NOTES FROM ABOVE GROUND
Field Notes is our space for practical sales preparation and the occasional corporate-speak intervention. No fake bylines, no invented case studies, and no urgent thought-leadership weather system.
FIELD NOTES / PRACTICAL CONVERSATION GUIDE
Ground Score, expanded here as Risk Intelligence GroundScore (RIGS), is a way to frame an observed-risk conversation—not a forecast or a verdict. Review observed business email and source details as historical evidence, then start with two understandable topics, pause, and agree on one useful validation step.
QUICK START
Keep the brief useful even if no next meeting happens. Its job is to make scope, evidence, and the next check easy to understand.
Set a shared scope before discussing risk.
The authorized domain, report date, report mode, and one plain-language reason for the review. State what was observed, not what you assume happened.Show only the two topics that are easiest to discuss first.
An aggregate account-exposure signal, if an authorized report confirms one, and the public DNS observations for SPF, DKIM, and DMARC. Keep confidence limits next to the evidence.Turn interest into one bounded check, not a broad promise.
One validation task, a named owner, a date, and a 30-day follow-up point. Record unknowns as unknowns until the right administrator can verify them.THE SIX-STEP SEQUENCE
Start with the observed business-email row and its source details. Do not call it a verified identity or pour more technical detail into the conversation until the owner has named what matters.
“Before we interpret anything, can we confirm that [domain] is the right business domain, this is the [report date] view, and this conversation is for a [public summary / authorized protected report]? I want to keep the scope accurate.”
Keep the boundary: Do not turn a public summary into an account list. Public summaries withhold individual emails, names, and account details.
“I brought a short GroundScore brief to make one question easier: where would a small validation step be most useful for [Company]? It is an observation tool, not a verdict and not a replacement conversation.”
Keep the boundary: Do not accuse a current provider, imply an incident, or promise a result from the score.
“If the authorized report confirms [count] historical records associated with [domain], I would describe that as context: it may identify accounts or reset practices worth checking. It does not prove an active compromise or password reuse today.”
Keep the boundary: Never reveal passwords. Full sanitized email-level rows belong only in an authorized protected report, never in an anonymous public summary.
“These published DNS records are instructions that help receiving mail systems assess messages using [domain]. We can see the records that are public; we cannot infer every sending system, every enforcement result, or the right change without checking your mail setup.”
Keep the boundary: A missing, partial, or unknown public record is not a proof of failure. Changes may need owner approval, staging, and testing.
“Of those two areas, which feels most worth validating first—or is there a different operational concern you want this brief to help us frame?”
Keep the boundary: Listen rather than qualifying with pressure. A source-provided name or job title is not proof that someone is the decision-maker.
“Would it be useful to validate [one check] with [owner or role] by [date], then decide what belongs in the next 30 days? We can write down what we confirm and what stays unknown.”
Keep the boundary: Keep public website contacts to the generic contact information the business has actually published. Do not use exposed account data as a lead list.
REUSABLE WORDING
These are original scripts with placeholders. Replace only what the report shows as observed, preserve source names and details, and do not turn historical evidence into a claim about a person or a current compromise.
Use when: Starting a conversation with a business owner or operational contact.
“I have a short, scoped GroundScore brief for [Company]. Before we use it, can you confirm [domain], the report date, and whether a public summary is the right mode for this conversation?”
Use when: An authorized report confirms an aggregate historical account-exposure signal.
“This report shows [count] historical records associated with [domain]. That is a prompt to check reset and access practices, not proof of a current compromise, password reuse, or an individual’s behavior.”
Use when: Explaining public SPF, DKIM, or DMARC observations.
“These are public mail-domain instructions. They help recipients decide how to treat messages that say they are from [domain]. The records are useful evidence, but they do not tell us every system that sends mail or whether a planned change is safe without testing.”
Use when: Closing after the owner has named a priority.
“Rather than make a big promise, let us validate [one item] with [owner or role] by [date]. We can use that answer to choose a sensible 30-day action or decide that no change is needed.”
