Mobile Security, Generational Attitudes, AI Impact, & Data Governance Trends w/ Denis O'Shea

[00:00:02] Don't you like to learn from an MSP that started in mobile? What if I told you they started in New Zealand, expanded to Australia, and moved into the US, and have been a Microsoft Partner of the Year four times? And they do their own research. Denis O'Shea, who's the CEO of Mobile Mentor, joins me on this bonus episode of The Business of Tech.

[00:00:23] Are you ready to get your brand in front of the tech leaders shaping the future of managed services? Here at The Business of Tech, we offer flexible sponsorship opportunities to meet your needs, whether it's live show sponsorship, podcast advertising, event promotion, or custom webinars.

[00:00:42] From affordable exposure options to exclusive sponsorships, our offerings are designed to fit businesses and vendors of all sizes looking to make an impact.

[00:00:51] Prices start at just $500 per month, making our packages a fraction of typical event sponsorship costs. Be a part of the conversation that matters to IT service providers worldwide. Join us at MSP Radio and amplify your message where it counts. Visit MSP Radio dot com slash engage today to explore all the ways we can help you grow.

[00:01:20] Well, Denis, welcome to the show.

[00:01:22] Thank you, Dave. Pleasure to be on your show.

[00:01:25] I am super excited to have you on because you're one of those MSPs that's profile looks a little different than the others. In particular, you've got a unique geographic footprint. You started in mobile and you do your own research. And so like just from a headline perspective, looking in, I knew I had to have you on. I'm going to start with the research because I'm dying to know a little bit about what you found in your ecosystem study.

[00:02:50] I'm dying to know a little bit about what you found in your business. I'm dying to know a little bit about what you found in your business.

[00:03:18] I'm dying to know a little bit about what you found in your business.

[00:03:18] It's really the criticality of protecting company information in the way that the generation X or the boomer generation or the older millennials do.

[00:03:27] So huge difference across the the demographic profile when it comes to both security and privacy attitudes.

[00:03:34] So let's actually talk a little bit about the device profile, because you would have a really unique insight here based on the experience of your managed services provider.

[00:03:42] Most MSPs, most traditional IT services, IT infrastructure firms have come at this from a very desktop focused perspective, right?

[00:03:50] Because that's very much the traditional one.

[00:03:52] Now, if we lean into that generational gap, we would also make the correlation here that Generation Z is one of the mobile first generation, right?

[00:04:00] They're much more likely to pull out their phone than they are to pull out their laptop to do this kind of work, right?

[00:04:07] So and your MSP started focusing on mobile.

[00:04:11] Tell me how those trends have kind of come together and what you're seeing going on with mobile in the workplace.

[00:04:17] Well, the genesis was really interesting.

[00:04:19] I used to work for Nokia.

[00:04:20] I spent 15 years for them selling 3G networks around the world.

[00:04:24] And I could see a huge problem, which was that carriers are spending billions on the technology, building out the 3G networks.

[00:04:31] Consumers are spending a thousand bucks buying their first smartphone.

[00:04:34] And all they were doing was sending text messages and making phone calls.

[00:04:37] People were really not consuming any smart database services.

[00:04:42] So I left Nokia and I set up this company called Mobile Mentor to try and address that problem.

[00:04:46] And the way I did it was I hired these really smart young people straight out of college, taught them everything they needed to know about the mobile operating system and how to sync a phone, how to set up email, how to get everything working.

[00:04:58] Because back in 2004, this was all very difficult.

[00:05:01] You need two different server addresses.

[00:05:03] You need a funky cable that you shoved up the bum of the phone to transfer contacts from your old phone.

[00:05:08] It was really hard to do sync.

[00:05:10] It was hard to get your music on it.

[00:05:12] And I taught these young people everything they needed to know.

[00:05:15] And then they went out and they would sit down with a business person for one hour and help that business person set up their first smartphone.

