Larry Meador | The Real Threat Is Hiding in Your Clients' Data

[00:00:09] Hey everyone, welcome to the latest installment of MSP Business School. As always, I'm your host, Brian Doyle, and a familiar face is joining me today. He has been on MSP Business School in the past, although I don't know, Larry, if we've had you in your current role yet. I was wondering that myself. I know I've been here before, but I was like, who was I with at the time?

[00:00:32] Well, for those that are listening on the podcast, opposed to watching on YouTube, that voice you're hearing is Larry Meador of Covello, and he is joining us today to tell us all kinds of interesting things. Because anytime I talk to Larry, I always find it very interesting, both on a personally and professional level. That's just because I babble on, you know? I mean, I just kind of keep talking about anything and everything. But Brian, thank you so much, man. It's good to see you again.

[00:00:58] And I know we've up into each other on the road quite a bit, but always a pleasure to come on MSP Business School here and talk what's going on in the industry. So, you know, Larry, to kind of tee things up, I'm sure there's some listeners that aren't familiar with you or haven't run into you yet on the show circuit. Maybe tell them a little bit about your journey and how you wound up in the crazy world of MSP. Yeah, you know, I'm still trying to figure that out myself, even though it's been almost 25 years. We all are, aren't we?

[00:01:27] Yeah, I started this when I was a young man. And now I'm, you know, one of these OGs or whatever they call it, or a classic or something like that. But yeah, so I've been in the channel now coming up on 25 years. And boy, the time has flown. And, you know, people like to kid me, those that have known me for a long time. Since the pandemic, I've changed companies a few times. And it's always been, you know, a result of getting recruited elsewhere.

[00:01:57] But I think what people forget is I spent my first 17 years in this channel with an old company called CNET Content Solutions, which we had a platform called Channel Online that was a quoting e-commerce and procurement solution designed for VARs and for MSPs. And believe it or not, that platform still exists. They just, CNET got bought by Private Equity, and then Private Equity sold it to somebody else. So now they're a company called One World Sync.

[00:02:26] But they still have that Channel Online platform. I just saw some of my old buddies that I used to work with for many years. They were out at Channel Con, where you and I were a couple of weeks ago. But yeah, from CNET, I went on to join some friends of mine here in the Dallas area that was running a – they've got an MSP as well as a VoIP platform called Green Lake Networks.

[00:02:50] And right after that, I got introduced to or recruited over to Datastream Cyber Insurance. And I think that's where you and I first crossed paths. I think that's definitely where we first connected because that was probably right around the time we were just kicking off ECIO Toolbox. So we definitely probably crossed paths there. Yep, exactly. And then we crossed paths again, and then we crossed paths a third time because your next stop was – I think you kind of spearheaded us integrating. Yeah, absolutely. Absolutely.

[00:03:20] Because, yeah, Datastream back in those days, I was hired to be Channel Chief and introduce them to the channel and had a great time. They're still around as well. And then from there, I got recruited down to Infima Cybersecurity, which was a security awareness training platform that still exists. And then I started being an advisor for Covello. And then, yeah, almost two years ago now, joined Covello officially as their channel chief. And so that's where I am now.

[00:03:49] And I'm having an absolute blast. So it's, once again, a pleasure to be back here and I look forward to chatting with you. Yeah, I mean, the one thing that can be said, Larry, is that every spot you've been, you've made it better. And that's the important part of when you do find yourself changing some roles. Did I do right by the last piece? And certainly Infima was a great example of where we got to integrate with those folks, and we got that introduction through getting to know you.

[00:04:16] And, you know, those integrations are what help build the ecosystem. So it's, you know, definitely something that I think the industry recognizes, hence why you keep getting recruited. You got it. You got it. At least I hope so. All right. So, you know, we're here today at Covello, and obviously I think most listeners know Covello is really known for a lot around security, particularly around vulnerability.

[00:04:42] Maybe talk a little bit about what you're seeing out in the MSP space today, just overall. You know, what's the temperature? What's the culture you're seeing as you're at a lot of shows talking to people both, you know, at a regional and global level, as well as the customers that are directly, you know, engaging with Covello? You know, it's interesting times now. And you and I, who have been around for a little while, we've seen this before.

[00:05:06] You know, when we did back in the early 2000s, the transition from reseller to MSP, and then the cloud environment came in and all of that fun stuff. And, of course, now we got AI. But, you know, cybersecurity is an incredibly difficult and technical type thing that MSPs need to be offering.

[00:05:30] And if you're not offering cybersecurity, you know, I hate to say it, but I don't know how you're going to keep pace. Because, you know, this is really what is needed by your clients to make sure that they're protected. So, you know, a lot of times, you know, when we've been speaking at some of these conferences that we go to and stuff like that, we talk about the challenges that MSPs are facing. And it's not always just cybersecurity.

