Signed

Hosted by ITBroker.com

Technology News

Website RSS feed

Episodes

228

Latest episode

Oct 2026

Language

About the show

The IT market is built for sellers, not buyers. That's why 80% of tech buyers regret their last major purchase. Deals take longer than they should. Teams get locked into platforms that don't fit, contracts they can't escape, and vendors they wouldn't choose again. The pitches, demos, and analyst reports are built to close deals, not help buyers make the right one. Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, talks with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals — the ones who can explain what actually determined whether the deal worked. Plus weekly Playbooks breaking down the moments that matter most: renewals, M&A, compliance mandates, office moves, budget cuts, and the specific plays that separate buyers who get it right from those who regret it. If you're responsible for choosing, negotiating, or living with the consequences of enterprise technology, this show is for you. New episodes weekly. An ITBroker.com podcast.

Listen to episodes

60 recent

October 13, 2026Episode 2291 hr 37 min

What AI Is Doing in Your Company (That You Don’t Know About)

Steve Wilson built his own AI assistant the careful way. He gave it its own Google account and read only access to his calendar, and told it not to talk to strangers. His company's CISO had a pen testing team go after it, and 4 days later the assistant reported that it had compressed his source code and attached it to a meeting with an outside consultant. A fake email from a lookalike domain, written as if it came from Steve, was all it took. Steve Wilson is Chief AI and Product Officer at Exabeam and founder and co chair of the OWASP Gen AI Security Project. He joins Max Clark to break down what AI agents are already doing inside companies, who is responsible for them, and what to check before you approve one. They get into why an agent using an employee's login is its own identity, why you can't filter prompt injection out, why blocking AI tools only sends people around IT, and what Steve's forecast of 10x the digital workers and 10x the attacks means for security teams. If nobody at your company can say which AI agents are running and who answers for them, this episode starts there. What You'll Learn What are the biggest security risks of AI agents inside a company? How do we know what AI agents our employees are running? Should an AI agent use an employee's login, or have its own identity? Who is responsible when an AI agent does something it shouldn't? Can an AI agent be tricked into leaking company data? Can you stop prompt injection with a filter? Should we block employees from using AI agents, or approve one and manage it? Can AI help a security team, and what does it do in the first minute of an alert? In this conversation: (00:00) - Intro (00:44) - What an AI agent does in the first minute of a security alert, so a human starts with a finished investigation (11:51) - Steve's two-year forecast: 10x more digital workers on your network, 10x more sophisticated attacks, 100x the data to sort through (19:30) - Insider threats now include AI agents that malfunction or go off course (37:41) - Blocking AI just sends people around you. Approve one tool and manage it instead (44:04) - The three kinds of AI agent in your company, and why you can't filter prompt injection out (49:32) - Who owns an AI agent: security, IT, the business, or the employee who built it (56:10) - He gave his AI assistant its own identity and limited access. It still got phished (01:02:44) - Shadow AI spreads faster than shadow IT, and your approved tool gets abandoned (01:22:53) - Why AI won't shrink your security team, and the entry-level hiring gap it leaves (01:31:48) - AI is moving back in-house, and what that changes for security What We Mentioned The Developer's Playbook for Large Language Model Security (O'Reilly) . Steve's book. It lays out what can go wrong when AI is built into products and how to defend against it, drawing on the 400+ experts behind the OWASP Top 10 for LLMs. It is written for developers and security teams, and it is the plain language reference if AI agents already have access to your systems. OWASP Gen AI Security Project OWASP Top 10 for LLM Applications Exabeam Exabeam Nova , the AI agent built for security operations centers OpenClaw , the open source AI agent Claude Code Claude Cowork OpenAI Codex MCP (Model Context Protocol) , the way software lets AI agents use it Salesforce Microsoft SharePoint Okta CrowdStrike Palo Alto Networks Cortex Microsoft Sentinel Dropbox , Steve's early example of shadow IT SOC (security operations center) SIEM (security information and event management), the central system that collects security data MSSP (managed security service provider) MDR (managed detection and response) EDR (endpoint detection and response) Prompt injection (hidden instructions an AI follows as if they were yours) Pen testing (authorized attacks used to test your defenses) About Steve Wilson Steve Wilson is Chief AI and Product Officer at Exabeam and founder and co chair of the OWASP Gen AI Security Project. He wrote the first OWASP Top 10 for large language models and the O'Reilly book The Developer's Playbook for Large Language Model Security. Steve Wilson on LinkedIn | Steve Wilson on X | Exabeam | Exabeam on LinkedIn | OWASP Gen AI Security Project | OWASP Gen AI Security Project on LinkedIn About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