[00:05:21] So it might have been a Blackberry or a Nokia or a Sony Ericsson or a Motorola.

[00:05:25] But we helped that person become really productive using their new smartphone as a productivity tool.

[00:05:33] And so we learned a lot about people and their relationship with their technology and what are the barriers to adoption, what are the triggers to adoption.

[00:05:41] And we ultimately delivered that service for a million people around the world, Brazil, China, Australia, New Zealand and parts of Europe.

[00:05:48] So we learned a huge amount about the mobile workforce, how people use mobile devices.

[00:05:54] And the evolution from that then was Microsoft launched.

[00:05:58] So many years later, we had become an MSP managing all the fleets of mobile devices for large organizations.

[00:06:03] And we were in a nice niche with mobile devices, iOS and Android and all of that.

[00:06:10] And that was all going hunky-dory.

[00:06:11] And then Microsoft brought up Microsoft 365.

[00:06:15] And I was in the stadium in Washington, D.C. when Satya announced it in 2016 or 17.

[00:06:23] I had been invited there as a guest of Microsoft because they were so annoyed with me competing against them because we did nothing with Microsoft.

[00:06:30] So they came to us and said, hey, we'd like you to stop mucking around with VMware and AirWatch and MobileIron and Citrix and Cisco and these other technologies.

[00:06:38] Come and play with Microsoft.

[00:06:40] Help us launch this technology called Intune, which is half-baked, but help us take it to market.

[00:06:46] And they, but Satya laid out was a vision where Microsoft 365 and all the Microsoft applications would work on every device.

[00:06:55] iOS, Android, iPads, smartphones, sorry, desktops, laptops.

[00:06:59] And that's when the lights went on for me and I realized, oh my God, we're going to need to secure every device because all the work data is going to be all across these five device categories.

[00:07:09] And so we started the broad.

[00:07:11] So back to your question around devices, we shifted quickly from iOS and Android to iPad.

[00:07:16] to Windows 10.

[00:07:18] And it's just kept expanding because the data is everywhere, even on BYO devices, you know, people's home PCs and BYO smartphones.

[00:07:27] So we've essentially followed the data onto different device platforms.

[00:07:31] Which makes perfect sense.

[00:07:33] So, but wouldn't, are people using it differently?

[00:07:36] Are there different concerns?

[00:07:37] Like, give me a little bit of sense of the way you think about that.

[00:07:40] Generational might be part of it.

[00:07:41] But I would feel like one policy to rule them all is not the way that you have to approach this.

[00:07:48] How do you think about securing all this data across devices?

[00:07:53] We would like it to be one policy across them all, but it's not like that at all.

[00:07:57] The reality is we go into most organizations.

[00:07:59] They've probably spent, you know, if it's a mature organization, they've spent 20 years layering up their security stack for their Windows devices.

[00:08:06] You know, they'll have SCCM and they'll have a whole bunch of agents and scripts and GPOs and all of that.

[00:08:12] 20 years of really protecting their Windows devices and absolutely nothing on their mobile devices.

[00:08:19] And it's a moment of shock and awe for them when they realize that their employees are accessing the same contacts and the same calendar data and the same emails,

[00:08:27] but the same attachments and the same OneDrive content and the same files and folders on the unsecured device as they are on the secure device.

[00:08:35] So it's a real problem today in that organizations that did not solve the mobile security issue 15 years ago.

[00:08:43] It's still a very big open wound for them today.

[00:08:48] And now we're seeing our research shows the prevalence of BYO laptop has really grown.

[00:08:53] It's like 70% in the US.

[00:08:55] 70% of people admit to using a personal laptop for more than an hour of work per day.

[00:09:01] So what used to be a problem with BYO smartphones is now a problem with BYO laptops that, again, have no security.

[00:09:08] The other thing that you would have particularly interesting insights into is cross-regional regulations.

[00:09:14] One of my working theories, of course, is that regulation is driving a lot of this because consumers are becoming dissatisfied with the idea of anything goes.

