Here are six psychological weapons of influence that you can apply to your MSP’s marketing to win more clients. Also this week, three hot marketing ideas around Copilot, and the surprising secret for talking to clients about cyber security.
Welcome to Episode 348 of the MSP Marketing Podcast with me, Paul Green, powered by the MSP Marketing Edge.
A deep dive into the psychology that drives prospects
One of my all-time favourite books is called Influence by Dr. Robert Cialdini. And today I want to walk you through his six psychological weapons of persuasion and show you exactly how they apply to winning clients for your MSP.
Now, this book which I’ve owned for about 20 years, in fact, if you’re watching on YouTube, the copy I’ve literally got in my hands now, I’ve had for a round of 20 years or so, it was actually first published in 1984. Of course, it’s been updated since, but it is still, in my opinion, the definitive work on why people say yes.
Dr. Robert Cialdini is a psychology professor, but he specialises in marketing. He’s still active now, I don’t know if he teaches still, I think he’s in his 70s, but he’s in New York, I believe.
He’s identified six psychological weapons of influence, and we can apply every single one of them to your MSP.
So let me take you through them and give you an example of how each one can help make your marketing so much easier and more effective.
The first is something called reciprocity. People feel compelled to give something back when they’ve received something completely free or something of high value at very, very low cost. So for example, I give away a free MSP marketing wall planner, and I do that partly because I want to educate thousands of MSPs around the world how to have better marketing. But also I know that in giving someone a physical free wall planner that I’ve had printed at my cost, that I’ve mailed out to them at my cost, there’s a certain level of reciprocity in that. And many, not all, but many of the people who get one of those wall planners will come back and buy something from me at some point in the future.
And by the way, if you don’t have one of those wall planners yet, I’ll tell you in just a few minutes how you can get one completely free. And there is no obligation to buy anything if there’s a psychological obligation that’s set up in your brain and that’s just good marketing from Dr. Robert Cialdini. But you can do this as well so you can give away free guides, you can give away other kind of lead magnets, scorecards are working really well right now as a lead magnet, and there’s still some reciprocity from that. You could do a really in-depth LinkedIn post, you could do a major in-depth guide on cyber security or something else on your websites. All of this is reciprocity in action.
What you’ve just got to remember is that when you give genuine value first, then the prospects feel a pull towards you before you’ve ever asked them for anything, ever asked them to buy anything from you. So practical question on this, what are you giving away that’s actually useful? So things like a buyer’s guide or a sales brochure, those kind of things are okay, but the more value you can give in your freebie, in the things you give away, the better.
And just a reminder, by the way, if you’re a member of the MSP Marketing Edge, we have a book called Email Hijack. That’s available to our B2B members. You can get it in the portal right now. It’s in the tool section and it’s kind of like a book, a fictional book about an email compromise attack. So you can very quickly update that with all of your details, put that on your website for free. People just enter their email address and you email them or physically post them, mail them, ship them a copy of email hijack. But that is a great example of a high value giveaway that you haven’t really asked much for. You’ve asked for their email address and their physical address, that’s it. It’s going to help you to build a relationship with prospects before they’re ready to pick a new MSP.
So Dr. Ciardini’s second weapon of influence is commitment and consistency. Once people take a small step, they want to stay consistent with that decision. So getting someone to download something or attend a webinar or even just reply to an email that you’ve sent to them, every small yes makes the next yes easier. And this is why nurturing is so important. You may have heard me talk on this podcast before about the fact we are not hunting. Hunting is one-off activity where you go out, see an opportunity, and you kill the clients, you kill the prospects, you hunt them and you bring them in. I’m much more interested in farming.
Farming is where you are growing something. You are very slowly working hundreds and hundreds of seeds at the same time to grow them. And some of them will turn into big trees that you can harvest into clients. Essentially, you’re building a trail of small commitments that leads you to a meeting. So from a practical point of view, what’s the smallest possible yes that you can ask a cold prospect for? And actually the easiest is hit reply to an email. “Hit reply to this and tell me what you think about this” or asking them to comment on a LinkedIn post or something like that, or even just getting a hold of them on the phone just to find out a little bit about their business. All of these little things, they help to build a relationship with them and at the point they’re ready to switch MSPs, they’re going to want to be consistent and continue that conversation with you.
