Webinar: Selling Cybersecurity at Every Level of the Sales Funnel

What's up?

Good morning. Hope y'all are doing absolutely stellar today. Lincoln, how are you?

I'm doing well. It's a Friday. No complaints. How are you doing?

Yeah, Friday. So, man, I am in. I'm not going to lie. I am. I just got back to Tampa really late last night. So it's— we were at Kaseya Connect. Phenomenal event. I think I saw Nathan there in passing. Great event. And I'm still catching up from the blur.

Yeah, I know, it's been a crazy week. I've seen everyone's post on LinkedIn, so, uh, I appreciate you still making time for this.

Yes, uh, 100%. I'm super excited about this. This is a fun topic that, like, I know is— you guys are big on this too, of making sure we get practical. And, um, this is going to be a lot of fun today. I want y'all to come out in the audience and chat with us, give us thoughts, add to things. You may have a better thought on something, a different idea. Let's take it and chase it. This is going to be a lot of fun and I'm really excited. So thanks for joining today. Let me get my screen shared out here and we will jump right into all this goodness. Here we go. So welcome, welcome to Selling Cybersecurity at Every Level of the Funnel. And Lincoln, I don't know about you, but I think a lot of times we talk about selling cyber and sometimes we make the assumption that someone's at the very bottom of the funnel, the very top of the funnel. What even is a funnel? Right. And so we're going to talk about all that today.

Yeah, and I think a lot of people, we'll get into this, a lot of people make the assumption that everyone wants cyber, right? Like, that can be one of the hardest parts of this. So we'll talk about that too. But yeah, excited to get into this.

Yes, exactly right. Max checking in. Max, what's going on from Cape Town? Max, a longtime Empath partner. Good to see you from all the way down in South Africa.

Hope you're doing well.

So just quick intro. I'm Wes Spencer. I'm one of the co-founders of Empath. Been a cyber nerd my whole career. Was one of the early folks over at Perch that got bought by ConnectWise and love just being involved in helping MSPs in their journey. So thanks for letting me be with y'all today. Lincoln.

Yeah, so I'm head of community at Petra. I'm still learning what that means, but a lot of it is helping our partners go out and sell Petra to their clients, right? Understand the value of security and talking through those incidents as one of those learning opportunities. So Been in cybersecurity sales almost a decade now, and my role right now is really focused on enabling our partners again to go out and communicate that value to their clients. I'm also an al pastor connoisseur. I'm very spoiled here in California. So if you ever want to talk tacos, I'm here for that too.

I do want to talk tacos and we should have a whole talk for that at some point because Tampa just lacks in that regard. So yeah. Oh, Matt Collier checking in. Matt, what's going on? Hope you're doing well, Sam and Harrison. Oh, also San Francisco. There you go. So like you and Sam, you sit down and talk taco spots. Let's make that happen here in chat. Absolutely love it. So Lincoln, you kind of let in on this, and I think this is exactly right. Most of the time, our clients don't want to buy cyber because cybersecurity is expensive. If we're not careful, it just gets in the way. They just see it as, you know, red line. You know, they don't see this. They see it on one side of the balance sheet, not the other. And so they don't really want all of this. It's not something that they really want. And is that something you guys see in Petra as well? Because I know you guys are in these conversations every day.

Yeah, 100%. And what a lot of our partners tell us, especially on some of those SMB companies where there's not that big vocal champion, CISO internal, even a CIO sometimes, right? They're trying to sell security to a CEO whose main objective is increasing revenue, or they're trying to sell it to a CFO whose main objective is lowering cost, right? And they end up being that, that voice of, hey, why don't we address risk? How about lowering risk? Where is that on the table, and how do we factor that into this ROI conversation?

Yep, right. So it's so well said, and, and I, I don't think we can undersell that enough. Like, hot take maybe, like, I come out of enterprise and I have a lot of like security leadership friends. I've got one I won't share his name because of the company he works for. It's quite large, but he will hold the position that he's like, of all the CISOs I know, he's like, very few of them actually deserve a board seat. To your exact point that they want a board seat and they get angry that they don't have it, or regulation forces them into the board seat, but yet they don't know how to engage correctly with decision makers. And as you said, CEO wants to grow, CFO who wants to just continue to trim and run efficiently. So That's what we're going to talk about today. We're going to talk about some of these hot takes, and I want you all to be open-minded for all of this. Matt checking in saying, no one wants to buy cyber insurance. Cyber is in a similar boat. Yeah, you're exactly right. And we'll talk a little bit about cyber insurance. And if you guys want to, you know, have even more discussion around that, we certainly can. But that's really well said. And then also, let's see, Max checking in here. I love this as well. For sure, we often are speaking to clients who just don't care as much as we do. And that's the reality. Remember Gary Pico one time said, why is it that I care? He said, I said to a client, I said to a client one time, why is it I care more about your company than you do? And it kind of like shocked them in all of this. And then Samuel, it's about risk management. It's exactly right. And by the way, I think, Lincoln, I'm curious what you think on this. I think Samuel's right, is that a lot of times what we can do as security leaders speaking to CEOs and CFOs is attach it to risk because that is a discussion that they care deeply about.

Yep, exactly. And I think you hit the nail on the head. I'm sure we'll get deeper into this, but those two big triggers for tying that risk to dollars, right? You call it out here because they might be regulated, right? Those compliance drivers. But also what we see a lot more on our side is those incidents, right? It's where the rubber meets the road for them. And oftentimes one of the only ways to get them to care if they don't have those compliance drivers. Yeah, right. So, uh, for those stakeholders, it's, it's risk to dollars is, is really where we're trying to get.

