Eltjo Hofstee - Unraveling the MSP to MIP journey

Welcome back to Partnerships Unraveled, the podcast where we dive deep into the mysteries and secrets of partnerships and the channel. My name is Michel, I'm head of marketing at Chanix, and I'll be your host for today. And I'm excited to sit down with Elcho Hostet, Global Sales Director at Easy D Mark. Elcho, how are you?

Yeah, thanks for having me in the in the podcast. Really uh really enjoy that. Absolutely. Yeah, no, I'm looking forward to this one.

And uh we were just discussing uh RSA and CloudFest. I think you were at CloudFest, I was at RSA, but at least I saw a lot of uh Easy D MARC polos, uh so you're gaining some notoriety in this field. Definitely. No, and we we're trying to attend uh a lot of these kind of uh events, and both CloudFest and RSA are important uh events for us, so that's why we decided, although it was this year in the same week, to do both.

Yeah, they should think about that a little bit better, I think, for the next time because I know that my flight to RSA was filled with 100% cybersecurity people from the Netherlands. Anyway, it's uh it's something to take a look at next year. But uh really great to have you here with us. Could you give us a quick introduction about yourself, your business?

Yes, so uh my name, as you mentioned, is Elcher Hofste, based in the Netherlands, close to Amsterdam. Um, and uh I work now for EZD Mark for almost uh four years, a bit less. And when when I had the first discussions with uh EZD Mark, have from day one the goal was to build a scalable sales organization. Once I got a little bit more information about the company, I noticed that we had a very strong product market fit.

We just had to scale up marketing and sales, so that was the request to me. So quite soon after I joined, we started with an SDR team qualifying leads, we started with a customer success team, and um quite soon after we also started with an MSP channel, and uh yeah, that's also a big part of uh today's discussion, I think. Yeah, absolutely. No, I think what I keep hearing from everyone I talk to is that scaling is partnerships.

It's the only way to scale these types of solutions. So let's kick off the conversation with a good hard look at these MSPs. So when you when you look at the MSP landscape, many MSPs still measure their value in terms of uptime, SLA, service delivery, things like that. And as the market shifts, I'm hearing more and more that this model is kind of going the way of the dinosaur.

It's it's disappearing slowly. Um, do you agree? And where do you think this model is going? Yes, I definitely agree.

And uh before I answer your full question, and maybe it's good for the audience to explain a little bit what ECD Mark is doing. ECD Mark is offering an outbound email security solution, which basically means that we are protecting emails that are sent from your domain, and we help MSPs to uh to offer a solution to the end users to protect the domain. But, and here comes part of the answer, uh we also help them in how to offer this to their customers. So, how to find customers, how to sell it.

But not only a DMARC solution, uh we have several solutions that really help them finding new customers, and we strongly believe that that's the kind of model that the MSP world is heading towards as well. So more results-driven and less in terms of things like uptime, SLAs, whatever. Because it's nice that the email server has 100% uptime, but if all emails end up in the spam folder, the end customer still doesn't get a real solution. SLA is mad, the customer is still unhappy.

And I think that's the real value of an MSP to not only help the customer in telling him, hey, your email server is always up, to just give that example, uh, but to really help how can I help your marketing and sales in sending out the right emails and making sure that they end up in the inbox. It's funny that you say this because though I I would almost classify uptime and SLAs in this context as vanity metrics. And as a marketer, I hear this quite a lot, and I've been involved with these as well, and I never forget I once had a CEO who said to me, uh, we need more leads.

And I said, What does that mean? Because leads aren't opportunities, opportunities aren't closed one. Like, what are you actually looking for? He said, No, no, no.

I committed to the board, 6,000 leads this quarter. And I said, But but the volume really isn't the problem, it's the conversion quality. And he said, No, no, no, I want 6,000 leads. So what I did is I I went into our analytics dashboard and I clicked on accept non-corporate email addresses.

Bam, I had 6,000 leads within a week. You didn't help him. I didn't help him, they meant nothing. And I think that the reality of what we're looking to achieve, like you mentioned, outcomes driven, is so much more valuable to all of us because it requires a mindset shift, obviously.

It requires us to be a little bit more honest with each other, but at the end of the day, that means better results and easier measurability. So I I think that's a really nice kind of path forward. Fully agree. And I now gave the example of of email because I'm in the email space, but this is actually applicable to every uh to everything, you know.

Uh if you're an MSSP and you're only concerned about security, why do you uh give an uptime of a firewall or a security solution? Why don't you say, hey, uh you pay me based on the real security that you that you receive? Yeah, what's your firewall blocking, yeah. Yeah, well, yeah, indeed.

