Chris Catanzaro on Strengthening Channel Strategies and Risk Quantification in Cybersecurity | ROCon 2025

Hey everyone. We're back here at Qualys Rock on continuing our, uh, morning of the second day, uh, coverage. I wanna introduce you to our next guest.

Him and I were just, well, we went around the world talking Chris Catanzaro or Chris Catanzaro. Chris, how are you man? It's good to have Great you on Techstrong tv.

Yeah. You know, why don't you introduce yourself to the audience a little bit. Sure.

Tell him what you do here. Yeah. Chris Catanzaro, I run our Global Channels and Alliances program.

Um, I'm actually kinda new to Qualys. Been here about three months now. Um, and got got some big initiatives around trying to operationalize how we go to market through partners, GSIs, mss, bs the whole bit.

Absolutely. You know, Chris, I've been in the security game a long time. We were talking, every successful security company that I ever knew back then always had a very strong channel Yeah.

Program. A lot of them went a hundred percent channel. Yeah.

Right. And so just took the conflict out of it. I know talking to a bunch of the Qualys execs, there's a big emphasis on building up the, the channel here.

They have kind of a unique proposition though, because, you know, with this, well, we're here at Qualys Rock Risk Operations Conference, but this whole risk operations center, I, I love it, to tell you the truth. 'cause I've always thought it was about security's about risk. Right.

Managed risk. But I think it presents a unique opportunity for a channel in that the same way a lot of organizations just don't have the resources to run their own soc or knock. They don't have the resources to run their own rock either.

That's for sure. Yep. And so I'm wondering, is that, how does that fit into your plan?

Sort of like a, a managed rock provider? So M-R-S-M-R-M-R-O-C-M Rock. Oh, M Rock, okay.

There you go. Little Managed Rock Discover Center. Exactly.

So let, let's hear about moc man. Yeah. So it will be critical for our partners, um, all partners too.

So there's a lot of different ways that a partner can get involved. One thing is we can't really give somebody a rock. Like we can, we have the software that help you create, uh, that illusion of a rock, I guess.

Um, but the people who have to bring a rock to life is somebody else is gonna have to do, uh, risk quantification. Parts of it. Yeah.

You're gonna have to have some overlay of, you're gonna have to go classify all the data on the front end so you know where all the data is and what it's relative to. Then you're gonna have to quantify it on the back end. So once you all get it into the system, basically, then you have to layer over the financials.

And so we don't do that. Like, that's not our plan. We don't do services.

Right. Uh, we'll teach people how to do that, but we don't do the services. So that's a big opportunity for our partners in itself, right there.

And then the MO itself, there's lots of different things that, uh, should be done maintenance wise to bring that to life. And then some coaching things as well. Like, so one of the best things we could do with that MRO is give our customers a quarterly border for it.

How is my risk? Am I getting better with risk or worse with risk? And how am I focused?

How am I distributing my risk? Uh, it was on stage a little bit ago and I joked about this. I need a rock for my email.

Like, I wish somebody could tell me which email's more important 'cause it gets me 'em now. So it's funny you say that. I actually have an email program that that's what it, it attempts to do.

Nice. Yeah. It it, it puts email into buckets, whether it was from an individual person, a notification Yeah.

Or a newsletter, and then tries to prioritize based upon my past habits. Yes. You know, it's all AI enabled, right?

Yeah. It's learning and uh, it's learning. I gotta, it doesn't work so good.

Somebody's gotta figure that. But if they could, yeah. You would be both brother.

But that's what we're doing for risk, right? Yeah. We're helping you understand what risk is more important.

So if you have, um, $50 million of revenue being generated out of, uh, the United States and you have $10,000 of revenue generated at Italy, like we were just talking about, would you spend the same amount of time, uh, securing Italy today? You get alerts from everything and you don't really have much weight on which alerts are the most important ones. And if you could have those alerts come in, understand which ones have more weight to your output, you're gonna spend more time there.

So we risk score everything, right? We give everything a score from zero to a thousand. And if you had some with a risk score of 9,000 or 998, and then you had one of 750, which one do you fix first?

Well, people would say, oh, I fixed the 998. That's not necessarily true. You're gonna fix the one that's over the most, uh, value for your organization.

Right. You would think, yeah. You would help.

And that, and that is, that's, you know, definitely plagued security for a long time. Right. Prioritization.