[00:05:57] It can be a challenge in and of itself because, obviously, like I said, it's still hard. But the constraint that we're seeing most MSPs pop up against is capacity. Being able to provide cybersecurity, you know, with the pace that things are changing, the demand is outpacing the capacity of the team and is bringing its own set of pressures.

[00:06:24] You know, as MSPs struggle to grow, they've got to bring on more clients. Well, when you bring on more clients, that means you're going to find more findings. You're going to have to do more follow-up. You're going to do all that good stuff. You're going to get more exposure because you're dealing with more clients who have more data. They've got more identities, more apps, all of that good stuff. And then, of course, we've got our friends, the insurers out there as well as auditors, and they want more proof.

[00:06:52] So, you know, there's a lot of things coming down on the MSPs that really demand their attention through having more capacity. And often, as you know, Brian, capacity is not a cheap thing for most of them to add because it usually means another headcount. And cybersecurity analyst-type positions are, number one, finding the right people. It's few and far between.

[00:07:21] And when you do find them, they ain't cheap. Nope. And, you know, everything that you just said there is so true and so consistent with what I hear when I'm talking to MSPs, you know, on the regular. It's just, you know, look, one, security is never going out of style. So if you're not addressing security, you've got a problem because, you know, you talked about all the other waves that you and I have seen over the years. The one common thread through all of them is how do you secure this?

[00:07:47] The difference is things are coming at us much faster than they ever have before. Then the second thing about capacity, you're spot on. You know, one of the things that I've seen interestingly come into our industry in the last five years that never took hold before that is actual MSP recruiting firms.

[00:08:05] And people actually paying the fee to bring that talent on now where, you know, 10 years ago, if you were trying to recruit in the MSP space, you know, it was almost like I don't need to pay you to find talent because we were really looking for techs. Now we need such specialized talent. It's becoming much harder to find those resources. You know, the good news is we don't have to find them in our own backyard as much anymore either, though. So it does expand at least the geography where we can hunt. Got it. You got it.

[00:08:33] It's kind of crazy out there. I'm not sure I want to be an MSP because it's kind of daunting. It's getting harder. And, you know, especially also with the kind of transition that's going on with the evolution of AI to more of a, you know, really more of an advisory consultancy type firm where you need to understand some of the business perspectives as much as you need to understand the technical perspectives.

[00:09:01] And certainly the pure play, you know, break, fix MSPs are just not going to find their way there, unfortunately. So I think there's going to be a wave of change behind us over the next few years. Yeah, I think you're right. I think you're right. It's certainly interesting times to be living through and see what the heck goes on with all of this because it's AI.

[00:09:25] AI, as you probably have seen yourself, AI can be absolutely fascinating with what it can do and how it can help you. It can also be scary as heck because, as we know, it's really reducing the time that we have to respond to the bad threat actors out there because they're using AI to go out there and find these vulnerabilities much faster than anybody could have ever imagined.

[00:09:56] I think that's the biggest thing. You know, we talked about some of the different waves, you know, the initial MSP wave, the cloud wave. You know, I go back to even when internet came online because, you know, even in the early 2000s, it was tough to get rid of it, right, in certain regions and certain areas. All of them had limiting factors for growth. AI doesn't feel like it has those constraints, you know. Correct. You know, cloud, it was I got to wait for my servers to age out. Internet was I got to wait until I get bandwidth at a price I can afford to bring the whole team in.

[00:10:25] You know, you look at these other things. Even MSP took a while. I still listen to people that said, oh, I've been in since the early days in 2011. And I'm like, I was buying monitoring in 2003. Yeah, exactly. But that's how long it really took to be accepted. And I think all these things are kind of stacking into the conversation of how much our industry is also maturing. Yes. That's probably a good, you know, that's a great thing for the end user.

[00:10:49] But it is also kind of weeding out, you know, the market a little bit from the MSP perspective. You know, you've got to be great now. You know, you have to be great. Yep, you're absolutely correct. And it's, you know, we're touching on so many different things that could be, you know, separate episodes in and of themselves. Oh, no doubt. But, you know, because this industry has matured a lot.

[00:11:16] It's an entirely different industry than it was 25 years ago. And I think that's why, you know, we're attracting more and more investors into this marketplace, taking a look at these MSPs. And you see these mergers and acquisitions going on. And, you know, sorry, I'm off on a tangent there. Kind of coming back to. I would say it's a realistic tangent and honestly one that, you know, has come up over the episodes here at MSP Business School.

