Hosted By
MSPs, there’s a danger lurking inside my marketing advice… platforms like LinkedIn, Facebook and Instagram are actually “borrowed audiences”. Here’s how to build an “owned audience”. Also this week, how to turn boring compliance updates into lead gen on LinkedIn, and how to sell more cyber security by telling stories.
Welcome to Episode 340 of the MSP Marketing Podcast with me, Paul Green, powered by the MSP Marketing Edge.
Can I be honest about something? There’s a danger lurking inside the marketing advice that I give to you every single week in this podcast and I want to address it head on.
If you’ve been listening to or watching this podcast for a while, you’ll know that I tell you to build your audience on LinkedIn to make connections, post every day, send messages, and just grow your network. And of course, I stand by all of that. LinkedIn is still the number one place for MSPs to go farming for new business.
But here’s the thing… LinkedIn is not yours.
Your connections, your content, your years of relationship building. All of it lives on a platform that belongs to someone else.
Well, it’s Microsoft, I mean, they own LinkedIn. So that means that someone, some vice president of Microsoft hidden away in a building somewhere can change the rules at any point without warning, without apology, and without any obligation to protect what you’ve spent years building.
We have a name for platforms like LinkedIn and Facebook and Instagram within marketing. They’re called “borrowed audiences”. And borrowed audiences are really cool right up until the moment that they’re not. So let me give you two examples from my world that really bring this to life. And the first one involves my own MSP Marketing Edge Facebook group, which we use for member support.
So I started that in 2017 and for years that group has been a buzzing community with members sharing ideas and asking questions and getting answers and just helping each other out. It’s been great. But over the last couple of years, I’ve noticed something. The engagement has dropped significantly and it’s not because our members stopped caring or because the content within the Facebook group got worse. It’s because Facebook changed its algorithm. It stopped showing content from the groups that you’re in, in your feed. And you might have noticed this yourself if you still use Facebook.
You’re probably still a member of 10 or 20 groups and they’re all things that you’re really interested in. But the content from those groups never really appears in your feed anymore. You have to remember to go to those groups. And instead in your feed, you just see content from other places and other people trying to sell you stuff. And Facebook, for whatever reason, has prioritised that. So I’ve still got great content in my group, there’s great help there and great conversations, but some of my members never see it because they don’t remember to go and look at it. And the algorithm has decided without asking anybody that group content wasn’t worth promoting anymore. Thank you, Mark Zuckerberg.
I didn’t get the memo on that. Well, actually there was no memo on that, there was no announcement, the rug just got pulled slowly and silently. And that was a risk. It crept up on me. And obviously we’ve now actually gone and we’ve started other communities for our members on other platforms. Technically, we’re going to face the same problems again, but at least we can get around the Facebook algorithm problem with our other places that we can build communities.
Now the second example involves a friend of mine, Matt Solomon of Better Tracker, who’s very, very well known in the channel. A couple of Christmases ago, Matt got what I can only described as LinkedIn slapped. His account was closed for breaking a rule that he didn’t even know existed. In fact, I’m not even sure he yet knows what he did wrong all those years back. But for a couple of weeks, he lost access to his entire LinkedIn network. Thousands and thousands of connections that he’d spent years building, gone just like that because an algorithm somewhere decided that something wasn’t quite right.
Matt did get it back eventually, but those couple of weeks were a huge reminder of something that we all need to take seriously. If LinkedIn or another borrowed audience is your only marketing platform, you are one algorithm update or one account flag or one unexplained restriction away from losing everything that you’ve spent years building. So what do you do about this? Well, the good news is there is an answer.
You build two audiences at the same time, a borrowed audience and an owned audience. So your borrowed audience is, let’s say, LinkedIn. You still build it, you still farm there every day because right now, as I said, it’s still the best place to find the right kind of business owners and managers that you want to work with, or indeed IT directors if you want to win co-managed IT.
