MSP cybersecurity: Fixed budgets can't cover school needs — Bryan Lukralle, CharterTS

[00:00:01] Schools and nonprofits are some of the most attacked organizations in technology and some of the least funded to defend themselves. Bryan Lukralle is Chief Strategy Officer at Charter Technology Solutions, a Brooklyn MSP that built its whole business around those clients. We get into what a realistic security floor looks like for a charter school, what happens when the insurer demands controls the budget can't cover, and whether going vertical is a moat or a ceiling.

[00:00:30] This is the Business of Tech. Bryan Lukralle, you are the Chief Strategy Officer at Charter Technology Solutions, or CTS. Welcome to the Business of Tech. Bryan Lukralle Thank you for having me, Dave. Bryan Lukralle Well, I'm excited to talk to you. You've worked at three different MSPs, including one that was around 400 people when you left.

[00:00:50] I'd really like to get a sense for you, like, what did the scale of a 400-person org teach you that you still use at CTS, and what did you deliberately leave behind? Bryan Lukralle Oh, what I learned a lot is about very quick scale and integrating lots of companies with different tools. And when I came to CTS, we are focused on charter schools and not-for-profits, and so it was a very different set of verticals.

[00:01:19] Bryan Lukralle So, a lot of positives came from my past experience because I had been exposed to a lot of technology that the people at CTS had not. But I had to meld that with the fact that CTS works in a very, again, specific vertical with different technologies that I didn't get exposed to, like a lot of Google Workspace, which never had to deal with, really, even at that size of an organization.

[00:01:40] So, we had to – a lot of the off-the-shelf things that I would have just said, let's just do these three things and they'll work, did not work, and we had to adjust. So, a lot of lessons learned. Bryan Lukralle Well, tell me a little bit about that. So, CTS is named for its first client, right, a charter school, and it still builds around that K-12 nonprofits and mission-driven orgs. So, I would think that there are operational and financial trade-offs that that specialization creates for the MSP.

[00:02:09] So, I'm really curious, like, what are those and how do you manage those? Bryan Lukralle Our starting point is an MSP. We want to provide the monthly support. We do manage IT. We do cybersecurity. But a very large part of our business is projects. And I know a lot of my peers in the space are seeing project work start to slow because of work from home. No one has on-prem servers anymore. We don't see that.

[00:02:35] We have a very heavy project season, mostly wrapped around the summer because schools tend to build, especially charter schools. They're constantly trying to grow their networks. So, every year we do 15 to 20 new schools in the summer. And that is a major operational challenge because how do you staff for four months of work over 12 months and not have a million contractors? So, every year we get a little bit better at it.

[00:03:04] And then the fact that charter schools have very fixed budgets and the nonprofits we work with as well have very fixed budgets. So, when an unexpected expense hits them, they don't have the ability to just pull money out of a rainy day fund. So, we have to do a lot of value engineering. And we've gotten really good at that. And that's allowed us to keep our charter schools. Most of the schools that we started with 10, 15 years ago are still with us because there isn't a better option than us, frankly.

[00:03:33] Well, I appreciate the confidence there. And give me a little bit more insight into that. So, you've talked a little bit about the summer cycles. So, how does that factor in to the way you staff and deliver? Like, are you kind of swirling away resources to cover the rest? Tell me a little bit more about how that works in practice. The way that we ramp up is there's a lull from November through about February where there's not a lot of net new work coming.

[00:04:01] But there's a lot of preparation happening. So, there's a lot of scoping. There's an E-rate proposal cycle that happens every year with U.S. schools. And so, as we get to April, there is a process by which we are hiring up for different types of roles. Project engineering, like really hardcore network engineering. Those guys, when you hire contractors, they tend to not be as good.

[00:04:27] So, we tend to slide people from the architecture side over to the implementation side. So, you get guys that design the project, then they implement the project. It's a nice cycle. And then they kind of go back after the summer into scoping again. That helps on that side. We do a tremendous amount of student devices. So, Chromebooks mostly and some iPads. And so, we have an intern program that runs every year, mostly out of internal.

[00:04:55] There's like a couple organizations in New York City that have people that are retraining into being in technology. They tend to be people that don't have college degrees, but they're really eager. And so, this year we had, I think, 15 or 16. They go through a process in May into June. And then they are literally imaging and QAing Chromebooks for two straight months, like assembly line style, in our office in Brooklyn and at our client sites. And so, they're all paid interns.

[00:05:23] And the great thing about that whole process is that every year we usually graduate at least two or three people to be full-time employees. They join us in the field. And so, we've been able to make the financial model work because we do ramp up our payroll in the summer. But it's when we recognize most of the non-recurring revenue. And so, it's lined up well. And then the MRR is consistent through the year. It does jump in the summer because when we get a new school, they tend to want to join when their fiscal starts in July. So, it hits then.

[00:05:52] But the models worked well. This year we're going to be north of $30 million, which is really crazy that we've gotten to that point. And I think it was $20 million when I joined three years ago. So, it's pretty neat. Well, congratulations on the success. Thank you. Now, what I wanted to get that into as well is I would think security is an issue, right? K-12 schools are a top ransomware target. And, of course, they've got thin budgets, little to no internal staff.

[00:06:20] I mean, it's exactly the conflict we talk about so much in small business, but almost the worst version of it. So, what security posture is actually reachable? Not the ideal, but what's the realistic one that you actually can get a school to? That was the major adjustment for me coming from a commercial-focused MSP is that we would come in and do QBRs and have very high bars we wanted to set for clients.

[00:06:48] And we're constantly pushing them with red, yellow, green. You have too much red. Keep getting to green. And coming here, we were starting with just getting schools to turn on MFA and Google. It's still a push. So, we adjusted our expectations and we changed how we presented. And we focused on is there any compliance standard that will force a school to think more critically about it, not just I had a breach now I'm going to do something.

[00:07:16] And in New York State specifically, and there are some in other states, there are regulations of sorts. They're not enforced in a fine-based manner, but they're enforced in a you-don't-want-to-end-up-in-the-news type manner. And so, we used that as the starting point and we built the assessment around that based on here are the things that you need to be doing as bare minimums. You should have security awareness training. You need to have MFA.

[00:07:46] You should have some kind of advanced email security because your teachers are more likely to click on things because they're not on their computer all day. They're teaching and then they're going back to their computer to read emails from parents. They're not going to think before they click something. So, like, we focused on a set of three or four things and then we packaged that. And this was within a month of me starting. I got very aggressively, very aggressive in the negotiation process with a couple vendors. And I was like, you have to make this work for schools.

[00:08:16] I know your model is that you want to bill for every single user in the tenant. You can't do that. There are students in the tenant. You have to. And I found three of the four that needed to make bend how they worked were able to bend because I said, this is what I have available. There's 5,000 plus users that all want to do it. And we came to a happy medium. All of those companies that we're working with, we're still working with today. And so we started three years ago with a set of like five clients.

[00:08:43] And now we have 50 of the 100 that are doing cybersecurity. And so it's a lift every year. All the big ones are doing it, thank goodness, because they're the ones that have the biggest exposure. But it is still doing cybersecurity on a nonprofit budget is difficult for them and for us to make happen. Well, I want to hear what's in it. So because you've assembled an affordable tool stack that CTS says aligns clients to the NIST cybersecurity framework. Now, that's a challenge, right?

[00:09:12] And alignment isn't necessarily perfect compliance. Tell me what you've put in it. And what did you have to leave out in order to hit the price point you wanted to? Sure. So the primary piece is MDR. And so MDR that covers the network side, the endpoint and the cloud. That was a lot of work because initially most of the products I was looking at were just focused on the endpoint. And I was like, I need to cover the cloud side because from an identity perspective, that's how most of these schools are getting hit.

[00:09:42] It's email compromises. So that's the biggest component. There's an email security component that is basically, you know, banners and protection against malware coming through. So security awareness training and then cloud backup because that's another piece that comes up through cyber insurance and other things. So we package it as a per user. And it's basically an add on to our existing support that we do for clients, which is typically per user. So it's a pretty easy thing to sell.

