Every year, we check whether our baseline still meets current safety requirements.

We started a few years ago, I think six or seven years ago, with the first managed services. The first products were Microsoft products, Microsoft Office 365, now Microsoft 365, but also the Sophos portfolio, especially server protection and licenses for endpoint protection and things like online backup were the first products when we started. That's still growing because we're in the process of introducing MSP and CSP products.

Well, we use our baseline and check every year whether it still meets the current safety requirements, and every customer has to comply with the baseline. Sometimes a customer does not adhere to it. Then you have to ask yourself whether that is the right customer. But most customers comply with it.

The basic structure includes monitoring, asset management and a range of security products. So there is a strict basic structure. And then you can add other products.

What you currently see in the market is that the subscription-based services such as the MSP and CSP versions in most cases offer more services than the designated licenses. For example, Microsoft 365 instead of Exchange on-premises. This is of course also a big difference in terms of security, but in some cases it is better to use the MSP licenses than the temporary services. As an MSP partner, we prefer to end all renewals. Therefore, we have been quite busy renewing all temporary licenses with a renewal date and such.

It's a big administrative burden and it's better with MSP and monthly, quarterly or annual payment. There is also a lot of work for the renewals team to calculate what license is needed and to get a quote from every vendor on the market. With MSP, you work on a quote to increase the margin and can then make long-term commitments with vendors to get more margin and lower the purchase price.

At the moment, for each product, we choose the one that works best for us. The MSP security products are the hardest part because every customer has a security breach once in their life. And with some products, like online backup products, you can say, okay, that's an all-inclusive service because we're responsible for the backup solution.

And if there's a problem, or if it doesn't work, or if a customer writes a ticket, they can solve the problem, including a price. But especially the server or endpoint security, threats or ransomware and pentest results and things like that. It's quite difficult for us to include all of that because it's too risky for us.

Yes, we look at the Managed SOC solution that we use. If something happens at the customer's site at night, we get a call from the extended Managed SOC. Well, it's four o'clock in the morning, the consultant is asleep, of course, I hope. And when we get the call, everything is covered up to that point. But if we have to call the customer because there's a security breach or an unauthorized login or something like that, that's not covered.

When I look at our customers, I estimate that 40 percent of them have their own IT staff. And we are in second or third place. Around 60% of customers don't have their own IT staff, maybe an IT manager, but that's it, then we can report problems or similar. But of course there is a difference, because the IT managers in the company are more eager to use new products.

But sometimes they are also more difficult because they are not always willing to use the latest products because they are afraid of their own responsibility and position in the company. But all the products in the baseline are just as suitable for small companies with five employees as they are for companies with 300 or 500 employees. That's the good thing about it. Only the larger companies get better prices in most cases because they increase their workforce and then you can offer better prices.

A highlight for 2024 for us is of course security, including with the term NIS2. We have a whole range of NIS2 customers in our customer base. So they need to take a critical look at their security needs. We are doing more pentests than ever before, but we offer pentests as a service. That means we don't just offer one-off pentests, we do multiple pentests throughout the year. So that's an important point for us. And we are expanding our Managed SOC, i.e. our Managed Security Services. And yes, other highlights that have nothing to do with security are talking to customers about sustainability and AI, things like Co-Pilot and things like that. So, some highlights are security, sustainability and AI.