[00:09:22] In the US, anything still goes at a federal level because there are still zero laws protecting it.

[00:09:29] But your organization works in Australia and New Zealand that do have privacy laws.

[00:09:34] And then in the US that doesn't.

[00:09:36] Tell me a little bit about what that's taught you about the impact of regulation in the way organizations work.

[00:09:42] Australia has the tightest regulations on privacy.

[00:09:45] So much so that we saw a 10 percentage point difference in our research over a two-year period.

[00:09:51] So in 2022, we asked people a simple question.

[00:09:53] What's most important to you, your personal privacy or your company security?

[00:09:58] And I think it was 82% of people in the last study said their personal privacy was the most important.

[00:10:05] And that's up from 72% two years ago.

[00:10:07] And part of the reason is Australia has had some horrific privacy breaches.

[00:10:12] And the legislation is really tightened.

[00:10:14] And I mean, those breaches are so bad that almost every one of the 26 million people had to get a new driver's license or a new passport.

[00:10:21] Because all their private information had been breached and sold multiple times.

[00:10:27] So they've experienced privacy breaches in a way that we in the US have experienced security breaches.

[00:10:33] And we've had the Equifax and all of that.

[00:10:36] Australia has had a whole bunch of personal information badly compromised.

[00:10:40] So we do see regional differences.

[00:10:44] And the same way that GDPR was a really interesting piece of legislation that for a while we all thought that's a European thing.

[00:10:51] We don't need to worry too much about it.

[00:10:53] Well, guess what?

[00:10:54] It has grown legs and wings and traveled around the world.

[00:10:59] Now, the next thing is the Digital Markets Act in Europe, which forces Apple to open up the ability to sideload apps onto your iOS device.

[00:11:08] Which is a shocking idea when we're so used to Apple's walled garden in the last 15 years when they did all the vetting and inspected the code and they protected us.

[00:11:17] Now you can have third parties, you know, selling apps through social media that had no vetting, no security, and could turn our devices into surveillance devices so easily.

[00:11:27] And again, we might think that's a European thing.

[00:11:30] They can keep it over there, but no, it's going to travel.

[00:11:33] It's going to grow wings and legs.

[00:11:35] You have actual insight, both research data and operational data in your own organization to be able to answer this question.

[00:11:43] Tell me a little bit about what the impact is on your services business in that regulated market versus what I would argue is a non-regulated market of the US.

[00:11:53] What are the differences between the two on your business?

[00:11:58] I would say the regulated market is forced to take security a bit more seriously and actually follow some standards, whether it's CIS or something else.

[00:12:10] They have to take security seriously.

[00:12:12] They have a budget for security.

[00:12:14] Some of the unregulated markets, some of them still have a surprisingly casual approach to security.

[00:12:20] They don't take it that seriously.

[00:12:23] They don't have much of a budget.

[00:12:25] Organizations may not have a dedicated security or privacy officer, and security may report to the CIO.

[00:12:32] Whereas in regulated industries, you typically see security is a separate line.

[00:12:37] The head of security might be a different person to the head of IT operations and treat it as an equal rather than a subordinate.

[00:12:49] And they'll have budget, and they'll be able to go out and buy Microsoft E5 because they've been told that's what they need to do.

[00:12:55] Whereas others will be still using Office E3 or Microsoft E3 and thinking it's good enough.

[00:13:02] Yep.

[00:13:03] I suspected that was the answer, but it's nice to get it confirmed.

[00:13:06] Now, you also feel like a perfect person to ask about some of my forward-thinking pieces.

[00:13:11] Now, we've managed to go over 10 minutes in this conversation without mentioning AI on a technical call, which is fantastic, and kudos to us for resisting.

[00:13:20] I don't want to go into a philosophical argument about that.

[00:13:26] What I'm actually interested to understand is, as somebody who's spending a lot of time on both data security and endpoint security, AI feels like it's going to be very driven by good data sets and good data governance.

