Orientation Meeting

Build a Better MSP - Blog

8 min read

The 4 Steps of Successful Cybersecurity Service Monetization

Aug 15, 2019

cyber-commodization

The problem

In my observation, previously working for an MSP and now with MSPs: for some, monetizing security is an elusive goal that seems to be reserved for those who already have connections, experience, and the right customers. Why?

The 4 Steps of Successful Cybersecurity Service Monetization FREE RECORDED SEMINAR

 

Clients are confused

It is very common for managed services customers to believe their MSP is responsible for cybersecurity. They think it should be included in the price they already pay. This is just an extension of the misconception that Information Security is part of Information Technology.

MSPs are inadequate

Selling cybersecurity services is only for those “big” enough to have an in-house service because quality security talent is hard to find, expensive, and nearly impossible to retain. And without some experience on the team, many MSPs are not sure they have adequate expertise to build and run a security program anyway.

Some turn to third parties for assessments and services, but are concerned that having a 3rd party conduct assessments might reveal that somehow the MSP has been doing a bad job with security. Often, the MSP can't play a role of any significance to the customer in the assessment process, so without an option for a heads-up, many abandon the effort.

MSPs are overwhelmed

Big companies are snapping up all the qualified/experienced security staff, while the rest are playing “employment pinball” until they’ve got enough experience to be a senior analyst somewhere. From the outside looking in, there’s a strong “gotta have money to make money” vibe in cybersecurity.

There also don’t seem to be any partners focused on helping MSPs build cybersecurity programs. All the partners and products are focused on the Enterprise sector. What guidance is available costs $thousands and still takes 8-12 months to build out a cybersecurity program and able to offer any services.

It shouldn’t be this hard

It just shouldn’t be this hard to build and monetize a cybersecurity program — especially if you actually care about it! There is a way. I’ve built a cybersecurity program designed for MSPs. This works for those who want to work on building their own in-house program as well as those who just want to be able to sell cybersecurity (and remain involved) without having to hire and retain their own cybersecurity experts.

7 Strategies to Monetize Cybersecurity FREE ONLINE COURSE

 

4 Steps to Monetize Cybersecurity in your MSP

Essentially, the process goes like this: Educate Sell Assess (and prioritize) → Remediate (remediate, and remediate some more).

Once I show a business owner their need, they then typically ask me what they should about it, so I sell them an assessment in which we build a roadmap of risk reduction projects to execute in both the short and long term. Now in my case, I’m not actively an MSP, so someone else is making the money on those remediation projects, and those projects hold more revenue than any single assessment — especially if the remediation includes subscription services.

Educate

When it comes to selling cybersecurity assessments, the first thing you should want to avoid is being shopped on price, so instead of vying for position in the eyes of the few who already know they need cybersecurity, seek to educate just some of the many who don’t understand their need. 

Some will understand if only you can explain things in a way they can relate to. That is the secret sauce. I have found a way to effectively communicate the significance of cybersecurity to the ongoing success of their business in this internet-connected world. 

In the book Made to Stick by Chip and Dan Heath, they describe how to shortcut the learning process for complex or new topics. Essentially, the human brain learns based on what it already knows. My favorite example is where they attempt to describe an uncommon fruit in detail, from scratch. When they’re done, the reader may think he has a decent understanding of this fruit. Then they start over, but this time they start with a point of common shared understanding: “it’s like a grapefruit, but bigger.” Instantly, the reader understands the fruit even more clearly than by reading the detailed description. This is the technique we use in helping business owners understand their need for security.

See a short sample video: Making Security Make Sense - Teaser

Here’s why I start with education: In my experience, when I play the role of mentor by educating the asset owners, they tend also look to me for their next step. They ask “OK, well… so now what do I do? What’s my next step?” The obvious answer is: start with an assessment.

Sell

Since the business owner already knows his need for an assessment at this point, my job is to continue to guide him toward his goal of getting one. He already wants to buy, so I explain the “simple process” the assessment follows. I do this because visualizing a simple start-to-finish process takes the mystery (read that: uncertainty) out of the purchase.

Once the process is understood, other than presenting him with a quote with a Statement of Work for an assessment, my job is to not give him any reason to think twice. Show him the process, then give them the quote + SOW. I am pretty firm on this not being the time to do special scoping discussions or negotiations. Keep it simple. Anything but a smooth path to purchase introduces risk of a lost sale.

Note: As a cybersecurity consulting firm, the sale of the assessment is my “win,” so I don’t really budge on pricing because I know what I need to get out of the transaction for it to be profitable. But for an MSP, there is another angle to consider: the assessment is just the beginning of the revenue stream from cybersecurity. For the MSP, remediation projects are more likely to be the real revenue source. So MSPs can flex on the front-end pricing (quite a bit in fact, if they know their typical remediation revenue). BUT, this bears repeating: Keep it simple. If you slow things down or introduce turbulence by debating numbers, the chance of losing the sale increases greatly.

So here’s what I suggest: Before you show them pricing, decide ahead of time what “deals” you’re willing to make. So if you’re willing to offer a half-price deal, be ready to cross through that initial price and put the half price number there. However, I wouldn’t start with a bid of several thousand dollars and be willing to go to free though… People don’t respect what they don’t have to pay for, and if they took you from $thousands to $0, “What kind of game are you playing?” Whatever your numbers, pick and stick so the process is quick.

