Anyone Can Run a Vulnerability Scan. Knowing What to Do Next Is Hard. | Michael Simmons

finding the vulnerabilities is easy. It's been easy for years. It's

Yeah.

what to do about it, and a lot of what to do about it is expressing exactly

what it is in a meaningful way to the

Yep.

business.

Welcome to the Security Cocktail Hour. I'm Joe Patti.

and I'm Adam Roth.

I think we have a friend of yours as a friend of ours, right?

That's right, a friend of ours in the literal sense, not in the Jersey sense. But we

have Michael Simmons. Mike, welcome to the show.

thanks for having me. Having me on guys.

It's great

to see you. We have known you for a while and boy, you've gone down a new path. You've been a security guy, a practitioner like us for a long time and now you're an entrepreneur and can say it for real. Why don't you tell us about what you got going on these days?

it's just kind of as I was kind of growing up in my cybersecurity career, I've just always been one to think about, let me try and solve a problem, you know, a problem I've seen. Part of what I've noticed when I was doing my time with consulting, I spent a lot of time in vulnerability management and that type of stuff and writing reports, doing consulting, I still do consulting

So I've spent a lot of my time just kind of solving the problem about what would make my life easier, which would then make a lot of other people's lives easier. And the company I've been building for the last few years at this point, just diligently coding, is a way to turn our external vulnerability scans and turn them into a repeatable process. So instead of...

doing the scan, having these technical findings coming out, and then trying to be like, okay, let me reword this and do all this fun stuff so that the executives can understand that I've made a way where I run a scan and about five or 10 minutes later, a report spits out and it's geared towards the executive, geared towards our clients, geared towards the business owners, right? Because at the end of the day, we do struggle sometimes of just being, all right, well, how do I reword this? How do I do this? And make it so that somebody can actually

Understand it, that's not technical.

for executives you just write in crayon. That's easy, come on.

Yeah,

I

said second, third grade, went up to that level.

Yeah,

And we, yeah.

you got

the other letters in the back. You can teach him to read,

Yeah exactly, that's my executive letters over there.

And

we spoke about that in the past, right? Like not only are you trying to solve a problem,

but you're

Mm-hmm.

solving a problem by bringing it to smaller and mid-size. Is that correct?

Absolutely, yeah. So you hit this nail on the head, right? The issue was, especially when I kind of first branched out of my own, trying to run my own service provider, these big guys, the products are great, but it's not cost effective for the little guys. It's a small business, right? People with a small shop or people with no shop, right? I'm focusing on that niche where it's like anyone that's a managed service provider, IT or consulting or whatever, that they can afford.

a product that's geared towards the small businesses. It's not going to cover what enterprise level, because it's not what we need. We need to be able to translate business risk repeatably. And that will add, and this adds another revenue source for these small businesses. So I focus on the niche that's, I tend to think of, right now I'm serving the underserved. I mean, that's where I want to stay. I'm not trying to grow into a

to enterprise level, I'm gonna keep focusing on driving the product where it needs to be, focusing on small businesses based on our man service providers. And I am not selling directly to small businesses. I'm helping our community.

Well, I got to say Mike, you're either a genius or you're completely insane because it is underserved,

Both.

man, selling security to small businesses is tough because they don't have the expertise. They don't even understand what it is that they're buying. And you're doing it for vulnerability management, which I still consider the absolute most painful discipline.

And you're looking for problems

Thank

there? Yeah, there are a lot of problems to solve

Uh-uh.

there.

Yeah, I think that I think what when you look at it, right if you sold to the larger organizations You're gonna make money when they get those sales So on the other side when he's selling like to the smaller more medium businesses that do have a requirement to probably They're not probably looking at you unless they really have a requirement. They probably need a requirement. Maybe point of sale Maybe financial

Mm-hmm.

maybe medical maybe it might be a doctor's office and

Absolutely.

Yeah

Yeah, so it's kind of expand on that, Yeah, because it is so a lot of the small businesses that have been having success with, you through some of my, you know, my early partners, right? They are having great success with like law firms, HIPAA, know, HIPAA firm, like healthcare, right? Anyone that has like a financial thing, right? Where, and also too, you have the cybersecurity insurance, right? So these are the agencies that are requiring some type of external scanning, right?

