Revisiting Vivienne Winborne and Mitchell Colton: Marketing as Education, Incident Response and the Real Test of Client Trust

Welcome to MSP Mastery Podcast, the podcast for MSP owners and leaders who want to build a better MSP, one that actually works for them.

I am Jeni Clift, joined by my husband and long time business partner, Nick Clift. Together, we unpack what is really working in thriving MSPs, including insights from the trusted partners and peers who support them.

In this episode, we step away from our regular guest format to revisit two previous conversations that stayed with us long after the recording ended: our episodes with Vivienne Winborne and Mitchell Colton.

Together, these two conversations highlight how client trust is built through authentic, educational marketing and how that trust is tested when serious adversity strikes.

We reflect on Vivienne Winborne’s insights about why marketing should feel like education rather than a sales pitch, why cold outreach rarely works and why MSP owners do not need to appeal to everyone.

Nick shares why finding the right client fit and standing by your core values matters more than trying to win every prospect. Some clients are simply not compatible with you, and you are not compatible with them.

We also revisit Mitchell Colton’s candid story of guiding his organisation through a serious cybersecurity incident. While the technical response is critical, clients are also focused on their business continuity, staff, reputation and what happens next.

This conversation explores why incident response plans must be practical rather than theoretical, how regular communication can reduce panic and how navigating a crisis with honesty and empathy can strengthen client relationships.

Here is what we covered together:

✅ Marketing as education: Why Vivienne Winborne believes marketing should help people understand the issues that affect them rather than push aggressive sales messages.

✅ Distinguishing marketing from sales: How marketing is about educating people on who you are, while sales is about solving a specific problem for a client.

✅ Escaping the cold outreach trap: Why cold calling and unsolicited LinkedIn messages rarely create genuine trust with business owners.

✅ Target market and client compatibility: Why MSPs do not need to attract everyone and should focus on working with clients who align with their values.

✅ Consistency over polish: Why showing up regularly and sharing real stories can be more effective than waiting for perfect production.

✅ Finding meaningful topics: How real client experiences, business challenges, mistakes and successful outcomes can create useful and authentic marketing content.

✅ Incident response plans in practice: Why an incident response plan cannot simply sit in a folder as a compliance exercise.

✅ Accountability during an incident: The importance of clearly assigning responsibility for technical remediation, client communication and the ongoing operation of the business.

✅ Empathy alongside technical fixes: Why understanding the human impact of an incident is just as important as restoring systems.

✅ Communication without panic: How regular and honest updates can prevent clients and team members from assuming the worst.

✅ Handling difficult truths: Why being transparent about what happened and acknowledging mistakes can build more credibility than trying to appear perfect.

✅ Crisis as the ultimate test of trust: How the way an MSP responds when things go wrong reveals its values, communication and commitment to its clients.

✅ Strengthening client relationships: Why managing a difficult situation with honesty, empathy and clear communication can deepen trust rather than damage it.

We created this podcast to share the real conversations and lessons we wish we had more of while running our own MSP, with practical insights from people who understand the challenges of this industry.

Connect with Vivienne Winborne on LinkedIn: Vivienne Winborne

Connect with Mitchell Colton on LinkedIn: Mitchell Colton

👉 Read more episode notes here: mspmastery.blog
👉 Watch on YouTube: youtube.com/@MSPMastery
🎧 Listen on YouTube: youtube.com/@MSPMasteryAudio
🎧 Listen on Spotify: open.spotify.com/show/4gftErFYrR8F80kthgvFbs
🎧 Listen on Apple Podcasts: podcasts.apple.com/us/podcast/msp-mastery-ctrl-alt-deliver/id1828105793

Transcript

Copy Transcript Copied

SPEAKER_01 0:00

The technical response absolutely matters, but clients also need to feel that someone understands the seriousness of what they're experiencing.

SPEAKER_00 0:10

The marketing is about finding people and educating them on who you are, and then sales is about actually solving a problem for that client. Some clients are just not compatible with you. You're not compatible with them. So be really clear on what your target market is and what your values are so that you can work together and talk about your values.