[00:11:41] And it's good to see the perspectives also on, you know, for better, for good, being very consistent in this story, too, from the folks that we speak to. You know, everybody's seeing the same thing. Faster, you know, to some of them. Simply faster, scarier, need more, can't find as many people as we want to make more happen. Right. So it's always that do more with less that MSPs have always had to work with, but there's more exposure on the other side.

[00:12:06] You got a great segue into getting into, you know, where does a Covello fit in that security stack and how does it help people close the gap on some of those fears? Yeah, absolutely. And it's one of those things that you can't protect what you can't see. And what I mean by that is, look, MSPs have built fantastic tech stacks.

[00:12:35] And these tech stacks, you know, are designed to keep the bad threat actors out. But ultimately, you've got to think about what is it that you're trying to do? You're trying to reduce risk exposure for your clients. And what is it that the bad threat threat, geez, I can't talk today. Threat actors are after. They're not after the endpoint or anything like that. They're after sensitive data.

[00:13:03] And if you can't see or if you don't know where your client's sensitive data is and if you don't know who has access to that data, and I can guarantee you most of your clients don't know where their sensitive data is or they probably think they know where it is. But it's amazing when MSPs put some of the reports that Covello can do, put these in front of the clients.

[00:13:30] You know, it really is an eye-opener to them because they had no idea they had this much sensitive data. They had no idea how much it was worth. They had no idea how many people within the organization had access to it. So, in a nutshell, what Covello does is we give you visibility to that sensitive data. We've got a whole lot of stuff that we do under the hood from asset discovery. We go out there and we find where all the assets are.

[00:13:58] Then we can go out there and find where all the sensitive data is. So, that's PII, PHI, CUI for CMMC partners. We can go out there and we can find all of this data. We can show you where that data is. We can show you who's got access to it, who shouldn't have access to it. We can show you what they've been doing with that data. And then we also build in vulnerability management because we've got access to where all that data is.

[00:14:26] We're not giving you contextualized vulnerability management as well as configuration management. So, if you're using some of the different frameworks out there, you can set your policies and then track drift from those policies by different users, different things like that. So, like I said, we do a whole lot under the hood, but it's really revolving around showing you where the risk is,

[00:14:51] where the exposure is, and then also giving the MSP the ability to show not only to their client, but also to those darn auditors and insurers out there that we were talking about. Those guys all want to see reduction of risk over time. So, they're not now just asking, hey, do you have all these things installed? They want proof that you've got these things, and they want proof that you're reducing a client's risk exposure.

[00:15:21] And so, that's what Covello can provide. Well, you're seeing a lot of it, and there's a lot of discussion on the threads on LinkedIn and whatnot, too, that the evidence process is becoming much more difficult as you go through your audits. It used to be the screenshots of a point in time, and doing it over the course of a few different screenshots over the course of your audit period would be enough to satisfy. Now, things are being asked for in much more real-time with much more logging.

[00:15:48] And, you know, and obviously the auditors are getting better in the process, too, of, you know, knowing what to look for. So, it's, you know, it's a good thing, absolutely, for those that have PII housed in systems, but it's opening up a lot of different things that MSPs have never had to consider before, and going back to that capacity problem. If there's not a way to automate it, but automate it with governance, right? Because if nobody's looking at it, it doesn't matter if the reports are coming out. That's the challenge we're seeing. You got it.

[00:16:17] You got it. And, you know, I talk about visibility, and, you know, look, visibility really only creates value when it becomes action. And that's one of the things that we kind of help point out in the Covello platform is, you know, here's the visibility to where everything is, and here's the recommended remediation plan that you should follow to take care of reducing a client's risk exposure.

[00:16:43] And, you know, a lot of that right now is, it's still kind of manual. And, I mean, MSPs have been great at putting tools in place that have automated many of the things that go in behind this, from, like, discovering and finding assets and finding data identities and vulnerabilities and assessing all of this. You know, that's all been automated.

[00:17:06] But it's the analyzation and prioritization and correlating the signals, the context, and all of that stuff, and recommending those remediation plans, recommending those next actions. That's the stage in the game that has never really been able to be automated or be scaled. And that's where we're headed next with the Covello platform. We are obviously, you know, where everybody's using AI,

[00:17:35] but what we're doing is we have used AI to create a, basically the brain behind everything within Covello. And we call our AI assistant, or I shouldn't say assistant, she's actually our AI analyst. We call her Cora. Again, she's the brain behind here because what she's doing is she lives in the platform,

[00:17:58] she lives in your client's data, and she's got the ability to go take all of this telemetry from five core signals, you know, where the sensitive data is, what vulnerabilities are out there, who's got access to those, like we've talked about, the configurations, where the assets are, all of that. She's able to pull all of that together so that that step of analyzing and prioritizing

[00:18:25] can now actually be automated so that when your team comes in the morning, Cora's already gone through here and she's prepared a list saying, all right, here's the exposure for today. These are the things that you need to fix. Here's how to fix these things. And where we're going with this in 2027 is the ability for her to do automated remediation with guardrails.

[00:18:54] Obviously, you know, I talked to enough MSPs, a lot of MSPs don't want to do stuff like this without them having control over it. And we're going to absolutely make sure that the MSPs still have control over what remediation she could automatically take care of for you. So, yeah, it's going to be completely with guardrail. It'll have to be kind of like an approval workflow before they start the work potentially. You got it. Depending on the type of problem, like, you know, look, vulnerability scanning can pick up

[00:19:24] that you've got some CVs out there, but it's tied to like Adobe. And those are low risk, go fix kind of things, you know. You got it. Like I said, we kind of call it automation with guardrails. Your team's going to stay in control of what runs, when it runs, where it runs, how it runs, all of that. But, you know, the good thing is the autonomous investigation, that part of it we've already built. It's already being tested with some of our largest partners.

[00:19:49] And everything we're getting back from everybody is like, holy cow, this is absolutely fantastic. This is saving us so much time. This is literally like hiring that perfect analyst that works 24 by 7, who never gets sick, and who educates the rest of the staff. So we're having a lot of success with it so far. So we're really excited about where we're going. That's awesome. Yeah, I mean, that's where I'm seeing AI come into play in a very valuable sense for customers.

[00:20:19] It's really helping summarize a lot of the noise that comes out of systems like yours, mine, and others, right? And be able to get you focused on what really needs to be attended to in the moment. And, you know, that step of being able to automate that one step further with guardrails is obviously the progression. I think we're going to see not just, you know, in the world of Cabello, of course, but I think across a lot of the tools that are in customer stacks. And that can help with the capacity problem, you know, at least a little bit.

[00:20:48] Man, you just stole my thunder. That's what helps with the capacity problem. Just tells you I'm listening, Larry. There you go. There you go. See, at least one person in this channel listens to me every once in a while. No, I don't know what you do. We were talking even before we got on today a little bit about, you know, the thing that MSPs jump to. Sometimes they see a vulnerability for their best customer, and that becomes the biggest problem when in reality there's little exposure where other things can be having bigger exposure,

[00:21:17] but you just don't look at the customer with the same value prop. And, you know, this is where AI is kind of helping you sort that out a little bit going, hey, you might want to look over here. Yeah, and what it is, it's that context behind that. And, you know, like you said, I mean, that's fantastic. You know, you've got your big customer. You've got your small customer. You've got the same CVE. Most people are going to automatically say, yeah, I'm going to go take care of it for my big customer because obviously that's where my bread and butter comes from.

[00:21:44] But without the context of seeing that on the big customer, that CVE is sitting on this workstation that only has two people on it and has no sensitive data. But on your small customer, the same CVE is sitting on a server with over 500 records of PII, and half the company has access to this server, and it's touching the Internet. You know, that changes the game.

[00:22:07] That's the context that a lot of, you know, right now, so many of these tools that the MSPs have deployed all act in their own different silos, and they don't talk to each other. And that's the beauty about CVE is because we bring it all into one platform, and it's all encompassing and talking and all that good stuff. We're getting near the end of our time for today, and I want to make sure if there's anything else outstanding or anywhere that you're going to be with CVE that you want to share with the audience that you get a chance to do that.

[00:22:36] So I'll turn it over to you for any closing thoughts you might have. Yeah, I know. It's funny. It feels like just yesterday it was still 2026. I mean 2025. It is 2026. And now we're already in the fourth quarter of 2026.

[00:22:52] And so CVE is going to be at the Exchange NextGen event, which I believe, if I'm not mistaken, is October 18th through the 20th down in Orlando. So that is the next event that we've got going. And you just never know. Things pop up, and we get little offers coming our way all the time saying, hey, we've got an extra spot at this show or an extra spot on this panel.

[00:23:21] You guys want to come speak? So you never know, but we might pop up. But from a scheduled standpoint, it's the Exchange NextGen event in Orlando. Perfect. Perfect. And listener, as always, we're going to put Larry's LinkedIn profile as well as a link to Covello in our show notes both up on YouTube or anywhere that you get your podcast. Larry, I really want to thank you for joining me again. It's always fun to catch up. And, you know, I'm sure I'll see you at bare minimum probably down at IT Nation, right?

[00:23:48] So that's always a big party. Yep, exactly. Exactly. It's always good to talk with you next time. Appreciate you coming in today and sharing some insights, and it's great to hear kind of where Covello's going as well. Absolutely. Thank you so much, Brian. It's always good to see you, and hopefully we'll bump into each other at the bar somewhere and have a drink next time. Sounds great. All right, folks, take care, and we'll see you again next week. Thanks again.