The Problem No One Patches with Aaron Morin, ex-Nike

Aaron Morin [00:00:00]:

The worst thing that you could do is push something out there, but not communicating the reason for the change.

 

Arek Dreyer [00:00:06]:

This is Patch Me If You Can, a show about the IT and security leaders rewriting the rules. Not just patching what's broken, but building what's next. Every episode we explore replacing outdated ways of working with simpler, smarter and more strategic approaches. I'm your host, Arek Dreyer. Today's guest is someone who's lived it from both the trenches and the strategy table. Aaron Morin is currently the GM at Kandji, but before that he was deep in the weeds as the lead mobility engineer at Nike. He's seen how systems scale, break and evolve, and he's got strong opinions about what needs to change, especially when it comes to compliance, AI and mobile device management. Aaron, welcome to Patch Me If You Can.

 

Aaron Morin [00:00:57]:

Thanks, Arek. Thanks for having me.

 

Arek Dreyer [00:00:59]:

I'm really looking to this conversation. For those joining us from home, make sure you're following us so you don't miss out on future episodes. Let's start out at Nike. What did being a mobility engineer make you realize about how IT teams really work inside of a huge organization?

 

Aaron Morin [00:01:19]:

Yeah, it definitely made you realize just how many cooks are in the kitchen at all times. You have teams that are focused on endpoint management, teams that are focused on security network infrastructure. There's just a ton of teams that you need to collaborate with to build a solution, to give a solution to your users. And the best thing you could possibly do in those scenarios is just be a great collaborator, work really well with the teams around you, and that's how the best end results come to be.

 

Arek Dreyer [00:01:57]:

Speaking of lots of cooks, would you see new teams being spun up to deal with new technologies, or would existing teams take on the new technology? Or is it a mix?

 

Aaron Morin [00:02:07]:

Yeah, it's a good question. You know, we would see teams that would spin up to work on certain innovation initiatives. For example, when digital whiteboards were first coming out, there was a team that had gotten spun up and they were trying to figure out how to manage the whiteboards with mdm. So we would get pulled in and the network team would get pulled in and the collaborations team would get pulled in and change management teams would get pulled in and before you knew it, there'd be like 20 teams collaborating on this one thing.

 

Arek Dreyer [00:02:40]:

On whiteboards.

 

Aaron Morin [00:02:40]:

On whiteboards.

 

Arek Dreyer [00:02:42]:

And then the whiteboards would be taken down.

 

Aaron Morin [00:02:43]:

Exactly. Yeah. It was definitely. There were some exciting things that never quite made it out to our users, our internal users. But it's always good to kind of tinker and get a feel for new technologies in the space.

 

Arek Dreyer [00:03:00]:

You've worked on some really tricky mobility and BYOD issues. What are some lessons that you learned that you think other teams need to know about and hear?

 

Aaron Morin [00:03:12]:

Yeah, I think first and foremost, anytime you're running a BYO program for end users for their personal devices, it can very quickly become a very sticky situation. And it's really, it's all about perceptions. Making sure that the end user knows that this is not Big Brother on their phone, that you're not here to change the way their phone works or, or doesn't work, or making sure they know that you're not going to be able to wipe their device or things of that nature. That's all really, really important, folks. Personal devices are just that, they're personal. And the worst thing you could do, the biggest hit to a reputation, is having some sort of BYO program where people feel like their devices are being modified or tinkered with or like, you know, something they're doing on the device is being scrutinized. And again, a lot of that just comes down to communication. Really strong change management processes, you know, making sure that users really know what you have control and don't have control over.

 

Aaron Morin [00:04:23]:

So that they feel really at ease about putting software from your company on the device, which is at the end of the day more secure anyway. Right. The big thing that a lot of security teams care most about is least privilege access and knowing as much as possible about every single device that is logging into a privileged service. And so device management is really at the center of that.

 

Arek Dreyer [00:04:52]:

So what I'm hearing you say is communication with the users was paramount.

 

Aaron Morin [00:04:57]:

100%. Yeah. I think the worst thing that you could do is push something out there that maybe you've worked a ton on and done a lot of great engineering work on and done a ton of internal testing on and maybe even some piloting with users on, but not communicating the reason for the change, what the user is going to get out of it, what the user doesn't have to worry about, and sort of getting out in front of a lot of the questions that they're going to have. Because again, the device is just so personal.

