HOW TO RUN QBRS THAT UPSELL YOUR CLIENTS

What is up everybody? Hope you guys are having a fantastic day. Welcome to another 7 figure MSP live webcast. My name is Chris Weiser here with you guys today. Waiting on my trusty companion that's going to be doing the webcast with me today. That's Ryan o'. Hara. Ryan is an MSP and was like, I think I need to reboot now.

And then it took forever and then it took for.

I mean it's typical. Yeah. How it goes, right? Well, Ryan, you came back into us being live, so welcome to the party. So that's kind of cool.

Hello.

So we got a great webcast for you guys today. Gonna just get your rolling here. Let me get our. You good? Ryan, you are left.

I'm good, yeah. So are you. I don't know if. If it's me on the source side. I got my backup laptop here ready to go. Just in.

Yeah. Okay, we'll see where it goes here. Anybody? So you guys that are here with us live, throw me some stuff in the chat to make sure that you guys can see us. We got a ton of people on with us live. We got a lot of stuff going on here. Let me just make sure. I am good too. Yeah, I'm. I'm good. It shows you're on WI fi and have low stream signal quality. Just so you know that.

Okay, cool.

So we're getting people commenting, so that's great. Yeah, it's weird. It could, you know, it could be a stream yard problem. Who knows? I mean there's always this stuff now just whatever you just did, it just went away. So that was good. So that's good. So you got a lot of people on with us live. Awesome guys. Good to see you. So we got a really cool webcast for you today. You kind of get a unique experience because you get two guys that used to own MSPs in the same room together, which Ryan and I, we're both kind of unique because we both used to be techs. And when I started my msp Back in 2004, late 2004, early 2005, I was the only tech. Ryan, we went through this last week on our, on our all hands coaching call and I immediately started hiring help desk guys and phone answering guys and all that stuff out of the box. And Ryan, I was in Milwaukee. Ryan was actually in Detroit. So we were actually both Midwest guys. And you know, Ryan, you are an MSP owner as well. I sold in 2015. When did you sell.

Last year? Last April.

Okay, last. So yeah, 2023 for Ryan, so, so we're gonna give you guys some, some pretty unique stuff now. A couple things that I'm going to talk about early here and we'll get into this just while we wait for people to join. Just make sure we get as many people in here as we can. And Ryan's trying to deal with his little bit of a tech stuff stuff here. How you doing? You okay? You're still lagging like crazy, man. I don't know what the deal is.

I'm. Yeah, I think I'm. It's hardwired. I'm gonna switch to WI Fi because I think that might be part of the problem here. I think something's going on with my connection.

If any of you guys as msps can help Ryan, that might be the path you want to go. So I love it, I love it. But anyway, so we're going to give you some unique stuff today. Most msps don't run regular business reviews, which I find to be honestly astonishing. And I'm going to talk a little bit about this just while Ryan gets rowing, while Ryan gets going here. But a lot of MSPs do not do regular client reviews. We've done a couple of surveys to not only the public, but our membership as well in seven figure msp in our coaching program, in our coaching program we see about 80% of members run regular client business reviews. But in the public we see about 25% runs client business reviews. And I think most of it is like, hey, we really want to, but either we don't know how to do it or it's uncomfortable and I don't want to deal with it or I just don't have the time. And not having the time is probably the biggest factor that we see that people saying they don't have time for it or don't have the avenue to do it. So we're going to give you a pretty solid roadmap today on how to run what would be known as a client quarterly business review. Now a couple caveats I'm going to throw in here for you guys out of the box. Number one, I like to call them TBRs, Technology Business Reviews. And Ryan and I kind of go back on this back and forth, back and forth. Because an industry standard term in the MSP world is quarterly business Review, qbr, all these terms, that's what that is. Now I personally view this a couple of different ways. Number one, you should be meeting with your clients on a regular basis. That's thing number one. Without question, the more important the client is, the more often you should meet with them. Now Ryan's going to go through and actually, really quick, how do we quantify what's important? Well, for the most part, how much do they pay you and how important are they to your business? The more often that you should meet with them. Right. So if they're a whale, you should be there at least every month in person meeting with their principals. Ryan's going to walk through what to review today, but I want to plant that seed. The more important they are with you, the more often. And I don't care what you call it internally. It doesn't matter. I would probably not call it a technology business review or a QBR or a cbr cyber cybersecurity business review. I wouldn't call it any of that stuff with your clients. I would just meet with them and you run the agenda and you run the show. These things are really, really critical. Think about, like going to your accountant. Think about, you know, think about any professional services industry that you personally work within your business. The experts that you hire, if they're any good at their job, what do they have you do on a regular basis? Review numbers. They control the cadence. They review whatever their measurables are with you, and they control the cadence. So I want to plan a couple, you know, a couple of those things in your head, and I want you guys to be very conscious of that. That stuff matters so much. So if you're relying on your client to meet with you, it's not going to go very well. First of all, probably not going to happen because they don't have time for this. The second thing that I'm going to tell you, and I have not really reviewed Ryan's slides for today, so a little bit of this I might be saying over the top, but another thing I want to make sure I plant is how critical mission, mission critical it is to focus on the things that the stakeholders care about. Do not care about tech reports and ticket numbers. Maybe if there's an issue, you address it. But for the most part, you want to talk about things that the stakeholders care about. Which overall, without question, in every business, stakeholders care about money and the things that move the needle to them. So money's one of them that moves the needle. But then what other metrics do that does that decision maker care about in their business? It's usually not ticket numbers. It's not response time. It's not. It's not stuff that they think they're hiring you for anyway. Okay, so I'm gonna go through a couple things really quick here and then we're gonna bring Ryan on here. We're gonna walk through this stuff. We'll get rolling. So. So I'm going to add a couple things here to the stage on my side and then we'll bring Ryan here. Let me make that a little bit bigger. I wonder if I. I think I'm almost better smaller, huh? I don't know. We'll see. We'll get there.

Okay.

Oh, shoot. I screwed that up. Okay, there we go. I think actually Ryan, just so you know, I know you're still listening. I think Streamyard's having some problems. Cause I'm seeing some weird lag on my side too. So I would entirely say that it's not you. I know he's switching devices right now, but we'll get rolling in here and we're gonna get. I'm gonna get started and we'll bring.