October 6, 2026Episode 22818 min

Playbook: Cybersecurity Truths

Before you compare a single vendor, a lot of the decision is already made. The systems you run today rule some platforms out, and the choices you make now decide whether a requirement three years from now means adding a license or replacing something the business runs on. In this Playbook, Max Clark, CEO of ITBroker.com, answers a question he was asked directly: which is harder, brownfield or greenfield? Brownfield means building on systems you already have. Greenfield means starting from nothing. Max walks through why your existing setup narrows your options more than any feature comparison or RFP, what to plan for when you're starting fresh, and why each situation needs its own approach. What You'll Learn How to tell if a new platform will work with the systems you already run How your existing technology narrows your vendor options before you compare them What to plan for when you're choosing IT infrastructure from scratch How to plan infrastructure for the next three to five years of business growth How to avoid buying technology you'll have to replace later Why brownfield and greenfield projects need different buying approaches Answer These Before You Compare Vendors What does a new system have to work with? List the hardware you plan to keep and the platforms it has to connect to, like Microsoft 365 or Google Workspace and your CRM. A vendor that can't support something on that list is either out or carrying a replacement cost. Which of those are you willing to replace? Some older equipment is worth replacing anyway. Decide that before the demo, so it's in the vendor's price instead of showing up during the rollout. What does your business plan say about the next three years? New locations and new compliance requirements change what your platform has to support. Write them down while they're still plans. If one of those happens, is it a license or a rebuild? Ask this about every platform you're considering. A feature you can turn on is a line item. A core system you have to replace is a project. If you can't answer two of these in writing, you're not ready to compare vendors yet. Max walks through both sides in the episode. The Playbook (00:00) - Intro (00:41) - The mistake: treating insurance's four checkboxes as the finish line (04:22) - The play, step 1: what security buyers skip past SWG, CASB, and ZTNA (09:07) - The play, step 2: what actually gets security budget approved, and why ROI is the wrong pitch (13:19) - The play, step 3: test your backups before you need them (14:38) - What to watch for next: measuring security by detection and containment speed, not tools bought Resources Mentioned Microsoft 365 and Google Workspace , Max's first example of a decision that already limits which platforms fit Salesforce and HubSpot , the CRM choice that shapes what you can layer on top of it Unified communications (UCaaS) , the phone system category in Max's example of checking a new platform against the hardware you already own About Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format: one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

September 29, 2026Episode 22711 min

Playbook: CSPs

Buying Microsoft 365, Google Workspace, or Azure direct feels like the simpler choice, until you need support or get locked out of your own tenant. In this Playbook, Max Clark breaks down what a Cloud Solution Provider (a CSP) actually does between you and the platform: faster support and escalation, help recovering a locked tenant, engineering and migration support, and access to vendor funding you can't reach on your own, usually at little or no added cost. If you're deciding whether to buy direct or through a CSP, or renewing that decision without ever having checked it, this one's for you. The Playbook (00:00) - The cold open (00:51) - What a CSP actually is (01:29) - Why Microsoft and Google aren't built to handle support directly (01:55) - Where a CSP actually sits between you and the platform (02:24) - The market development and incentive funds vendors push through CSPs (03:19) - The dedicated admin account problem most companies skip (04:17) - The real causes of a tenant lockout (05:14) - How being a sub of the CSP changes your escalation path (06:11) - The engineering, migration, and configuration work a CSP's own staff can do (06:38) - Why CSPs range from pure billing pass throughs to full service providers (07:03) - Tier zero versus tier one support (08:26) - The difference between support built for end users and support built for admins (09:25) - Why CSPs get paid through the platform's margin (10:17) - Max's bottom line: why the CSP relationship is worth having almost every time About Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

September 22, 2026Episode 2261 hr 53 min

Did You Choose Cloud for the Wrong Reason?