Number three is social proof. You’ve heard of this before, right? People look to other people like them to decide what the correct course of action is, especially when they’re uncertain about what to do. So for ordinary business owners choosing an MSP, they are very, very uncertain because they don’t understand the technical stuff. That’s kind of easy to understand if you are targeting business owners. Now, if you’re targeting IT directors for co-managed contracts, obviously they do understand the technical stuff, but they are operating from a position of greater fear.
Business owners are scared of making the wrong choice, picking the wrong MSP because it will cost them time and money. IT directors are typically employees. If they get the wrong choice, if they pick the wrong MSP, it could cost them their job, their career. That’s actually a bigger perceived risk for them than it is the business owner. The business owner loses money and time. It’s annoying, but it’s not the end of the world. The IT director could lose their job and their career. That is the end of the world. So even though both of these people are completely different, they want to know that other people like them have trusted you already because that makes you perceived to be safer.
So we know that social proof is made up of three primary tools. You’ve got testimonials, reviews, and case studies. So a testimonial is where someone gives you a review of the business, but they give it to you, you’re in charge of it, you can edit it. And a testimonial’s okay, but it’s not as good as a review. A review is a testimonial that goes on a third-party platform. So people will look at it and know that you haven’t edited it. It’s very, very powerful.
My recommendation is always that you pursue reviews on third-party platforms and then you copy those reviews into your website and other marketing and you just say where you got it from. So for example, get Google reviews and then take the very best of those Google reviews and copy them, either screenshot them or recreate them into your website. So you’ve got testimonials and reviews, and then the third form you’ve got is case studies.
A case study is telling a story. It’s essentially the same as a review of a testimonial, but it’s a structured case study and you see someone’s journey from the problem they had to the solution that you put in place to the outcome, which is of course always a much better outcome because they’re working with you. Now, specific and named social proof is always, always better than generic social proof. So “Jane at XYZ Accountant saved three hours this week”, is always going to be better and more powerful and more persuasive than someone just saying, “Great service would recommend”.
And I know that MSPs hate putting people’s photos and their names and their job titles and the name of the business. I know you hate that because there are security concerns and I understand that, but the reality is if you have a good system in place for your client to make sure that it is you and your technicians calling them the persuasive power of publishing the name of your client and their photo, which is best practice, it far outweighs the security risk of you doing this thing.
So a practical action on this. When did you last proactively ask a happy client for a review or a testimonial? The answer to this of course is you systemise it. So you either have something built into your PSA. You know when you close a big ticket and it sends out the little faces thing, it says, “Are you happy?” And they can tap the happy face or the sad face or the one in between. If they tap the happy face, that should take them to a page asking them to leave a review. If they haven’t done so already, you have to set up basic rules for this kind of thing. That’s one good system. Another good system is just to ask everyone after their first 90 days with you or when you’ve completed a project for them. Both of those are great times to ask for reviews. And you should also explain why you want reviews.
Another little thing that Cialdini has put in one of his books I’ve read somewhere is that when you give someone a reason why you’re asking for something, even if the reason doesn’t make sense, they’re much more likely to go along with it. The example he gave was, and this shows how old this was because it’s about photocopying, but when there was a queue of people for a photocopier, if you said to someone, “Hey, can I just cut in the queue?” Nine times out of 10 they said no. Whereas if you said to someone, “Hey, can I cut into the queue because I need to do some photocopying?” Even though that reason doesn’t make sense, everyone’s there because they need to do some photocopying, the person was much more likely to let them into the queue. It’s curious, isn’t it? So when you’re asking people for a review, you just say to them, “Would you mind helping me out by giving us a review please, because we’re trying to attract more clients like you.” Simple as that.
Okay, next weapon of persuasion from Dr. Robert Cialdini is authority. Now, people follow credible experts. They want to be led by someone who they perceive knows more than they do. And this is exactly why, for example, why I do this podcast, it’s exactly why I do a LinkedIn newsletter every week, and why I do things like a wall planner, why I’ve written my book MSP Marketing Start Here, which you can get on Amazon and Audible and Kindle.