 

Arek Dreyer [00:05:29]:

And I can see why that would happen because you're in a hurry, you're under deadlines and communicating to lots of people. People, it's hard, it's cumbersome. So let's, let's just, let's do it. We've got our solution. It looks like it's going to work and deploy 100%.

 

Aaron Morin [00:05:45]:

Yeah. And even with being in a larger company or even just a company that's international, you have people in many different time zones, many different countries. There's implications legally, Even within the U.S. certain states that have rules about personal use on devices, doing business work on personal devices, and there's just a ton of different things that need to be communicated. And so the worst thing you can do is spend 80% of the time on the engineering of the solution and then 20% on the actual execution and rollout of it.

 

Arek Dreyer [00:06:22]:

Was there any point at which that you can think of where you said this whole thing needs a rethink?

 

Aaron Morin [00:06:30]:

Yeah, I think, and I can't imagine that I'm in the minority here, but I think there are multiple times as a system engineer where I just said, man, I need a career change, I need to do something different. This is the last role that I want in device management and security. And it's because you're so beholden to the tools. And if the tools are not giving you the capabilities that you need or they're not allowing you to do the job the way that you want to do the job, you can really feel very constrained and you can, you know, sort of at the end of the day feel like a glorified button pusher. And so the key is really making sure that the solutions that you're using make you better and that work with you and even work for you and that you don't need to change your approach necessarily to use them and to be successful with them and to provide end user value to the folks that are on the other side of all the changes that you're making. I mean, that's the reason why I joined Kandji. I pretty much was done with the Apple device management and security space and then Kandji came along in its very early days and they were doing something a little bit different and in some ways a lot different. And yeah, it was a no brainer to come on to shape the future of Apple device management.

 

Arek Dreyer [00:07:55]:

I'm really glad you didn't leave the field despite all that.

 

Aaron Morin [00:08:00]:

Same, same here.

 

Arek Dreyer [00:08:03]:

What is one outdated mindset that it's time for IT leaders to leave behind?

 

Aaron Morin [00:08:11]:

Yeah, I think there are, especially with AI, right. There's a lot of change. There's a lot of things that are progressing extremely fast in the IT and security space. I don't know what the future holds, but I think the future is very different from the current state. I think that's an understatement. And so I don't know if there's one specific thing that comes to mind. I think there's probably a lot of things, but I think just overall, being open to change and not being afraid to do different POCs and sort of testing new solutions or new ways of doing things, it's going to keep a lot of these IT and InfoSec teams fresh and on top of managing all the change that's happening outside of the four walls that they operate with for.

 

Arek Dreyer [00:09:10]:

IT teams to take on new challenges and new PoCs. Is there any strategic, like, here's one way you can do that, like to embrace that change?

 

Aaron Morin [00:09:24]:

Yeah. I think what I've seen most successful in my past roles is just trying to put as much of the reoccurring IT and security tasks on the back burner as possible. If you're able to reduce the cognitive load that you're dealing with on a daily basis through manual action and having to spot check things in your environment and maybe even being reactive, if you can kind of move away from all that, that puts you in a really great position, a position of power, really, to be able to spend the time to test new technologies and to understand kind of where the puck is going and to go there as a team. One of the biggest ways that IT teams can do that is just by having a really robust observability strategy and being able to see what's happening in their environment before a problem arises. That was one of the things that really helped us back at Nike, where we would see a spike in enrollment errors or users were having trouble getting to a specific website or internal tool. And the moment you're able to get out in front of that. And again, like we mentioned earlier, especially with international teams, teams that are distributed in multiple different time zones, the best thing you can do is really have full command of your, your IT ecosystem by trying to bring in as much data as you can and put it in one place. Whether it's, you know, a splunk or a panther, another sim tool, it's extremely helpful to get a full view of your environment and what's happening inside of it.

 

Arek Dreyer [00:11:17]:

So if you collect that data, it's not enough. You've also got to use it and look at it and analyze it 100%.

 

Aaron Morin [00:11:24]:

I think the first sort of blocker or hurdle to get over is collecting the data. In some organizations, that's the hardest part. There might be red tape, there might be, like we talked about earlier, just a ton of teams.

