Episode 8: Rev Up Risk Management: How to Discover Cyber Risks in Potential Clients

So what are we talking about today, man?

I don't know, something about security and making people smarter.

Ooh, right. Revving up the risk, or rev up risk, revving up. Wow, punctuation helps, doesn't it?

I don't know, but I see that in my brain, can't stop thinking revenue. So let's talk about how we can make revenue by doing risk management right. Yes, you know, I'm coin operated that way, so let's just, let's just focus on that.

Well, and at the end of the day, right, it's, it's the lifeblood of our business. If we don't got revenue, we, we really don't have much. I mean, even nonprofits, right?

Like, they thought you're gonna say if there's not risk, then there's no need for our business. So it goes both ways.

Oh, um, yeah, definitely. And thank you, Wes Spencer, for hopping on another one of these. Um, we're glad to have you.

Of course, always, always happy to be on anytime.

And, um, for those of you that don't know Boo-boo, right guys? Uh, Kyle Christiansen, uh, been in this channel for about 20 years now, uh, through strategy, turnarounds, uh, making Alex blush when it's necessary, and which it's always necessary, uh, but that's all not important stuff because he does have a prettier face than me.

Um, I don't know about that. I don't know about— oh, you're right, you're right, I'm sorry. Um, yeah, so Alex Farling, for those of you who don't know, I was one of the co-founders at Lifecycle Insights, helping MSPs do all this fancy risk management and strategy stuff for their customers.

Woohoo! And then we got the man, we got the myth, we've got the legend, Mr. Wes Spencer. Wes, who are you?

Or you just have me. I don't know about any legends over here, but hey man, I'm really glad to be here. So Wes Spencer here, security nerd by trade, and I was one of the co-founders at Perch Security way back in 2016 to 2020. ConnectWise bought us. And man, I do all kinds of stuff. I'm at CyberFox as their VP and external kind of security strategist, and then also founder of Empath Cyber, which helping MSPs grow in their security, right? Like helping everyone moving in lockstep together and getting, getting this security journey figured out. So this is an area of passion for mine and pumped to be on today.

And also from featured in the Wall Street Journal, ProPublica, Dark Reading, and many other outlets.

Indeed, the modest legend in the channel.

Uh, not a legend. Get the fuck out of here. So, um, what do we— Alex, walk us through a little bit on how we've gotten to the point of what— why we need Wes's superpower.

Yeah, well, I mean, we kind of started this conversation about how to build a sales process if you're an MSP, right? And we talked about how sales really shouldn't be that scary. It's a process just like anything else. And if we just follow the process and iterate and continue to improve It's definitely something that just works. And so we tried to demystify and take some of the black magic out of that. But as we start at the top, you and I had a really good discussion about places where you might want to identify what kind of risk you're walking into and places where, you know, it might be okay to shortcut some of that and have some different conversations. And when we did that, we got a really positive reaction. Everybody got super excited. And then they said, you know, you talked about how to build this out, how to figure it out, but give me some material, give me some more stuff. So that was kind of the purpose of today was to really explore that top of the funnel where we figure out who is this that I'm about to get in a relationship with, because that's what your customer becomes and what kind of baggage are they bringing with them, right?

Well, and to go to that point, right, Wes Spencer, you and I spent some time talking about these maturity stages and this ideal client profile. And I don't know if you want to recap a little bit on what we were kind of trying to, to bestow on some of these more willing and able MSPs that are looking to grow and mature.

100%. This is one of my most favorite things. When you built this and you showed it to me, like, this is, this is incredible, Kyle. And I know all three of us have been riffing on this and improving it, but this is a really helpful way for all of us to understand to some degree where we're at in our revenue stages and what our advantages are and our challenges are. And those challenges continue to change as you continue to grow, right? We're always like, man, if I could just get to that first million, I just get to that first $10 million. You know, how life would be better. Well, it just introduces new complexities that come in. And so I think one thing that's great about this that I love is like using this to future cast and peer review yourself, you know, like, okay, what do I— this is, this is where I'm at. This is probably where I've got some struggle. Looking into the future a little bit, I want to start thinking about, you know, where, how am I going to start building this team out or how I'm going to augment my tech stack? What am I going to build versus buy? You know, all those kinds of things. This is one of the most favorite things I think we've ever released. I absolutely love this maturity stage graph.

Now, slide up full screen there, Kyle. They're asking for it in the chat.

Uh, or can we view a copy? Uh, I don't know. Uh, I can zoom in, I can tweak it.

Maybe not. We'll make this—

as always, guys, we'll get you everything. Um, but kind of real quick though, I did want to have a conversation here, which, um, is Wes, going back to your Perch days a little bit. I can imagine that in the excitement that new tools fuels a lot of us MSPs, you probably had some in those very, I don't want to say immature because it sounds disrespectful, but let's call it immature as a relative statement. You know, $1 million, $2 million looking to buy a SIEM tool. And I'm just curious on kind of what was that dialogue like? What was that for you as a software founder having to navigate when at your core you're probably realizing like, I don't know, this might be a little too much for you.

It, it's scary at first, right? And usually the way it happened was we would have an MSP come in the door and say, hey, I found you guys on Reddit, word of mouth, peer group, whatever it is, and we're trying to solve for this security thing because we got a bank and that bank is asking us for a SIEM and we saw that you do that and we don't want to lose that revenue. We'd rather be the one to matchmake. And so the conversation would always start like that and we're going to dive in a little bit deeper into this. But one of the very first things I would ask an MSP, we talk about right fit, you know, my very first question I would ask an MSP and if I've I've never met you and I get a chance to speak with you at a conference, you're going to see me do this to you. I just ask you this one question. Say, hey, what are you guys doing for security? And I know that sounds like a really generic question, and it is intentionally generic because what I'm trying to suss out in the conversation is like, what does that look like for you? And I'll notice little things. Sometimes an MSP will say, well, I'm using Cisco for this and I'm using SentinelOne for that. I'm using, you know, Datto for this and so on and so forth. And they refer to their security stack by vendor names. And typically, I know when I enter into a conversation like that, the MSP is a little bit less mature. If they take the other tack of like, well, we're really framework aligned and, you know, we've chosen CIS, we're 85% there and we're really struggling with, you know, Controls 1 and 16 and really trying to solve for that. And, you know, and they take that direction of a conversation. I know, wow, they're a whole lot more mature. And so it doesn't matter the level of maturity. But going back to your question, I ask that question to determine that because that dictates how the conversation is going to go and what we're going to zoom into. And there's nothing wrong with being a younger MSP that's new into this and doesn't have that maturity and is building their way into that. That's great, right? It just, it changes the dynamics of the conversation because at the end of the day, some MSPs are like ready to go on this. Maybe they've done, they have like dedicated security folks that like are, understand a SIEM and how to use it. Maybe some of them are like a 1 or 2 person band. And that's it. They don't have the capability of doing more, right? And so they're going to really have to outsource a lot of it. And so that's where a lot of that good discovery at the very beginning really helps tailor that conversation. I had to learn how to do that at Perch because I think our success as a company really came in making sure that I'm having the right conversation with the MSP and the journey that they're in and what they're trying to solve for.