Well said. Yeah, that's exactly right. So with that being said, what we're going to do today is we're going to talk about the funnel itself. If you've never heard of or seen a funnel before, this is basically— think of it as a normal funnel. The top of— you have something to pour into something else. We use a funnel, right? You can easily pour at the top of the funnel. I can make mistakes as I'm pouring. It all comes down into one entry point that will go into something else, right? And so if you think about a sales funnel, we have the top of the funnel, which is where our very first conversations emerge, where we're talking to people that we don't exactly know their level of interest, if they're a fit for us, if we're a fit for them, a lot of those questions. Then we get to that middle of the funnel where activity gets— we have certain things of activity, certain items and, um, uh, activity points, and we're going to talk about that. And then we're talking about the bottom of the funnel as we begin to really identify and close. So Lincoln, let's start today at the top of the funnel, and we're going to answer these questions here. How do we find prospects? How do we gain that initial interest? What methods work best and what kind of activity is most effective? And the reason this is a good place to start, I'm going to have a hot take here. I talk to a lot of MSPs. I don't know about you, Lincoln, that just say, I wish I had more leads. If I had more leads, then I would have more opportunity. I just need more leads. And then they go and they find a third-party lead sourcing company and they just typically don't get great results with it. And they're just on the struggle bus. Is this kind of what you see too?

I see it all the time. Yep. And it's, it's hard. It's a crowded marketplace. It's hard to differentiate. And especially when it comes to security, oftentimes it's perceived as, again, a cost center or something that's going to slow down the business. Right. So having those leads of those clients that care about maturity, care about cybersecurity maturity, and are willing to put their money where their mouth is in terms of spend. Right. That's always the biggest challenge.

Yeah, it really is. And so coming into this, one of the things I put this picture on here. So this is from— and I have permission to share pretty much everything here. This is from Sean Torres. This is over in telecom in Slidell, Louisiana. Most of you could never find it on a map. They are, I know, over $50 million in revenue. Sean's all organic. Sean started his MSP. He tells his story of how he was just a Lost Cajun selling phones in a Verizon store. And then he started it in telecom and they started in the telecom selling, you know, telecom lines and VoIP and all that kind of stuff. And then as they've grown into a full-fledged MSP, they have grown and grown and grown and grown into, I mean, top 5 percentile MSP out there, 50 million plus. And one of the ways that he does, he's just very adamant about this. He's like, If you want to find prospects, if you want interest, go get it. Stop saying passively, I wish it would just happen. I wish I just had more coming in the door. I wish my Google Leads would work. He's like, no, you're going to go out there and you're going to get it. There's two ways you get it. You pick up the phone and you pull a door. And so he literally has this sticker on every phone in, in the, uh, in the MSP, every single one. It says, pick me up, I make you money. And I love this because Sean knows if we put in the activity, we put in the hard work, if we make the— if we have the willingness to make calls and to pursue this relentlessly, we're gonna build the top of the funnel. And if we don't do this, then the top of funnel is gonna struggle. And if we have a weak top of funnel, then how are we ever going to grow? So, so really, this is, this is one of the most important beginning parts to, to really work through. I just want to encourage you to, to think through that. Um, so let's talk about building some of that top of the funnel. Uh, Lincoln, love to hear from you on, on some of this.

Yeah, yeah. So this we see is, is a big driver of a lot of those, again, those incident triggers, right? We see that really picking up this year. And a lot of what I do, right, is helping our partners find these prospects or clients maybe that haven't bought security yet and finding those that are really worth spending time with. The reason I mentioned business email compromise is this is 90% of those incidents that start with phishing, right? So BEC, it's business email compromise, kind of a pun here, business biggest existential crisis, because this really is where the vast majority of these incidents are going to be for your clients and where you can immediately find those that are going to have that more proactive conversation with you and come ready to learn, right? So just this past year alone, we're seeing from eSentire, 389% increase in BECs. And again, this is, this is that incident driver. So this is how clients are going to be judging you based on your security proactivity and maturity of your program. Right. And we see here, I threw in the FBI crime stats that just came out. Pretty sobering stuff. We see here it's, it's the number 2 just behind investment crimes, right? You see down there the conman or romance scams. You have over 3 times the chance of losing a dollar to, let's say, a fake Amazon gift card email than to, you know, thinking George Clooney's in love with you and sending him some money. So it's really becoming a big thing. And I threw in ransomware and malware there so you could see by proportion what a big driver this is. So for your clients, think about this as being the primary threat that they're going to be facing as you're having these, these conversations. But also understand they're probably going to see peers popped. They're probably going to see those, those malicious emails come to their inbox. And there's a good chance that they've dealt with one of these. So as we continue talking, a big part of our go-to-market is doing that 6-month look back to see, hey, has there been any malicious activity and can we start that more proactive security conversation today?

Right, right, right. Yes. Well said. And so I think, yeah, these are some talking points that I think are relevant. I don't think— we know they're relevant, right? You're exactly right. Such a pickup in this, such a— the damages are so high. This really is something that we need to be shouting from the megaphone. Exactly right. And this really does become a very top-of-funnel type of communication point to let them know, No, it's a serious and persistent threat, and we need to take care of ourselves, right? And so as we start to think through, where do we start to build top of funnel? Well, one thing we told you is go pull the phone, right? Make phone calls, go pull doors open, go meet people in your community. And that kind of leads into even local events, right? I talk to a lot of MSPs that are very particular about, I don't miss local events, whether they're a chamber event, if they're tech meetups. One thing I wanna say about tech meetups for MSPs that are really starting to grow and co-manage Tech meetups are really important because you're going to go meet CIOs and CISOs and IT directors and those kind of people that say, well, I don't need, you know, an all-in MSP, but, but wow, it sounds like you guys are doing some things around this business email compromise. And you say, for sure. And this is something that's really hard for any company, 200 employees and down, to self-manage. And so we'd love a conversation with you about that, you know. And so those are, I think, really important ways to do this. The other thing I wanted to mention too is think about partnering up. Go meet some of the banks, some of the healthcare libraries that are in town. A lot of those types of industries, even universities. Y'all, last week I did a cybersecurity talk at Murray State University in Kentucky, and I met with 3 MSPs while we were there. The MSPs were there, I was there, and so I'm speaking on cybersecurity. I'm not a security practitioner anymore, but I'm speaking sort of on their behalf, and there's a ton of business leaders that were there. And so my whole thing at the very end, I'm like, by the way, there are 3 incredible MSPs right back there. Go to each one of them and go meet them. Go shake their hands and see how they offer to solve some some of these challenges. So I just think that we can't undersell that. Banks, by the way, I come from a bank, they're required under the Community Reinvestment Act law, they have to actually do things in the community. And so you can actually do a cyber talk that the bank will help you promote. It helps with their CRA credits. It helps you just learn and meet new people, and you can turn into a great educational opportunity. And, you know, Lincoln, even though they may not be the first to just, you know, they sign up right out of the gate, what it does is it builds the opportunity for them to say, wow, that they're really, they know what they're talking about. And it's going to be the next time you reach out to them, they're going to remember that and they're going to want to take your call.

