Your account manager is on a quarterly review when the client pivots to a question about ransomware. The AM pauses, says “let me have someone follow up,” and changes the subject. The security conversation dies right there, and a version of it plays out hundreds of times a day across the channel while the service, the pricing, and the delivery capability all sit inside the practice the AM works for.
Most MSPs treat this as a knowledge gap and run more training, but more training rarely moves the needle, because the real issue is fluency, not knowledge. Fluency takes a different program design, and the one below has four parts: three fluency levels, the competencies each needs, the tactics that build them, and the metrics that prove it is working.
Why Hiring Can’t Close the Security Skills Gap
The security labor market makes hiring the wrong lever, and the math has run against it for years. The 2025 ISC2 Cybersecurity Workforce Study documents a global shortage of more than 4 million unfilled cybersecurity positions, with demand outpacing supply in every region and the credentialing pipeline falling further behind.
The MSP signal is just as clear: among providers that haven’t added vCISO services, 32% cite a lack of skilled personnel as a primary barrier, per the 2025 State of the vCISO survey, even as 67% of providers now offer vCISO services and 96% report client demand for them. Demand is structural; the talent supply isn’t catching up on any timeline hiring can reach.
ChannelPro reframes the skills shortage as an MSP opportunity, not just a crisis, and that is the useful read. The MSPs winning in 2026 built systems that let the people they already have carry the security conversation. Hiring stays one input; fluency in the existing team is the bigger lever, because it’s the one you can pull this quarter rather than next year.
What Security Credibility Actually Requires
The trap most enablement programs fall into is assuming non-security staff need to be security experts, which the math above makes impossible. The staff member running a client conversation needs fluency, not expertise, and fluency means doing four things reliably inside the conversation.
Explaining why security matters in business terms comes first. Business risk, customer impact, regulatory exposure, and operational continuity do the work that threat vectors and CVE counts cannot do in an executive’s ear, and translating the technical reality into the business consequence is the skill to build.
Spotting a gap worth exploring is second. A passing comment about a vendor questionnaire, a complaint about an insurer asking too many questions, a story about a competitor hit by ransomware: the staff member learns to hear these as conversations waiting to start rather than remarks to nod through.
Describing the practice’s services without overselling or underselling is third. Two minutes, three sentences, the right specificity for the client in the room, framed as a deliberate scope rather than a product pitch or a vague reassurance.
Handing off cleanly when the conversation needs depth is fourth. “Let me bring our security lead in for the next call” reads as professional; “I’ll have someone follow up” reads as deferral and kills the momentum the staff member just built.
ECI’s partner case study names the dynamic: “It’s been able to take complex IT and security terminology and put it into an action plan for the average IT or security person to go and run with.” The capability was translation, not security knowledge, and the staff built fluency on top of structure already in place.
The Three-Tier Fluency Framework
Different staff need different fluency levels, and training everyone to the same depth wastes money while leaving some conversations underserved and others overserved. The framework maps three tiers to the competencies and roles each requires.
| Level | Core competency | What the staff member can do | Who needs this |
|---|---|---|---|
| Awareness | What the practice offers, basic threat landscape, common client triggers | Mention security in a relevant context; recognize a security signal in a client conversation | All client-facing staff |
| Conversation | How to ask qualifying questions, frame risk in business terms, handle common objections | Hold a 15-minute security conversation, qualify the opportunity, hand off cleanly | Sales, CSMs, account managers |
| Credibility | How to use assessment results, present security posture in QBRs, identify upsell moments | Lead an executive-level security conversation, walk the client through a posture report, recommend next steps | Senior AMs, vCIOs, sales leadership |
Awareness is the floor, the tier every client-facing person should reach. It’s cheap to get to, since a few hours of structured exposure to the practice’s positioning is enough, and the cost of staying below it is that client security signals go unrecognized and opportunities disappear inside the practice’s own conversations.
Conversation is the operating tier, where most revenue moves. Sales reps, CSMs, and account managers run their client work here, asking the qualifying questions that separate a passing comment from a real opportunity, framing services in business terms, and either closing the engagement or setting up a clean handoff.
Credibility is the leadership tier, where upgrades happen. Senior AMs, vCIOs, and sales leadership operate here, sitting with the client’s CFO, CEO, or board, walking them through a posture report, framing the strategic case, and recommending the next-tier service inside the conversation. That is what makes account expansion work.
The framework’s value is that it stops the practice from training everyone to credibility level (expensive and unnecessary) or stopping at awareness (which leaves the conversation tier undone). Each role gets the right depth, and the investment compounds across the team rather than fading after a one-off event.
Building the Enablement Program
A working program is a system, not a one-time training event, and most awareness training underperforms precisely because it’s built as content delivery rather than an engagement system, per Cybersecurity Dive. Cynomi’s guide on bridging the cybersecurity skills gap walks the operational version. Six tactics build sustained fluency.
Monthly 15-minute briefings are the backbone: what’s moving in the threat landscape, what’s changing in regulation, what clients are likely to raise, no single topic over three minutes.
A QBR slide library, pre-built by the security team for the AM to present, frames the client’s posture in business terms in three to five slides, so the AM walks through a narrative the security team built rather than improvising one in the meeting.
Client-facing summaries get written for non-experts to read aloud. One-pagers and posture snapshots flow from the security team to the AM, who sends the right one after the call, so the translation happens upstream.
Role-play is the gym for the conversation tier. Sales leadership runs short scenarios at the monthly session: the ransomware question, the vendor-questionnaire mention, the insurer complaint, the “we don’t need security” response. Three minutes of role-play and two of debrief per scenario builds the muscle that handles the real version on a live call.
Cheat sheets handle the top 10 client questions with three-sentence answer scaffolds rather than scripts. The AM internalizes the structure, not the wording, so the same scaffold survives different client contexts.
Handoff protocols define when and how to bring in the expert. “Let me bring in our security lead, say Tomás, for the next call to walk through your specific posture.” Structured, named, and momentum-preserving, the handoff moves from the conversation tier to the credibility tier inside the same call rather than into a follow-up that never gets scheduled.
Measuring Whether Security Enablement Is Working
The signs the program is working differ from the signs the training merely happened, and four metrics track whether fluency is compounding.
The clearest leading metric is the ratio of security conversations started by non-security staff to those started by the security team alone. It should climb over the quarters after rollout, as reps and CSMs surface opportunities the security team didn’t have to chase, with revenue following a quarter or two later.
Security service attach rate on existing accounts is next. The share of managed IT accounts also paying for security is the cleanest read on whether conversations convert, and the program raises it directly because the staff making the calls now know how to qualify.
Time from security question to qualified conversation tells you whether the fluency is real. Broken state: “I’ll have someone follow up,” gone for a week. Enabled state: the conversation continues in the moment and the follow-up gets scheduled before the call ends.
Client satisfaction with security communication is the lagging confirmation. Feedback, NPS, and retention all track whether clients feel they get clear answers from anyone in the practice, and clients routed to a specialist for every question retain worse than clients who experience the practice as fluent across its team.
Burwood’s partner case study puts the platform’s role plainly: “Cynomi is that assistant that would cost the equivalent of one or two full-time engineers annually. It allows me to drive the assessment process naturally, without spending years developing something ourselves.” The platform encodes the methodology and generates the client-ready outputs, giving non-security staff the structural depth they didn’t have to build before walking into the QBR.
You cannot hire your way out of the skills gap, and most MSPs keep trying anyway, losing the conversations their client-facing staff should be having every day. The fix is the program above: the tiered framework as the spine, the tactics as the muscle, and the MSP Growth Guide as the playbook for formalizing it. Build it once and the next ransomware question on a QBR becomes the opening of a conversation the practice was already equipped to have. Put Cynomi’s CISO Intelligence behind the team you already have, and they deliver expert-level guidance, with the structure underneath them, across every client and every maturity level.
Table of contents
