In October 2013 at the ScanSource Security Partner Conference, Chief Technology Officer Greg Dixon gave a presentation titled, “Managed Services — Best Practices for Security Solutions.” This article is an edited version of the full presentation, including many of the slides that Dixon originally presented to attendees.

Dixon believes that security systems integrators need to adopt a business model based on the managed services concept — but one that goes beyond the types of services that a traditional security integrator has ever considered and in many ways resembles that of an IT integrator. Here, he discusses that business model, the factors he feels are influencing the need for it, the financial considerations prompting it, and many suggested new services from providers that offer “dealer programs.”

Further, ScanSource recently signed on with a new vendor, Intelisys, which Dixon describes as a “master agent to about 70 cloud-based solutions and services.” Intelisys is one of several service vendors that integrators can partner with to offer these managed services under their own brand.

Some of the realities of business that integrators find themselves facing today are similar to those faced by the IT industry, which is why some business models adopted by IT integrators can be applied successfully to security integrator businesses.

In order to know where you are, you have to know where you come from. My first job out of college in 1977 was as a field engineer on big IBM mainframe peripherals. Behind the big glass wall was massive hardware — “the big iron,” they called it. IBM was the dominant player in that space, and I worked for one of the peripheral manufacturers.

When we moved on to the personal computer — the PC — it really created a standard by which everyone could follow. Right behind that came the local area network. I was a Certified Netware Engineer (CNE). With NetWare and the concept of local area networks on the scene, we began connecting these powerful computers that were at the desktop — connecting them all together and connecting them to this thing in the background called a server; and then connecting LANS to each other and they become WANS. Now we were rackin’ and stackin’ things in 19-inch racks with structuring cabling systems. This was a very dynamic business.

During this time, we saw centralized control replaced by distributed control — from the centralized control behind the big glass wall, now distributed throughout the organization. We saw expensive hardware replaced by cheap hardware. We saw complicated maintenance replaced by easier maintenance. And we saw outsourced service — much the domain of the manufacturer and a few exclusive, big integrators —replaced by in-house service and the advent of the help desk. We saw a lot go on in the evolution of IT services — and that was the 20th Century.

The 21st Century, of course, brings us the cloud, and cloud computing changes everything. We may think, well, that’s not new — it’s been around. It’s just a matter of where the servers live: in-house or out-of-house. That’s the cloud. We’ve seen a lot of innovation around mobile devices, around storage, around bandwidth requirements, and all the things that go with that.

Within just a few years in the last decade or so, we’ve seen distributed control replaced by centralized control, so we’re coming full circle. In the 21st Century, we have seen cheaper hardware replaced by less hardware. We’ve seen easier maintenance replaced by automatic maintenance. We’ve seen in-house service (the help desk) replaced by outsourced service. Full circle.

And we’re seeing a new character in the plot called an MSP — a managed services provider.

One of the realities of business today is an undifferentiated price competition —commoditization. We’ve seen our own product set replaced and commoditized, and simplified, and cheapened, cheapened, cheapened until now we’re competing with the likes of Sam’s and Staples for some products that we might sell.

Another reality: less margin on less hardware.  Some of this can be blamed on economic lows; we are still recovering from the recession and we are seeing smaller deals based on that economic pressure.

Commoditized hardware is easy to find and easy to use. Some hardware has moved completely out of the picture to the cloud; we don’t even sell it anymore. Another reality is less margin on software. The traditional software model is a perpetually licensed model that you sell outright; the end user owns it. Now, as that becomes transitioned to a cloud model, there is no big check up front.

Is there a response to this reality? There is: What we have to learn how to do is to sell more services. That’s what managed services is really about.

A profile of an old-model video surveillance system might include four locations, with eight cameras per location for a total of 32 cameras at $20,000. Servers and storage at four locations is another $12,000. Switching, to connect it all together, (this is an IP solution, right?) is another $4,000; and cabling about $2,000.

Four software licenses times the number of cameras is about $5,000. Installation — now here’s where we can make some money with cabling drops and camera drops, guys up on a ladder — that’s not cheap. So, about $12,000 for installation. An annual service contract, just on the software alone, would be a minimum of $1,000 up front. There is a nice bottom line on this deal: $56,000. This is an “old deal” profile — the one we have become used to.

Let’s compare this with what I perceive to be a “newer deal” profile. It is going to involve fewer cameras or less money overall for the same number of cameras, maybe because the customer can afford only half as many because of financial pressure or maybe because they waved in your face that commodity camera they found on the Internet. You are faced with that today and you have to price compete.

There are no servers and storage in this deal — it’s all a cloud-based solution. You are going to have to price compete on the switches, too, as this is a very commoditized product. Cable will stay the same. Software — this deal is hosted. Installation — there is less to install, so a lesser installation charge. Then we have this managed services contract we’re going to come back to. We have a much smaller number here to work with. Bottom line: $21,000.