Yep, 100%. And that is when I was in the channel in my last role selling security, that was 100% my playbook. Hey, we're going to do the peer group events, right? ISC², CSA were two of my favorites, but I was religious about. Right? But when you go, you're going to learn alongside peers. You're not going to, to sell, right? Um, and so just that, that atmosphere where you can learn together, uh, and then you have natural conversation triggers to talk about threats that you can take to, to your clients. Or, you know, down the line you get that call, uh, again, like with, with going to buy a car, I use this analogy, right? It's not about closing them on the spot. And I think a lot of us going to a dealership would be very turned off by that sign-on-the-dotted-line kind approach. Whereas if you get a business card and you know they're there to, to learn about cars with you, to educate you about cars, you know it's a safe person to call the next time you want a car, right? And that is what the most effective salespeople look like. It's that—

exactly—

that education first soft sell, but then you have, you have that touch point that they know when they need it, they got you there.

Yep, exactly right. And the one thing we didn't put on here, um, we did think about is even social media, right? One of my favorite things is seeing you as an MSP make a post on LinkedIn about cyber stuff, you know, educational kind of components or stories or things like I— and I, every time I see those, I hit the like just because I'm like, more MSPs need to be doing this, right? Even YouTube channels, you can't undersell that. So what I want to hear in the comments are what are you doing when it comes to like prior, pre-top of funnel? How are you building the funnel? What events, what types of things work for you? I'm going to pull out a comment right here from Matt Collier. He said, I spoke with the University of Tennessee. Go Vols! A month ago or so, met a student whose parents were at a business in town. We just signed them for fractional CISO. Love that. We're discussing managed services as well. Love that. Can't emphasize this point enough. It's so true. So thank you, Matt, for sharing all of that. It really does work. And if you're not willing to go and do these things, you're gonna struggle with building your funnel. Like, that's just how it goes. So thank you for sharing that, Matt. Really, really great. I'd love to hear from others too. This is one of these where we all share. This works for me. You should consider this. That's how we learn. So what kinds of content when we're doing this? The good question that we should ask ourselves is what kind of content works best? And I'm telling you, having done this for a long time, and Lincoln, I'm sure you can attest to this as well, if we walk in and we just sales pitch, they're going to tune us out. If we walk in and we come in with all the scary dark web, thready threat kind of stuff, they're going to— one of two things will happen. It's the first time they've heard it. You're going to scare them into caring. But then what's going to happen is nothing. If nothing actually happens, which is likely because incidents not happening like every single second, they're going to be like, wait, you scared me into caring. You feel like the boy who cried wolf, right? And so we have to play this middle ground of like relevant data. Just to go back a couple of slides, what you shared here, Lincoln, is good, right? Sharing real relevant data authenticated by actual sources. This is no different than the news, you know, the news person saying there's a hurricane coming and I can't stop that. And that's the reality. And I'm showing this bad news to you because you need to be prepared for it. It needs to It needs to be some of that, along with practical steps of what we can do. They need to know it's not just going to cost them enormous amounts of money and they can never afford it. But it also needs to be something real and practical. So these are, I think, really things that are valuable. And I personally, Lincoln, I don't know about you, but I love to share analogies. I love to share stories and examples. And we'll do a few of those as we kind of break deeper into this. But what resonates here for you too?

Yeah, I was going to call out the boy who cried wolf, right? The biggest thing that I see with partners who really struggle to sell security is when they're, they're doing, let's say, an opt-out campaign or they're rolling out a new tool. We all know this is a game of cat and mouse. So you're going to bring new tools to your clients. That's going to happen repeatedly. But they get really hung up on short-term gains and they say this one's going to solve 100% of security issues, right? This one silver bullet will solve all security issues and stop 100% of attacks. We all know that to be false, right? There's going to be workarounds for any tool and attackers are professionals at this, right? So what I would say is keep that long-term mentality. Make sure your clients are educated that this will be a cat and mouse game that's never fully solved. There's going to be new technology. There's going to be new threat vectors. That's something that's given. And the sooner you can have that conversation with your clients, the easier each one of these is going to go. So they don't feel like they're buying snake oil when you say it's going to solve 100% of your problems.

That's right. Yeah, that's exactly right. So as we kind of work through this, Max— yeah, that's right. Layered security, he's saying. That's exactly right. So it's always about— right. And that's what risk management is about. So, so here's some— I want to do some dos and don'ts at the top of the funnel. Don't, don't, as we said, just scare people with the dark web. We've all done that. I'm guilty of that, right? It's people can buy drugs online through the dark web with Bitcoin, you know. Yeah, cool. It's really interesting. It is interesting. I think it's fascinating. But that's really not the conversation we need to be talking about. What we should be doing is talking a little bit more about relevance. And so here's an example. Maybe help them understand they're a target. One of the big challenges that they typically start to run into is they're looking at all this and they're like, well, Come on, like, this is big for Bank of America, right? This is not big for me. This is big for, you know, a huge healthcare org, not me. So one of the things I like to do is just help them understand that you are a target. If you understand you're a target, then we will respond correctly, right? So one of the questions I like to ask Lincoln, I'll be like, hey, do any of you know, like, what the average salary of a Russian citizen is? And they kind of pause and they're not sure and they're thinking about it. And then I'll say, I'll tell you what it is. The average salary of a Russian citizen is somewhere around $14,000. So if I can pop you with business email compromise for $137,000, that's 10x my salary. You mean I can make my average salary 10x off one business email compromise? Of course you are a target. Can your business survive $137,000? It's not going to be easy, but a lot of small businesses can one way or another. Of course you are a target. In fact, you're more of a target than the big boys, because you're more vulnerable and not doing near the things Bank of America is doing. And that $137 makes a huge difference to someone making $14K. So, so this really does help resonate that we are targets.

