Week 4 of the MSP security playbook: send short security briefs and follow up fast

Week 4 closes Phase 1 of The First 90 Days, Client Posture's free 13-week playbook for MSPs building a security practice. Phase 1 (Days 1–30) is "Set up and baseline your clients and prospects," and its goal is "every client baselined, 10 prospects contacted, and a branded look that makes you seem bigger than you are." Week 4 is where those 10 prospects get contacted.

The week is called Send short security briefs and follow up fast, and it has four tasks.

1. Send your top 10 prospects a one-page brief

In week 3 you listed 25–50 businesses, ranked them, and picked a top 10. Now each of those 10 gets "a one-page brief: what's working, what's not, and how you'd fix it."

Keep the brief inside the playbook's guardrails:

• Lead with what's working, then the gaps.
• No breach claims, no "you've been hacked." A public check shows configuration, not compromise.
• Don't call an external check a pentest.
• Only verified fails become recommendations. Unknowns get an honest sentence: "Here's what's public, and here's what we'd check next."
• End with one next step.

The playbook's "finding to conversation" sheet gives plain-English wording for common findings. For DMARC that's missing or at p=none, it suggests: "Right now, anyone can send email that looks like it came from you, and receiving servers aren't told to block it." For SPF problems: "Your list of who's allowed to send as you is incomplete, so some real mail may land in spam."

2. Call the same day they open it

The playbook's instruction is to "call the same day they open it, while it's still on their screen." Its Brief-open call opener script, tagged "Week 4 · same day they open it," is:

> "Hi [Name], it's [You] from [MSP]. I sent over a short brief on [domain]'s email and website setup. It's all public information, nothing invasive. The good news is [one win]. The one thing I'd fix first is [one verified finding], because [plain reason]. Want me to show you how we'd handle it?"

Be ready for the two questions the playbook says you'll get on these calls:

• "Is this a pentest?" "No, and I won't call it one. It's a check of what's visible from the outside. If you need a pentest for a contract or insurer, I'll bring in a partner for it."
• "Did you scan us without asking?" "I only looked at public records: DNS, your website certificate, and your domain registration, the same things search engines see. Nothing was tested or logged into."

3. Send an insurance questionnaire to 2–3 friendly clients

Week 4 also looks ahead to insurance season. The playbook says to "send a cyber insurance readiness questionnaire to 2–3 friendly existing clients," and to "frame it as renewal prep, not a sale." Its Insurance prep note script reads:

> "Hi [Name], when does your cyber insurance renew? Carriers keep asking more about MFA, backups, and email security. Here's a short questionnaire: [link]. I've filled in what I could confirm from the outside. Take a look at the rest, and we'll make sure your answers are accurate before the application is due. You confirm every answer; I'm just helping you prepare."

The guardrail here is "insurance answers belong to the applicant." The playbook notes that things you can't see from outside, "like MFA, backups, and endpoint protection, are exactly what cyber insurance applications ask about." That's the bridge to the paid assessment in week 5. Week 11 comes back to insurance season in full.

4. End of month: review what got replies

"Review what got replies. Keep the tools that earned their place." Then check yourself against the playbook's Day-30 scorecard:

• 100% of client domains baselined and reported
• 10 prospects sent a brief built on their own findings
• 2–3 clients started on insurance renewal prep

Phase 2 (Days 31–60) starts next, with week 5 ("Package a paid assessment") and week 6 ("Turn findings into proposals").

Where Client Posture fits this week

You can write briefs and questionnaires yourself. The playbook's "In Client Posture" note for week 4: Security Briefs "go out under your logo with a projected grade and your booking link, and you get an alert when the prospect opens one." The insurance questionnaire "is a no-login link that the scan pre-fills where it can prove an answer. It's on every plan, Free included."

Plan details: Security Briefs are 2 a month on Starter, and unlimited on Pro and Founding Partner (with 150 prospect scans a month). Open alerts come by email and in the app, on Starter and above, when the prospect opens the Brief link (opens of a downloaded PDF aren't tracked). Questionnaire answers are labeled by source, and the applicant confirms every answer. It isn't insurance advice.

Week 4 checklist (from the playbook's 90-day checklist)

• 10 briefs sent, with personal notes
• Same-day call on every brief open
• Insurance questionnaire to 2–3 clients

Build your first brief

Grade a prospect's email security free →

You get one transparent grade from verified SPF, DKIM, DMARC, and MX checks and the top three verified fixes. It's a defensible starting point for a brief. No signup needed to scan.

Get the free 90-day playbook, with all the week 4 scripts →

Founding Partner: $1,999, one time. Founding Partner includes unlimited Security Briefs (150 prospect scans a month) with open alerts, the insurance questionnaire with scan auto-fill, the Grow toolkit, and 50 client domains with full branding (logo and colors), weekly rescans and change alerts, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →