Weekly Newsletter

See for yourself

In each edition of MSP Bento you’re guaranteed to find something new to tackle, no matter how much time you have. 

So what are you waiting for? Sign up now and we’ll send you a collection of the most popular tips and tools we’ve shared so far.

Building Your Stack

• See the best-rated MSP software across 12 categories [guide]
  Our freshly updated guide compares 90+ products across 12 software categories, from RMM and PSA solutions to security and documentation software. Discover what other MSPs rate as their favorite tools of 2020.
• Understand what exactly is included in every Microsoft 365 license type [diagrams]
  Want to see the differences between Business Premium, E3, E5, Education, and more? These awesome visual diagrams from Aaron Dinnage make it all crystal clear.
• See how a simple chart can help you make more practical security buying decision [YouTube]
  We first learned about the "Cyber Defense Matrix" from Huntress CEO Kyle Hanslovan. If you're considering making any changes to your security stack you should definitely check it out (the first glimpse of the matrix is at 1:37).
• Map out a Virtual CIO offering [guide]
  Learn why vCIO services have become a core offering for many maturing MSPs, and discover the essential building blocks for rolling out your own.
• Lay the groundwork for a managed container offering
  Looking for a way to differentiate and grow your business in 2021? Providing managed Docker and Kubernetes services may be an option.

Client Management

Customer satisfaction

• Start reducing churn by making CSAT data more actionable [YouTube]
  Simplesat co-founder Cory Brown joined us to share ways you can gather more meaningful customer feedback more easily (and use that feedback to drive revenue).
• The Complete Guide to Customer Survey Questions [blog post]
  Check out this roundup Cory pulled together on the different types of customer surveys and example questions you can use in different types of situations. Hopefully they inspire your team's next customer survey initiative.

QBRs

• Check out a new tool for creating killer QBR reports [YouTube]
  Lifecycle Insights founder Alex Farling shares how to deliver impressive quarterly business reviews at a fraction of the prep time.
• Learn how to turn my QBRs into a deal-closing sales tool [blog post]
  Alex shares 5 unexpected ways the most successful MSPs leverage quarterly business reviews.
• Get tips for making remote QBRs and other client meetings more engaging
  Rex Frank from Sea-Level Operations and Denes Purnhauser from Managed Services Platform explain why the context you're trying to have strategic client discussions in is totally different — and why your approach needs to be different, too.
• Improve your quarterly business reviews (QBRs) [blog]
  Learn what to include (and what not to include) to make it clear to your customers they're getting what they're paying for.

Company Development

Finance & KPIs

• Calculate your MSP's cash runway + how a recession could impact your revenue [tool]
  Two different examples of a "Months of Cash" spreadsheet that MSPs can use to determine how severely the crisis might affect their finances (via Service Leadership).
• Learn about a different metric for determining your best (read: most profitable) client [YouTube]
  MSPCFO co-founder Larry Cobrin explains to bvoip's George Bardissi why margin isn't everything, and why you should be measuring something he refers to as "contribution per hour."
• 79 Metrics for MSPs to track [guide]
  The team at Brightgauge have a giant list of metrics you can use to measure everything from your financial health to your sales, marketing, and services performance.

Growth advice

• Hear how to avoid the biggest stumbling blocks to surpassing $1M ARR
  Even the most initially successful MSPs hit walls during their growth, and for many, the $1M ARR mark is where things get really challenging. Former MSP owner and NinjaRMM Channel Chief Advisor Tom Watson sits down with bvoip founder George Bardissi to share hard-earned lessons learned and what he'd change if he had the chance to do it all over again.
• Tackle the top 11 reasons your business feels chaotic
  Support Adventure founder Eric Muth breaks down the 11 most common problems stopping MSPs from being more organized, efficient, and profitable.
• Building a $6 Million ARR MSP: 5 Things I Wish I'd Known Starting Out [blog]
  Aaron Underhill of Dedicated IT shares five important lessons that he and his team had to learn the hard way during their rapid growth.

Hiring

• Compare MSP salary numbers [report]
  See salary data for techs (Tier 1, 2, and 3) and sales roles pulled from over 5,000 interviews conducted with MSPs.
• Reduce bias in your hiring process [blog post]
  If you're interested in making conscious efforts to ensure your MSP is inclusive and a great place for employees of all backgrounds, Google Play Engineering Director Mekka Okereke offers some important tips.
• Learn the secret to keeping my best techs happy [blog post]
  With the competition for good technical hires high, the secret to retaining your top talent may ultimately boil down to asking one very important question.

