The Claims Pointed at People: Nick Wolf on Tate Talks (S13E2)

On Season 13, Episode 2 of Tate Talks, Hook Security VP of Sales Nick Wolf told host Chris Tate why he moved from backup and XDR to security awareness training. Paying out cyber warranty claims at Cork, he saw the security tools usually did their job. Many losses started with a person being manipulated. So that's where MSPs should start.

Listen on Apple Podcasts · Spotify · Watch on YouTube

In 35 minutes they cover how MSPs actually sell training (hint: not as a line item), what a hands-off program looks like, why typo-spotting is finished, whether AI replaces MSPs, and Nick's one tip for owners heading into 2027. Plus a ruling on New Haven pizza.

First, credit where it's due

Chris Tate runs TotallyMSP and hosts Tate Talks, a long-running interview show about the people who make up the MSP community. By its own description the show is rarely technical and often off-topic, which is the point. You learn how people think, not just what they sell.

Chris and Nick go back to Datto. Chris was on the business development team in the UK. Nick was the name Chris remembers at the top of the sales charts. This episode is sponsored by enhanced.io.

How does a high school tech club kid become Datto's top rep?

Nick met Austin McChord when the Datto founder came back to his old Newtown, Connecticut high school tech club and handed students early Datto appliances to try to break. A couple of years later, at a summer bonfire, friends mentioned they were working at Datto. Nick started as one of its first interns in 2011, employee number 16.

He packed five college classes into Tuesdays and Thursdays at Western Connecticut State University and worked at Datto the other three days, right through graduation. He also ran early competitive intelligence, writing battle cards against the backup brands MSPs were replacing. By the time he left about a decade later, Datto had grown past 2,000 employees and Nick had become its number one sales rep.

What did cyber warranty payouts teach him?

After Datto, Nick sold XDR at Skout Cybersecurity, later acquired by Barracuda Networks. Then he joined Cork, a cyber warranty company Austin McChord founded. Cork paid MSPs when a client had an incident, which put Nick in a rare seat: he saw where incidents actually started.

Looking back at those payouts, he said “it wasn't necessarily the software that was failing.” The endpoint tools were good. The losses came from wire transfer fraud, from gift cards bought for a CEO who wasn't the CEO, from someone being talked into a request that looked like part of their job.

Nick's career has worked its way up the attack chain, and he walked Chris through it:

• Backup at Datto: something bad already happened. Get the client running again.
• XDR at Skout: stop the bad thing on the server or workstation.
• People at Hook: help the person spot the manipulation before anything reaches the endpoint.

Nick calls the person the first line of defense. Hook goes a step further and calls people the best defense, as long as training respects them instead of blaming them. That belief is the core of Psychological Security (PsySec).

Should MSPs sell security awareness training as a line item?

Mostly no, according to Nick. Most of the MSPs Hook works with don't sell it à la carte. They bundle it into the security stack next to EDR, email security, and MFA, and price the bundle however fits their model.

The billing follows the directory. Hook connects to the client's Microsoft 365 or Google Workspace and pulls in its people, so a 93-person client is billed for 93 seats. The Hook MSP program has no minimum seat counts, and partners can bill monthly, quarterly, or annually. Hook also backs partners with a price-lock guarantee: as long as you stay with Hook, your rate doesn't go up.

Cyber insurance makes the bundle an easy case. Nick said U.S. insurers expect MFA everywhere plus security awareness training, usually at least once a year. Many MSPs he talks to now go further: a one-to-five-minute micro-training every month plus one or two phishing simulations. Chris said the UK is a step behind but heading the same way. If you're assembling the paperwork, here's the evidence insurers ask small businesses for.

What does the MSP actually have to run?

As little as they want. Nick described two ways to work.

Hands-off: Security Awareness on Autopilot. The MSP connects a client's Microsoft or Google directory, and Hook picks the monthly training and sends the monthly phishing simulation. The MSP keeps a multi-tenant view across every client, plus reports it can hand straight to them.

Hands-on: MSPs who want to choose the content themselves can do it from the same platform.

Either way, the dashboard shows who finished training, who clicked a simulation, and who reported it. Nick's advice is to thank the people who report. That habit is what stops real attacks, and it's why reporting matters more than click rate.