Now I’ve done all of these things to help demonstrate my perceived authority. You can do the same thing as well. You can write a book. In fact, that book Email Hijack I was talking about earlier for our MSP Marketing Edge B2B members, that’s a really great example of this. You can publish guides, you can write a LinkedIn newsletter, you can talk, go and speak at local events or events within your niche or your vertical. The MSP who publishes useful content and speaks at events and puts on webinars is automatically perceived as more authoritative than the MSP who doesn’t. And trust me, the vast majority of your competitors are not doing this.
So what are some of the other authority signals that you can put out there? Well, things like good credentials, accreditations being mentioned in the media, as I’ve already said, speaking at events. All of these are authority signals. So a practical suggestion for you, where on your website and where on your LinkedIn does your authority come through? Can I go on your website and your LinkedIn right now and see you speaking at events, see the guides and books and things that you’ve published, or join your webinar? Because as I said, your competitors are not doing this. This is a big opportunity for you.
Then we’ve got weapon number five, which is liking. People buy from people that they like. It really is as simple as that. And likability comes from how similar you are to the person you are talking to, how familiar they are with you, and this is why building a relationship with someone is always a good idea before you ask them to choose your MSP. And it also comes from genuine warmth as well. The more your real genuine personality comes through in your marketing, the more people will feel like they know you.
Please don’t ever try to be someone else. You might watch me on YouTube or listen to me on this podcast and think, “Well, that Paul seems all right.” I hope you think that, and maybe you’d think, “I’ll try and be like Paul.” But I’m just being me, right? It’s taken me many years to get to the point where I’m comfortable being me. And I know that some people don’t like me. They don’t like the way I present, the way I talk, the ideas I’ve got. And do you know what? I’m okay with that because actually it’s better to be yourself, be authentic and have some people, a very small proportion of people that don’t like you, whereas most people will like you because they’ve got something to hook onto. They can be attracted to your genuine authentic personality. It’s really important that people feel like they know the real you.
And they might not spot you being inauthentic or unauthentic, but they will feel it. We have all sorts of incredible gut reactions and gut feelings inside ourselves, and they warn us when something doesn’t feel quite right. And you trying not to be you is going to trigger that in someone else. So just be you. Be the authentic you. And I promise you these days where anybody and everybody does content and video, being yourself is the best thing you can do. So a practical thing then, does your marketing sound like it’s coming from a person or does it sound like it’s coming from a corporation, from a business? The more authentic and real and human your marketing is, the easier you’re making it for people to like you. And it is so important.
And then the final weapon. The final weapon from Dr. Cialdini is scarcity. People want what they might not be able to have. And real scarcity is much more powerful than manufactured scarcity. Prospects really can smell the difference. I’ll give you an example. Our MSP Marketing Edge membership, we genuinely only work with one MSP per area. Well, it’s one per membership. So we’ve got one B2B member and one co-managed member. And it’s genuine so that no one’s using the same marketing in the same marketplace. And we actually have more people, this is true. We have more MSPs on our waiting list than we actually do as active members. So it’s genuine scarcity because it helps keep our quality high and it keeps everything working for me and for our members.
Now for your MSP, you can’t use anything like scarcity of software, scarcity of tools because we all know that software is endless. it’s limitless, it never really runs out. So your scarcity is your time and your attention. For example, onboarding. Now genuinely, you can probably only onboard one client per month, right? Or maybe two at a push because I know how onboarding takes so much work from you and all of your team. So actually you can use that. If you’re having two or three sales conversations, you can say, “Hey guys, look, as you’re making this decision about which MSP you’re going to go to, and obviously we hope you choose us, just be aware that for quality reasons and for workload reasons, we only onboard one client a month. We already have someone right now for this month. Next month we currently have free and the month after, but I am about to pencil someone in for next month. So do you want me to pencil you in for that or did you want to go for the month after?” And that’s genuine scarcity, right? Because you are then just onboarding one client a month. And I know that actually for most MSPs, just winning one new client a month would be chef’s kiss, beautiful.
So positioning yourself as selective rather than desperate is one of the most powerful things you can do. So just to tie that one up with a practical suggestion, again, do your prospects know that you’re not available to everyone, that actually you won’t work with everyone. You have a very, very clear idea of an ideal client. What’s a good fit for you and for them. Are you telling prospects about that? Are you telling them that you have a scarce amount of onboarding? These are smart things to work in. They’re not the only reasons they would choose you, but they’re a persuasive tool and they will help them to make the decision. Nothing’s worse than a prospect, just not making a decision, never getting back to you. You want them to be yes or no, black or white. Which is it going to be? And that’s one of the weapons you can use to help make that happen.