And, and I think you hit on a really important topic, especially with where we want to steer this conversation in, in Starting and kind of going back to our slides a little bit, right, Alex? And I think you can kind of take this from here is after I've kind of identified, right, I've turned that client into a lead, right? I've done my prospecting and we've done our activities like Adam, you know, gave us some ideas about how to do last session that we had, right? At some point though, we got to talk to that decision maker and we got to start kind of lifting up who they actually are a little bit, right? Yep. So let's recap a little bit on that right fit call. What's the difference between this and that stakeholder interview?

Yeah, so we talked about this a little bit in the first week that we discussed the sales process, and if you remember, we stole the name of this from the Tech Tribe. Nigel does a great job of this, so if you guys are already Tech Tribe members, go out to the Tech Tribe, search for the right fit call, you'll find Nigel's little framework on this. We always just called it a prospecting call at my MSP, but Nigel's name was cooler, so we stole it. But in the interest of the right fit call, really what we're trying to do here is just have a 10 or 15-minute quick phone call with a prospect to say, yes, you're somebody who I'd like to go on a first date with, or you're not. And, you know, I'm referencing sales and dating a lot because they're very much the same thing. If we have someone sign a 3-year contract, we're with them for what feels like an eternity. So we need to know Yes, this is someone who I'd like to explore further with, who I'd like to go, you know, poke around a little bit and learn a little bit more about. Or no, this is not somebody who's a good fit for me. This person seems crazy and I'd like to distance myself from them. Time to go. Right. And we know this when we date. We know this when we do business. There are certain people who we want to be in with because they have the same values that we do. They understand the same risks that we do. They're just at the same place in their life or in their maturity as we are. You know, if you're an early-stage company, you may find yourself attracted to early-stage companies. If you're a later-stage company, a mature company, as we've been saying today, then you may find yourself more attracted to more mature companies because they'll do things like technology budgeting, and they'll actually live with and follow a budget. They'll take security, security seriously, and they will allow you to use technology to further their business, where a less mature earlier-stage company isn't going to take those things quite as serious. And if you've made it to that $2, $3, $5 million mark, you're probably going, hey, I want the more mature folks and I'm going to wave off those early stages. And if you're at, you know, $500,000 or $1 million, you're probably going, hey, I'll take any revenue I can get as long as they'll take my minimum security stack. And, you know, and they're not a huge breach risk that's going to cause my insurance company to fire me.

Well, we actually covered that too. Kyle, do you mind to quickly go back to the revenue stage model and zoom in on the very beginnings? Because Alex, what you said is exactly what this— this is the journey for all of us, right? Like in that owner hustle, the owner reinforcement stage, right?

You're just trying to claw into this.

You're It's like literally anybody that can use IT of any kind. Oh, you can't afford managed service, but you can do, you know, some amount of time and materials. Great. Yeah, we'll take that. Right. I get it.

Right.

I don't want to be the one that's hating on that and says like, oh, you know, you can't— like, you can't do that. It's going to— it's going to be poison. It might be poison down the road, but you got to start somewhere. We're cognizant of that. Right. You really do. But what I have seen every successful MSP do in the years that go by is they really start to hone in. They hone in on a size, they hone in on a couple industries, and the more you, you really start to do that, you find success. I'll give an example. One of my very favorite MSPs is a company, is, is DevSource in Kentucky, and I actually used them in my bank. And in the early days, and, and they— Trent would let me tell it, I've told this story with Trent's permission, and Trent and I need to do a talk on this at some point— but we, we were really starting to push DevSource and the amount of like stuff that we needed from them, better policies and better controls. This is like 2013, 2014, right? And they just were struggling with it. We finally got to a point where I think we outgrew them. And so we had a conversation and we just kind of said, hey, we need to go our own ways. And Mike, the CEO, said, hey, are you firing me? I'm like, yeah, I think so. He's like, okay, good, because I was going to fire you in the same meeting if you weren't going to fire me. He's like, we're just not a fit for each other. We're spending so much, so many cycles on you guys and we're just not doing this profitably. So it was a very peaceful, amiable kind of split up. Fast forward 3 years. Now DevSource works with more banks and credit unions than I can count. And they said, you know, when we decided to walk away, we had a moment where we said, you know what, maybe we should settle on banks. Maybe we should go overboard and really solidify and, you know, build our security maturity. And they started to do that and they got my old bank. They got a ton of other credit unions. They got a couple like crypto types of companies too, like some really cool stuff that they're doing. They're very, very heavily focused in banking and they're like, that was a crux moment for us to decide, fit or not fit, and they decided we're not a fit, but we need to become a fit. And they went down that journey and now it's paid off dividends. So just, I want to use that as a story for everyone here to say, if you're struggling in a particular industry, sometimes it's good to start saying we're going to build mastery and maturity around that industry and really begin to focus and zero in on it as we continue to grow.

Well, and to kind of pull this full circle into the conversation that we're having today, this is why the right fit call is so important, because there's two things that are really, that are coming into play for us. The first is that this is a numbers game, right? To find your future prospects, I need to be able to get through as many as fast as I can to identify those ones that are just leads and that, hey, they're worth my time going down the path. And at the same time, that second big thing is I can't be asking them a million questions just to qualify them, right? Because I'm trying to be proactive to figure out, hey, this is a right relationship for me. This is something that's worth my acquisition costs or my cost per lead, right? There's plenty of sales KPIs that we've kind of discussed. And if I'm sitting there just trying to ask every question on the very first call because I don't have time as a leader owner in that hustle stage, then you know what, maybe my revenue is better geared to my investment from sales. And whether it's time or money is really invested on getting those ones that are going to be the best relationship for me right now.

