Most security marketing aimed at small businesses runs on fear: headlines about ransomware, padlock icons, warnings about what "could" happen. It is easy to write and it mostly does not work. Owners have heard it all before, and when a stranger tells them they are in danger, the natural reaction is suspicion, not a signed contract.
There is a better approach, and it is also more honest: show them something specific about their own business, explain what it means in their terms, and make the first step small.
Why fear underperforms
- It is generic. "Small businesses are a target" applies to everyone, so it feels like it applies to no one.
- It cannot be checked. The owner has no way to verify the threat, so they discount it.
- It triggers avoidance. Big, vague risks lead to "we'll deal with it later".
- It damages trust. If the scary thing does not happen, you were the one who cried wolf.
Evidence-based selling in four steps
1. Start with an observation they can verify
Public settings are ideal: whether the domain publishes a DMARC policy, when the website's certificate expires, whether the domain is locked at the registrar. They are facts, they are about this business, and the owner (or their web designer) can confirm them. A passive security assessment gives you a list of them in a minute.
2. Translate it into a business outcome
| Finding | What the owner hears |
|---|---|
| No DMARC record | Fake invoices can be sent in your name, and your real email is more likely to land in spam. |
| Certificate expires in 9 days | Visitors will see a browser warning instead of your website. |
| Domain not transfer-locked | Your web address is easier to move away from you than it needs to be. |
| SPF over 10 lookups | Some of your real emails are failing a basic check right now. |
3. Be honest about severity
Rank findings and say which ones do not matter much. "This one is worth fixing this month; these two are tidy-ups" is the sentence that makes an owner trust everything else you say. Hookgap reports label every gap with an effort and an urgency for the same reason.
4. Offer a small, concrete first step
Not "a comprehensive security programme" but "set up DMARC reporting this week, review it with you in a month". A fixed scope and price is easy to approve. The relationship, and the larger work, follow from doing that well.
Language to use and avoid
| Instead of | Say |
|---|---|
| "You're vulnerable." | "There's a gap here that's quick to close." |
| "You could be hacked tomorrow." | "Right now, anyone can send email that appears to come from you." |
| "You've been breached." | "I can't see that from outside. Reporting would tell us within a few weeks." |
| "Total protection." | "This stops exact-domain spoofing. It doesn't stop everything." |
Where compliance fits
Regulated businesses do care about their obligations, and it is fair to mention them, accurately. A dental practice handling patient information has security duties under HIPAA; a law firm has professional duties around client confidentiality. Do not claim a specific setting is legally required unless it is. Our guide to email security for dental and medical practices shows how to raise this carefully.
The long game
Evidence-based selling is slower to write and faster to close. It also scales: once you have a way to produce specific observations for any domain, every prospect gets a message that is about them. And when a watched domain changes (a certificate about to expire, a DMARC policy weakened) you have a reason to get back in touch that is not just "checking in". Follow-up triggers covers that part.
Frequently asked questions
Why does fear-based selling fail for MSPs?
Small business owners hear security warnings constantly, so generic fear blends into the noise. When it does land, it often produces paralysis or suspicion rather than a decision, and it makes the MSP look like it is selling insurance against a threat it cannot prove.
What should replace fear in a security pitch?
Specific, verifiable observations about the prospect, explained in business terms, with an honest severity and a small, scoped first project.
How do I talk about risk without exaggerating?
Describe what is visible and what it allows, not what has happened. "Anyone can send email that appears to come from you" is accurate. "You are being targeted" usually is not something you can know.
Keep reading
Guide · 11 min read
MSP lead generation without ads: a practical guide for small MSPs
The whole system in one place: pick a niche, build a list, open with something specific, follow up when there is a reason, and measure it.
explain DMARC to clients · 6 min read
How to explain DMARC to a business owner in two minutes
A short script, an analogy that lands, and straight answers to the four questions owners always ask.
passive security assessment · 8 min read
Passive security assessments: what you can check before a prospect says yes
Where the line sits between reading public data and testing someone's systems, and what you learn from staying on the right side of it.