How I Would Build A $1 Million Per Year Cybersecurity Firm

Hey there, it's Matt. And this video is going to go over how I would build a $1 million per year cybersecurity company in the healthcare industry. So the main benefit of a video like this is just the thought process behind it. Even if you don't have a healthcare cybersecurity company, you can apply the same context to an agency or any kind of service business that you are running. So let's get started right now. So let's get started into how I would build this agency. And if you've never watched one of my videos before, my name is Matt and I am the founder of 1000x leads and 10k per month agency programs. And I work with 315 agencies on a monthly basis. So I know what works right now and what doesn't. I've also built three agencies to over $1 million per year in annual revenue myself, including the last one was about 7 million before I sold it. So I actually have real experience building these agencies, unlike a lot of people. Everything in this video that you're gonna see is gonna be over the 1000x leads funnel which I created as part of my program. And it's a very good complete marketing funnel that will lead to fast and permanent growth for any agency or B2B business such as this healthcare cyber security consulting firm. The first thing we need to take care of are the offers. And inside the thousand x leads funnel there are seven offers. We have a recurring service, our intro offer, referrals, courses, programs, affiliates and products. So all seven of these offers are very important to have because it's the only way that we can monetize the entire target audience. If we just have our recurring service like a lot of businesses have, 99% of people are not going to be qualified to buy that. Whether that's it's too expensive, it's not a good fit, they don't need it, et cetera. But when we have all of these offers, we can monetize everyone from the absolute beginners to the medium people to the big people, and then all the way up to enterprise. It's very, very important. The first offer I'm going to go over is my recurring service. So what I would do here, and I wouldn't do this for every type of agency or business, but in the context of cybersecurity, I would have different tiers or different solutions tailored to different levels of the market. So I would have three. I would have a basic, basic cybersecurity standard and then advanced. And it would be for you Know, different revenue levels, different needs, all that kind of stuff. So in my lowest tier I would have the, the standard stuff, the vulnerability assessments, risk analysis, that kind of stuff, basic network monitoring, compliance checks, that kind of stuff. And that would be for small clinics, you know, walk in clinic, all that kind of stuff that just has to comply with the HIPAA regulations and that's about it. For a medium term package or medium tier it's going to be for not just the small walk in clinics, but I'm going to have more stuff and this is going to be better for not quite full on hospitals or healthcare like or huge healthcare organizations, but in between, in between some of like a walk in clinic and a full hospital system and that's going to cost a lot more. And then for the either ones with like the full hospital systems or those that have like excessive or more than standard like compliance and that kind of stuff, highly sensitive data, I would have the full cybersecurity package with a dedicated account manager, I would have the monthly cybersecurity reviews and I would be doing the automatic audits and real time detection. So those are the three different tiers and I would have those three tiers in this case because if not it's kind of a situation where you're even taking this to a greater extent. So not even you're excluding people from your recurring service, let alone not having all of the rest of the offers like most people. For my intro offer it's kind of hard to just offer like I'll do cybersecurity for you for one month and then you can decide if you like it or not. Doesn't really make sense to have an intro offer of that type. So what I would do is a one time cybersecurity audit and risk assessment and I basically go into the organization or have my employees do that and really maybe go over 25 step checklist or whatever it ends up being. But I would complete do a complete review of their current infrastructure and the risk assessment and compliance and incident response plan and I would put this into a document and present it to them and say okay, like this is your current situation and if you join the full cybersecurity package I will give you this credit towards the first month. And I don't personally know enough about the ins and outs of cybersecurity to know what pricing I should do. I just kind of set these prices kind of arbitrarily. I'm sure for cybersecurity for healthcare you probably could get into pretty expensive packages but bear with me here is this the lead generation video, not a pricing video. I would also want to be able to refer my clients to other businesses that can give me a referral fee or something of that nature. And that will just increase the lifetime value of every one of my clients. So some things that I wrote down are compliance consultants, legal firms, insurance providers, healthcare IT services. These are stuff that my clients would feasibly want or need. So if they ask me, they say, wow, you are so great to work with. Do you know anybody who does compliance or do you know anyone who works at a legal firm that specializes in these healthcare regulations? I would say yes, and then I would refer to them and collect a fee. That would just increase my LTV quite a bit. I would also have a course that might be good for, you know, maybe like individual doctors or smaller clinics who want to know how to do themselves. Maybe they have a receptionist who can do it, that kind of stuff. So I would have a $997 course and then that course I would include training videos for every steps and then stuff that they can do or, you