For MSPs
How do MSPs sell security awareness training to small business clients?
Updated
Short answer
MSPs sell security awareness training most easily by tying it to something the client already has to deal with: a cyber insurance application, a compliance rule such as the FTC Safeguards Rule, or a recent phishing scare. Package it inside your managed plan or as a simple per user add-on, run it for the client with little effort on their side, and show results in every review.
Why do small businesses buy security awareness training?
Most small business owners do not wake up wanting training. They buy it because a third party asks for it, or because someone on staff nearly wired money to a fake supplier.
Lead with the reason that already applies to the client in front of you. A generic pitch about "the human firewall" is easy to ignore. A question on their insurance renewal form is not.
- Cyber insurance: many applications ask whether staff get awareness training and whether phishing simulations are run. Cowbell's own application guidance says it will require a training program at renewal if one is not in place.
- Regulation: in the US, the FTC Safeguards Rule requires covered financial institutions (the FTC's examples include tax preparation firms and mortgage brokers) to give personnel security awareness training.
- Government guidance: in Canada, the Canadian Centre for Cyber Security lists employee awareness training as one of its baseline controls for small and medium organizations.
- A near miss: a convincing fake invoice or a compromised mailbox makes the risk concrete overnight.
Which clients should an MSP pitch first?
Start with clients who have an external reason to say yes. They convert fastest and become your reference accounts.
Sort your client list by these signals and work from the top down.
- Cyber insurance renewal in the next 90 days.
- Regulated work: accounting, tax, legal, health, financial services, auto sales.
- Staff who handle payments, payroll or supplier bank details.
- Any phishing incident, mailbox compromise or wire fraud attempt in the last year.
- Clients already on your top managed tier, where training fills an obvious gap.
What should an MSP say in the sales conversation?
Keep it short and about their business. Owners want to know three things: what problem it solves, how much of their staff's time it takes, and what proof they get at the end.
A simple framing works: "Your insurer asks whether your team is trained and tested on phishing. We can run that for you every month, it takes each person a few minutes, and you get a report you can hand to your broker."
Avoid fear heavy pitches and avoid promising that training stops all attacks. It reduces risk and gives you evidence; it does not make anyone immune.
How should MSPs package security awareness training?
Packaging matters more than features. Clients compare your offer to doing nothing, not to a competitor's feature list.
The three common approaches are bundling it into your managed security tier, selling it as a per user add-on, or including it only in your top tier as a reason to upgrade. Each has trade offs on margin and adoption, covered in our pricing models guide.
- Bundle it when you want every client covered and simpler contracts.
- Sell it as an add-on when clients are price sensitive or your plans are already set.
- Use it as a tier differentiator when you want to move clients up to a higher plan.
How do you roll it out without upsetting staff?
Rollout is where deals turn into renewals or cancellations. If staff feel tricked or shamed, the owner hears about it and the program becomes a political problem.
Agree the ground rules with the owner before the first simulation goes out.
- Send a short note from the owner (not the MSP) explaining that practice phishing emails are coming and why.
- Make the first month easy so people learn the format before the harder lures arrive.
- Treat clicks as a training moment, never as a disciplinary matter.
- Show staff how to report a suspicious email and thank people who do.
- Make sure your email security tools are not producing fake clicks, or your first report will look worse than reality.
How do you prove the value and keep the client renewing?
Show results at every quarterly business review. Click rate, report rate and training completion over time tell a simple story the owner can repeat to their insurer or auditor.
Hand over a report the client can actually use, for example to attach to an insurance application or keep on file for a compliance review. That document is often what the client remembers paying for.
What should the platform you resell handle for you?
Choose a platform that keeps your delivery time low: automatic user sync, scanner filtering, your own branding and a report the client can hand to an insurer.
NetMinder is a phishing simulation and awareness training platform that MSPs resell under their own brand. It sends monthly practice emails, shows a two minute lesson with a three question check when someone clicks, filters out scanner clicks, syncs staff from Microsoft 365 and produces a branded cyber insurance report for any date range. Billing is per active user, monthly, with no minimum seats or contract.
Sources
- 16 CFR 314.4, FTC Safeguards Rule elements (Cornell LII)
- FTC: Safeguards Rule, what your business needs to know
- 45 CFR 164.308, HIPAA administrative safeguards (Cornell LII)
- Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations
- Cowbell: Recommendations to prepare a cyber insurance application (PDF)
- Ridge Canada Cyber Solutions: Cyber application, large risk (PDF)