And I have, again, I have a small shop now that doesn't have a traditional security analyst. And they've actually expanded their offerings because now, something they can't offer, they can offer it without having to add an expensive analyst, Or for someone coming out of school that wants a certain amount. But now they're able to extend, which actually increases their, it's actually increasing the revenue on top of their services.

When I ask this question, you're going to say, wow, I know you would probably ask me this question, but you have an interesting perspective, right? You're kind of, you know, that kind of, you're like, in the military also, you know, serving our country, thank you for your service. You also are former law enforcement, and you have your security hat also on. Do all these three different perspectives give you an interesting view into this?

No, absolutely, right? Because at the end of the day, it's like when I use my accountant, I want to make sure my stuff is safe, right? We used to use it when I had lawyers in the past. I want to make sure that their stuff is safe from doing consulting work and also to my experience in investigations, right? Doing the field-scarred stuff on top of my police stuff. It's more like, okay, well, now I'm walking into these offices. I'm like, oh my goodness, why is my stuff is...

locked behind this unlocked server in their office. So I want to make sure that they're safe. And some of the best way to do it is making sure that their email is safe, make sure that their domain is safe, make sure that there's security headers, stuff that's easy for somebody to make sure to go in and break into their network. Make sure that that's all locked down. And I've created a way that the lawyers will understand as well.

We'll be there.

If

you've figured out a security thing that the lawyers understand, my hat is off to you because I worked for a law firm for six years. I don't think they understood a damn word I ever said to them.

jokie or worked for a law firm up to six years

Yeah.

we will work

Yeah.

side by side don't forget that

that's what vulnerabilities is all about.

Yeah. Yeah.

It's very easy to identify them, but how you present it to that executive, how do you present it in a meaningful way that somebody understands it and executes on it? That's what I think this whole vulnerability management's all about. People are like, I have four high vulnerabilities, at least it's not 10. I'm good. But what people don't realize is that four high vulnerabilities might be insanely bad. Or I have one high vulnerability, I have six medium vulnerabilities, and guess what? Those six medium vulnerabilities,

Mm-hmm

can actually cause more damage because those six vulnerabilities can

lead to a worse situation. So it really is about how do I give that information to that CRO, that CFO,

Yep.

that CEO, that CXO.

No, absolutely. And just to kind of highlight what I, you know, like the main thing I do is like I'm bridging, I'm bridging the enterprise, you know, to the, because we all know that like the small businesses they use, they use a small open source, it's scanners, right? It's full of noise, right? As we know, right? It's like,

Look, the

expensive enterprise ones are full of noise too. They basically are the same thing. They just collect more stuff.

yeah, I just I remember working for I was remember

working on a log4j Back and I'm like I just like how do I explain this to the you know to the executive right but this you know, have the Big guys and you know guys and they're all full of noise, right? So even kind of what I've what I've been what took me part about three or four months to do is just like I've I was going through

my the results from scanning my own stuff, right? Mixing there I can break things, right? And just say, okay, well, this is not a true error, right? So I've also came in here with a consultant mindset of things I've seen and things I've done to even pre get some of those noise, right? My reports are gonna spit out a hundred different vulnerabilities, right? Because we all know when these scanners pop out something, there's usually a lot of noise you have to sit through, right?

There's a lot of the things that we from just experience, right? Where it's like, we know it's a false positive. Why? Right? And also what I kind of built up with, so pretty much what it is like with the control pane I built out, I have it where the scan, all that data is in my central portal, right? And if there is something, say you do work for a small business, right? I actually implemented risk acceptance, right? It's like, this is reason why.

we can stop reporting on this, right? So I definitely took my enterprise level vulnerability management and my small companies I've worked for, right? And just kind of made something that's in between, right? Not too enterprise level, but enough for SMB to really appreciate it. And the

best part about it is, my stuff is, and I built the multi-tenant thing, right? So your stuff is, everyone's stuff is separated on top of the fact that you can,

separate your clients, right? So client A, client B, client C. And it just looks really cool. Like at the end of the day, you throw a couple logos on it, that report generates and even your logos

Nice.

run reports.