M&A

• Start putting yourself in the best position to sell your MSP [guide]
  BrightGauge co-founder Eric Dosal shares the 10 biggest lessons he learned through the process of selling his $8.8M ARR MSP.
• Learn how to boost my MSP's valuation with long-term contracts
  BrightGauge co-founder Eric Dosal shares how 3-year contracts (structured the right way) played a major role in growing his MSP 10X in 5 years.
• Find out how much my MSP could be worth [blog post]
  Evergreen Services Group shares the criteria they look at to valuate MSPs and make them an offer.
• Get advice for how to handle buying another MSP — or selling yours — in this climate
  Find out how COVID has affected the M&A market and get insights for both buying and selling in this guide from Service Leadership.

Strategic planning & growth advice

• Draft a strategic roadmap for 2020 — and beyond [template]
  Step back and learn about this proven framework that can help your team establish big goals and hone in on the right priorities and objectives.

COVID Resources

Client relations

• Send clients an email update re: COVID-19 [template]
  Now's the time to be regularly reaching out to and reassure clients, set expectations around any anticipated changes in service, and provide them with a list of things to be aware of in regards to their IT. Here's a template to work from (crowd-reviewed on Reddit).
• Warn clients about Coronavirus-related scams and phishing emails [alert]
  Show clients you've got their back by sharing this advisory and list of precautions from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

Financial planning & assistance

• Understand how to get financial aid via the CARES Act stimulus [blog post]
  If you and/or your clients are based in the U.S. you should read this breakdown of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. It explains the two types of loans most relevant to small businesses — Economic Injury Disaster Loans (EIDLs) and Paycheck Protection Program Loans.
• Research small business relief programs [list]
  Forbes is keeping a regularly updated list of federal, state, and local programs for businesses in the U.S. hit hard by COVID-19-related restrictions. See who's eligible and how to apply.
• Come up with a plan for cutting (the right) costs [blog post]
  How do you walk the line between lowering expenses and stunting your growth? If you're considering tightening your belt (and signs are you should) read this first.
• See more COVID-19 resources, including ones for MSPs in the UK, Europe, and Australia [list]
  Many of the COVID-related resources we've been sharing have been U.S.-centric. This list from Richard Tubb has more useful resources for MSPs all around the world.
• Get specific, actionable advice on how to come out of 2020 stronger [guide]
  The Tech Tribe's Nigel Moore has a new 89-page guide on how to "survive and thrive" during these hard times, with tips for communicating with your team and clients, managing your cash flow, and keeping your growth engine running.

Remote work

• Get all the tips, tools, and resources I need to help my team and clients adjust to remote work [guide]
  "The Remote Work Survival Kit" is a massive crowdsourced Google Doc that has been heavily contributed to.
• See "Remote Worker Security Guidelines" I can share with my team and clients [checklist]
  "Remote" doesn't have to mean "less secure." Get organized around this free checklist from Skout Cyberescurity.
• Check out a tool for setting up VPNs [reddit]
  This MSP explains how using Microsoft's Connection Manager Administration Kit (CMAK) sooner would have saved his company 40hrs last week alone.

See how others are doing

• See the numbers behind COVID-19's impact on MSPs [report]
  This year, IT Glue ran two versions of their annual MSP benchmarks survey — one in February and one in May — to gain perspective on how the first few months of the pandemic effected priorities, finances, and more.
• See how other MSPs are doing in terms of MRR, team morale, and more [article]
  We asked MSPs who attended a July MSP Live Chat to give us an update on where things stand on a variety of fronts. Some of the responses we got were surprising — in a really encouraging way.

Marketing

Conferences & events

• See which major 2020 MSP conferences are cancelled, still in-person, or gone virtual [blog post]
  What's the status of your favorite annual MSP events? Find out which conferences have been cancelled, which have moved online, and which hosts have lowered costs or even made them free as a result.

