For IT providers, MSPs and technology consultants
Run a cyber programme across your client base — and record every answer.
Assess each client against the Essential Eight or another recognised framework, train their staff, run safe phishing simulations, and turn the findings into recommendations your client actually decides on. Approved, deferred, or declined with the risk formally accepted.
- Framework assessment and maturity tracking per client
- Phishing simulations and training across the whole book
- Recommendations published to a client portal in your branding
- An immutable risk acceptance register with review dates
Priced per MSP, not per client seat. From 10 client organisations on MSP Starter to 250 on MSP Pro.
Across 12 assessed clients
- Clients assessed this quarter12 of 40
- Weakest strategy across bookApplication control
- Simulations run9 campaigns
- Approved this quarter7
- Deferred3
- Risk formally accepted2
Illustrative. Every client is a separate tenant, and access is scoped to the clients on your plan.
The commercial problem
You are not losing cyber work on technical merit. You are losing it to silence.
A recommendation that gets no answer is worse than one that gets declined. A decline is a decision you can record, revisit and reprice. Silence is a liability you carry for free.
- Client says yes — it becomes scheduled work
- Approved
- Client wants numbers — you have a live opportunity
- Quote
- Client wants later — with a date you can chase
- Deferred
- Client says no — and formally accepts the risk
- Declined
There is no fifth option. Cyber Guys removes “no response” as a possible outcome, which is the single biggest change most MSPs need in their cyber conversation.
Assess. Train. Simulate. Improve. Prove.
A productised cyber service, not a feature.
Each stage feeds the next, per client. An assessment gap becomes a recommendation you publish. A simulation failure becomes a training assignment. Both end up in the report you take to the quarterly review.
- Step 1
Assess
Find out where you actually stand.
Work through a recognised framework — the Essential Eight, NIST CSF 2.0, ISO 27001 readiness or your insurer’s questionnaire — and get a gap list instead of a feeling.
Learn more - Step 2
Train
Teach the people who make the decisions.
Scenario-based modules for staff, managers and owners, written in plain English and measured on judgement rather than on whether somebody reached the last page.
Learn more - Step 3
Simulate
Test readiness safely, with permission.
Authorised phishing simulations using approved templates, with follow-up training assigned automatically to the people who need it.
Learn more - Step 4
Improve
Turn findings into decisions somebody owns.
Gaps become prioritised recommendations in business language, each with an owner, a due date and a recorded answer — approved, deferred, or declined with the risk formally accepted.
Learn more - Step 5
Prove
Show the improvement to whoever asks.
Evidence records, verifiable certificates and reports that answer an insurer, a board, a major client or an auditor without anybody rebuilding the story from email.
Learn more
What you get
The tools that live between your technical assessment and the client's answer.
Framework assessment per client
Assess each client against the Essential Eight, NIST CSF 2.0, ISO 27001 readiness, cyber-insurance readiness or any of 13 frameworks — all sharing one control library, so the work compounds across the book.
Phishing simulations
Authorised simulations across your client base with approved templates, an approval workflow so you never act unilaterally on a client’s staff, and follow-up training assigned automatically. Recurring campaigns from MSP Growth.
Training for client staff
Assign scenario-based cyber and AI-risk modules to your clients’ people, track completion, and issue verifiable certificates under your own branding.
Risk explainer library
Twenty paid-access explainers. Each has a plain-English explanation, what could go wrong, signs of trouble, a client version, a manager version, a QBR talking point and pre-written risk acceptance wording.
Recommendation builder
A guided workflow: pick the client, the risk area, the explainer, a template, then customise the wording, urgency, owner, effort and cost. Publish it and the client is notified.
Client action portal
Your client gets a clean, branded portal — not a PDF attachment. Every recommendation shows what it means, why it matters, what happens if ignored and who needs to act.
Risk acceptance register
Filterable by client, category, urgency and review date. Every accepted risk is dated, attributed and immutable. Corrections create a new version rather than editing history.
Objection handling library
“We are too small.” “Isn’t this included?” “Microsoft already protects us.” Twelve real objections with a suggested response, a business explanation, a follow-up question and the next action.
Campaign builder
Run an MFA approval campaign or a payment verification campaign across your client base, with a manager checklist, linked training and an acknowledgement form.
QBR and management reports
Turn the quarter into an executive summary: completed actions, approved work, outstanding items, deferrals, accepted risks, training completion and readiness score.
Client staff training
Assign awareness or manager modules to your client’s people, track completion, chase the stragglers and export a completion summary they can hand to their insurer.
Co-branded or white-label
Your logo, your colour, your name in front of the client. Cyber Guys can sit visibly behind you, quietly behind you, or not at all — depending on plan.
A worked example
What happens when a client says no.
- 1
You recommend
Shared admin account in use. Plain-English explanation, high urgency, IT provider to implement, two hours estimated.
- 2
They decline
The practice manager clicks “Decline and accept risk” in the portal rather than leaving it unanswered.
- 3
They acknowledge
A statement appears explaining what declining may increase the risk of. They type their name, role and reason, and set a review date.
- 4
It becomes a record
An immutable risk acceptance record is stored with the exact recommendation wording, timestamp, and user. It appears in your register and your next QBR.
The acknowledgement they sign
“I understand this recommendation has been made to reduce cyber risk. I understand that declining or delaying this action may increase the risk of account compromise, fraud, data loss, downtime, privacy breach, reputational harm, insurance issues or other business impacts.”
Why MSPs adopt it
It changes what happens after the meeting.
- Cyber recommendations stop being technical emails and start being business decisions.
- Every quarter you can show a client exactly what they approved and what they declined.
- Declined work does not disappear — it sits in a register with a review date on it.
- When a client asks “why weren’t we told?”, you have the wording and the timestamp.
- Your team stops rewriting the same explanation of MFA for the eleventh time.
- Training completion becomes something you can sell, evidence and report on.
“The register is the bit that changed things for us. Every risk a client has ever declined is in one filterable list with a review date. That list is now the agenda for every QBR we run.”
Defy IT is the managed service provider where Cyber Guys started, and is involved in building and operating the platform. We publish their experience as the product’s origin story, not as independent validation. Independent customer results will be published as named case studies once those customers agree to be named. More about the relationship.
Stop carrying risk your clients never actually accepted.
See the recommendation builder, the client portal and the risk acceptance register on a real client action plan.