SPEAKER_01 0:33

Welcome to MSP Mastery, the podcast for MSP owners and leaders who want to build a better MSP. I'm Jenny Clift, and alongside my longtime business and life partner Nick, we draw on our 60 plus years of combined experience to explore what's really working in thriving MSPs. Our goal with this podcast is to share the real stories and hard-won lessons that inspire and add genuine value to our industry, helping you build a business that is both profitable and fulfilling. This is MSP Mastery. No special guest today, just Nick and I doing what I actually quite like doing these ones, revisiting a few topics from previous episodes. Today with Vivian Winbourne and Mitch Colton. Both were conversations that really stuck with us and we found ourselves reflecting on since we finished recording. Nick, welcome.

SPEAKER_00 1:31

Thank you, Jenny, and welcome everybody. Yeah, this will be a very interesting thing. It was a kind of a joint topic across two episodes. How to deal with shit.

SPEAKER_01 1:41

Pretty much, yeah. How to deal with shit. I think maybe we'll just call the episode this how to how to deal with shit. So let's jump into Viv's episode. It was actually during the recording of that we thought we have to get Mitch in. And I think we jumped the cue a bit with him when we recorded and then moved him up so that the two episodes came out back to back. So Vivian started off talking about marketing should feel like education, not a sales pitch. And I completely agree. But Viv made a really strong point about MSP marketing. It's not about constantly pushing products or asking people for a meeting before you've earned their trust, as they say, you know, don't propose marriage on the first date, but about educating people around the issues that genuinely affect them, whether that's cyber risk, AI, legislation, or changes in their industry, which is a big thing happening at the moment. But when you're consistently sharing useful information and helping people make sense of what's happening around them, you build trust well before they're ready to buy. So, Nick, why do you think many MSPs still find marketing uncomfortable or the big unknown? And how can they start treating it as a genuine service to clients and prospects instead?

SPEAKER_00 2:59

Yeah, it's something I I've always struggled with as well. But I do understand the concepts and that conversation with you was really good to cement a few things together. It's marketing is about educating people so that they know who you are and what you do, and ultimately what problem you solve, not what technology you use to do it, not how much you cost, not how many staff you've got, not where you're located. It's just generally giving quality answers to common solutions out there. The reason that BMSPs find it difficult is because they we don't buy that way ourselves, right? We go and try stuff, we get we talk to other people that have used the product. So that we use a lot of referral base when we're buying a tool or a product or choosing a partner. Sometimes it is relationship based, depending on the individual person you're dealing with at that vendor. But a lot of the time we're doing a lot of fact checking first around the back. So vendors that put education out in general are ones that uh have a better update, you know, because they are doing it. They're they're you know, you've got to give information away for free with no ex expectation of anything in return. You've got to, you know, you obviously don't want to give away your IP. No, but you've got to be giving value for people to to talk about and get in, get in the conversation. That's all you really want to. And then when you do have something that's really important or it's a groundbreaking thing, or something awesome that you've done, or you've won, or you've won an award, then you can start to promote that. And people go, Oh, actually those guys. Yeah, I remember hearing about them. Oh, they just did that. Oh, okay, cool. We'll just file that away. And next time I hear of somebody that needs that service or has that problem or I had that problem, they'll be one of the ones that comes to mind. Not the only one.

SPEAKER_01 4:46

Not the only one, yeah. And I think marketing often gets confused with selling, and they're two completely different things.

SPEAKER_00 4:53

Yeah, interesting. They cannot be treated as separate silos, though, because we 100% need to be literally singing from the same playbook. But the marketing is is about finding people and educating them on who you are, and then sales is about actually solving a problem for that client. They are completely different things, but you can't do one without the other, and you can't be selling something that you're not marketing and not knowing known for. And the last thing you want to be doing is having a doing a great LinkedIn campaign and a couple of webinars about a product or a service, then you your tech team don't actually, your sales team don't even know what that product is or what how how to sell it, you know. That's that's really bad.

SPEAKER_01 5:33

I often see people, you know, we're going to do cold calling, we're gonna ring people and ask to book a meeting with them. And I always what comes to my mind is how often when I get one of the many sales calls and actually answer the phone for a start, most of the time I don't, and they're selling something, how often do I say yes? And it's rarely or never. So, and I ask that question of the MSP owner, how often do you answer a cold sales call? How often do you say yes? Oh, they usually don't answer, and I never say yes. So, why are you using that approach as a marketing tool then? If it doesn't work with you, why would you think it worked with others? The chances are of your cold caller ringing an owner of a business at the exact moment that they think, oh, I need to find an MSP. It's pretty slim. Think about what works for you and how you want your business represented and your your brand, your marketed, and make sure it's in alignment with that.