Creating marketing collateral & campaigns

• 25 inexpensive tools for creating your own marketing collateral [blog post]
  If you've been considering getting more active on the marketing front and want to try things out on your own before shelling out $$$ to an agency then check out this list of tools first.
• Design a better marketing brochure [guide]
  We've put together everything you need to create your own brochures without getting a design degree or combing through a mountain of profiles on Fiverr.
• Plan a successful direct mail campaign [blog post]
  Our VP Marketing has built her career on effective direct mail campaigns. She's sharing her tried-and-true playbook here.

Digital advertising

• Start generating leads from Facebook, LinkedIn, and YouTube [guide]
  We cover everything you need to know to get started with paid social advertising, from determining your spend to creating the right types of ads that convert.
• Get a crash course in generating leads via retargeting [guide]
  If you're the slightest bit considering investing in digital advertising you need to read this guide first.
• Read how one company wasted $50K on Google Ads
  So you can know what NOT to do with your marketing budget.

SEO

• Get a crash course in SEO geared specifically for MSPs [guide]
  What's better than seeing inbound leads flooding into your website? Knowing that you're getting them organically (not paying for them) thanks to optimized content. This guide from Your Sales Energy explains how to get your pages ranking higher in search results and converting more visitors.
• Identify new search terms to target [blog post]
  MSP Growth Hack's Kevin Clune shares data on nine IT-related search terms that have seen a serious jump in traffic through the COVID crisis.
• Leverage Google My Business to get more leads [blog post]
  Did you know top Google My Business listings often show up above the top results in local Google searches? Find out what you can do to land that valuable digital real estate and get in front of more prospects.

Video marketing

• See the videos that won Ninja's "MSP Oscars" awards [blog post]
  From Best "About Us" Video to Best Customer Testimonial, we've rounded up videos that show MSPs at the top of their marketing game.
• See a list of free tools for creating marketing videos [blog]
  Great video content can put you head and shoulders above your competition — and it's never been easier to create.

Website building & optimization

• Get ideas for improving your website
  We reviewed all of the websites for ChannelE2E's 2019 Top 100 Vertical Market MSPs to find out what makes a good (or bad) MSP website. Here's what we learned.
• Get inspiration from the 10 best MSP websites of 2019 [blog post]
  We see a lot of MSP websites. Here are the 10 that have impressed us most. With engaging layouts, compelling copy, and high-quality imagery, there are a ton of good takeaways worth checking out.

Sales

Assessments

• Turn your prospect IT audit into an unfair sales advantage [YouTube]
  MSP owner and audIT founder Frank DeBenedetto walks through his sales process and shares how the right audit report can move the conversation away from speeds and feeds and push all the right psychological buttons to make prospects actually want to invest more.

Benchmarks

• See average sales and marketing conversion rates for MSPs [blog post]
  Data from Collabrance and CharTec will help you establish expectations in terms of how many leads it takes to generate a deal.
• See stats on when to send sales emails or make calls to maximize response rates [blog post]
  Looking to convert more of your sales leads? Find out what the numbers say about the best times to reach out and how many sales touches to plan for.

Co-managed IT

• Hear how to land and successfully manage deals where the client keeps their internal IT [YouTube]
  According to many channel experts, one of the biggest opportunities for MSPs right now is targeting clients who are looking to augment rather than completely replace their IT. During this MSP Live Chat, "co-managed IT" expert Bob Coppedge laid out the keys to making that arrangement actually work.

Managed services agreement (MSA)

• Adjust your Managed Services Agreement so it covers the extreme circumstances you're seeing now [templates]
  During this MSP Live Chat, NinjaRMM Channel Chief Advisor Tom Watson shared sample Force Majeure clauses MSPs can add to their MSA. You'll want to confirm with your legal counsel before you do, but these should provide you with solid language to start with.