Yep. And I threw the toolkits in here so we can understand from an ROI perspective, right? These attackers are buying software just like you, and it's not too expensive, right? We see here, uh, Evil Proxy is only $400, Caffeine's $250., it only goes down from there. Right. And these are toolkits that can get around MFA. They have, and by far the most popular is Microsoft, by the way, but that fake login screen, they have residential proxies built in, which essentially this guy from Russia, he's going to log in from Ohio if his, if his attacker or if his target is there. Right. So these are advanced toolkits that are getting much more accessible and the rewards are there. Why don't the attackers do that? Right? This is what's driving that huge uptick in attacks, particularly that, hey, I can obscure my location. I can get around most location-based detections. Now I can get around MFA. Oh, and by the way, all these MSPs that sold their client MFA, that's going to stop 100% of attacks. Well, I'm off to the races now, right? They don't need behavioral detectors. They don't need other layers because I can get around MFA and that's all they thought they needed. So it's getting much easier. The other, other thing I was going to add on there, right? You talked about helping clients understand their targets. This is a shameless plug that we can help you find that data. We can generate reports showing failed attacks on your clients. And it really creates a way to, to pull all that noise, make it tangible, put it on paper and help them understand what these threats actually look like from a tangible perspective.

Yeah, yeah, it's well said. I want to pull in what Samuel said too. This is so good. He said last week I was at the Stripe conference and I made it count. I worked the room, vendors and attendees alike, talking through gettoinbox.com. If you haven't seen that, just— you should be aware, Lincoln, you might even want to talk about that and what we do. Picture's simple. Pull out your phone, run your domain score through it right now. People did. The feedback was strong and we walked away with real signups because people saw the tangibility and all of that. And they said, I didn't know. And by the way, the Stripe conference, what a great place to go. Places where, you know, Stripe is all about payment gateways and mechanisms So you can be talking to people that are ultimately involved, not just in e-commerce, but like all of the payment transaction requirements. So security is definitely something that they're thinking about. Absolutely love that. How brilliant. So let's move on. Let's see here. So another don't do. So maybe don't tell them like you go pull IBM cost of a data breach, $4.8 million. Like that's true, right? Like, but IBM is aggregating this across thousands and thousands of data points. Right? And so when they average it all together, 4.8. Now the problem with this, and I've seen people use this before, it's not that the data is bad, it's that it's not relevant, right? And a smart business owner is like, come on, man. Like, I don't even make near that in a year. Like, I just know, I just know that's not right. And so there's better ways to say this. There's better ways to frame it up. One of those, I'll take the first one and then I want you to take the second one, Lincoln. The first one is, I just like to ask a simple question. In my days at Perch, when we saw someone pop by ransomware, and we're helping them recover, it was about 16 days of outage time, about 16. So an easy way to say this would be, what does this look like for your business if half your revenue is slashed in half? And that's not even counting the, the slowly getting back up to speed, just 16 hard days of outage. If we slash revenue in half for the month, some businesses don't have the float to survive that. Those that do, it's still a long tail of difficulty that we're going towards. So it's very easy, as we said before, risk-based conversation to say from a risk perspective, How does that affect you? And have we really thought through that? Because your business owes that thought process. Lincoln, what about the second one?

Yeah, yeah. I threw this in there because there's obviously that big scary stat that the average cost of, of wire fraud on these BEC cases is $137K. But to your client, right, I can really land like that last stat sometimes where it's important to highlight that 71% of these don't actually get to that last step. Of financial fraud. But along the way, again, just tying to those outcomes for your, for your client, they can't always understand the technical aspects, but they can understand that, hey, access data, data that's stolen, that's fed to an LLM, can't put that cat back in the bag, right? So that stolen data is a big outcome. The reputational damage is the next step. So once they have all that context, then they're sending out emails. They know your, your top clients, your top partners for your business. That's who they're going to target first because that's who's going to have more likelihood to pay invoices. So just helping them understand what that attacker kill chain looks like and then helping them understand what does that mean for your business, right? What would be the damage to those relationships if you had to inform a client of an incident and they got a fraudulent email from your email address, right? Right. What does that do for your book of business if they could isolate those top 5 10 clients that you have and damage your company's reputation and steal some of their data. Little caveat here, it's worth looking at data disclosure laws. Those are really growing quite a bit, and that can mean reputational damage even if the attacker doesn't send out emails. Right. So we're seeing those, those first two negative outcomes. Again, that data theft and reputational damage really are important tickers that often get kind of brushed to the side with some of those big scary cost of an incident stats.

Yeah, yeah, that's exactly right. So as we kind of think about objectives for top of funnel, we're trying to get to is first of all getting to a meeting. What do you think about that, Lincoln?

Yeah, well, this is always the hardest part of any sales process, especially if you're, if you're going out, you're hunting, it's cold. But I was going to say, per that, that data disclosure law, right? We're seeing a lot of these third-party compromises where attackers are using these trust networks, exploiting them. And I want to encourage MSPs to also use these trust networks as the good guys, right? Because if you find one of these compromised accounts, chances are they've sent out emails to others. Good chance they've compromised others, or at least should be notified. That there could be some phishing emails or fraudulent communications that could jeopardize their employees. So I always encourage folks who are wanting to be on that more proactive business development side, don't ambulance chase, but be that ambulance, because a lot of these, these small businesses don't have that security person internally who's actually monitoring these things and able to respond. So it can be an interesting way to jump develops a business.

Yeah, yeah, I, I totally agree, and, and I love that, right? This really is about building that trust relationship, right? And we'll talk a bit more about that coming up. But as you build the trust, um, again, it may not turn into business right away, but what it will do is over time you start to be, hey, that's the person I'm gonna call when I need them, right? But it, to your point, also when you build the trust relationship, it lets us, we're more effective when we reach out. We send the email out to somebody they reply back when we make the phone call, we go pop in with some, a box of donuts and just say, "Hey, I know you're busy today, but just got a little thing I wanted to give you. And if you're open to it, next week, I'm gonna give you a call. I'd love to just stop in a little bit longer and just talk about this." If you've done those things, because you've already been educating them at other events or wherever it's, those things become very, very effective in getting to that next step, right? And trust is a huge component of all of this. So I absolutely love this. So let's talk about, you know, as we start to we build that top of funnel, right? So we're doing these things, we're doing this activity, we're out and about in the community, we're teaching, we're educating, we're using social media, we're just active among people, we're making ourselves known. But that gets us the right to hit this middle of funnel, right, as we're starting to build those relationships. And now we're actually conversing and we're talking. And we— what do we do next? What does that look like? Well, there's a lot of things to talk about. One of the things I wanted to make sure we speak a good bit around is discovery. One of the things I think that sometimes we miss, and I've seen this in not just on the MSP side, but even where sales teams miss this on the vendor side, is we haven't done proper discovery. And so we end up wasting time on somebody that is not a good fit for us, or we don't spend enough time on somebody who is a good fit for us. And discovery and lack thereof causes a lot of problems in the middle of the sales funnel process because we've never done this. So we're going to unpack some questions that we should have very well detailed and documented as an MSP or as any business to make sure that our discovery works really well. So start with this cameras, gates, and weapons analogy, if you would, Lincoln.