Assess / Prioritize

Whether you’re running your own assessments in-house or you’ve outsourced them, they need to be timely and relevant, and they need to demonstrate business value.

Timely Assessments

If you’ve read this far, you’re probably not trying to run comprehensive assessments with complex requirements. That means there’s no good reason for these assessments to take long.

For relatively straightforward assessments, I shoot for two weeks as a maximum amount of time to gather data, prioritize findings, produce the summary with recommendations, and be presenting back to the client. I’ve found they typically tolerate three weeks, but at the fourth week and beyond, they’re impatient and much more likely to be critical of your findings, process, advice, etc, especially if you have any “critical findings” in your report which you took your sweet time to tell them about. So if your goal is to sell remediation services after the assessment, be quick about the process.

Relevant, demonstrating business value

Unfortunately, many assessments have been delivered which had little more than the standard output from whatever scanning tool was used. That’s like a mechanic handing me a color-coded printout of the OBD2 readouts and telling me to fix all the red stuff first. Thanks a lot.

For an assessment to be relevant and have business value, it has to provide realistic guidance for the particular business for whom it was performed. A quality assessment delves into the risk tolerance, the whos, and the whys of the customer. Only when you have a good understanding of the business’ objectives can you make relevant recommendations. For example, there are plenty of critical severity findings which may pose no practical risk for a given business, while several low severity findings in combination pose immediate risk.

Relevance and business value go hand-in-hand. If you understand how the business operates, what it wants to achieve, and it’s mid-to-long term goals, you can offer practical guidance on risk reduction.

Remediate

Remediation is the sweetest part for an MSP. It’s additional revenue (maybe even monthly recurring revenue!) on top of whatever managed services are already in place. 

When it’s time to present findings and remediation guidance to the customer, it’s best to break it into timeframes. There may well be several relatively critical findings, but keep in mind: if this business owner only recently realized the need for cybersecurity, they don’t have a budget set for remediation. They bought the assessment to get a feel for what they need to do something about vs what they’re going to have to put off until later (or simply accept as inherent risk). So in my experience, it is very well received to provide them a “menu” of things to fix within different timeframes. Something like “Immediate,” “This Quarter,” and “This Year.” (Keep it simple.)

During the report presentation, I explain the implications of findings and my recommendations for immediate fixes, then I ask the business owner which ones they can / want to tackle first. Everything else in the “Immediate” section gets moved down into the “This Quarter” section, with anything else already there. Again, we discuss what would be practical to pursue within the next 60-90 days and move everything else down into the “This Year” section.

These discussions can’t really take place without some understanding of the price for the various remediation projects. So I recommend the MSP come to the meeting with individual quotes for each item in the “Immediate” section and rough price-only estimates for the items in the “This Quarter” section. This allows the business owner to do some quick mental math so we can plot a rough course for the next year during the presentation meeting. Estimates for the longer-term projects are optional, but aren’t very helpful during this meeting.

Once the business owner has decided the order of remediation projects, an Account Manager can handle the roadmap without further need of a cybersecurity analyst. Any immediate actions for which the MSP brought quotes can be executed on the spot.

Note: MSPs need to be ready for the findings. Some findings may reflect poorly on the MSP, so be ready to step up and fix things ASAP. While this may be embarrassing at first, it is usually endearing to the customer when they see you doing your part, just like you’re recommending for them to do.

The 4 Steps of Successful Cybersecurity Service Monetization FREE RECORDED SEMINAR

 

Caleb Christopher
Written by Caleb Christopher

Caleb worked at an MSP who wanted to build a security program. He felt the frustrations of needing to develop an education program to help clients understand cybersecurity and their need to do something about it, needing to choose the right cybersecurity tools, train-up or staff-up for security, and mobilize a salesforce and technical team around a cybersecurity program offering. Caleb was a Director of Technical Operations at a cybersecurity firm, managing a penetration testing team, vulnerability assessments, and conducting consultative executive summary briefings with customers. He’s authored articles in BoardRoom Magazine, is a regular speaker at regional IT and Information Security conferences, and is an active member of the local information security community. He believes the SMB market is very underserved with regard to affordable security services and education, and believes MSPs want to help. He used to work at an MSP and saw the struggle from within and in conversation with other MSPs. Many agree there is a moral imperative to introduce security to their customers, but don’t know where to start, don’t have time, or can’t afford to stand up security services internally. So Caleb started Infosec Consulting to be a security practice enabling SMB-focused MSPs to deliver cybersecurity services to their clients. He’s held positions such as Director of IT at a midsize business and Director of Technical Operations at a cybersecurity assessments firm, and worked at an MSP to build a security program. Caleb’s passion for security drives him to be active in the community, so he speaks regularly for local business events and at regional IT and information security conferences. He’s also been published in BoardRoom Magazine on the topic of cybersecurity and was a guest speaker on Auvik’s FranklyMSP podcast.

Post a Comment

Featured

I Read the Book “Building a StoryBrand”, Now What? FREE SEMINAR