Well, you may be lean, but you've definitely got the important stuff because here and like, definitely got a consulting background putting the risk assessment and even if you're not a risk person, because you know you got to get someone besides yourself to sign on that. I I I love to tell the story. I had a CIO who used to say, the risk assessment is the auditor's kryptonite. If everything is

huh.

risk accepted by someone else, you sleep well.

The one part that I find really interesting is the journey you have had. You don't have to get into real specifics, but the journey you have had with having developers work for you. It's been interesting, right? Nonetheless, tell us a little bit about

Yeah, yeah, very interesting. I learned a lot.

that.

Okay,

and you're not a developer.

No, I'm not a

Right, mean, originally, yeah, okay. So how

No.

is that? That's actually interesting.

was actually kind of funny, right? Because it's like, I did learn how to code and one thing kind of led to another, right? First I was like, all right, well, I think I told you before I started Leasing Trace, I was going to run my own managed service provider, right? In the New Jersey, I throw a stone and there's a managed service provider, right? So it like, it was like, was like,

Yeah,

you can find them next to a laundromat in a strip mall, seems like, you know? Yeah, the bagel stuff.

In a bagel store. It's like funny you walk down the block. It's

Exactly, exactly.

a bagel store, it's a laundromat, and then it's

Ha

the vulnerability management. People don't realize they hide behind like stores.

Exactly. then when I was like, all right, well, I was getting some clients, but it's super oversaturated MSP space, which is like, okay, well, how do I differentiate myself? So then I just went, all well, some big MSPs, they have products. So then was like, you know, and then I started doing some research. How much would it be to get some of the big scanners? How much would it to get the small scanners? I'm like, well, this is a lot more expensive than I thought it would be. So then I decided to build one.

And then I started building one. took me probably the first six months to trial and error. And this guy like where I was using it for myself and be like, okay, well, here's the noise I'm getting on some of my clients. Here's the noise I'm getting on some of my clients. The safe list and the suppress, right? Suppress some of these alerts, right? And then it got to a point where it's like, okay, well, this is actually an idea and I haven't edited in some research. It's like, there's nobody that's affordable that will do something close to what I do. And also too, I've used some of those products and the reports are not the greatest, but

They're usable, you know. Yeah, I still had to do a lot of things, So then what happened was I just kept building. was like, okay, well, what's the next step? Oh, now let me get a platform, essentially, because everyone loves central managed platforms, right? The one thing I work in the managed services space is that a lot of companies, don't have like a multi-tenant platform, or they don't have something where I can say, hey, this is my company.

I can have client A, B and C in there and see their stuff differently. So I was like, okay, well, I'm a managed service provider or a I want this. that's what Adam was talking about. That's what I had. I don't have the skills to develop that whole back end of that. So I had an awesome development team who got me from what my idea was to the finish. And I knew enough to keep us on track.

Wow.

Yeah, it was cool. I was able to, you know, I ran a development team for what they helped. They were building for like eight months, you know, we'll go back, back and forth. We're developing in parallel, you know, making sure that we're all safe and secure. Right. And I was using, since we all know developers sometimes are not the best at the security side of the house. So I was checking, you know, we're just doing like waterfall stuff, right? Like let's, let's, let's, uh, let's check, let's take this checkpoint to make sure that we're good. We're on the same page. Everything's working as needed. So.

That's great. Nothing fancy, nothing exotic. do it out. careful. So I got to ask you, your developers,

Yes, sir.

offshore or onshore?

They were actually in Jersey City, so they were right next to me. Yes, so I'm sure. Yeah, I got lucky.

They're in Jersey City. Wow! Crazy!

So I've had this conversation with Joe multiple times and we discussed our existence as a podcast. You know, what makes us important, what makes us good or why keep going. And my feeling always is no matter what the space is, whether it's an MSP, whether it's a bagel store,

Hehe.

whether it's, you know, vulnerability management, I don't think that should ever stop us from persevering.