Yeah, I use this a lot for non-technical folks, and it's just a way of understanding different aspects of security, right? So I use home analogy. There is kind of separate controls into 3 departments, right? So we have our gates, right? Everyone has— should have a front door, right? It would be like username, password. MFA added a front gate, right? Think of it like a driveway gate or something where it can be a little bit easier to understand, especially for some of those folks who maybe don't like fumbling around for their keys. Not to keep picking on MFA, but it does— it creates some friction sometimes that gives people a negative impression of security. Right. But I say this because there's other ways to think about it. There's less, let's say, constraining aspects of security like cameras who are going to passively monitor and tag and classify information. Right. It's going to be looking eye in the sky. What's going on? Do I have visibility into what XYZ is doing? And then you have your weapons, right? This is what Petra would fall under. This is going to be your last line of defense. All that acronym soup that ends in R, or detection and response, if you will. But it's going to be that reactive piece of security, right? So I like to use this analogy because a lot of our clients are going to fall somewhere in the spectrum of, let's say, what part of town they're in, right? Where do you have street lamps at night in your part of the the neighborhood, right? Do you need, do you need a gun in the drawer? Because usually that's going to be the first step. If you're on the wrong side of town, you need that last line of defense, right? Before you're hooking up this really expensive camera system, you're buying this big automated gate for the driveway. It can be a good way to help your clients understand security in terms of just basic home safety. 50.

Yeah, yeah, exactly right. And I love that. Such an easy way for folks to start to understand this. And you're right, most of the time in my experience, a lot of businesses, they still are in that gates and camera and that's it, right? Or gates only. And at some point the gate fails, right? It's a good way to think about that. It's not that the gates are bad, but at some point people are going to get past the gate. So what are we going to do about that, right? And so next thing to think about too is your ICP, your ideal customer profile. The reality is, okay, hot take again. If you're a small MSP, I get that any customer is a good customer. I totally understand. I'm not going to fault any MSP for saying, dude, I am hungry and I need business and I have time. I'll take anybody. Totally understand that. Would never fault you. But hear me, as you continue to grow, you're going to just naturally find this is a good customer for me. It's a particular industry that we do well with. It's a particular size. It's a particular area of complexity. It maybe is a particular region. There's a lot of things that come into this that that you're just going to be very good at certain things and not others. And we cannot be a jack of all trades, master of none forever. At some point, that falls down, and we have to start to think through what does good look like for us. And the reason this is important is because otherwise, we again spend lots of time cycling on people who are not a fit for us, and they are never going to close with us because we're not— we don't meet their need. And so it's sort of an honest gut check. We've got to work on that for sure. Also, even asking good questions, you know, do you have an MSP today? What are your pain points? Those are all great questions that we should be asking because we're trying to assess and discover where are they at today? What are their needs? What are their expectations? What do we know that they need that they may not know that they need? And we need to educate them through that. So yeah, anything else stand out in particular here, Lincoln?

No, you covered it well.

Okay, so let's move past this a little bit into another component that's really important is, and this is something I think Petra does really well, is assessing, educating, and informing, right? This is the idea of where if we jump too soon into trying to get the deal and we have not correctly helped them understand where the risk really is, why they need to invest, they're going to, they're going to eventually do one of two things. They're going to completely ghost us, which is one of the worst, or they're just going to flat out tell us, hey, this is great, but no thank you. We're going to stick with this terrible MSP. We're going to stick with doing this thing on our own. We don't need you. You're not important. And I look at the cost. Remember we said at the very beginning, no one wants to buy this stuff.

Stuff.

So we have to overcome the, the, the normal position, which is why, why do I, why should I invest in this? This sounds expensive. So this is really important. What does this look like for y'all at Petra, Lincoln? And how do you guys help MSPs with this?

Yeah, this is a great one to highlight because really security isn't going to be top of mind for everyone, right? And this is the stage of the funnel where you should be qualifying out, right? You think of it, the taper on a funnel. This is where leads should be condensing. There should be lots of volume here, right? And I think what a lot of people miss in talking with partners is that not everyone has a reason to care about security, right? Again, there's the big compliance driver and the big incident driver, right? Until one of those happens, oftentimes folks will be very blasé towards their data security. And there's not a lot that you can do. There are some, some interesting things that we can help with in this, in this department, though. I mentioned showing failed attacks earlier. Really, this is the part of the funnel where we want to create as much tangibility for security as possible, right? So showing those failed attacks can be a really good way to ground that threat in reality. Another aspect of this middle of funnel right? And I'm going to talk specifically about our middle of funnel. If we're working with you as a partner, this is where you've already had some, some POV results, right? You've already seen the product in action. And this is where we're surfacing those clients for you that have had incidents, right? Look, in that 6-month lookback, folks that have had past compromises that maybe haven't been educated about the forensics of what happened. This can be a really good educational time. Or maybe you found one they didn't know about, right? What is that going to do for your sales cycle if they have another provider right now, right? Or if they have someone in-house, or if this is something that's totally not, not under control. That's something that I would approach as an assumed sale. Um, and happy to talk more about what that looks like. But this is that, that part of the funnel where you should be qualifying stuff out or in. And zooming in on that, usually it's going to be 20%, right? Pareto's principle of accounts that need that velvet glove touch that have a reason to care about security.