know, use to make it faster and easier. So I'd have videos about understanding cyber security, managing network security, insurance compliance or ensuring compliance, incident response planning, securing data, implementing access controls and all of that kind of stuff. And you could read this document itself, it's going to be in the description, but this is the kind of stuff and the categories that I would be using. And then I would you be having templates, swipe files, checklists and assets that work on every step and make it faster. So for security. So we might have a network setup guide for managing the compliance. You might have a compliance checklist or if they're about to be audited, here's a guide on how to get everything you need to, you know, be audited type thing. We might have a plan that if they get breached, what should we do? And this stuff will just make it a lot easier to implement what I'm teaching in the videos and save them a lot of time. Like this kind of stuff really increases the perceived value exponentially. As, as, as opposed to just having the videos. I would also have a program that follows somewhere between the course and the doing it for them. Now the course is do it yourself services are done for you. This would be done with you if you've ever heard the term. And this basically have like they get a three month plan, they get a weekly Q and A call and they can get chat support, but they do it all themselves other than me Helping them a little bit. And it's just a nice offering that's kind of in between and will increase your LTV and help you close more deals for the type of person who wants something like that. For my affiliate links, this is a great way to put these in your email flows and your lead magnets and get some MRR from basically getting people to sign up for tools that they would be using anyways. So I might use CrowdStrike, which is kind of funny based on the CrowdStrike glitch that happened about a month ago at the time of recording this. I would use Splunk for security management Duo Security for my two factor authentication and I would use Vanta for compliance help. So these are stuff that these people would need anyway. And if they click on my link and then sign up for the software, I'm probably going to get some pretty good recurring commissions. And if I have this full funnel and I'm getting tons and tons and tons of leads, this will add up to a lot more than you think over time for my paid product. I kind of was struggling to think of something good here, but what I thought of was a healthcare cyber security compliance tracker. So this could be basically a spreadsheet template that helps you manage all of your cybersecurity regulations such as the HIPAA and all that kind of stuff. So it'd just be a matter of, you know, you build the spreadsheet once using the necessary logic and the steps and all of the assets, you sell it to them and has pre built formulas and conditional formatting to help them with stuff like reminders and highlight areas needing attention and that kind of stuff. With the paid product I would also have a few free bonuses. I would have a policy compliance tracker, an incident response log and a cybersecurity audit checklist. These things will just add to the perceived value and there's something that they would need to have anyways so they would make great bonuses for this $100 product that will really just increase our conversion rate when we're selling it. Those are what I would do for the seven offers. And the next step is going to be the bottom of the funnel. When we get to the bottom of the funnel, it is basically right here we have our conversion mechanisms like our webinars, our VSLs, our live workshops, newsletters, communities, appointment setters content and more. And we need the bottom of the funnel because that is what helps us qualify the leads that we're generating in the middle of the funnel and get them onto a sales call. The first thing that I would do is I would have a newsletter that is about, you know, healthcare cyber security. It's not going to be sexy, it's not going to be, you know, very interesting to anyone who doesn't have a healthcare business. But I would write a newsletter every Monday, Wednesday and Friday and each of them would have a few main sections. I put three here. I meant four. I would have an actionable tip that they can implement within 24 hours. Basically like do this to secure, like to greater secure your data. I would have a short example of what I would do for X. So for local businesses here what or for local healthcare clinics, here's what I would do. Then I would have an example about how we solved a specific cybersecurity challenge for a certain healthcare client we had. And then I would have a long form section about an important topic in healthcare cybersecurity. Something like the actionable tip, but just a longer and more theoretical. I would also have my appointment center emailing, phoning and sending text messages to all of the qualified leads based on my form. And I'm just going to get a lot more booked calls by doing that as opposed to not doing it at all. Same with my retargeting ads. I would be running retargeting ads on YouTube, Google Display Network and Facebook. On all three of these platforms I would be putting retargeting ads to people who have been to my website, but on YouTube as well. I would also put retargeting ads on people who have watched my YouTube videos. For my conversion mechanism, I would probably use a prerecorded webinar just because I might not use a group or a live workshop as I don't really know what I would talk about or post about or you know, there's just not the sample size I don't think. And the, in my opinion this target market doesn't have enough time to engage in a group all the time. So what I would do is make a 45 to 60 minute pre recording webinar just based on the, the topics that we're talking about earlier, the same topics from the course, but instead of having a full course, this would be just 40 to 45 to 60 minutes. I would set up my