Pricing & packaging

• Grab a simple managed services cost calculator [tool]
  We hosted not one but two MSP Live Chats on how to price your managed services packages effectively. This agenda doc has links to the recordings plus a free calculator you can use to determine your costs and profit margins.
• Calculate your margins in even more detail + factor in “pain in the a$$” costs [tool]
  The folks at MSP Exchange have another free calculator that can help you get more granular to determine what specific types of end users are really costing you — and how much you need to be charging clients to make a sustainable profit.
• Learn how to prevent client sticker shock [blog post]
  MSP Growth Hacks co-founder Kevin Clune shares four tricks to avoid getting put on the defensive when you hand over your quote.
• Hear how to eliminate price objections during the sales process [Reddit]
  Struggling with prospects focusing on price? Genuine Technology's Ernest Murry provides an amazing answer that breaks down what his team says — and doesn't say — in their sales process to avoid that problem altogether.
• Learn how to price and package vCIO services effectively
  Any interest in reinventing the wheel? Of course not! Instead, watch Virtual C co-founder Adam Walter break down how to include vCIO in your managed services offering and get your pricing right, starting with the easy, peasy "5% rule."
• Revisit pricing and packaging to focus on strategic bundling [YouTube]
  This webinar is a great refresher covering the basic do's and don'ts around offering services bundles, with additional tips for the best types of bundles to offer in the context of all [waves hands around] this.

Sales hiring & compensation

• Hear how one MSP handles sales compensation for his sales reps [YouTube]
  Tom Lawrence breaks down the difference between paying reps based on net revenue vs. gross margin, and why he's structured comp at his company around the latter.
• Learn the biggest mistakes to avoid when hiring your first sales leader [YouTube]
  It's arguably the most critical role for your growth, yet so many people get it wrong. Jason Lemkin shares how to do it right.
• Learn how to screen outsourced sales/lead gen providers [guide]
  Feeling nervous about paying a third-party firm to generate leads and appointments? You should be! Here are questions to ask to make sure the partner you found is the real deal.

Sales training

• Understand the approach that sets today's top tech salespeople apart [YouTube]
  If you think the most important thing you can do during a sales call is ask the right questions then you need to watch Matt Dixon explain the Challenger Sales Model. It may just change your mind.
• Learn how to respond to one of the most common objections in MSP sales [blog]
  Cold calling expert Carrie Simpson shares the right open-ended questions to ask when a prospect says, “we already have IT covered.”
• Know the right questions to ask during sales discovery calls
  Time on the phone is money, whether you're the one dialing or you have salespeople who are. Here are the questions you need to ask to qualify leads quickly.

Selling security

• Start pitching additional security to clients in ways they actually relate to [guide]
  Huntress Labs may be known for their live-hacking breakdowns and research, but they also have a great guide on selling SMBs on the value of cybersecurity.
• Get a free Microsoft 365 security assessment to highlight client needs and risk [tool]
  Need to do a better job of educating clients where they're coming up short in terms of security? Alex Fields has put together a fantastic assessment tool based on CIS controls that simplifies the security discussion and makes it visual.
• See the latest ransomware stats you should be showing your clients [blog post]
  Selling security is tough. Let these stats in Coveware's Q2 quarterly ransomware report do the hard work for you. Show your clients Q2's average ransom payment and watch their jaws hit the floor.
• See a giant list of more cybersecurity statistics to share with clients/prospects [blog post]
  Need a recent stat to make your case? This list from Hashed Out has 126 of them 👀, sorted by categories.
• Get a great visual to convince clients of the danger of exposing RDP
  It may be a dead horse for most of us, but the fact is exposed RDP continues to account for a sizable chunk of compromises. If you know anyone who needs convincing, this clever visual may finally help do the trick.

Security

Backup

• Protect backups from hackers [YouTube]
  Philip Elder provides a great refresher on making sure backups are isolated and properly managed.

Cyber insurance & risk management

• Get answers to your questions about cyber insurance and the legal risk of ransomware [YouTube]
  Watch our FAQ webinar with MSP legal advisor Bradley Gross and insurance expert Justin Reinmuth from techrug.
• Get a primer on protecting your business with effective risk management [YouTube]
  Techrug CEO Justin Reinmuth breaks down how to better leverage your contract, processes, procedures, and insurance to reduce your liability (more important now than ever with WFH and COVID).
• Get the facts on how liable you (or your clients) are for a data breach [YouTube]
  One of the biggest worries surrounding data breaches is the thought that your MSP could be held responsible and subject to fines and damages. This explainer video from Joseph Brunsman will help arm you with the facts and help put your mind at ease.

Dark web & data breach monitoring

• Start notifying clients when their email addresses are in data breaches [script]
  When Kelvin Tegelaar's MSP was approached by a vendor offering to provide info on what breaches their email addresses were associated with, he thought — why don't I just build that myself? The result is a set of PowerShell scripts anyone can use.