Yeah, yeah, exactly right. So we asked a question in chat. What does middle funnel look like? Got two great comments. Matt said, we work with opportunities to understand their current maturity and pain points, give them a high-level plan of attack to get them to where they want to be within their budget. That's great. I love it. That's exactly what we should be doing is pretty much what Lincoln just said. And then Samuel, I knew he's being funny, but it's so great. He's like, the middle of the funnel Middle of funnel is where leads go to think about it and marketers go to question their life choices. Samuel, I love you. Thank you. That's great. Ray checking in. I love this too. Middle of funnel means doing your best to ask qualifying questions. Exactly right. Find true need and how much they care. Hate crossing prospects off, but trying to be more disciplined about it. Would love more tips on quick and effective education at this point. Right. So, yeah, I think there's a lot to say on this. And we've got a couple more slides on the middle of funnel because middle funnel is tricky, right? Again, we want every— we want to nurture everyone. You can nurture everyone. Just because you mark them off the, you know, it doesn't mean that you're going to remove them from the relationship. They might still get some emails from you. You might still check in periodically with them. But they're just not the ones that you're in the middle of spending the time and resources to educate, to work on, as Matt said, that battle plan, right? And so, I would encourage you just to think through a little bit of that of like, who are our most important ones? And what's the criteria for that? Do they match the ICP? Have we actually worked through them to understand where their pain points are? And all these things is what I would have a very methodical process. And if I'm talking to my sales team, I'd say, show me who's in your funnel, show me who's in your pipeline, show me where they're at in the pipeline based on what criteria. Because the reality is we can overspin our wheels on the wrong and underspin on the right, and we're going to really struggle. Right. So I would say, Ray, one of the more important things that you can do is build out the middle of funnel strategy to say, what does this look like? And then I would look at that as a leader every single month. And look at what we're doing from a sales perspective to see, are we matching this according to criteria? We following this battle plan or are we starting to know gaps in the battle plan? We need to go address it and fix it. Anything else stand out to you on that question from Ray Lincoln? Because I think it's a good one.

Yeah. And I was just going to add to that. Clients will push themselves to middle of funnel. We saw that crazy stat from, from East Entire, 389% increase in business email compromise. Right. So again, this is, this is where we're seeing the rubber meet the road. On that incident qualifier, let's call it, right? So there's a really good chance you talk to a lot of people and you are just that next person they call, right? A lot of people won't, won't be qualified until they have an incident is really the fact of the matter. So oftentimes getting to that middle of funnel, it's not always in your control. That top of funnel is much more in your control. So again, just focusing on those education, being the next person they call, all those activities that help you expand your trust and cast a wide net.

Yeah, exactly. And we do have— Ray, reach out to us at Empath. We've got a ton of stuff that's really good around cybersecurity education, top sales objections that we love to talk through, you know, analogies that make all this make sense. And that really kind of plays right into this slide of, you know, I love saying— I say this all the time— to educate is to disarm. In other words, if they don't know who we are, one of the best things we can do is come across as a sage to point them on the way. If you look at The Hero's Journey, that book written way back in like the '70s, the whole idea of that book was the genesis of all good stories is that you have a hero who's in a normal position in life. They get called out of that normal position into a time of difficulty. In the middle of the darkness and difficulty, they don't know the way. They meet a guide. The guide cannot get them where they need to go, but the guide can point the way. And the truth is, and if you've seen StoryBrand, it's sort of a modern version of that. The idea is that you are the guide. You are not the hero. And so, it is our job to come in. We are the Gandalf. We are the Dumbledore. We are the Yoda when we come into these situations. We are pointing the way. That means that we're an educator. That means that we're a sage. That means that we come in and we say, this is where the world is going. And this is what it looks like. And I want you to be aware of this too. And how can I help you? And how can I answer these questions. It comes across, you hear people say trusted advisor. I think sometimes we use that term without defining it, but really think and ask yourself, what does our middle of funnel activity look like? What is the education that we have? And what are the activities that we're doing? Does it match up to being that guide to helping them along the way? And understanding that not every single time I talk to them does it turn into a deal. And I see too many MSPs go right for the kill shot every single time, and it doesn't work because now you're not educating You're selling and clients are smart. They sniff it out right away. So if you're not opening that way and opening up for questions, opening up for them to discuss, then we're missing the boat for sure. Anything else that stands out to you here on this one, Lincoln?

Yeah, I think you hit the nail on the head with this one. And you guys do an awesome job of being education first. I like that, you know, your product education, but your go-to-market is education. It just proves that it actually works. Works. And that's a— yeah, way to roll it out.

Yeah, 100%. So walk us through some bottom of funnels. We're working through the middle and now we're getting to this next step. Assessments are a big component of the beginning of the bottom of the funnel, right? So walk us through some things here that stand out to you.

Yeah, yeah. So creating that mutual action plan, I think that's a really important part of this where sometimes this just looks like checking in on results together. Together, right? Uh, if, if you can block that time off and really have some focused time where they're learning, um, my rule for this is keep it off of email. Make sure they, they feel like they're in an environment where they can ask dumb questions. Going back to that education, they— you're not going to know what they don't know unless they feel comfortable telling you, right? And so that's why having those action plans with the— with those check-ins is very useful. And for you, you should come in with answers, anticipate what those questions are going to be and have some data to present. Again, that's grounding those threats in reality. That's creating some tangibility for all that noise going on in the market. Here's what it looks like for your environment. At this point, you've done discovery. You understand what those, those holistic drivers are for their business, but also those reasons of why they should care about their security, right? And so that can be a really good way to create some mutual accountability, but also that like you can essentially pare it back what you've heard during discovery in this process where, hey, you told me XYZ drives, drives the needle for your business. You told me these areas of security slowed your business down. So here's this, this custom program that I'm presenting to you. Let's get some feedback and let's whittle this down into something that, that works both budget and functionality-wise.