SPEAKER_00 6:38

It just made me think of something really funny. I can't remember where it happened, but somebody said, Would you want you as a client?

SPEAKER_01 6:45

Oh, that's a bit controversial.

SPEAKER_00 6:47

So the way you behave and your way you operate and the way you treat people trying to sell to you, would you want you as a client? Good point. And you've got to think about that. Because if if you would want you as a client because you value technology and you fit all the boxes, but you don't want to be cold call, well then, mate, don't do that. Like Jenny just said, don't do that to try and get people in the door. Yeah. Yeah. But who do you want to be and who do you want to attract and who do you want to work with? And like one of the things that that Jenny and I have always said is one of the things we learned from the EOS journey is that you know the EOS life and it is doing what you love with people you love. Like some clients are just not compatible with you. You're not compatible with them. So be really clear on what your target market is and what your values are so that you can work together and talk about your values. And when you're talking and when you're out there promoting the business or doing whatever, coming on a podcast or doing it, writing an article, use your values that you want to attract as a client because there's no point having a client that is not compatible with your values.

SPEAKER_01 7:50

I remember getting a completely cold message on LinkedIn from somebody who'd sent a connection request, which was immediately followed up by this awful message that was misspelled. I think they got my name wrong. And they were selling their services as LinkedIn outreach. And I thought, if this is the quality of the work that you do, really? It was just astonishing. And I see it all the time. You know, people reaching out in a way that is icky, is the word that comes to mind. But is that how you want your brand to be seen? So I guess the other part for me is make sure that if somebody's marketing doing some work for you, just make sure you're watching it. And if you look at it and cringe, and that's your brand being represented, you're going down the wrong path.

SPEAKER_00 8:42

And like like look this right now. Like we're we're sitting here recording and talking, and we are putting out who we are. So if somebody wants to evaluate Jenny or Nick to see whether we're compatible with them to work as a coach or an advisor or help them with a project, you're gonna know who the real us is. Just listen to one of our 50 episodes, read a bit of the LinkedIn stuff. You know who we are. So we're putting ourselves out there so people can, you know, and people do judge and they evaluate and say, oh, well I'm not like what is that idiot talking about? Like that's okay, because you don't want to attract every single what? There's what is there, five billion people in the world? And let's be honest, guys, we only ever want 30 really good customers. Yeah, if you're in my view, if you're in the MSP world and you're working as a founder of a business that's engaged in the activities, yeah, once you get above about 30 good, fully engaged clients, then you become something other than the MSP. You become a systems integrator, you become the next phase up and you you have removed yourself from the day-to-day operations of that business and it's a different kettle of fish. But if you're just trying to build it up and you, you know, most of our clients that most of the listeners on here are in that 10 to 20 staff range kind of if you had 30 awesome, absolutely best as best as clients, it's only 30. So you don't want to attract everybody. So don't worry about that. I was paranoid about doing this stuff, and oh, I'm gonna, you know, some people won't like what I say, I might offend someone. Or that's great. You know, like you need to get nine no's before you get the tenth one that says yes. So it's not not about every single contact, every single person you meet, you talk to. I I mean I've I've I don't do that anymore. I used to used to think, well, am I gonna go to an event and invest my time and effort? And how many business cards did you swap was a classic thing. That was the marketing of the 90s and 2000s. Go to an event and swap 10 business cards and then you harass the crap out of them until they commit to do something with you.

SPEAKER_01 10:45

Like if I say yes, will you stop ringing me?

SPEAKER_00 10:47

I I have actually signed up to something that was a cold call once, but it was just such a random thing that happened to be exactly the problem I was having at the exact time.

SPEAKER_01 10:56

Yeah, one in 63 years, yeah.

SPEAKER_00 10:58

Yeah, and it didn't work out in the end anyway. So, you know, blah, blah, blah. But yeah, it's very rare. So yeah, putting putting information out there, yeah, marketing is about awareness. That's that's what it's all about.

SPEAKER_01 11:08

And I think what you said about, you know, us and we don't appeal to everybody and that sort of thing, which is fantastic. Consistency matters more than polished content. So making sure that, you know, if you say we're going to put something out twice a week, that you don't do it for three weeks and go, I haven't got anything from it, so I'm not going to do that anymore. You have to commit and you have to do that consistently. Way more important than polished content. Use our podcast as an example. You went and got your hair done today. You went and got fresh. But my hair is minimal makeup. We're here in our office in Bali. We could book a recording studio every time. We could, you know, have it super polished, cost us a fortune. It would be inconsistent because we'd have to, you know, allow four times as much time as we do now. And for for what? We committed to getting a podcast out every week. We're nearly a year in now and we've missed one week through a screw up. But it's consistent. It comes out every week. They're all around the same sort of time. Far more important than perfect hair and perfect makeup and a perfect location. And I guess the final part of that is what do we talk about? How do we find topics that our clients are wanting to listen to? So you're doing your marketing however that whether it's a newsletter or a podcast or a LinkedIn post, whatever. But how do we find topics worth talking about that our clients will be interested or potential clients interested in listening to?

SPEAKER_00 12:38

For me, it's a thousand percent just stories. You can sign up to you know MSP marketing gurus and they'll generate their probably use AI these days, but even if it's not AI generated, it's still like it's the same content regurgitated. It irks me when I see someone from an MSP posting something about a Microsoft 2FA. What the fuck? Tell me a story about where you save someone a hundred thousand dollars by implementing the technology or what was the problem you saw? What was the story? Like, I don't need you to promote a Microsoft ad. That to me, sorry, guys that do that. I just that's not what I'm talking about. That's not marketing, that's not thought leadership. That is regurgitating a vendor's slop to do something and tick the box that says Tell us what you really think, Nick. Because I used to do that. That's to tick a box to say I did a post this week. Well, you didn't even do the friggin' post, right? You've either got some automation doing it for you or the vendors doing it on your behalf, or you're paying a VA to type it in your own, you know, like the good thing about Jenny and I, we do our own posts. Yes, we use AI to do research, 100%.

SPEAKER_01 13:45

And for the final polish so that it sounds and reads well.

SPEAKER_00 13:49

Because I'm my spelling and grammar's not great, but we write our own topics. We sit down and we talk about it and we figure out what topics. So if you're struggling for a topic, just think about what happened in your life last week. When was the last time you got an absolute serve from a client? Tell that story and what the great outcome was at the end of it. Or when did you get a customer out of the blue ringing you up and say, God, you guys saved our asses. You are awesome. Yeah, and that's why we ask these questions on the podcast, because they are the things that people want to listen to. They're the things they relate to, is there stories about what you're doing and the problems you're solving. And yes, you can weave, if you really want to weave some technology in there, weave it into the story, but don't just regurgitate some other pre-canned crap. Anyway, off my soapbox.

SPEAKER_01 14:31

And I'll get on the soapbox for a second. If you are signed up to a program, then I can pretty much guarantee that everybody who signed up to that program is going to be rolling out the same slop as you are. If it's not this week, it's last week or it was next week, but it's going to be the same, same. So we talked in an earlier episode about adding value. And to me, that's not adding value. If you're just rolling out the same stuff as everybody else, you look the same as everybody else. I'll get off the soapbox now as well. Let's go to a different topic. Mitch talked about he had an incident response plan in his business. And unfortunately, he had to use it. They had a major incident. So he gave us, I guess, that practical reminder that an incident response plan is essential, but the document itself is only the beginning. When a serious incident happens, as they did, people need clarity, direction, and confidence in who is doing what. So the plan needs to reflect how the business will actually operate under pressure. It needs clear responsibilities, trusted people, practice communication, and an understanding of the decisions that must be made quickly when the stakes are high. So, Nick, when a business is under real pressure, and we've been in this situation ourselves a long time ago, we had an incident as well. When a business is under real pressure, what makes the difference between a plan that sits in a folder and a plan that genuinely helps the team respond well?