CRM so that we can really basically see who's a small clinic, who is, you know, a large healthcare system, all of that kind of stuff. And I don't know what I would really tag this on because a lot of these systems, I just don't know enough about cybersecurity. To know like, you know, what revenue ranges these are. And this is a hypothetical video just to show you like the different examples. It's not me trying to start a healthcare business. So, you know, this very well could be, you know, if you're a large hospital system, you might be doing millions and millions per month, right. But I would more let or nevertheless I would have different revenue tags on my form so I kind of get a better idea about who I'm dealing with. In the middle of the funnel, we have our lead capture and lead nurturing systems. So lead magnets, our email flows and our thank you page. So what I would do for the lead magnets is the exact same thing that I did for the course as well as the webinar. I would have documents that I would make, you know, exact guides for the cybersecurity foundation, the risk management, the compliance and regulations, the incident response planning, and I would have exact full length guides that people can download and see that I definitely know what I'm talking about. And I'm the expert. I would make sure that all of them are very valuable. And even though they're free, I would make it so valuable that people would have no problem paying $50 for this. Because if that wasn't the case, it's just not good enough. For the actionable rule, I would make sure that everything has a quick win that they can implement within 24 hours of downloading it. And I would make it very readable with one idea and image per slide. You got to remember that you're not talking in the lead magnet. It's not a video. Usually people are just scrolling down like this. And if we have one idea and one image per slide, it becomes a lot more easy to consume for a lot of people. I would have two email flows that trigger when everybody, whenever somebody signs up for a call or a lead magnet form or whatever, I would deliver the lead magnet. I would tell them what we do one hour later. I would tell them why they need to solve these problems an hour after that and then I would tell them how we solve these problems after that. So It'd be across three to four hours after that's done, 24 hours after the first email, I would be sending 30 day email flow, one email per day. And each email is focused on solving one objection, one faq, all of that kind of stuff. So stuff like, no, why should I do it? Or why should I hire you versus do it myself? You know, what are the real costs? You know, can you guarantee the safety of my patient? Data like these are all objections or FAQs? No. Do you need a long term commitment for cyber security? Yes, it's, you know, mandated at this point, stuff like that. Will these cybersecurity tools like be very cumbersome and slow down the operations to have to like do two factor authentication and all of the. I don't know what you would call them, but how do I stay ahead of cybersecurity regulations? How often should you audit? Like these are all things that people would want to know. And it's not sexy for a cybersecurity firm for healthcare. But the process to getting clients is the same no matter what the niche is. And then on my thank you page I would basically have a VSL about my offer, a book, a call button and some proof of other companies I've helped. And when they sign up for the lead magnets and they start getting the email flows, they'll also be redirected to the thank you page and I will, you know, put these things up there. That is the end of our middle of funnel. So now we need to do the top of funnel and the sales and then we'll be all done with this example. In the top of funnel, we have a few different traffic sources, we have paid ads, we have content, we have outreach and we have partnerships. For my paid ads, I would basically do three types of campaigns. On Facebook I would do lead magnet ads, intro offer ads, and digital product ads. Because I can go basically through a few different paths here. I could go, you know, just like this, let's get our connection restored quick. I could go through the lead magnet and down the funnel, I could go through the paid product and down the funnel and I could also go like all the way around right to the intro offer to the funnel. So on YouTube it doesn't really make sense to have a lead magnet funnel or an intro or a digital product funnel just because of the economics. So on YouTube and Google search, I would just stick to my intro offer, which would be that audit. For my written content, I would try to post five times per day on LinkedIn, Instagram and Twitter and I would schedule these using hypefury so it will automatically cross post it. So I don't have to make unique content for each. But basically all I would be doing is taking those same categories and thinking of FAQs for each. So I think of probably 20 plus FAQs for each and then get the FAQs and then just write short content about it and short content about what I think and how to do it. And I put it on LinkedIn and Instagram and Twitter and that's all there is to it. Realistically, it's the easiest and one of the most effective content strategies because when people follow you, they're gonna see that you understand them and you understand what their concerns are and it makes you look like an expert. These are can be thought of as FAQs objections. And if people follow you along and follow you long enough and you answer every single one of those objections over the course of weeks or months, eventually they're just gonna book a call. It's really that easy. For my YouTube videos, I just thought of some things here I got the foolproof method for protecting patient data in healthcare, Simplifying cybersecurity compliance in healthcare, A step by step guide and stuff like the best network security setup for healthcare organizations. These are not going to get many views at all, but the algorithm