This is speaking, by the way, this is can we, can we ask the right questions early, get them out quick? And now we're just making piles, right? This is the pile I'm going to follow up with. This is the pile I'm not moving on.

Well, and as a helpless promo, uh, I, I did do a whole video on this actually on my YouTube page about why blending revenue can be dangerous. Because if I'm going after clients that are too big for me and I'm going, I need a foot in the door, I'm just going to sell them whatever I can so I can build a relationship off of a very small deal, you actually now start to really constrain your gross profit dollars. And now next thing you know, you're spending hundreds of hours of sales time trying to go after pennies. And then all of a sudden, we sit there in a hardship, kind of like what you're saying, Wes Spencer, is I sold a bunch of SIM because it was easy to sell because they had an immediate need for it. But next thing you know, they're actually not within my clients, and I've opened myself up to that risk. So, so we kind of have to juggle all of these things with really what it is, is our identity and what we're going to grow into. And that's kind of, I think, what leads us up to kind of what we're kind of going to talk about in tandem, the discovery and the stakeholder interview. I guess, Alex, kind of as our resident sales expert, walk us through a little bit on what, what is the big purpose of this?

Well, so obviously the right fit call is, are we moving on to the next step, right? Is this somebody who I want to explore with? As we get into stakeholder interview, this is about getting our customer to open up to us and kind of tell us where the pain is. If we really get this right, the stakeholder interview is the thing that tells us all the boxes we have to check when we go to make our presentation. So this is where we're going to get things like how much can the customer afford to spend or what are they expecting to spend? How risk-averse are they and how much risk do they have in their, in their mind around their business? We'll go back it up later with the technology review, with finding out if what they think is in the network is really what the state of the network. But we'll talk through that. We'll talk through pain points and how we really impact the business with technology. And of course, at this point, we want to unearth what is the decision-making process? Who are the humans who have to be at the table for me to get the yes? And who is that person off in the wings that can be a no that I'm not talking to yet or that I don't know about yet?

So there's a lot we got to know about them.

Yeah.

And, you know, it kind of reminds me of this quote that, right, at the end of the day, people do not care how much you know until they know how much you care. And the reason I really selected this quote was I've been saying it for years a little bit more crass, which is your clients don't give a shit about how smart you are, right? At the end of the day, your clients have pain, they have a need, and all they want to know is, can you help me? If you are able to answer the question—

mostly what they want to know is that you're competent, not confident, right? And I think that one of the things we can learn in this pre-sales conversation is we can learn to present to our customer an air of confidence that shows them that we're competent. And the ability to go in and ask the right questions is going to get a customer to go, "Hey, you know what? Not everybody asked me that question. Not everybody sat me down at the table and picked apart my business and learned about me. Some guy just came in here, counted my computers and gave me a number and said, 'We can do business together.'". And some customers are going to shy towards the guy who spent the time to learn how their business works and learn how they're running the cash register, um, because they know that that guy has a better understanding of what it takes to keep them in business and to support them over the long haul.

And Wes Spencer, this is probably a fun one too, in the sense that risk really is outside of cyber. While cyber is inclusive in this whole word of risk with a new prospect, there's a lot of things that we could really start to see as risk that either could be leading or lagging indicators for is this the right client for me?

Absolutely. And I think that's the job of someone in IT is we often use these words like, you know, align to the business, right? And we're like, well, I hear people say that and it almost sounds buzzwordy. What are we talking about? Well, it's your job to be able to transition that conversation to helping the client understand here's what I am doing for you and how that accomplishes and helps you accomplish your business goals, right? You're trying to get to the new revenue level, you're trying to go solve this major project, you're trying to go get this new client deal that's coming through on like a major contractor. How are you going to get there? Well, it's my job to help you understand what do I do as service delivery to get you there? What do I do around security to limit those risks, to make sure that you're able to grow and succeed and make sure those things happen, right? Like, that's what we have to do. And so, yeah, when we talk about risk, it's not just cyber risk, it's not just hackers. It's not just ransomware. It's let's deal with all of these externalities that could cause you to not make those goals, to not be scalable, to not be profitable, right? And so all of this kind of ties back together when we say speak the language of business. We're talking to the client about, hey, Miss CEO, here's how we can help make sure that you have got this accomplished, though you're trying to solve for— here's what we can do to make sure that we're in lockstep to help you get to those goals and objectives.

Right?

And so when I think risk, oftentimes my brain goes right to that, to like business level risk before it just goes into like the cyber threats that we say, well, we want to keep the bad guys out. Well, sure, but it's so much more than that. And that's what the client wants to hear.

Well, I think back to my days of operating an MSP and MSSP where having a vulnerable conversation, especially if you're talking to an owner, like it's owner to owner, which a lot of us in our early stages, right? That's a lot of the time what it's going to be. Don't be afraid to talk about things like budget of, you know, Mr. Client, I want to be conscious of what I'm going to give you because at the end of the day, I know as an owner, I got to keep an eye, a close watch on my bills. And if I give you a bill that is going to be tough or a stretch for you to make, the last thing I want to do is have a nasty relationship because behind closed curtains, you just don't want to spend the money.

It's wonderful to hear you say that because one of the reasons that we at My MSP had our account management team give quarterly business reviews to us as business owners was so that they could literally go to a customer and say, when we go through this exercise in-house, this is what it looks and feels like, how we manage our budget and how these things go. Because as you start to get to that $2, $3, $5 million mark, you're delegating some of this, you're putting it off on somebody else and having them have that access in your business, having them treat you like customer number one and being able to show them how you run the business really helps enable them to go out to your customers and have number one, the same consistent conversation no matter who's delivering it. But number two, it gives them visibility into and to be able to say, hey, in-house, this is how we deal with it. And I know I'm not the owner, I know I'm not the CEO, but we do this exact same exercise to make sure that we keep our business resilient and we want to do the same for yours.

Well, and I think it goes back to that you're building a relationship. They need help. They have insecurities of things they don't know how to control. Right. They are all proficient or experts in their own right, in their own line of business, that they have come to their own understanding that they need to delegate things that they are not great at, right? They're going through their own strategy, or to steal a Dan Sullivan term, their own who, not how. You just happen to be the who for that stuff that they don't want to touch, which is technology. And it's kind of funny, right? Because when we built these slides, We put cyber in a lot of here, but really it's really just how to uncover and manage risks effectively with your client. Right, Wes Spencer?