SPEAKER_00 16:05

I think the difference is the mindset of the leadership team. Like if you're having an incident response plan because you're ticking a box for your ISO certification or your SMB gold, whatever it is, that's not the way to do it. Right? That means nobody really knows where it is. Nobody's actually read it. And and then the the other end of the scale is you've actually done a desktop table, what they call a tabletop exercise, where you run through the scenario of it actually happening. And not too many people do that. Yeah, I probably didn't do that, but I definitely read it. I we we made sure everybody knew where it was. We made sure we and when when that actually happened, I mean, the thing, I think the critical thing about when a big bad incident happens is somebody needs to be accountable to run that incident that's not going to be distracted by the day-to-day operation of your business because your business still has to run. Yeah. Right. So you've got to treat it like a client server outage, you know, for us old school guys that know what that means. That that that hurts. You get that phone call. Oh, can't access the network drive, can't print. Hang on, can't access the network drive. Hang on. Email's down. Oh, the RAID's just crashed on the server, right? That's like the worst case phone call you get as an MSP. You know, you don't get that so much these days, but you know, but the whole customer network's down. So we need somebody to communicate with the customer, the staff at the customer, our team, and then we need someone else to manage the fixing of the problem. And you've got to be really clear to delineate those. And in the modern world of cyber insurances and bits and pieces like that, you may have a, and Mitch talked about that in his podcast in the details of that. So go to that episode for the details. But basically, depending on what your scenario is, you may outsource the management of the incident to someone else and you become a provider to them to do the work. So you've still got to treat that as work to be done, but you have to look after your existing clients and communicate to those clients. Like we we had tools deployed to our clients' machines that we could send messages to everybody at every client, or just the leadership teams, or you know, we had email lists for managers, we had, but we had a deployment method. If it was a major outage like Telstra had, yeah, Telstra, blame Telstra, blame Microsoft, whatever. So a major provider that's got an outage that impacts multiple clients, instead of having a help desk get flooded by 20,000 phone calls that day, we would send a message out, a broadcast message out saying, hey guys, just letting you know this is this this is an outage, it's happening, impacting, blah, blah, blah, blah. And obviously, if there it impacts email, you can't send that by email. You've got to be logic. So I suppose having a plan, to get back to your point, Jen, having a plan, but also the accountability in that plan is the most important thing. Because when you get that horrible phone call or something's happened, you don't think logically. You don't make great decisions in the heat of the moment, in the urgency of what's going on. So having that documented so you know what to do, you know. Absolutely.

SPEAKER_01 19:00

And that preparation reduces, I guess, the panic. And whether that's your client who's panicking or clients who are panicking, but also your team, you know, who's going to what needs to be done, who's going to be doing it. And, you know, people, different people react differently to crisis. So that preparation definitely helps reduce that panic. But as you said, it also helps them make better decisions and having that clarity around dividing up tasks, who's going to manage the communication, who's going to oversee that team, who's going to take care of business as usual, and really making those decisions early, communicating. And I think there's two parts of the communication as well. There's that external communication piece that Mitch talked about through, you know, they used their marketing team for that. They also had insurers involved. But, you know, just a smaller incident, or as in our case, when we had that breach years ago, it was one client, but it was our way, well biggest client. You know, how are we managing that external messaging? But that internal communication, communication piece is a is a big part of it of making sure that your team know, say somebody takes a phone call and it's a journalist, what do they do? Do they say something that ends up as a headline somewhere? Do they know who they should refer that call to? But that internal communication and, you know, and if I look back through our journey through the COVID piece in Melbourne, we probably over-communicated with our team where every week we would give our team an update on exactly where we were as a business. Because if you don't tell people stuff, they will make it up. So pretty much every week for two years, we gave them an update. Our estimate was that the business would take a 30% hit. And, you know, we're at 29%, we're at 30%, we're at 31%, we're at 30%, we're at 30%. But every week, so we're not panicking. They knew that we were okay. We had a plan, we were managing to that plan. And so that internal communication is so important in these sort of situations.

SPEAKER_00 21:16

I've only had negative feedback from a client when we have not communicated well. It's never about that should not have, you know, shit happens, right? Minimize the risk and remediate as quick as possible, but you can't eliminate it. And if you think you can eliminate all the problems for a client, just never tell a client you can eliminate everything. And in the modern world today, where it's it's a shared journey, it's a shared responsibility model. Yeah, we can't be liable for all your cybersecurity risks because you have humans at keyboards, right? They're the ones that contribute to the problem. We don't personally train, coach, and manage every single one of those individual people, and we're not watching them every day. So that's on you if you want to go to that level. But it's a shared relationship and we need to. communicate equally both ways. And don't get it wrong, it's not always the MSP that has the communication problem. Sometimes clients don't, oh, this is not working. What did you change? Nothing. And then you find out two days later that they had an external consultant in there updating their website. And all of a sudden their email's not working. They got all this issues going with their network. But we didn't do anything. Well yes, you didn't do anything on purpose, but things happened.

SPEAKER_01 22:25

Or the I IT coordinator had nothing to do on a Friday night, so I decided to recable the server cabinet so it was neat.

SPEAKER_00 22:32

Yeah, with custom cut lengths of cables for each individual patch with solid core wire, not multi-core. Yeah, yeah, don't go there. But they didn't do anything and she lied.