But your owned audience is your email list, sitting inside your CRM. And the reason it’s called an owned audience is simple. If your CRM provider decides tomorrow that they don’t like you and they kick you out, the data inside the CRM is still yours. You take that data with you and you move it to another CRM. The data does not belong to the platform. It belongs to you. So here’s the practical bit. As you’re growing your LinkedIn connections, make a habit of getting those connections off LinkedIn and into your CRM.
You find their email address, you can use data enrichment tools like Lusher or Apollo or Hunter.io to do this really quickly, or you could just Google them kind of like a brute force. It’s pretty easy to find someone’s email address online. There are just various things you could try… [email protected], b.wayne, bruce.w, bruce@. You get the idea, right? There’s about seven or eight of those that you can try. And it doesn’t matter how you do this, whether you brute force it and do it the hard way or whether you automate it with a tool. What matters is that you actually do it.
Because the moment someone’s email address is sitting in your CRM, and particularly if you’ve then used data enrichment tools to build up more of a profile of them in your CRM, you now have a direct line to them that no algorithm can ever take away from you. LinkedIn can change its rules because it’s not like Microsoft is well known for not changing things, is it? Microsoft changes its rules all the time. Twitter became something that none of us recognise anyway. All of these platforms can and will eventually just disappear or restrict you or simply decide your content isn’t worth showing to anyone.
All of that can happen on all of those borrowed audiences. But your email list, that’s yours, and always will be. The MSPs who market themselves really well don’t rely on any single platform. They use both the borrowed platforms like LinkedIn to find people and start relationships, but they also used owned platforms like their email list to deepen those relationships over time. One without the other is fragile, together they’re a marketing system that can withstand almost anything.
Let me ask you something. When a new piece of legislation drops or a compliance deadline gets announced, something that’s relevant to the kind of clients that you work with, what does your MSP do with that information? Because most MSPs do one of two things. Either they email their existing clients about it, which is good, or they do nothing at all, which to me seems like a massive missed marketing opportunity.
What almost nobody does is use compliance news as lead generation fuel on LinkedIn. And that’s a genuine shame because compliance updates are one of the most powerful pieces of content you will ever post on that platform. And not because they’re exciting, they’re not, but because they’re perfectly timed, highly relevant, and maybe even quietly terrifying to the business owners who sees them. And terrified people look for help.
Here’s the thing about compliance news. When something like a new cyber security regulation drops or there’s a deadline for something or a government guidance update goes out, every business owner who sees it has the same reaction. It’s actually three questions that they think. First, they think, “Does this affect me? ” And then they think, “What do I need to do? ” And then they think, “Who can help me with this?
“Does this affect me? What do I need to do? Who can help me?” That three question sequence happens every single time.
And if your MSP is the voice that surfaces in their LinkedIn feed at that exact moment explaining what it means, whether they need to worry and what their options are, then you’re not just posting content. You are positioning yourself as the expert they need to talk to right now. So how do you actually do this? Because it’s not as simple as just sharing a PDF sent out by the government and saying, “Here you go. That’s boring.” That’s just going to force your audience into a coma. Instead, here’s the approach that works.
First, do watch out for the news before your prospects see it. So subscribe to alerts, updates, government cyber bulletins, whatever is relevant in your market. In the UK, US, Australia, Canada, every market has official channels that push out this stuff. And you probably know about this stuff already, right? You just maybe need to sign up for the alerts or you could also set up a Google alert for things like the words “cyber compliance update” or “data protection guidance” or “IT regulation 2026”, just perhaps do 2027, 2028 when you’re setting it up at the same time. And when something drops, you then want to be the first to talk about it, but you must do that in plain language.
Second, translate it for your audience. And this is the crucial bit. Take the compliance update, strip out all of the jargon. Don’t post the actual regulation itself, it’s boring. Post what it means for a business owner who has no idea what they’re looking at. So instead of saying things like “organisations must implement appropriate technical measures”, what does that mean? You write something like this, you say, “Hey, a new government guideline just dropped. Here’s my two-minute version of what it means for businesses with fewer than a hundred staff.”, which by the way is 80% of the whole marketplace. And what you’re doing is the translation work so that they don’t have to do it, because they don’t have the time or the inclination to do it themselves and they will love you for translating it for them.
