How to bridge the gap between cyber security technologies and business value
The borders of the network have disappeared, and people have moved out of the office with minimal focus on securing their remote environment. Ransomware events are increasing in both frequency and amounts demanded. Compliance and certification is getting more focus as governments move to support cyber security initiatives. The news is full of talk about security concerns.
Despite all the trends favouring cyber security related services, the gap is still growing between the real value of cyber security Services and their perceived business value.
In this article we go after why MSPs still seem to be struggling to articulate the business value of higher cyber security standards, creating proper business development plans and capturing the market opportunity. That leads to all kinds of problems for clients, including not being protected. Bad executive decisions mean MSPs cannot monetize cyber security services and end up hurting their bottom lines.
We are going to go through the 4 main challenges creating the gap between the technology service providers and the clients. The interesting thing is that all the four major challenges are related to miscommunication.
Just a step back before we jump in on the communication issues and the potential fixes.
We all know that cyber security issues have increased because technology affects personal lives and businesses deeper and wider.
Most of the cyber security related issues are invisible to users and business owners.
Most of these issues can not be solved by implementing another technology, but need to change user and executive behaviour.
That means solving the problem is not really a technology problem but a leadership one. Solving the issues won’t come by just implementing more solutions. They need to actually take leadership and guide the clients through this transformation.
Most service providers, though they’ve shown years of excellence providing best of class services, have no experience in stepping forward to lead people through behaviour changes.
Therefore the root of the problem to solve cyber security problems is NOT applying a technology solution but applying business leadership. The gap is getting wider between cyber security services and perceived business value as the service providers are applying more tech instead of more leadership.
Let’s see how MSPs are making this happen.
COMMUNICATION ISSUE 1 - TECHNOLOGY CONTEXT
MSPs often see and communicate the issues from the technology perspective.
- firewall needs replacement
- MFA should be adopted
- stronger passwords need to be implemented
These are all technology related solutions and so they create a technology context for the conversation. Many of these are acute issues so the MSPs try everything to convince these executives to implement those solutions.
The problem is that clients get turned off, maybe seeing MSPs as pitching products and services taking advantage of their lack of knowledge. Of course this is the opposite of the original intent.
How to fix: Apply Business Context
If the communication generates a business context then MSPs can apply the solutions in the client’s frame of reference rather than their own. MSPs should ask questions to lead executives toward better decisions.
- How comfortable are you with your current ability to respond to a detected cyber incident?
- What does that mean to your reputation, client’s perception or the organization’s day if a ransomware attack could lock up your systems?
- What do you think your role as a business owner is in providing a secure and low risk environment to your employees, clients and stakeholders?
The result is a business conversation where the MSP can understand the executive’s thinking process and give their input about a potential false assumption or offer more help in understanding the potential impact of issues. The goal is not to convince them that cyber security is important but to furnish them with the perceptual framework so they understand the risks and their role.
Communication Issue 2 - Technology Assessments
The market has been flooded with different kinds of cyber security assessments. The better ones follow a framework such as NIST CSF (US) / Essential Eight (AU) / Cyber Essentials (UK). These assessment software solutions help MSPs to streamline and automate a conversation about cyber security, risk assessments and remediation plans.
Although we believe this is the way to go, the major issue of these attempts is that it is driven by technology people in a technology context. These assessments check the security posture against various threats and try to convince executives to fix those with various technology tricks.
How to fix: Business Assessments
These assessments should be backed by cyber security frameworks such as NIST CSF (US) however the recommendations should be easy to understand business action plans for executives. These reports should be delivered by account managers and not technology people purposefully. If the results and recommendations are delivered from a business perspective there is always an option to go in depth with technology people. However the conversation stays on a business level in general.
The benefit is that the Account Managers are forced to look for the business use cases and can filter out the unnecessary tech talk from these assessments. Obviously the preparation of these assessments comes from the technology side but the presentation, and the leadership will be on the business level.
That gives relief to the executives of speaking the same language and forces the account managers to effectively communicate the business value instead of listing technology recommendations.
Communication Issue 3 - Technology Solutions
Most cyber security assessments list an overwhelming amount of technology recommendations - systems to implement, hardware to purchase, upgrades, policy and compliance activities and other things an average client will not comprehend. This leads to confusion and confused people make default decisions. The default decision is obviously to do nothing. This is very easy to do as most of these technology recommendations yield benefits that are not tangible.
How to fix: Business Action Plan
Instead of listing recommendations such as: “Implement Multi Factor Authentication Solution” which is a “solution” to a business benefit narrative to “Prevent unauthorized access even with a password breach”. Or Instead of “Security Awareness Training” which is a solution to a benefit “Building a Cyber Vigilant Employee Culture”.
Now you are able to list those benefits as projects, and you can list the activities behind the projects such as implementing technologies, but the narrative is business friendly. That communication encourages better decisions and demonstrates the benefits of the initiatives instead of leaving clients confused by a plethora of technology solutions.
