If you're offering network or cybersecurity assessments like buy-one-get-one-free coupons, you’re missing out on huge opportunities for your clients and your own bottom line. Assessments that are sold and executed correctly, experts say, can bring both business-changing value to clients and revenue-generating services to channel pros.
The consensus around giving away assessments is clear: Don’t do it. At least, don’t give too much. Giveaways undermine the importance of doing thorough assessments and devalue MSPs’ expertise.
“Historically, assessments have been something MSPs have used almost as a foot in the door, with the goal being to then have a conversation about managed services,” says Richard Tubb, a U.K.-based IT business growth expert. Now, he says, savvy MSPs use assessments as a consultancy tool rather than as a sales tool.
The “light” presales assessments some MSPs provide are unlikely to generate enough information to make a significant difference for the prospect or foster valuable sales opportunities anyway, says Peter Melby, president of Greystone Technology, an IT services provider in Denver. Instead, he recommends selling a deeper assessment up front. The dozens of hours you invest will make you the go-to for solving the problems you identify, because the process itself helps build trust with the customer.
Some providers credit the cost of assessments against ongoing service bills. That’s better than free, but not ideal, says Tubb. “I think charging outright is a great way to set the value barometer and say, ‘Hey, the work that we do is valuable, and we’ll charge you for it.’”
If you must give something away, a dark web scan is one creative and inexpensive way to catch clients’ attention presales, says Erick Simpson, a security, cloud, and managed services business consultant. His clients have won assessment sales appointments by alerting prospects that credentials from their domain are for sale in the cybercrime black market.
Market Motivators
Thankfully, a few current trends are making it easier to build a case for thorough—and billed—assessments. For one, the businesses many SMBs sell to are increasingly asking questions about security. “Our clients’ customers expect a level of sophistication and security that’s driving change,” says Melby. “Clients in the process of landing large customers are now having to verify they have certain things in place, and that’s definitely new.”
Additionally, emerging data privacy laws like Europe’s GDPR and the California Consumer Privacy Act are introducing compliance concerns to all businesses. Tubb says these laws arm channel pros to position themselves as trusted advisers by treating assessments as part of a broader compliance strategy.
What to Assess
Assessments are “part art and science,” says Simpson. “You’ve got to be able to demonstrate the data that can’t be disputed.” In addition to asset inventories, penetration risks, and equipment age, assessments should uncover vulnerabilities such as personally identifiable information and sensitive records that shouldn’t be on a network. That can require patience and diligence.
“Organizations are oftentimes very fragmented. The accounting department might have three different systems that IT doesn’t even know about,” says Melby. Talking to multiple departments can help you better understand—and explain to the customer—how internal activities might pose threats.
“Honestly, that’s where it starts: employee experience,” says Melby. “How adept are they at using the systems? Do the systems properly support what they’re doing? If they can’t use the software, they’ll find [systems] they can [use] or do things that have security impacts like email [documents to] themselves rather than using Microsoft SharePoint so they can work over the weekend.”
Don’t forget, assessments also guide the MSP on what to charge a new client. “If you just go in and quote a client without doing an assessment and then go in and find [many problems], then you’re eroding your profit margin,” says Simpson.
Talk Business, not Tech
There are two ways channel pros miss the mark on talking about assessments: how they speak, and whom they speak with.
A conversational tone is always preferable to technical jargon, says Simpson. “You’ve got to use human terms, and the most important focus should be to create the sense of urgency and put it into business terms for the decision maker. … If you’re using scientific, antiseptic, generic technical terms, you’ll never get that sense of connection that you need,” he says.
The same is true for reporting. While an assessment should be highly detailed, the resulting report should not.
“The patience for consuming that is almost none,” says Melby. Even worse, information overload tends to inhibit people from taking action and reaping the value of the assessment. That’s why Melby offers no more than five action items, distilled within three pages or less, in his reports.
IT providers also underestimate how business-focused the assessment process should be. Channel pros who tie assessments to competitive goals and opportunities are much less expendable than less insightful peers. “I think MSPs are losing clients right now because of a lack of understanding of what’s going on deeply with their clients,” says Melby, who learned this lesson the hard way after doing a “beautiful” assessment for a large company. It revealed all the conventional technology and cultural challenges, he recalls.
“But they fired us because we missed the fact that they had one critical business mission that they had to get to in the next 45 days, and we didn’t ask about it,” says Melby. Not involving company leaders who had those insights in the assessment process was partly to blame for that costly blunder.
“We’ve learned that you don’t come in at a low level and work your way up to the high level,” he says. If a contact balks at the thought of getting an expensive assessment approved higher up, Melby continues, use that as an opportunity to explain how you will support that person in championing the project in a way a businessperson will appreciate.
A conversational tone is always preferable to technical jargon, says Simpson. “You’ve got to use human terms, and the most important focus should be to create the sense of urgency and put it into business terms for the decision maker. … If you’re using scientific, antiseptic, generic technical terms, you’ll never get that sense of connection that you need,” he says.
The same is true for reporting. While an assessment should be highly detailed, the resulting report should not.
“The patience for consuming that is almost none,” says Melby. Even worse, information overload tends to inhibit people from taking action and reaping the value of the assessment. That’s why Melby offers no more than five action items, distilled within three pages or less, in his reports.
IT providers also underestimate how business-focused the assessment process should be. Channel pros who tie assessments to competitive goals and opportunities are much less expendable than less insightful peers. “I think MSPs are losing clients right now because of a lack of understanding of what’s going on deeply with their clients,” says Melby, who learned this lesson the hard way after doing a “beautiful” assessment for a large company. It revealed all the conventional technology and cultural challenges, he recalls.
“But they fired us because we missed the fact that they had one critical business mission that they had to get to in the next 45 days, and we didn’t ask about it,” says Melby. Not involving company leaders who had those insights in the assessment process was partly to blame for that costly blunder.
“We’ve learned that you don’t come in at a low level and work your way up to the high level,” he says. If a contact balks at the thought of getting an expensive assessment approved higher up, Melby continues, use that as an opportunity to explain how you will support that person in championing the project in a way a businessperson will appreciate.
This piece first appeared in ChannelPro Magazine.