What is our primary use case?
I used it in my previous company. I was heading up sales and doing research into new solutions for a team of four on-the-ground people. We leveraged ConnectWise as our network operation center, security operation center, and help desk. We wanted to stop people from experiencing ransomware. We wanted to protect them.
What is most valuable?
The recovery time objective and recovery point objective were most valuable. It was easy to use, and it was easy to recover a file. I was the head of sales and a product evaluator for an MSSP, so I never had to deal with recovery from ransomware. However, I was confident that if ransomware had occurred, I would only lose a maximum of 59 minutes of data. The files were encrypted.
Their support was exceptional. They were always very responsive, and the escalation process was extremely easy.
What needs improvement?
It is being improved daily, but of course, there is always room for improvement because cybersecurity changes all the time in terms of the attack factors from the different cybercriminals. At the time I was using it, I would've focused more on signatures of malicious software in the cloud. I love Datto, and I know they're on the right path, but I probably would've focused more on the operating system update management. When you go from the desk to the cloud or from the server room to the cloud, everything changes. Everything is different. You're not in control of your servers anymore. It is from the Active Directory management perspective and not from the perspective of zero-day attacks or other similar things. At the time, more focus on zero-day attacks and business email compromise (BEC) would've been a better protection factor than just educating about how many of these attacks have occurred. Cybersecurity runs deep and long. There are a lot of different facets. There is a lot of hype about a specific zero-day attack or a specific vulnerability, such as whether it is a Microsoft operating system attack, or it is an Oracle attack, or it is a takeover of your update server. You hear all that stuff with the big breaches. At the smaller level, it's basically ignorance. So, you need a better understanding of what steps an MSP or MSSP can take to protect their clients as compared to just giving them a warning.
I don't want any additional features, but I want to keep the same security-minded management and product development team in place. Datto has now become a public company. Things change when you're a public company. There are multi-levels of management, but the company was never managed that way. It was managed as a private company—a very successful private company. So, the intricacies of being public should never get in the way of the original vision of the company to be an MSP-only company providing MSPs-only solutions. I believe that there is a community of about 300,000 people who do business with Datto, and they would agree with me.
For how long have I used the solution?
I have been using this solution for about eight years.
How are customer service and support?
On a scale of one to five, I would rate them a five out of five. They were always very responsive, and the escalation process was extremely easy. If you're dealing with a vendor who has a responsibility to care for your customer's data, understanding the escalation process is imperative. For example, if I'm dealing with IBM for protecting my clients, it is a bit of a tangled web to get to a proper escalation process. Every second is another conceivable $1,000 for a company in stress or peril, whatever you want to call it. There could be some catastrophic failure of a backup. A lot of times it is simple stuff where somebody upgraded an operating system without permission from the security operations center. So, the ability to escalate and have people who understand what's going on to resolve that issue is imperative. I was working with an MSSP that did $190,000 a month. So, choosing a partner is imperative to understand not only what that partner's solution is, but also the following:
- Where is the value when something goes wrong?
- Where is the response?
- How does the escalation process work?
- What do I do if there is a problem with the service you're providing me?
Being a partner-only company and selling to a partner-only company, Austin and the other original members of Datto clearly understood that the escalation process needs to happen rapidly and effectively. I would also lend that to their account management side. It was easy for me to escalate up three levels if I ever needed to. I didn't really need to, but it was easy. I had access to say that I've got a problem here, and it is not being fixed. My client is in pain, and I need it fixed now. When that message got delivered, it was addressed immediately.
Which solution did I use previously and why did I switch?
In 1995 or 1996, there were a lot of solutions that were focused on cybersecurity, but they only had the ability to notify you if something went wrong or they suspected that something went wrong. If you were a decent-sized company, you had to put your security operations team on it to understand what went wrong. In 2005 or 2006, when I started at my previous company, I was responsible for business development and growing their business. I was also responsible for evaluating or recommending new products to bring on board and turn them from a managed IT services provider to a managed IT services and cybersecurity services provider, which I did successfully, but there were so many companies that were in the legacy that just notified you of a problem. Datto not only notified you of a problem, but they also worked to resolve it without your intervention. So, that's what I brought on board.
What's my experience with pricing, setup cost, and licensing?
As the company grew from business continuity—or what used to be called business BCDR—they brought on services. Certain services, such as SaaS protection, were a value-add, but you would expect to pay for them. They are not going to be free. It is just the life that you live when you're evaluating software vendors, partners, etc. There is going to be some form of a base offering, and then there are going to be different tiers that you need to get up to a better level.
Based on my 28 years of experience in this business, Datto was the very best at taking care of its partners. As you achieved different tiers, you were rewarded—it could be a nice dinner for your team, or it could be a deeper discount on the charge per month for the backup. They were always very effective at enticing or enhancing and bringing on new offers to keep their partners growing.
What other advice do I have?
Ransomware and attacks on the infrastructure seem to be what's on everybody's mind today, but the truth be told, business email compromises cost more money last year than ransomware. If you want to balance your approach to protecting a client, you need to understand the key points for protecting your client. Datto has partnered with a company, which I don't really like, for cybersecurity awareness training. That's very important because social engineering or business email compromise is going to be a huge issue. You need to know how to fight that. We all know the human firewall is the weakest point in our link. I could sell you $6 million worth of software and specialized hardware, but if you're not changing the thought process of your employees or the people who are working for you to recognize social engineering, which is basically business email compromise, you're not protecting the weakest link in the chain. The least educated are the employees. If you want to put together a cybersecurity stack that works, you need to incorporate all different facets, such as multi-factor authentication, password management, and timeouts or limits on failed password authentication. However, when you have all these restraints on your employees, it's somewhat uncomfortable. So, you got to force that down to the sea level and say that this is how I'm going to help you. Without proper education about malware, business email compromise can't be avoided. For example, about two years ago, a client transferred $275,000 to an account through the electronic funds transfer. If they had recognized the faults in the email, they never would've done anything. They would've said that this is a lie, and an attempt to steal. The ability to recognize what's conceivably wrong with that text or that email is imperative. It is an imperative piece of the whole cybersecurity stack.
I would rate this solution a 10 out of 10. They are laser-focused on bringing forth proven protection technologies and stopping cybercriminals from being able to breach, break, steal, or compromise your data.