If Nothing Changes, Then What Will Change?

My dad said, “If nothing changes, then what will change?” Too often in business and life, we fool ourselves by thinking that our results will change if our intentions change.

Our peer groups have a process called “The Hot Seat.” At each quarterly meeting, one business breaks down its business in detail. It also shares its goals and its plans to get there. This has proven to be extremely valuable not only to The Hot Seat participant but also to all other peer members.

Everyone gains perspective from this process.

The most common thing I see is that people have had the same results or issues for years. Their plans to move forward are the same plans they’ve had, but, according to them, “We’re going to do it this time!”

My response is, “No, you’re not.”

It’s not because they don’t want to or aren’t capable. It’s just that if they were going to make the plans work, they already would have.

There are systemic things with your business or your self-image that are holding you back. You need to dig deeper and do things differently if you want things to change.

Here’s the bottom line. If you want dramatically different results, you must do things differently. Trying harder and having better intentions are great. It’s just not enough.

We spend too much time in our life kidding ourselves about protecting our self-image. I challenge you to think about where you want to be in two to three years and ask yourself, “Is my plan the same plan that has only gotten me this far?” “What is standing in my way?” “What will I do dramatically different?”

Again, if nothing changes, then what will change?

Are You Sure You’re Ready to Hire an MSP Salesperson?

The opportunity for MSPs to grow new logo sales has never been better. Our target markets have improved in every way. The sweet spots for the number of users in our target customers are rising. (Even our seat prices are increasing!) More targets willing to pay more for our services is an excellent market to be in — but how do we capitalize?

The first thing you will probably think is, “Oh, I’ll hire a salesperson.” We love problems we think we can outsource, don’t we? We hire a salesperson. We tell them to sell. Then we go back to running our business. Wouldn’t it be great if that worked? Unfortunately, you must get to the hard part. So, what should you do? I like to work backward to solve challenges.

Let’s start with the amount of new monthly recurring revenue (MRR) you want in a year. For example, let’s say your target is $40,000. Well, how many customers would you need to hit your goal? If my average customers are $3,500 a month, that’s 11 customers I would need, so about 1 customer a month. Then determine how many leads or first-time appointments (FTAs) you would need to close 11 deals. You should base this on your close ratio. If you have sold $10,000 of MRR in the past 12 months, or if your average deal size is $2,000 versus $3,500, then your goal of $40,000 may be out of reach. Your lead generation process doesn’t currently support the goal.

Here’s why this is important. If you have no process to generate FTAs today, specifically warm leads, hiring a salesperson may not fix your problem. This doesn’t mean you shouldn’t hire a salesperson; you just need to be sure you have the right expectations and set the right priorities.

It would help if you decided on the qualifications of the salesperson, too. I like young salespeople who have had success in high-activity sales jobs. You need a high-revving motor in MSP sales! I want salespeople who have gone through activity reluctance. But I don’t want them to have so much experience that they can’t change if they’re too stuck in their ways to adapt to the sales process for MSPs.

Then, think about this: How would you train these salespeople? What activity metrics would you judge them on? What quota would you assign, and how would it ramp?

Salespeople, just like any technical role, need to be put in a position to be successful. This means defining the role and process, the key metrics, the accountability process, and putting people in a place to be successful.

The Best Time to Join an MSP Peer Group Was 10 Years Ago, But There’s Good News

To be honest, the best time to join an MSP peer group was 10 years ago, but here’s the good news — today is the second-best time to join a peer group!

There’s only so much you can do sitting in your office. If you want to increase your margins, generate monthly recurring revenue (MRR) at the right price, and grow your business, you need to join an industry peer group (such as TruPeer) to learn from like-minded individuals, especially if you’re stuck in your business (because if you don’t, you may never get unstuck).

Dan Tomaszewski, Executive Vice President of the Channel at Kaseya, and I, recently hosted a webinar about the importance of industry peer groups, and in addition to providing our thoughts, we spoke to several peer group members.

Here are some key takeaways from our discussion.

Industry peer groups provide more insight than local networking groups

While joining local networking groups can help you with acquiring new business, they usually don’t offer you the industry perspective you’re looking for when trying to transform your business. There usually isn’t anyone in your group you can compare yourself to or bounce ideas off, as everyone is in a different business. “TruPeer has really been a huge blessing and resource for me to be able to fill that gap,” said Jimmy Huber, President of InfoTech Solutions and Services, Inc. When you’re stuck in your business, you need guidance, and sometimes the best advice can come from your peers in the same business as you. But it’s not always easy to find someone who can help point you in the right direction, especially when you’re with a group of individuals who can’t assist from an industry standpoint.