Ryan here in a minute.

So a couple things for you guys today with me. First of all, my promise to you that we're gonna do for today. We're going to show you exactly how to use CSRAs within and inside of your quarterly and technology business reviews, depending on how often you do them, whether they're quarterly, whether they're monthly, whether they're. Honestly, the bigger. If you have a massive client, you could do it weekly. There's a lot of things going on here. Okay. A lot of stuff going on. So I want you to pay very special attention to everything that we're dealing with today. We're going to show you kind of how to conduct these. But the bottom line is we are going to refocus your QBR from this ticket based, backup based. Hey Ryan, you got a ton of background noise now too, so I don't like you.

Switch to the backup computer. Hang on. I think I know it's the mic. I always have a backup and now I gotta switch.

You gotta just mute yourself. I'm here for a second. Sorry guys. I think it's the platform that we got going on today, but we've got a weird, weird stuff going on that's not normal. So bottom line, we're going to show you all the stuff to help thousands a month to your business and at the very least keeping your clients very, very happy. That's really important things to be mindful of. So we're going to show you all the steps to this just by being on the call today. You're going to get a ton of free, really, really valuable content along with Multiple deliverables to help take you to the next level. And to add this to your MSP offering, to add this to your MSSP offering. There's all kinds of different pieces that you can do that we're going to show you guys today. We're going to show you the sales process that we use inside of our program with our existing clients, for their existing clients. So this is not necessarily about new prospects. Now, you can definitely use this to sell or to do these other things, but the bottom line that you should be focusing on with today's content is this is how you keep existing clients happy. This is how you make sure that you're ahead of this. Remember, I said think about what the things that the stakeholders care about, what moves the needle to them. And then you schedule your reviews with them on your cadence. Now, again, that depends on the size of the client. Minimum quarterly, my largest, probably five clients on my MSP we've met with every single month. And I want you to be very mindful of that. So we're going to take these processes then help you learn this. And now I know our company is called 7Figure MSP, blah, blah, blah. We have people say like, oh, you only work with seven figure companies. Are you doing seven figure deals? Because you should be, because that's the level. So we're talking about seven figure years, seven, seven figure quarters, seven figure months, seven figure deals. That's the mindset you want. And all the same principles and prospects and pieces apply to this. Okay, guys. So keep that in mind. And if you guys stay until the end with me, I got a couple of things with you. I have multiple prizes. So one winner is going to get a $250Amazon gift card that's going to be delivered through tremendous dot com. So that works in Canada, that works in the States. If you're in the uk, it's the only place that doesn't work that we've kind of figured out. If you're in the UK, we'll get you PayPal or something like that. We'll get you cash. But it does work in Australia. It does work in the us Also works in the United States obviously as well. So one winner is going to get a $250 gift card. Second winner is going to get a $100Amazon gift card as well. You know what? I'm hitting my backwards button on accident. Second winner is going to get a $100Amazon gift card. And then everyone that's with us on the webcast is going to have the opportunity to get a $50Amazon gift card by booking a call with our sales team. We're going to give you a booking call link a couple times during today's webcast and we'll see where we guys get from there. Okay? Last thing I got for you guys before I bring Ryan in here is please pay attention. That means, and I know this is tough for you guys because we got tickets up, we got all this stuff blowing up all the time. So that means put your tickets away, put your phone away. My phone is put away over here on the side. Put your phone away for a while. Close your tickets, close your email, close your teams, close your slack. I know it's hard guys, but let's just try and focus on no distractions for 60 minutes. Like Ryan and I committed to making this a 60 minute webinar today. And that's our goal, is to, to give you guys 60 minutes. And let's see what we got from there. We're going to have a time for Q and A. We're going to have a bunch of other stuff and if you're serious about changing your Life, give us 60 minutes. That's all we asked you to do. And then we'll, we'll work on, you know, we got questions, we got some other stuff as we go here, going out. And then at the end, I'm also going to have a little gift for you guys, a special bonus, Our ultimate cybersecurity Risk assessment guide. Ryan's got a giveaway that he's doing which is a deliverable that he built up specifically for QBRs, TBRs, just for this webcast. And then I have our ultimate CSRA guide that's redone for 2024, which I'm going to give you guys a link for as well. So just to give you a little background on me, if you don't know who I am going to go through a couple different things for you guys. My name is Chris Weiser. I was an MSP owner up in the Milwaukee, Wisconsin market. That's about for you guys that are not from the States or even maybe North America. That's about an hour and a half north of Chicago in the Midwest. So we had about a million person overall market. I started that MSP in 2005 early. Like January 2005 was my official start date. So end of 2004 in reality sold that MSP mid 2015. So I had that over 10 years. I had almost 300k of MRR when I sold the company. Now that was before cyber security that was before all this other stuff that really, really happened. So all those same principles that I took to grow that company from a zero person shop or you know, I guess a one person shop to a 30 person, pretty decent sized company. Now I'm not gonna sit here and say that I was a hundred million dollar company owner. We did very, very solid revenue. We had a really good company that was profitable. I sold it with a good seven figure exit but it wasn't retire money. So I do different things. And what I've done now since then is built a multimillion dollar eight figure. In fact, we found this out last week. We won. We are in the Inc. 5000 for the second time as well. Can't really officially announce that yet, but I can say it on a webcast. We are in the Inc. 5000 for the second time. So we've built a multi million dollar eight figure coaching firm called Seven Figure MSP. And everything that we do in this company, everything that we do in this program is built on making you guys profitable. Cash. That's what we do. Yes, we want you to be really successful service delivery companies. But nobody does well if you don't make money. And I'm going to promise you that. I had somebody tell me on the, on the post last week, Ryan, they're like, oh yeah, all money. You know, you just suck at managing money if you're not profitable as an MSP and okay, that's fine, but you got to be, you got to be profitable and you got to know how to run the business the right way. Especially in today's world.

Right?