So um I think that's a way better way of uh offering it than just in terms terminology of uh SLAs and service delivery. Yeah, I fully agree. And and this lines up with uh something that stuck out to me during our prep call. Um you think that MSPs are evolving into MIPs, and MIP is not just the acronym for my favorite Rose, but an acronym for managed intelligence providers.

Now, what does that shift actually look like and what new expectations does it create for partners? Yeah, well, um very much what what we just discussed. The terminology, at least I heard it for the first time uh from PEX8, one of the marketplaces that we use to sell uh to our MSPs. And um they are a very strong advocate of the idea that MSPs have to move into managed intelligence providers.

It's a concept that has uh several uh ideas basically. One of the things is that it should be more result-driven, what we just discussed, but that also means that the MSP, or the managed intelligence provider of the future, should have more data and more understanding of what is really a value driver for the business. Because only then he can really help him. So that's why they call it a managed uh intelligence provider, and I very much support that idea, because if you have more data of your customer, and normally you do have that as an MSP, you can really come proactively to the end user and say, Hey, we constantly see that um your emails are going to to the spam folder, or maybe even a step further, you can even say, Well, based on the data that we have from you, we can see that the amount of leads is less converting than two years ago.

What's the problem? And we have an idea already what the problem is. Maybe your emails are going into the spam folder. Just eh?

So that way you become, then that's where the terminology comes from. That that way you become a managed intelligence provider because you sit on a as an MSP, you really sit on a a big bunch of data, and you can leverage that to really help your uh uh MSP a step further. Yeah, no, I I think that makes total sense, and it also aligns with the actual normal colloquial definition of what a partner even is, right? A partner is not a one-way street, a partnership is a relationship, and I think this fits so nicely into that into that paradigm, and it's because if we have that data, why not share it and basically become better together?

I'd uh I'd I fully agree. And you know, when we started the MSP proposition for Easy DMARC, in the beginning we were very much focused on offering uh D a DMARC solution to the to the uh managed service providers, and of course we're still doing that, but in the meantime we really shifted away from that because it's way more important that they have a partner that not only just offers them a DMARC solution, they get so many solutions offered, you know. You you can't really stand out from the competition that way.

No, it's important that they have a uh a partner that also helps them in how to sell DMARC and how to sell other services as well, and where to find the right leads. And we've built a full program around that, and that goes way further, in my opinion, than just another DMARC vendor. I completely agree, and I think this segues very nicely into another topic that's really interesting here, and that is email in general. Um, email is obviously treated as basic infrastructure, but I think that's only because it's so incredibly common to our daily lives we barely even think about it anymore.

But in reality, being so common means that it requires really high degrees of security, trust, communication, performance. What lessons are you learning from being in the email space when it's when it comes to where MSPs are are heading? What we really see, and uh that's also uh if every email that an end user sends out when DMAC is set up uh generates an XML report, and we receive all those reports. And what we can really see is that um MSPs are setting up more and more domains, and therefore they get more and more insights basically in what the the customer their end user is doing with email, and in many cases they find new sources.

For example, the end user himself even didn't know that marketing is using a certain SaaS tool, so they get way better visibility over the email infrastructure. DMARC wasn't meant that way, basically, it was really to secure email, but we now see that IT departments and MSPs get much better visibility over what is actually really the real email infrastructure of their end user, and because they have so much better insight, they can way better advise the end user in what to do.

One of the things you said really, really stuck with me at the beginning of this conversation that you're talking about how Easy D Mart focuses on outbound email protection. Um and it's something that seems so logical when you say it, but I'd personally never really thought about that before. Um, I think that a lot of smaller companies will probably have a similar perspective, right? They might assume that they're too small or too obscure uh to be impersonated.

In psychology, I think this is called the normalcy bias. When people basically think, uh, why would anything bad happen to me? Like I'm not special. Do you have any anecdotes or experiences that tell a different story?

Yeah, actually, uh two things here. Uh almost every customer or end user that we help uh online with with DMARC, uh the moment that they that they set everything up, they realize, oh, I'm actually constantly being impersonated. Everybody says I'm too small and whatever. The bigger ones don't say that, but a lot of small end users think I'm just a bakery or something really not so much focused on on the internet on the internet business.

But um once they set up DMARC, they suddenly see the real threats, and that's always a lot more than uh you think uh you have. And another nice example when I joined uh Easy DMARC at that time was still relatively a small company, and we had constantly people trying to impersonate also our address. Yeah, we were protected by DMARC, so uh it wasn't. You drink your own champagne.

