Stop scaring prospects who already agree on cybersecurity

Stefanie Hammond opens this month's MSP Sales & Marketing BookClub with a prospect every managed service provider (MSP, an outsourced IT and security operator for small and midsize businesses) has met. The buyer has security gaps, budget, executive concern and a cyber insurance renewal coming up. Six months later the answer is still "we're thinking about it."

Hammond, one of N-able's Head Nerds, says in a MarketScale Studio segment that The JOLT Effect by Matthew Dixon and Ted McKenna gave her a different diagnosis for that stall. The prospect already agrees cybersecurity matters and that the proposed program makes sense. What stops the signature is fear of making the wrong call, and every tactic the seller reaches for next tends to feed that fear.

The argument has a dated edge. Challenger Inc. summarized the book's research in February 2024, putting 40% to 60% of lost deals in the no-decision column, and Gong published an updated talk-time analysis in August 2025 that cuts against one of the book's headline findings. For an MSP owner whose pipeline is full of qualified cybersecurity deals that never close, the cost is the selling hours a small team keeps spending on buyers who cannot decide.

Nine in ten sales calls carry indecision, and the win rate pays for it

Dixon and McKenna started in the spring of 2020 with 2.5 million recorded sales conversations from Zoom, Teams, Webex and similar platforms, according to Challenger Inc.'s February 2024 account of the study. Automatic speech recognition turned the audio into text, and machine learning then isolated 8,300 distinct factors tied to winning or losing. Dixon, who co-wrote The Challenger Sale, told The Quota in October 2022 that the closest precedent was Neil Rackham's SPIN Selling research, in which a team spent a decade physically sitting in on more than 32,000 sales calls.

The scale matters because of what it found. Win rates fell to 6% when buyer indecision ran high, according to Challenger Inc. That high-indecision band covered about 30% of the calls analyzed, the medium band covered about 60% and won at 30%, and some level of indecision showed up in nine out of ten calls.

Neither the authors' own site nor Challenger Inc. spells out how a conversation was labeled won or lost beyond a deal closing versus ending in no decision. The recordings also came from B2B sellers at large, not from MSPs selling security. Hammond's job in the book club is translation, and she starts with the split she thinks fits her audience best.

Dixon and McKenna found 56% of no-decision losses stem from fear of failure, not status quo preference. The remaining 44%, they wrote on their own site in October 2024, went to buyers who preferred to leave things as they were. Their point for sellers is that the playbooks on the market almost all attack that smaller share, the case for change, while the larger share goes unaddressed.

A nine-item security menu asks the buyer to be the architect

Hammond's second lesson is the one she says she has trained on for her whole consulting career. Traditional sales wisdom presents options, a good, better, best or bronze, silver, gold menu, on the theory that choice gives the buyer control. A typical MSP cybersecurity proposal can carry identity protection, endpoint protection, managed detection and response (MDR, an outsourced team that watches devices around the clock and reacts to threats), backup, recovery, awareness training, vulnerability management, patch management and compliance, plus different packages, terms and add-ons.

Every added package, Hammond argues, is another way for an anxious buyer to be wrong. The mechanism, as Dixon and McKenna describe it in their October 2024 post, is that too much choice raises the odds of a bad pick, so the buyer parks the issue until confidence returns, which it rarely does on its own. A firm recommendation works because the seller takes a share of the blame for any wrong choice, and that shared ownership is what lets a stuck buyer move.

Ted McKenna sorted that paralysis into three anxieties in an interview with Dreamdata published on 30 April: options overload, where configurations and service levels multiply; information overload, where the buyer suspects something critical is still hidden; and outcome uncertainty, where the buyer fears their company will be the exception that fails. Hammond's recommended script addresses the first directly. Based on the risk profile, the gaps identified and the outcomes leadership named, she says, this is the program I recommend and here is why.

The information request gets the same treatment. When a prospect asks for another case study, reference, white paper or comparison chart, Hammond's reply from the book is to agree and then ask what specific decision the extra material will help the team make. She draws the line between decision-enabling and decision-delaying information, and says the seller's job is to notice when research has become a substitute for deciding, without blocking legitimate due diligence.

Talk more, but only to recommend

The finding that surprised Hammond most reverses years of discovery training in which the customer does most of the talking. She notes that recent book club sessions had covered questioning, discovery and negotiation techniques that all push the seller toward silence.

Her reading is that the winners were advising, clarifying and recommending, and that listening still dominates discovery. At the proposal and negotiation stage, she says, the customer no longer needs another discovery question. The customer needs a professional opinion.

Gong's data runs the other way. Gong found reps who closed deals talked 57% of the time while reps who lost talked 62%. That came from an August 2025 analysis of 326,000 sales calls of at least ten minutes, where the overall average was 60% seller talk time, measured by the talk-to-listen ratio (the share of a call the seller spends speaking versus listening), a metric Gong has tracked since 2016, when it recommended 43% talking.