So speaking of seeing me on stage, we do have our Denver event coming up here shortly. This is our Q3 2024 double your MRR live training. This is at the Brown palace in Denver, Colorado. That's in the States. We have an awesome, awesome event. We have our live. It's a Tuesday, Wednesday, Thursday, August 13th, 14th and 15th, 2024. We'd love to have you come spend a couple days with us. Here's your URL, Ryan, if you want to throw that in the chat for me as well. That's our URL to sign up for that. I'm also going to have a a thing on the screen, but you can come join us. We have some amazing speakers. We have Mr. Penn Jillette from Penn and Teller. We have Jeff. What the hell is Jeff's last name? I can't remember Jeff's last name. Guy doing a whole talk on AI.

It's an L, isn't it?

Yeah, I just brain fart. But also we are doing, our Wednesday night event is going to be at Red Rocks Amphitheater. We are going to go see Spoon and Revitalists. We have a whole custom area and some really cool stuff for that as well. That's going to be brought to you by a couple different sponsors that are with our group, from Flexpoint to Citricom and a couple other different partners that are helping us out on that as well. So you guys can either hit that URL that Ryan put in the chat there. You can also those of you guys that are on Facebook and LinkedIn and the rest of the places, you can hit that QR code or go to seven figure MSP events.com forward/denver. We'd love to have you guys there and it's really, really cool. So, Ryan, I'm gonna kind of let you go. I'm gonna bring up your stuff for our next slide. Let. We'll let Mr. Ryan O' Hara take it away.

Does it sound better a little bit now?

Definitely. Definitely better than it was.

I see I ended up switching to my backup laptop, so I think that there's some streamyard issues. I think my laptop was freaking out a little bit as well. Then when I brought it back, I.

Don'T, I don't think it's, I don't think it's your laptop. I think we're seeing some lag here and there and I think they're having some Internet issues at streamyard today.

So could be it was significantly better when I switched. So it is what it is.

Yeah. Everything that I see right now is great. So I'll just let you take it away.

We'll keep going on. All right, so as Chris mentioned, we're going to talk and we're going to use the term qbr, but we're mainly using the term QBR because, because it's an industry standard term. We're going to teach you how to use that as leverage to have these conversations with your customers and educate them on the things that they really need to know, things that are maybe important to them that they don't even realize that they need to be focusing on right now. Because let's face it, if you think about the MSP industry for years and years and years, for them it's been about mapping printers and my computer's running slow. A lot of these small, medium sized business clients don't even realize that risk is something that they need to look at because they're just living in that bubble of I Don't need to worry about that. That kind of stuff. I'm too small. Like, things are not going to happen to me. I don't have anything hackers want anyway. So what we need to do is have these conversations with our customers and make sure that they are aware of the risks. We have to talk to them about this and let them come to terms with this so they can ultimately make a decision with actual information. So, like, one of my running jokes is that your average business owner puts more research into what they're having for lunch that day than they do into how they choose their IT company. And I think that's really, really true. Like, if you really look at it like all of the traditional sales process, the traditional conversations we have from an IT standpoint with a lot of business owners, like, it revolves around either price or like, my computer's not running that fast. And things have obviously changed in this world with the risks that are coming out. And we need to find ways to have these conversations with our customers. So when we talk about QBRs here, this is our opportunity now as the provider for that company to have these conversations and be able to really educate them on what they need to be worried about. Because we're the experts in this situation, you know, and in a lot of cases, we're going to need to flip the script on that because they're really just looking at us more as a general service provider. Right. We need to be more the doctor than the janitor.

Yeah. I really like what you said there. And I want you guys that are watching this to really think about how you work with your clients and where the positioning is. Right. We talked about this in our onboarding call this morning, coincidentally. Right. And I think this is a really important concept, and it's a little bit of a mind shift that you as an MSP owner and your team needs to think about. This is no longer a place where your client should be allowed to dictate any of this. You think about any professional services organization that you work with, they dictate the cadence. They dictate the when and the why and the how and the what. Now, that doesn't necessarily mean you're a jerk. Like, it's fine to do this stuff and be professional because your clients are will respond to this. We don't go in and be like, but you're actively talking to them and being really conscious of setting expectations. Here's when we're going to meet. We are experts. And what's the why? I want you to be understanding the why. The why is making sure they realize that this stuff is really, really necessary. Because we have to now lay a path showing that we cared about protection and recovery. There is no more prevention, guys. Your clients have to understand that. And I know you're sitting there like, oh, I can prevent some stuff. Yeah, I know we can prevent some stuff, but we can't prevent everything. So you have to go into every single meeting saying, here's our best courses of action. We have to be ready for the, we have to be ready for D day. The hurricane's coming, we got to get ready and we have to make sure that somebody's here to pay the bill. So you're laying that groundwork behind you, that path, establishing so much deniability and making sure your client just understands the why that's so critical now. Okay, Ryan, sorry, take your.

And, and it's, it's sometimes it's a difficult conversation to have because you, you know that they're not going to want to pay for it. You know that like they're, they're just thinking that this is another upsell fail tactic. But if you really, really think about it, the real disservice is not explaining to them what's really going on out there. Okay. We see day in and day out, the statistics show it. We've dealt with, most of us, some form of incident response. So we're seeing this happen on a daily basis and not educating our clients and allowing them to have that, that standpoint, that assumption that they're not a target, I think is the biggest, bigger disservice than not having this conversation with them the first place. And if you think about it like you go to a doctor, right? Doctor's going to tell you what they recommend as far as a treatment for whatever you're there for, like you still got the right and the opportunity to decline that treatment and go a different path. But the doctor has as a responsibility to let you know what's really going on and what their prescribed treatment would be, what the best course of action in their opinion would be. We're no different anymore. And that's, that's the reality we live in and that's what we need to educate our customers. So my first question to people is, how many of you are actually doing some form of qbr, tbr, regular check ins with your client? Go ahead and put it in the chat if you can, but this is something where I talk to a lot of MSPs and I don't think I've ever had Anybody disagree and say that this was a bad idea or this was not something that you need to do. But the number of people when I talk to them that are actually doing this is surprisingly low. And I think part of it is because people don't have an idea of what, what to do. I think a lot of it is, is not, you know, when, when we think about the tech mind, right? Like, are you actually covering things that they care about? A lot of us have that tech background. We started these, these businesses because it was something that we were good at and we were familiar with and we talk a lot about tech. And the average customer that you have doesn't care about that stuff, right? So we're spending all of this time talking about tech and tickets.