But

I don't think anyone should go just without caution. you know, I get it there's a lot of MSPs, but it could always be a better MSP. Somebody always wants to buy something. I don't

Yep.

watch Shark Tank a lot, but I see somebody comes out with the next amazing thing. So we persevere as a podcast because we know that we bring something different. And I know that you persevere with vulnerability management because you bring something different. So

Yeah.

my guess, my thought out there is for anybody listening to us.

If you have an idea, don't get afraid and say, my god, everyone is like 50 more out there, a thousand, a million. Come up with something different. Come up with something

Okay.

that you think can persevere and push it.

Yeah, but be like Mike, Mike, whether or not you realize it, be like Mike. Yeah, was not, that was a commercial years ago,

Be like Mike, isn't that a commercial?

Yeah, they're commercial.

but, you know, whether you realize it or not, you just gave a class in business, which is like, what'd you do? You found a problem. You knew the industry very well. You knew the issues. You found a problem and you built to that problem. You, you built something that you knew people wanted.

And I'm guessing that your friends in the MSP space who you know, we're thinking like, yeah, we'll buy that. That's cool.

Yeah, and I have a lot of good feedback from them too.

Right. the feedback to

Somebody go check this. Yeah.

do it. So everyone out there, be like Mike. That's what you got to do.

with

Just because you think it's

So we had a...

cool doesn't mean it's going to sell.

Yeah, exactly.

So we had a podcast a while ago, maybe even a year ago, and the woman's name was Keren. And Keren was telling us, literally, and this kind of blew my mind, she's like, what problem are you trying to solve? But that wasn't the only issue. She said, and how are you going to change the world? I'm like, that's a lofty goal. How are you going

to change

Yeah

the world? Am I really, like, am I right? That's what she said, right, Joe?

That

is what she said and unfortunately shows you my business acumen when she said, you know, what problem are you trying to solve? And I'm like, well, I want to Porsche GT3. You know, that's my

Okay.

problem. But it wasn't what she was talking about.

Yeah,

Yeah.

what I'm getting at is, you know, like I'm doing a dissertation and the

Thank

whole thing about dissertations is what problem are you trying to solve? And they tell you, like your goal is to add to our body of knowledge. So we think about this like that's a large thing to think of. But is it really? If your product, Michael, can change certain things about the business,

Like I was watching that Nike, be like Mike type of thing,

Hmm.

I was watching that Nike movie the other day and how they changed the whole entire industry. I watched it again on sneakers, right? How they changed the whole industry. One, I know Nike is big now, but they weren't that big before. They were okay. And they changed the whole industry by just making one change and giving a revenue or equity to the people that were wearing their shoes, their sneakers.

Mm-hmm. Mm-hmm.

So let's see how you change the world, Michael.

Well, absolutely. It's it's like I'm trying to change it in a way that it's meaningful, right? It's it's I'm not enough. It's a bit a word. I'm not filled by greed. You know, I want to change the way cybersecurity is, at least in this in the small business, the medium sized business space. You know, I want I want to be the go to product where it's like, hey, these people are going to take care of me. They're not going to nickel and dime me, you know, everything. Right. And it's very the way I envision it is being very community driven. Right. Because

I'm one person, I've had a lot of good feedback from a lot of big bigwigs from the MSP space. And I'm just gonna keep driving, but hey, I just wanna give the people what they want.

That's

it.

Cool. So I got to ask, getting away from the business and more into some of the guts of it. Of course we have to say, and because I need the hashtag, does it use AI? Of course, yes. All right. Got to use AI. Excellent. Well

Of course, yeah, of course it does. Yeah. Yes.

done.

How many jobs were lost because of you using AI?

That's

right.

No, no, no, hopefully none, because it does not, I do not want to replace people. want to replace the manual effort takes, right? So I'm not, I'm not trying to replace people. And plus it

It that

also takes, right, for AI, we run into this issue, right, where people rely too heavily on it, right, for certain things. It doesn't, it doesn't replace human judgment.

And that's a good point, right? And Joe, we can go back and forth with this, right? AI is a needed aspect in this world today with the way data is processed. But I still think for certain things that a human has to be in the chain of command for certain decision making. It's good that AI can process. It's good AI can make decisions.

or recommend decisions, but there are times when ultimately a human has to make that change.

Huh?

