and maybe a little bit of detect.

We lead with the people expertise of cybersecurity to help you identify those people processes and technology measures that you need to take to be as secure as you can based on your resources.

Do you feel that approach is something that sets you other firms in the space.

Why?

So give me a little detail there.

Well, we're not leading with technology, so we're not trying to sell you another piece of technology and we're not trying to.

We're not leading with the notion that you have to boil the ocean.

What we're bringing in is we're bringing in more expertise than you have in your IT section.

A more holistic, more sophisticated, more experienced approach.

Our advisors are all mid career, minimum 15 years experience, but probably more.

They've been a director at some level and they understand the big system problems that even small businesses going to have.

You still have big system problems, there's.

A lot of value there.

But how do you communicate that value to your clients or your prospects now?

Because that's a very interesting, unique selling proposition, but a bit of a word sandwich.

So how do you communicate that?

Yeah, great question.

This is like really recent as we've kind of got around.

You know, you go round and round, you have your marketing proposition and your value proposition and, and you're always out there working on it and then you're like, you know what you're looking for that differentiator.

But you know, case in point, when we had just picked up a customer less than two weeks ago, they contacted us because they felt like they had been breached.

And the first thing you do is help them manage the situation, help them manage their emotions.

It's like, hey, we're here, we, we're doing this together.

I, myself and the owner and the three of us, we're going to be okay, we're going to solve this.

And you just lay out, you know, the technology piece has to go first, we have to take care of that first.

But then, you know, it's that discussion of we bring this expertise for you and it's more important than the technology.

So what I am hearing is this has, you've had a couple of pivots over the past three years roughly, right.

Can you share maybe one or two times where you pivoted your strateg strategy to achieve growth objectives and what happened along the process?

Yeah, so the number one thing I did as a business leader, I came out, you know, coming out of the government and you understand the way the government works and the way we got business then was really on my name reputation because I worked in the Pentagon.

And so when it was a matter of bringing on my company, they felt like they were bringing on me.

And I, I think I had a good professional reputation when I decided to make that pivot.

This is going to be Different.

But now I've been in business a while and learned other aspects of business that I just didn't know from being in the government.

And you realize the leadership piece to me was kind of just a continuation that that's been almost 40 year journey of, you know, of leadership and sales and marketing were my, my weakest points.

So my tagline was make better decisions, which to me made sense.

But you said, well what does that mean?

And then you bring that over into the commercial space.

We're a cybersecurity company.

Make better decisions.

What do you mean?

I want to make safer decisions.

I want to use, trust your decisions.

But Wall Street Journal already had it.

So I thought they'd come after me if I tried to do that.

I don't know anybody in this space.

How am I going to connect with them?

And so now you're networking, right?

So you've got all these networking groups now that you have to do a lot more networking.

And then you have sales.

And to me, sales is not a natural conversation because you have to be, you have to be inquisitive and you have to know how to ask questions in such a way that it stimulates interest.

And the person wants to keep talking.

And I lost him.

And you know how I lost them?

I didn't stop talking.

Right.

And all I had to do was, here's my card, can I get yours?

I'll follow up.

As the business owner was really to focus more on sales and marketing.

So that's where the primary investment was.

It's 20 is the rule.

Right.

Let them talk 80% of the time.

And you,.

How has your leadership style evolved as your company has grown?

Yeah, I love that question.

Because sometimes the private sector or civilian side will just like, gosh, militaries, they've been to war and all that.

And you know, that is hard.

And I'm not trying to, you know, cut my peers short, including myself.

However, leadership is a little bit easier when everybody has to follow you orders or else.

So now it's like, well, they don't have to follow my orders.

They can find a better opportunity somewhere else.

So in that regard, I think I've become more collaborative.

I'm just going to go with what I consider to be the essential leadership skill.

What I consider to be the number one skill of any leader is adaptability.

And that's being able to recognize your situation and apply the right leadership.

Okay, looking ahead, what do you see as the biggest opportunities and challenges for firms in your space over the next few years and AI I want more of an answer than AI.

No, I'm not going to say AI.

Going back to.

We were kind of talking about this earlier.