[00:10:11] And yes, it's kind of it. So how do you balance the insurance side of things? Because I assume there's going to be parts of what a client does and they can't afford all of the controls that the insurer may require. Like, how are you balancing that? We are explaining that you. If you make the right investments when it comes to your cybersecurity, there are opportunities to reduce your premiums and to get better coverage.

[00:10:38] And we've helped facilitate conversations with carriers and through agents for that thing. But there are a number of situations where clients just decide to get the cheapest thing. And we provide, you know, not even waivers. We just let them know that you should try the next year that you have budget to do more. That's the most that we can do, right? It's not about forcing them out the door. Our MSAs say you need to have cyber insurance. You have to have a certain liability and premium. And we know that there's some that still don't meet it.

[00:11:07] We don't kick them out the door. It usually comes up after they get breached and they say, I can't pay for IR. And then we try to figure out a way to make it work. So we've tried to build value engineer solutions that will work within that tight budget. But it's not it doesn't always fit. We'll be right back after this message. Every MSP I talk to has the same problem. They've got AI. What they don't have is a way to charge for it. Pax 8 calls the fix managed intelligence.

[00:11:37] Selling outcomes customers want to pay for, not just one-off tools. The Pax 8 marketplace is where you build it. Stop reselling software. Start running intelligence. 47,000 MSPs already made the move. Start yours at pax8.com. That's P-A-X, the number eight, dot com. And we're back.

[00:12:02] Now, I want to ask a little bit more about MFA, which you already mentioned is a struggle with teachers. Right. And I see all the time that the conversations around MFA rollouts for both frontline and school staff really fail around leadership and training, not the technology. So how do you get a principal or an executive director to really own that mandate? Like, walk me through and how that works best.

[00:12:27] It's been pretty easy, actually, more recently because there have been so many breaches. So it's pretty much every school has had some kind of light breach through MFA without having MFA that you can explain the benefit. And then typically it's below the executive director level that it's a director of operations who has kind of tentacles into all parts of the organization.

[00:12:51] And the benefit on the Google side is that it's it's a you turn the button on and it'll wait for a certain number of days and everyone has to get it done. And if the certain number of days passes, you just get locked out. So people are, you know, the help desk gets hit a little bit, but then we're past it and it's enforced. We haven't had a lot of problems with getting engaged. It's about getting the initial approval.

[00:13:13] Sometimes a little scary because the leadership people maybe are not the people that even they don't want to do it to begin with because they think it's going to be a burden for the teachers. But once they see something bad happen and they see the risk, they tend to bend. And then students, we keep out of it because there still is not a good solution in the channel or anywhere, frankly, for student security. And it's a struggle for us and everyone else in the industry.

[00:13:39] We have not found a good way to protect student accounts because they don't carry cell phones with them. Some of these kids are pre-K. Hey, if someone can come up with a really good idea to solve for student security, they'd be rich probably. Well, so tell me a little bit more about that student security problem. And mostly just from the what in your mind is somebody who lives and breathes this? What are the requirements to be able to do it? Not the solution, but you would understand what the need is better than anybody.

[00:14:09] The challenge and solution is going to come down to something physical that a kid can have on them. There are somewhat bridge solutions that exist, like clever badges is an example, badges where they are scanning it. But people haven't really figured out how to have fully replaced passwords. MSPs really talk about uptime, ticket times, SLA compliance. But I found really interesting is you've written that the right provider should make ownership visible.

[00:14:38] I thought that was a really interesting positioning. And how do you know a client is actually better off because of CTS? And what does that measurement look like internally? Our structure internally, our client managers manage eight to 10 clients total because it is a very high touch environment. You're talking to your POCs all the time because there are one. One, there are constant needs around peripherals and devices. And there's just like a lot of transactions.

[00:15:04] And then they don't understand technology very well. And it is a very hectic environment. So we are constantly getting feedback around the quality of our service. If there are delays, if there's something that is reoccurring. There is there is so much activity inside of CTS because of the way the schools work. It's actually a challenge because our we do have a growing commercial and nonprofit segment that work very differently.