Yeah, it takes a lot of time. mean, the past few months I've been spending a lot of time on AI and on the agentic stuff and they

you

need a lot of care and feeding. They're like, just give it

Yeah.

an outcome. Tell it what you want at the end. And when you do that, you get a mess.

Mm-hmm.

Maybe, maybe if you're lucky, after 30 or 40 iterations, you start to get it to the point where you can think about letting it go by itself. But most things are...

that it's not easy getting there. And I wonder how many people have really legitimately gotten there.

Do remember Max Headroom,

No?

It was AI, but I don't want...

I don't know

if

Mike was around for Max Headroom. He's a little younger than us. don't know.

Yeah, he's probably Mike's probably one-third of my age. But anyway, I

Up quiz.

found out Michael we took him by AI replacement I Joe and I shared the same folders for the podcast in our business

Yeah.

and I looked in the folders and I saw something weird I saw a Co-host a virtual co-host for Joe and it looks a little bit like me, but it's an AI agent I'm not sure what he's trying to do

If I were doing that, which I'm not, but if I were, I'd be doing you a favor because I still got to pay you for your likeness and everything. Now you just sit on the beach and hang out and let all the millions from the Security Cocktail Hour podcast profits roll in for doing nothing.

yeah if i had so speaking

of greedy i've already bought you know three Porsches already was it GT3's I bought Joe

Yeah,

he gets GT3s.

There you go.

You took one to lunch the other day.

Yeah, we were hanging out. Yeah, that was it.

So Mike, so what, so have you been focused just on this? And I know you're obviously spending a lot of time, but are you focused just on this or like many entrepreneurs, do you have a lot of other things cooking? Are you looking down the road to do more stuff? You always got your eye out for the next opportunity.

I

Like what else is cooking?

No to be completely honest with you like I've been a serial entrepreneur with like my whole my whole life but

Well, okay.

this this is the first time where I'm like this misses my full focus because Right once once phase one is done. I'm looking at phase two, which is now tackling the internal scan inside stuff, right and and doing that's a big mess. That's a big undertaking It's good to take more

Mm-hmm.

than me to do it

You know, but I, so yes, in a way I do look forward, right? But I want to make sure what I have now is good, solid, right? It does what it needs to do and it helps the community. And then I can, one, let the community drive where I go next, right? But it's all going to be within the same sphere, right? It's going to be in the same, the same assets. It's going to be focused around vulnerability management or doing, know, let's drive some revenue, you know, for some MSPs.

so there's a great focus on your part. There's a great vision there. But from that vision, obviously you have to have a vision for what people want for vulnerability management. Is there a vision of who your audience is going to be? And how are you going to get that people to sign up?

No, my vision is exactly what I'm serving right now. The places I've worked, right? Managed service providers IT consultants, anyone that's trying to, you know, obviously grow their business, right? Because it's by, and how do you grow your business? By making things that you do already or should be doing easier, right?

And one of the things that I pride myself on, like I think last time we spoke, I spent a year and a half in my basement. didn't really saw any sun, just developing, right? Just so that somebody else.

Was

that voluntary or like, know, do you have someone locking you down there?

I was, maybe. Yeah, somebody locked

me down and said, hey, just focus.

No, no,

Okay.

no, it was a bring a return on your investment now.

Oh, 100 % right. It's like, cause I needed, I needed a hundred percent focus, right. And, and I, I envisioned like these, the small to medium sized service providers, right. The people that have maybe a few guys on the security team, right. Cause I've worked out a lot of them that we only had, there's only three of us, you know, I, I did work out one that had, we had, I had six engineers or like a couple, I hear one, two, two, right. But still like the issue was still there is like,

when we had to do vulnerability management or sorry, just do our external, our monthly reporting with scanning, right? We still had to go through every single time and produce a spreadsheet and get the raw data, To put everything together, then try and be like, okay, well, what makes sense for this? What am I gonna tell the client? What's the story this time, right? Where

Yeah.

I've tried to nip that pain point, right? That pain point is.

not gonna be there with my products because it's not just scans, it reviews everything and then it spits it out in a business context for SMBs.

Yeah.