There's this disconnect in my opinion, at the small business level where owners are not satisfied with their current IT team.

They don't have enough expertise in cybersecurity or possibly even AI.

So the opportunity for us is to help them find better partners and better partners that work with us to help as a team color in that risk mitigation.

The danger spot for some of these small IT teams is if you don't adapt, if you're not willing to pick up more expertise, if you're not willing to stay engaged with your clients, they're going to leave you.

This just happened a week ago.

We're advising a law firm and they were breached.

And he said, well the IT team, they came in and they installed Huntress and they also enabled multi factor authentication.

And the owner said, he said to me, I don't know why they never recommended this to me and he's looking for somebody else.

I talked a little bit about AI and you said that wasn't a challenge out there, but it's still in the space.

It's impacting a lot of people in the space.

Have you seen anything in particular with any particular vertical that you work with that has really raised AI to a different level?

So for a few examples, registered investment advisors now they have a lot of compliance requirements.

Some of them like, they like start to use OpenClaw, which is a security sieve.

And so that's very risky to them and their compliance.

And then one of the interesting things is talking to bank risk assessors.

You know, we were talking to one, for example, they've got a client who's got eight different vendors who also use some type of AI.

That's eight different variations of third party risk that you're now also potentially assuming now.

I was talking to one, he was a VP for one of the larger international banks and he did a query in their AI platform, I think it was copilot.

And he said, what's the CEO's position on topic X?

And it told him everything that the CEO had ever queried in AI, including bringing up emails.

What is one surprising skill or hobby that most people wouldn't associate with someone in your position or field?

I like to lift weights, I like to pump iron as much as I can.

Try to have a personal trainer somewhere in my workout, maybe not full time, but just so I can get their expertise and talk to them about Other things I'm doing and to get challenged.

Was that something that existed pre service, something you picked up in service or something after either?

No, I, I've been lifting since I was 15.

Wow.

Ever compete?

No, no, never.

Never competed.

So how do you think your weightlifting as a hobby has contributed to your success?

I just, it's because it's like this.

I have conversation with my, my, my dad or my uncle, they always say, carm, don't get old.

And I'm like, hey, it beats plan B.

It's a good point.

Absolutely, positively.

Yeah.

And on the cybersecurity side, it's the same thing.

Plan A is be proactive.

Plan B is be breached.

So what's a challenge you faced outside of work that has had a significant impact on how you approach your professional life?

Take your time.

You know what it is actually, it's having a family and in the contrast to being like in the military.

In the military.

Right.

And you have a chain of command and at some point I'm the boss of something.

Right.

And you're accustomed.

By the time I retired, I was a colonel.

I was in 29 years.

To put this in perspective, there were about roughly 450,000 people in the active army at the time.

Roughly.

I would have actually been ranked maybe number 3,000 kind of high up there.

But when you go home, that's a different animal.

I mean, wife and three kids, they're doing their thing and they've been doing their thing most of the day and in walk you, you know, and you don't get your way and you have to, you have to learn to speak to them and find out what they're doing and stay connected with your kids especially and then try to nudge them along and influence them along.

Hey look, this has been a really enjoyable conversation.

I really enjoyed our time.

What's the best way for people to get in touch with Carm to hear more about your advisory work and how you can help guide them to the right decisions as a partner?

So I am on LinkedIn.

That's probably the best way to get a hold of me.

You can also try and get a hold of me by email.

Carm.

C a r m cybercic.com Perfect.

Hey look, thanks again so much for your time.

Thank you again for your service.

Thank you so much for your time and sharing your unique perspectives with the Growth Guild audience.

And we'll talk to you again soon.

I appreciate it, Chris.

And that wraps up another valuable conversation on the Growth guild conversations with IT CEOs.

If you're an IT CEO facing that revenue growth plateau, reach out to Chris Larkade on LinkedIn to have a conversation on how he can help your business break through that ceiling.

Finally, if you found value in today's episode, please subscribe to the podcast and leave us a quick rating or review.

Wherever you listen, it helps other leaders find the growth guild.

Thank you for joining us.

And until next time, keep growing.