A customer walked in sure they wanted colocation. The quote in their head was $10,000 a month. Once Jeremy Pease's team modeled the real requirements, staffing, connectivity, compliance, the number came back at $80,000. Jeremy Pease is CEO of Aptum, a hybrid multi cloud managed service provider. He joins Max Clark to break down how IT leaders should actually decide where applications run, across public cloud, private cloud, colocation, and bare metal, instead of starting with the platform and working backward. They get into egress costs that can exceed the infrastructure bill itself, the VMware exodus ahead of the April 2027 contract deadline, why most companies are running workloads at a scale they never needed, and why repatriation almost always requires someone willing to make the unpopular call. The question isn't whether you negotiated a good rate. It's whether you're on the right infrastructure in the first place. What You'll Learn How to tell if a workload actually belongs in public cloud, private cloud, colocation, or bare metal Why egress fees, not compute, are often the real driver of a surprise cloud bill What's forcing companies to leave VMware before April 2027, and what it actually costs to stay Why "multi cloud" rarely means what the marketing implies How to build the ROI case your own IT team can't build for itself What a real disaster recovery conversation looks like once the price tag is on the table In this conversation: (00:00) - The colocation quote that changed after the real requirements came out (00:53) - Why the application should dictate the infrastructure, not the other way around (04:16) - The myth that cloud is automatically more secure or compliant (06:15) - Why shared cloud workloads create a real compliance gap (08:11) - The five Cs: cost, compliance, customer service, complexity, and visibility (09:27) - Gently explaining to a customer that their plan is wrong (10:42) - When a board mandates cloud migration without understanding the tradeoffs (13:17) - Why small IT teams can't manage what they've been told to run (15:03) - Patching still exists in the cloud, just under a different name (16:14) - The rise and quiet retreat of the multi cloud pitch (20:38) - How much of infrastructure strategy is really about a toxic relationship with IT (22:15) - Running infrastructure alone for six of the largest US banks on $130K a month (26:25) - Ad tech, real time bidding, and why egress became the real cost center (27:13) - Internet connectivity now costs more than the infrastructure itself (29:03) - FinOps isn't cost control, it's just explaining the bill (31:54) - Why repatriation needs a founder willing to make the unsafe decision (32:56) - The cloud spend threshold where a real conversation starts (35:44) - Data sovereignty, the US Cloud Act, and owning entities by country (37:01) - The EU tiers where US controlled infrastructure becomes disqualifying (40:12) - Is data sovereignty the real trojan horse for repatriation (43:02) - Aptum's seventy two to seventy five percent average cost reduction (43:48) - Walking a repatriation curious customer from first call to signed contract (47:13) - Why some staff can't follow the migration to a new platform (48:11) - Cloud as the ultimate expression of tech debt (50:38) - Why your AWS account team is incentivized to grow your bill, not shrink it (52:23) - A CEO's gross revenue cloud spend becoming a business viability problem (53:31) - Why finance teams hate the cloud: no control, no predictability (55:11) - What people get wrong about disaster recovery in the cloud (58:48) - Why dedicated DR instances still cost less than running them live (01:00:27) - The real question for any circuit: more or less than $500 a month (01:02:12) - Why some customers blame the public internet for problems they chose (01:04:33) - The coming skills gap: why electricians are becoming the new high demand hire (01:07:09) - Being an expert generalist in a market that rewards niching (01:11:01) - Nine hundred and sixty seven vendors, narrowed to eighty two (01:13:41) - Controversial take: IT is a solved problem, most issues are self inflicted (01:15:32) - Shadow IT and the spreadsheets built because IT wouldn't touch it (01:19:27) - VMware's relevance after the Broadcom price increases (01:20:39) - The Oracle playbook: raise prices until only the trapped customers remain (01:23:19) - What April 2027 actually means for every VMware contract (01:25:36) - What percentage of VMware customers actually use its differentiators (01:29:31) - Migrating off VMware: where the majority of workloads are actually going (01:32:15) - Short executive tenure and who's left holding the decision (01:34:19) - The customer who insisted on colo, until the real number was $80K a month (01:36:29) - Nobody cares about the technology, they care what it lets them do (01:38:10) - Building the ROI presentation the IT team can't build for themselves (01:40:44) - Helping IT teams speak board, not just TCO and ROI (01:42:49) - Aptum's real ICP: one to three thousand employees, five to ten IT staff (01:43:47) - Migration work versus simply needing an expert to run it (01:48:01) - Efficiency and specialization: why selective outsourcing wins at scale (01:48:46) - Self serve without losing control: automation when they want it, service when they need it What We Mentioned Aptum AWS Microsoft Azure Google Cloud VMware (now part of Broadcom) Broadcom Nutanix Proxmox Zerto Megaport Equinix Digital Realty Netflix (one of the earliest and most public cloud repatriation cases) Dropbox FinOps EDP (Enterprise Discount Program) RI (Reserved Instance) RTO / RPO (Recovery Time Objective / Recovery Point Objective) DR (Disaster Recovery) About Jeremy Pease Jeremy Pease is CEO of Aptum, a global hybrid multi cloud managed service provider. He has more than two decades of experience leading data center, cloud, and managed infrastructure businesses, including executive roles at Hivelocity, Colohouse, DataBank, and Aptum. Jeremy Pease on LinkedIn Aptum About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom

September 15, 2026Episode 22516 min

Playbook: Buy on Purpose

You didn't choose your cloud provider. You inherited it, from whoever picked the safe option first and called it a decision. In this Playbook, Max Clark, CEO of ITBroker.com, names what that habit actually costs: three decades of consensus defaults, from the dot com era stack to LAMP to AWS's US East 1, and what the buyers who never questioned any of them paid for it, including the 15 hour outage this past October that took down Snapchat, Venmo, and a foreign government's tax site along with them. One question either ends the habit or exposes that you've never really made this decision at all: compared to what? The Playbook (00:00) - Why "nobody gets fired for buying IBM" still runs every enterprise tech decision (01:28) - The mistake: the consensus default isn't neutral, it's the product the market is built to sell you (03:05) - Proof from history: the safe choice and the weird choice have traded places twice before this one (04:37) - Today's default: AWS, US East 1, and what the October 2025 outage actually cost the buyers who never questioned it (06:32) - The play, step 1: the average cost structure you guarantee yourself by matching every competitor's stack (08:00) - The play, step 2: the cloud flexibility trap, committed spend agreements, and what cockroach mode actually protects (08:57) - The play, step 3: a16z, 37signals, and Netflix chose three different answers, on purpose (13:51) - What to watch for next: this isn't anti-cloud, it's anti-default (15:00) - The buyer's job: ask "compared to what?" on every consequential decision Resources Mentioned Andreessen Horowitz, "The Cost of the Cloud: A Trillion Dollar Paradox" (Sarah Wang & Martin Casado, 2021) 37signals / DHH's public cloud exit writeup (Basecamp, HEY) Netflix Open Connect Dropbox's pre-IPO infrastructure buildout AWS US East 1 outage, October 2025 Further reading: Most of Your Infrastructure Can Be Standard. Some of It Shouldn't Be. — the six-part decision filter for identifying which infrastructure choices actually deserve a comparison against the default, built directly from this episode About the Show Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today’s Playbook is one you’re facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