Gong's own conclusion softens the contrast. Its researchers called the gap modest, found that high performers held the same ratio whether they won or lost while low performers swung from 54% to 64%, and found that losing reps asked more questions, about 20 per call against 15 or 16 for winners. Long seller monologues marked lost deals, and interactivity, the amount of back-and-forth, separated top sellers more cleanly than talk time.

That leaves the MSP seller with two datasets that disagree on the number and agree on the texture. Gong's finding on questions and Hammond's on recommendations point the same way: more discovery questions aimed at a hesitant buyer do not move the deal. Hammond's distinction, talk when your expertise helps the customer decide, survives either set of percentages.

Urgency works until the buyer agrees, then it backfires

Cybersecurity sellers, Hammond says, are especially good at the cost of doing nothing: ransomware, breaches, downtime, cyber insurance, compliance, business disruption. Every day you wait increases your risk exposure. She has no quarrel with that language early in a deal, when the seller still has to establish the problem.

The trouble starts when the customer has said yes, we agree, we like the program, we need to think about it. Hitting that buyer with more breach statistics, she argues, deepens the indecision because the buyer is already afraid, just of different things: choosing the wrong MSP, a failed implementation, employee resistance, or a breach after the purchase that leadership pins on the person who signed.

The research behind that line is blunt. Pushing the case for change on a hesitant buyer backfired 84% of the time, Dixon and McKenna wrote. The figure appears in their October 2024 summary, and McKenna told Dreamdata that buyers fear an error of commission, a mistake they made, far more than an error of omission, a gain they missed, so pressure applied to someone already frozen makes inaction more likely.

That raises the obvious objection for an MSP: some urgency is real. An insurance renewal has a date, and a compliance audit has a deadline. Hammond treats the renewal as part of what qualifies a prospect in the first place, and in her stage rule the problem, its business impact and the challenge to the status quo all belong before the customer agrees, which is where a real deadline does its work.

After the yes, the tool that fits a real deadline is reassurance about the path, which is where Gong's conversation data lines up with the book. Gong found sellers who used risk-soothing language about opt-outs, guarantees and service level agreements won 32% more often. That analysis, published in April 2017 from hundreds of thousands of recorded B2B calls, treats an SLA, the contractual promise of what a provider delivers and how fast, as one of the phrases that calms a buyer.

Hammond adds a boundary from the other direction. A prospect asking for guarantees the MSP knows it cannot keep is, on her list, a warning sign of a buyer who cannot decide, so the reassurance has to be one the provider can honor.

Keep the whole program, deploy it in three bites

The lesson Hammond admits she struggled with is sell less to sell more. For a financial planning firm, a healthcare organization or an accounting practice, she says, a risk assessment that calls for identity protection, MDR, endpoint security, backup, recovery and security awareness is not negotiable, and pulling MDR out to make the deal cheaper leaves the customer exposed.

Her example runs in three monthly phases. Month one covers the identity pillar: multi-factor authentication (MFA, a second proof of identity beyond a password) and conditional access, the rules that decide which users and devices may reach which systems. Month two brings endpoint protection and MDR online, and month three puts backup in place along with backup validation and recovery testing, the exercise of restoring data to prove the backup works.

Hammond's phased rollout keeps every control in the program and moves only the calendar. The recommendation, the vision and the protection stay intact, she says, and what changes is the path to adoption. Hammond puts no price on the three-phase program, and the recording does not say how long each phase runs for a real client once an MSP's own engineering schedule is applied.

The phasing answers the third of McKenna's anxieties, outcome uncertainty, and the fourth JOLT skill, which Challenger Inc. labels taking risk off the table. McKenna told Dreamdata the fear of a mistake outweighs most incentives or discounts a seller can offer, so a smaller first step with a visible success test at the end of it targets the fear itself.

Where JOLT sits next to Challenger and SPIN

Hammond's closing argument is about stages, and it maps onto Dixon's own earlier work. Buyers are almost 60% through their journey before a seller appears, Dixon told The Quota. That was in October 2022, and it is why The Challenger Sale taught reps to show customers what should keep them up at night instead of asking what does.

Challenger Inc. wrote in February 2024 that a seller can run that whole choreography, teaching, tailoring and taking control of the sale, and still watch the buyer go silent, which is the gap JOLT is meant to fill. Dixon and McKenna describe JOLT as complementary to any selling methodology. The four letters are the sequence: judge the level of indecision, offer a recommendation, limit the exploration, take risk off the table, and Hammond's six controversies are the MSP-shaped version of those four moves.

The first of them flies in the face of the never-give-up mentality in sales: qualify the prospect's ability to decide, not only the ability to buy. Her warning signs are a buyer who keeps changing the evaluation criteria, keeps adding stakeholders, keeps asking for contract or package changes, offers verbal commitments with no concrete next steps, or never puts the seller in front of the person who owns the decision. Six months of that, she says, means the sales resources may be better invested elsewhere.

The signal Hammond points to is a sentence from the customer: yes, I agree, I know we need to change. From that moment, she says, the seller stops proving that the customer needs to change and starts helping them feel confident about how to change. The measure of the conversation becomes whether the cybersecurity decision feels clearer, safer and easier to defend for the person who has to sign it.