Signed

Before you compare a single vendor, a lot of the decision is already made. The systems you run today rule some platforms out, and the choices you make now decide whether a requirement three years from now means adding a license or replacing something the business runs on. In this Playbook, Max Clark, CEO of ITBroker.com, answers a question he was asked directly: which is harder, brownfield or greenfield? Brownfield means building on systems you already have. Greenfield means starting from nothing. Max walks through why your existing setup narrows your options more than any feature comparison or RFP, what to plan for when you're starting fresh, and why each situation needs its own approach. What You'll Learn How to tell if a new platform will work with the systems you already run How your existing technology narrows your vendor options before you compare them What to plan for when you're choosing IT infrastructure from scratch How to plan infrastructure for the next three to five years of business growth How to avoid buying technology you'll have to replace later Why brownfield and greenfield projects need different buying approaches Answer These Before You Compare Vendors What does a new system have to work with? List the hardware you plan to keep and the platforms it has to connect to, like Microsoft 365 or Google Workspace and your CRM. A vendor that can't support something on that list is either out or carrying a replacement cost. Which of those are you willing to replace? Some older equipment is worth replacing anyway. Decide that before the demo, so it's in the vendor's price instead of showing up during the rollout. What does your business plan say about the next three years? New locations and new compliance requirements change what your platform has to support. Write them down while they're still plans. If one of those happens, is it a license or a rebuild? Ask this about every platform you're considering. A feature you can turn on is a line item. A core system you have to replace is a project. If you can't answer two of these in writing, you're not ready to compare vendors yet. Max walks through both sides in the episode. The Playbook (00:00) - The three year test: add a license or replace a core system (00:32) - Why existing systems make vendor selection easier (01:32) - Why your current setup matters more than the RFP (02:31) - Starting from scratch: decisions that last five to seven years (02:59) - How your industry shapes what you'll need next (03:55) - Why neither approach is easier Resources Mentioned Microsoft 365 and Google Workspace, Max's first example of a decision that already limits which platforms fit Salesforce and HubSpot, the CRM choice that shapes what you can layer on top of it Unified communications (UCaaS), the phone system category in Max's example of checking a new platform against the hardware you already own About Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format: one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

Steve Wilson built his own AI assistant the careful way. He gave it its own Google account and read only access to his calendar, and told it not to talk to strangers. His company's CISO had a pen testing team go after it, and 4 days later the assistant reported that it had compressed his source code and attached it to a meeting with an outside consultant. A fake email from a lookalike domain, written as if it came from Steve, was all it took. Steve Wilson is Chief AI and Product Officer at Exabeam and founder and co chair of the OWASP Gen AI Security Project. He joins Max Clark to break down what AI agents are already doing inside companies, who is responsible for them, and what to check before you approve one. They get into why an agent using an employee's login is its own identity, why you can't filter prompt injection out, why blocking AI tools only sends people around IT, and what Steve's forecast of 10x the digital workers and 10x the attacks means for security teams. If nobody at your company can say which AI agents are running and who answers for them, this episode starts there. What You'll Learn What are the biggest security risks of AI agents inside a company? How do we know what AI agents our employees are running? Should an AI agent use an employee's login, or have its own identity? Who is responsible when an AI agent does something it shouldn't? Can an AI agent be tricked into leaking company data? Can you stop prompt injection with a filter? Should we block employees from using AI agents, or approve one and manage it? Can AI help a security team, and what does it do in the first minute of an alert? In this conversation: (00:00) - Intro (00:44) - What an AI agent does in the first minute of a security alert, so a human starts with a finished investigation (11:51) - Steve's two-year forecast: 10x more digital workers on your network, 10x more sophisticated attacks, 100x the data to sort through (19:30) - Insider threats now include AI agents that malfunction or go off course (37:41) - Blocking AI just sends people around you. Approve one tool and manage it instead (44:04) - The three kinds of AI agent in your company, and why you can't filter prompt injection out (49:32) - Who owns an AI agent: security, IT, the business, or the employee who built it (56:10) - He gave his AI assistant its own identity and limited access. It still got phished (01:02:44) - Shadow AI spreads faster than shadow IT, and your approved tool gets abandoned (01:22:53) - Why AI won't shrink your security team, and the entry-level hiring gap it leaves (01:31:48) - AI is moving back in-house, and what that changes for security What We Mentioned The Developer's Playbook for Large Language Model Security (O'Reilly). Steve's book. It lays out what can go wrong when AI is built into products and how to defend against it, drawing on the 400+ experts behind the OWASP Top 10 for LLMs. It is written for developers and security teams, and it is the plain language reference if AI agents already have access to your systems. OWASP Gen AI Security Project OWASP Top 10 for LLM Applications Exabeam Exabeam Nova, the AI agent built for security operations centers OpenClaw, the open source AI agent Claude Code Claude Cowork OpenAI Codex MCP (Model Context Protocol), the way software lets AI agents use it Salesforce Microsoft SharePoint Okta CrowdStrike Palo Alto Networks Cortex Microsoft Sentinel Dropbox, Steve's early example of shadow IT SOC (security operations center) SIEM (security information and event management), the central system that collects security data MSSP (managed security service provider) MDR (managed detection and response) EDR (endpoint detection and response) Prompt injection (hidden instructions an AI follows as if they were yours) Pen testing (authorized attacks used to test your defenses) About Steve Wilson Steve Wilson is Chief AI and Product Officer at Exabeam and founder and co chair of the OWASP Gen AI Security Project. He wrote the first OWASP Top 10 for large language models and the O'Reilly book The Developer's Playbook for Large Language Model Security. Steve Wilson on LinkedIn | Steve Wilson on X | Exabeam | Exabeam on LinkedIn | OWASP Gen AI Security Project | OWASP Gen AI Security Project on LinkedIn About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