September 8, 2026Episode 2241 hr 59 min

How to Tell If Anyone Is Actually Managing Your Technology Spend

A 270 line wireless account doesn't look like it has much room for savings. It had $4,000 a month sitting unnoticed, almost $40,000 a year, nobody had looked closely enough to catch it. Tommi Ellis is Channel Director at Intratem, a telecom and technology expense management company built on auditing invoices against the contracts, inventory, and usage behind them, not just processing the bill. She joins Max Clark to break down why invoice approval and invoice validation are two completely different jobs, and why almost nobody is doing both. They get into what actually happens when an employee's personal device gets pulled into a legal discovery request, why POS line replacement generates more noise than it deserves relative to its actual cost, and why the biggest myth about outsourcing this work is that it threatens somebody's job. What You'll Learn Why invoice approval isn't the same as invoice validation, and what gets missed in between What size company actually needs a dedicated TEM function Why BYOD stipends create more legal exposure than most IT teams realize How to spot a vendor that says they manage your telecom spend but doesn't actually do it well The five questions that actually matter when evaluating a TEM provider Why POS line overbilling keeps slipping past companies for years at a time In this conversation: (00:00) - Cold open: the $4,000 a month hiding on a 270 line account (03:24) - What TEM actually means, beyond telecom cost cutting (05:51) - Who the real customer is inside the company: IT, finance, or both (08:00) - Why bills are wrong so often, and why carriers are slow to fix their own mistakes (10:54) - Why the fear of outsourcing fades once a company sees real savings (13:36) - From telco to wireless to SaaS: how TEM kept being renamed (16:27) - How AI license waste mirrors old wireless waste, and what size company actually needs a TEM (19:14) - Why in house control rarely means real control (22:26) - Stackable services: how mobility work turns into wireline and MDM work (24:43) - Why MDM deployment is still scary, even when it's the right call (28:49) - Why bills are wrong so often: disconnects that keep billing, and bad tax codes (31:17) - Why first bill reviews exist, and what they usually catch (36:08) - The lifecycle problem: phones in a drawer, and what nobody reclaims (36:47) - Help desk as an untapped part of TEM, and what it actually solves (39:26) - The hidden cost of sending an employee to the Apple Store (41:05) - BYOD vs. corporate owned: where companies actually get into trouble (44:43) - Why e-discovery is the real argument against personal devices for work (46:39) - Spoliation: the legal risk of not being able to produce an employee's device (52:10) - How MDM solves geolocation, not just security (54:49) - Does a company need a TEM and FinOps separately, or do they merge (59:30) - Why visibility, not cost cutting, is the actual product (01:01:39) - Reinventing the same IT problems generation after generation (01:03:42) - Top three onboarding mistakes: HR feed delays, "we're already optimized," and fear of being audited (01:07:15) - Do companies negotiate good contracts and then just stop enforcing them (01:08:22) - The biggest myth about TEM: that it replaces someone's job (01:10:41) - Spotting a partner who says they do TEM but doesn't do it well (01:14:10) - What a real first 90 days of onboarding actually looks like (01:16:57) - Reconciling four different sources of truth down to one (01:20:20) - What a human account manager actually does that software can't (01:22:13) - How a people led business scales without losing the human part (01:24:23) - Who actually receives the invoice, and who pays it (01:27:32) - What's included by default versus what's billed as an add on (01:29:32) - Rip and replace versus optimizing within what a client already has (01:32:38) - Why TEMs and aggregators solve the same problem but bill differently (01:34:00) - Does the customer relationship change once the big first year savings are gone (01:38:21) - How the TEM and carrier relationship is quietly changing (01:40:10) - Who actually signs the check: IT, finance, or a split (01:42:07) - What a good channel partner does that a mediocre one doesn't (01:43:48) - The five questions that actually matter when evaluating a TEM (01:45:54) - The biggest red flag: a vendor that leads with the portal (01:46:26) - What protections to put in a TEM contract, including term length and exit clauses (01:48:06) - Private equity's growing interest in TEM, and what that means for customers (01:51:20) - The $2,000 a month POS line nobody noticed (01:53:21) - Why POS line retirement keeps getting delayed, even when the carrier wants out (01:55:13) - Why POS lines get disproportionate attention next to the bigger problems (01:57:18) - Speed round: broken billing systems, the best unused negotiation lever, iPhone vs. Android cost, and 30 years of career advice What We Mentioned Intratem Verizon Wireless AirTouch Cellular ServiceNow Microsoft 365 (E3, E5) MDM (Mobile Device Management) BYOD (Bring Your Own Device) MACD (Moves, Adds, Changes, Disconnects) TEM (Telecom/Technology Expense Management) FinOps e-discovery and spoliation POS lines (Plain Old Telephone Service) LOA (Letter of Authorization) About Tommi Ellis Tommi Ellis is Channel Director at Intratem, where she was brought on to build out the company's partner and channel program. She spent 20 years at Verizon Wireless, first in retail stores and then as a corporate trainer, before moving into telecom and technology expense management. Intratem positions itself as human led and data backed, auditing telecom and technology invoices against the contracts, inventory, and usage behind them rather than just processing the bill. Tommi Ellis on LinkedIn Intratem About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