Communication Issue 4 - Development Projects
Many MSPs are longing for a “big bang” revolutionary cyber security project to be purchased by the client. The assessment remediation projects can be done from the technology perspective in weeks or months. They try to sell the project and probably try to move the client from a low maturity to a super high maturity level quickly. Yes, when companies had to face lockdowns they reacted and adopted change quickly. However if external forces are not that powerful the adoption of change is very slow.
How to fix: Development Process
Seeing cyber security as a “never-ending development process” instead of a “one-off project” gives many advantages. The MSP does not have to force all changes quickly, they can distribute the projects over months and prioritize the low hanging fruit. It also allows the MSP to bring up cyber security-related initiatives to sign off quarterly. That makes it a standard agenda based on the bigger roadmap. So account managers do not have to convince executives all the time, but help them take one step at a time to establish a less risky business over time.
As you can see, these 4 communication challenges and potential fixes are nothing but a change in your perspective.
- think about the client’s point of view
- have a business conversation instead of technology presentation
- enforce a benefit narrative rather than a solution narrative
- think about a slow burn culture change instead of a quick revolution
That turns you into a true advisor, sought after business partner and a communication expert. It will enable you to secure all your clients, reduce your business risk and make your business more profitable.
If you cannot break those old habits then the gap will widen between your technology services and the perceived business value your clients see. That leads to endless arguments with your clients about why they need to invest more in technology and a stagnating and less profitable business.
The 4 Steps of Successful Cyber Security Service Monetization
In my observation, previously working for an managed service provider and now with MSPs: for some, monetizing security is an elusive goal that seems to be reserved for those who already have connections, experience, and the right customers. Why?
Generate client engagement
with five NIST cyber security roadmaps in 30 days
Clients are confused
It is very common for managed services customers to believe their MSP is responsible for cyber security. They think it should be included in the price they already pay. This is just an extension of the misconception that Information Security is part of Information Technology.
MSPs are inadequate
Selling cyber security services is only for those “big” enough to have an in-house service because quality security talent is hard to find, expensive, and nearly impossible to retain. And without some experience on the team, many MSPs are not sure they have adequate expertise to build and run a security program anyway.
Some turn to third parties for assessments and services, but are concerned that having a 3rd party conduct assessments might reveal that somehow the MSP has been doing a bad job with security. Often, the MSP can't play a role of any significance to the customer in the assessment process, so without an option for a heads-up, many abandon the effort.
MSPs are overwhelmed
Big companies are snapping up all the qualified/experienced security staff, while the rest are playing “employment pinball” until they’ve got enough experience to be a senior analyst somewhere. From the outside looking in, there’s a strong “gotta have money to make money” vibe in cyber security.
There also don’t seem to be any partners focused on helping MSPs build cyber security programs. All the partners and products are focused on the Enterprise sector. What guidance is available costs $thousands and still takes 8-12 months to build out a cyber security program and able to offer any services.
It shouldn’t be this hard
It just shouldn’t be this hard to build and monetize a cyber security program — especially if you actually care about it! There is a way. I’ve built a cyber security program designed for MSPs. This works for those who want to work on building their own in-house program as well as those who just want to be able to sell cyber security (and remain involved) without having to hire and retain their own cyber security experts.
4 Steps to Monetize Cyber security in your MSP
Essentially, the process goes like this: Educate → Sell → Assess (and prioritize) → Remediate (remediate, and remediate some more).
Once I show a business owner their need, they then typically ask me what they should about it, so I sell them an assessment in which we build a roadmap of risk reduction projects to execute in both the short and long term. Now in my case, I’m not actively an MSP, so someone else is making the money on those remediation projects, and those projects hold more revenue than any single assessment — especially if the remediation includes subscription services.
Educate
When it comes to selling cyber security assessments, the first thing you should want to avoid is being shopped on price, so instead of vying for position in the eyes of the few who already know they need cyber security, seek to educate just some of the many who don’t understand their need.
Some will understand if only you can explain things in a way they can relate to. That is the secret sauce. I have found a way to effectively communicate the significance of cyber security to the ongoing success of their business in this internet-connected world.
In the book Made to Stick by Chip and Dan Heath, they describe how to shortcut the learning process for complex or new topics. Essentially, the human brain learns based on what it already knows. My favorite example is where they attempt to describe an uncommon fruit in detail, from scratch. When they’re done, the reader may think he has a decent understanding of this fruit. Then they start over, but this time they start with a point of common shared understanding: “it’s like a grapefruit, but bigger.” Instantly, the reader understands the fruit even more clearly than by reading the detailed description. This is the technique we use in helping business owners understand their need for security.
See a short sample video: Making Security Make Sense - Teaser
Here’s why I start with education: In my experience, when I play the role of mentor by educating the asset owners, they tend also look to me for their next step. They ask “OK, well… so now what do I do? What’s my next step?” The obvious answer is: start with an assessment.