[00:13:40] That if you're doing a good job of data governance, you will be better positioned to be effective with AI, however that looks over the next two to three years.

[00:13:53] Yeah.

[00:13:53] We're talking in the back half of 2024.

[00:13:57] What are you seeing in terms of the impact of that AI thinking on data governance right now?

[00:14:05] What I'm seeing is that the vast majority of organizations have been caught with their pants down.

[00:14:11] They're not ready.

[00:14:12] Their data is not classified.

[00:14:15] It's not labeled.

[00:14:17] They have no governance over the data.

[00:14:19] They don't know what their employees are doing on a day-to-day basis.

[00:14:23] And the biggest risk is employees will take some internal information, paste it into an open source large language model to get it reformatted or summarized or corrected or whatever.

[00:14:33] And bye-bye company data.

[00:14:35] It's now in a public large language model.

[00:14:38] We know that has happened.

[00:14:40] Our data and everyone else's data will tell you more than 80% of employees are using various AI tools throughout the day.

[00:14:47] And so if there's no governance on the data and someone can just go copy from a company document or a company spreadsheet and paste it into an external tool that is outside the tenant, outside their organization, that is a problem.

[00:15:03] And most organizations just have not done the groundwork.

[00:15:06] But the data gravity, understanding where their data is, what kind of data is it, and how to protect it and how to have some governance over how it moves and where it goes.

[00:15:18] And I want to get your sense of the – again, we're talking the back half of 2024 here.

[00:15:23] This is about to get particularly worse on mobile devices if I look at both what Google's doing with Android with the infusion of Gemini being built in.

[00:15:32] And Apple's about to finish baking in ChatGPT into the product.

[00:15:36] This is going to get a whole lot worse, a whole lot faster.

[00:15:39] Am I reading the tea leaves here?

[00:15:42] AI is going to be everywhere, absolutely everywhere.

[00:15:46] And large language models are going to mop up a colossal amount of stuff we give them and stuff we don't give them.

[00:15:53] It's going to just mop up everything it possibly can.

[00:15:57] And so there is a real risk here that a lot of the things we do on our devices will get absorbed into AI tooling.

[00:16:08] So give me a sense of what are you advising clients right now to be doing in this – and it's stepping back from AI strictly, but in the space of data governance.

[00:16:16] What are you advising customers to be thinking about right now as the top, say, three priorities?

[00:16:22] For most of them, actually, we're two steps back from that.

[00:16:24] I would say most of the conversations we're having with clients is getting that plumbing in order, just getting the basics in order to free up IT time.

[00:16:33] So by that, I mean automating provisioning, automating the five lifecycle processes, how you provision a device, onboard a new user, deploy all your applications and content to them, automate all your OS updates, automate your patching, automate the end-of-life retirement,

[00:16:48] so that you can free up IT time to then think about data security and do some of the work on data classification, data governance.

[00:16:54] Because most organizations we work with, kind of if you say, you know, you've got the leaders who have done all that, the laggards who will get to it in five or 10 years' time.

[00:17:05] The mid-market, the middle market, they're all working through this, but very few of them have already – have fully automated all their day-to-day IT operations.

[00:17:14] So they don't have the headspace to go and work on the data governance yet.

[00:17:19] So that's where we think that the greatest gains are, automate all the day-to-day stuff so that you can then put your energy and your resources into data governance,

[00:17:28] so that you can then embrace AI to make your business faster, smarter, more efficient.

[00:17:35] Yours and mine align here, and I want to get your take on something as we sort of think about this opportunity.

[00:17:39] So if we think about the laggards, right, there's a bottom group that will probably always be laggards, right?

[00:17:43] Yeah.

[00:17:44] And then we have some top-tier both providers, MSPs, IT services, but also customers.

[00:17:50] They're top performers.

[00:17:52] They're going to lean in.

[00:17:53] They're going to run really fast, and they're going to do amazing things, and we're just along for the ride.