September 1, 2026Episode 2231 hr 43 min

How to Tell If Your MDR Provider Will Actually Stop an Attack

You're paying an MDR provider to protect you. Most of them will alert you and wait for someone else to act. This conversation names the one question that tells you which one you actually bought. Know the answer before it's 2am and someone's waiting on you to decide. You signed a contract for managed detection and response. You assumed that meant somebody would step in and stop an attack while it was happening. For a lot of MDR providers, what you actually bought is guided remediation. They find the incident, tell your team what to do, and hand it back to you to execute. That distinction is the entire reason you're paying for this instead of running it yourself, and most buyers don't find out which one they signed for until they're the one on the call at 2am being asked what to do next. Miles Lowry, Senior Territory Manager at eSentire, has sold cybersecurity from every seat in the market, VAR, Nutanix, Rubrik, and eSentire, and he walks through the one question that exposes the gap before you sign. This conversation also covers where the same blind spot shows up everywhere else in a typical MDR evaluation. Buyers send RFPs to eighteen vendors and get eighteen generic capability dumps back instead of a real fit assessment. Rules of engagement quietly change depending on whether the compromised machine belongs to your CEO or your help desk. It also gets into DLP requests that get approved without anyone defining what they're actually trying to stop, and security licensing already sitting in your Microsoft contract that almost nobody has turned on. The buyers with the best MDR outcomes never send a broad RFP at all. Miles names the one question he says he'd ask first if he were sitting on the buyer's side of the table. Know the answer before it's 2am and someone's waiting on you to decide. Want the exact test to run against your own contract? Read the full breakdown: How to Tell If Your Managed Cybersecurity Provider Will Actually Respond During an Attack. What We Get Into (00:00) - The rules of engagement: isolating a device when the CEO's machine is ground zero (00:37) - From VAR to vendor: 14 years across VAR, Nutanix, Rubrik, and eSentire (01:27) - How selling changed when hardware became a subscription (08:40) - What to size up on a first call, and why the customer is the biggest liar (13:22) - Selling cybersecurity to someone who isn't actively shopping for it (17:21) - Why "dragging them through the glass" backfires, and what works instead (21:14) - The real disconnect between sales leadership and what a rep can actually sell (25:08) - Why buyers now know what they want, but just want to pay less (30:35) - What's actually driving purchases: compliance, not fear (32:49) - The RFP pet peeve, and why AI is now writing most of them (41:21) - Why "how much data do you have" is a trick question, and the shift to unlimited SIEM (47:50) - The biggest buyer mistake: "just tell us everything you do" (54:04) - Who should be in the room on the buyer's side and almost never is (01:01:49) - Guided remediation versus an MDR provider that actually takes the response (01:10:43) - What a buyer's team composition reveals about how the deal will go (01:19:32) - Gartner invented SSE and SASE, and now admits MDR is just as muddled (01:31:52) - Microsoft E5 entitlements nobody turns on, and the hardening gap (01:38:29) - The two-to-three-year stale relationship problem, and re-selling existing clients (01:42:33) - Closing: AI, junior analysts, and the CNC-machinist parallel What We Mentioned eSentire CrowdStrike (Falcon Complete) Sentinel One Fortinet Palo Alto Cortex Microsoft Defender, Sentinel, and Entra Nutanix Rubrik Veeam Gartner NIST CSF Log4j Tenable About Miles Lowry Miles Lowry is Senior Territory Manager at eSentire, where he works directly with security leaders on managed detection and response. He's spent 14 years in enterprise technology sales, moving through VAR, Nutanix, Rubrik, and now eSentire, giving him a rare, direct view into where buyers get MDR wrong before they ever sign. LinkedIn: https://www.linkedin.com/in/cloud-ai-expert/ Company: https://esentire.com About Signed Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly. Listen: itbroker.com/podcast About Signed The IT market is built for sellers, not buyers. Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised. New episodes weekly. An ITBroker.com podcast. Full Transcript Click here to view the episode transcript.