The content is built to be watched. Hook's training library is live action, filmed in-house with real actors and writers, with no cartoons. Nick's bar is simple: nobody should groan at a video they already saw two months ago, or check how many of the 38 minutes are left.

Do typos still give phishing away?

No. The training Nick and Chris both sat through years ago taught people to look for the misspellings of a hacker typing fast in a basement. Now AI writes most phishing, and it writes better than most people do. The same tool helping the good guys is helping attackers.

Nick unpacked what to train instead (urgency, emotion, and context) in his KnowTechTalk episode on AI phishing.

Will AI replace MSPs?

Nick's answer was a flat no. But he expects AI to change how clients buy from MSPs and which services they buy. The risk he sees is simpler: if an MSP isn't helping clients understand and adopt AI, those clients will find that help somewhere else.

He pointed to Hatz AI as a vendor building AI tools with the channel in mind. That landed well, since Hatz founder Jimmy Hatzell was Chris's guest on the episode right before this one. Nick and Jimmy worked together at Skout for two years. Nick has no ties to the company; he just follows their work.

What's Nick's one tip for MSP owners heading into 2027?

Delegate. Chris asks every guest for one tip, and Nick aimed his at the owner who still does everything. You can't scale an MSP as a one-person shop. Hire the second, third, and fourth technician. Hire someone just for marketing and someone just for sales. Hire a level-one tech so the owner stops losing afternoons to account lockouts and reset tickets.

His example was Austin McChord. Datto was Austin's company, but he hired strong leaders for marketing, business development, and support when he knew they'd do those jobs better. Chris countered that Austin was usually the smartest person in the room anyway. Nick's point stands: it's your company, and it's still fine to let go of the reins.

The detour: 50 states, 63 national parks, and one pizza city

This is Tate Talks, so it went off-topic. Nick and his wife have seen about 35 of the 50 states and roughly half of the 63 U.S. national parks. They keep a shared bucket list of what to do in every state, so a work trip to a random city turns into a mini vacation. Nick credits the Boy Scouts: be prepared. They're also Disney World annual passholders.

Hawaii is next, for the Jurassic Park filming locations and some scuba diving. In every state they eat the local dish: ribs in St. Louis, an oversized pork sandwich in Indianapolis, Rocky Mountain oysters in Colorado. Nick's verdict on his home state: go to New Haven for the pizza.

Questions to take back to your team

• Is security awareness training a line item on your quotes, or part of the stack clients already expect?
• When a client's employee reports a phishing email, does anyone thank them?
• How many of last year's incidents started with a tool failing, and how many started with a person being manipulated?
• What are you still doing yourself that you should have handed off a year ago?

If those answers point at training, see how Hook works with MSPs.

Listen to the full episode

Thanks to Chris Tate for having Nick on. Catch S13E2 on TotallyMSP, Apple Podcasts, Spotify, or YouTube, and subscribe while Season 13 rolls out.

Want to keep the conversation going? Connect with Nick Wolf on LinkedIn, read why he joined Hook as VP of Sales, or catch his KnowTechTalk episode.

FAQ

What is Tate Talks?

Tate Talks is an interview podcast for the MSP community hosted by Chris Tate of TotallyMSP. Season 13, Episode 2 features Nick Wolf, VP of Sales at Hook Security, and was published on October 1, 2026.

Who is Nick Wolf?

Nick Wolf is VP of Sales at Hook Security. He spent about a decade at Datto, starting as an intern in 2011 and becoming its top sales rep, then worked at Skout Cybersecurity and the cyber warranty company Cork before joining Hook.

Should MSPs bundle security awareness training or sell it separately?

Most MSPs Nick works with bundle it into their security stack alongside EDR, email security, and MFA instead of selling it as a separate line item. Cyber insurance requirements make the bundle easy to justify to clients.

How often should small businesses run security awareness training?

Insurers typically expect training at least once a year. Many MSPs now run a short micro-training every month plus one or two phishing simulations, which keeps habits fresh without eating into the workday.

Will AI replace MSPs?

Nick Wolf doesn't think so. He expects AI to change how clients buy and which services they buy, and he warns that MSPs who don't help clients adopt AI will lose that work to someone who does.