Third, make it about them and not about you. An easy mistake to make is ending every compliance post with a pitch. “Call us if you want to find out if you’re compliant.” That kills the trust that you’ve just built. So instead, end it with an engagement question. “Does your team know what your current backup policy covers and what it doesn’t?” Or you could say, “When did you last have someone check whether your email security meets current guidance?” A question is good because it invites engagement. And engagement tells the LinkedIn algorithm that this is interesting content, and it opens a conversation in the comments that you can take further.
Fourth, and this is the really smart bit, follow up privately with the people who engage. So if someone likes your post or better still, they comment on it, in a way that’s a hand going up and they’re not really ready to buy, of course, selling managed services doesn’t work like that, but they’re telling you that this landed with them. So send them a short personal message, no pitch. Just something like, “Hey, I’m glad that that post was useful. If you ever want a second opinion on where you stand, I’m happy to have a quick chat.” and please don’t be scared to do this. Don’t overthink it. Don’t talk yourself out of it. Just do it. Send them that simple message. Because there’s no hard sell, there’s no brochure attached to it. It’s just one human being offering to help another human being.
The reason all of this works so well is timing. Compliance updates have an urgency built in that most of the rest of your marketing content doesn’t. They create a natural deadline. They tap into loss aversion, which is one of the most powerful psychological drivers there is. People are a lot more motivated to avoid a problem than to pursue a gain. So a compliance post says something is changing and you need to be aware of it.
And when your MSP is the one saying that consistently in natural language over months and months and months, you become the authority. And in fact, you become the person that local business owners and managers think of when the next update drops. The expert who makes complicated stuff simple. What a great position to hold, right? And that trust built, post by post, is what eventually turns a LinkedIn connection into a discovery Zoom call, into a sales meeting, into a new client.
If you’re a member of the MSP Marketing Edge, a reminder that we recently relaunched our website reviews. Every month I pull one of our members’ websites at random and I do a full review based on our specific framework that we’ve created to help you create a website that converts traffic into leads. Now you can enter your website into the draw anytime in our member portal. You just go to portal.mspmarketingedge.com/websitereviews.
And if you need a more urgent review, perhaps as you’re about to do some review on your website, there’s also details in our portal of how you can get a member of my team to give your website a quick going over. And by the way, if you’re not yet a member of the MSP Marketing Edge, we do only work with one MSP per area so you can check if your area is free at mspmarketingedge.com/membership, just enter your postcode or zip code on that page.
Featured guest: Adam Pilton spent 15 years in law enforcement, culminating as a Detective Sergeant leading Covert Operations and Cyber Crime. Since 2016, he has worked across cyber security roles, advising organisations, improving cyber maturity, and translating complex threats into clear guidance for leaders, end users, and global businesses.
Every MSP wants to sell more cyber security to their existing clients and also to the new business that’s starting with you. And that makes sense because the more protection they buy from you, the more protected they are and actually the more protected you are. I realise that security is probably the one thing that’s most likely to keep you awake at night, right? Well, if that is the case, you’re going to love my special guest right now. He is a true expert at selling more cyber security and his approach to it is very natural and very authentic. He believes you can turn cyber security into compelling stories that you tell to your clients.
Hello, I’m Adam Pilton. I’m a cyber security advisor at Heimdal Security.
Thanks so much for joining us on the show, Adam, because we’re going to talk about something very important today. How do you persuade more of your clients to spend more on cyber security, to protect themselves, to listen to you and actually realise how big a deal it is? And as we are here sort of getting towards the middle of 2026, you and I know that cyber security is 50 million times more important than it was last year and the year before and the year before that, but the ordinary business owners and managers out there, they don’t know that.