And actually, I'll say this too, even if they care, it doesn't serve their best needs, right? So I want you to be mindful of that. Like, even if you have somebody that likes tech and you're entertaining them and they're staying focused, it's not necessarily in their best interest to talk about tech and tickets.

It's not actionable in a lot of cases. I mean, like, you know, minorly so. Like you're talking about maybe response times or things like that, but it's not stuff that's going to drive their business. It's not something that's going to dictate their decision making process for the next six to 12 months. Right. So what you need to be focusing on are things like risk and money. Like, you have to think about these conversations less from a, I'm a technician and I'm going to talk to them about tech and tickets, but more from a business owner to business owner kind of conversation. Okay. And when you think about the business aspect of your company, you're thinking about things like risk and money. Because without money you don't have a business. And you have to be playing the, the, the odds and looking at risk. Because if you're not taking risks or if you don't are not aware of the risks that you have at stake, you know, you're going to have some potential problems with your decision making process in your business. Okay. Daniel had an answer to my question about QBRs and I think this is probably another, another one that's, that's very consistent answer that I get from MSP is yes, but not consistent. So, you know, it's probably one of those things that comes up when something comes up or when you have something specific to talk to them about. And I think this is another reason why? In a lot of cases, customers are now kind of geared to, when we reach out to them and have meetings like this, they just assume that we're coming to nickel and dime them or upsell them on one thing or another. Okay, now what we're going to talk about here is, yes, if they're not on a full cybersecurity stack, we are going to be making recommendations to them and we are going to be talking about stuff, stuff that they need. But the context in the way that you deliver this is really, really critical. Right. We're not going in and giving them a sales pitch per se. We're going in and we're educating them on something that they probably didn't know much about at a minimum before we had this conversation. So each QBR really should be, whatever you want to call it should be a mini risk assessment because that's one of the critical things that they need to understand and they need to be aware of. And again, you know, while they know, you know, they probably have a better idea of the calories than in what they ordered for lunch, than they do how much PII is on their systems, and that's, that's a problem. So we need to educate them on what their risk actually looks like. Because that, that's, that's a really perfect example. I mean, I don't know how many of you have done CSRAs in the past or have evaluated things like personal identifiable information. But I know for me, I know for a lot of people who are part of our community, like when you start having those conversations with customers and ask them how much personal identifiable information they have on their network, I mean, short of like the really obvious examples like a CPA who deals in Social Security numbers and financial information, most business owners are going to tell you, oh, I don't have anything like that. We're good. Or it's in the cloud. I don't have to worry about that.

That's the big answer now, right? Is it in the cloud? That's the whole CDK breach. If you guys don't know what that is. A big car dealership back end got breached in the last couple weeks, probably about a month now, I think.

Yeah, well, it's still ongoing, so it seems like yesterday.

But a lot of the dealerships, in fact, we had a member talk to us today that he's doing a CSRA with a CDK dealership literally today. And one of their big responses to him prior to that is, we're in the cloud. We're great, right? So that's these people need to understand.

Well, and it goes back to the. The unintentional ignorance, right? Like, you know, most of them still don't understand even what the cloud is. I mean, it's not that different than, you know, their old server that they used to have on site. It's just now somebody else has it. So that data still exists someplace, and you are the person or the company that, that, that your customers trusted with that data. So whether you use a third party or store it locally, that responsibility is still yours. And we all know that there's a million ways that somebody can get that. It doesn't have to be somebody attacking that cloud provider. It could be something as simple as an attack on one of your computers and a simple key logger to get the logins to log into that. But the point being is we need to educate them on what their risk really looks like, because most of them don't have a clue. They have those assumptions about being in the cloud and being safe or being somebody else's responsibility or not being a target. We need to talk about this stuff to them so that they can make an informed decision on how they want to manage it. Okay? And at the end of the day, it's their decision. But if we're not educating them on it, they don't have the information in order to even be able to make that decision. So that's our job. And when I talk about this not being a sales pitch, that's. That's the way it. The context and the way that you speak about it. It's about educating your customers. Because even if they do decide to go and accept that risk or, you know, take another course of action to handle that risk, now, they are at least 10 steps further from where they were before because they understand what their risk actually looks like. And that's part of the service that we offer. And that's how you are able to set yourself apart as an expert, as opposed to, you know, somebody who's just coming in and selling the latest tool that, you know, another vendor had sold you. Right? Which is kind of how we've been doing things for years. We added that next thing to our tool stack from this vendor that we met at a trade show or something, and now we're trying to sell that to our customers. Now we're selling cybersecurity. We're selling risk. We're selling our risk management. We're selling a platform based on cybersecurity frameworks to provide the solutions to that, to provide the Layers to help them. But we need to educate them so that they can make that decision for themselves.

Themselves.

So what we're going to go through here is kind of the process. And I purposely didn't go super heavy on the slides because I wanted to have some conversation. I know Chris and I both have a lot of opinions on this, a lot of background on this. So we're going to have some conversations on some of this stuff. And now you may have customers, either now or in the future, that are already on your full stack cyber security plan. This is the process for those that are not on. And, and quite frankly, this, this still applies in a lot of those cases as well. Because this is a constantly moving target. It's. It's constantly evolving. You know, things have changed. Cyber attacks are way up. You know, we've been saying that in our community for years, and it's no different today than it was two years ago, five years ago. Right. Like, it's just, honestly, it's just changing faster as we continue to move forward.

Yeah. One thing I want to say on this too. There's definitely some of you that are going to say, what do you mean my full stack cyber security plan? So one of the things that we train inside of our coaching program is one stack. No more good, better, best you should be. Now, this is not saying I want you to be very common sense applies to this. And I want to be very conscious. I want you to be very conscious of this. And I want to be very clear. Think about what you should be putting in at every single client. And that's where you really have to be. Now. That's what Ryan's going to go over here. But I want to just kind of like set the bar as the reason we talk about this and the reason we talk about good, better, best, no longer existing. Like, you can deliver down the road, whatever. Okay. It's a math problem. It's not that hard to figure out. But the bottom line here is going into every single client you should be delivering to them. And this varies based on every single client. You should have a baseline kind of standard, but it really varies based on every single client. What should we be putting in for them? That should be your baseline, and that's where you should be sitting with every single client. So when we talk about your full cyber, Full stack cybersecurity plan, it's. You did an assessment. This is what they should have. We've educated them so much that they have the knowledge now to where they can, like, okay, we understand why so if you're doing exactly the same stuff that you've always done and you just plop in front of them, you know, a 200 raise in prices to put cyber security, they're going to be like, get the hell out of my office, because all you're doing is jacking up the rates. There has to be concept and process and procedure behind this. That's completely different than how you've done this in the past. And I want you to be very, very conscious of that. Because if you try and walk in the door with a 200 or 500 raise and they don't get it, all you are is a widget. And what do people do with widgets? They price shop widgets. So be very mindful of that. Sorry, Ryan. I just wanted to get that out.