DNS & URL filtering

• See a head-to-head assessment of DNS malware filtering tools [YouTube]
  Tom Lawrence of Lawrence Systems recently ran a test that compared filtering results for Quad9, Cloudflare, DNS Filter, and OpenDNS/Cisco Umbrella. The results were dramatic (though Tom did need to issue a follow-up to clarify a few things).
• Stay on top of new malicious URLs to block [tool]
  URLhaus is an open and regularly updated database of malicious sites being actively used for malware distribution.

MSP internal security

• Grab this MSP cybersecurity checklist to protect your company from ransomware and other attacks [checklist]
  This is a perfect time to roll out security controls you may have been putting off. This checklist has more than 50 practical suggestions that can save your bacon. Is there anything on here that you’ve missed?
• Take a major step forward with your internal security by introducing Named Accounts
  Cyberdrain author Kelvin Tegelaar explains why introducing named accounts is crucial to improving audability and access control, reducing attack surface, and more. Better yet, he shares PowerShell scripts to automate that.
• See how criminals sell access to MSPs on the dark web [blog post]
  Go undercover with Huntress Labs as they interact directly with a seller. The goal: get enough information to warn the would-be victim MSP in time.

Phishing

• Sign up to get notified when one of your MSP employees gets phished [tool]
  Abuse.ch, the non-profit behind URLhaus, has a free web service that sends out email notifications if a user enters their password on a phishing website.
• See an example of the latest (incredibly convincing) phishing emails targeting MSP remote access tools [reddit]
  As if we needed any reminder that MSPs are top targets. Reddit user /char512 shares details and a screenshot of the phishing attempt he received targeting his ConnectWise Control credentials.
• Run a variety of DNS, blacklist, and SMTP diagnostic tests with just one tool [tool]
  If you're not familiar with mxtoolbox.com it's a great site to diagnose a host of things, including DNS issues and DMARC.

Ransomware

• See new statistics behind the latest ransomware trends [blog post]
  Big changes in the ransomware ecosystem are resulting in large increases in downtime, resulting costs, and average ransom amounts — from $6,733 in Q4 2018 to $84,116. Find out why.
• See a fantastic breakdown of 2020 ransomware campaigns along with attack vectors and mitigation techniques [article]
  Microsoft's Threat Protection Intelligence Team shares data they've gathered on ransomware deployments during the first two weeks of April. This is honestly one of the best, most actionable write-ups on ransomware we've seen in a while.
• See data on Q1 ransomware trends gathered from victim organizations [blog post]
  These days there are really only two security vendor reports I actually look forward to: 1) Verizon's DBIR; 2) Coveware's Quarterly Ransomware Marketplace Report. The latter's report for Q1 2020 highlights a 33% rise in the average ransom payment along with several interesting shifts in attacker activity and tactics.
• Get threat intel on the ransomware that is costing Cognizant $50 - $70M
  MSP heavyweight Cognizant says that the Maze ransomware attack it suffered in April is going to significantly cut into its Q2 2020 revenue. FireEye recently released a deep dive on Maze, includiing IoCs.

Securing Microsoft (Azure, M365, O365, Teams, etc.)

• Tighten up Microsoft Office 365 Email Security [checklist]
  For all the talk of sophisticated new attack techniques, the truth is email remains one of the most popular attack vectors. This checklist will help you conduct an audit and reduce your risk.
• Set up alerts for O365 logins from untrusted locations [blog post + PowerShell script
  CyberDrain author Kelvin Tegelaar offers a script that monitors where users are logging on from and compares it to a database online.
• Learn all about why Microsoft 365 Sensitivity Labels are a big deal [blog post]
  ITProMentor author Alex Fields explains why Sensitivity Labels represent the future of access control.
• Make sure Microsoft Teams is setup securely
  If you're encouraging your clients to use Teams here's a walkthrough of configurations and controls that can harden its security. If the linked-to video is too long for you, check out the checklist here.
• Ensure Azure service is HIPAA, PCI, GDPR, and/or CCPA compliant [guide]
  This meaty guide walks through each of the restrictions and covers all the best practices you need to know.
• Learn about Azure AD password spraying attacks and how to defend against them [blog post]
  Daniel Chronlund shares an example of a password spray attack abusing PowerShell and how to break it with a simple Conditional Access policy
• Secure Microsoft Exchange Online with PowerShell
  This video walkthrough covers settings and policies you can configure to harden Exchange Online and reduce its attack surface. Better yet, scripts are included to make it all automated.
• Start reporting to clients what their Microsoft Secure Scores are [script]
  If you're looking for ways to upsell clients on security products/services, a proven way of convincing them is by introducing them to their Microsoft Secure Score — and getting them to chase after raising it. This script from Elliot Munro at GCITS automates pulling client scores and exporting the data into a branded HTML report.