Look, Cialdini’s point in his book is that these aren’t tricks. These are how human decision-making actually works already. We are built this way, we are wired this way, and we’ve been like that for thousands of years. When prospects are thinking of working with you or not, they’re not making rational decisions. They’re making emotional decisions and then they’re justifying them afterwards using their brain. They’re justifying them in a rational manner. The MSPs who understand this, do marketing that is completely different and superior to those who don’t understand this. So if you haven’t read it yet, please go read Influence by Dr. Robert Cialdini. It’s on Audible if you want to listen to it. 80% of it is great. 20% of it is a bit of a slog to get through, but you can just skip over those bits. But I promise you it will change how you see every piece of marketing that you produce. You’ll never be able to look at a prospect conversation the same way again.
Three hot marketing ideas around Copilot
Copilot is one of the biggest commercial opportunities sitting in front of your MSP right now, but you might not yet be using it as a marketing tool. So let’s fix that with three specific ideas that you can act on straight away.
And the first idea is a Shadow AI webinar. Now, most business owners already know that their staff are using AI. They just don’t know who’s doing that and which AI tools they’re using. So Sandra in accounts might be using ChatGPT. Dave in Sales might be on Gemini. Someone else might be using Claude and all of them of course are using personal accounts.
And I think business owners are starting to wake up to the fact that this is a risk because where’s all the data going? If they’re taking our business data and putting that into their own personal AI, what are we liable for? How do we protect our data? What happens if Dave in sales leaves and he’s got like 50, 100, 200 leads worth of data in his Claude? How do I even know he’s got that data there, let alone actually stop him from taking that data away from the business?
This is a perfect webinar topic because it’s the kind of thing that business owners are already thinking about right now.
The best webinars, the best events, the best content in marketing is about things that people are already thinking about. So here’s a suggested topic. Is AI being used in your business without your knowledge? And what’s the risk? And we can be pretty certain that someone somewhere in the business is using AI either on their laptop or on their phone.
So this is not intended as a Copilot sales pitch. It’s a genuine educational event all about shadow AI. You’ll need to explain that term to them because they won’t understand it. And it’s also about data governance as well. And as you talk about these problems, it will become clear when you talk about the capabilities of Copilot that is the natural solution because of course data can be controlled, you can set up guardrails, it’s secure, it’s the Microsoft approved answer. And if they’re already in the Microsoft ecosystem, it’s a lot easier for them to roll that out to their business.
And people who attend this webinar are going to be warm. They’re going to be people who’ve turned up because the problem for them is real. They’ve either actually got the problem and they’ve noticed it, or they’re fearful that they’ve got that problem and they want to head it off before it becomes something that does damage to the business. So you will get a bunch of people registering for the webinar, a proportion of those, let’s say a third of those will actually turn up to the webinar. That’s fine, that’s normal. You send out the recording to the other two-thirds and you follow up everyone within 24 hours and you do this every single time. This is really important on a webinar.
The first people you follow up are the ones who attended and you’ve called them asking for a bit of feedback. You’re not really interested in their feedback, but it’s a way of starting the conversation.
You’re like, “Oh, hi, John. I know you were on my webinar yesterday. I’m just curious, what was the most useful thing you found from it? ” So you get them talking about the subject and that leads naturally into a conversation about, “So tell me what the situation is in your business right now.” And you as someone who does sales all the time, you may or may not be a trained salesperson, but as the owner, as someone who does this a lot, you will very easily turn that into a conversation about their business, what else they’re doing right now. Is it worth the two of you meeting? Could be just for a coffee catch-up or it could be for a formal meeting to discuss their technology and their business. That’s a really powerful thing.
So follow up the people who attended first and then follow up those who didn’t attend. You might choose to track who’s opened the email and watched the video, there’s various tools to do that. But again, that would prioritise them for you. Call the people who’ve attended first, then call the people who didn’t attend but open the video, then call the people who registered but didn’t attend and didn’t open the video. You’re much more likely to get hold of the people at the beginning and it will tail off as you get towards the end.