That's exactly right. That's kind of what I was hinting at, you know. And so we can uncover a lot of those things by asking those right questions. Right. What you see here, a lot of what you see here, like I'm even thinking like when we do that initial risk assessment, what are we trying to uncover? We're trying to find out where their maturity lies. What kinds of like what kind of risks posed to them could cause issues if should some of those things come about, right? So like one of my favorite things to do is like tie this into like the number of records that I'm just as an example, like the number of records a client has, right? You may be small, maybe just 15 employees, something like that. But you might be, you know, $40 or $50 million in revenue and have, you know, 2 million records because of your nature of business, right? That's a significant amount of risk that you have in place. You need to make sure that you shored up your security, especially because what's the cost cost should those all get stolen? Should those all get ransom? Should those all get exfiltrated by a bad guy? Right? So it's important to step above just the cyber and really help them understand, here's what your business is doing, here's how you're making money, here's those inputs and outputs in the process, here's where you sit in the supply chain, here's your regulatory requirements, here's your cyber insurance requirements. We're going to unpack a lot of this in a minute, but those are all the things that a good risk assessment can really bring to light and help us understand as a whole where you stand as a business. And then we can design good, mature cyber aging around all that. It's always framework aligned for sure, but inputs to those questions are very, very important. Let me just give an example. If two people come in to see a doctor and both of them suspect they have the same health issue, sometimes the treatment might be wildly different based upon your age, based upon your weight, based upon your past medical history, based upon a lot of other factors. Just because we all have the same symptoms and maybe even the same predicament, same disease, whatever it may be, doesn't mean the treatment plan is going to begin in the same spot and be identical from one to the other. That's why we ask these good questions and really try to assess as we go down that journey so that we can have that treatment plan that's tailored to the, to the client.

Well, and what's funny is, you know, there was a point in time, and I'm still guilty of it here and there, where I loved a good silver tongue objection handling. And my clients would ask me, well, how much more is this going to cost me than what I'm doing right now? And I would tell them, free or less than what you're paying now. Right? Like, I'd give them that confident, a little cocky, a little salesy type response, but I was able to follow it up with, well, you know, my objective with the growing landscape in your business that you've told me is growing by X number or per year, it's my job to either one, create some operational efficiencies with technology that you don't have to expand some other costs, but at the same time to look for the things that you're not cognizant of that could potentially end up in some type of risk cost, some type of a loss, or some type of a real sticky situation to where you're down, right? Like, I was working with a giant financial firm. They were day traders, and they were trading anywhere between— I think it was anywhere between $800,000 to $1 million per every 30 minutes. So if they were down literally for more than 10 minutes, there was a potential of them to lose a million bucks, right? Like, this is very high stress. So in that type of a scenario, right, I had every right to say that I was cheaper than whatever risk they were coming up against because of understanding the economical cash flow that their business operated in. So the rest of the relationship was a lot easier because when I talked about disaster recovery or redundancy or whatever, right, the, the, the endpoint or shiny was, it had nothing to do with me wanting to sell add-ons. It had everything with me wanting to align with my client's objectives and needs. So, you know, it's, it's— don't be afraid of pulling that silver tongue response, right? There's a level to where, as you mature in your own ability to build relationships, that you do have this value. You have worked for the years to get to the standpoint. There is nothing wrong with being confident about it. Don't be cocky, right? Sometimes I come off cocky, and I realize that's my own shortcoming. Right. But there is that level to where this is what we're here to do. And going back to my initial statement of my client only cares about, can you help me? Hell yeah. Hell yeah, I can help you. So let's talk about this discovery. Let's talk about this client question. So, and especially from your banking background, I think it would be almost fun, Wes Spencer, almost like you looking to apply to be a CISO or CIO at an organization. What are the things that your curious brain like immediately goes to? What do you want to know about them?

Yeah, great question. A few things that come to my mind right at the beginning. The first thing I'm going to ask, I'm going to put myself in the interviewer's shoes, right? I'm interviewing for this job. I tend to have this viewpoint of like, I'm actually interviewing you. You're not interviewing me. If I do a really good job of that, then it proves that I'm the right person for the job. It's funny how that works. It's definitely a paradox. So one of the first things I'm going to ask is I want to know the reporting structure. I'm going to ask some kind of question like, hey, how does IT— who's responsible for IT here and who manages it? How does it report? The reason I think that's important is because if you ask the same question to a client, you might get some shocking answers back. You might get answers back like, I have no idea. Like whoever's barking the loudest, you might get, oh, you know, our financial controller is responsible, which tells you a lot about how IT is viewed. It's definitely a cost. It's a red line. It's something that like is literally falling into how much do we spend and how much do we limit because finance is controlling it. Maybe it reports up through risk. That's interesting, right? How is security— if it's reporting up through risk, it probably tells you some amount of maturity of the organization. What if IT reports directly or security reports directly to the CEO? That's also telling and probably a really good sign saying like it's an executive level. We're not shoving this off and cordoning it off into this little corner and say, go away, IT nerd. This actually has the command and attention of the CEO themself. So like, I really love that question of who's responsible for overseeing IT because it really opens up a lot and will really with one question help you zoom into where the maturity of that organization is and also determine even right fit, you know, to really say, is this somebody that I really want to work with when they say they always shoved it to the bookkeeper or nobody handles IT. And so you're just going to answer to whoever's yelling at you. That tells you a lot, right?

The front desk person is your point of contact. You know, that one always got me in a great— but it does. It happens all the time. You know, that's the person who organizes and schedules everything. Well, Mr. Customer, we need to understand that IT is not about scheduling service calls. It's about thinking, seeing things down the road and around the corner and spotting them before they become real and making sure that we're prepared to address whatever risk is coming.

Yeah. And you see how important this is? And one question, just one question we've already uncovered. If that's the case, then how are you ever going to get their attention for a QBR? How are you ever going to get their attention to care about investing and budgeting for security? Like, you're not. You've got to start at the ground level here. So now you have to ask yourself the question, is this a client I really want to work with when they're that immature? Maybe you can have an honest conversation right then and there and see if they're willing to listen and change for sure. But like, that tells you a lot right from the get-go. And we always zoom into like, oh, this best practice in dealing with our clients in account management. We've got these cycled QBRs and all these metrics reporting. And well, they may not even care about any of that from the very beginning. And that's why that question right there will really identify where they stand.

