You need people in marketing just like in technology

That’s not so easy to say. Of course, you need good products for managed security services; that’s clear. You need solutions and products, and a manufacturer who understands and supports the managed service idea. It’s about issues like scaling licenses up and down, monthly billing, and centralized management of tools and solutions. Without these, you don’t even need to start.

Another extremely important point is in-house expertise. This is a complex topic. You need people with an incredibly strong foundational knowledge of networking technologies because the security layer sits on top of that. Without a deep understanding of the network, you’ll also struggle with security.

And lastly, and this applies to all managed services, it’s all about process—process, process, process. Managed service is highly automated, and efficient and economically successful operations depend on well-defined processes and automations.

So the last addition to the Managed Security portfolio was 'Managed Compliance Monitoring'. And we actually came to it by chance. We have a large customer who at some point received the TISAX challenge from the automotive industry. This is a derivation of ISO 27.001, i.e. a type of security certification. And we then carried out this certification for the customer together with a consulting firm. And one of the topics was compliance monitoring. Ultimately, this is a monitoring of user rights to activities, files, and all these things, so that you always know exactly who has accessed where and when. Or are there accesses that are out of the ordinary? Are there requests that are atypical? Are there anomalies and things like that? And yes, we then introduced a corresponding product and turned it into a service that we now also sell to other customers. Because Microsoft simply delivers relatively little in this area with on-board resources.

We have gone through various stages of evolution and actually started with the product-based topics, i.e. a managed firewall, five managed clients with Endpoint Security, and all these things. But today, my heart beats for this user-oriented view, and we have already been able to convince many customers of this. The flat rate per user per month is based on how complex the individual customer's infrastructure is. How many servers does it have? How many employees? How many networks? How many locations? How many firewalls? We have developed a certain methodology from which we can calculate a per-user flat rate.

I think I'm like most entrepreneurs and managing directors out there of companies our size. But once you reach the limit of 20 employees, referral marketing is no longer nearly enough. And that's why I said we have to actively acquire customers because we want to keep growing. As a technology enthusiast, I sought professional support. We actually used the time last year during the coronavirus pandemic to put the brakes on and ask ourselves: how should our customer acquisition work at all? How does modern marketing work? I learned that inbound marketing is the key to success today. The relevant channels such as social media, LinkedIn, Xing, or whatever else is out there are suitable for this. We use these channels to tease certain topics, arouse interest, and then engage with customers about their specific interests. Specifically, we use security checklists, webinars, expert talks, and social media posts to encourage people to get in touch with us. From there, we try to identify how we can contribute with our portfolio and turn a customer into a long-term fan who says, "I want to work with you."

We were very structured in our managed services but previously lacked clarity and organization in our sales processes. This was a significant learning experience for us. Just as you need technical staff to bring managed services to life, you also need to invest equally in the marketing and sales process. You need dedicated people for this, and a managing director can’t do it alone. For us, this meant hiring a part-time marketing specialist, three inside sales employees, and a dedicated account manager. We also invested in a robust marketing software license and defined a clear process.

This approach has been successful for us. The best content is useless without a well-defined and actively managed process. Every ad hoc measure or Facebook campaign is ineffective if the process isn’t clear and adhered to. For us, this means that when someone downloads a document or registers for a webinar, they receive a call within an hour after the webinar ends. Experts refer to this as a small product. We always aim to launch the product, starting with an expert discussion. The first step is to engage with our engineers or our security architect for an hour.

On one hand, we will be focusing on Network Access Control as a Service. On the other hand, we are also looking at vulnerability scanning as a service. There are sophisticated tools available for scanning networks to identify vulnerabilities. Our goal is to monitor what’s happening in our customers’ networks that we might not have under our control as a service provider. While scanning and identifying vulnerabilities is one aspect, addressing and fixing them is another. I believe there is significant potential to generate work by offering these services.