Digging deep

Sometimes you need someone else to help you with digging deep. There are two parts to fulfilling potential. One is knowing what to do, and the second part is being able to do it. The latter is where peer groups come in handy. For example, only industry peers can deliver insight on what a good customer looks like and how much your customers should be paying you monthly. When assessing his customer base, Jesse Hill, President of Tier 3 I.T. Solutions, decided to raise his company’s monthly rate after attending a TruPeer event. “When you really sit down and look at it, every one of those low-paying clients is distracting you from doing a great job and delivering what other clients are paying for and expecting,” he said. Having people around you who know what to ask to find out what you’re doing wrong behind the scenes is critical.

Different stages of the business journey

Everyone in industry peer groups is at a different stage of the business journey, so someone in your peer group has probably faced many of the same challenges you’re confronted with today. “We all have the same problems,” said Danny Carlson, Executive Vice President of Platinum Systems. “We really do, so it’s really nice to be able to go and talk to somebody else. It’s good to have that support.” That someone, who is already ahead of you can usually identify your struggles and provide you with a roadmap to overcome them. In return, you provide industry veterans with a fresh perspective on the industry. “You can’t just move the boulder tomorrow,” Carlson said. “It’s all of these tiny little steps you have to make, and those start adding up to something.”

Joining an industry peer group can be life-changing for not only your business but also for you. Consider one of the peer groups offered by TruMethods to start your transformation.

Protect your Clients from Business Email Compromise Attacks

Business email compromise (BEC) attacks are some of the costliest cybercrimes companies face now. In BEC attacks, criminals impersonate a legitimate email account and use it to send messages that appear to come from a known source. For example, they may send an invoice with an updated mailing address, request that an employee with purchasing authority buy gift cards or transfer funds or ask clients to wire payments to a phony account.

These attacks can be challenging to detect and prevent because they appear to be from a trusted source and generally do not include malicious attachments. They rely on psychology to be effective – users will generally trust an email that looks like it came from a colleague or a vendor.

Stopping these types of attacks requires a high level of visibility into email traffic and the ability to respond rapidly to suspicious activity.

Why a Managed SOC Makes Sense

A 24/7 Security Operations Center (SOC) can play a crucial role in defending against these attacks, but most companies lack the staff, know-how and technology to create an effective SOC. Offering SOC as a service can help MSPs monitor and secure multiple client networks, in the cloud and on-premises from a central location, but SOCs are difficult to establish and expensive to operate.

A SOC is a 24/7 commitment, and given the shortage of cybersecurity professionals, even a large MSP would be hard pressed to establish these types of services from scratch. However, by partnering with a technology provider like Barracuda, MSPs can tap into a platform that provides automated monitoring across multiple clients and the ability to identify a wide variety of threats. For example, the Barracuda SKOUT Managed XDR solution includes wraparound SOC services without the headache and expense of cobbling together a DIY solution.

Barracuda acquired SKOUT cybersecurity in 2021, which added extended detection and response (XDR) capabilities to its product line, which it offers to MSPs as a managed solution. As a result, MSPs can access around-the-clock monitoring and response without the costs and headaches of setting up various security tools, threat intelligence and machine learning capabilities, and staffing and training security teams to stay ahead of ever-changing cyber landscape.

Barracuda SKOUT Managed XDR allows MSPs to offer wraparound SOC services to their clients. With a SOC, MSPs can help clients proactively detect malicious activity and adjust defenses in response to new threat alerts. The SOC can also identify vulnerabilities before an attack and conduct detailed analysis following a breach.

Leveraging a SOC also allows companies to benefit from software tools to help identify potential BEC attacks. For example, these solutions can automatically check inboxes for BEC keywords, deleted messages, and other tell-tale signs. They can also watch for new mailbox delegates or forwarding rules to external addresses, unusual geolocation data for logins, and other suspicious activities.

A well-run SOC partner will also stay up to date on new threats and utilize analysis tools to continuously improve the performance of the security infrastructure by analyzing daily usage data and information about previous attacks. This makes it easier to sort out suspicious email activity from normal communications.

Leveraging an outsourced SOC provides security benefits without requiring the client to dedicate IT resources to these daily security tasks. In addition, it helps the MSP provide 24/7 monitoring and response without bogging down their team with time-consuming mitigation and investigation tasks.

In the case of the Barracuda SKOUT Managed Email Protection offering, the SOC includes a team of security experts to detect and respond to email threats and a holistic global threat detection network consisting of a threat database and artificial intelligence-based software for analysis and resident security analysts and engineers. It also enables centralized security policy management and provides MSPs with a central dashboard for monitoring activity across the client base.

As the number of BEC and other phishing attacks increases, a managed SOC offering will help MSPs and their clients consistently identify and block these increasingly clever cybercriminals.

Adam Khan is Vice President, Global Security Operations for Barracuda.