Yeah, I love that. And something I'll say too is that this bottom of funnel is oftentimes not just for potential new clients. You should think of this almost as current clients too. How many of you have had these types of conversations with your current clients? If you haven't, there's a good chance another MSP is doing it too. And this is a lot of times we lose a client is because we haven't engaged in this and we're afraid to engage in this because we're like, wait, that means I got to come back and have this conversation I never did before with them. Yeah. Yeah, you do. So what I would just say is eat crow and just say, "Hey, you know, I just want to let you know, we've really been spending time in this year getting to know our clients more. And I just want to spend a little time with you knowing, like, where you're going and what's important for you, what some of your major objectives this year are. And I just want to make sure that we, as your MSP, we're well aware, we're documenting these things, and we're having the opportunity to make sure we help you meet those goals and objectives." And just open up like that, like just eat a little crow and watch them say, oh, that's cool. Thank you for asking. And watching them open up, or if they don't open up, you realize you might actually need to go back up and treat them almost middle of funnel and start educating and working with them again. Right. So just, just be aware that these activities are not just potential net new, but it could even be current clients too. So I want to— what we're going to do, what Lincoln are going to do is actually unpack this even more. So, so not just— let me go back a slide. This is sort of like the North Star. And we're gonna, we're gonna start unpacking each of these a little bit more. So first of all, present your findings, right? And I really like this idea of, it's great to show gaps, right? But clients don't always understand the relevance of a gap. They're going to probably say, well, I probably got lots of gaps. I don't really know what that means. I'm not sure, you know, what I should do about that. And it sounds expensive, right? So one of the things that we can do is we can really help them understand from a gap perspective, these are the ones that are critical must-fix. These are the things that are very important coming up, and these are some things we can chase later. And what's really nice about that is it lets them see from our perspective, we're not asking you to go deploy every bit of, you know, money and capital you have saved up to go do everything. We want to go after the big things. Here's an analogy. I told you we like analogies. If I— let's say I go to a financial planner for the first time. And I say to that financial planner, you know, I'd really like to retire at 58. And they say, great, sounds wonderful. Let's make it happen. Give me all your finances. And they come back and look at my finances. And Lincoln's my financial advisor. He says, Wes, buddy, you've got crazy credit card debt. You've got a mortgage, you're still paying off college for your kids, you got 2 cars that you're paying off. Like, buddy, it's not in the cards. I don't know what to do. You've got You got 1,500 things you're gonna have to clean up. I'm probably gonna give up and just say, well, I guess I'm working till I die. But what happens if he comes to me and he says, Lincoln says to me, Wes Spencer, you're not great right now. You got a lot of debt, buddy. And that's going to be a real detriment to getting there. But what I want you to know is there's 3 big things that we should work on right now to work on that. The number 1 is credit card debt. Can we build a plan over the next 2 weeks? To address how to build a budget, to stay disciplined to that budget, and to destroy that credit card debt in a year. Can we do that, buddy? I'm marching forward to that because you gave me the one thing to work on or the two things to work on. And I think this is what's really important for us as MSPs, is that at the bottom of the funnel, we need to lead in that direction. What are the critical bleeding elements that we got to start working on? And we'll get to the other things later. And so I just love that analogy because it really helps us think through, um, how we should be having these discussions with our clients. Um, Lincoln, what do you think?

Yeah, and I think this feeds really well into, um, a land and expand motion, right? Because security doesn't— it doesn't make money out the gate, right? And so with that, I like to go back to that house analogy of, hey, Mr. Client, right now you don't have a front door. I'm just going to screw on a front door. We're going to take a small step today. Is that okay with you, Mr. Client? Where you can, you can walk that into, hey, well, someone could, could throw their shoulder against the door, barge in, and you don't have a bat behind the door. Let's get you a bat.

Oh, okay.

Well, you know, your grandma's room, she might not be able to swing a bat. Let's get you a Glock in there, right? Let's make sure grandma's protected and she has something that worst case scenario she can use. But it's going to require a little bit of nurturing as you grow their maturity. And I see a lot of MSPs approach this with bundles, which are awesome, right? Those can really help you sort these controls into critical, important, optional. Bundle, right? And oftentimes there will be 3 bundles. My only caution there is make sure that it feels holistic for the client and make sure you have some flexibility on how you roll those out, right?

Yeah, well said. Going into this, you know, Matt says, I think we're doing a pretty good job of the sales cycle. And Matt's over at Tin Hats, great MSP out of Knoxville area. We've done a ton of work over the past years to position ourselves in the community as, as the go-to experts and paying off now. Wow, right on. Love that. It may not happen right away. So another analogy for you, because again, I just like analogies. I remember my banking days, Lincoln. I remember sitting down in my board meetings as the CIO, and I would hear my CFO talk often about the Texas ratio. And he'd be like, well, our Texas ratio is really good right now. We compare our Texas ratio to these other two banks that we're competing with, and et cetera, et cetera. And I'm like, first of all, I don't know what Texas ratio is. I think Texas ratio, I'm like, I guess how good like this guy does like on the horse or whatever. But, um, the other thing I noticed was that everyone listened when he talked about the Texas ratio and everyone like joined in the conversation about how this was good and it helped our Texas ratio and we need to work on this to improve our Texas ratio. I'm like, this is the most bizarre thing. The entire boardroom, all of the board members are engaged on this and this Texas ratio. So I immediately go out of my office and I go to Google. I'm like, what the heck is the Texas ratio? And what it is is a bunch of nerd stuff right here, like all this crazy stuff, non-performing asset, blah, blah, blah, blah, blah. And it turns into a ratio. And what I learned was a good Texas ratio is anything 100% at a score of 100 or over. Anything bad is 100 or under. No, what I learned was, and I asked some questions and my CFO was like, no one knows how to calculate this but me. I'm the only guy that calculates this for our bank. But what they know is over 100 good, under 100 bad. And I'm like, oh, I got it. He's like, so I use this all the time to be able to say, you know, we're not doing this and pull our Texas ratio down. Like, oh no, we can't have that, right? And it just was this epiphany to me that the CFO has for so long done such a good job of taking complex math. Trust me, I'm a CFO. I know how to do the math. You don't have to worry about it. I'll do it for you, but I'll distill it into an actionable insight. Right side. And why is it that the finance industry has been so good at that over the years and we in the security industry really struggle with it? And so what we typically do— again, hot take— is we want to talk about the right side of this formula over here to our decision makers. They're like, I don't know what any of that means. I don't know what CIS IG2 means. Well, that goes into the ratio on the right. What I need to do is distill on the left to give them something that they can compare and understand, right? Lincoln, I'm gonna put you on the spot here, but like, like, uh, what things resonate to you guys as good Texas equivalents of Texas ratios? Like good scores, good mechanisms, good easy-to-understand kind of KPIs that you like to share and use?

