Karun Malik and Barb Huelskamp Explore Enterprise Solutions | Qualys QSC23

This is Textron tv. Hello. And we're back at the Quass Security Conference, and we're here with Karun Malick and Barb Samp.

And they are the channel managers for Qualys. And for those of you who don't know what the channel is, well it's that partner ecosystem, you know, all the folks that get together that actually implement things and make things work. Well, it's those folks.

So we're gonna dive in here for a little minute and say, what's going on with the partners and what do we hear from their customers? Karun, how are you? Yeah, thank you for having us here.

So, uh, we are hearing a lot of excitement from partners, a lot of excitement from customers. A very fact that, as you saw today, we announced enterprise true risk. It's a lot of excitement because now it helps customers measure true risk, qualified, true risk remediate and measure and calculate it at the end of the day.

The other things we are also hearing from our partners today is, is about how they can leverage and provide a better TCO to customers. So our platform story that we've been talking about since many years now, with the fact that we have one agent, we can consolidate TCO, we can consolidate technology, we can consolidate any kind of investments they're making. So the beauty of, of the platform is now that we've moved to this risk-based model is now we can measure and we can have a board level discussion of, Hey, where's your risk?

Is what I can do with your risk? And the other interesting part is, as we've evolved our platform, uh, customers are now asking partners for, Hey, can I build, can you build a service offering for us? That's where the shift is happening.

So the traditional resellers that we had in our, in our space, which we still have today, they're all slowly and steadily moving a, making a shift towards, you know, services, which is either what you would call an industry definition as an MSP or an MSSP. So that evolution is happening and we believe we are helping accelerate some of that evolution by providing them a platform to help accelerate this. That's Right.

Hold that thought for a second. You've been with the company Grand total to six days now? Three Days.

It's my third day. Three days. What are your first impressions as you kinda look at all of this?

Yeah, well first, what a fantastic platform. Really exciting to see the company continuing to innovate. And we're hearing from partners proactively.

We're not even soliciting, uh, the feedback yet, and they're telling us how excited that they are about the true risk platform and the continued innovation. We're a best of breed platform and we're really focused on enabling them, helping them build that service practice. And that's meaningful to them.

It creates great customer outcomes and more profitability for them. Let's come back to those managed service folks. If I think back in time, usually maybe 10 to 15% of the total market was consumed by managed services, security seems to be evolving.

So ultimately, do you think it'll be half the market, most of the market? What will be the mix between stuff that's consumed by an internal IT department versus delivery by a managed service provider? Yeah, so a good question.

So if you look at the market and you segregate that into two different functions, which is one is the S-M-B-S-M-E and the enterprise in the S-M-B-S-M-E, there is a clear shift to managed service providers, uh, in the enterprise space. The one shift I see happening, which never happened before, is if you and managed services are categorized into response and and detection in the detection space, every managed service provider was good. They were always there in the response space.

They were not there. But now that's what what we are helping them change. So now with the platform that we have, like we have orchestration, I can push a patch response, I can push an EDR response, I can push an enterprise tourist response that Sumit and the entire team spoke about today.

So now we are helping trend transition from just an incident service provider to a response service provider, which is where the new age SSPs, as we classify them as MDR providers are now coming up. So a big transition is happening, uh, I would say in the SMB SMEs, it's already happened. Mm-Hmm.

In the enterprise space, the response, uh, providers are coming up and up and coming in terms of having it in-house. I see in-house functions being more of ITIL and CMDB and operational based, I don't see them getting into response or into incident response. It needs headcount, it needs investment, it needs best of breed technologies because in MSSB, I came from that world 2010 years ago before I came to call us.

The investment there as an M-S-S-P-O, as an MDR is in operationalizing frameworks. It's not in the headcount. So you build best of beat products or frameworks based, and then you map them to your incident response or ITIL framework in providing best in blast security managed service provider solutions to your end customers.

I can't quantify the growth, but the MSSP model is gonna continue to grow. When you think about the resource shortage, the the shortfall in cyber security skills, they are looking for organizations to help them. And that's where our partners can really step up and help them stay on top of the growing threats.

You've been an MSP, so I'll ask you this question. Is it becoming less expensive to become an MSP? 'cause one of the limiting factors was it was a big lift.