Profit is a Decision

Let’s talk about profitability. For many MSP leaders, profitability is an elusive goal — and, sometimes, it’s not even a goal.

I meet MSPs every month that have been in business for several years and have never had annual profitability above 12 to 14 percent after a true owner salary. I always say that “you get what you tolerate.” If you’re happy with that kind of profitability, based on the risk and effort that you put into the business for a 12 percent return, it’s your choice.

Again, I want to be clear that it is a choice.

Profit is a decision. Dan Tomaszewski, Executive Vice President of Channel at Kaseya, and I interviewed several of our peer members on a webinar recently. We discussed this very topic, and one of our members quoted me when I said that you can make 70 percent gross margin decisions in your business, or you can make 40 percent gross margin decisions, but you can’t do both.

Here’s the first issue. If you don’t know your cost drivers, and you don’t know what 70 percent looks like, you can’t make profitable decisions. You’ve taken your choice away. In other words, profit is a choice if you understand it.

If you’re a business owner, your salary is what you earn for doing your job in the business. The profit you make after salary is your return on investment or return on effort, and there’s no reason why every MSP should not run at a true profit of more than 20 percent. It just means you either don’t know how to get there, or you’re unable to execute. Both are fixable.

Profit builds culture. It allows you to take better care of your team and your customers. Profit is a decision.

Are All Your Eggs in One MSP Basket?

Putting all your eggs in one basket is never a good strategy. It’s always best to diversify most aspects of your business, especially your customer base.

Most of us have been there before. We score a big customer and tout it as a big win, which is a significant milestone for your business. Landing a whale can completely change your business. But not always for the better.

How having a large customer can negatively impact your business.

For instance, having a customer who’s more than 5% to 8% of revenue is a significant risk for any MSP. Large customers usually are a more considerable percentage of tickets and overall costs than their percentage of revenue. This reduces the overall gross margin and diminishes resources for other customers to pay the right price. Even if the customer is profitable, when one customer uses too many of your team’s resources — it puts you in a difficult position.

Also, if you decide to sell your business down the road, a large customer in your portfolio will reduce your valuation significantly. A single customer keeping your business afloat is a risky investment for investors. What if the customer leaves after acquisition? This alone is a major concern for buyers, which is why they’re more likely to purchase businesses with diverse customer bases.

Want a pro tip? Diversify your customers, and you won’t have to worry about scrambling to replace revenue.

What should you do if you lose your biggest customer?

But what happens if you don’t heed my advice and end up losing your biggest customer? While you’re in a tough spot, you have options. Take out your profit and loss statement (P&L) and review all your costs. Some words of advice: It’s time to step up and be a leader. Please make the necessary decisions (no matter how hard they may be) to stay profitable. Then, double down on your go-to-market (GTM) strategy. The only way to reduce risk to your customer base after losing a large customer is to add new sweet spot customers until the overall percentage of revenue is reduced. Rethink your business. How do you plan on acquiring new business? Are you investing in social media marketing? Are you joining your local business networking group? Think about what you will do differently to make up for lost revenue and develop new business relationships. Pledge to never rely on a single customer for the bulk of your revenue again. I’ll say this: Your future self will appreciate what you did.

The best way to avoid putting your eggs in one basket is by reviewing your revenue regularly to assess where the bulk of your revenue comes from. If it’s all from one source, rethink your strategy and find where you can improve your revenue streams.

Gary Said What?

I remember when I first started training MSPs and speaking at MSP events, probably around 2008 or 2009. At that time, many IT providers were trying to change from an hourly business model to a recurring revenue model. I told people they had to get to $150 a seat. Many of them couldn’t believe their ears! “Gary said what?” “Is he crazy?” “We charge $100 a seat, and customers are already complaining.”

Over time, most of you figured out how to build a valuable offering that could command that price. At a recent peer meeting, people reacted similarly when I told them it was time to set $300 a seat as the new standard. I believe we all need to achieve this price or, more importantly, this value level for our customers in the next few years.

You have more tools, higher wages, and more security, process, and governance. All of these have dramatically impacted your cost.

A seat cost of $90 at a 70 percent gross margin is $300 a seat. That’s the math. You all have a seat cost today above $50 a seat — without backup, or a SOC or SIEM solution. Add some security process, and you’re knocking on the door for your cost of $90 a seat.

Listen, in the transition to $150 a seat, we saw MSPs who struggled to make the change start to leak margin and have their growth severely slowed. The difference was it happened more slowly the first time. Things are moving faster this time, so you must get your expectations set now and begin bulking up your value.

Generating MSP Leads: Building Your Presence in Your Community

Marketing is still one of the top challenges managed services providers (MSPs) face today. When you’re a one-person shop, marketing sometimes falls to the wayside, as there are typically urgent matters to tackle. But if you don’t have a presence in your community, someone will.

Remember: Your local community is where many of your prospects are. Doesn’t it make sense to rub elbows with them?

Here are a few ways to ensure you stay present and relevant in your community.

Contributing to Local Business Publications

Adding value is a sound strategy for acquiring new business. Local publications are always looking for engaging content. Why not offer to write a weekly or monthly column on trending topics in the IT space or some of the major IT issues businesses are facing today?

Now, I know what you’re thinking, “Gary, I don’t have enough time to run my day-to-day business operations. How will I ever find the time to sit down and write a regular column for a local business publication?” As the saying goes, if there’s a will, there’s a way.

Find someone who can help you streamline the writing process. For instance, is there anyone you know with a background in journalism or creative writing who can take an outline and turn it into a story?

You’re an expert in your field. You have ideas to share. You must figure out the best way to take those ideas and put them on paper.

Getting Involved With Local Business Leaders and Your Community

Learn to enjoy networking. You’re a local business. Many of your customers and prospects are in your local community. Get out of your seat and become involved with what’s happening around you.

For instance, join a networking group (e.g., Business Network International (BNI)) to help you acquire new leads. Here’s the thing. You can’t acquire all new business from behind your computer. Seek opportunities to connect with the business leaders in your community. You must go out and network with them; they have networks you can access if you’re willing to put in the time and effort.

But remember this: Avoid looking at everything as a transaction. Sometimes you may add value to someone’s business without receiving anything in return — and that’s okay. Focus on building long-term business relationships with the leaders in your community if you want results.

Is Your Digital Presence Current?

Is your website up to date? Do you update your social media accounts? Have you hired someone for SEO? Where can prospects find you? If you don’t have a digital presence, prospects won’t be able to hire you — it’s that simple.

Allocating revenue for marketing can help you generate leads and ensure your business is top of mind whenever any business in your community thinks about IT. That won’t happen if your competitors are doing a better job marketing themselves than you.

Staying involved in your community takes a lot of hard work. But if you put in the time and effort to build relationships and add value, you’ll be well on your way to not only growing your presence in your community but also generating more leads.

Mapping Your APIs Could Reduce Your Attack Surface

In a previous blog post, I talked about how MSPs today have many more tools and technology than ever before. Most of these tools provide integrations to other tools. Of course, this is done through APIs. While integration can help efficiency and make a technician’s job easier, it can also create additional security risks.

Security vulnerabilities in one product can migrate to other products via API access. On The Weekly CyberCall a few months ago, Ryan Weeks, Datto’s CISO, discussed these risks. He suggested that MSPs begin to map their APIs. (I had a few customers tell me that they did this for a few products and the result looked like a spiderweb!)

You may find that when products are set up, their default is to use all the available APIs. I suggest you begin mapping your APIs, review each, and turn off any that are not needed. Think about it this way: If you eliminate 20 percent of APIs, you reduce your attack surface by 20 percent.

Look, this process takes time, and time is money. It seems that we’re always talking about something else that you need to do that you didn’t have to do a few years ago. All of this has increased your cost, and not doing more increases your risk — that has a cost as well.

You need to have a process for all of these non-automated tasks. Tony Williams, our Operations Coach, calls this “having a process for process.” Then, you must assign everything to a role and be sure that this role is accounted for in your seat costs.

Tools, Tools, Tools: How MSPs Can Learn to Love Them

Every MSP has more tools and technology than it did a few years ago. Think about it: The average number of tools in your stack has probably increased dramatically. But tool costs have gone from 10 percent to 20 percent to 30 percent of your seat cost! So, it’s something MSPs should pay attention to.

Now, the rise in tool costs is not necessarily a bad thing. With tools, we offer more value to customers, making them more secure, and, hopefully, making ourselves and our customers more productive. With that, there are a few things to consider.

Understanding costs. You must understand the total cost of a tool. First, be sure to convert the cost from whatever unit of measure you are billed to an average cost per seat. For example, if you have 20 tools with 10 different units of billing from vendors, then it’s like adding fractions with different denominators. For those of you who aren’t good with fractions, it doesn’t work! It would be best if you converted everything to a common denominator. For us, that is a ‘seat’.

Labor costs. Be sure you understand the labor cost of adding a new tool. This includes managing the tool, training people, upgrades, and any tickets from using the tool.

Utilization. How many of the tool’s capabilities are you using? Most tools only have 10 percent to 20 percent of their features utilized.

Instrumentation. Do you have reporting metrics to determine if the tool accomplishes its intended result?

Accountability. Is someone accountable for the result of each tool? Hint: If you say everyone, that means no one is accountable.

This quarter, our peer groups are doing a packaging and pricing gut check, and, as part of that, a deep dive into their tool stacks. I suggest you do the same.