Idea number two is a Copilot ROI conversation, return on investment conversation with your existing clients. So you may know this already, that your existing clients are your easiest wins for any kind of new thing that you introduce because they already trust you and you know everything about them. Now, most small businesses are still at the experimentation stage with AI. They’ve probably dabbled. Maybe the business owner has got Claude or ChatGPT. Maybe they’re still on the free level. And we all know that people who use the paid tool learn dramatically faster than those that kind of get stuck on the free level. But maybe the business owners that you’re talking to that you’re looking after, maybe they haven’t yet committed.
So the conversation to have with them is that you’ve been looking at what Copilot is actually doing for businesses like theirs. And you’ve been looking at the savings, you’ve been looking at the productivity increases and talk to them about real things like hours saved or data protected or systems automated. You can take a real life example that they’re doing in their business. Or if you don’t know, say to them, “Tell me something that you’re doing within your business that you are pretty convinced you could make more efficient, you just don’t know how to do that.” And it’s bound to be some manual process where someone’s copying data into this spreadsheet and then over to this database and checking this and doing that. And you can tell them how Microsoft’s own data shows these real productivity gains. You can actually use that in your client conversations.
One thing that I think works really well is to frame this around a specific role in their business. So you could say, for example, “Your finance team could save X hours a month on report drafting” or something like this. Take a real life thing where you can spot manual processes or where there’s just excessive amounts of admin and talk to them about how together you could explore using Copilot to do that in a way which is safe and productive and they stay in control. This is an upsell conversation that’s dressed up as a helpful conversation and it is genuinely helpful.
And even clients who don’t immediately buy Copilot consulting from you or some level of engagement, they become warmer and warmer and warmer because you’re their supplier, their partner who is thinking ahead for them. This of course also generates referrals because happy clients talk to other business owners about the conversation that they’ve had, whether or not they’ve bought the thing that you have talked to them about.
Idea number three is LinkedIn content, positioning you as the local Copilot expert. As we are right now at this moment in 2026, very few MSPs in any given area are posting regularly about Copilot in plain English. So business owners are seeing news about AI everywhere, but really no one’s translating it for them into business owner speak. So that’s the opportunity for you. You can become the go-to voice in your area for “What does this AI stuff actually mean for my business?”. So post regularly about specific Copilot use cases, but don’t talk about features, talk about benefits. Talk about real scenarios. Here’s how a 20-person accountancy firm used Copilot to cut their month-end reporting from two days to half a day.
Whatever you do, don’t go anywhere near here’s how a business lost people or managed to reduce payroll or managed to reduce headcount. If the business owners choose to do that, that’s fine. But a lot of people are scared that that’s what AI is all about, about reducing people. Whereas you and I know that actually it just makes your existing people more productive so they can get more done. They can do more stuff. So yeah, sure, maybe you don’t need to hire more staff because your existing staff can cope with more business. That’s not a bad thing because no one lost out on a job there.
Use short, specific, jargon-free content. Write it for someone who doesn’t understand AI, someone who doesn’t understand IT or technology. And if you do this often enough, like once or twice a week at minimum, then over time this is going to build authority and probably even some inbound interest as well because people will come to you rather than you having to chase them. But it does also give you a reason to reach out to your cold connections. You could say just in a DM on LinkedIn or in a phone call, you can say, “I’ve been posting about Copilot quite a lot recently and there’s one here that’s about CPAs, about accountants. I know you’re a CPA, I though this might be relevant to you.” That kind of cold outreach via DM or even a phone call, that can be really good because you’re showing that you’ve got something that could be and should be relevant to them.
The way that I see this is that Copilot isn’t just a product that you sell. Right now it’s a huge conversation starter. It’s a credibility builder and it’s a reason for you to get in front of prospects who are already worried about AI, but they don’t know yet who to trust. The MSP who shows up first talks in plain English and is genuinely helpful, wins that relationship.
Members’ Update
If you’re an MSP Marketing Edge member, here’s something inside our member portal that’s worth your time right now. It’s the Standout MSP Website Framework, because your website is either working for you or it’s working against you and most MSPs don’t know which. So the framework walks you through exactly what your website needs to do and say to turn visitors into inquiries. It covers how to make it immediately obvious who you help and what you do for them, how to build trust before a prospect has spoken to you, how to answer the pricing question without committing to an actually very specific number, and what your call to action needs to be to get people to actually take the next step.