But we definitely drink our own champagne, and uh but we could already see how many threats our domain uh received. So uh yeah, I think that's a good example. Yeah, no, I I love it. I think that normalcy bias really plays a part here, right?

Because if you think about it, normal people they they win the lottery every day. So there's no reason why bad luck wouldn't operate in the same way. And just from my perspective, and please correct me if I'm wrong, I think smaller companies might even be easier to target because they're less prone to have controls in place, they might have a higher degree of trust with their suppliers or buyers. Um and you mainly hear about the large uh attacks with Jaguar Land Rover in the UK or Odido in in the Netherlands.

Um sorry for mainly European uh examples, but those are the ones that you hear a lot about in the in the news. But uh small companies are constantly under attack as well. You just don't hear it so much in the news. Yeah, and I think that that's really also a mindset shift, right?

That cybersecurity is something that that everybody needs. And I think a lot of again, a lot of companies might not think that they're big enough or important enough or interesting enough uh to be cyber attacked, but they are, you know, ransomware as well. That happens to small companies, right? Because it's actually much easier to get them to pay up.

It's much easier. Maybe you can't ask the millions that you can ask at a big company, but if you do ten times a small company, you also have several millions, probably. So uh no, that definitely happens, and we see it on a day-to-day base that the moment that people set up uh a domain with DMARC, uh they see how many times there uh someone is trying to impersonate their domain. Yeah, does that scare them?

Yes, not normally people are in shock about it, yes. Yeah. I can imagine. I think it's uh similar to the first time you get one of those messages with like your your password has been found in 1200 hacks, right?

That kind of stuff. Uh thank God for uh multi-factor authentication and pass keys, right? Yes, thank God for that. And uh I also don't like the fact that uh that maybe someone else might have my passport details.

Yeah, I'm pretty sure someone has, and that doesn't feel secure. Yeah. Yeah, to be fair, maybe I should stop using password one, two, three, four, but uh, you know, we'll talk about that. You're using that as well.

I always use welcome zero one. That's my biggest. That also works. Yeah, it works very well.

Yes. Hey, talking a little bit about Easy DMark's solution, right? I think there's a there's a an interesting challenge for any vendor with a reasonably priced but high functioning product. Um, if it works quietly in the background, it can be pretty easy to overlook.

I actually recently talked to a multi-billion dollar cybersecurity firm about exactly this, but then in the context of protecting their brand awareness when their product is often white-labeled by their partners. So for Easy DMARC, how do you stay relevant and top of mind with your partners over time? Yeah, very good question. And actually, I get this question quite often.

Um and um we we basically have two phases. Um, once uh a customer starts using us or directly or through the MSP, um, first you need to move him to a protected mode. That takes some time, you need to gather data, whatever. So there our platform really helps to move the customer as quick as possible to the secure mode.

But once you're in that stage, you still want to receive alerts. If you suddenly the amount of impersonation goes up, you definitely want to hear that there's a threat going on. Because in many cases that can be an indicator that there are also other threats going on, and that could be an early warning system. Um, second of all, a lot of our MSPs have now integrated the data that they receive from uh a DMARC, the DMARC information data they receive uh through us, uh they have integrated that with something uh like uh Microsoft Sentinel or Splunk.

So they gather that data into everything into a broader uh to get a broader view of of the security level of of a specific end user. So even after you you you move to re reject policy, you still need alerting, you still need to get visibility who's trying to impersonate you, and you also want to have that visibility. Maybe marketing is suddenly using a new SaaS tool and sending out uh emails with a different tool or whatever, and then you want to be the early uh warning system basically as an MSP that you can go to your end user and say, Hey, are you realizing that we see that you from now on you're using a different tool, that those emails will never get into the inbox because they're all rejected because the source isn't uh set up correctly.

So as an MSP, you definitely want that proactive mode, I would say, to watch your end user. And to do that, you you yeah you basically need constant monitoring and alerting to be able to advise your customer in the right way. Yeah, I think that makes total sense. And I realize that there's one thing we haven't talked about yet.

And seeing as you were at CloudFest and I was at uh RSA this year, we probably saw one word uh or actually two letters more often than any other word. Uh AI came up more than cybersecurity trust or whatever. I saw it was actually hilarious driving into San Francisco that every billboard had the word AI on it. So I just want to ask, especially when it comes to this kind of stuff, threat detection, is there anything specific that uh Easy DMark is doing with uh AI at the moment that's really uh moving the needle?