August 25, 2026Episode 2228 min

Playbook: Cloud Cost Ownership

A VP spent weeks building a plan to cut an eight figure cloud bill. He walked into one meeting with engineering. Three words killed it: not my KPI. The bill lands on whoever gets handed the mandate to cut it, but the authority to actually change it sits with someone else entirely, usually engineering, whose time is already spoken for by other priorities. A FinOps platform will find you the free money, orphaned resources, idle instances, the stuff nobody has to defend. It won't touch the savings that require someone to decide engineering's time is worth spending on this instead of shipping. Run this before you spend a dollar on another cloud cost initiative Name the owner of the cost. Whoever's name is on the number when it climbs, that's accountability. Name the owner of the fix. Whoever controls the roadmap and the sprint, that's authority. Check if they're the same person. If yes, you have a real cost cutting project. If no, "not my KPI" is already on its way. Check if the cost is tied to margin, not just revenue. A product can bring in real revenue and still be a bad bet once its true cost is on the table. Revenue won't show you that. Margin will. Check if that picture reaches the executive team. Visibility only moves the decision if it lands with the people who can reprioritize across teams. If items one and two name different people, and item five has no answer, you're looking at an org chart gap. No FinOps platform touches that. Map who actually holds the authority before you spend the next dollar. The full checklist, plus the question most teams skip, is here. You can buy the platform. If the wrong person still owns the decision, the bill doesn't move, and now you've paid for the privilege of watching it not move. The Playbook (00:00) - Intro (01:29) - The trigger and why it matters (02:54) - The mistake most buyers make (05:19) - The play, step 1 (05:48) - The play, step 2 (06:17) - The play, step 3 (07:13) - What to watch for next Resources mentioned FinOps platforms, the cost visibility tools that surface idle and orphaned cloud resources Cost tagging systems, deployed across cloud and data center infrastructure to compare spend apples to apples About the show Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

August 18, 2026Episode 2218 min

Playbook: Finding the Truth When Everyone Is Lying

Every vendor stretches the truth somewhere in your sales process, and most buyers respond to all of it the same way, forgiving everything or torching a good deal over nothing. In this Playbook, Max Clark sorts vendor lies into three categories, a harmless stretch, one rep's invented promise, and a lie the whole company stands behind, and gives a different response for each. Then he turns the mirror on buyers, the shopped quote, the invented deadline, the fake executive sponsorship, because buyers run the same three plays back. Keep guessing which lie you just caught, or put someone neutral in the room who ends the guessing entirely. That's the only fix that actually works. Run this the next time a vendor claim doesn't sit right Creative embellishment. The provider is stretching into a category they do not quite fit, out in the open. Calling a router with a config page "SD WAN" is the pattern. Costs you nothing to see through. Note it, move on. One rep's invention. A specific promise nobody at the company authorized. "I text the CEO directly" is the tell. This is a person problem, not a company problem. Get a different rep, do not walk from the vendor over it. Institutional fiction. The whole sales org repeats the same claim with a straight face, and leadership blessed it. When the dishonesty is the official story, that is the provider you cut. Now run your own last vendor call through the same three buckets, from the vendor's side of the table. Telling three competitors they're each the front runner, that's your version of Bucket 1. Inventing a deadline that doesn't exist to force urgency, that's Bucket 2. Claiming executive sponsorship that doesn't exist because your whole team has quietly agreed to say it, that's Bucket 3. Keep guessing which lie you just caught, or put someone neutral in the room who ends the guessing entirely. That's the only fix that actually works. The Playbook (00:00) - Intro (01:07) - The trigger and why it matters (02:47) - The mistake most buyers make (03:16) - The play, step 1 (03:46) - The play, step 2 (04:14) - The play, step 3 (04:31) - What to watch for next Resources mentioned SD WAN, the capability category vendors most often mislabel Public company 10-K filings, used to fact check inflated market share claims AWS cloud spend, used as the scale comparison that exposes a fake top-customer claim About the show Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