SPEAKER_01 22:42

But that but that person lied on Monday morning when literally nothing was working and we said what's changed? She said nothing. And you know, four hours drive later she finally fessed up just before he arrived to say oh I'm sure it's got nothing to do with it but this is what happened. But we got the blame. She certainly wasn't taking that. So you cannot take the you know we'll manage everything approach. So let's continue on with that communication piece. And a big part of this is acknowledging the human impact. So we touched on this a little bit just now but one of the strongest lessons from Mitch's story was during that security interest incident that they got involved in, clients are not just looking for a technical fix. They're going to be worried about their business, their staff, their reputation and what happens next. So the technical response absolutely matters, but clients also need to feel that someone understands the seriousness of what they're experiencing. So that clear and regular communication can be just as important as the remediation work happening in the background. So Nick, when a client's panicking during an incident, how do we as an MSP balance giving them confidence, properly acknowledging how serious and frightening the situation feels for them?

SPEAKER_00 24:13

I don't think there's a textbook for this. I think it's just an innate empathy you have to need to have for the client to understand what's going on for them because it'll be different for every person in their business and and the owner will have a different set of feelings to one of the staff members or person on the front reception desk. Yeah they just need to know what to say or who to put the call through to but the owner's the one that's got his reputation on the line and and or or not or maybe it's something else going on. So I think it's just having really open and honest communication with them and and not fobbing them off.

SPEAKER_01 24:46

Yeah you can't just say it's fine don't worry about it.

SPEAKER_00 24:49

No. And you need to also not give false information. So sometimes you are going to need to dance around the issue a little bit to just give yourself some or the team a bit more time to come up with the right answer because you don't want to be committing to something or giving false hope when it's not the case. That that's probably the worst thing to do. So you don't want to say nothing like our big telco friends do when something happens they just deny everything until magically it's fixed. But no we didn't do anything nothing happened. So there it's a it's a fine line but it I don't think there's any kind of individual advice on that. It's about just really and and for yourself if you're in that situation you've got to have someone you can go to that's outside of the situation. Whether it's a good friend or if you're in entrepreneurs organization your forum you'd go and talk to them say this this just happened you get some moral emotional support whatever you need but you've you've got don't don't bottle it all up yourself. Yeah Jenny and I were very fortunate that we were we were both kind of obviously involved in the business and any issue and so far what have we been together nearly 40 years now we've not both been down in the dumps at the same time you know very rarely so if one of us is losing the plot we can always go to the other one say you know what that's the that's the beautiful thing about having a good solid business partner. If you don't have that then you've got some you've got to find some emotional support or mentor out there. Could be in your peer group could be in your your community group that you work with or church or football club or whatever it is the Friday night crew at the pub, there'll be somebody in your life that you can go and have a debrief with and a talk and go, oh my God. Because one thing I've learned in life is that no matter how bad it is for you right now, there are other people with worse problems. And no matter how good you've got it, there are other people that have it way better than you. So when you think you're at the bottom you're probably nowhere near it. And when you think you got everything completely sweet and it's awesome yeah you're nowhere near that either. So don't stress about that. Just worry about you in your place right now. How do you turn up to be the best you can be because that's probably the most important thing. You need to be the best person you can be for your partner for your life partner for your family for your business and for your clients and that's tough to manage all those things especially in the middle of a crisis. So get some help. Find a couple of people you can talk to that are outside of your normal inner circle that are not going to be emotionally involved in the issue. They're just going to worry about you and how to help you be the best you can be.

SPEAKER_01 27:24

Absolutely because you know clients will be looking to you your staff will be looking to you your probably your family looking to you to be the strong one and you really need somebody who can help you. Yeah. And I think the other part of this is being honest without creating unnecessary fear. So it's having the ability to to say what needs to be said but still give a sense of we've got this, we've got it under control. Listening, not just updating, you know, if if the customer client needs to or one of your staff needs to just vent, you got to just let them and be a bit what do they say Teflon? You know let it slide off you know it's probably not personal aimed at you not aimed at you it it's the situation. But how do we communicate what are we saying when there's actually no or limited new information but you've got to give that update you know how do you manage that?

SPEAKER_00 28:19

I would just say be honest. It's a regular update we've committed to do this and there's not much changed. The situation's under control if we're still doing investigations or whatever it is. We've got analysts working on this part of it. Everything's on track there's the breach or whatever has happened has been identified and remediated. Now we're doing the due diligence to figure out how to prevent it from happening in the future. Yeah you don't need to make up stories but there'll be some form of update even if the update is we're 72% through they're not going to know whether it's 52 or 72.