[00:17:58] It feels like that this moment where we're infusing more automation to then get to better data outcomes, better data analysis,

[00:18:07] particularly when I talk to the data people about what they're going to be able to do with all of this.

[00:18:11] It feels very exciting.

[00:18:13] Lots of downsides, too, but lots of opportunities.

[00:18:15] It feels like it's going to stretch things a lot.

[00:18:18] That if we think about normally we do a bell curve and we put most people on the top of a bell curve,

[00:18:22] it's probably going to stretch it so that the bell comes down and stretches out things where the leaders are far ahead,

[00:18:31] the laggards are far behind, but there's going to be a much wider gamut in the middle.

[00:18:37] That means that this is also an opportunity for a lot of people to get closer to the top end of the market by being dragged along.

[00:18:47] What's your take here?

[00:18:49] Is this a time to lean in and be good, or is this a time to be more cautious?

[00:18:55] How would you be thinking about this right now?

[00:18:57] That's a great question.

[00:18:58] I really like the way you framed that.

[00:19:01] You're probably familiar with Gartner's, the hype curve for new technology.

[00:19:06] Very much so.

[00:19:07] Talk about it all the time.

[00:19:07] And I feel like we are sliding down that slope from, what was it?

[00:19:14] The hype of inflated expectations.

[00:19:16] Peak of inflated expectations.

[00:19:17] Thank you.

[00:19:18] Sliding down the trough into the trough of disillusionment with AI.

[00:19:22] Because the reality is, you know, people who have bought certain AI tools are frustrated

[00:19:27] because they're not getting all the things that were, that was promised in some of the

[00:19:32] enterprise tooling.

[00:19:33] And then the consumer tooling, you know, just using Gemini or ChatGPT is extraordinarily useful

[00:19:39] because there's no shackles on it in the way there is with some of the enterprise tooling.

[00:19:43] So I feel like we're going through a sobering up moment with some of the expectations around

[00:19:50] AI, but for sure, the people who lean in and invest in and learn how to do AI are the ones

[00:19:57] who are going to come out the other side of this as leaders.

[00:20:01] It will take time.

[00:20:03] You know, somebody said to me recently, expect that AI will help you do the work that might

[00:20:07] not be quite at the level of an intern.

[00:20:10] But in a couple of years time, it probably will be at the level of somebody with a bachelor

[00:20:14] of school.

[00:20:15] And in five years time, it'll probably be the level of a master's degree or a PhD.

[00:20:18] And if that's your expectation and you lean in and you learn how to use it and, you know,

[00:20:23] make it part of your business, you will harness the benefits over time.

[00:20:28] That feels like a great place to leave it with that opportunity.

[00:20:31] Dennis O'Shea is the CEO of Mobile Mentor, an award-winning company specializing in endpoint

[00:20:35] security and workforce enablement.

[00:20:37] With extensive experience guiding organizations through the challenges of modern endpoint ecosystems,

[00:20:42] Dennis has become an authority on balancing productivity and security.

[00:20:46] Dennis, this has been great fun.

[00:20:47] Thanks for joining me today.

[00:20:48] Thank you, Dave.

[00:20:49] Been a pleasure.

[00:20:50] Appreciate it.

[00:20:53] The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines,

[00:20:58] posted at businessof.tech.

[00:21:00] If you like the content, please make sure to hit that like button and follow or subscribe.

[00:21:06] It's free and easy and the best way to support the show and help us grow.

[00:21:10] You can also check out our Patreon where you can join the Business of Tech community at patreon.com

[00:21:17] slash mspradio or buy our Why Do We Care merch at businessof.tech.

[00:21:23] Finally, if you're interested in advertising on this show, visit mspradio.com slash engage.

[00:21:30] Once again, thanks for listening to me.

[00:21:33] And I will talk to you again on our next episode of the Business of Tech.

[00:21:39] Part of the MSP Radio Network.