Before you compare a single vendor, a lot of the decision is already made. The systems you run today rule some platforms out, and the choices you make now decide whether a requirement three years from now means adding a license or replacing something the business runs on. In this Playbook, Max Clark, CEO of ITBroker.com, answers a question he was asked directly: which is harder, brownfield or greenfield? Brownfield means building on systems you already have. Greenfield means starting from nothing. Max walks through why your existing setup narrows your options more than any feature comparison or RFP, what to plan for when you're starting fresh, and why each situation needs its own approach. What You'll Learn How to tell if a new platform will work with the systems you already run How your existing technology narrows your vendor options before you compare them What to plan for when you're choosing IT infrastructure from scratch How to plan infrastructure for the next three to five years of business growth How to avoid buying technology you'll have to replace later Why brownfield and greenfield projects need different buying approaches Answer These Before You Compare Vendors What does a new system have to work with? List the hardware you plan to keep and the platforms it has to connect to, like Microsoft 365 or Google Workspace and your CRM. A vendor that can't support something on that list is either out or carrying a replacement cost. Which of those are you willing to replace? Some older equipment is worth replacing anyway. Decide that before the demo, so it's in the vendor's price instead of showing up during the rollout. What does your business plan say about the next three years? New locations and new compliance requirements change what your platform has to support. Write them down while they're still plans. If one of those happens, is it a license or a rebuild? Ask this about every platform you're considering. A feature you can turn on is a line item. A core system you have to replace is a project. If you can't answer two of these in writing, you're not ready to compare vendors yet. Max walks through both sides in the episode. The Playbook (00:00) - Intro (00:41) - The mistake: treating insurance's four checkboxes as the finish line (04:22) - The play, step 1: what security buyers skip past SWG, CASB, and ZTNA (09:07) - The play, step 2: what actually gets security budget approved, and why ROI is the wrong pitch (13:19) - The play, step 3: test your backups before you need them (14:38) - What to watch for next: measuring security by detection and containment speed, not tools bought Resources Mentioned Microsoft 365 and Google Workspace, Max's first example of a decision that already limits which platforms fit Salesforce and HubSpot, the CRM choice that shapes what you can layer on top of it Unified communications (UCaaS), the phone system category in Max's example of checking a new platform against the hardware you already own About Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format: one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

Buying Microsoft 365, Google Workspace, or Azure direct feels like the simpler choice, until you need support or get locked out of your own tenant. In this Playbook, Max Clark breaks down what a Cloud Solution Provider (a CSP) actually does between you and the platform: faster support and escalation, help recovering a locked tenant, engineering and migration support, and access to vendor funding you can't reach on your own, usually at little or no added cost. If you're deciding whether to buy direct or through a CSP, or renewing that decision without ever having checked it, this one's for you. The Playbook (00:00) - The cold open (00:51) - What a CSP actually is (01:29) - Why Microsoft and Google aren't built to handle support directly (01:55) - Where a CSP actually sits between you and the platform (02:24) - The market development and incentive funds vendors push through CSPs (03:19) - The dedicated admin account problem most companies skip (04:17) - The real causes of a tenant lockout (05:14) - How being a sub of the CSP changes your escalation path (06:11) - The engineering, migration, and configuration work a CSP's own staff can do (06:38) - Why CSPs range from pure billing pass throughs to full service providers (07:03) - Tier zero versus tier one support (08:26) - The difference between support built for end users and support built for admins (09:25) - Why CSPs get paid through the platform's margin (10:17) - Max's bottom line: why the CSP relationship is worth having almost every time About Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