If this is your revenue picture today and you look towards the future thinking, “Later on, times are going to be better and we can make more money,” there is no certainty. The question is, how do you get from now to later? If all you do is convert perpetually licensed software to cloud-based software, you are going to get a J-curve in your revenue. If all you do is convert your annual service contracts to a monthly managed service approach, you are also going to get a J-curve — and that’s a cash flow difficulty.

There is something you can do about it, but you have to start modestly and with something new. You can start to offer some new incremental services — some brand new things that you did not have before. Think outside the traditional box, or this is not going to be easy. As you add these services incrementally to your monthly recurring revenue model, it will prop up your cash flow — the more services you add, the more it will prop it up. These new services are going to be delivered in a way that is more profitable than the old model.

Some examples of some easy add-on incremental services are:

Carrier services. In the previous example of the four locations, each of those sites is going to store their video feed offsite. They are going to need a big fat Internet pipe. Why don’t you sell it to them? You know how much bandwidth is going to be required, and you should be able to sell that to them. ScanSource has the bandwidth calculators online. You can sell it to them not as something you’re providing, but from the local carrier — the local ISP or cable company. There are several organizations that offer it to integrators to resell. Furthermore, you get to be part of the monthly recurring revenue stream. Every time that customer pays their bill with the ISP or the cable company, you get a piece of it — a little piece, but it adds up over time.

Email hosting. I use this as an example to illustrate that you have to get outside of your normal perspective. You need to begin to learn to ask for some extra things. The deal is done and now you want to say, “Let me tell you about some other things I can do for you. We talked about the bandwidth; you should buy that from me.” Customers want one throat to choke. They want one phone number to call. That should be you.

Disaster recovery backup. This is a cloud-based service, and you may think that because the video feed is going off site they are already backing it up. But what about all the other data that this company stores? Where is it backed up? You need to ask, and if your customer answers that they store it “on site,” then you have another opportunity. Talk to your customers about a disaster recovery / backup solution that is cloud-based and automatic.

I follow CompTIA, the IT industry trade association. If you are not a member, you should be. Their constituents are vendors, distributors like us, and they don’t even call them resellers anymore. They are MSPs. That is the functional state of the IT industry today.

The Managed Services model is described as “an ongoing, contractual arrangement in which the MSP remotely monitors, manages and updates a customer’s technology devices, infrastructure, systems, and services.”

Remotely monitors and manages are the key words here. As an MSP, you would negotiate a flat monthly bill with the customer, based on a service level agreement. Depending on what services they want and how much they can afford to pay, you could offer gold, silver, and bronze packages. Then, at least twice a year (and up to four times a year), you would meet with the customer to evaluate and suggest additional services. It gets the attention of the client when you say something like, “Here is what we’ve been doing for you. And now, honestly, you have used a few more services than we thought; so we think you should move from bronze to silver.”

That MSP model is common across the IT industry. But security integrators should think in terms of the MSSP, or managed security services provider. That is what your business model might look like. The managed security services provider has an ongoing, contractual arrangement in which the MSSP — that’s you — provides remote monitoring and verification (starting to sound more familiar, isn’t it?); video storage; and manages and updates a customer’s security devices, analytics, infrastructure, systems and services. Again, it is based on a flat rate, predicated on a service level agreement, and re-evaluated periodically.

There are reasons to start a transformation of your business. If you ask any successful MSP — and CompTIA says there are 125,000 IT infrastructure resellers and service providers in the United States — between 60 and 70 percent now claim to be MSPs to some degree. If you asked why they got started, the obvious answer is because “it keeps pace with the current trends.” You need to think about that, because the IT integrators are about five or six years ahead. Some of you probably are that person.

As you start to present these new service offerings to your customers, they may say, “We already have managed services for some of our infrastructure pieces.” This is not an enterprise-only offering; in fact, enterprises are the ones that are least likely to have managed services. Rather, small to mid-tiered businesses are going to be most invested in this concept.

CompTIA calls managed services the long-term lifeline of much of today’s IT channel. When I see those words — and I was on the board of directors of CompTIA a long time, and I’m in their MSP partners groups — I tend to believe what they say. Managed services are a sustainable, long-term business model.

How to start? Just basically make a decision. If you have a written business plan, add a new chapter to it: MSSP. Show it to your business partners and have some accountability about it so everybody knows this is what you are going to do. Show it to your sales team. Show it to your technical team. Explain, “This is where our future is and we’re all going to go there together.”

Focus on existing markets; you do not have to find a completely new customer set. Go to your very best customer and ask, “What would this look like between you and me, this managed services relationship, and how would we go about it?” He or she would probably say, “Where were you last year, or two years, or five years ago?” Start with a small portfolio, perhaps a couple of the core managed services.