is so good these days that it's going to hit the people that you want it to hit. I would keep it to the tutorial style, the example style and quick wins and do what I'm doing here where basically it's kind of like you are screen sharing and talking over an asset. You just got to get good at screen sharing and doing that over time. And then you are going to, you know, slowly build up and slowly build up and people are going to find out about you. And this is one of the best ways to actually book calls is to have videos like this. These particular subjects, not exactly sexy, not going to get a lot of views. But these are just some ideas that I came up with and if I was doing this I would. These are the videos that I'd be doing for my short form content. I basically just see all of my tweets and see all of that kind of stuff and see which ones get the most engagement. And if they have the most engagement, that's a sign that people are interested in it. And I would expand on all of it with a TikTok, a reel, shorts, et cetera. For my outreach, what I would be doing would be targeting people in the USA and probably the COO like CMO, CEO and founder job titles with a 10 plus employee count with healthcare keywords, medical center, clinic, that kind of stuff. I might put cybersecurity in here only for like forming partnerships. But if I was really just going to do this to the target audience, I would only focus on these ones. Here's what my script will like. So I noticed that your healthcare organization might benefit from stronger cybersecurity measures, I can create a customized three month healthcare cybersecurity plan tailored to protect your data and ensure compliance just like we did for someone else. We could probably make this better. If I knew a little bit more about healthcare stuff and if I was building this company I would obviously know that. But 50 words or less, you know, this is what I can do. Like I did for this. Can I send a video for you? And that video can explain it more in depth. Show your face, show your voice, let them hear your voice, all that kind of stuff. For partnerships. My referral and white label partnerships were the same ones that I talked about earlier, so I won't go on too much about those. But IT services, compliance consultants, legal firms, cybersecurity tool providers. For my media partnerships I would go to like healthcare industry blogs or cybersecurity newsletters or healthcare industry podcasts, YouTubers, newsletters, that kind of stuff. I would try to speak at events and help on like the healthcare and the cybersecurity communities. Because even if you know you're speaking more of a cybersecurity community, a lot of people do cybersecurity for whatever, but they don't do it for healthcare. So you might get some partnerships that way. And for the joint venture partnerships, I would speak with IT service providers and compliance consultants to try to have a solution where if they hire either one of us, they can get, you know, fully optimized IT services but also with cybersecurity measures that we need for the sales, which is the last part and oops, I put the wrong thing in here. Let's go back. Sales is down here, so let's replace that one there, Let's delete this one. So sales is down here in the funnel and it consists of the pre call flow, the sales presentation, the follow up and the sales call. So before they even get to the call, I'd be sending them reminders 24 hours, four hours and one hours before. So that would basically be email and SMS to reduce no shows. I would get a lot of good qualifying information on the call just so I know what I'm dealing with. And then when they book the form they're going to be redirected to the sales presentation that I would go over on the call. So they're going to be 100% familiar. I would send them a pre call video, who I am, what problems we solve, why we need to solve them, how we solve them, examples. And I would aim this for this to be maximum of 10 minutes and I would do that in like the confirmation email in my sales presentation, I would, you know, answer a few questions like what are we trying to do? We're trying to ensure compliance, cybersecurity posture, protect sensitive patient data. You know, if you have basic security measures, manual monitoring, monitoring and ad hoc compliance like, nope, prone to human error, might not scale well with growing threats, you're gonna be get screwed basically. So we have proactive cybersecurity measures, automatic threat detection and continuous monitoring. And that minimizes the risks and ensures ongoing compliance and provides real time protection. So this contrast in sales, especially the presentations, is pretty important. You know, who cares? Like really, what difference will it make? We're going to reduce the risk, protect patients trust and ensure regulatory compliance so we won't get fined. A lot of this stuff is compliance like mandated. What are the risks? So like if we're over, if we have over reliance on our automated systems without proper oversight, that might be a bad thing. Whatever the risks are, like we need to bring them up or people are just going to think we're sneaky or stupid and don't realize the risks exist. We bring up the risks and then say, okay, now here's how I will overcome it. How long will it, how much will it cost? How long will it take? You know, midterm stuff and finish it off with more proof. So in the sales call I would break it down into three parts. Information gathering, screen share, presentation, which I just went over and then the objection handling. And for my follow up, basically what I would be doing is I would make 12 or so follow up or 12 or so weeks worth of follow up templates, two per week for 24 total. And in each I would give like I would follow up and ask for the sale, but I would give some good practical advice and that kind of stuff. And I have it here. I'm not going to read them all. I'm going to link this in the description. So I hope you enjoyed this video and that was valuable. And I'll see you in the next one.