Yes. Bang for the buck kind of decisions. Um, you know, you, you, you described I think, a great opportunity for a channel partner to help organizations get their rocks off the ground.

Yeah, for sure. Get their rocks off. Yeah.

It's probably not a good thing to say. There's many entendres you got. Yeah.

Right. Yeah. But I think there's another opportunity where just totally outsourcing your rock.

Oh, definitely. I mean, without question, there's gonna be organizations that would rather just have it outsourced. There're specialized resources.

And you see, I mean, that's why Soxs have, you know, managed stocks have been so popular. You get these great talented employees and they leave every 18 months. Absolutely.

You know, some bigger companies hiring 'em for a bigger title down the street, and you don't get that continuity. So continuity around the, the managing your, your risk would be the most important. So we actually think that whether you even have your own rock, you're gonna at least augment it with somebody else at a worse space.

You have to, I, you know, we were talking off camera, right? I, I helped Mike, one of the companies I co-founded become a managed security service provider. Right.

And I remember going through the exercise of how many people does it take to, to man a 24, 7 to 65. Yeah. What what's your answer?

I, we needed at least 23 people. Holy man. I was saying seven.

We used to say seven for, for 24 7. 24 7, 3 55, 5. We used to say seven.

How do you figure that? I don't remember. That was our big thing.

We needed seven people. I'll tell you real quick. Five days a week.

Yeah. Three shifts a day. Right.

But you were nicer to your employees. Yeah, well, you know, we tried, but, so you're making 'em work, you know, 12 hour days, so, and that No, no. We were doing eight hour day.

So it was three shifts a day, five days a week. So you needed like two extra shifts basically. And then you had to have an extra Oh, you let your people go on vacation?

Yeah. Yeah. We would, you know, we couldn't help it.

They it was a union state or something. Yeah, no, 23 is probably right. We, yeah, no, we had about 23.

We came up with seven would be your minimum that you could do follow the sun approach and you need two of 'em somewhere else. And, um, oh, that would, yeah. That was, well, no, we had people in, in the soc.

Oh. And that, that was part of it too. We had a secondary failover soc.

Yeah. Yeah. And those people on call.

But regardless, you're right to do all of the sun. It's a big job. It's not, it's not for the light of art.

You're probably way more. Correct. At 23 people.

I think seven would be a minimum if you had some experts and you might only allow one person to go on vacation every other year. Right. Or someone, and no one ever got sick and everything else.

Right? Yeah. Yeah.

We were, we weren't cutting it that close to the bone. Yeah, exactly. But if you do, if you do something once, you know, you're, you're gonna be, you're gonna learn a lot, right?

You do it one time. You learn a ton as you're doing. You try to build something, go to Ikea and try to build something from ikea.

You're like, oh, I wish I could do that over. Uh, absolutely. Uh, second time you build it, it's gonna be a lot better.

If you have twins, you probably get good at doing stuff. 'cause you have to build everything twice. Twice.

Uh, but when it comes to security operations, and especially managed risk, if you do it once, you're gonna be pretty good. If you do it a hundred times, you're gonna be fantastic at it. You're gonna know what to look for.

What's really a risk, what's not a risk. How does that impact my business? Is that relevant to my industry?

So what if it's a high risk, but what if it's only for manufacturing and I'm not doing, you know, I'm selling plane tickets or something. I'm not doing manufacturing. So I gotcha.

And, and, and there is, so that you do need some of that subject matter. Yeah. Right.

Expertise. Yeah. Specific.

Exactly. Um, Chris, I'm going to give you an opportunity to look in this camera. Yeah, yeah.

And talk to potential ROC partners out there about the opportunity, the kind of profile you're looking for, and, and you know, what, what, what's the end game? What's, what's in it for them? So I think if you got A-M-S-S-P today and you're doing manage, I'm looking at the camera now, now you Absolutely.

Yeah. He told me to. So I was saying if, uh, if you have a managed security service today, and you're managed like you're managing EDR for instance, or soc stuff, um, right now I'm seeing that as a race to the bottom.

I'm seeing people say, I can do it for $5, uh, per asset per month, you know, per month, per year, whatever. And it seems to keep going down. And people, I can do it for $4.

I can do it for $3. If you don't add true value on top of that, you're really, truly just at risk of somebody taking you out. It's becoming more commoditized.