Yeah. So if I am now working off of platforms that you guys have already made the investment, can I lower that bar and might there be more MSPs ultimately? Yeah.

So Mike, you, you, your question is exactly aligning to the strategy that we have, which is the platform strategy. The biggest bar for an MSP has always been product investment. It's always, that's been the biggest number one entry barrier for them.

But now with the models that we have as a platform where, hey, the same agent can do five different things for you. I'll give you an example how, for the MSP business, which is, you know, the S-M-B-S-M-B mid-market business, we announced packages called fix it protected, especially for this market because we knew, A, the market is price conscious. B, we also know they're hampered, as she said, by resources, they can't put in like 20 resources out there.

So now with our packaging and our platform, we have removed the barrier. Two days ago. In fact, yesterday we announced the MSSP portal.

So in the past, what all these MSPs were doing is they were aggregating data from various resources and then building a dashboard or a UI and saying, Hey, this is the output. We've changed that game. Now with our managed service MSSP, multi-tenant portal, I can aggregate the data, I can visualize the data.

So the only investment for them is to come train on our platform. And guess what? We don't charge for training.

So come get trained, deliver the outcomes, and deliver a risk based outcome. Back to your customers, What do you look for in a partner? What makes a good partner?

What are the attributes? I think we need to look at what the customers are, are looking for. And every customer segment, um, has their own their own demands.

We're looking for a joint commitment. We are certainly gonna be making an investment in the partners, as Koon said. Um, we are ramping up our enablement.

Uh, we are ramping up our demand generation, but we're also looking for partners who are going to join us in that, that journey and are committed to that enablement, committed to growing partners, and I think as importantly, committed to those outcomes with, with the customers. Mm-Hmm. We wanna make sure that we're providing them with, with a, a product, but then the service that meets their expectations.

What's your advice to partners about how to better engage? And I asked the question because one of the knocks against partners has always been, they're not so great at the outbound marketing side of this equation. Yeah, they do a nice job once they get the deal going, but they don't generate a lot of demand.

So how do we get them to that next level? Absolutely. So one is we've made a lot of investments in the team today.

We have a global team. We have channel account managers globally in every region. Uh, work with your cams or channel account managers.

They'll give you a lot of native knowledge that you need. The second is the big investment we made now in training is we have enhanced our partner portal experience. What that makes them is that now makes them independent, where they can click, sign on, get the data, whether it's content, whether it's brochures, whether it's pricing, whether it's marketing strategy, battle cards, name it, all the ammunition you need to be successful as a partner is one click away.

So the more they engage with our, with every enhancement or efficiency we've built in, the more successful they'll be on messaging, on marketing and our production. Yeah. And we're putting a bigger focus on developing a joint partner business plan.

We can't do a cookie cutter approach and expect that every partner is great at digital marketing, or every partner is great at webinars. There are some partners who do really well with maybe an eight CEO CSO round table. Right?

And, and, um, smaller footprint, more executive thought leadership. And there are others who do really well in SMB and they're hosting webinars. So we wanna meet the partner where they are doing well and or how can we help enable them to find new customers and help them along that journey.

Not everybody watching this is a partner. A lot of them are the customers of partners You've been in MSP, what should they look for in an MSP? What's your advice to them as they kind of look at the portfolio of partners?

There's a lot to choose from. What makes a good MSSP? Yeah.

I, I I, I say the simple way is look at customer satisfaction. Yeah. Customer Stories.

If customer stories, customer satisfaction. Um, and, and because in an MSSP delivery model, it's all about the outcome of what you deliver. Look at the partner that is invested most in engineering and product and customer experience.

Those partners will deliver the best value to you as an end, as an end partner or end customer. Mm-Hmm. There's a lot of talk about AI these days and everybody's walking around going, you know, is my job gonna go away?

And I'm sure the partners are looking at it going, you know, are we about to be automated out of existence? What's your take? Not at all.

I think AI is gonna help us get smarter. And quite frankly, it frees up some of those human hours for other strategic work. As simple as that.

I think there's, there, it's a powerful tool and quite frankly, the bad actors are also using it. So that's creating more work for anybody in the cybersecurity segment. Do you think that the, clearly the partners need to make some investments, they have limited resources.

So where should they prioritize those investments from your perspective? Well, simple in learning the platform. The more they learn the platform, the more they get equipped on what the platform offers, the more value to the end customers.

You talked about training. Um, every partner program I ever met has all these certifications involved, and you have to go and get those and take a test. Are you gonna make that process easier?

'cause every partner I ever met complains about it. So We, we are, you know, we had a, a very healthy conversation with some of our partners who attended, uh, this week in our partner summit and our partner advisory council. All of them were very eager to participate.

More training from sales training to understanding how to position the product to pre-sales, and then the technical certification. So we are going to be expanding our enablement, not just in what we deliver, but how we deliver it. Um, se boot camps and bringing enablement out to partners into different parts of, of the regions, and they're expressing an eagerness to, to participate.

The only time that I see partners getting along with each other is when they come to a conference like this, um, a lot of them have become concerned that there's too many partners Yeah. In this space. And then they worry about the competition.

So how do you kinda promote a market that's indirect, but not to the point where everybody winds up stepping on each other and nobody's making any money? I, I'll, I'll, I'll go first and let you jump in. I think there's plenty of opportunity and it's understanding where they're focused.

Where's your customer base? What kind of customers are there specific verticals? And then how we go to market.

I think there's plenty of opportunity for everybody. Yeah. And I second what Bob said is there's enough for everybody and every partner has their own unique value.

Mm-Hmm. But I'll, I'll give you an example. Um, you know, if you look at the paradigm shift of partners, AWS like marketplaces, like AWS, Google, GCP, and Azure have come up as an alternative sourcing strategy for, for partnerships.

Now, with the way we can all coexist, for example, AWS has a model called CPPO where I can sell through Opta and Guidepoint and all my other partners who are part of the AWS ecosystem also. So we can all together create more value for the end customers. So we are all being creative about it, and we all realize that every partner brings in a different value.

Some partners are better in orchestration, some are better in professional services, some are better in managed services. And that's where our tams or our sellers understand the value and we help promote the value to our customer base. It's, it's, it's really getting focused on what we're gonna do together.

And not peanut butter spread yourself across too wide of a swath where you're not really having an impact. Yeah. And, and Mike, the big difference that comms here is unlike, you know, other providers in the same space, so ISV technology companies, we are a no zero.

We are a zero services company. So a, we, we eliminate that conflict on day zero or day one. So we don't provide managed services, we don't provide professional services.

We empower these partners, which are our partners to provide these services. And That's their value differentiator. That's the big value difference.

Where should the partners kinda put their emphasis in terms of hiring people? And I asked the question for the following reasons. So many of the partners I know are what I would call accidental entrepreneurs.

They are tech people who saw a need, started a company, and then they built that. And their natural inclination is to go hire another engineer. Maybe they should be reallocating more of their funds to hiring sales and marketing people.

'cause the cost of the engineering side's is coming down. That's, Yeah. I think you've gotta assess where you get the best bang for your buck, quite frankly.

Right? And as an example, we talked to one partner and they're doing very well in SMB. Um, they, they weren't really big enough to do well with some of the more global customers.

So why not double down an SMB and, and invest resources on how you're going to attain more customers, how you're gonna expand the customers that you do have, and then what services can you expand to across our entire platform? They may have found a sweet spot, but there's plenty of services left and right that they hadn't built yet. Is the channel now effectively global?

We had, you know, it used to be we had Americas, and I mean, and then Covid came and suddenly everybody woke up and said, Hey, I'm not tied to my zip code anymore. So is it a different world? So our partner program is global, so hence, you know, it percolates down to every region, every country, every regional partner has aspirations to be global.

So the answer is, you know, the way we've designed our platform is we help them be global because the platform helps you accelerate. We have made investments in platforms in in Saudi, in UAE, in Sydney, in India. We've always had platforms here.

We've made an investment three years ago, my platform in Canada. So guess what if, if a large telecommunication company comes, which is like a Telstra in Australia, and says, my plan is to be fully global by 2024, we are, the platform can let, let, can make them ride. Vice versa.

If there are companies that are headquartered in, in North America and want to get into unique regions in Southeast Asia, we have a sales team to execute. We have a platform there to execute. So we are ready to help them execute.