Understand that you never stop being a VAR and you never completely become an MSSP. There are always steps along the way — and you may always be some of both. If you ask the most successful MSP on the planet, he’s going to say that he is about 70 percent managed services and about 30 percent project-based solutions. There is always going to be hardware to install on the site. Fortunately for us, who live in the outside ring of this IT infrastructure, we are the ones most protected and the least likely to ever go away. Figure out a way you can get a video stream without a camera and we’ll talk!

Your internal people will need to learn some new sales and technical skills. You will need a new compensation plan for sales representatives. That will be tricky, especially if your sales reps have gotten used to a big check after a project. You may need to compromise with them, or you may need to give them a little bump after their sale.

Go to the CompTIA website, www.CompTIA.org. If you’re not a member, you should join because it gives members tons of resources on how to become an MSP.

This is all about automated delivery, which brings efficiency and profitability. It is done with a couple of tools, one of which is called PSA, professional services automation software. Many security integrators may already run something like it. It gives you the ability to make sure that all of your technicians’ time is billed, and that everything is recorded in the system. It helps you with monthly billing and a lot of basic business management. It can help integrators automate their basic business model to come up-to-speed with this new delivery method.

Along with the PSA software is RMM, remote monitoring and management software. This is where the rubber meets the road. It is a tool that allows you to monitor the technology remotely. It allows you to check the health of a solution down to the particular device, whether it’s a wireless access point, a camera, a mobile device, a server, bandwidth — no matter what it is. It allows you to manage all of that remotely, providing alerts so someone doesn’t need to look at a screen all day. You can respond to those without your customer ever being aware that you’re doing it behind the scenes.

You can do the remote monitoring and management in your own network operations center. It doesn’t need to start expensively; it can start with your lead technician’s desktop PC. Alternatively, it all can occur in the cloud.

If you look at managed services from the IT perspective, you might see a long list of things such as:

• network management
• desktop management
• mobile device management
• email, intranet, Internet
• help desk/problem management, and more

They are all interesting things, but security integrators should focus on the category of Managed Services for Security Solutions, and specifically about managed security and video surveillance. These are services you can get from a partner, but you provide to the customer. Look for a white box solution, because you do not want your customer seeing someone else’s name on your managed service offering. You would label it with your brand.

Consider what happens if a particular camera loses video. Is your customer not going to know about that until it is too late, when they need the video stream but it’s not there? This is a perfect example, because you would be aware of it. You solve the problem. You go to the camera, log in, and do what you need to do to get the camera back online.

You can offer bandwidth management. Recall the solution you installed previously at those four stores. You calculated the bandwidth they would need, but they are over-using their bandwidth every month. Either you could give them more bandwidth, which is not a bad solution, or you could adjust the frame rate so the customer does not have to spend more money. That kind of an online, immediate response would be amazing to the customer, compared with what they are used to.

You can offer storage management. The customer subscribes to an exact amount, but it turns out they need a lot more or a lot less. As a provider of managed services, you would pay attention to that. By alerting the customer that they are using less storage than they are paying for and saving them money, you may just become their hero.

You can provide multi-site consolidation, offering customers the ability to manage all of their sites from one location. By providing periodic security assessments and adjustments, you can communicate information that will allow your customer to make adjustments and improvements to their security.

Wireless networks are involved in security solutions, and you should be able to provide remote wireless network management. There are many great wireless vendors. For example, Motorola has something called Wireless as a service, using a virtualized version of their controller; it’s in the cloud. You access it, and you manage the customer’s wireless network remotely. It’s a service you can provide on a monthly basis for a monthly fee.

Another one from Ruckus runs on a mobile device, such as a tablet. It gives you the ability to do these things, and it gives you some flexibility in managing that customer service.

Mobility is a hot topic and you should be able to take advantage of that by providing mobile device management. As mobile devices become a part of your physical security solution or your mobile wireless solution, you can be managing and monitoring it for your customers.

SOTI MobiControl, which ScanSource sells, is a mobile device management tool. It is also a remote monitoring and management tool. Once you are managing those mobile devices that are part of the security solution, why not manage that BYOD community that is part of the business? 

As you approach someone who is in their 30s — the decision-makers in your customers’ businesses today — they were born in the cloud. They have no concept of limitations on storage or mobility. As you enter that space, you cannot go through the door with an old business model. Instead, you are going to have to sell a solution that is relevant and clearly shows value to today’s business environment. Remote monitoring and management gives you a complete solution for that new generation of decision-makers. n

About the Author: Greg Dixon is chief technology officer at ScanSource Security Inc. He is also known affectionately as a “technology evangelist.”