Hollie Whittles on Why Incomplete AI Governance Leaves MSPs Vulnerable to Data Liability

[00:00:01] Dave Sobel here reporting from the floor of ChannelCon, sitting down with Hollie Whittles. Now Holly is the co-founder and director of Purple Frog Data, a Microsoft data and AI consultancy out of Telford in the UK. This year's GTA UK and Ireland Spotlight winner for IT Service Bride of the Year, chair of GTA's Data and AI Interest Group, and as of June, a member of the Order of the British Empire for services to business, female entrepreneurship and skills.

[00:00:29] You're one of the few people at this show who does the data work in related to AI rather than selling tools that measurement. We're going to dive into some of that. Holly, welcome to the show. Oh, it's great to be here. So I'm going to start with you chair of GTA's Data and AI Interest Group. The data there says 97% of IT Service Providers have adopted AI and 20% have the governance to make it worth anything. Tell me what's happening inside that gap.

[00:00:55] I mean, that's a great question. And it's something that we see a lot. And a lot of people are really struggling with that governance angle because I think there's a lot of pressure on businesses to kind of innovate and accelerate using things like AI. But actually, let's step it back to the data. And that's got to be right before you can start adopting those systems. And the governance of that data is so, so important.

[00:01:19] So in terms of bridging the gap, what we're doing in the UK is working very closely with the UK governments and they're trying to help ITSPs, MSPs, vendors actually come up with frameworks and policies before they start running, before they can walk. And it's all about, you know, have you considered the moral impacts behind doing things, the systems that they're in and how clean your data is before you start trying to model it and transform it into all this kind of amazing stuff with it.

[00:01:47] But in terms of the UK, I think we're a little bit behind in terms of adoption. I was reading a study done by the Federation of Small Businesses in the UK and they were saying that 86% of organisations are really struggling with that gap and they haven't yet adopted and they don't know where to start.

[00:02:05] So that's quite concerning for us. So I think being part of a community like GTA, you can come to like Channel Con and that can start, for me, closing that gap and getting that knowledge from people that are already living it and doing it. Now, one of the things you said that I thought was interesting is people are racing ahead before they've got the governance in place. And until you then, until you do that, you can't start racing ahead. Be concrete. Talk to me about how long does that take to put that in place?

[00:02:32] And what does it cost, say, a 15 person MSP to do it? It really comes down to having that board level buy-in before you start back in that conversation. We've seen businesses fail where the people in the middle are trying to push it, but actually the board are like, why are we doing this? And it can cost tens of thousands of pounds. So it's a really difficult one to get started. And also it depends what technology you're using, which other vendors you're using.

[00:03:01] There's so many different things that you need to do. And for us, it's about stepping it back and actually having a plan. And what's your challenge? What's your strategy? Where are you trying to get to? And then we'll come up with a solution. Now, the advice to slow down and do the governance potentially costs an MSP money in the short run. The competitor down the street who runs ahead, skips the governance, ships a deal this quarter.

[00:03:27] You're asking owners to leave revenue on the table with the promise that it'll pay off in the end. Why should they believe that? I think if they don't, they're going to be replaced by companies that are. So it's that whole analogy about, you know, AI is not going to take your jobs, you know, but actually you're going to be replaced by companies that are using AI. And it's the same with data and governance. So that's what we try and explain to them is that, yes, you might be OK now, but step forward 18 months, 24 months.

[00:03:56] Actually, you might be being left behind. So that is you leaving that revenue in that future, recurring revenue as well. Now, you're one of the people here who actually sells this or many of the people here are selling a tool that tells the client data. You're actually one of the people that's doing the work to fix it. So when you open up like a mid-market client's data estate, what are you finding that's actually broken? What do you, what do you, I mean, name a thing that you find like every single time.

[00:04:22] Every single time we get told the data is good and every single time we find out actually it isn't. Because the problem is there's been a human involved with that. So when data has been put into systems, there's, that allows opportunity for error. So we were working with a really big bank and they were like, yeah, our data is great. Our reporting is great.

[00:04:45] And it turns out they were misreporting by thousands and thousands of dollars because people have been allocating things to wrong policies or to policies where people are actually dead. And those bank accounts didn't exist anymore. So once we'd actually cleaned and extracted and transformed that data, put it into a big data warehouse, then reported on it, we were like, and showed them. They didn't believe us. So then we have to do the whole proving.

[00:05:11] And, but yeah, a lot of people will think their data is good and it takes companies like us that specialize in data analytics to show them actually it's not. But we can help you clean that. Every tool you bolt onto Microsoft 365 is another console, another login, another thing that eats your team's time. Proofpoint 365 Total Protection gives that time back. Security, backup and compliance for Microsoft 365 in one multi-tenant platform.

[00:05:40] Built MSP first. Enterprise-grade protection tailored for your small and mid-sized clients with the operational simplicity that protects your margin. Modern threats covered, resilience built in, one pane of glass. Built on Hornet security, now part of Proofpoint. Learn more at proofpoint-total-protection.com.

[00:06:07] A lot of MSPs who have no data engineers and no readiness tools, like what should they be looking for in a client's data estate to know whether this is like a six-week job or a six-month job? Oh, that's an interesting one. I think you could do it within sort of three months, I think, if you really went for it. But you've got to get the buy-in to actually be able to talk to the people that have the information.

[00:06:32] So if you're going to ring fence people off because they're working on client deliverables and projects are going to get more prioritization than actually the strategic things of adoption, then that's going to be a problem. So you really need, like I said before, board-level buy-in to actually make these things work. Now, you're Purple Frog's InfoSec director and you hold the ISO 27001, right? Yeah.

[00:06:57] Your worry at number 10 was firms pasting customer spreadsheets into ChatGPT, right? Yeah. But you run AI over client data for a living, right? So where does a client's data physically go when you build them a model? And what does an MSP need in their contract to answer that for their own clients? That's a really good one. And I think with a company like us that do data analytics, it would be very easy to say, we'll take all your data and we'll have it in our tenant and our environments.

[00:07:26] What we do is we always build in theirs. So they are in full control and it's in their tenant, it's in their environment. So actually for us, the cyber risk is also with them as well. So it's really important to have the proper due diligence in place when you engage a company like ours that are going to be accessing live data. And in some respects, we have more access than they do because we're doing the live reporting over the top of it. But it's much safer.

[00:07:53] It's more and powerful for them to keep everything within their organization. So that's kind of our model for working. So you've told us you're an ITSP, right? But to be specific, Purple Frog is a Microsoft data and AI specialist and you've got MVPs on staff. It isn't a service desk, right? This is different in offering. So when you tell MSPs to get data ready, my interest in there is, are you advising them or are you also potentially offering them work that they can subcontract out to a firm like yours? Yeah, it's both.

[00:08:23] Some companies engage us, like we work with a big retail client in the UK and they just engage us for consultancy and then they were going to go off and build it themselves. Most people will engage us as a third party to build their data solutions. And that could be building a data lake. It could be building a machine learning. It could be building an AI agent. It depends what their appetite is and what they're trying to get.

[00:08:50] But because we're a Microsoft partner, we quite often end up building things like a whole Power BI reporting suite, for example. But that's kind of the end product. The skill in using someone like us is actually getting the data model right. And that's the hardest part. Everyone goes, oh, I can build a report. I can drag and drop stuff on. It's fine. But actually, there's a lot of risk with that. And there was a horror story that we found with one of our clients that engaged a consultant to build.

[00:09:19] And they just wanted an HR report that showed how many hours have been taken in vacation time. So very simple HR report. But this contractor behind the scenes in the data model had dragged in the entire HR database. So actually, if you knew how to use Power BI, you could drag on salary, disciplinary, all sorts of director salaries. And all of a sudden, you've opened the keys to the kingdom.

[00:09:45] So for us, we will build a proper, secure system where only the right people can access it and leverage it. So I think that's why we are now in this kind of niche area of actually helping people make better data-driven decisions with their data. Now, I want to ask you something that's targeted. It's not at all a criticism. It's actually a governance question. I want to understand because you're someone who thinks a lot about this. And I want you to make sure to understand the way this would work.

[00:10:14] You chair the GTIA interest group that writes the channel's AI guidance. And your company sells exactly that. So I'm interested in the data and AI consulting you're selling potentially to the same firms. How do you firewall that off between the two different roles from a governance perspective yourself? Yeah, so that's a really interesting one. Because when you're working with an organization like GTIA, you have to be very, very careful to be vendor agnostic and neutral, those different things.

[00:10:41] So I would never self-promote, for example, in the data and AI interest group. But that actually came from member feedback that MSPs were struggling with where to get started. So one of the things we did was we created a GTIA guidebook around data and AI governance, which actually steps them through everything that they need to do. So that then led to with people going, well, great, I've got the guidebook. I've got halfway through it and I'm stuck. So we've created the interest group.

[00:11:09] And what we do, my role is finding interesting speakers. So I will pick a theme and a topic and I will find the best person I can to come and fill that hour. We invite, it's open to everyone, you can join the call. But that for me is something that I will do just as GTIA. I will not sell my services. And that's how I kind of keep the differential between the two. Here's a question MSPs don't ask often enough.

[00:11:35] How secure is the tool that has the keys to every one of your client endpoints? Your RMM is the most powerful and most targeted software you run. LogMeIn and Resolve was built with a zero-trust architecture specifically to close gaps that other RMMs leave open. If the security of your remote management platform is on your mind, and after the last few years it should be, LogMeIn is worth evaluating on exactly that.

[00:12:04] Visit logmein.com slash MSP growth. Now, your MBE was for services to business, female entrepreneurship, and skills. And you're the FSB's national skills champion and a college governor. So congratulations. But I want to leverage that. If you run a 15-person MSP and I want real data capability in 12 months, who do I hire first? And can I train somebody I already have? Yeah, both.

[00:12:33] I mean, what we always try and do is we will train up the people within that organization and empower them. So they can partner with us and we will run everything for them. But if their appetite is, can you build it because you're the experts but actually want our people to run it, we will actually sort of gradually hand that off to them and we will do internal training. So when they're working with an organization like ours, they have to be very, very clear on what exactly they want. Because they are in the driving seat. They don't have to just accept what they're being told.

[00:13:02] It depends on what technology they're using. You know, you could have the same solution built in AWS or Microsoft. So, again, it's not about sort of picking whatever the shiny thing is in front of them. It's thinking about their organization, what's going to be best for them. And then in terms of some of those roles that you mentioned, in terms of like the skills champion, that is a fantastic opportunity that was given to me where I can actually talk to the UK government.

[00:13:26] And I can say on the ground, this is what MSPs and vendors, distributors and ICSPs, this is what they're experiencing. And that UK policy that you're bringing in isn't going to fit for them. And a classic example is our government is currently focusing on AI adoption. So they've created this AI essential skills framework. So I reviewed it with my small business owner hat on. You know, you're classic. We've got 25 people in our business.

[00:13:52] And I said, I don't have some of these roles that you've put in the essential skills framework. And I said, I can guarantee you a lot of firms that I work with won't have those roles either. And when you're running a smaller business, you're quite often wearing multiple hats at the same time. So we need to come up with a framework that works for everyone. So, again, I use that role to try and make a difference. Makes sense. Now, kind of last question here.

[00:14:17] One thing that you think every MSP owner should stop doing with AI in the next 12 months. What's that? Oh, gosh. What they should stop doing is just randomly asking questions without having any kind of plan. I would encourage them to start building skills within AI.

[00:14:39] So, for example, if you think about Claude, for example, rather than asking it questions, why don't you work with Claude to build skills that you can then use in MTP to make your business better? And you can save time. And a classic example could be writing statements of work. We've built something with Claude now that we've got a skill for writing statements of work. It knows how we like to structure things. It knows things that we always say. And it's taken hours off something that used to, you know, take days.

[00:15:09] We can do it in like two hours. So I would say start with that. Start thinking about skills that you can build with inside these AIs. Wow. You've given us tons of actionable items. Thank you so much for that. Congratulations on your success. Oh, you're welcome. What would you fix in your business with the right playbook? Small Biz Thoughts members get a library of templates and operational resources, recorded member calls, and classes through IT Service Provider University.

[00:15:37] Operational education built specifically for independent MSPs. Start at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage. The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode.

[00:16:08] Produced by Picture This Video. Part of the MSP Radio Network.