Well, and the opposite can be true, too. I mean, this is something that we've talked about a few times where I, I had an example of this. You can also have clients that trust you implicitly, that you've got so much know like and trust built up that when you go and talk to them about cyber security, they know it's coming. I, I don't have the time to listen to this. I, I just want, you know, just tell me where to sign and I'll upgrade.

Right.

That's. You can have the exact same problem in the opposite direction with that, because eventually they're going to go, why am I paying all of this? If they don't understand the what and the why, at some point it's going to come back to price. Whether it's one month from now or six months from now, if they don't understand why they're doing it, they need to be educated. And a lot of this just has to do with that mindset shift that MSP business owners need to have from that providing a service to being an expert. Okay.

Yeah.

Whether it's, whether it's ongoing MSP services, whether it's advising somebody who comes to you who already is in the midst of a cyber incident, whether it's just, what do you think I need to do for this project? Here's what we want to accomplish. We need to think about this as an expert from every angle. Always start with what your expert recommendation is. If you need to back into something else, if they want to accept the risk, if they want to do things a little bit different way. Nobody's saying that you can't take that business on and do what they ultimately are asking you to do, but you always need to start with what Your expert opinion is because if you think about it from a security standpoint, if you only go to them and sell them, what you think that they're going to say yes to or what you think that they're going to be able to afford and then they get hacked.

Yeah.

You think the insurance company is going to care if you said, well, I didn't tell them about it because I didn't think that they could afford. Afford it? No. They're going to say, why you, you should have known better. Why didn't you have this conversation?

You're their expert. What are you doing? Right.

So every decision you need you make, every, every conversation you have with your customers needs to begin with your expert opinion. And you can always back from that. But that involves the customer making that conscious decision to do something other than what you recommend. And I, I still think you're probably going to have those lines in the sand too, where there's just like, you're not going to go that far. Right.

Well, so many of these people are not gonna. I want you guys to be also conscious of the fact that most of your clients probably aren't ready for, they're surely not financially ready for this because they've been doing stuff the same way for as long as they've had technology. So it's on you to flip their brain. And some of them are not ready. Some of them, like, some of them, it's going to take some type of a push that's probably not going to be from you. That push is insurance company legislation. Maybe them getting breached, maybe them having a vendor in their supply chain get breached. There's all these different things that are going to maybe push them. And you want to look like the person in the shop that said, we told you. And then they're like, oh, crap, you were right. Like that. Positioning is so important, guys. And you got to understand that the times we say this a lot. Ryan mentioned this earlier, times have changed. We have to do things differently. So you have to position this all now with that in mind, 100%.

And yeah, it's really just getting in that right frame of mind and looking at that kind of stuff and understanding that stuff, and that's really what's going to help make the difference for you when you're having these conversations. All right, so we're going to get a little bit into this. And now this laptop's acting up and my display just went wonky.

No, I, I, I legit think it's, it's something with streamyard. Ryan Just lost his camera. Sorry, guys, I don't know what's going on today. We'll give it just a second here. A couple things that I'm gonna say. If you guys got any, any comments while we're sitting here, any questions, feel free to throw in the chat. I think there's something, you know, it's always DNS, right? It's always some DNS or something going on here. But a couple things that I want. I don't even have control or Ryan's damn, damn slides. But I want you to be conscious of all of the things that we're actively talking about here. And one question I want to ask you while we're sitting here now that we're thinking about this. Do you guys think this is the right approach? Do you think QBRs are the right approach? Do you think cybersecurity focused QBRs are the right approach? Why don't you give me something in the chat and let's talk about it really quick while we wait for Ryan to get back here. He's trying to get back here. I can tell. And then if I have to finish this out, I will. But do you think QBRs are the right approach? Do you think Cyber security focused QBRs.

Are the right approach?

And we'll give it a second here while we're going. I know there's a bunch of outages around the Internet here in the states today too because I actually had to come home because my office Internet is down and I have Google Fiber. So something's like something's weird today. I don't know what it is. Probably a. Probably a hack or something. Probably a debate hack. The United States Debate Act. Yep. Okay, so Mark just said here, yes, I agree that these are the right approaches. I really like this from Daniel. Needs to strike a balance between cyber security and general developments that might benefit the customer's need. I totally agree with that. And I want to stress Again, most MSPs that I talk to and I'm going to say 90% plus, their idea of QBR is printing out the tickets for the month and reviewing them and then talking about the server status and the server health and all that kind of stuff. I'm going to tell you right now, clients do not care about that. And even if they do care about that, it does not move the needle towards justifying your spend or seeing the things that you want to be doing. So it's really, really important stuff to think about. I really like this as well from Fabioso. I think it is. Sorry, it is One of the approaches, but cannot limit oneself to one approach. I really agree with those things as well. So Ryan, are you back? You can't hear you at all though. You have no audio. No audio. So guys, I'm also give you some advice. Don't bring Ryan o' Hara on to do webinars with you, okay? Got another comment here from David. Ryan, just talk when you're ready. I'm gonna keep going on this. Another comment here from David. We used to run regular calls with clients. The challenge was finding enough to talk about to make the calls worthwhile without being just sales spam. Really, really good point. Which is why you want to make it cyber security focused. Because there's so much stuff to talk about, right? So much relevant content to talk about with breaches and security and all those other things. Another one here from Comb. Yes, but we see QBRs as being the same as cyber based QBRs anyway. Why draw a distinction? Hey, you call it whatever you want. We're not saying necessarily drawing a distinction, guys. We're saying do the QBR but make it focused on cyber is what we're saying. Ryan, you back yet? Nope, no audio. How do you. How are you breaking? I thought you're a tech guy, man. Daniel said example. Many customers are wanting to embrace the hot new topic AI. So totally agree with this, Daniel. Really, really good point. Make a good chunk of your qBR or your TBR or whatever your business review is directly related to educating on a new topic. You could also make this about the whole staff, right? Maybe make part of your qBR or your TBR or whatever your review period is all about a new topic. Love that. Have no arguments with that at all. Well, this is a show. Sorry guys. We don't normally have too many bugs during our. During our webcast. Ryan, you right? He's sitting here in the lobby. I'm watching him. Nope. This is terrible. I'm sorry, guys. I don't know what to tell you. Frustrating. Okay, so I am gonna bounce. But let me just get my slides backwards here to where we're on Ryan's slides and then I can kind of COVID this. I'll go through this on my own without him. Ross, just put this in here. I'm with you, buddy. Sorry, man. It's technology glitches sometimes. Yeah, I appreciate, appreciate it, buddy. I'm sorry. Just live some. It is what it is. I did hear a beep of some sort. You got audio now? There you go.