Sell
Since the business owner already knows his need for an assessment at this point, my job is to continue to guide him toward his goal of getting one. He already wants to buy, so I explain the “simple process” the assessment follows. I do this because visualizing a simple start-to-finish process takes the mystery (read that: uncertainty) out of the purchase.
Once the process is understood, other than presenting him with a quote with a Statement of Work for an NIST cyber security assessment, my job is to not give him any reason to think twice. Show him the process, then give them the quote + SOW. I am pretty firm on this not being the time to do special scoping discussions or negotiations. Keep it simple. Anything but a smooth path to purchase introduces risk of a lost sale.
Note: As a cyber security consulting firm, the sale of the assessment is my “win,” so I don’t really budge on pricing because I know what I need to get out of the transaction for it to be profitable. But for an MSP, there is another angle to consider: the assessment is just the beginning of the revenue stream from cyber security. For the MSP, remediation projects are more likely to be the real revenue source. So MSPs can flex on the front-end pricing (quite a bit in fact, if they know their typical remediation revenue). BUT, this bears repeating: Keep it simple. If you slow things down or introduce turbulence by debating numbers, the chance of losing the sale increases greatly.
So here’s what I suggest: Before you show them pricing, decide ahead of time what “deals” you’re willing to make. So if you’re willing to offer a half-price deal, be ready to cross through that initial price and put the half price number there. However, I wouldn’t start with a bid of several thousand dollars and be willing to go to free though… People don’t respect what they don’t have to pay for, and if they took you from $thousands to $0, “What kind of game are you playing?” Whatever your numbers, pick and stick so the process is quick.
Assess / Prioritize
Whether you’re running your own assessments in-house or you’ve outsourced them, they need to be timely and relevant, and they need to demonstrate business value.
Timely Assessments
If you’ve read this far, you’re probably not trying to run comprehensive assessments with complex requirements. That means there’s no good reason for these assessments to take long.
For relatively straightforward assessments, I shoot for two weeks as a maximum amount of time to gather data, prioritize findings, produce the summary with recommendations, and be presenting back to the client. I’ve found they typically tolerate three weeks, but at the fourth week and beyond, they’re impatient and much more likely to be critical of your findings, process, advice, etc, especially if you have any “critical findings” in your report which you took your sweet time to tell them about. So if your goal is to sell remediation services after the NIST cyber security assessment, be quick about the process.
Relevant, demonstrating business value
Unfortunately, many assessments have been delivered which had little more than the standard output from whatever scanning tool was used. That’s like a mechanic handing me a color-coded printout of the OBD2 readouts and telling me to fix all the red stuff first. Thanks a lot.
For an assessment to be relevant and have business value, it has to provide realistic guidance for the particular business for whom it was performed. A quality assessment delves into the risk tolerance, the whos, and the whys of the customer. Only when you have a good understanding of the business’ objectives can you make relevant recommendations. For example, there are plenty of critical severity findings which may pose no practical risk for a given business, while several low severity findings in combination pose immediate risk.
Relevance and business value go hand-in-hand. If you understand how the business operates, what it wants to achieve, and it’s mid-to-long term goals, you can offer practical guidance on risk reduction.
Remediate
Remediation is the sweetest part for an MSP. It’s additional revenue (maybe even monthly recurring revenue!) on top of whatever managed services are already in place.
When it’s time to present findings and remediation guidance to the customer, it’s best to break it into timeframes. There may well be several relatively critical findings, but keep in mind: if this business owner only recently realized the need for cyber security, they don’t have a budget set for remediation. They bought the assessment to get a feel for what they need to do something about vs what they’re going to have to put off until later (or simply accept as inherent risk). So in my experience, it is very well received to provide them a “menu” of things to fix within different timeframes. Something like “Immediate,” “This Quarter,” and “This Year.” (Keep it simple.)
During the report presentation, I explain the implications of findings and my recommendations for immediate fixes, then I ask the business owner which ones they can / want to tackle first. Everything else in the “Immediate” section gets moved down into the “This Quarter” section, with anything else already there. Again, we discuss what would be practical to pursue within the next 60-90 days and move everything else down into the “This Year” section.
These discussions can’t really take place without some understanding of the price for the various remediation projects. So I recommend the MSP come to the meeting with individual quotes for each item in the “Immediate” section and rough price-only estimates for the items in the “This Quarter” section. This allows the business owner to do some quick mental math so we can plot a rough course for the next year during the presentation meeting. Estimates for the longer-term projects are optional, but aren’t very helpful during this meeting.
Once the business owner has decided the order of remediation projects, an Account Manager or vCIO can handle the roadmap without further need of a cyber security analyst. Any immediate actions for which the MSP brought quotes can be executed on the spot.
Note: MSPs need to be ready for the findings. Some findings may reflect poorly on the MSP, so be ready to step up and fix things ASAP. While this may be embarrassing at first, it is usually endearing to the customer when they see you doing your part, just like you’re recommending for them to do.
The 4 Steps of Successful Cyber security Service Monetization
FREE RECORDED SEMINAR