We just had Peter Gajawa from Service Leadership on one of our Friday workshops at Lifecycle Insights, and what he said to us was the MSPs that have the best luck with quarterly business reviews, and that, you know, they run benchmarks and statistics and all this, are the ones who are telling the client during the sale, before they become a client, that this is required and with the value that they'll get out of it. And their data also shows that clients who show up for them, MSPs who have clients who regularly show up and force them to show up, are 13% more profitable. Now, Kyle can speak to this. 30% of MSPs aren't profitable at all. The average is like 6%. So if you're average plus doing QBRs, you're at best in class. It's literally a simple math, math problem, but you have to get your customer to the table. And that's what we're trying to uncover here is who's the customer that won't come to the table when it's important.

Well, in most of business, it's really just a simple math problem. I try to so often take away the veil of confusion of running a company by the numbers because you think it it takes away the gut feel, it takes away the, the sympathy, it takes away the empathy, right? When you run the business by the numbers. However, you can run the business by the numbers to give an experience to your customers and your employees and your peers and your partners because it allows you to give— have that extra cash flow to do those types of things. And also though, right, we— I think there's a dark side of the moon or another perspective on this, which is if you do hear that it's the front desk lady, right, and you're only at $800,000 in revenue, $1 million in revenue, right, that might be a client that I then actually am able to support because I don't have the stress of a CFO with a massive corporate structure where I'm going to have multiple decision makers that are calling in, multiple VIPs that I need to prioritize help desk to, right? There are those clients where, you know, I remember some of my clients, big health organization in Phoenix, they, they were a cancer, cancer treatment center. They had not only the doctors, not only the patients, but they had a board. So like when you think of all the VIPs that were in our PSA, they would say immediately it's a P1 ticket because they're a high-use user. It wasn't just the one person that's the owner or the one person that was the office manager. It was like 15 points of contacts that we had to constantly manage and attend to. So, right, we've got what's the reporting structure like? Wes, what's the next thing that your brain goes, I need to know?

The next one, these are one and two punch, and they're always the top two for me. So the next thing I need to know is what does our budget look like, right? Like, do we even have a budget? So it's a simple question of like, let's talk about how IT works for you. Do you have a set budget that you work with, that you've created, that you follow? And again, it's okay if the client comes back and says no. It just— I'm asking the question to determine this, right? So in my world is like putting the CIO hat on. The reason I'm asking asking that is I need to know what I'm working with. You will sometimes run into lower maturity, smaller companies that are like, no, we just spend money as we need to. And that is okay, but it comes with caveats. One of those caveats is, what— when do they need to? Who decides the need? If they say, no, we don't, we don't have a set budget, we'll just— if we need to spend it on something, we will. Well, then you need to make sure that you're prepared and understanding what's their framework for when they spend that money, when they determine the need. Conversely, if they come back and they say, yeah, we actually have a budget for this and we know exactly what we spend, and we know what this should look like, and we follow this. A lot of times that can work really well because it tells you that the client is aware and has kind of thought through this. I will say, just food for thought, on average— I think Gartner tracks this— the budget spent in IT, which would include cybersecurity, is somewhere around 5% of revenue. So just— you, and you can help them understand this, right? Like, if they say, well, we have a budget, I don't know if it's good enough or not, or no, we don't have one but we're open to creating one, what does that look like for us? A good rule of thumb is somewhere around around 5%. But the thing is, certain regulated industries go in even a little bit higher. I know healthcare and finance, especially banking and finance, is closer to like 8, 8.5% of revenue goes into IT and cybersecurity, just because the requirements are much higher, the resilience is much, much higher. And so they have to have a higher spend to account for that, that, that capability, that maturity. So you can kind of start with that and help them understand, you know, this is roughly what this would cost. And you can even do some back of the napkin math to kind of understand in your head as you're engaging with them if a per-seat price in your managed service, and you can already kind of reverse engineer that and say, wow, look at what we're doing because you're working with us as an IT provider and we're able to spread these services out in a more efficient way. We're actually coming in way under the cost of what it would cost for you and your spend if you were to try to do this alone. I mean, where are you going to hire the people and train them? How are you going to find the technology and the stack to keep that going, let alone security and the requirements around that? Who's watching it 24/7 and how do you get enterprise-grade tools in your environment if you're trying to do this on your own?

Right.

So you can actually reverse engineer hear that to even defend the value of your services that you're providing. But I gotta know the answer, right? I gotta know how do they budget for this, because again, it will tell me so much as I do future discovery with them to kind of understand pain points and priorities and, and all of those sorts of things.

Yeah, and one of the, one of the things that I always heard when I had my MSP, and I'm sure some folks on the, on the call can tell us whether they hear the same thing, the minute I ask what your budget looks like, I get, "Oh, well, you know, we're not really ready to share that," or, you know, some reluctance to give that out to you. And one of the things that I always use to kind of pick that apart and help figure out where the customer was at was, I do know my cost as a managed service provider. We've probably had some talk about their size, and I know a 20-person organization, I can do the math real quick and, you know, go figure out $250 a seat for that organization. We're gonna be at $5,000 a month. Life is good. I know it. So now I can sit down with those folks and go, hey, 4,500 to 5,500 companies about your size. This is what I see them spending, and this is what they typically have to spend to be successful. If I told you that was the number, am I in the ballpark of what you think it ought to be, or are you going to throw me out of here on my ear? And that would always let me kind of gauge even the folks who were a little bit too close to the vest with the numbers instead of going in and feeling like the sales guys who just goes, hey, tell me your budget so I can spend all of the money that you've got earmarked for IT. We can at least throw something out there and then they go, oh, he knows exactly what this costs. He's got this right off the top of his head. And I'm just giving them a bracket. And, and if they go to me and go, oh, even at $4,500, I think it's a stretch, then I can start to unpack that and go, well, what part of this do you not see value in? And if I got you down to my most minimum offering, is there even an opportunity for us to work here? And so what Wes Spencer has done is identified not just the maturity of the customer, but really quickly queued us up to go, Hey, this is a no, no, no deal for me. This is a— this is one who isn't going to be workable for me because I think they need to spend a minimum of $4,500, and they told me $1,200 was their budget.