All right. I just. I had to kill my entire browser at that Point. I don't know what's going on.

It definitely feels like user error to me.

So it may be a little, little bit of that, a little bit of street yard. I don't know. Who knows what's going on.

I'm gonna address the next question from Justin here as well. Okay. Some people are already getting buzzword fatigue over AI. Don't, don't disagree with this. That doesn't mean that it's not relevant though. You don't have to call it AI. You can call whatever the hell you want. But I just will tell you that it's really important to continually talk about these things and just educate, make it relevant. Totally agree with you, Justin. Have no argument over that.

All right, good to go.

I'm gonna add you back to the stage. Okay. All right folks, he's back.

We'll speak for how long?

Like what kind of laptop you got? I don't even know what this, like what is going on.

My second laptop just for this one stream yard, so I don't know what's going on.

Geez, must be Detroit.

So decision makers, it's really, really important to make sure the decision makers in the room. This is Another thing with QBRs that tends to happen a lot. It's real easy for business owners to dismiss as much as, as sometimes we as MSP owners like to avoid. These business owners like to avoid them as well because again, they're always just assuming that you're going to be asking for something or you know, trying to, it's going to cost them more. So they need to be in there. But the thing is like, even if, even if the person who is in the room had the authority to make your typical IT decision, this is something that is typically going to be above those delegated decision makers authority. Okay. We're going to talk about things involving risk that even the business owner has probably never spoken with with their IT provider that that person who is delegated is definitely not going to be able to make that decision. And so it's something that's really, really important to set that table early and set that tone. You know, you're, you may not be able to guarantee that you get them in there. You may end up having to get that person who is delegated for decisions delegated to have that conversation moving forward and at least understanding and being in your corner. Like wow, I didn't realize that we even have this much risk. I've never thought of things that way. And then get that decision maker in there for a follow up meeting. But as much as you can, you want to try and get that decision maker in the room and have that conversation with them. Because the last thing you want to get is, is somebody trying to convey what you talk about to the decision maker not being in there, not having that context, because then it's just going to come down to price at that point. So step one, make sure you get that decision maker in the room. And then what we're going to do is we're going to complete a cybersecurity risk assessment. So this is a big part of this. And again, we're basically using the concept of a QBR to, to as an opportunity to educate our customer on what their risk looks like. So we're going to do some things like dark web scan, vulnerability scan, Personal identifiable information and password scans, SAS analysis, phishing campaigns. Like these are, these are kind of the core pieces of what a basic cybersecurity risk assessment looks like. The way that I look at it, this is the bare minimum. The more information that you can gather, the better. I like to use the analogy of this being a crime scene investigation, right. When we run these tools, these are the things that are going out and gathering the evidence at the crime scene for us. And then we take that information as the MSP owner or as the technical contact at your msp, whoever's going to be actually performing, performing these. And we do, we, we look at this as a detective, right? We're analyzing how instead of how the crime was committed, the most likely way that the crime is going to be committed, how the hackers are going to do this. Okay, we're analyzing the results as if we were a cyber criminal ourselves.

Maybe, maybe like a, an analysis of how hackable your client is.

Yeah.

Now, one challenge that I will tell you that you guys are probably going to start thinking about, of this is, okay, doesn't that put me in the crosshairs? Doesn't make, doesn't that make me look bad? This is why you have to be educating your clients. Now keep in mind we're talking specifically existing clients in this point. This is why you have to be constantly, always educating your clients that times have changed, things have to be done differently. So one of the things that we recommend you do, like when we bring new prospects, or let me clarify, when we bring new clients into seven figure msp, the first thing that we have, you guys do go back to your existing client base. Let's start talking about how times have changed, why things are different. We give you a sales presentation all around that we had you do a CSRA as part of that, a cybersecurity risk assessment and then we present to them educating the whole time. Now by going back to them on a regular basis with your QBRs, this gives you the opportunity to regular regularly hammer all of this home. But you have to educate really well. You can't just go in there and talk a bunch of mumbo jumbo like AI this and AI that or cyber security this and cyber security that. You have to make sure you speak in language that they understand. And it's very, very business relevant things like they are going to, the hackers are actively going after your money. Here's how relevant this is. And then one other thing I want you to be very conscious of. The other factor that I'm seeing from a lot of MSPs is they aren't delivering a lot of cyber security services anyway and don't know how to upsell their clients. So they just like put stuff in place and eat the cost. At some point the problem you're going to have is you can't upsell them. If you keep doing that and you're going to kind of, you're kind of screwing yourself. So be very careful.

You can't sustain a business that way.

Definitely can't sustain a business that way.

