This afternoon I had an interesting conversation with someone in my network who is co-owner/co-founder of a boutique cyber-security services firm. More generally, it was an eye-opening/jaw-dropping discussion. But my point here is to share key points regaring $DSE and the Microsoft back-up announcement.

My contact was not knowledgeable about $DSE (and is not an investor in it) as his focus is on larger enterprise clients and goverment agencies. However,he is very well-credentialled, sitting on the advisory board as a cyber-security expert to a highly respected Australian IT institution, so I attach some weight to his insights, as I would not normally write up opinions of non-expert acquaintances.

When I shared what was going on with MS-365 backups and the speculation about the impact on $DSE's value proposition, he did not hestiate and was unequivocal. He stated that the principal of "defence in depth" would mean that a completely independent back-up service would always be valuable from a business continuity/resilience perspective, for some of the reasons we have speculated about here. He believeds there would continue to be a large and growing market for such a service.

He went on to say that cyber attackers usually follow a dual strategy of seeking to defeat firewalls and go first of all for the back-up service. A back-up hosted in a completely separate environment, governed and controlled by a separate entity would be a more robust proposition. This would particurly the case if the service maintained compliance with the various global cyber-security standards. Such a service would also likely have advantages in terms of cyersecurity insurance premiums - a rapidly emerging area. He is also involved in this as a service line, as part of what his company does is assess cyber-risk of comapnies seeking insurance.

While he admitted that many clients might settle for a back-up service provided by the SaaS provider, he would always recommend his clients to view an appropriately-credentialled, completely indepedent service as superior, and this would be reflected in an actuarial assessment.

He fully agreed that $DSE may have a job of work to do to educate their MSP customers, as there is a high degree of variability in capability on security awareness across the MSP industry. This is in large part because of the limited availability of security talent. He cited that there is a shortage today of 30,000 IT securiy professionals across Australia, and one of his biggest areas of focus at the moment is defending his existing staff from poaching attacks my competitors.

Ironically, I have reduced by $DSE position in the last few days, simply because I wanted to increase some other positions, and it is lowest on my merit order for allocating capital (There being no cash in my SM position, and in RL I am "at weight" in my microcap / risky portfolio, so am unwilling to add more cash.) I'm not sure that today's conversation would have changed my decision, had it occurred a few days earlier, but it does strengthen my conviction somewhat regarding my remaining $DSE holding.

I regret I cannot give referenes to back this all up, as it was a private conversation. But this is someone with impeccable credentials whose opinion I trust.

So, when we meet with Charif, one question to ask in addition to understanding the MSP response to $MSFT Back-up, is to probe how security-savvy his MSP customers are, and what EXTRA effort he believes is required to educate them?