Week 3 of the MSP security playbook: build a prospect list

Week 3 of The First 90 Days, Client Posture's free 13-week security playbook for MSPs, is Build a prospect list. It's the third week of Phase 1 (Days 1–30, "Set up and baseline your clients and prospects"). By the end of week 2 you've baselined your existing clients. Now you point the same check outward.

The Phase 1 goal is a useful target to keep in mind: by day 30, "every client baselined, 10 prospects contacted, and a branded look that makes you seem bigger than you are." Week 3 is where those 10 prospects come from.

The three tasks in week 3

1. List 25–50 local businesses

The playbook names three places to look: "your vertical, your town, your referral partners' clients."

• Your vertical. Businesses like the clients you already serve well. You know their tools, their software, and what keeps them up at night.
• Your town. Local businesses you can meet in person and that can check your reputation locally.
• Your referral partners' clients. The accountants, lawyers, and other advisors you already work alongside serve businesses that could use you.

For each one, the domain is what you'll check. A named contact and how you're connected are what make the outreach feel personal later.

2. Run a passive, public-data check on each, and rank them

The playbook's instruction is to "run a passive, public-data check on each and rank them by how much work the findings open up."

Passive and public matter here. Phase 1's script page has a ready answer for the question "Did you scan us without asking?": "I only looked at public records: DNS, your website certificate, and your domain registration, the same things search engines see. Nothing was tested or logged into." Keep your check within that description, and you can say it honestly.

To judge "how much work the findings open up," the playbook's From finding to conversation reference maps common verified findings to the services they usually lead to:

The playbook's one rule still applies: "never put a claim in front of a client that you can't back up." Only verified fails count toward a prospect's ranking. Unknowns get an honest sentence: "Here's what's public, and here's what we'd check next."

3. Pick your top 10 and write each a short note

"Pick your top 10 and write each one a short note built on their real findings, not a generic pitch."

The playbook gives you a Prospect intro email for exactly this, tagged "Week 3 · top 10 prospects":

> Subject: Something I noticed about [domain]'s email

> Hi [Name], I run [MSP] here in [town]. I put together a one-page brief on [domain] from public records only, nothing invasive. [One win] is in good shape. The one thing I'd fix first is [one verified finding], because [plain reason].

> The brief is here: [link]. If it's useful, I'm glad to walk you through it in 15 minutes.

It follows the playbook's general advice for every script: "Each script names one win, one verified gap, and one next step." It also follows the guardrail to lead with what's working, then the gaps.

The one-page brief itself, and the same-day follow-up call, are week 4.

Why lead with email findings

The playbook recommends leading with email security because it's "visible from the outside, easy to show on screen, and easy to explain," and because it's "a fix you can scope, price, and finish in about a week." For prospects, an email finding is usually the clearest "one verified finding" to put in that intro note.

Where Client Posture fits this week

You can do week 3 with a spreadsheet and free DNS checkers. The playbook's "In Client Posture" note for this week: "paste or upload domains into Grow. It scans each one, ranks them by dollar opportunity from your Service Library, and drafts a pitch email and call script from real findings. You send it yourself. Client Posture never does."

Plan details:

• Grow is on Pro and Founding Partner, with 150 prospect scans a month. That covers a full 25–50 list plus room to re-scan and expand.
• Prospects are ranked by estimated dollar opportunity. On Pro, that estimate uses your own Service Library prices. Founding Partner doesn't include the Service Library, so the ranking uses Client Posture's default example prices instead.
• Each prospect lands on a pipeline board that moves through Brief sent, Viewed, Proposal, Assessment, and Won. Week 8 of the playbook is a review of that pipeline.

Week 3 checklist (from the playbook's 90-day checklist)

• 25–50 prospect domains listed
• Top 10 prospects picked

Check a prospect's domain now

Grade any domain's email security free →

Passive, public lookups of SPF, DKIM, DMARC, and MX, with points per check, the top three verified fixes, and Unknowns that never deduct. No signup needed to scan.

Get the free 90-day playbook (12-page PDF) →

Founding Partner: $1,999, one time. Founding Partner includes the Grow toolkit with 150 prospect scans a month and unlimited Security Briefs, plus 50 client domains with full branding (logo and colors), weekly rescans and change alerts, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →