Stop selling cybersecurity

I know what some of you thought when you read that title.

“Has Trevor lost his mind? Stop selling cybersecurity? We need to sell more of it.” Fair.

I mean, doesn’t this come from the same guy people call The Cyber Cowboy? The guy who talks about layered security and making sure you’re ready for when everything goes wrong? Yep. That guy.

And before one of my vendors calls to ask if I’ve completely gone off the rails, let me explain. I’m not telling MSPs to stop selling cybersecurity. I’m telling us to stop just selling cybersecurity. There’s a big difference.

We’ve gotten good at selling the stack: EDR, MDR, SIEM, SOC, MFA and BCDR. We can sit across the table from a business owner and throw around enough acronyms to make them regret agreeing to have lunch with us. I know because I’ve done it. Then we install everything, send the invoice and move on.

But somewhere along the way, I think our industry started confusing selling cybersecurity with creating a secure customer. Those are not the same thing.

Behind every firewall, email filter, MFA prompt and security policy is still a human being sitting behind a screen. Sooner or later, that human being must make a decision. Click or don’t click, approve or deny, trust or verify.

That’s where cybersecurity stops being something we sell and becomes something we have to teach.

We keep buying better locks

Sometimes I think cybersecurity is a little like protecting a house. We keep buying better locks. Then an alarm and then cameras. Meanwhile, nobody explained what to do when a guy wearing a utility-company shirt knocks on the door and says there’s an emergency. Eventually someone opens it, not because they’re stupid but because they’re human.

People respond to urgency. They want to help and trust people who sound like they know what they’re doing and attackers know that.

You can patch software and operating system but you cannot patch a human on Tuesday night during your maintenance window. You have to teach them.

Our clients don’t speak MSP

Technical people forget how weird our world sounds to everybody else. A dentist doesn’t need to understand token theft and a receptionist shouldn’t need to explain conditional access. That’s why they hired us. But clients do need to know what danger looks like from their side of the screen.

They need to know why an MFA prompt they didn’t initiate matters. They need to know that someone saying, “Hey, this is IT and I need to remote into your computer,” deserves a second question.

Most importantly, they need to know what to do when something feels off. I would rather a client call us ten times about something harmless than call us once after they wired $80,000 to someone in another country.

Awareness training isn’t education

Somebody is probably saying, “Trevor, that’s why we have security awareness training.” I agree and we use it, sell it and I believe in it. But MSPs sometimes hide behind it.

• Employees watched the video. Check.
• Phishing test sent. Check.
• Pretty QBR report. Check.

That is training and I’m not convinced it is always education. Education happens when people understand why: Why are we requiring MFA, why are we taking away local admin and why should you question someone claiming to be your IT provider?

If all we ever tell users is “because IT said so,” don’t be surprised when they find ways around us.

Maybe we need to teach more and sell less

That probably sounds strange coming from an MSP owner because sales matter and believe me, I know. Payroll still shows up every two weeks, licensing isn’t getting cheaper and engineers aren’t free. And I’m pretty sure Microsoft wakes up occasionally just to see if there’s another way to license something.

We have to sell, but I don’t want every conversation with a customer to be about the next thing we can sell them. Eventually that makes us a vendor.

I want us to be the people a client calls before they make the mistake. The most valuable fifteen minutes in a quarterly meeting is explaining the scam we’ve seen three times this month or talking with accounting about wire fraud. It’s telling employees, “If something feels wrong, stop and call us. You are not a bother.”

None of that creates another line item on the invoice, but it might prevent an incident.

Stop calling the user the problem

Our industry has never exactly been gentle with end users. We’ve all made the jokes.

“Problem exists between keyboard and chair.”

“Layer 8 issue.”

I’ve probably said worse, but the longer I do this, the less comfortable I am with calling users the weakest link and acting like that ends the conversation. If they are the weakest link, what did we do to strengthen them?

Did we teach them or explain the threat in plain language? Did we make it acceptable for them to slow something down and question it or did we install security software, assign a phishing video and assume our part was finished?

Where I’ve landed

October is Cybersecurity Awareness Month and expect to see a million articles about passwords, phishing, MFA, AI and whatever threat is terrifying everybody this week. Most of them will probably be right, but I think MSPs need a little cybersecurity awareness of our own. We are not just here to sell security, we are supposed to teach it.

Sooner or later, every firewall, filter, EDR platform and security policy ends with a person looking at a screen and making a decision: click or don’t click, approve or deny, trust or verify, speak up or stay quiet. Technology can make that decision safer but it cannot make every decision for them.

My grandfather used to tell me a man is only as good as his word. If we’re going to tell a customer we are their trusted advisor and that we’re protecting their business, then our responsibility cannot end when the software gets installed and the invoice gets paid.

Teach the owner, accounting, the receptionist and the employee who started Tuesday, then teach them again. Sometimes the most important cybersecurity tool we can give a customer isn’t another product. It’s knowing what to do before they click.

Related: 5 cybersecurity myths MSPs hear from clients