And like I said, I'm serving the underserved. I'm not focused on the people who have served the companies we've worked for, some of the bigger ones. That's not my lane. I wanna be the best in this vertical. And I think within a short time, once this keeps catching on,

I think I will be.

When we worked for Joe, we were very lucky. Well, not we were lucky working for Joe, but no, we had at least eight

You were very lucky working for me. Don't forget that.

Yeah. Yeah, yeah.

people.

I wouldn't be here if I wasn't working for Joe.

We had at

least eight people on the security team for under a billion dollar law firm at that time. And people listening like, my God, you think under a billion dollars is not a little? It is actually a lot of people for a law firm. And what's happening, think, I'm not talking about law firms, just everybody, typically, a billion dollars in revenue, it's trending downward with the amount of people people are hiring. They're going less and less.

eight people has now become four in certain organizations so your product has to serve a purpose because

Yeah.

yeah.

Oh, it definitely serves a purpose, because I've worked, again, I've worked in managed service providers. I've had handful, maybe like five or six in my career. And a lot of it's like, oh, guys, either I was a security guy.

or I had another person that was helping me, you know, and there's one time where I had a team of security people, you know, which is awesome, you know, but still for these people who focused on cybersecurity, it's like, how do, it was the same thing, right? We all had a couple clients or five or 10, right? And we all had to these monthly reports out, you know, and it'd be like, okay, well, how do I dumb this down, right? It's the same thing. Well, I'm going to remove this from the report, that, right? And then,

I just made it easier where it's like, I've used my experience to be like, okay, well, I already know this is a false positive. I already know this is, you know, just be safe listed. So I've suppressed a lot of that noise. And now the rest of it is to be up to the person, right? Because that's why I added risk acceptance, you know?

now I get it's interesting. I did ask you about the AI and I'm sure you're using it. from what you're saying, all these problems predate AI or

yes.

predate the latest generative AI stuff. And in fact, the trend of

more automation and trying to make a sense of it and actually cutting down the amount of information, not this huge explosion is a trend that's been going on. AI has been helping with that because it was very difficult. now it's gotten on that bandwagon. also you're right, especially when it comes to vulnerabilities, takes

a lot of knowledge to go through a vulnerability report with literally tens of thousands of things and everything and try to

Yeah. Yep.

make sense of what's real, what's important, what isn't. It takes a lot of knowledge. It takes a lot of context and it's been a problem for a long time. So if you've managed to translate that into something that's much easier, much more automatic.

Yeah.

That's great because that's again, that's where the work is. Not in finding the stuff. finding it. Yeah, finding it. Scan will put out anything. will put out lots of stuff. mean, I've

Yeah. That is easy. Yeah. I'll tell you what you want to know.

Chug, yeah.

seen... God, I've railed on consultants when I see a report and they're like, this is a security assessment. I go, okay. And I look at it and I go, these are raw scan results. I go, these are not even...

filtered and verified scan results. They're raw scan

Mm-hmm.

results with false positive. I'm like, get an intern to do this.

Joe brings up a great point. When we were working together, or I was working for Joe, and we were getting vulnerability reports, sometimes it was Cisco configurations, sometimes it was scanning the network. Anybody can run a scan report, but if the report does not include the context behind it, then anybody can run an Nmap or a Tenable or anything, but

Yeah. Yep.

Not only is it bad that there's no context behind it, it's even worse when the wrong context is behind it. And not everybody can add context. So while anybody can run a scan report, cut in and paste it onto a Word document, not everybody can interpret it in such a way or use some kind of interpretation that can give meaningful information.

No, absolutely. That was one of my big things when I've even done my own consulting blueprint management. There's been times when like, have no idea what this even, why has it given me this, right? And I'll

yeah.

leave it Tyler Chiu and to kind of point on that, like, yeah, I use AI, but it's definitely not, most of it's coming from my head.

You know because it's like the one big issue that one of the new features I'm rolling out is reliable CVEs and the it the risk score, right? Because you don't realize what really goes into and how much false really when I'm digging so I don't know how many false positives can really get like some of that stuff is loosely tied to the scan, right? I had something pop up that said like we're port 21 and and it gave me something that was completely off.