Way. All right, so we're looking at the results. We're analyzing them like a cyber criminal. I mean essentially what we're doing is we're getting prepped to tell them a story. Like with the information that we found in this assessment, if we were the hacker, the most likely way we would be, we would be hacking them. And the, what we're trying to get them to understand is how easy it would be in the right set of circumstances to hack them where they're at right now and, and really showing them that they're not a specific target like they assume, but that the hackers are doing more of a net phishing attack. They're trying to find any way that they can to find all of this low hanging fruit. And in 99% of cases they don't even know who you are until they get into your systems and have access and start looking around. So really, really important to make sure that they understand how easy it is and how susceptible they are right now in their current standpoint point to, to being hacked. So once you've got that information, you're going to start putting your presentation together and now you're going to get into the presentation, you're going to use stories. This is really, really Important. So I think a lot of us have a tendency to get overly technical, to use, you know, a lot of statistics. But if you think about it, think about statistics, right? Like if you come in and tell somebody like, hey, 80% of attacks are small businesses, it's real easy to disassociate yourself with that statistic. Oh, well, you know, I don't know anybody else who's been hacked. You know, I haven't, I haven't talked. I talked to a lot of business owners. None of them are said they've been hacked. So, you know, one, I can either say, you know, that's, that's a BS statistic, it was completely made up, or at a minimum, I can say, well, you know, 20% isn't that bad. You know, I'm sure I'll fall into that 20% because, you know, my people know better than to click on things. Okay? Now when you tell them a story of, you know, a company that you dealt with that, that has gone through something like this, that has experienced a hack, a story about somebody who's in a similar type of business locally who's been hacked, you know, different things that you can tell them when you use a story. Now they're in a situation where they can put themselves in that scenario and realize and really think about what would happen if that was them as opposed to somebody else. Okay? So we're using those stories and we are talking about the results of the assessment. So once we get through handling those common objections through stories, okay? And so like some of the common ones that we talk about and really kind of, you know, head off at the pass are the too small to be hacked kind of thing that this doesn't happen around here. The insurance is going to protect me. The my data is in the cloud, right? So we're going to tell a bunch of stories that kind of tackle those objections before they happen, even have a chance to think about them and have them themselves. Okay? So once we get through talking about those common objections and kind of giving them a lay of the land, now we're going to get into what their environment actually looks like. The things that we found in their world that are going to kind of tie back to these stories. And now they know how often this happens and they know what theirs look like, like, right? So when we do things, we kind of break it out into some categories. We always start off talking about their team because all of the technology in the world that we can implement, it's almost always the, the human factor that is the Thing that we have to.

Worry the most about, okay, social engineering, stored passwords, and, you know, specifically people storing passwords in their browsers is probably one of the big factors. Right. We all see that.

And my favorite analogy along this lines is you could have the most sophisticated, expensive security system in the world on your house. And if you open up the door and somebody's talking smooth and you let them in, security system doesn't do you any good because you just let them in the front door. And that's literally what happens every day when somebody clicks on something and submits their passwords and passes through that MFA token. There's a million and one ways that people can let someone, somebody in the front door. And in a lot of cases, they don't even know that they did something wrong until it's too late. So we always start with the team and educating them and the kind of behaviors that they do and really highlight that kind of things. A lot of business owners as well, kind of think like, well, I wouldn't, I'm a smart business owner. I wouldn't do anything like that. They don't think about their, their employees and their staff. You know, I don't care how good you are at training somebody on something, Just because you train them on something doesn't mean that it's actually going to happen, that they're actually doing the things that, you know, that they're supposed to be doing. So we need to have things in place to be able to handle that. All right? And now we're going to get into talking about risks in their network. So here's where we're looking at things like vulnerabilities and whatnot. This is, you know, it gets a little bit technical when we, when we actually reveal this stuff to them. We're going to be doing this, you know, we're going to give them this, this background, but again, we're going to be using stories. Okay? So when I talked earlier about taking that information and putting it into the ways that they're most likely to get hacked, that's how we're going to present this. Right? It's not just giving them a laundry list of what we found, but, you know, using a common example, you know, we found some information on the Dark Web. We look at their365 tenant, and they were all set up as global admins because easier to do it that way. And they don't have MFA enabled. Right. So they are literally, you know, just waiting for somebody to stumble on that information on the Dark Web. And they're instantly hacked and in trouble. So putting that into the context of stories, but looking at some of these things from that perspective and then looking at their data, here's that personal identifiable information, this is another big one where they typically don't know that they have these problems. They don't even think about storing this stuff. You know, I'm kind of going back to the, to the human factor, right? Oh, well, we, we process credit cards in the cloud. Okay, that's great. Do you know for certain that Sally from accounting processes them directly into the cloud, or does she maybe get busy during the day and put them into a Word document and then process them at the end of the night and then forget and leave them on our computer? Okay. This is all stuff that people need to be aware of and understand. And most of them are just living in this blissful ignorance, thinking that things are being done the way that they, they have envisioned or the way that they've trained their employees, or they may not even be thinking about it all, which is just as dangerous. Okay, so now we, we start getting into, you know, the, the hard costs of what a breach actually looks like. And this is another thing that I think a lot of business owners just don't have any concept of. They're, they're looking at things from the standpoint of the, the traditional IT support. Right. So they think when they get hacked, you know, they're just going to call you out and have you reload their computers for the same price, hourly rate, that, like, you map their printers and connect to their shared data. They don't understand the requirements in a lot of cases of what needs to actually happen and what needs to be done, the excessive costs of that kind of stuff, because, you know, let's be honest, incident response and forensics, it's a specialized skill. The people who do that typically have some sort of like government intelligence, NSA type background. Like, this is not just the average, hey, I'm a tech and I like pouring through logs kind of stuff. So the customer needs to understand, you know, this isn't something, oh, I got, I got a ransomware incident. I'm just going to reload my computers. It's going to be, you know, a little bit painful for a couple of days. No big deal. Okay. We're talking like you, I would guess to do proper incident response, you're probably looking at, even for a small company, a minimum of about 50 grand to, to properly do this. And on top of that, most insurance companies right now are actually requiring that you do this to even entertain the claim. So they need to have an understanding of what their, their minimum level of costs are going to be just to get out of this in the first place, which can include legal fees. A lot of times they don't think about things like downtime or they're going to give you an excuse like, well, you know, we'll just do business with pen and paper for a couple of days and we'll be fine. You still have downtime in that scenario because somebody's going to have to take that paper and pencil stuff and put it back into the system later. So it's not even really downtime. It's more like double time. You know, if you're dealing with, you know, a manufacturer, you could have loss of production. If you're dealing with somebody who's got goods that, that they can't sell, that can spoil, and you're looking at loss of inventory. There's a lot of costs that people need to understand and associate with this. But they, they're, they're thinking about having.

