How do I upsell security services to clients who only bought basic support?
Many clients signed up for help desk support years ago. Their security needs have changed; their agreement hasn't.
- Clients refuse security add-ons.
- How do we explain the need?
- Should security be mandatory?
Assess each client against a neutral standard, such as the Canadian Centre for Cyber Security baseline controls or NIST CSF, and show gaps in plain language. Tie them to business risks the client cares about: downtime, insurance, client trust. Offer security as a tier upgrade, not a list of tools. Some MSPs now make core security mandatory in every agreement.
Approach
| Step | What |
|---|---|
| Assess | Against a standard |
| Explain | Gaps and business risks |
| Offer | Tier upgrade with clear price |
| Record | Document declined recommendations |
Document declines
If a client declines, record it in writing. It protects both sides and creates a later conversation.
How we look at it at ShoutEx
We create security upgrade campaigns and QBR materials. Messaging without fear helps.
- Fear tactics.
- Tool lists.
- No standard.
- Declines not documented.
- Neutral standard.
- Business risks.
- Tier upgrades.
- Written declines.
What MSP owners and guidance say
Here is what MSPs and guidance say.
Government baseline controls for small and medium organizations.
Read the guidance →Community summaries describe recurring themes in public threads, not individual posts. Vendor pages describe vendor claims, so test them on your own calls.
Read next
Go deeper in the ShoutEx guides, or check the sources behind this answer.
We'll build upgrade campaigns and QBR materials.
Book a call →Follow-up questions
Should we drop clients who refuse?
Some MSPs do. Decide your policy.
Is a vCISO service worth offering?
For larger or regulated clients, often.
How do we price security tiers?
Per user, with clear inclusions.