THREATCAPTAIN
BOATS Methodology
Method · End to end

BOATS turns cybersecurity selling into a financial conversation.

BOATS is how an MSP turns a cold prospect into a closed cyber engagement by treating cybersecurity as a financial conversation. Every dollar of cyber risk is one of three things: accepted, mitigated, or transferred. Executives can decide on that frame; they cannot decide on a tool list.

Higher close ratesLarger deal sizesBetter-qualified pipelineLower churnReal security adoption
B
Prospecting
Build the Opportunity
O
Discovery
Open the Conversation
A
Audit / Assessment
Accelerate with Business Impact
T
Presentation / Close
Tell the Story
S
Retention & Expansion
Smooth Sailing
Through-line

Accept / Mitigate / Transfer starts as language in B, becomes discovery in O, stays quiet while A listens, becomes the choice in T, and becomes the canonical record in S.

Weeks 0–N
Always-on B

Pipeline is always running through outbound, referrals, workshops, thought leadership, and events.

Discovery day
O

One structured conversation validates whether a paid BRA is worth the customer’s time and money.

Weeks 1–2
A

The MSP listens deeply, runs the audit, and collects the document packet T will build on.

Prep window
T-prep

Scenarios, packages, impact numbers, and the two centerpiece slides are built before the meeting.

Close day
T

The buyer sees the financial picture and chooses status quo, the Improved Path, or a delayed decision path.

Post-close
S

QBRs, tolerance checks, threat intel, trigger response, and referrals keep the cycle compounding.

The five phases

Same sales cycle, different conversation.

B
Prospecting · Always-on

Build the Opportunity

Create qualified pipeline with prospects already primed for a business-risk conversation, not a technical sales pitch.

Customer frame

A/M/T is introduced as language in workshops, scripts, email subjects, booth talk tracks, and website copy.

Entry signal

The MSP exists, has a service offering, and has time and budget for outreach.

Exit signal

A discovery call is on the calendar with a qualified prospect and a hypothesized decision-maker.

What the MSP does
  • Define a clear ICP
  • Enrich decision-maker messaging
  • Build named prospect lists
  • End every touchpoint with a calendar ask
Failure signals
  • ICP is too broad
  • Outreach leads with technical pitch
  • No financial framing
  • Touchpoints end without a specific ask
ThreatCaptain platform play

ICP Lead Discovery surfaces named decision-makers so the BDR does not have to research manually.

O
Discovery · 30 minutes

Open the Conversation

Shift the prospect from a technical frame into a business-risk conversation and validate whether a paid BRA is the right next step.

Customer frame

A/M/T is reinforced in the upfront contract and through six discovery questions about what the business is accepting by default.

Entry signal

A discovery call is on the calendar from B.

Exit signal

Ready for A, another O conversation with the right person, or a mutual clean exit.

What the MSP does
  • Open with a Sandler upfront contract
  • Ask the Business Goals question
  • Run the Six Discovery Questions
  • Close on a paid BRA or exit cleanly
Failure signals
  • No committed next step
  • Feature defense replaces discovery
  • IT-level questions dominate
  • Proposal delivered too early
ThreatCaptain platform play

Quick Sim can create a ballpark Accept figure when it helps earn the BRA.

A
Audit / Assessment · 1–2 weeks

Accelerate with Business Impact

Run a paid Business Risk Assessment as a focused listening engagement. Gather the customer’s words and documents; keep numbers sealed until T.

Customer frame

A captures the inputs. The optional preview can anchor the customer on a range, but options and allocations stay out of view.

Entry signal

O ends with a verbal commit, decision-maker access, and readiness to scope the BRA.

Exit signal

Audit notes, insurance, contracts, claims history, and enough business context are ready for T-prep.

What the MSP does
  • Kick off the paid BRA
  • Run the audit working session
  • Collect the document packet
  • Optionally preview financial findings only when needed
Failure signals
  • BRA becomes a demo
  • Numbers are shown too early
  • Deck building starts in A
  • Customer words are not captured
ThreatCaptain platform play

BRA Module captures business discovery and technical assessment into framework-mapped data.

T
Presentation / Close · 60 minutes + prep

Tell the Story

Tell the executive the story their data has been writing: current exposure, the improved path, and the A/M/T split inside that path.

Customer frame

A/M/T appears as the choice: the Improved Path’s residual is split into Accept, Mitigate, and Transfer with real numbers.

Entry signal

A is complete and the platform has the customer’s numbers, scenarios, and audit context.

Exit signal

Signed contract, chosen status quo, or a specific delayed-close path with next steps.

What the MSP does
  • Run scenarios
  • Select one improved scenario
  • Apply packages
  • Compare before and after
  • Allocate the residual into A/M/T
Failure signals
  • Comparison slide comes before impact
  • A/M/T is new to the buyer
  • The rep over-explains
  • The customer debates estimates instead of choosing a path
ThreatCaptain platform play

Proposal Generator and Deal Builder produce the Impact Slide and Two Financial Paths.

S
Retention & Expansion · Continuous

Smooth Sailing

Keep the customer on course through changing waters with QBRs, tolerance checks, threat intel, trigger response, and referral asks.

Customer frame

The signed A/M/T allocation becomes the canonical record that every QBR re-validates against current business reality.

Entry signal

T produces a closed customer with a chosen path, funded roadmap, and defined A/M/T allocation.

Exit signal

S does not really exit; it triggers a focused A → T re-cycle when the business, threat landscape, or tolerance changes.

What the MSP does
  • Run quarterly business reviews
  • Check risk tolerance semi-annually
  • Send curated threat intel
  • Respond to trigger events
  • Ask for referrals at success moments
Failure signals
  • QBR becomes a ticket review
  • Risk tolerance is never revisited
  • Threat updates are generic
  • Expansion waits for renewal time
ThreatCaptain platform play

Client Profile, usage tracking, churn signals, and QBR deck auto-sync keep the posture view current.

The common failure modes are upstream.

T cannot compensate for B/O/A errors. Each phase has to do its own job so the final conversation feels like a choice, not a pitch.

01

B sends the wrong person into discovery.

02

O ends without a verbal commit or a specific next meeting.

03

A turns into a tool demo or numbers preview.

04

A/M/T is introduced for the first time in T.

05

T leads with pricing comparison instead of the Impact Slide.

How BOATS gets taught

Enablement, reference, coaching, and customer lessons.

Maiden Voyage

The primary enablement motion where the MSP learns BOATS after close.

Threat Academy

Phase guides, scripts, objection handlers, case studies, and certification tracks.

Beakon AI

In-product coaching that surfaces prompts, follow-ups, and next steps for the current stage.

Ship Mates

Customer stories and deal patterns that let MSPs learn from other MSPs.