 

Arek Dreyer [00:11:37]:

You have to collaborate with a lot.

 

Aaron Morin [00:11:39]:

Of cooks in the kitchen. And so sometimes collecting the data can be very difficult. And you know, I think depending on what you want to do with that data, the second part, making sense of it, can be very difficult as well. But there's a little less interpersonal or collaborative work that likely needs to happen to make sense of the data. And there's some great tools out there today.

 

Arek Dreyer [00:12:07]:

But that's assuming that the teams that need to look at the data have access to the data 100%. So it's a challenge to collect the data, it's a challenge to access the data, and it's a challenge to then see the insights from that data.

 

Aaron Morin [00:12:19]:

Exactly. And I think, you know, depending on the organization that you're in, whether it's a transparent environment or a rather opaque environment between teams, sometimes you don't know that certain data points exist. You don't know what you don't know.

 

Arek Dreyer [00:12:33]:

Yeah.

 

Aaron Morin [00:12:34]:

And so again, that is another thing that or another reason why collaborative environments, when that's fostered, you really begin to see the benefits come from that.

 

Arek Dreyer [00:12:46]:

Yeah.

 

Aaron Morin [00:12:46]:

To go deeper on that question, I mean, the patch is just the start. It's also table stakes. The quicker that you can kind of put that on the back burner, the quicker that you can make the patch relatively automatic, the better. You know, there was a team back at Nike that was very focused on our retail POS devices, really the main conduit in which Nike did their retail business. So, you know, a very large percentage, 90 plus percent of the sales that happened in a retail store were transacted on either ipod touch or more recently, iPhone.

 

Arek Dreyer [00:13:29]:

Handheld device.

 

Aaron Morin [00:13:30]:

Exactly. Yeah. Much like an Apple Store does. And you know, one of the biggest challenges was making sure that those devices could be patched without downtime. And so the team. That was a massive bit of work that the team would be tasked with and they would purposely do it as little as they could throughout the year because of the implications of it. And it was a team of four or five people that would literally go over one of the team members house for pizza and patching like once a quarter or, you know, sometimes not even that often because it was just such an undertaking and a lot of great work was done, but it was a lot of overhead. So the quicker that you can take that and back burner it, the better.

 

Aaron Morin [00:14:19]:

And you know, I think one of the stories that comes to mind was maybe just before COVID we had a, a IT manager in one of our distribution centers down in Tennessee come to us and essentially say, hey, we have this Paper process right now for all employee onboarding.

 

Arek Dreyer [00:14:44]:

Paper.

 

Aaron Morin [00:14:45]:

Paper in 2019. Right. And we left. But there's so many businesses that are still in this current state today. And it's a real blocker. Right. And so it was a blocker for them. They were literally losing workers, employees to a competitor, a large technology competitor that had just moved into town and that was offering their own distribution jobs.

 

Aaron Morin [00:15:14]:

And these workers were going over there because they knew that, you know, when they need to do classroom trainings, they weren't going to have to do it on paper. And the systems that they were dealing with were less antiquated. And so it sort of spun up this whole initiative to bring in hundreds of iPads to these massive distribution centers to be able to consistently and continually keep these workers updated on the best practices for doing their work and for various different safety trainings. And it was a big undertaking. But iPad is such a great platform to build off of if it's, you know, done right. And part of doing it right is making sure that devices are constantly patched from an OS perspective in the apps that are running on it are constantly up to date and that they're secured in a safe place and constantly charging and constantly online. And, you know, once we were able to kind of get over that hurdle.

 

Arek Dreyer [00:16:13]:

So that was the patch. Then what were you able to transform with that?

 

Aaron Morin [00:16:18]:

Right, yeah. And then from there, we were able to reduce a lot of the friction that existed in training these employees. And I don't remember the percentage increase exactly, but they had done a study where they were measuring employee satisfaction before and after. And it was a massive step change for the business, a massive increase in satisfaction just because of how much better the trainings were able to be because we replaced paper process with iPad. And again, none of that would have been possible if you had not gotten that foundation right, that patch correct and in place, because then you would have devices going offline, devices falling out of compliance, devices disappearing, not up to date, et cetera. It would have been a real disaster.

 

Arek Dreyer [00:17:06]:

Yeah, I know that AI is a really big focus for you right now. Do you think that IT leaders are ready to let AI take on some of the tasks that they're traditionally responsible for?