SPEAKER_01 28:53

And I guess it's committing if you've committed to communicate there'll be daily updates until further notice and then sort of not much is changing then you have to say we're going to go now to updates every three days but commit to those and make sure you do that because silence I think in these sort of situations is is a big big risk.

SPEAKER_00 29:14

Yeah and you guys guys just think about when you've been in a situation where you've had something go horribly wrong with a vendor and you've gone through the normal process and you've logged a ticket and you're getting nowhere then you've reached out to your account manager and you're still getting donuts and then you've reached out to the Australian director or whatever whoever your contacts are and you're still getting donuts. The reason you're getting nothing back they don't know what to say. That what pisses me off the most. So when you've got a good relationship with a vendor they will get on a phone call with you and say look we're still trying to figure out what happened. I mean I it happened with me and yeah one of our good vendors and a mistake was made in the back end of their system and they there was two companies in their worldwide database that had exactly the same name and they deleted the wrong one which just happened to be one of my clients but once I knew that I knew how to say what I needed to say to the client my client and we we recovered the situation. But not knowing makes you straight away think I can't trust any of this infrastructure because they don't know what happened. They're not telling me what happened so therefore I can't trust it. I can't trust it. I have to change you know and and in all honesty if you did your own due diligence if you had a a major outage with somebody or something and you didn't you never got to the bottom of it you have no choice but to change vendor. And that's where your clients are at. If you don't give your clients honest even if it's hurts and it's bad and you may lose that client you have to give them honest answers. Otherwise you're potentially going to lose a whole lot of stuff because they they had they won't have a choice. You know it's like that client that when we had our breach back in the 2000s we lost that client we gave them all the information we proved that it wasn't us that was at fault. We were not negligent but they didn't have a choice due to political pressure from inside that council they didn't have a choice they had to change a provider and I I it was unfortunate but I don't hold that against them. I was just that's just the political landscape you know but we were we didn't hold anything back. It was 100% open we we had the logs we had the firewall logs we knew exactly who did what when they did it and how they did it and yeah the federal police did it crime division did a really good job scared the crap out of us and the client but guy got convicted and um he went to he wouldn't I don't know if he went he did actually go to jail I think.

SPEAKER_01 31:31

Well he actually appealed his conviction yeah he got a suspended suspended sentence and a massive fine he appealed his sentence and the judge that heard the appeal told him that he would have sent him to jail did he want to continue with his appeal and he decided not to.

SPEAKER_00 31:49

The moral was even though we didn't do anything wrong in that case we still lost that client. We still lost the client and so but that shouldn't stop you from basically telling the truth what's going on because you need to yeah do the right thing. And we didn't lose any other clients so that was that was the other option we could have lost a lot of clients over that but it was just the one.

SPEAKER_01 32:08

Absolutely yeah okay let's jump into responding in a crisis as the ultimate test of trust. So again we've kind of touched on this so we deliberate deliberately ran Mitch's episode back to back with Vivian as I mentioned earlier. So Vivian talked about building trust from the start through that authentic helpful marketing long before someone becomes a client. And then Mitch shared in his episode what it looks like when that trust is tested in the middle of a company breach. And for him it was a lot of clients it wasn't just one. So authentic marketing is not only what you say in a newsletter on social media or in a presentation it is also how you behave when things go wrong. And I'm talking as a client not individuals but as a client. So presenting that united front everybody's presenting that same messaging. So a crisis can be one of the clearest demonstrations of an MSP's values communication and commitment to its clients Nick you talked before about values it's how we show up it's how we it's like our DNA it's how we operate as a whole Vivian talked about marketing being authentic, educational to build trust. Looking at how Mitch navigated his company's breach, do you think an MSP's best marketing can happen during its most difficult moments? And how does coming through a crisis with clients change the relationship compared with simply sending a monthly email?

SPEAKER_00 33:47

I think from memory that episode with Mitch it it he did use the commun the the process they went through really did solidify the relationship with their clients. I don't think they lost any clients out of the whole thing. Not a single one.

SPEAKER_01 34:01

Yep.

