Why Software Asset Management Tools Don't Fix Compliance

What We Need to Grow, Episode 067: Change Is the Enemy. A Founder Talk conversation with Rory Canavan, founder and owner of SAM Charter. Cleaned for readability; the words are the speakers' own.

Caleb Pedosiuk: Let me tee it up, Rory. samcharter.com, your company. I would love to hear you explain this, and I would love it if you could start with the problem. We had a conversation outside of this, and I think it's important for people to understand the problem that you help solve. From the problem, maybe we can go into how you do it. But first introduce yourself, your company, and then please paint that picture.

Rory Canavan: Absolutely. Well, thanks very much, Caleb. My name is Rory Canavan. I'm the founder and owner of a company called SAM Charter, as you've highlighted already, and what we do is help organizations better manage hardware and software. So that if someone like Microsoft, Oracle, or IBM knocked on the door and said, tell us what you have installed compared to what you've paid for, you don't then go through an experience of wailing and gnashing of teeth and crying. You've got a structured framework, a systematic approach, to be able to produce that report.

So the particular problem that organizations face when that knock on the door occurs is that they may not have what we call a SAM suite or an ITAM suite that takes the installation data from the IT estate and compares it to the contracts and licences that they might have bought. And one thing I found with a lot of organizations is that even if they do have that SAM suite or ITAM suite in place to be able to generate that report, they don't have an idea of how to get the report better. It's garbage in, garbage out. So at that point you need the processes that look after the lifecycle of the software and hardware that comes into an organization, to fine-tune the data that then goes into that report.

There's an expression, people, process, and technology, which I'm sure you've come across before. People feel it's a bit like gym membership. They invest in the technology and think, well, the problem's solved. We've sorted the problem because we've spent all this money over here. And in reality, it's like a gym membership that doesn't get used. That gym membership doesn't get me fitter. I've got to go to the gym and I've got to actually work out.

Caleb: So would you be like the personal trainer of these corporations, of these teams, when it comes to these pieces? They get this gym membership, so to speak, but then you're the one who's actually coming in, and you use your SAM frameworks or other things to be able to look and say, okay, for this team, these are the things you need to be doing at this interval, these are the things that you have to stop doing as well. Is that the sort of guidance that you bring?

Rory: Yes, absolutely. And also, apart from those examples that you offered, which are typically operational or day-to-day in nature, the better solutions and the better programs that I help organizations with start to look at the strategy and the vision and the policy that guides a business to a clearer path over the next 3 to 5 years as to what they want to do with hardware and software. And that also sets the business up to have a radar for change.

A favourite expression of mine is that change is the enemy. It would be wonderful if we could set up these IT estates, shrink-wrap them, and then keep the humans off them, to stop the change. It's the change that trips people up and trips organizations up, unfortunately. So having that awareness that data changes. Well, if it changes, you've got to change it back. You've got to change it to suit your situation, your argument. And that's where the processes come in, to corral that data.

Caleb: So from our first conversation, I think you explained to me a little bit about what's at stake. First of all, if a large company, let's say an enterprise organization, does not have this stuff properly structured, the downside is that it's a lot of time. There can be legal exposure. There can be hidden costs. You can be in breach of what your enterprise-level agreement was. So you've got this frustration, this distraction for your team from what you're actually supposed to be doing. But then there's this other side of it, where you mentioned that sometimes in running this properly, a lot of companies will look and realize, oh, we actually don't need this level of engagement that we perhaps thought we did when we first set out to engage with the software. So actually having your ship run well for a company doing this can result in cost savings, where there could be costs leaking unnecessarily.

Rory: Absolutely. And where the hot topic around this is at the moment, you might have heard of an expression called tokenomics. So you have AI, and lots of businesses have invested very heavily in AI. But some organizations have taken AI tokens, thrown them across the workforce, and wondered why they haven't had an upswing of productivity to the tune of 20 or 30% in the next 3 days. And the idea is that you've got to align your tokens, if you will, and your application of AI, to the value that it brings.

There's one classic story, and this is in the public domain, so I'm not telling tales out of school or setting you up for any lawsuits. There's a company called Retool where one of their developers took it upon himself to develop an out-of-office reply using AI. And didn't tell anybody, set it running. And it burnt through about $10,000 of credits a month. Just doing the same functionality that the Outlook out-of-office reply does. But this AI agent was off through the company corporate records, looking for this data and looking for that data, and just churn, churn, churn, tokens going out the window.

So my ethos on tokenomics is that you've got to have value at the centre of everything you do around AI. What is the value in engaging with AI against what's currently in place? And if there is an improvement or additional value that comes out of using AI, then fine, let's proceed, and let's look at the business case, and let's look at the cost compared to the value. Because the value may not necessarily be more dollars coming in the door. It could be a lateral or a back-office benefit that is harder to quantify fiscally. So FinOps is a great area where they look at cost versus benefit in that respect.