 

Aaron Morin [00:17:23]:

I think it's a mixed bag. There are leaders today in, you know, many different companies that are excited and really bullish on what the AI future holds? There are also leaders that are sort of afraid or just not wanting to introduce the risk that they feel AI adds to their environment. You know, I think we talked about this A little bit already. But making sure that systems and software is both secure but also extremely stable is really important. And there's really massive business and profitability implications if any of those two things are not the case. And so I think AI is not going anywhere. AI is going to continue to. It's not going away, not going away.

 

Aaron Morin [00:18:18]:

It's going to continue to be pretty pervasive and it's only going to get better. And so hopefully in time there'll be trust that is built in these solutions that are built with AI. We've already seen at Kandji a ton of instances where something would not have been possible to build without AI, something that just would have been nearly impossible, if not completely impossible, to code or engineer is now possible with AI. And so I really think that IT leaders are going to see a pretty massive increase in productivity and the satisfaction of their workers with some of these AI tools that are coming on the scene. And I think it's really on the makers of that software to ensure they're instilling trust in the solutions that are being built and that leaders have complete transparency into how AI is being used, how their data is being used or not used. And that way, hopefully leaders feel like they can make that leap without any concern for business impact.

 

Arek Dreyer [00:19:34]:

Coming back to the communication, the collaboration data, the.

 

Aaron Morin [00:19:40]:

Observability.

 

Arek Dreyer [00:19:41]:

Thank you.

 

Aaron Morin [00:19:42]:

Yeah, yeah, it's going to be really important. And you see there are certifications now, ISO certifications for doing AI responsibly, and that sort of stuff is going to be really important. Moving into the future. Yeah. There's this Bill Gates quote that essentially. I'll paraphrase. Basically it says that we sort of overestimate what can be done in a year and we underestimate what can be done in five.

 

Arek Dreyer [00:20:12]:

Sure.

 

Aaron Morin [00:20:13]:

And I think in some way AI is sort of flipping that around. How so? Yeah, I think we're sort of, in many ways needing to change our mindset, because I think AI, we're sort of expecting it to deliver less change over the course of the next year. And maybe we are, you know, expecting more change in the next five years from AI. So I think there's definitely a paradigm shift going on and it'll be really interesting to see how it plays out.

 

Arek Dreyer [00:20:45]:

It's an interesting flip.

 

Aaron Morin [00:20:47]:

Yeah.

 

Arek Dreyer [00:20:48]:

Everyone thinks, like, oh, my gosh, the next week's release is going to change the world.

 

Aaron Morin [00:20:52]:

Yeah. It's sort of like this shift where I think we don't think that AI will deliver on certain promises in the short term, but it Will and the same strain. Right. We think that AI is going to completely change the world in five years. And while it likely will, it probably won't quite cash in on the checks that we're writing for it right now.

 

Arek Dreyer [00:21:20]:

I've got the closing question for you. If you could instantly patch something in your world right now, what would that be?

 

Aaron Morin [00:21:27]:

I think it would have to be my sleep. Right now. We have a one year old at home and he's a handful. We love him a ton, but sleep is still a little bit hard to come by, especially uninterrupted sleep. And so if I could patch that right now, that'd be pretty great. Maybe more relevant to our conversation though. I think it would be really great if I could patch the perception on AI. We were just talking about this in this previous question you asked, but I think it's not going anywhere.

 

Aaron Morin [00:22:01]:

We know that it has a lot to offer as long as it's done correctly and it's not abused. And I think it'd be great to see folks sort of come from all different industries and come to the same table and have a real conversation around how to do it right and what the future looks like with AI so that we can all build it together again.

 

Arek Dreyer [00:22:27]:

Communication and collaboration.

 

Aaron Morin [00:22:29]:

Yes.

 

Arek Dreyer [00:22:31]:

Well, huge thanks to Aaron for joining us on this episode of Patch Me If You Can to talk about what it's like to stop reacting and start architecting. Aaron, thanks so much for joining.

 

Aaron Morin [00:22:43]:

Yeah, great. Great to be here. I appreciate you having me here.

 

Arek Dreyer [00:22:46]:

If you like the episode, hit, follow and share with someone who's ready to lead it from the front. We'll see you next time.