SPEAKER_00 34:02

And I think it just learnt well we we all learned lesson by listening to that story about that the fact that communication and open and honest is the way to go for sure. And I can reflect back to some of the issues I've ever had with outages in most of our bigger ones were government say hospitals or local government councils and you'd think that they would get really super pissed by having an outage and it was never the case it was what happened why did it happen what have you what have you put in place so it doesn't happen again. And that was like and one of the the massive ones we had was we the IT manager we put in an antivirus system way back in the early 2000s and one of his staff members kept complaining that one of these emails was blocked. So they sent it to the f to the IT manager who said yeah it's been blocked but he decided to open it and just see what it was anyway. And this was a was before crypto but it was I can't it was something to do with anyway it was a a network crawling bug that basically deleted files off Windows desktops. So his curiosity resulted in a hundred machines us having to re-image a hundred machines over the weekend. Now luckily we didn't get the blame for that because the IT manager made the actual mistake but we did get I did get called in and had to have a meeting with the CEO on bits and pieces and we just explained in clear terms what actually happened and I said it was an honest mistake. It shouldn't have happened. Yes there's nothing wrong with anything this is what we're going to do to prevent this in the system we need to trust these tools that if they say it's bad, it's bad. And no matter what the emotion of the person who thinks they should be able to have the right to open every single email and file that's mythically sent to them for some demon on the internet like why would this person get upset anyway? Like Jesus that's an issue that the management team had to take back and do education with their team because they'd never done any education about email within this organization. So to me that was a bad situation that could have gone really really bad but because we were open and communicated and we and we did and it happens time and time again I went in and we had an outage and I just yeah said to the client look we need two hours to fix this problem with performance issues and they said well it's one o'clock on a Friday just take the network down now. I said what do you mean we'll do it on the weekend no no they need to suffer some pain in this organization.

SPEAKER_01 36:21

It's all been it's all been way too nice for them yeah let them wear some pain.

SPEAKER_00 36:26

Honestly sometimes it is like not that you want to go and sabotage networks I'm not suggesting that at all. Definitely not but e even the the corporate services and the CAs sometimes people need to appreciate what they've got and the fact that the network is so super reliable that it doesn't hurt for them to have some outage to understand that we're doing maintenance to because we as MSPs we try to do everything silently behind the scenes after hours. And sometimes that's not to our best advantage we don't communicate about that stuff. And when you are doing updates and upgrades this is another thing you need to be communicating about that properly. But when it does turn into shit and at midnight on a Sunday you're still sweating bricks and haven't got the system back up yet, you've already been communicating with the client and you know what the backup plan and the rollback plan is. And the beauty of doing that in advance is your team actually knows what to do when it doesn't work. Because that's when you get into trouble when you you just go in and do something and assume everything's going to be beautiful and it doesn't work and then we have this once again if it doesn't work then that's effectively an incident and if you've got a plan and a backup plan then you should be able to come back out of that. So yeah I just think yeah it's a bit of a roundabout conversation but that's okay.

SPEAKER_01 37:40

No it's good because I think you know what I take from that is honesty is way more powerful than trying to appear perfect. And I've said this myself you know we employ people people are not perfect you know mistakes will happen. So honesty not throwing people under the bus but you know shit happens. And the other thing I think is to me what I took from Mitch's episode is a well handled incident and we've seen this in our business as well can actually deepen those existing client relationships because you're having real conversations they know that you're there for them.

SPEAKER_00 38:17

We picked up a a council client through they'd had an incident I think on the from memory Sunday they rang us on the Wednesday the entire council had been down for a couple of days and we called on the services of an ex-employee who was home in Germany and somehow or another he managed to get that entire network up was it Thursday overnight Thursday for example from sorry from memory deepen those relations relationships when you can step in be honest communicate well and get somebody out of a situation and and lots of lots of our clients over the years started off with a basic need or a problem and then we we worked with them built the trust and then they developed into long term super valuable clients from both sides you know okay let's wrap Nick thank you I really enjoy these episodes thanks for joining me and entertaining me. That's all right it's a nice sunny day here in Bali so you know Sunday afternoon what what better thing to do than sitting in an air conditioned room recording a few podcasts.

SPEAKER_01 39:25

Too hot to go outside I was going to say let's head to the beach and I uh maybe have a bintang but yeah we'll see. If this conversation hit home for you or got you thinking head to mspmastery.blog and keep the conversation going. You'll find all our episodes there and more wisdom from the peers and partners who are shaping the future of our industry. And make sure you subscribe so you don't miss future episodes. We've got plenty more great guests and stories coming your way. Until next time this is MSP Mastery