So that’s what we’re trying to do in the next 10, 15 minutes or so is to give the MSPs who are listening to this or watching this on YouTube, some weapons, some tools that they can use to help business owners to protect themselves. So let’s first of all just delve into your background. How did you end up with a fantastic job like the one you’ve got right now?
Certainly. Yeah. So my background is in law enforcement. I was actually a police officer for 15 years. And I led something called the COVID Operations Management Unit, which was three distinct teams, the COVID Authorities Bureau, the guys responsible for obtaining lawful authorities in relation to COVID activity, whether it be real world surveillance or the online world hacking accounts. Second team, communication data investigators, the guys and girls responsible for obtaining communications data from Google, Facebook, Apple, and then locally from telephone and internet service providers. And then as you probably expect in the final team, the cyber crime team conducting cyber crime investigations, but also providing that tactical digital support in relation to traditional investigations, whether it be harassment through to murder.
Amazing. And what was some of the most astonishing things that you saw during your law enforcement career?
It’s a real array what you see. It exposes you. I started relatively young in the police and I think it’s the fact that there’s all types of different lives going on, and the standards that you have in your own life are very different in the other side of this world. So, lots of different experiences, but I very much came away with the mentality of the people are people. We’ve all ultimately got the same aim, as we care for the people that are closest to us. And whether you are a drug user or someone that’s top of the game in the business world, we’re all people.
Yeah. And I guess people are predictable to certain extent, which I guess the police rely on that, don’t they? That predictable nature. And we all screw up as well, which I guess is another important part of it. So let’s talk now about helping to protect business owners from themselves. So you talked to loads of MSPs. And before I ask for your advice on what MSPs can do, where are we right now? Because you know a lot more about cyber security than perhaps anyone else listening to this or watching this, because you’re right there at the frontline every day. It’s not just an aspect of what you do, it is what you do. So where are we right now in terms of awareness from business owners in terms of their willingness to invest in terms of their compliance with what their managed service providers suggests to them?
I think it’s on their radars for sure. Business owners now recognise cyber security. They understand there’s a degree of importance to it, but we’re still at that point, no further. There’s that motivation to actually take action but there’s that lack of confidence. There’s that not sure, there’s not enough money. And quite often I’ll speak to MSPs and they’ll say they have multiple bundles… bundle one, the beginner level, then you’ve got the medium and then you’ve got the higher tier, the premium tier security package they offer. And the majority of their customers, they take budget because it’s really difficult for business owners to understand that cyber security has different levels and yes, you might be spending what you deemed to be a lot of money on cyber security, but it doesn’t make you secure. Even at the premium level, you’re never a hundred percent guaranteed.
Business owners struggle with understanding that they need to spend a bit more money than they’d like in order to give them the level of protection they want.
And I think we’re very much stuck in a compliance stage at the moment as in ticking boxes to get certificates, which give us a false sense of security.
Yeah, I can understand that. And do you think that sort of mismatch with the business owners and the MSPs is because in the channel we are reading about it every day, we’re seeing what happens when companies get breached, talking to people like yourself, whereas business owners, unless it’s happened to someone they know, it’s not real, is it? It’s almost like being burgled, I guess.
Yeah, that’s exactly like it. And that’s exactly how I’d always try and explain it. Bring it into something real world that everyone can understand. Even if you haven’t been burgled, you could imagine what it would feel like to some degree. It wouldn’t be a nice experience and yeah, exactly that. So we need to compare it to things that are realistic. And for most business owners, their LinkedIn feeds, their news feeds, their social media feeds are going to be from peers. So they’re not generally going to be talking about cyber security. Whereas like if you and I, maybe MSPs, we are going to see a lot more about cyber security. It’s going to feel more real. And obviously myself, having dealt with cyber security for the police for a number of years, I’ve seen it from all angles, from the victims to arrest and the cyber criminals themselves.