RESPECTFUL RESPONSES
A good response leaves room for existing relationships, current constraints, and a genuine “not now.”
That is useful context. This is not an argument to replace anyone. A short, clearly scoped observation can give your existing team one question to confirm or dismiss.
They may be old. Historical exposure is still not proof that a password is active, reused, or connected to a current incident. The practical question is whether reset and MFA practices should be validated.
GroundScore is higher when it observes more risk context. It is not the percentage chance of a hack, a grade of your people, or a number to compare with another provider’s score.
Understood. A useful review should fit the business’s current priorities. We do not need to create urgency from a partial signal.
NON-NEGOTIABLE CONTROLS
The conversation pacing is independently adapted from Iceberg Cyber’s How to Talk About the Cyber Score card (MSP Guide). Original GroundScore adaptation for our controls; not an endorsement of or comparison with another provider.
The reviewed source training, Talk Tracks About the Cyber Score Card by Michael Bakaic / Iceberg Cyber, supports the same two-topic pacing. The supplied analysis identifies the two-topic opening at about 00:20–00:45 and the pause-before-proceeding pattern at about 00:46–01:17. It is context, not a verbatim transcript.
This guide uses original scripts and does not adopt the video’s claim that email-identity changes are a free five-minute fix. It does not use an external scorecard’s data, artwork, or claims.
THE SATIRE HAS A POINT
The Sales Theater Translator is satire, not a scan of real salespeople. Its useful bit is the small, practical shift from saying more to preparing better.
For those moments when the pitch deck has more buzzwords than the product has features.
“Just circling back to bubble this up to the top of your inbox.”
“I don’t have a new reason to email you.”
The ground game: Lead with one useful insight. Give them a reason to care.
INDUSTRY CONTEXT / NOT A COMPANY FINDING
Research-led context for a practical security conversation. Each figure has a clear source and scope.
Verizon observed a human element in 62% of analyzed breaches. This is a report-wide breach attribute, not a probability for any individual organization.
Verizon 2026 Data Breach Investigations Report · 2026 Verizon's global 2026 DBIR: more than 22,000 confirmed breaches involving organizations in 145 countries; incidents in scope were Nov. 1, 2024–Oct. 31, 2025.Verizon observed a ransomware action somewhere in the attack chain in 48% of analyzed breaches. It describes reported breach cases, not the chance a company will experience ransomware.
Verizon 2026 Data Breach Investigations Report · 2026 All breaches in Verizon's global 2026 DBIR dataset; more than 22,000 confirmed breaches involving organizations in 145 countries, with 2025 as the primary caseload.IBM reported a US$4.99M global average breach cost. It is an average across studied breaches, not a forecast or expected loss for any individual company.
IBM Cost of a Data Breach Report 2026 · 2026 IBM/Ponemon 2026 study of breaches experienced by 602 organizations globally between March 2025 and February 2026; cost is reported in USD.These are independent, aggregated industry-report observations for context. They are not GroundGameLabs findings, product-performance claims, customer results, or a prediction of any organization's risk or cost.
THREE THINGS TO TRY BEFORE THE NEXT OUTREACH
These are preparation habits, not promised outcomes. They can make an MSP sales conversation more specific, more respectful, and more worth having.
Before reaching out, look for a public change that may be relevant: a new office, a hiring pattern, a service launch, or a stated technology priority. Name the fact plainly and leave room for them to correct it.
Set a twelve-month meeting goal, then work backward through your conversion assumptions, retries, recycled prospects, and real team capacity. The gaps are more useful before the quarter starts than after it slips.
Offer a useful observation, say why it might matter, and ask whether a conversation is worthwhile. If you reference report evidence, review the observed business-email row and its source details. Describe it as historical evidence, not verified employment or a current compromise; do not frame an illustrative sample as a live assessment.
DO THE HOMEWORK FIRST
A practical activity plan is a better place to start than another string of “just checking in.” Use the free Ground Game Plan to map your team’s next steps.
Open the growth planner