Security awareness training

• Get your hands on remote work security training materials [kit]
  The great folks at SANS have made a bunch of their training materials available for free, including a security awareness guide and checklist.

Security monitoring

• Get a primer/refresher on critical Windows logging [cheat sheet]
  Are you collecting the right logs necessary for security audits and incident response? Here's a handy cheat sheet to confirm.
• Confirm which crucial Windows Event IDs I should be monitoring [blog post]
  While not comprehensive, this post from RocketCyber shares what they consider to be the top 10 security events, from account logins to lockouts.
• Know what ports are open on client networks [blog post]
  Kelvin Tegelaar walks through how to conduct quick and easy external port scanning with PowerShell, and shares a script for alerting when 3389 or any other port is open.

Security policies & incident response planning

• See 50 examples of security policy templates from SANS [templates]
  We've had several partners asking for examples of policies templates. This collection from SANS covers everything from antivirus guidelines to workstation security for HIPAA compliance.
• Grab an example incident response plan template
  Is your team ready to jump into action when a security incident hits? Get access to a collection of playbooks here.

System hardening

• Secure ConnectWise Control (ScreenConnect) with 2FA [YouTube]
  With attackers continuing to abuse it to deploy ransomware, it's absolutely crucial to have access locked down with 2FA. Tom Lawrence of Lawrence Systems shows how.
• Learn how to defend against PowerShell attacks [blog post]
  See the latest recommendations directly from Microsoft, including its take on disabling PowerShell (spoiler alert: it's not recommended).
• Learn how to prevent PowerShell-based “living-off-the-land” attacks [blog post]
  Why drop malware when you can achieve malicious goals by abusing legitimate system programs, instead? That approach — referred to as "living off the land" — has instigated yet another cat-and-mouse game between attackers and defenders. But as Kelvin Tegelaar points out in this post, many living-off-the-land techniques leverage PowerShell commands that can be blocked relatively easily.
• Check for security holes accidentally introduced during the mad WFH rush [checklist]
  Security expert Jake Williams points out some of the core things you should look out for and mitigate — before attackers find them first.
• Learn how to create an application whitelisting policy in Windows [guide]
  For all the shiny, cutting-edge security software out there, the fact is, under the right conditions, application whitelisting can still do a lot of heavy lifting.

Vulnerabilities & patch management

• Mitigate Citrix RCE vulnerability CVE-2019-19781 —which is actively being exploited [blog post]
  Referred to as "one of the most dangerous bugs disclosed in recent years" you can learn all about CVE-2019-19781 aka "Shitrix" along with mitigations here.
• Check to make sure Microsoft Exchange servers haven’t been compromised [blog post]
  Attackers are actively exploiting a vulnerability that allows them to remotely execute code as SYSTEM. Microsoft issued a patch last month, but if you're concerned the folks at TrustedSec have provided a list of IoCs.

Windows 7 & Windows Server 2008 EOL

• See how much Extended Security Updates are going to cost [chart]
  This handy visual breaks down the options and costs for receiving ESUs for Windows 7, Windows Server 2008, and Windows SQL Server 2008.
• Confirm how I'm actually going to get Windows 7 ESUs [blog post]
  There's quite a bit of confusion surrounding who can get ESUs and who can't, not to mention what the actual process looks like. This post helps clear things up.
• Confirm how I'm actually going to get Windows Server 2008 ESUs [documentation]
  These are being handled differently than Windows 7 ESUs. Here are the details straight from Microsoft.
• Get a reminder of the other Microsoft products/versions going EOL in 2020 [list]
  Windows 7 and Server 2008 may be the big ones, but they're not alone. See the full list along with migration guidance for each here.