[00:15:31] We've actually made adjustments internally recently where we have client managers now that are dedicated to working with not the schools. And then the schools like building a little bit more business separation because the motions are so different. And even like the QBRs, you can't have quarterly meetings with schools. They meet twice. They want to meet twice a year. They want to meet in budget season in the fall. And they want to meet in the spring to figure out, are they ready for the summer and all the things that are going to happen when they change over everyone? So that that has been how we you know, we don't focus as much.

[00:16:01] We do have SLAs. We use ConnectWise and we stare at the right cage dashboards all day like everyone else does. But when our clients come back to us, it's not about response times on tickets necessarily. It's really about not letting things linger. Resolution times are the most important things for us because they don't have time in between classes to talk to us. They just want the problems to go away. We see all the headlines about students using AI and teachers using AI. This feels like an interesting space.

[00:16:27] And you wrote last September about the AI governance gap in not-for-profits and the way MSPs can play a role in here. So walk me through like the actual harms you're seeing when there isn't AI governance going on and what you're doing to address those. Honestly, the last two months has been a lot of clients that are just hooking up things like Claude and ChatGPT to their shared files. And in their mind, it's their own staff accessing their own files.

[00:16:56] What's the problem? The biggest issue that we've seen is that more often than not, AI doesn't recognize that if someone has set up poor permissions inside of their files and given access to things that are 20 subfolders down, that's not exposed when you give people access to just SharePoint because you'd have to dig so much to find it. But if you just say, find me that HR file, it's going to find it.

[00:17:21] So there's a lot of work around permissioning and access control that larger not-for-profits and schools are not thinking about because they're just like, no one's going to find that file. AI is going to find that file. And so we've had situations where things get exposed and then the question is, okay, what can we do to fix it? We want to start with every client with having an AI acceptable usage policy.

[00:17:47] Just having at least just a starting point that you share with your staff and then starting to build a structured assessment of what are you trying to attempt? What do you want to accomplish? And what is your actual budget based on the cost now? We don't know a year from now whether all of these per-user models are being token-based and then everything's going to be too expensive anyway. But as of right now, it's very usable in both a Microsoft and a Google environment.

[00:18:14] I'm getting into a situation myself where anytime I evaluate a product, I'm like, should I buy this and spend another $1,000 a month in our tools budget? Or should I just make it the way I want it to be for CTS? And because we have this whole Google education bend, anything we get off the shelf is going to be built more for commercial Windows environments, not for Macs, not for Google.

[00:18:38] And so it's like it's almost worth a little bit of extra effort for us to have it built for how we work, build it so it matches my internal processes. I just don't know how we support that, though. That's the thing that we've been talking about a lot right now as we go into our yearly retreat. Like, how do we staff to support clients building their own vibe-coded applications and their developers are teachers or administrators? It's a brave new world.

[00:19:06] We'll be right back after this message. This episode is supported by Mail Protector. One of the things I keep hearing from MSPs is that they want email security from a vendor focused on MSPs, not a relationship where you're wondering what the roadmap looks like after the next acquisition or you fall behind enterprise clients. Mail Protector is independent, partner-aligned, and to reduce the ticket friction that eats up their day.

[00:19:33] In a market where trust matters more than ever, that's a real differentiator. Visit MailProtector.com to learn more. So I want to separate out my follow-ups in kind of two buckets. Okay, sure. And I'm going to put aside for a moment the customer zero portion. Like, what are you doing internally? And I want to talk about a little bit of the, like, what are we doing on the client side? Because in particular, you talked about a couple of things that you're doing. Acceptable use policies, like doing inventory. Are those services you sell distinctly?

[00:20:03] Are they conversations you're giving away? Is it rolling? Like, how are you approaching it commercially with your school clients to have those conversations? Our hope would be that we have a commercial offering when we come into January. Right now, we're giving it away. We, at first, we were trying to see where the market was going and if there was going to be off-the-shelf products that could help us with some of the R&D we need to do to build, like, a true program. I'm starting to see some things come to fruition.

[00:20:32] There's some products that I'm demoing right now that are very interesting in the channel. We haven't signed for anything yet. But my hope is that we're either going to sign for something that will help us with having that kind of productized approach. Because until then, it's a lot of giving stuff away. Some of it we've been able to sell as billable engagements to do AI readiness. But it's not as structured as I'd like it to be. And now we have enough of a groundswell of clients asking that I almost feel a little bit behind.