A customer walked in sure they wanted colocation. The quote in their head was $10,000 a month. Once Jeremy Pease's team modeled the real requirements, staffing, connectivity, compliance, the number came back at $80,000. Jeremy Pease is CEO of Aptum, a hybrid multi cloud managed service provider. He joins Max Clark to break down how IT leaders should actually decide where applications run, across public cloud, private cloud, colocation, and bare metal, instead of starting with the platform and working backward. They get into egress costs that can exceed the infrastructure bill itself, the VMware exodus ahead of the April 2027 contract deadline, why most companies are running workloads at a scale they never needed, and why repatriation almost always requires someone willing to make the unpopular call. The question isn't whether you negotiated a good rate. It's whether you're on the right infrastructure in the first place. What You'll Learn How to tell if a workload actually belongs in public cloud, private cloud, colocation, or bare metal Why egress fees, not compute, are often the real driver of a surprise cloud bill What's forcing companies to leave VMware before April 2027, and what it actually costs to stay Why "multi cloud" rarely means what the marketing implies How to build the ROI case your own IT team can't build for itself What a real disaster recovery conversation looks like once the price tag is on the table In this conversation: (00:00) - The colocation quote that changed after the real requirements came out (00:53) - Why the application should dictate the infrastructure, not the other way around (04:16) - The myth that cloud is automatically more secure or compliant (06:15) - Why shared cloud workloads create a real compliance gap (08:11) - The five Cs: cost, compliance, customer service, complexity, and visibility (09:27) - Gently explaining to a customer that their plan is wrong (10:42) - When a board mandates cloud migration without understanding the tradeoffs (13:17) - Why small IT teams can't manage what they've been told to run (15:03) - Patching still exists in the cloud, just under a different name (16:14) - The rise and quiet retreat of the multi cloud pitch (20:38) - How much of infrastructure strategy is really about a toxic relationship with IT (22:15) - Running infrastructure alone for six of the largest US banks on $130K a month (26:25) - Ad tech, real time bidding, and why egress became the real cost center (27:13) - Internet connectivity now costs more than the infrastructure itself (29:03) - FinOps isn't cost control, it's just explaining the bill (31:54) - Why repatriation needs a founder willing to make the unsafe decision (32:56) - The cloud spend threshold where a real conversation starts (35:44) - Data sovereignty, the US Cloud Act, and owning entities by country (37:01) - The EU tiers where US controlled infrastructure becomes disqualifying (40:12) - Is data sovereignty the real trojan horse for repatriation (43:02) - Aptum's seventy two to seventy five percent average cost reduction (43:48) - Walking a repatriation curious customer from first call to signed contract (47:13) - Why some staff can't follow the migration to a new platform (48:11) - Cloud as the ultimate expression of tech debt (50:38) - Why your AWS account team is incentivized to grow your bill, not shrink it (52:23) - A CEO's gross revenue cloud spend becoming a business viability problem (53:31) - Why finance teams hate the cloud: no control, no predictability (55:11) - What people get wrong about disaster recovery in the cloud (58:48) - Why dedicated DR instances still cost less than running them live (01:00:27) - The real question for any circuit: more or less than $500 a month (01:02:12) - Why some customers blame the public internet for problems they chose (01:04:33) - The coming skills gap: why electricians are becoming the new high demand hire (01:07:09) - Being an expert generalist in a market that rewards niching (01:11:01) - Nine hundred and sixty seven vendors, narrowed to eighty two (01:13:41) - Controversial take: IT is a solved problem, most issues are self inflicted (01:15:32) - Shadow IT and the spreadsheets built because IT wouldn't touch it (01:19:27) - VMware's relevance after the Broadcom price increases (01:20:39) - The Oracle playbook: raise prices until only the trapped customers remain (01:23:19) - What April 2027 actually means for every VMware contract (01:25:36) - What percentage of VMware customers actually use its differentiators (01:29:31) - Migrating off VMware: where the majority of workloads are actually going (01:32:15) - Short executive tenure and who's left holding the decision (01:34:19) - The customer who insisted on colo, until the real number was $80K a month (01:36:29) - Nobody cares about the technology, they care what it lets them do (01:38:10) - Building the ROI presentation the IT team can't build for themselves (01:40:44) - Helping IT teams speak board, not just TCO and ROI (01:42:49) - Aptum's real ICP: one to three thousand employees, five to ten IT staff (01:43:47) - Migration work versus simply needing an expert to run it (01:48:01) - Efficiency and specialization: why selective outsourcing wins at scale (01:48:46) - Self serve without losing control: automation when they want it, service when they need it What We Mentioned Aptum AWS Microsoft Azure Google Cloud VMware (now part of Broadcom) Broadcom Nutanix Proxmox Zerto Megaport Equinix Digital Realty Netflix (one of the earliest and most public cloud repatriation cases) Dropbox FinOps EDP (Enterprise Discount Program) RI (Reserved Instance) RTO / RPO (Recovery Time Objective / Recovery Point Objective) DR (Disaster Recovery) About Jeremy Pease Jeremy Pease is CEO of Aptum, a global hybrid multi cloud managed service provider. He has more than two decades of experience leading data center, cloud, and managed infrastructure businesses, including executive roles at Hivelocity, Colohouse, DataBank, and Aptum. Jeremy Pease on LinkedIn Aptum About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom