FIELD NOTE 04
What a Domain Can Tell You—and What It Can’t.
Understand what public-domain evidence establishes, which internal conditions remain unknown, and when customer-approved Microsoft 365 access is needed.
Read the field note →INSIGHTS · MICROSOFT 365
Tenant evidence with the boundary left visible.
Field notes on identity, MFA, guest accounts, connected applications, and what a read-only Microsoft 365 source can support.
FIELD NOTE 05
The Questions Your Client’s Tenant Can Answer Before They Do.
Related: [Guest accounts now outnumber employees two to one](/insights/microsoft-365-guest-accounts) Hand a business owner a security questionnaire and…
Read the field note →FIELD NOTE 06
Your Client's Cyber Insurance Application Is a Sales Document.
Related: [MFA adoption statistics for small business](/insights/mfa-adoption-statistics-small-business) Somewhere in your client's filing cabinet, or more…
Read the field note →FIELD NOTE 08
Renewal Season Is the Best Sales Season Nobody Uses.
Every MSP I've ever met complains about the same thing. Outreach is miserable. Cold calls go nowhere, email campaigns get deleted, and the marketing dollars…
Read the field note →FIELD NOTE 09
The App Nobody Remembers Approving.
Every Microsoft 365 tenant I've seen scanned has at least one, and most have a dozen: an application, connected years ago, holding permissions nobody can…
Read the field note →FIELD NOTE 10
Your Clients Already Connected AI. Here’s What the Tenant Can Prove.
Every MSP is preparing for the conversation where clients ask about adopting AI. I have news: the adoption already happened. It just didn't go through you,…
Read the field note →FIELD NOTE 16
Why We Refuse to Read Your Files.
When we designed the SCOUTz collector architecture, we made a decision that cost us features and I'd make again tomorrow: the platform does not read…
Read the field note →FIELD NOTE 20
Outside-In Scores Are Estimates. Tenant Data Is Evidence.
Related: [SaaS security in 2026](/insights/saas-security-2026) There's a booming category of tools that will hand you a security score for any company on…
Read the field note →FIELD NOTE 22
Eight Business Worries. One Consented Assessment.
Here's a mistake I made for years and watch other MSPs make daily: assuming clients care about security the way we care about security. We think in…
Read the field note →FIELD NOTE 23
A Domain Scan Won’t Win the Deal. It Wins the Conversation.
Think about how an MSP walked into a first meeting ten years ago. A business card, a folder of references, maybe a co-branded brochure from whatever vendor…
Read the field note →FIELD NOTE 25
Scanning Without Asking: The Boundary for Read-Only Assessment.
There's an uncomfortable fact at the front door of this whole business, and I'd rather address it head-on than hope nobody notices. The read-only domain…
Read the field note →FIELD NOTE 26
What a Read-Only Domain Review Actually Does, and the Rules It Follows.
I've talked a lot about the free domain review as a conversation starter, so it's time to open the hood. What does a read-only domain review actually…
Read the field note →FIELD NOTE 28
Zombie Licenses: Payroll for People Who Don't Work Here.
Every company has an offboarding checklist, and almost every one of them contains the same hole. Collect the laptop. Disable the account. Forward the mail…
Read the field note →FIELD NOTE 31
The MSP's Real Moat Isn't the Stack. It's the Relationship.
RMM, PSA, EDR, backup, SOC, documentation, AI: most MSPs can buy roughly the same categories of tools. A competitor can copy a stack faster than they can…
Read the field note →FIELD NOTE 32
Domain Review vs Cloud Review: They Solve Two Different Problems.
Picture two browser tabs before a first meeting. One can read the company's public domain records without asking anyone for access. The other cannot open…
Read the field note →FIELD NOTE 35
AI Is Out of Control. That Doesn't Mean We Should Lose Our Minds.
An MSP opens an application list and sees ChatGPT, Copilot, an AI meeting assistant, and three products whose AI features arrived during ordinary updates.…
Read the field note →FIELD NOTE 42
AI Does Not Become a Service Until It Has a Boundary.
Putting AI in a service description does not create an AI service. It creates a claim. A real managed offering needs a defined customer, a supported use…
Read the field note →FIELD NOTE 43
You Cannot Hire Your Way Out of Manual Security Work.
More talent helps. It does not repair a workflow that asks every new technician to rediscover the same process. MSPs lose capacity in the spaces between…
Read the field note →FIELD NOTE 49
The Prospect Should Become the Client Without Losing the Story.
The usual MSP sales process loses information at every handoff. Marketing has the campaign context. Sales has CRM notes. The assessor has scanner output.…
Read the field note →FIELD NOTE 51
Those Product Screens Are Real. AI Didn't Invent the Product.
I have stood at a conference kiosk looking at a perfect dashboard on the big monitor while the actual demo ran on a laptop turned away from the room. The…
Read the field note →FIELD NOTE 53
The Goal Wasn't More Leads. It Was a Better Conversation With the Lead You Already Had.
There is always another list available. More companies, more contacts, more titles, more phone numbers, more records to move into a sequence. Those tools…
Read the field note →FIELD NOTE 56
The Prospect Has Google Too.
The modern buyer does not wait for the MSP to explain what an MSP is. They can compare websites, reviews, service lists, certifications, vendors, pricing…
Read the field note →FIELD NOTE 59
SCOUTz Doesn’t Close the Deal. You Do.
Software companies occasionally describe sales technology as if the relationship is an inefficient step waiting to be automated. We do not believe that.
Read the field note →FIELD NOTE 61
We’ll Put This Part in Writing: There Are No Guarantees.
Trust is easy to discuss when the claim is flattering. It matters more when the sentence limits the sale. SCOUTz does not guarantee more leads, a shorter…
Read the field note →FIELD NOTE 64
Your Prospect’s Email Appeared in a Breach. What Does That Actually Mean?
The breach slide usually starts with a familiar email address in large type. Then the label grows teeth: exposed credential, active risk, compromised user.…
Read the field note →FIELD NOTE 65
The More Frightening the Claim, the Better the Evidence Should Be.
Strong cybersecurity claims require evidence that can support their certainty. Fear-based labels weaken credibility when the source proves less.
Read the field note →FIELD NOTE 67
Stop Selling Your Stack
Explain the condition, scope, ownership and verification behind an MSP recommendation before comparing tools and price. Evidence does not guarantee a sale.
Read the field note →FIELD NOTE 70
Finding ChatGPT Isn't the Same as Finding AI Risk
An AI application name is a starting point, not a conclusion. ChatGPT installed does not prove active use. An enterprise application registration does not…
Read the field note →FIELD NOTE 71
Before You Govern AI, Figure Out What AI Discovery Means
Related: [Shadow AI in small business](/insights/shadow-ai-small-business) AI discovery is not one capability. The phrase is used for several evidence…
Read the field note →FIELD NOTE 72
The Cloud Assessment Is Where You Stop Looking Like Another MSP
The Domain Scan earns a responsible reason to talk. It does not close the deal, finish discovery, or prove what is happening inside the company. The…
Read the field note →FIELD NOTE 80
MSP Prospect Intelligence vs. CRM and Contact Data
Understand how CRM, contact data and security evidence support different parts of MSP sales preparation—and what a useful prospect brief should contain.
Read the field note →FIELD NOTE 81
Cost Visibility vs. Security Evidence in Microsoft 365
Two products can review the same Microsoft 365 environment and answer different questions. BetterTracker publicly describes 365 Scout and its wider platform…
Read the field note →FIELD NOTE 85
The Founder Claim Has to Be as Precise as the Evidence
For a while I described SCOUTz as a product that was not built by vendors. The line sounded sharp. It was also incomplete. It told you who I wanted to…
Read the field note →FIELD NOTE 87
Nobody Won the Hundred Dollars
Credibility, a plan, and trust. A domain scan produces expertise and earns the appointment. The consented cloud review produces the facts the plan is built…
Read the field note →FIELD NOTE 93
Shadow AI in Small Business: What the Connected Apps Show
Shadow AI means AI use outside an organization’s approved governance. An application name or permission grant alone does not establish that use is unapproved. Establish the evidence, then confirm purpose, ownership and approval.
Read the field note →FIELD NOTE 94
SaaS Security in 2026, Read From the MSP Side of the Table
Kaseya's 2026 SaaS Security Report covers 27.6 billion events across 50,000+ small businesses. The findings that matter for MSPs, and how to use them in sales.
Read the field note →FIELD NOTE 96
Guest Accounts Now Outnumber Employees Two to One
69% of SaaS accounts in small businesses are guests, per Kaseya's 2026 data. Why Microsoft 365 guest access sprawls, the risk, and the cleanup MSPs can sell.
Read the field note →FIELD NOTE 97
MFA Adoption Statistics for Small Business (2026)
Only 27% of small businesses enforce MFA and 56% of accounts have it off, per Kaseya's 2026 SaaS data. What the MFA gap means and how MSPs close it.
Read the field note →FIELD NOTE 98
The External Surface Playbook for MSPs
A step-by-step SCOUTz playbook for using public domain evidence to prepare an MSP conversation, earn consent, and hand a clearly bounded next step into delivery.
Read the field note →FIELD NOTE 100
The Same MSP Pitch Fails With the Founder and the CFO
The same MSP sales pitch can land with a founder and fail with a CFO. Start with the consequence each decision-maker is responsible for, then make the evidence fit the question.
Read the field note →FIELD NOTE 112
Microsoft 365 Scan to Sales-Ready Evidence: 2026 Workflow
A 2026 workflow for turning customer-authorized, read-only Microsoft 365 observations into a dated MSP sales briefing with evidence, insight, proof, and clear limits.
Read the field note →FIELD NOTE 113
Domain Scan to First-Call Evidence Packet: Complete 2026 Workflow
A complete 2026 workflow for turning a public-domain review into a traceable first-call evidence packet with sources, dates, limits, and verification questions.
Read the field note →FIELD NOTE 114
Can MSPs scan a prospect's domain before getting permission?
Public records and direct security tests are different activities. Review authorization, federal and state law, evidence limits and MSP outreach requirements.
Read the field note →FIELD NOTE 116
Can MSPs email an unsolicited security report?
Understand CAN-SPAM requirements for rep-sent security reports: truthful claims, sender identity, postal address, opt-outs and the separate collection question.
Read the field note →FIELD NOTE 117
Is It Legal for MSPs to Scan a Prospect's Domain? A 50-State Guide
Use a 50-state research map to separate statutory access, consent, defenses, civil remedies and pending verification. No blanket scanning permission or risk rating.
Read the field note →FIELD NOTE 118
How to document authorization for a prospect security assessment
Document who authorizes a prospect assessment, its systems, methods, permissions, recipients and stop conditions. OAuth is scoped access, not legal clearance.
Read the field note →FIELD NOTE 119
Is It Legal to Scan a Prospect's Domain in Arizona?
Read Arizona's access definition and computer-tampering provisions together. Distinguish knowing access, authority, disruption and public-source MSP observations.
Read the field note →FIELD NOTE 120
Is It Legal to Scan a Prospect's Domain in California?
Review California Penal Code § 502 access, data use, computer services and qualifying civil loss. Read-only operations do not by themselves establish permission.
Read the field note →FIELD NOTE 121
Is It Legal to Scan a Prospect's Domain in Florida?
Examine Florida's knowledge requirement, authorized-security exception and conviction-linked civil remedy. Keep public observations and direct requests distinct.
Read the field note →FIELD NOTE 122
Is It Legal to Scan a Prospect's Domain in Texas?
Read official Texas Penal Code §§ 33.01 and 33.02 for access, effective consent and the limited security-contract defense. Scope and purpose still need review.
Read the field note →FIELD NOTE 123
Is It Legal to Scan a Prospect's Domain in Pennsylvania?
Read Pennsylvania § 7611 alongside § 7605's authorization defense. Examine implied consent, reasonable belief, confidentiality, restitution and jurisdiction.
Read the field note →FIELD NOTE 124
Is It Legal to Scan a Prospect's Domain in Michigan?
Examine Michigan's access and computer-service provisions, plus the aggregate-loss definition. Public-source evidence, permission and civil claims remain distinct.
Read the field note →FIELD NOTE 125
Is It Legal to Scan a Prospect's Domain in Massachusetts?
Read Massachusetts § 120F on knowing unauthorized access, authentication notice and failing to terminate access. No password is not universal permission.
Read the field note →FIELD NOTE 126
Is It Legal to Scan a Prospect's Domain in Washington?
Review Washington's barrier-based authorization definition and white-hat research conditions. Commercial purpose, other laws and verification gaps still matter.
Read the field note →FIELD NOTE 127
Continuous Security Posture Assessment: Dated Evidence vs. Static Reports
Compare continuous security posture assessment with static reports. Use dated domain and Microsoft 365 evidence to guide an MSP buyer's next decision.
Read the field note →FIELD NOTE 128
What should an Applications Center tell an MSP about a client app?
An Applications Center for MSPs should connect permissions, licenses, AI features, history and trust. Review each client app without treating unknowns as clean.
Read the field note →FIELD NOTE 129
What should an MSP's AI Center actually tell a client?
An AI Center for MSPs should separate connected apps, vendor AI features, agent identities, device evidence and Copilot seats. Turn each source into a decision.
Read the field note →FIELD NOTE 131
MFA registration vs enforcement: what should MSPs verify?
Verify Microsoft 365 MFA enforcement beyond registration. Compare capability, policy coverage, sign-in evidence and unknowns before making a client claim.
Read the field note →FIELD NOTE 132
Do OAuth permissions prove a Microsoft 365 app was compromised?
OAuth app governance needs more than a permissions list. Separate access, ownership, activity and compromise evidence in a defensible Microsoft 365 review.
Read the field note →FIELD NOTE 133
Does external file sharing mean Microsoft 365 data leaked?
A Microsoft 365 external sharing audit must separate access from leakage. Review links, guest access, business purpose and activity without inventing a breach.
Read the field note →FIELD NOTE 134
MSP AI demand vs revenue: what the 2026 survey really shows
MSP AI demand vs revenue: interpret Kaseya's 48% and 13% survey findings, avoid false market-size claims, and define an evidence-led client service boundary.
Read the field note →FIELD NOTE 135
Does a service-principal login success alert mean an attack?
A service principal login success alert is not proof of compromise. Review identity, permissions, credentials and activity before making a Microsoft 365 claim.
Read the field note →FIELD NOTE 139
MSP sales training: coach evidence-led conversations with SCOUTz
Use SCOUTz reports, findings and work context to train MSP sales teams on evidence-led discovery, consent, scope and technical handoffs.
Read the field note →FIELD NOTE 140
MSP sales discovery: how SCOUTz prepares the first meeting
Use SCOUTz to prepare MSP sales discovery questions from company context, domain findings and approved cloud evidence, without rebuilding the brief each time.
Read the field note →Your next prospect meeting is already on the calendar.
Bring dated evidence, clear limits, and useful questions.