So our partner program, our partner ecosystem is global and we have, we have sales reps including cams, globally supporting our regions. All right. It's the end of the year.

You're still relatively new, but looking into the next year, 2024, you know, what's your expectation for where we're gonna be collectively, both with the partners and the company. We are making some big investments and continuing to evolve our partner program and our commitment to a partner centric strategy. So, uh, we communicated to our partners just this week some of the additional enhancements we wanna make in the program.

Um, expanding enablement, expanding demand generation. How can we include partners in our own internal campaigns and how do we help them develop that service practice? So with our new, um, expanding portfolio that they are accelerating and simplifying for their customers.

So you're gonna continue to see those investments and that cultural shift with our own organization pairing up the partners with our sales organization. We still have a direct sales organization, but they understand our partners have customer relationships that are deep and wide and they bring additional value. They create stickiness, they integrate other technologies.

So how do we bring that, that sales play to our own sales organization? Alright, I saved a harder question for you. Um, it's the end of the year.

There are sales goals for 2024. Each partner has a number and a and a goal. Yeah.

So, you know, what does that look like? Are the goals, you know, much higher because the opportunity's much higher or Yeah. How big a lift is it gonna be?

What do you think? Well, I, I'll I'll tell you, it's, it'll be an easy lesson and I'll tell you why. Uh, with enterprise truist now, as I said, we are helping them measure, communicate, eliminate risk.

It opens up a new paradigm like cyber insurance. You know, it's, it's a hard topic. What, what, how can cyber insurance help me now the different ways of how we can view it.

But the way we view it is a, we are helping the underwriters get better data, but the customers, to your point, how am I helping customers or partners? I'm helping customers reduce their cyber insurance. So a I'm providing ROI.

So if you saw the IDC report that we launched two days ago, it covers a lot of these factors of with callers, with one agent, one story. How do I reduce economic ROI, but also how do I reduce the risk? ROI.

So with partners, my goal and my vision to them, which you know, Barbara, Bob and I have been talking is get to know the platform better and you provide a better ROI to customers. If you know the platform and you deliver the platform better, the economic output follows that. It's a simple transition.

What is your best advice to the partners about dealing with the cyber insurance companies? 'cause some of them are providing a managed service. Yeah.

Others are partnering with managed service providers and they seem to be, um, trying to force people to elevate their cybersecurity game. Yeah. Which is good because I think they all got taken in the cleaners a few years ago when they started writing checks and they went holy the moly.

Yeah. Yeah. So how do I as a partner engage with those folks?

'cause they're kind of big and nobody knows quite where the front door is. Well, I, I'll tell you, it's so SIM Bob, sorry, do you wanna go first? No, no, go ahead.

It gets me excited because I'm, I'm running this program for callers. So cyber insurance, the IS data, okay. It's simple.

The data derives the risk, the data, the risk reside derives a premium for any partner, whether it's an a managed service provider or an ISV partner like us. As long as you can justify the value of your data to the underwriter, because the underwriter is, is a, so software or a program that ingests the data. Now with we have quality data, we can provide them data on measurement, on risk, on asset, whatever, you know, that the, the a hundred foot data that is needed.

But as a service provider here is the interesting concept where service companies can step in. Cyber insurance is moving from a pro from a reactive to a proactive manner. So a new concept called adaptive insurance is not being adopted.

Like we go for a health checkups every month and if you're healthy, our premium should be lower. Which they're not. But it is what it is.

Same with cyber insurance. If, if every month somebody can do a checkup on your state of your risk, and that's where service providers like you spoke of can come and step in and create that ecosystem. So some of our partners are far down the line of creating an ecosystem, but they are the checks to do checks on services, on health, on risk.

And then they provide remediation that if you do these four actions, your risk score is improved and hence your insurance premiums are also reduced. So there's a play for everybody out here. All right folks, you heard it here.

It is increasingly being consumed as a service and so is security to go along with that. The thing is, you know, they used to say follow the money. But I think what's really follow the data at this point.

Hey, thanks for being on the show guys. Thank you. Thank You, Mike.

Thanks for having us. Yeah. Thank you for being here.