Yes, what we like to— and again, we want to create some tangibility of these threats, right?

Yes.

We like to do again is just focus on those clients that are going to be in that I'm ready to modern state of mind. Where— when they're going to be there is right after an incident. So the metrics that we like to tie to are the 3 big outcomes of a cyber attack, right? That is data theft, reputational damage, and financial fraud. So that is something that we pull forward on our forensics reports. And again, to make it easy for our partners to roll it out, we want that to be super front and center to communicate to a non-technical stakeholder, simplify that down and show them exactly what that attack path looks like. You know, you don't have to be a MITRE-certified red teamer to understand what an attacker does when they get in an account and how we can avoid some of those bad outcomes on the next time this happens.

Yes. Love that. Love that. So yeah, we encourage you to think through how do you report? And how do you track that reporting and how does that reporting stack up? Right. Matt said way earlier in there, he's like, I don't like best practice. A good, better version might be like peer analysis, right? And people want to know. They don't want to be— they don't necessarily want to be the leader of the pack, but they certainly don't want to be the end of the pack. Right. So as we kind of work through bottom of funnel, we're closing up on time here. Packaging the fix, right? Most of the time we jump into tools and the client's like, dude, that's nerd stuff. And I don't understand that nerd stuff. And again, those are like, I almost like when I go to get my car fixed and my mechanic gives me this big long list of stuff, I'm like, I don't care. Bottom line, what's it going to cost me? Oftentimes, that's what they do. And so if we're trying to sell all the parts, they're going to come back and say, that's nerd language. Like, that's— I pay you for that stuff to go away. Give me the outcome. The difference with the car mechanic is the car mechanic says, I fixed the car and now it's safe to drive and your family's safe in it. That's the outcome I want. So I encourage you to drive through the outcomes. So some of them could be, if it's a more mature client, you can sell on these like security identity foundation, right? You, you, a protection layer. If it's a mature client, if it's a less mature client, if it's a smaller client, then it's going to be a little bit different how we talk about those outcomes. It's going to usually be tied to business objectives and what they're trying to do. And we say, I can help you do that, but we got to put the right things in place to get there. And we can help you with those efficiencies, by the way, as well, some automation. And other things like that too. Lincoln, what do you think on this slide?

I was just having a chuckle to myself thinking about nerd speak and, you know, us being Dumbledore also, or Yoda to the client. But yeah, this just has to be that kind of final educational time where you're tying back to those outcomes. And yeah, I see a lot of different flavors of these bundles.. But just understand that your tech stack ultimately reflects on you as the provider. And so nailing in those, those best of breed offers, um, and having that make sense, having that be a differentiator for you, and then being able to, again, tie that back to those outcomes, to the threat landscape, um, where, where clients understand that this isn't fixed point in time, going to solve all my solutions forever. It's going to be something that evolves over time because you as an advisor are staying on top of the market on their behalf.

That's right. Yep, exactly right. And I'll show you an example of how this can get so nerd item if you're not careful. So this comes from Andrew Zuccoli, really great VC. So that I know out of Atlanta, Georgia. And what he did, he's like, Wes, who is like, you were talking about this like tech stack and tool speak. And it's— you're right. So what he did was he actually took— and we don't have time to talk about this today, but he took the cyber defense matrix. Matrix, which is sort of a way to express all of the deliverables that you can meet from a control outcome perspective. And he laid it out and he's like, you know what I do now is I sit this in front of a client like, like, I know you don't care about each of these line items. It's a bunch of junk. It's nerd stuff. I'll handle it for you. But what I want you to know is when we think about good security, holistic security, he's like, this is what the federal government kind of lays out is good security. He's like, I just want you to know we have things that we do across the board on all of this. And the dark green stuff is our premium that we think you're a better fit for because you're a regular a related client or a smaller client may not need all those things. But I want you to know, when we give you a good security program, we're intentful about it. If you want to ask questions on the nerd stuff, we can do it. I just want to show it to you so you know we're holistically approaching it. Then he moves on and it typically works out really well for him. So as we're kind of finishing up here, we need to think about what happens next, right? We need to talk to them about what are the ramifications if we don't do these things. And this should again be tied to the ICP. We should know from an ICP perspective, they don't do these things, what can happen to them? And it could be any of these things— failed audits, cyber insurance denial, any of those kind of things. And also, you mentioned this before, Lincoln, that data discovery and disclosure laws are coming into place. Negligence is a real thing. Inaction is no longer going to be tolerated as, well, I just didn't do anything. Negligence can be a real issue. And so we need to think about that. So we're going to finish here. I knew we'd have a few more slides than we had time for, but two really great things we want to leave you with. One is on the empath side, we've got a really great workbook on offense and defense. Pop that QR code and you can grab it absolutely for free. And then on the Petra side, really, really great workbook as well. So go grab that as well. Lincoln, any other kind of closing thoughts, questions you want to tackle more, anything like that?

Yeah, I appreciate you having me on. Appreciate all the educational stuff you all do. So nothing else, but again, that QR code on our side, that will get you set up for a scam. So that's what we're doing to help you educate your clients. You'll learn a ton going through one of these. But really, we're looking 6 months back. We're trying to find those, those accounts that are going to make it down that funnel, right? We're trying to isolate those, that, that 20% cohort initially. It's like, hey, these guys have had incidents. These guys have real things to talk about. We can put threat into dollars and we can communicate these new threats out there in the landscape. So that's how we're helping our partners build out their cyber go-to-market and really excited to help with that.

Love it. Love it. Love the Petra team. You guys have been crushing it in the industry because you're doing such a great job with it and helping partners along the way and solving a real, real problem around the visibility of Microsoft 365 and the threat landscape they're in. Lincoln, to you and the entire Petro team, thanks for joining us today. To the audience, Matt in particular, Samuel, a lot of those have been chatting. Thank you for all the discussions. Link to the, to the workbook there as well. So thank you guys for joining us today. It's been a super fun discussion. On behalf of Empath and Petro, we want to say thank you and hope you all have an incredibly amazing weekend. Thank you so much.

Thanks, guys.