Yeah, I can imagine. There’s a story, I think I’ve told it in the podcast before, where I once, a very long time ago, like 25 years ago, I lived in a city called Nottingham in the UK and I lived in the rough part of Nottingham. We got burgled twice in six months. And it was funny after we’d been burgled the second time and sort of word got around the neighbours, burglar alarms started appearing on some of the houses. So that street, and we were perhaps the worst house in the street, but once it was, “the guy next door or the guy two doors away”, it actually became real for them and people actually started to think about prevention because of what happened to us. I would imagine it’s exactly the same with cyber security right now.
I know that you have a very robust three-pronged approach, which you recommend that MSPs use. Could you take us through what those three prongs are and sort of perhaps go into some detail and just explain why you would use each of the three prongs when talking to business owners?
Yeah, certainly. So trust, clarity and storytelling are the three prongs I use. So trust is really important and it’s becoming day by day even more important. So if I say to fake news, AI generated content, deep fakes, that’s the angle I’m thinking of right now. We no longer know what is true or not. I was watching a video every day on YouTube and I was questioning at the end, is it real or not? And I didn’t know. I still don’t know and that’s where we’re at. We don’t know what is real. We don’t know what is fake. Whether it be phishing emails, they’re getting better quality, whether it be the video call right now. I said to you when I first joined the call, it felt strange, I’ve seen you so many times stood there, but now you’re talking back to me. So we don’t know what is real.
So we need to make sure that we have people that we trust in our lives in terms of people that can give us good quality information that we know is going to give us good qualification in terms of protecting ourselves, but also processes to protect ourselves. So when we’re thinking about deep fakes and potentially payment fraud type scams where we heard it was last year now of the company that paid out $25 million because a deep fake CFO came onto a call and told the employee to do it. So having processes helps protect us and helps build that trust element.
And I think as well, and we slightly touched on this really, but the clarity and the storytelling piece. So with clarity, it’s all about making things simple. So it could be, like you’ve just described talking or comparing cyber crime to burglary, making it appear like something that people recognise, that they can relate to, that they actually understand. Because quite often when it comes to cyber security, if you say cyber security people, they may go, “Oh, that’s dull.” Or, “That’s technical, I don’t understand,” which that’s not where we want people to be. So the simpler and clearer we can make it, then the better it is.
And storytelling, for me, it’s a winner every time because it engages people. If you think about the stuff that we all watch on the telly, what’s on Netflix, what’s with the cinemas, it’s crime-based drama. Well, that’s what cyber security is. So if we can get people engaged by storytelling, then they’ll come away and they will take those little nuggets with them into the future, into their day-to-day lives.
Yeah. And there’s a reason we still enjoy storytelling for our entertainment. And I think will, certainly for our lifetimes and potentially for the rest of time, the rest of however long humanity is around, because back in the day, that was how we learned information. So before we could write, in caveman times, we were passing information to our children by telling them stories. And if you put someone through a functioning MRI machine and tell them a story, all these parts of their brain light up, which means they’re making connections, which means they remember. Versus telling them the same story as a series of facts, one part of their brain lights up and they don’t tend to remember so much.
So let’s delve a bit more into that. So what kind of stories would you tell? I mean, I know that a lot of MSPs are scared of using FUDs – fear and certainty and doubt, quite rightly – it’s the completely the wrong way, I believe, and I’m sure you believe as well to try and educate people about cyber security, but if it’s not fear and uncertainty and doubt, what kind of stories should we be telling?
I think we’ve got to be careful around the FUD piece, first of all, because I totally agree we shouldn’t be using it consciously and intentionally, but I would also say unfortunately part of cyber security does come with an element of FUD. We can’t sugarcoat it, it’s not a nice experience, it’s not somewhere you want to be. Just like in the burglary story we spoke about earlier, people acted because of FUD. So we shouldn’t sugarcoat it, but equally that should not be our motivating factor to scare people to take action.
So the way I always do it is I’m lucky enough to be able to refer back to cyber crime cases that I investigated, I dealt with, I’ve seen firsthand. So I tell those stories and then intertwine them into what would now be what’s happening in the real world. So it might be an insider case that I dealt with or a certain crime case I’ve dealt with, whether it be cyber crime or not, use that story to then draw in the comparisons of an MSP’s life, a business owner’s life and then bring to them the sort of moral of the story being the action they need to take, the things they need to be thinking about.
But by doing that, it engages them and they are passively learning rather than having to sit through a presentation, hopefully, rather than having to give you a presentation while they’re waiting for the end.
That makes sense. And I worked with an MSP a few years ago who had a client who was about to sign up with them and their Outlook got breached and someone edited a PDF and they paid, I think it was a very large amount of money for a house purchase to the wrong bank account. And I don’t know how it is around the world, but here in the UK, if a lawyer does that, the lawyer is responsible for that money. So that nearly took that entire business down. And the MSP I knew was using that story to educate other lawyers about A) the dangers and B) this is how you protect yourself from this kind of business email compromise attack happening.
So for MSPs, obviously you’ve got your police career and your police stories to lean back on. For MSPs, for those who’ve had those scares, should they be referring to those and telling those stories anonymised, of course. But then what about those MSPs who are perhaps a little bit newer to the game, haven’t had those scares yet? Should they take the kind of stories that they’re hearing elsewhere and turn those into stories to use?
Yeah, certainly. So yeah, I also look at big cases or interesting cyber crime cases that happen internationally. So whether that be, we mentioned before the call Marks and Spencers in the UK, which is a large and a very old famous retail chain, they got hit last year by a cyber attack and that was big news across the UK. Not only was it on our mainstream media or the news every night, but people were seeing the impact in the shops because there was certain food that was missing, empty shelves and it felt very real.
So those are the exact type of cases and where you can draw out that human emotion, whether it be highlighting a character in the story, the victim or someone that’s impacted, to make it feel real. And like I said there, with the empty shelves, the sandwiches, people recognise that. They felt that because that impacted their day-to-day life. So when you find that moment in those stories, that’s the stories that you want to take forward because people relate to it.
Yeah, that makes perfect sense. One final question for you, Adam, in terms of how you tell these stories, what do you think is best? Should you turn them into videos? Should you do written stories? Should it be just conversations like we’re having or should it be all of these things?
Yeah, I think all of these things really. And I would say depending on the person, so some people might not like to be in front of a camera and talking and they may prefer the written word. Whatever suits you, all of them are absolutely legitimate, but if you find that you’re a better writer, write. If you find that you cannot stand writing, you’re no good at it and you want to be in front of a camera, whichever way you communicate best is the way for you, getting that message out there is the most important thing.
Yeah, I love it. Thank you. Thank you so much for some fantastic advice there. We are definitely going to get you back on a future podcast episode because I can imagine you’ve got a whole ton of other information and advice that you can share on cyber security. So just tell us briefly about Heimdal. What do you guys do and what should MSPs who are listening to this or watching this do if they want to have a conversation about improving the cyber security of their clients?
Certainly, yeah. So Heimdal are a unified security platforms. We cover network, we cover endpoint detection and we cover the human, the identity layer. So essentially if you are an MSP, I’m sure you’ll be using at least one of the products we offer. We cover everything from ransomware encryption to email security. So if you want to find out more, then go to our website, which is heimdalsecurity.com and equally a little plug for my webinars as well. I run a webinar every month. So heimdalsecurity.com/webinars where I run one webinar as a product webinar and the other webinar is all about threat intelligence, the latest threats from that month we have guests as well. So those two options are a way you learn more about Heimdal.
Most MSP owners are drowning in marketing tasks, telling themselves they’re saving money or keeping control, when in reality they’re just burning through their...
In this week’s episode As your MSP grows and you take on more staff, there’s an increased chance you’ll be criticised by those that...
Episode 186 Welcome to the MSP Marketing Podcast with me, Paul Green. This is THE show if you want to grow your MSP. This...
