Great techs. Nobody out selling.

MSP buyers are rarely IT people. In a 20 to 150 person business, the decision usually sits with the owner or CEO, often with the office manager or operations director doing the legwork. In medical and dental practices, it is the practice administrator. In accounting and law firms, it is a managing partner. Larger prospects may have a solo IT manager who is drowning and quietly wants help.

So we talk about business risk, not tooling. The strongest openers tie to something already on the prospect's desk:

• Cyber insurance. Carriers now ask detailed questions about multi-factor authentication, endpoint detection and tested backups. "When your policy renewed last time, did you have to answer the MFA and backup questions yourself?"
• Compliance. Since May 13, 2024, non-bank financial firms covered by the FTC Safeguards Rule must report qualifying breaches to the FTC within 30 days. CPA firms, tax preparers and mortgage brokers feel this. Defense suppliers face CMMC.
• People change. "I heard your IT manager moved on. Who's covering tickets right now?"

Objections we plan for:

• "We have an IT guy." We ask what happens when he is on vacation and who signs the insurance questionnaire.
• "We're in a contract." We ask when it ends and book a call for 90 days before.
• "It's too expensive." We ask what downtime cost them last time. Your team handles pricing in the meeting.

The meeting most MSPs want is a network or security assessment, or a discovery call that leads to one. Before we book it, we confirm four things and put them in the CRM.

• Budget. What they pay today for IT, whether that is a managed contract, a break-fix vendor or staff time. We confirm the seat count fits your minimum. We never quote your pricing.
• Authority. Who signs the MSP agreement. If the office manager is our contact, we ask that the owner joins the assessment review.
• Need. A concrete problem: slow response from the current provider, an insurance questionnaire they could not answer, a compliance requirement, a recent incident, growth that outpaced their setup.
• Timeline. When the current MSP agreement ends, when the cyber insurance policy renews and any compliance deadline in the way.

You also get context: number of users and locations, Microsoft 365 or Google Workspace, line-of-business software they mentioned, and who their current provider is if they named it.

A prospect who is locked in for another year is still valuable. We log the end date, set a follow-up and keep them in a light nurture so your name is on their list when renewal comes.

Why referrals stop being enough

Referrals from happy clients are the best leads an MSP gets, but they come in a trickle and usually look like the clients you already have. If you want to add a vertical, like defense suppliers before CMMC or CPA firms under the Safeguards Rule, you need to go and get them.

Here is the kind of sequence we would test for an MSP targeting 20 to 80 person accounting firms. Names are made up.

Touch 1, call (Tuesday, 8:45 a.m. their time, before clients arrive): "Hi, is this Rob? Sylvia calling for Keystone IT. I work with accounting firms in Houston on the FTC Safeguards Rule. Quick question: when your cyber insurance renewed, who filled out the security questionnaire?" If Rob says he did it himself and guessed on half of it, that is the opening for an assessment.

Touch 2, email (same day): Subject: your insurance questionnaire. "Rob, short version of what I mentioned: insurers keep asking about MFA, endpoint protection and backup testing, and the Safeguards Rule now requires breach reports to the FTC. We do a one-hour review that tells you where you stand. Thursday at 3 or Friday at 10?"

Touch 3, LinkedIn (three days later): Connection request to Rob and to the firm's office manager, no pitch. Follow-up message only after they accept.

Tax season changes the calendar. For CPA firms we avoid February through mid-April and push hard in May and after the October extension deadline, when partners have time to think about IT. That kind of timing is built into every campaign we run.