Well, and even beyond that, right, like, for like right now in the calendar year, it's July, August, September. We're so late in the budget cycles. You can always— if they don't want to tell you the budget, you always ask the question, well, Mr. Client, I'm— if your calendar year with your, your fiscal spending then we're mid-budget. I don't want to be in a situation where I put you beyond your budget cycle and this whole conversation is moot. Let's just get together in November, December, and let's just, let's just part our separate ways, right? Let's book that call for December so I can help you add to the budget to bring us on board. And you can have that conversation of what does mid-year budget analysis look like if I come to you and say, hey, you need to spend way more than you were budgeted for because of either higher growth than you expected and new risk or compliance needs that you may have, right? We're still having that business conversation. And for everyone that's kind of watching what we're starting to do actually, and we're going to make this a lot prettier after the call, is we're building a template, right? We're starting to build structure and consistency, right? So all we need to do is sprinkle a little bit of discipline on all of this. And we start to now have, as Wes Spencer, you've already insightfully kind of given some spoilers to, to build into the proposal conversation to where I can show, hey, you told me your budget was this or your budget cycle was that, and we were able to find a way to, right, have perfect harmony in it so that you don't even get to the, well, you're too expensive. You don't even get the, and that was more than we wanted to spend because I am meeting exactly what the relationship needs. And I kind of want to kick it to you, Alex, a little bit, because I know you had your own version of this. What was it that your, your curious mind was trying to understand from the client?

Yeah, the thing I'm always trying to learn is what I need to protect. And that usually typically in the customer's mind leads to how they make money. So my question for them is, you know, how is it that money travels through your organization? How do you ring the cash register? What happens to that once a transaction happens? What systems are required for you to deliver the output of that transaction to make sure that you can get paid, right? So, so how does the organization make money is super important to me. I need to know what every one of those critical systems is so that I know how to protect it.

I put a few of them off guard.

Same thing, right? Yep.

And I'm kind of being in these situations, I had to say that. That probably threw them off a little bit.

It does because they're quite often the answer is, "Well, I just need you to worry about my technology," right? And then you very quickly get to go, "Well, let's talk about how you make money," and then they realize there's a billing system and a quoting system and, you know, some sort of a CRM and all kinds of service delivery functions and all these things. And then you get into the fact that they have to pay payroll in order to deliver a project or, you know, we had one company who it was we worked with them for 2 years before they decided to open up and tell us told us that they had some antiquated driver's license lookup to make sure that the folks that they had driving their vans were, you know, had clean driving records and all this. And that stuff sat out there for years before we found it. So we wanted to dig in and figure out, you know, what all the pieces are for the technology that really mattered to that customer. Because when we found this application, then we realized that, you know, they had been on some solution that should have died with Windows XP and we were 3 years into Windows 7, you know. So you really want to unearth these things before a patch comes across and breaks it, or before it's down and unavailable and your customer can't get to it, or before it creates another problem that you just didn't see coming.

Well, and what's beautiful about this too, though, right, is you're immediately showing that you're investing in a relationship perspective, right? I understand now your budgets, how you make money, right? Who on your team we're going to be interfacing with. And one thing we didn't even talk about too, right, is if they tell us that they were going to report to the CFO CFO, I should probably in my own discovery process have a conversation with the CFO, right? Understand his vision of where he sees the tech department going, right? Or the IT department going, or, right? You now may be able to add a value prop of, Mr. CFO, you're probably tired of dealing with this IT shit, right?

Yeah.

You probably just want to focus on what you're good at, right? Yeah. Okay, so here's how we interface with other CFOs. You're going to give him direct value because you could save him something that no one else can save him, which is his time back.

Yep. Yep. And that's so valuable. And, you know, it kind of leads to the next question that I always like to ask, which is— and this one, this one is one that I didn't use at my MSP. I learned it later. But as we've been talking to folks about it, it's just a wonderful question. And that is, have you ever been involved in this kind of a purchasing decision before? Right? Have you ever purchased this kind of a product or service? This tells me how mature that customer is. Right? And if they've hemmed and hawed on budget and then they've never really been involved in this and the only IT they ever had was Uncle Timmy's little boy, you know, fixing things on the side, it gets really interesting really fast as we start to look at the type of buyer that we're dealing with and what might be their motivations and why they might choose us over someone else and why we might want them to choose someone else over us in some cases.

Or if they had a bad experience.

Yeah, yep. If they have bought this before, then you get the opportunity to dive in and go, hey, tell me what that last purchase looked like, right? What was the experience? Why is it that the decision you made last time is no longer good for you today? What's changed?

Or Wes Spencer, you're a curveball. Hey, we had to fire the last MSP because of a breach. Where's your brain run with that one?

It gets right to— I think you're reading Bob Miller's, um, uh, thought right there in, in chat, right? Same thing, right? Because that opens up a whole bunch of— it's obvious why I'm switching away. What's not clear is who and where and why and how I should switch to, right? Because this cost me as a small business, and, and maybe it had no fault of the MSP, but the perception from the client was that it was the MSP that's causing them to have to move, right? Be— maybe they're the ones that clicked on the phishing email. Maybe they're the the ones that fed in their credentials. Maybe they're the ones that, you know, that caused all this to happen. But perhaps it wasn't. That's a training point for you and a mental note for you to think through. So they're blaming the prior MSP even though it doesn't sound like it was any fault of the MSP at all. But maybe perhaps the MSP didn't do a good job explaining the client's responsibilities versus theirs. Maybe the MSA didn't have enough protections and the client was able to actually come after the MSP. There's a lot of things that could be baked into that that that from Kyle, that, that, that question of like, where does the liability lie and how much have you been able to explain and clarify to the MSP or to the client that's their responsibility, right? So those are things that absolutely you're going to have to really suss out in that conversation.

Well, it also shows you too the type of people they are, right? How they value their partners, because if they just needed a scapegoat and they cut the MSP loose because right? The CEO did the typical, I don't want spam filtering or phishing testing on myself because I'm higher, you know, I'm more mightier than thou, right? Like, you then can immediately go, oh shit, you're that guy. Yeah, I, I, we're good. Yeah, you know, you probably got all this stuff that's buried and you probably got all this stuff that's hidden and I'm gonna have to unravel it or I'm gonna have to be the next scapegoat, right? Like, you can start— the curious snowball starts to really roll from there because maybe I don't want to do business with them. Maybe it's not important to them. Maybe, like, I'm not gonna lie, I had a, I had a legal firm. They bought an entire MSSP stack, including SIEM, including appliance, the whole nine yards. They signed the dotted lines, looked us in the eye, and said, do not install anything on our network. We just want to pay the bill.

