r/msp Launch Post — DRAFT v1
Last updated: March 9, 2026
Post Title Options (pick one):
Option A (Direct value):
I built a tool that generates external security reports for client QBRs and insurance audits — looking for feedback
Option B (Problem-first):
Cyber insurance auditors are asking for external security documentation — here's what I built to solve it
Option C (Show don't tell):
I scanned 50 random SMB domains to see what's actually exposed — the results were rough
Recommended: Option A or C — Option B sounds too salesy. A is honest, C is intriguing.
Post Body — DRAFT
[If using Option A title]
Hey r/msp,
I've been lurking here for a while and kept seeing the same pain come up:
- Clients need external security posture documentation for cyber insurance renewals
- QBR security sections are either manual spreadsheets or enterprise tools that cost $20K+/year
- Galactic Advisors requires a sales call, ConnectSecure only does internal scanning
So I built something.
What it does:
You enter a domain. It scans DNS health, SSL configuration, email security (SPF/DKIM/DMARC), exposed ports, HTTP security headers, and a few other things. Takes about 60 seconds. Outputs a scored report with specific findings and remediation steps — PDF you can hand to a client or an insurance auditor.
What it doesn't do:
- No agent install
- No access to client infrastructure
- No internal network scanning (that's what ConnectSecure is for)
It's purely external attack surface — what anyone on the internet can see about your client's domain.
Pricing:
$99/month for 100 scans (~$0.99/scan). I know UpGuard charges $79/vendor/month and BitSight is enterprise-only pricing, so I wanted something that actually makes sense for MSPs managing 20-100 clients.
Why I'm posting:
I'm not here to sell you anything today. I'm offering 5 free scans to anyone who wants to try it and tell me what sucks. Brutal feedback welcome — I'd rather fix problems now than after launch.
If you want to try it, drop a comment or DM me and I'll send you a link.
What I'm specifically looking for feedback on:
- Is the report output actually useful, or is it just noise?
- What's missing that would make this a no-brainer for QBRs?
- Would you actually pay $99/month for this, or is that too high/low?
Thanks for reading. Happy to answer any questions about how it works under the hood.
[If using Option C title]
Hey r/msp,
I've been building an external security scanning tool and needed to test it on real domains. So I grabbed 50 random SMB websites from Google Maps (plumbers, dentists, law firms, accountants — the kinds of businesses you manage) and scanned them.
The results were... not great.
- 72% had SPF records but no DMARC enforcement (spoofable email)
- 18% had SSL certs expiring within 30 days
- 41% were missing basic HTTP security headers (X-Frame-Options, CSP, etc.)
- 8% had open ports that shouldn't be exposed (RDP, SMB, database ports)
- 23% had DNS misconfigurations that could cause delivery issues
The scary part: most of these businesses probably think they're "secure" because they have antivirus and a firewall.
What I built:
A tool that scans a domain's external attack surface in about 60 seconds and generates a report with findings + remediation steps. No agent, no install, no access to internal infrastructure. Just what's visible from the internet.
I built it because I kept seeing MSPs here talk about needing documentation for:
- Cyber insurance audits (which are getting stricter)
- QBR security sections
- New client onboarding assessments
And the existing options are either enterprise-priced (BitSight, SecurityScorecard, UpGuard) or require a sales call (Galactic Advisors).
Pricing: $99/month for 100 scans. Works out to about $1/client if you're scanning monthly.
Looking for feedback:
I'm offering 5 free scans to anyone here who wants to test it on their own clients and tell me what's useful vs. what's noise.
Drop a comment or DM if you want access. Roast me if it sucks — I'd rather know now.
Key Elements (don't forget):
- Lead with value/problem, not product ✓
- Show real data/findings — need to actually run these scans before posting
- Acknowledge existing tools — ConnectSecure, Galactic, etc. (shows you know the space)
- Free offer with no strings — 5 free scans, no CC required
- Ask for specific feedback — gives people a reason to engage
- Don't link to the product in the post — let people ask for it (Reddit algorithm likes engagement)
- Be in the comments — respond to every comment within the first 2 hours
What NOT to do:
- ❌ Don't say "we" — you're a solo builder, say "I"
- ❌ Don't link the URL in the post body — looks like an ad, gets downvoted
- ❌ Don't post and disappear — engagement in first 2 hours is critical
- ❌ Don't get defensive about criticism — thank people for feedback
- ❌ Don't compare to competitors negatively — just state facts
- ❌ Don't post on Monday morning or Friday afternoon — worst engagement times
Best time to post:
Tuesday or Wednesday, 10am-12pm ET — MSPs are at their desks, not slammed with Monday fires or checked out for the weekend.
Follow-up comment to post immediately after:
For anyone curious about the technical side: it runs 17 different checks including DNS record validation, SSL certificate chain analysis, email authentication (SPF/DKIM/DMARC policy parsing), port scanning for common exposed services, and HTTP header analysis. All non-intrusive — nothing that would trigger any security alerts on the target domain.
Happy to go deeper on any of these if you're interested in what we're actually checking for.
Before posting — must have ready:
- [ ] 5 free scan codes or signup link ready to DM
- [ ] Landing page live and tested
- [ ] Scan at least 10 real domains to verify report quality
- [ ] Have 2-3 example report PDFs ready to share if asked
- [ ] Clear your calendar for 2 hours after posting to respond to comments
Engagement strategy:
- First 30 min: Respond to every comment, even just "thanks for the feedback"
- Ask follow-up questions: "What would make the report more useful for you specifically?"
- If someone says "I use X instead": "How's that working for you? What do you like about it?" (learn, don't sell)
- If someone roasts the pricing: "What would you pay for this? Genuinely curious about where the value threshold is."
- If someone asks for a feature: "That's a good idea — adding it to the list. Would that be a dealbreaker or nice-to-have?"
Success metrics:
- Good: 20+ comments, 50+ upvotes, 10+ DMs asking for access
- Great: 50+ comments, 100+ upvotes, 25+ DMs, follow-up post requested
- Home run: Makes r/msp front page, gets crossposted, people share screenshots of reports
This is a draft. Refine based on actual scan data before posting.
Built by ComplianceLayer — scan any domain for security compliance in seconds. Get your free API key.
Top comments (0)