You know,

Yeah.

so that's something I'm doing, like this is knowledge, right? Just kind of, okay, well, what's wrong, right? Let's dig into the actual findings. I can produce that noisy false positive full. I do have the option where someone wants a technical scan to see where all the data comes from. That's a thing that people can select. That's what kind of does even my risk acceptance, right? Because they get the full scan, right? I'm not hiding anything, you know.

Yeah,

well traditionally a lot of scanners have tended to err on the side of putting stuff out so you get a lot of false positives. They'd rather get a false positive than get a false negative, which is miss something that isn't there.

Hmm.

And that may protect the vendor and their reputation and everything, but the flip side of that is that, again, when you've...

It's not that you get one or two of them, you need to filter it. It's when you have thousands of them at scale, you get so inundated. It's like, you know, we need to filter it down to what's really

real

Okay.

and not the noise. That's the tough, tough part. Yeah.

That's part of the engagement, right Joe? That's part of engagement.

for me. When I'm launching something, when I put new features in, I want to make sure it's tested. For instance, before I even, I Adam, I you and I, I know you and I were talking for a while about it. I thought I would be ready for, I thought I was gonna be ready to launch six, like six to nine months ago, right? But I wasn't happy with where it was being, because I want to make sure that when I put myself forward and I'm saying, hey, I'm going to make your life easier, and that things that,

and I want you to eventually trust it to give to your clients automatically, right? Because my stuff does get sent out by email if they want, you know. I want to make sure that everything that's in there is accurate, you know. And if it's not, they can do the risk acceptance because there might be something that they know about that client that I don't know, that's not traditional, right? We've all been there, you know. Where this is safe because of this, you know. So.

It's definitely as customizable as they want it to be, but I definitely take pride in making sure that what I'm putting out is going to be good, you know, and it's not going

to be full of noise.

Even now, I would love to say my product is perfect, but it's very close to it.

Right.

there are some bugs. I'm in there testing everything. I have clients, and I have the reporting feature. Everything goes right to me. if they find this, now if I have five or 10 people using it over me, they're going to find some bugs and I can fix it. I have alerts. And that's the thing. I'm not trying to...

I'm not trying to even expand features until we get this phase one locked in good and everyone's happy without something to be in. I'm getting some really good feedback right now. hopefully phase two will be maybe next year or so.

Mike, you are a renegade. You're like commitment to quality, fixing stuff, not going to add new features until what you've got is right. my God. Wow. They'll run you right out of Silicon Valley for that if you ever go out there. Jesus.

That's new. A renaissance movie.

and commitment to swag.

Commitment to swag. I got his cup already. He's

monk.

yeah. You got a mug? I didn't get a mug. Come on. All

Yeah, what mug you talking about? Mugs in the mail.

You

right. Now, well, Mike, you are definitely doing something really interesting. It sounds like you got a really good handle on it, and it's important. And it sounds like you're doing it right. you've restored my faith in the industry, I suppose I can say.

But seriously, good luck. really hope you do well. It does sound like something great that you're doing.

I appreciate you guys. Thank you for having me on.

Well, wait first, get in a

Yeah.

good plug. Make sure everyone knows what it is.

Yeah, I'm Michael Simmons. I am the owner, founder and CEO of the Elysium Trace. You have to look us up at ElysiumTrace.com and definitely hit me up on LinkedIn and we can talk.

That's right. Okay. Excellent. So Adam, any parting thoughts?

No, this goes to show you that somebody like Michael who's been in the industry took that leap. And I think it's important for everybody who's listening to this that if you have an idea, push yourself forward. And we could also put you in touch with Michael or any of our other guests that might be able to give you some insight. We can't promise that you'll always get information quickly, but we try to build a community of people that can help each other.

kind of what the podcast is about. And Michael has always been a friend to us. he first was a co worker. And that's how things expand. And now he's an entrepreneur, that's probably going to excel. And I'll be begging him for a job in a couple months.

There we go. Yeah, everyone,

Toys always open Adam

if you want to engage, if you want some help to get a great insight or just talk, please put something in the comments, hit us up on LinkedIn, wherever, we're around. So gentlemen, thank you very much. Always fun and thanks everyone for listening.