Caleb: It's made me wonder if there's going to be a way, or maybe there is already in some respect, a way to bridge these calculations. Because especially at the enterprise level, you have individuals in teams, in departments, and they have this one piece of the puzzle they're working on. So if they're looking to improve those efficiencies, they might not have enough context to understand what the value is of that collective effort, what that's doing. Whereas to zoom out and have an understanding of, well, actually the token cost of this is this, versus having humans do it.

I think it was Steve Jobs, one of his big aha moments was with Tesla, where he had recognized that you should not automate something until you have really mastered the optimization of the production of it. Where he had to go through the factory and he was ripping things apart, cutting holes in the factory wall to tear out machines, because he realized humans could do it faster, and he realized he was automating too quickly.

But I wonder with tokens. Recently, since Grok Bot has come out and I've been experimenting, I moved a lot of a workflow over to be able to see that. And one of the interesting things was that Cursor is not public about how many tokens they are giving per tier. It's like a black box until you go over, and then they're saying, hey, set your cost limits. So I was experimenting a little bit with it and I went through $50 in a day. It was like, oh, well, why don't you set a month? So I'd already gone over. I was experimenting with some video stuff, and it was like, well, let's just try this. And so it plowed through it, and I'm like, okay, this is interesting. The work was probably the equivalent of maybe 2 hours of somebody doing work. If I had someone in the seat doing that work, maybe 2, 3 hours of an entry-level person doing that kind of editing work. But to not have that visibility was a surprise to me. And when I reached out, it was like, hey, am I missing some page or something where it gives this calculation?

So all that to say, frameworks like yours, paired with more of a macro understanding of tokenomics, and an understanding of licensing agreements and the vision of the company and what the goals are, those factors communicating well, and then having a clear-to-understand green, yellow, red checkpoint for teams making decisions, is probably so important. To know, actually, this is not as helpful as you may think. Or it is, this is an ideal use case.

Rory: I was thinking about how I would describe the difference between software asset management and AI consumption. A thought came to me about Pirates of the Caribbean. So back in the day, you're the captain of the ship, and you're off to find treasure. And if you do so, typically you're doing so with a map. And your map will give you X and Y coordinates as to where the treasure is buried. So the SAM equivalent there is software consumption, typically installations versus the contracts and licences that you've bought to say you can use it. So there's your X and Y, there's your compliance position, relatively speaking, on the comparative map.

But if we go to AI, and you sail to that point as the captain of the ship, what the map doesn't tell you is how much digging you have to do to get to the gold. And what it also doesn't tell you is, is the digging worth the value? Because you could get to the casket, open it up, and there's no gold.

Caleb: Or a tiny amount.

Rory: And it doesn't tell you about the alligators, or the swamps you have to go through. The map just gets you there. It doesn't get you in there. It doesn't necessarily get you what you want. So I think if people can appreciate that they've got to do a bit more thinking than just looking at the problems from an X, Y, or an A/B comparison of data. You've got to dig deep with tokenomics, absolutely.

Caleb: I hear what you're saying though. You set this goal, you set this target for getting to a certain point, and then there's no sense of, okay, how deep is that going to be? You got there, you arrived there, now how much work is actually going to need to be done for that?

So who is the kind of person at an enterprise level that is looking for what you have? There's got to be someone scratching their head trying to solve this problem. Maybe they don't have language to put around it, maybe they do. But who's looking for you right now?

Rory: I think the people or organizations that are looking for me are the ones that are heavily federated. So if they've got to answer to a lot of legislation and regulation, then they should be keen to speak to me. People who are dealing with procurement contracts that are engaged with the likes of Microsoft. And I was about to say Copilot, but that is Microsoft, isn't it? And then Claude and ChatGPT and Anthropic, all of these AI organizations, and indeed software organizations too. It doesn't just have to be all AI. Organizations that have recently been through an audit with a software vendor. Or organizations that are looking at a SAM or an ITAM suite and thinking, it's not working for us, we need to change.

And that is the parallel to the old metaphor of a bad workman always blaming his tools. I guarantee you can go through a world of pain switching out another system equivalent from the one that you have to do this calculation. And it won't get better. It won't get better, because you've not thought about the lifecycle that goes around the ITAM suite that needs to respect the data going in.

Also, organizations that are looking to improve their risk position, or looking to improve their information security position, because the core data that SAM or ITAM grabs really supports information security around version and edition control, patching, that kind of thing.