[00:21:02] So we're trying to catch up as best we can. So then let's do the customer zero portion. Like, how much of that is implement your own governance policies? Like, how are you managing that internally at CTS? Well, I mean, we went through SOC 2, Type 1 earlier this year, which didn't expose the AI side as much. And now as we prepare for Type 2, we put in place our own AI governance policy. We set up our own structure around.

[00:21:29] We gave certain staff access to specific LLMs. And then others we gave access to a more general HATS-like situation. And that's worked out decently. But again, I think every organization is struggling with knowing what people are using, should be using. I've noticed now we have some AI detection tools through our MDR solution. And I looked last week and there's 30 people using ChatGPT. And it's not authorized.

[00:21:59] So, I mean, if we're having that issue and we have all tech people, all very compliant, what does that mean for a normal, you know, one of our clients? I'm sure it's 10 times worse. So, you also talked a little bit about the idea of coding up your own piece. I'm hearing this from many MSPs. You've got to have a way that you're starting to judge that, knowing that it's not fully baked. Give me a little bit of the way that you're looking at that, you know,

[00:22:26] how that build versus buy is getting redefined for you. I think some of it has come down to when vibe coding as a term became kind of part of the ethos and technology companies and any companies like a year, year and a half ago. So, it was used as a term to denigrate like this is vibe coded.

[00:22:49] It's it's it's this is not going to stand up to any level of of people on it. And for us, we started with some ideas in the summer. We've been developing internally at CTS for a number of years for different internal apps that were something didn't exist on the market, especially around Google. And for us, it's it's a measurement against it's not even about the cost of the solutions, but we use a number of point products as an MSP.

[00:23:17] I started with client strategy and client management, and I looked at what we use today. And again, without a lot of development experience, I have none. It was mostly me prompting over the course of a couple weekends. And I had something I was like, oh, this is interesting. And I put it in front of a couple people. I was like, they're like, this is better than what we have. How do we expand upon this? And then I have internal developers. So then we firmed it up a little bit more. And now it is a conversation as I'm going into budget season.

[00:23:45] I'm looking at all of the things that we buy right now, which are web based platforms that do things connecting to back to connect wise. I'm like, is that makes sense for me to be paying X amount where this thing that I stood up two months ago has been solid. It hasn't gone down. We have very few bugs and people can say to me, hey, can you change this thing and make it do this? And it's an hour and it's doing that versus putting in a feature request and waiting for it to hit the roadmap. So it's very appealing.

[00:24:15] But there's some fear that we have internally that we don't know about the bug that hasn't come yet. So the hope is that we're at a point where the elements have gotten good enough that that won't be coming. And this isn't client exposed. So there's less risk there. So we're feeling through it. I'm not ready to make the big LinkedIn post and say I've created the product that puts three others out of business.

[00:24:36] But I have friends in the industry, three or four guys that I've worked with that last couple of places that are all they all have side projects where they're building SaaS apps for MSPs for different unique things. Everyone thinks that they can be developers now. And this is just the people I know. And I'm sure there's a lot of people who are working their nine to five. And then they're going home and saying, I'm going to make a better PSA, a better RMM, a better network monitoring tool. And they're going to start springing up everywhere.

[00:25:03] And it's going to be interesting to see how it affects the channel because there's obviously a close knit like how you develop software and bring it to market is established. These people don't have teams. They have AI bots that are just posting things on LinkedIn and on Reddit. Bryan, this has been really interesting. If people are interested in continuing the conversation, talking to you and learning more about CTS, what's the best way to reach out? Through our website, charterts.com. We have contact us pages, but I'm also on LinkedIn.

[00:25:29] And I'm happy to speak to anyone that is interested in the space and in schools and MSPs in general. Awesome. Brian, thanks so much for joining me today. Thanks, Dave. The hardest part of running an MSP? Doing it alone. The Small Biz Thoughts community has been the room where independent operators compare notes for nearly 20 years. Real peers, real numbers, real answers from people running businesses just like yours.

[00:25:58] Pull up a chair at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage. The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode. Produced by Picture This Video.

[00:26:29] Part of the MSP Radio Network.