So you need to think about what, how do you align with the business? The business is gonna be aligned at where do they spend their money and how do they assess risk. So if you already are doing like a managed DDR, you really should consider doing a M roc and m roc.

Like we talk about 'em almost next to each other. Like, you got a rock sock. Maybe think about it almost like a, a a, a little wedge on top of that, because you're gonna be doing some of the same things.

But what you really want to do is, is be able to communicate with your end customers, the investment they're making in you as the service provider and the investment they're making in the tools that they're buying and the investment they're making in their own businesses. And then be able to associate that to, are they doing better or worse because of you? I worked for an early, we were talking about earlier, I worked for an early, early, early days managed service provider.

And I had a customer, a big customer, and they unplugged their firewalls. We were managing firewall logs. They unplugged them.

We didn't know. Hmm. I remember that.

Yeah. Like we've, we've all seen stupid, right. How do you provide value though?

Like, you gotta provide value. And if you're just telling people like, oh, we blocked this many incidents, or we did this, you know, you haven't had a breach lately. Well, that's good.

Um, you gotta start that you know of. Yeah. You gotta start adding true value, which would be like, Hey, the value in this is we're telling you where your risk is.

We're helping you quantify that risk across your different domiciles and we're giving you a, a a a better or worse. Did I get better last month or worse last month? Absolutely.

And I think, so I think that's one of the things that separates sort of, uh, you know, the rock from the sock. Yeah. The sock is nothing happened.

So that's good. Yeah. Right.

With the rock, there's a little bit more, you know, the proverbial ROI calculator question Yeah. Involved there, right. Where we could show, Hey, this is your risk.

We could quantify that risk. We could put dollars and cents on it. And I think people appreciate that, especially non-security people.

Yeah. Right. Because non-security people, you tell them about how many vulnerabilities you found, how many remediated, how many threats you thwarted, what your firewall block.

It's all bits and bites to them. And a hundred percent. So I've got a buddy who's a CFO of a publicly traded company, and he was asking me, he goes, man, I spend all this money.

He goes, I buy all these tools. They're all awesome tools, right? Yeah.

And he was going down the list. I was like, Hey, you're doing good. Like, those are all good.

Oh, you've got great stuff. Top solutions. He goes, when does it end that?

What do I stop? But that's been the problem. Yeah.

Right down, man. We got ai, so we got more tools to buy. Yeah.

Just for the AI stuff. Yeah. You got, you could buy more tools just to have the AI manage No, but the answer to him, right, is he's, he won't care if it's just tools.

And a matter of fact, he's the CFO, so he is saying no. Now people are coming to him say, Hey, I need this tool. He is like, no, I bought, you bought tools last year.

Right. And now if you come to him as the CFO and you say, I've quantified the risk, I need to invest a little bit more in this identity and, you know, non-human identity solution, he's gonna say, okay, why? Well, I've quantified my risk and this will lower my risk score and it will protect us in a much greater way than we were today from ai.

Right. You can actually contextualize it. That CFO's gonna give you a check again.

Yep. But you're not gonna get anymore if you go back and you say, I gotta have no, if the old boy's not gonna work, you gotta show, look, you have $10 million at risk. Yeah.

This lowers your risk by 20%. 20% of 10 million bucks. And, and the solution costs 2% of 10 million and nobody's doing it.

Like honestly, nobody's doing it until now. And I talked to that same friend. I said, well, this is what I'm doing now.

He's like, done, fortunately he's already a customer, but he's like, sign me up. No, no. But that, but that's the language They understand the language they speak.

Yeah. He says, sign me up and, and I want more integration and I want to talk to your leadership more. Uh, you know, I wanna be more aligned with a company that thinks that way.

And you're gonna help me, uh, make more sense of my investments in that, in that van. Well, yeah. Blank check for 20 years, right?

Like it was a long time. Well, that's what's been going on for the last, right. We keep buying new drinks.

Thank God I've been in this industry for 20 years. You and me both. I gotta really earn my, uh, now.

Well, but now you got something new to sell, Chris, man, good luck. Pleasure on board here at Qualys. Keep it up.

Hey, if you're interested in being in M Rock, check Chris out. Yep. Um, we're gonna take a break.

We're still live here. We got one more interview I think before lunch, and then we'll be back. You're watching Tex on tv.