And one of the more interesting cases is organizations that are going through mergers and acquisitions as well. This idea that typically when you buy an organization, and I wasn't aware of this in the past, but when you hand the money over to buy an organization, typically what you do is you hand over 90% of the cost. And then you have a window after the transaction to fine-tune the actual settlement and the final number, based on the potential snakes and snurglies that you might have bought that you didn't know about. And a lot of those snakes and snurglies can reside in the IT estate. So if you've got an ability to assess an organization for its maturity around software and hardware, either if you're buying an organization or if you're selling a portion of it off, it just means that you get closer to that deal. And it's a more swan-like experience, whether you buy or whether you sell.

Caleb: That is fascinating. So would you say that one of the avatars, in terms of a buying cycle, that you would really bring a lot of value to would be a decision maker who is involved in preparing a company to be sold, or to be bought?

Rory: Either, either or both.

Caleb: This is a really interesting spot to me, because of the specific role. You have venture capital firms, you have companies that are doing roll-ups. We had a client that we worked with during a real significant push of growth, where their acquisition strategy was how they were growing. Well, one of the aspects of how they were growing. They were acquiring upwards of about a dozen companies a year. We were helping rebrand all those companies and integrate them into the fold, which was awesome, and getting to work with so many different teams was really incredible. But it was interesting to me that there had to be an integration strategy. You cannot add complexity, and the wheels have to stay on the vehicle. In fact, all the more. The level of engineering that happens in Formula 1, or if someone's doing a race across the country, all the more attention to detail is needed.

And so it's interesting to me, because the kind of people that, whether they know it or not, want you in the mix are probably those that are structuring deals, development officers maybe, that are actually pioneering these deals. They may not have the language, the snakes and snurglies that you mentioned, but to understand that you want to get this in order. It's almost like preparing a house for renovation or for sale. You've got to get into the basement, into the different areas. You've got to make sure there's no moisture in there, you've got to make sure there's no leaks, there's no drafts, everything's properly set up. So I don't know how your messaging works for that, I haven't looked too closely, but to me, I feel like someone is looking for exactly what you do.

Rory: So just to give you sight and visibility, Caleb, of what I do and how I operate. A collaboration with a lady called Kylie Fowler. And if folks don't know Kylie, then by all means do look her up on LinkedIn, do connect with her. She's an absolute legend in respect of IT asset management, cloud, and AI, and the governance around it. We sell process kits in line with the ISO standards. For hardware, for software, for cloud, and we're working on the AI process kit at the moment.

Caleb: And how do you spell Kylie? Can you say it a little bit slower?

Rory: Kylie, K-Y-L-I-E, space, Fowler, F-O-W-L-E-R.

So we don't sell a lot of these kits, unfortunately, which is a bit of a blow to morale, because we put a lot of effort into these things. They're top drawer. I really believe that. But where we're going with the product development, the monetization of our time and effort and our experience in these kits, because they're PDFs and videos. You can change them and you get your own custom processes, or you can bring us in and we can customize them for you for a consultancy engagement.

But where we're going with the IP in the kits is to create an add-on. I'm wary of using the expression plugin, because it has its own connotations, but an additional piece of software that will plug into your SAM or ITAM suite and tell you where the data does not sit well with the processes that you should have in place. So rather than this ITAM or SAM suite saying, this is your view of the estate based on Microsoft or Oracle or IBM, what it says instead is, this is where the data is not supporting your joiners, movers, leavers process, or your software request process, or your lost and stolen devices process. And it basically gives you a to-do list of go fix this stuff.

And that's where I think the mergers and acquisitions use case is of supreme value. Because at that point, you're not tipping your hand to an organization that is being bought. Because it's just adding somebody's name in a database and giving them permissions to connect to our product, and then we can give you that maturity assessment straight away. We can give you that view, and nobody is any the wiser at that point. It doesn't tip your hand in that respect.

Caleb: So is samcharter.com the best place to find out more about those kits that you've put together?

Rory: The best website is itamaccelerate.com, and that's I-T-A-M, the word accelerate, dot com. And that's a joint brand between Kylie and I on that score.

Caleb: Very cool. So last question I'd like to ask is, if you had to pick one thing that you need most to grow right now, what would you suggest that that would be?

Rory: We're after technology vendor partners. Right now, that product I mentioned to plug into SAM suites is called Remora. And it is at an MVP stage of maturity. We've got a massive roadmap that we want to develop and bring it through, so it's truly ready for market and it will blitz the enterprise, as it were. We're looking for technology vendor partners who have either Flexera, ServiceNow SAM Pro, or Xensam installed, who would be interested in working with us to accelerate the roadmap quicker, so we can go to market sooner, and they can get preferential rates on licensing moving forward.

Caleb: Rory, thank you so much. Really appreciate it.

Rory: Thank you, Caleb. It's been great speaking with you.