Shocking.

And, and what ends up, right, like, literally, like, it's shocking, but like, it should have been a red flag at this point, Kyle, many years ago. Right? And they— and there was dollar signs in my eyes because they were paying us like $12,000 a month to do literally nothing. So there was that part of me going, eh, let's ride this out a little bit just so that, you know, I can use that revenue for some maturity. But 9 times out of 10, there's red flags all over the place, not just Kyle being greedy.

Yep. I'll steal a page out of Gary Pica's book on Cyber Call. A few months back, um, he was talking and he mentioned he was talking to a client or a prospect or something, and they were really resistant. They didn't want to move on something. They want to pay for it. You know, I saw Tim Golden put in a question like, how do you deal with those kind of clients that don't care? They're too small, whatever. And he actually just had this statement to the client. He said, why is it that I care more about your security than you do? He just left it there, just sort of like dropped that bomb right in front of him. And I thought that was— it's sort of sometimes you need a bit of a shock factor. Again, this goes back to what you mentioned before. It's not arrogance, Kyle. It's confidence of like, what are we— what do you do? Like, if I truly genuinely am the IT and security expert as an MSP, be, then there are times that I just have to come back to the client with some amount of confidence and say, that's just stupid. Like, that's a bad idea. Why are you doing that? Like, that, that is something that's not good for you or your business. What's that?

That might be the nastiest word I've ever heard Wes Spencer say. He just called a customer stupid. That's why I just said that's just stupid, right?

I call them stupid. But yeah, no, 100%, that's what's going on my brain. But there are times when you've got to exert yourself as the authority here on those kinds of things.

Yeah, we used to have these conversations with existing customers, right? I don't want to show up for a QBR. Everything's fine. We don't need to meet. Well, Mr. Customer, I have some legitimate concerns, and I can't care about your network more than you do, so we're gonna be at your office Tuesday at 3:00 unless you give me a better date and time, right? And, you know, you just have to break it down that way sometimes, and it's nice to learn that early and often.

Well, and honestly, I think it comes without saying, kind of, I think we led into the next question without even having having to say it, which is like, what are the requirements that you have? Are there any regulatory? Are there any compliance? Is there any type of, um, like supply chain type function that we need to be aware of in why we're having this conversation? Now, this one may not need to be explicitly asked. I don't think— I think this one, in— if you've gotten this far in these questions, it's going to happen. Like, it's just going to come up just in banter. But there's— right, you're getting to a point to have to understand of like, am I going to have to scope something extra? Am I going to need some add-ons with my managed services offering, right? Am I going to have to do some technical discovery? And we'll get that in a second. Or is this, you know, something a little more relaxed where they just kind of want to start the relationship?

Now, you know, I think earlier about— oh, go ahead.

No, go ahead.

Well, we talked earlier about, you know, focusing on a niche somewhere that is, hey, I'm in manufacturing, or I'm in— and my MSP, we spent a ton of time in K-12 and education, and we spent some time in municipalities. And I knew very well who, what the major software platforms were in those spaces. So when I went into one of them, I could say, hey, do you run this software or this one? And they would go, oh yeah, we run PowerSchool. Okay, great. Knowing that you run PowerSchool, you probably have this kind of data and we probably have some compliance that you're required to meet because of the kind of data you hold. And so it's very easy if you live in a niche to know, to be able to say, hey, Mr. Customer, you probably have this kind of data somewhere, don't you? Okay, that leads to requirements. Requirements around this, this, and this. Or if you're in this business, you probably have this kind of client and they may have access to this kind of data, so you probably have a CMMC requirement or something else. And so if you really live in that niche, this is easier than if you're just attracting, taking any customer that will, that will write you a check.

Yeah. Oh, trust me, that was that legal client that was the big red flag. I think, uh, someone said Danger Will Robinson, right? The reason that I got referred to them was we were document management experts. We knew WorldDocs, we knew iManage, we knew all of those softwares where the vendors were actually bringing us in because they said, hey, these guys speak legal tech technology. Um, and, uh, you know, really, even in the event that they say, like, like Tim just said, right, like, oh, we don't care about HIPAA, right? I think there's a level here to where you could still make this a conversation where it's not you versus them, right? Because we really want to avoid the you versus them conversations. You're not there to tell them what they You are there to educate them and lead them to what they need. And understanding their 3-year goals is, right, is for me a little changing pace. But at the same time, what I'm trying to find out is if they tell me, right, they're a K-12, they only have 100 students, but they have a goal to get to 500 students, right? They have a goal to start branching out and building their own curriculum, right? They're starting to get into what a lot more advanced schools would do. Right now you're going to have to have something to talk about to say, hey, part of your 3-year plan— you don't have to force the compliance down their throat, but you can tell them that their technology needs are going to excel, and you can lead them in a way to do it efficiently and do it well.

Yep, 100%.

Um, oops, I just realized I clicked on the wrong, the wrong people boxes.

So why you're too many things for while you're working on that one, I got one for us. So this is one that snuck up in the past 2 years and is just going to become more and more important. And it's so important. You got to standardize this question is, hey, tell me about your last cyber insurance renewal and how did that go? And the reason I think you just verbatim say it like that and assume that they have one and that is because like they should have one, right? It's like you shouldn't ask, do you have cyber insurance? Let me tell you why I think it's important. I think we're at the stage now where it's like I just expect that you have habit. So they come back and they say, no, I don't, I don't— what? I haven't ever done that. What is that? That's okay. That doesn't mean you just walk away from the client and, you know, do the shame, shame, shame on them, right? But it does mean that, you know, it's probably a good educating moment to explain exactly why this matters. And shout out to the team at Fifth Wall Solutions because they're doing the best in— they're doing the best of anyone in the industry. They're the best at like this education pathway for clients on this and teaching MSPs how to engage in that conversation and helping them understand why these questionnaires are so critical. Because it's not it's just about, you know, there's so much that's baked into that, right? Obviously the client is like, yeah, I saw that questionnaire and like, that's 4 times more expensive than it was last year, and all these questions I don't know the answer to. Can you help me with that? You actually do that for me? And, and there's a lot baked into that. You don't just fill out the questionnaire for them, but you certainly can work with them through it. And there's sales opportunities, tons of cross-sale into all of that to help them understand, hey, this EDR thing really is important and here's why, and this is why the carriers are mandating it. We can help you with that, right? But I would really be ready for that question. But you do need to be trained in that question before you just go ask it, right? So if you haven't— just again, shout out to Fifth Wall— if you haven't gone through their education pathway, go do it. It's completely free. That'll get you prepared to ask the insurance renewal question, and they'll even teach you some things around like how you build this into your process to make sure that you know when the renewal is coming up so you can get in front of it. You know what things you can and can't say legally so you don't get into, you know, any kind of FINRA hot water, all that kind of stuff. So I just— it's funny how that's the question that's like one of the most important ones that's come up in the past 2 or 3 years, and I think it's here to stay.