August 12, 2026Episode 2203 hr 18 min

Are Your Security Tools Actually Protecting You?

Your security tool says you're protected. So does your BAA, your SOC 2 report, and the maturity score you handed your board. None of that means any of them are telling the truth. Zach Stewart is a hands on CISO who spends his days doing exactly what this show is about: buying technology in a market built for the people selling it, then fighting to get it funded and adopted inside his own company. He's someone ITBroker.com works with directly, which is exactly why he's here. No product to pitch, no reason to give a polished answer. Max and Zach cover where to even start when you're hired into a mature security program, how to sell security to a business that treats it as a tax, where to find budget nobody knew they had, and the technical traps that catch people who should know better. Check before your next audit, your next renewal, or your next incident does it for you. What You'll Learn What "hands on" actually means for a CISO day to day, beyond the risk register and the slide deck How to evaluate a vendor's tool instead of their sales deck What a SOC 2 report and a signed BAA don't actually tell you Why SSO is quietly sold back to you as a premium feature, and how to push back When it makes sense to run your own SOC versus outsourcing to MDR Why a one to ten security maturity score means nothing to your board In this conversation: (00:00) - Cold open: what XDR actually means, and nobody has a straight answer (01:12) - Intro: Zach Stewart, hands on CISO (01:22) - What "hands on" actually means for a CISO day to day (04:10) - Day one priorities when you're hired into a maturing security program (06:19) - Velocity, change management, and where risk actually lives (10:25) - Why you can't just stop patching, even when updates break things (13:51) - What GRC actually means, stripped of the jargon (16:05) - How to quantify risk in terms the business actually understands (20:37) - Running risk as a dashboard, not a one time report (22:39) - Frontier risk: when there's no case law yet and no proof it'll happen (25:31) - Why visibility is the one thing a risk program can't work without (26:46) - Spotting real maturity versus theater in the first 30 days (49:20) - Show me the tool, not the slide deck (01:05:18) - A new vendor says they're secure because of SOC 2. What else to check (01:08:35) - The HIPAA BAA loophole nobody reads closely enough (01:23:29) - SSO can cost more than the product it's attached to (01:33:14) - The real math behind running your own SOC, and where MDR falls short (01:40:07) - Test your backups. Actually test them (02:03:09) - The company running its entire security budget at under a dollar per employee (02:06:30) - Outage risk and breach risk need two different plans (02:22:28) - When a customer contract forces corporate owned devices (02:28:39) - Why a one to ten maturity score means nothing to your board (02:48:24) - Passkeys are useful. Most companies deployed them wrong (02:57:47) - The SSO coverage gap nobody's counting (03:07:02) - The breach where almost anything would have stopped it What We Mentioned DSPM (Data Security Posture Management) DLP (Data Loss Prevention) IDP (Identity Provider) and zero trust identity SASE (Secure Access Service Edge) EDR (Endpoint Detection and Response) SOC 2 and HIPAA BAAs MDM / UEM and mobile device management MDR (Managed Detection and Response) and SOC staffing models NIST CSF Passkeys and passwordless authentication About Zach Stewart Zach Stewart is a hands on CISO and security leader who has built security and risk management programs from the ground up across multiple organizations. He works directly with ITBroker.com, which is why he's on the show: no product to sell, no incentive to give a polished answer. His focus is on the practical gap between what gets purchased and what actually gets implemented, and how security leaders can build real organizational credibility rather than just checking compliance boxes. LinkedIn: https://www.linkedin.com/in/zacharykstewart/ Company: https://steno.com About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.