r/msp Launch Post — READY TO POST
Subreddit: r/msp
Best time: Tuesday 9-11 AM ET
Tone: Data-first, genuinely helpful, tool mention is casual at the end
Title Options (pick one)
- "I scanned 100 MSP client domains for security issues — here's what I found"
- "PSA: Most of your clients probably have F-grade security headers"
- "Ran external security scans on 100 small business domains. The results were rough."
Post Body
I built a tool to scan external infrastructure (SSL, DNS security, HTTP headers, open ports) and give each domain an A-F grade. Figured I'd run it against a sample of small business domains to see what the landscape looks like.
Scanned 100 domains. Here's the breakdown:
| Grade | Count | % |
|---|---|---|
| A | 3 | 3% |
| B | 12 | 12% |
| C | 31 | 31% |
| D | 38 | 38% |
| F | 16 | 16% |
Most common issues:
- Missing Content-Security-Policy header — 89% of domains
- No DNSSEC — 84% of domains
- Missing X-Frame-Options or weak config — 71%
- TLS 1.0/1.1 still enabled — 23%
- Open ports that shouldn't be exposed — 18%
The A grades were all tech companies with dedicated security teams. Most SMBs had never touched their security headers.
The takeaway: There's a gap here. Most businesses have no idea their external posture is this exposed. For MSPs, this is either a risk (clients getting breached) or an opportunity (upsell security services with real data).
The tool: I've been using this internally, but figured others might find it useful. It's at compliancelayer.net — free tier gives you 10 scans/month, enough to audit a few client domains and see what turns up. No sales pitch, just built it because I needed it.
Happy to answer questions about the methodology or findings.
Comment Strategy
Be ready to respond to:
- "What scanners are you using under the hood?" → Be transparent (Shodan, custom TLS checks, header analysis, etc.)
- "How is this different from Nessus/Qualys?" → "This is external posture only, not agent-based vuln scanning. Different use case — think of it as what an attacker sees from the outside."
- "Can I white-label this for clients?" → "Working on that. DM me if you're interested."
- "Pricing?" → "$99/mo for 100 scans, scales from there. Free tier for testing."
Cross-Post Schedule
- Tuesday 9 AM: r/msp (main post)
- Tuesday 11 AM: r/sysadmin (slightly different angle — "external security posture for small orgs")
- Wednesday: r/MSSP, r/netsec
Pre-Post Checklist
- [ ] Run 100 real scans on SMB domains (need actual data, not made up)
- [ ] Screenshot a few anonymized reports for comments
- [ ] Make sure compliancelayer.net loads fast and signup works
- [ ] Have Robert's Reddit account ready (aged account > new account)
Draft ready. Robert approves → post Tuesday.
Built by ComplianceLayer — scan any domain for security compliance in seconds. Get your free API key.
Top comments (0)