Yes, quite a few things actually. Uh from a pure technical uh point of view, uh you can say that uh all non-DMARC compliant emails are one bucket, but with smart AI, we basically detect, hey, this is a legitimate source and this is really someone impersonating you. And that makes a huge difference because we can categorize them differently. It makes a huge difference in how quickly you can set up uh DMARC using our platform, but we also use it a lot in in sales, uh we use it a lot in marketing, uh in our support.

So uh yes, we are heavily using AI already. Yes. Yeah, I think especially in this space, it's incredibly valuable. Um I wonder, just being a bit of a nihilist, when the AI models are gonna start clashing with each other, like inbound and outbound.

Um I I heard a company at RSA say that they basically said they block everything. That's their USB. We don't care if it's good or bad, we block everything and we figure it out later. Um and I think that's really interesting to see how this kind of stuff will work when unbound and inbound start to kind of mesh together when it comes to AI models.

Uh, but that's a conversation for uh, I think maybe our second podcast. Uh definitely. And and let's be honest, um, if you see how many emails you nowadays receive that are clearly written with AI, and they try to sort of make it personal, but it does still feel a bit artificial. Yeah.

Artificial intelligence. But uh yeah, you can clearly see that we're getting there, but we're we're not there yet as uh as society, I would say. Yeah. No, I think that's a great point.

It's so nuanced, right? And and I I experienced the same with uh you can probably talk to this uh even much better than I can about sales methodologies. When you look at something like uh challenger sale, right, or solution selling, it's a very logical way of structuring a conversation with a with a potential uh client. But if you start to use it very literally, it becomes incredibly transparent.

And and I recently had someone um on a sales call, they they cold called me and they were having this conversation, and I said, Okay, what does your product do? I was like, fine, I'll listen to you, it's okay. And he said, No, no, no. I don't want to talk about the product right now.

I want to talk about what challenges you have. And I said, nope, I want to know about your product. Yeah, because the whole point is that you have to apply it organically. And I think that's the same thing with AI.

If people feel like it's artificial, that's going to have a net negative effect, right? So I think that's a really, really important point. Yeah, no, I I fully agree. Yeah.

Yeah, words of wisdom uh to live by. Also, this has been great. Uh, we always do ask our guests to invite the next guest on the podcast. So, who do you think we should have next?

Yeah, my uh recommendation would be, and uh we work quite often with him, and it's a fantastic guy. Um, it's Matt Lee from uh PEXAID. He's senior director of security and compliance at PEXAI. And um he's a real security guy, he comes from a uh heavy uh security background, and he can not only speak about email security, he has a bit of a broader view than uh than uh ECD Mark in that sense.

But what he can do very nicely is to explain security issues in a very simple way, uh, so that also less uh security-minded audience can still understand uh what it's about. And I definitely recommend you to uh to contact him and I can also give you an introduction of that would be absolutely fantastic, and I think it's so important, especially in the cybersecurity space. Uh when I was walking around RSA, I was asking people to explain their business to me like I was five years old.

Um, and what you notice is that many people do actually struggle with that. Um, and I think that's because we get so entrenched in our industries that we feel like everything is um to use the Dutch word von self spread, like readily apparent, right? But to many people, even within the industry, some things might not be as clear. So to present these concepts simply, it actually uh helps everyone.

And that's very much his strength, yes. Oh, I've seen him doing that in uh in in s s with several audiences, and it works very well. Yeah, amazing. I I'll definitely uh get in touch with him.

Um to wrap this up, do you have any final insights, tips, or tricks that you'd like to share with the audience? Um well as I think as an MSP. It's quite interesting time to be honest, and probably this this uh it has always been interesting because the market is always uh shifting. But um I really believe now that you have more and more subscription models uh for all kinds of uh tooling, that the role of an MSP changes and he becomes more and more a trusted advisor and less the guy doing everything.

And in that sense, I strongly believe in the PAX8 idea of managed intelligence provider. If you really want to add value to your end customer, you should become a real proactive advisor of your customer and not just the company fixing a few laptops or something like that. I think those are definitely words to live by. We have to continue to look forward, and I think MSP should definitely uh do the same because uh if they win, we all win, right?

That's the nice thing about a partner first uh methodology. Correct. I fully uh I fully agree. Yeah.

I love it. Elcho, thanks so much for sharing the thoughts and taking the time to speak with me. And uh for you, dear listeners, thanks for tuning in and see you in the next episode. Thanks, Elcho.

Thank you very much.