Your entire books, your bookkeeping, like all that stuff. Like, so it costs a lot, right?

It's, it's painful. Like, you know, dealing with, with, with business owners and having gone through this, like, it's not comfortable. Right? Like, you think about uncomfortable conversations when you find out somebody that you know has come down with a serious illness or somebody, some, somebody had a loved one who passed away. Like, it's one of those kind of things that you just, like, you don't know how to say the right things. There's nothing that you can say to make, make them feel better about themselves, even though you're trying to help them through this. Like, you, if you've ever been through one of these, you don't want anybody to have to go through this. So making sure that we're educating them so that they can understand this stuff and make that decision for themselves. So we're going through this. We're doing kind of to review this a little bit. We're, we're using the stories to tackle those common objections. We're presenting the results, and then we get to what we call the pivot question. Okay. So we've just presented them with this information. We've educated them on what's really going on in their environment. We've told them what their risk really looks like, and we straight up ask them how you want to manage your risk. And we wait for an answer. Because this is something that's really, really important. They need to say it out loud. They need to process it, they need to think about it. They need to be able to do that. So we wait for them to do that. And ideally, what we're looking for here is for them to invite us in. And so that is our door to recommend what our offer would be, what our expert recommendations would be to protect them against this stuff, to manage their risk.

Really, really quick on this one. You notice that Ryan's talking about the CSRA as part of the qbr. This is a really important thing that you walk in the door with this done because you want to be basically ready to sell on the fly. You have the decision makers in the room for your meeting. You walk in the door with all of the ammo and then get them to a place where they're saying, just like Ryan's check says there, oh, holy crap. Can you show me. I get it now. Can you show me what that would look like or get it getting. You want to get them. This is called positioning in sales. You want to get them to a point, I almost knocked my drink over hour. You want to get them to a point in sales where they start to. It starts to click in their head. And once they realize that and they're like, oh, crap, I. I really need to pay more attention to this cyber security stuff or I'm concerned about being socially engineered or I'm concerned about my staff because they're all stupid. Like, once that stuff starts to get realized, your price point goes. Your price point objections go to, like here, because it's no longer about the price. It's about, oh, crap, I realized that I need to do more. That's a big thing, guys.

And it's different when they're. They're now asking you for your help or your advice versus, like, you just going right into explaining what you would do for it and kind of hitting that upsell like, it just changes the.

Vibe all about sales psychology and how well you deliver all of the information 100%.

So when you ask that question, it's really, really important that you shut up and listen. You need to let them respond at that point. And, you know, they may have. They may just invite you right in. They may have some questions or issues that they bring up along that. But you need to be conscious and let them talk at this point. Let them explain their issues to you, and then you can sell on the pain you solve. Right? You're just getting them to say that stuff out loud and move forward with that. Don't talk tech. This is another big one throughout this Entire process, like focus on the risk, focus on the stories. But when you, even when you get into talking about what your recommended solution is, you know, they don't know what an EDR is, they don't care what an EDR is. You don't need to get into that. You need to just focus on the things that you're doing to solve their problem, that you're going to protect them. You're setting them out for the various things that we want to achieve. Right, we want to achieve that. We're setting them up to hopefully be a lot less likely to get attacked. Okay. Hackers are lazy. Like we have even basic protections in place most of the time. Those Net phishing type hacker attacks, they're going to hit that first roadblock and they're going to move on to the next easy target because they're not going to waste time with you. Okay. So we're reducing that. If they do get in the tool stack that we recommend that full stack cybersecurity plan following a cybersecurity framework is going to significantly reduce the blast radius of that attack. Right. So instead of it being an entire location's computers ransomed, maybe it's just one or two, and then the tools that we have and the services and the SOC isolate it so it stops that spread. And then probably the most important things are we're going to be positioned to have them recover very quickly and we're going to position them to have their cybersecurity insurance company claim paid as opposed to being denied for not doing enough. Okay. Those are the things we need to focus. They do not care about what tools you're going to use to do this. Don't confuse them. This is one of Chris's favorite sayings. The confused mind says no and it's a hundred percent accurate. Okay. Which is another reason to avoid talking tech because typically you know about it, it's, it's second nature to you. But it's going to confuse them. Okay. They need to understand. So that takes them through what you always get the question talking about this, what if they're already a full stack cybersecurity client? So again, that doesn't mean that there's not still room for improvement here because things are changing so rapidly. So we're going to go through this a little bit faster, perform an updated assessment and review. Like it's really important. Like we talked about educating them and knowing where they're at, you know, so when we're in this situation now going forward, it's still important to have these regular touch points with them, go over where they're at now, update them on any new PII maybe that's added to their system. You need to show them that we're still monitoring these things, that we're keeping track of the stuff, that we're evaluating things and protecting anything new. Because in this constantly changing environment, giving them an updated review of that stuff, show them the results of the service, showing them how many login attempts through the 365 environment that we've logged and have monitored and looked at. Like show the value of the service that you're providing to refresh and reinforce what you're doing. Really important that they understand that just as important as it is in the beginning to show them what you're doing and why you're doing it, they need to know that that's something that's ongoing. It's not something that we just produced a bunch of results and then didn't do anything about. Evaluate and discuss any gaps that may have been discovered or new threat vectors that may need to be considered. Again, this is all stuff that's rapidly changing. The cybersecurity world today is very different than it was six months ago, a year ago, five years ago. It's constantly changing and we're showing them that we're keeping up with those types of things. Listen to any problems, concerns or objections that they might have or that have come up. A really good opportunity to do that temperature check of the relationship so you don't have any surprises coming forward. Right. Talk to MSPs all the time. Hey, this client left me out of the blue and I had no idea.

If you didn't, if you didn't know. Yeah, you're not doing your job, guys. I'm sorry, but I mean, you should know about every single temperature level of every single client you have. And if they won't meet with you, it's ice cold and you better get in there and warm that thing up.

100. And this is, this is your opportunity. So that's, again, it's why these things are so important. Whether you call it a qbr, a tbr, or whatever you want to call it, the having that regular touch point with your clients. Because I mean, if you think about it, if we're doing everything right, we probably aren't talking to our clients very often at all. Like, and that was something I, I always said to my clients. The, the less you have to call me, the better.