Stop Selling to the Office Manager: How an MSP Owner Became the Board's vCISO

“It's the biggest risk to their business, almost certainly.” Dave Lane has run an MSP since 2006, moved it from the UK to Malaga, and then did what most MSP owners only talk about: he stopped competing in the break-fix race to the bottom and rebuilt the business as fractional IT leadership and vCISO work, sold directly to boards. We get into why he could not deliver real business value while his contact was the office manager, what shadow AI does to a company that thinks it has IT under control, and why good governance starts with people, not tools. What we cover: - Building an MSP from 2006 and moving it from the UK to Malaga - Why break-fix stopped being defensible and what he rebuilt instead - Selling direct to boards, and the “two bosses” problem of working through MSPs - Shadow IT vs shadow AI, and why the second one is worse - Governance without surveillance: policy, training and least privilege over spying (yes, the mouse jiggler story) - AI security tooling that cost tens of thousands of pounds a month five years ago and hundreds now - Why one- and two-person MSPs face a consolidation wave as cyber and AI risk outgrow them Connect with Dave: LinkedIn: https://www.linkedin.com/in/davelane/ Good Choice IT: https://goodchoiceit.co.uk Amalan Advisory (vCISO): https://advisory.amalan.co.uk