This framework is built around how real business owners read and decide, it’s not built around how MSPs think they read and decide. So if your website currently looks okay, it looks fine, but it’s just not generating leads, I bet you I have the answer to why this is the case. So please log in to the portal, you can find it in the training section. It’s in both portals, the B2B one and the co-managed one.
And if you are not yet a member of the MSP Marketing Edge, there are two memberships available in each area. We’ve got B2B that’s designed to help you win more business owner clients. And then we’ve got co-managed, which is designed to help you win IT director contracts, one MSP per area for each of these. Now you can check if yours is available without having to put in your contact details. You just put your postal code or your zip code at mspmarketingedge.com/membership.
The surprising secret for talking to clients about cyber security
Featured guest: Craig Taylor is a Certified Information Systems Security Professional (CISSP) since 2001, and a 30-year veteran of Cyber security. In 2014 he co-founded a cyber security training company – CyberHoot – to help businesses of all sizes and industries learn cyber literacy.
During his career, Craig has led cyber security organisations ranging from Fortune 50 companies (JPMorgan Chase, Vistaprint) to MSPs serving dozens of individual clients.
Craig is a Rotarian (Portsmouth, NH) and a sports enthusiast. He enjoys fundraising for cancer research, having raised $150,000 by riding in the Pan Mass Challenge for the past 12 years.
So you and I know that cyber security is one of the most important conversations that you can have with a business owner. But the business owners themselves, well, sometimes they glaze over a bit, don’t they? I’ve got a special guest today who’s about to reveal the surprising secret for how to talk to clients about cyber security in a way that always interests them.
Hi, I’m Craig Taylor, CEO and co-founder of CyberHoot. We teach cyber literacy to the world.
And what a mission that is for you, Craig. Thank you so much for joining me on the podcast today. We’re going to talk about how to have those important cyber security conversations with your clients without having to delve into fear, uncertainty, and doubt. FUD. Everyone has heard of FUD and for many years that was the standard way of having the conversation about cyber security. But things have moved on, cyber security itself has moved on, the conversations need to move on and you are obviously an expert at doing this. So that’s what we’re going to delve into today. Just first of all, tell us a bit about you. So how do you get to the point of educating the world about cyber security?
That’s a great question. So if I go back in time, I have a degree in psychology and I knew right away I wasn’t going to do a PhD, so I decided I have to get a job doing something else. And I fell into cyber security. For 30 years I’ve been doing cyber security, had my CISSP in 2001. So lots of experience trying to build resilient cyber security programs for businesses from Fortune 500 – JP Morgan, Chase, Vistaprint – down to the MSPs of the world where I’ve spent many years working with MSPs. And what I’ve found on the market was really disappointing. It was fear and uncertainty and doubt, shameful. You clicked on a phishing link, now you’re punished. That does not change behaviours.
And a light dawned on me about six years ago within CyberHoot’s 10-year journey. I remembered my operant conditioning psychology degree, which says essentially for 75 years, punished behaviours are never extinguished. They don’t stop. It’s an external focus or locus of control, but rewarded behaviours are repeated. That’s been proven as well. BF Skinner did and lots of studies since then. So we pivoted at CyberHoot, we said, stop punishing and shaming people with fake email messages to the inbox. Those messages where your IT team sends it to you or your MSP and you click and, oh no, that was a test. I failed it. Now I’ve got to watch this video, I’m not in a good mood to watch, I don’t want to learn.
There was a study recently at BlackHat last year that said people spent 10 seconds watching those videos and then they walked away because they just aren’t in a frame of mind, and it doesn’t change behaviour. So we changed to a in-browser exercise where you choose safe or unsafe indicators throughout an email, six or seven different questions, the sending domain. And the beauty of doing it in a simulation in the browser is we can emulate real hacker domains. So we can change an M in Microsoft or Amazon to an R and an N, similar to what a hacker might do for a few days before the domain is taken down. So our testing is much more well received.
As an MSP, I think the listeners of this know your lifeblood is the value you add to your customer relationships. If you’re sending fake messages to the inbox and tricking your clients and their employees, you’re eroding your lifeline. You’re sawing the branch you sit on off the tree. What you need to do is reinforce good behaviours, reward and gamify that experience so that people want to participate. And that’s really what we’ve been able to accomplish in our exercises.
We have leaderboards that suddenly we introduced leaderboards a month ago, no, maybe about four months ago. And Paul, we started to see senior leaders at the companies we train starting their assignments for the first time. The only thing we could think of is that they saw their leaderboard status on this anonymous leaderboard. We’re in a company of a hundred and I am 95th in the list as a leader. I can’t do that, I can’t be 95th, I have to be first at everything. And so they started doing the training.
Gamification makes it fun. It makes it like play instead of work. People get engaged and they compete with one another.
We get support tickets like, why is my colleague ahead of me when we’ve done the exact same things? And so people are having fun learning cyber literacy and the behaviours are sticking. That’s the big thing. The outcome that we just always sought after and wanted was people to look at an email and go, huh, I remember my HootPhish training. The sender looks, oh my gosh, there’s a period in the wrong place. I’m not going to click. I’m going to report it.
Yeah, I love that. And do you know what? As you were describing these psychological concepts, that makes perfect sense. I have a 15-year-old daughter who right now as I’m recording this, she’s about to do her big exams here in the UK, which kids do two years before high school ends in the US. But in the UK, they’re called GCSEs. And any UK MSPs listening to this or watching this on YouTube will know that you have a month of hell where you’re trying to drag your 15, 16-year-old kicking and screaming through the most important exams of their life that literally dictate their entire future. But they’re not yet quite mature enough to get that because it makes a lot more sense to do with 18.
Anyway, so I figured out a long time ago that that whole the stick doesn’t work. The carrot absolutely works. And we all know this inherently. And yet it’s weird, isn’t it, that we’ve developed all these, and I say we as a channel, have developed all these cyber security programs that are, stick, stick, stick. You’ve done the wrong thing. I’m going to hit you, hit you, hit you. And maybe it’s because exactly as you said, and I can’t remember the psychology words you used, was it locus of control? Is that it? Internal versus external. So as the leader of a big business or a big whatever, if I’ve got 500 people that work for me, it’s easier for me to hit the 200 people that do something wrong because I can figure that out more easily than constantly rewarding the people that get this right. Is that correct?
It is and it isn’t, right? Because you want engagement and engagement only occurs when you reward good behaviours, when you have positive reinforcement. Think about dog training. You can train with a shock collar or treats. And what does the dog prefer? Treats. What does the owner prefer? Treats. We don’t like to press the button and shock our dogs. But the best analogy I’ve thought of is back to the children. My three-year-old daughter was walking towards the road one day in our backyard and I didn’t notice at first. And I heard a car coming and I saw she was close to the road and I screamed as loud as I could. And she froze instantly, sat down and began to cry, which was the exact effect I wanted. But that’s what our fake email phishing testing is doing. It’s freezing people in the moment from clicking, but not teaching them why.
I had to work with that daughter for the next five years to say, “Look at the cars going by. It’s really dangerous if you were to walk out on that roadway without knowing that you look both ways.” And teaching them the positive behaviours to exhibit before they could go out on their bike and those sorts of things. That’s what we’ve forgotten to do with our employees. In the moment, clicking on a fake email can lead to drastic consequences… ransomware. Is this email compromised? And down the road, wire fraud, all hundreds of thousands of dollars in damages. So the thought is stop them in the moment, but that doesn’t work long-term. You have to educate them on why and how it works.
With the HootPhish exercise we do, I like to say we teach people how to phish, feeding them for a lifetime of secure, efficient, confident email processing. And they internalise it. Users internalise it and they enjoy learning the lessons instead of the slap them on the wrist. “Oh, I won’t click today.” That’s feeding them a phish for today. Tomorrow they’re going to click again. You need to explain the whys and the hows.
Yeah, I love that. And make it fun. Make it fun is the big takeaway from this. So we’re going to talk in a second about what exactly your business does and how you work with MSPs. But before we do, let’s take this one step further. And so obviously you’ve got the software solution, which is your answer of how MSPs can make it fun, but what are some other ways that MSPs can have the right kinds of conversations with people without falling back on fear and uncertainty and doubt? What techniques do you suggest that MSPs use or avenues of conversation other than the software solution?
So you need to explain what the companies out there are up against. There’s a lot of folks that don’t know what they don’t know regarding cyber security. So you can explain that the number one way companies are breached is email phishing attacks. The number two is password hygiene. So when you’re sitting down with a business owner, you can ask things like, “Have you funded and encouraged the adoption of a password manager? Because if you haven’t, then you’re guaranteed that all your employees are reusing their favourite personal password or their VPN password. And if it’s not MFA or two-factor protected, hackers can just look it up on the dark web and log into your VPN. Done. You’re done.” I mean, that’s not fear and uncertainty, that’s just facts.
And so you need to explain what’s out there, what the biggest risks are. Phishing is the largest risk today because AI is creating 10 different emails that appeal to you, Paul. Your specific social media profile online can be fed into AI and I can send you 10 things that you desperately want to click on because it pertains to your passions in life, whether you like your children, your dog, your sports, your family, your business, and you’ll want to click on those things. So we need to teach exactly what’s going on in those spaces. And you just have to have a candid conversation with your clients to say, these are the ways hackers are breaking in.
Then we can also help you with things like data retention strategies. I worked on a forensic investigation with a law firm this year that had 20 years of case studies on their network and they were breached and the data was exfiltrated and they had to go talk to or email or contact 20 years… They had to find the customers from 20 years ago but they didn’t know where they were. Now, if they had done any kind of data retention strategy that said, we haven’t touched anything older than five years old and archived that, they don’t have to delete it, they can archive it to a place where it’s safe and it’s offline and it’s available. It just can’t be attacked. It can’t be stolen. And they would’ve had five years of this or three years of this or the current work that they’re doing.
So you can have these really candid conversations with your clients about easy, simple things you can do to mitigate risk. And truthfully, these methods like password manager, it’s an efficiency tool as much as it is a security tool. Password resets waste 10 hours a year per employee times a hundred employees. You’ve got a lot of lost productivity there and employees are happier when they actually can click a link and get to where they need to go and they’re logged in automatically. So those are the kinds of conversations I would recommend.
I love it. Thank you so much, Craig. Let’s just very briefly finish with, tell us a little bit what your platform does. What’s the benefits for MSPs of using this? Although I think we’ve just been talking about that for the last 15 minutes, let’s be honest. But also just tell us where can people get in touch with you and come and see what your software does.
So reach out to sales@cyberhoot.com and you can book a free demo and we have a free trial for 30 days if you wish. We’ll give any listeners to this that mention the MSP Marketing podcast 20% off for one year as a discount. What we do is we send out short three-minute videos once a month, short HootPhish exercises in the browser, not attacking people in their inboxes. So it’s a complete awareness that I’m going to learn about phishing. I’m not being tricked. So it builds your relationship with your clients. Retention goes up with CyberHoot versus down with a fake email phish testing. We also have dark web monitoring. We have a whole bevy of things, product training. When you roll out that password manager, we can send your employees one email with 10 links to videos from OnePassword or Keeper or Bitwarden to teach your users how to use this product, reducing the cost to your help desk of tickets. How do I do this? How do I do that? So it’s 100% automated.
Many of the products out there take a lot of precision work to define these specific fake email phishing tests. It can be too hard, too easy and lead to a lot of erosion of goodwill. With us, it’s 100% automated. You don’t pick anything, you just turn it on, synchronise with Google Sync or Microsoft Entra Sync, and it runs itself. It’s the lowest cost of ownership out there for a learning management system for MSPs in a multi-tenant environment. And our website is cyberhoot.com.
Useful Links
- This podcast is powered by the MSP Marketing Edge, the place where 700+ MSPs generate leads, win clients & achieve freedom.
- Join me in MSP Marketing Facebook group.
- Connect with me on LinkedIn.
- Connect with my guest, Craig Taylor, on LinkedIn. And visit the CyberHoot website.
- Mentioned book: Influence by Dr. Robert Cialdini.
- Got a question about your MSP’s marketing? Let me know.
Discover the marketing used by successful MSPs to generate leads & win clients
And when you subscribe for free, you also get a MSP marketing: Start Here
You can buy it on Audible.
Or subscribe to my newsletter, and today.