Well, it's got a stat that 55% of folks have cyber insurance today, which number one is way too small. But the reason you ask the question that way is so that you can be stunned when they say, I don't have it.

So I do want to be conscious of time because we're running up against a wall right now like we always do. Um, but if one thing that's, that, that's obvious for the, the more keen-eyed viewers is nowhere on this list do we have yes or no questions, right? It's how did your last insurance renewal process go? Tell me about the requirements that you have for your business. What are your 3-year goals? And I want to give everyone a quick tip. Whenever you're having these conversations, I want you guys on a piece of paper, right? Wait, W-A-I-T. And this is going to tell you why am I talking. This is a, this is a little acronym that I was told years ago by one of my mentors, which which is at the end of the day, your client needs to be talking somewhere in the realm of 80 to 75% of the time, and you need to talk 25% of the time.

So I actually quoted that number— I actually quoted that number last week in a room and happened to have, uh, one of the employees from Gong in the room. And if you don't know who Gong is, they're a sales organization and they teach all this stuff and they track metrics around all of that. And they said you'll have the best close rate somewhere with a 60/40 split, your customer talking 60% and you talking 40%, and they actually have numbers to prove that. So there you go. You can talk a little more than you thought, but for the most part, shut up and let your customer tell you what they need.

Right?

Your ears are your most valuable, right?

Listening is such a valuable trait in this motion. And obviously the three of us suck at it because we talk over each other all day long on this call. But right, the whole idea here is that for you to build a relationship, for you to be able to have a successful proposal, proposal, we have to understand that. Now, you mentioned one thing really interesting, Wes Spencer. I'm going to give a freebie box. And I think if you do have a niche, if you do have an ideal client profile, if you do have a target market, you, you should try really hard to build a question that surrounds this, right? Give a way for you to show your subject expertise. Show them that you know your client's business, right? Your K-12, you mentioned a line of business app, right? Ask them about that relationship. Ask them how they enjoy that platform. Platform. Because like Wes, you were mentioning, if I'm a CIO and I want to build efficiencies to make that 3-year goal, I may need to go, hey, you know, we've been working with a lot of K-12 that have upgraded to this other platform, right? They're going to go, oh shit, their ears are immediately going to perk because you know me, you know who I am.

And you know, if there's one more question Yeah, I mean, this is one of my favorites. Why me? Why now? Right? What is it that caused you to make that decision, and why did you call me in the room? Is it because you know somebody I know? Do I have some leverage here because you were a referral? Um, is this the time to jump because you're just really ticked at the old guy? Is he asking you to spend money you don't want to spend? Is there a problem on the network that he's trying to push you off? What is the thing that's causing you to make the decision? And if you can get that question right, it really opens up a lot of what's going on with your customer, why things are changing, why things are different, why they're making the choice right now today. And it may be, "I've got an insurance audit coming up and my other guy's not checking enough boxes," or it could simply be, "He wants me to spend money and I'm cheap and I don't want to spend the money." And that's one of the things you want to hear early so that you can say, "Maybe this isn't the right fit for me." So to recognize everyone's time, time.

Um, and I know we're coming up against the door right now. This has been a fantastic conversation, Wes. We really do appreciate your time. What we're gonna do for everyone that's on the call today, cuz we do have your contact info if you registered on Zoom, we are going to email from @K7Leadership both the deck, the recording, and we're actually gonna have one of our awesome content editors actually create an interview guide for your client based off these questions. So if you wanted just an easy giveaway print these out, make them a PDF, put them in a form software, and just scribble notes, right?

Have it—

I know one person that laminates them and then uses just a dry erase marker so that while they're talking to their clients, it's just a single thing on their desk. So we're going to go ahead and get that for all of you off of what we just built live today. Um, so make sure that that's there. And also, well, any of the, the future conversation that we're going to have, which I'm actually really excited about, is is we're going to move to the next stage. We're going to talk about the proposal stage. We're going to talk about objection handling. And Alex and I are really excited because we're bringing on Sean Torres from Intellicom. If you guys don't know Intellicom, they're actually a pretty large MSP down in New Orleans. Um, they've gone through a lot of these maturity stages, but the one big differentiator of them is they actually grew 100% in one year. They actually took a giant leap. And the big differentiation between them and other organizations that I've had the privilege of working with is they have a sales culture that is really 100% gung-ho on building relationships. So we're going to have Sean come on as an owner of an MSP and just show us how does he do proposals? How does he handle objections? He's a fantastic personality. So make sure to register for that one, July 26th, 2 Eastern. Um, and then Wes, how, where, where can we find more of you?

Yeah, you know, you can find me all over the place, I suppose. Definitely LinkedIn is probably one of my primary conduits and outlets, but definitely check me out, right? Like there's a few other places, you know, I do a Cyber Call every Monday. I do a— also do a Cybercast. It's a podcast on the CIS Controls. We're getting ready to finish our 18th and final control, which is wild. It's got over like 25,000, 30,000 downloads now. It's wild. But one of the best places to just stay in touch with me is right here. Just sign up. It's called the Empath Cyber Power-Up newsletter. You can scan that QR, you just go right to empathcyber.com/powerup and that will take you into my weekly newsletter. And what I'm doing is just, just like curating a bunch of stuff that I think is important for MSPs, some thoughts I've had from the week, and then also just cluing you into any kind of like events, things that I'm doing that you may want to jump into. So it's awesome. It's free, completely there for you. Need it. And then of course, for MSPs that do want to take the next step and really growing in cyber maturity for everybody, check out what we're doing at Empath. Path Cyber as well.

Well, with that said, everybody, we, you know, we really appreciate your time. We look forward to seeing you guys at the end of July. Uh, we'll have an extra week between this session and the next session. Wes, again, thank you for coming on, man.

Anytime.

Thanks, buddy.

All right, everyone, it's been a pleasure. Take care. Have a great rest of your week.