Blueprint Playbook for Atera

Who the Hell is Jordan Crawford?

Founder of Blueprint. I help companies stop sending emails nobody wants to read.

The problem with outbound isn't the message. It's the list. When you know WHO to target and WHY they need you right now, the message writes itself.

I built this system using government databases, public records, and 25 million job posts to find pain signals most companies miss. Predictable Revenue is dead. Data-driven intelligence is what works now.

The Old Way (What Everyone Does)

Your GTM team is buying lists from ZoomInfo, adding "personalization" like mentioning a LinkedIn post, then blasting generic messages about features. Here's what it actually looks like:

The Typical Atera SDR Email:

Subject: Streamline your IT operations Hi {First Name}, I noticed your company is growing quickly based on your recent LinkedIn posts about hiring. Congrats on the expansion! At Atera, we help IT teams like yours manage endpoints more efficiently with our all-in-one RMM platform. We've helped companies reduce ticket resolution time by up to 30%. Would you be open to a quick 15-minute call to explore how we can help you scale your operations? Best, {SDR Name}

Why this fails: The prospect is an expert. They've seen this template 1,000 times. There's zero indication you understand their specific situation. Delete.

The New Way: Intelligence-Driven GTM

Blueprint flips the approach. Instead of interrupting prospects with pitches, you deliver insights so valuable they'd pay consulting fees to receive them.

1. Hard Data Over Soft Signals

Stop: "I see you're hiring compliance people" (job postings - everyone sees this)

Start: "Your network scan shows 847 unpatched CVEs across 23 exposed endpoints" (external vulnerability scan with specific counts)

2. Mirror Situations, Don't Pitch Solutions

PQS (Pain-Qualified Segment): Reflect their exact situation with such specificity they think "how did you know?" Use government data with dates, record numbers, facility addresses.

PVP (Permissionless Value Proposition): Deliver immediate value they can use today - analysis already done, deadlines already pulled, patterns already identified - whether they buy or not.

Atera Intelligence Plays

These messages demonstrate precise understanding of the prospect's situation (PQS) or deliver immediate value (PVP). Every claim traces to specific data sources.

PVP Internal Data Strong (9.4/10)

MSP Client Profitability Analysis

What's the play?

Use aggregated ticket and revenue data from the prospect's PSA tool to identify unprofitable client relationships - showing them which customers generate disproportionate support burden relative to MRR.

Why this works

This is incredibly specific to THEIR business - not generic stats. The profitability insight is something they should know but probably don't track. Helps them make better pricing decisions immediately.

Data Sources
  1. PSA Integration (ConnectWise/Autotask) - ticket volume by client, MRR data

The message:

Subject: Your 6 biggest clients generating 61% of tickets Ran your ticket distribution - 6 clients account for 61% of your support volume but only 32% of MRR. Those accounts are underwater on profitability unless you're charging premium rates. Want the client-by-client breakdown?
DATA REQUIREMENT

This play requires PSA integration providing ticket volume by client and MRR data to calculate distribution patterns.

Helps the MSP identify unprofitable client relationships and reprice services appropriately.
PVP Internal Data Strong (9.1/10)

MSP ConnectWise Ticket Resolution Analysis

What's the play?

Pull actual ticket metrics from the prospect's ConnectWise instance and compare their performance to top-quartile MSPs using Atera's platform - showing exactly where they're losing efficiency.

Why this works

They pulled MY actual ConnectWise data. The 8.4 vs 5.2 comparison is specific and actionable. Low commitment ask - just want a list. This tells them something they didn't know about their own efficiency.

Data Sources
  1. PSA Integration (ConnectWise/Autotask) - ticket counts, endpoint counts, resolution times
  2. Internal Atera Benchmarks - aggregated performance data across MSP customers

The message:

Subject: You closed 2,847 tickets last quarter Your ConnectWise instance shows 2,847 tickets closed Q4 2024 across 340 managed endpoints. That's 8.4 tickets per endpoint - top MSPs run 5.2 by automating patch/maintenance workflows. Want the list of what they're automating?
DATA REQUIREMENT

This play requires integration access to prospect's PSA tool (ConnectWise/Autotask) to pull actual ticket volumes and endpoint counts.

Benchmarking against aggregated customer data is proprietary - only Atera can deliver this insight.
PVP Public + Internal Strong (9.0/10)

Healthcare Vulnerability Pattern Matching

What's the play?

Cross-reference external vulnerability scanning of the prospect's network with HHS breach database correlation to identify highest-risk devices matching known breach patterns.

Why this works

This is sophisticated analysis they couldn't do themselves. Specific to THEIR network vulnerabilities. The '8 of 12' creates urgency without being alarmist. Gives them actionable intelligence immediately.

Data Sources
  1. External Network Vulnerability Scanning - CVE detection on exposed IP ranges
  2. HHS HIPAA Breach Notification Database - breach descriptions, CVE patterns

The message:

Subject: 340 healthcare breaches share 12 vulnerability patterns Analyzed 847 HHS breach reports - 340 involved network access incidents that share 12 common CVE patterns. Your network scan shows 8 of those 12 patterns active right now. Want the report showing which 8 and their breach frequency?
DATA REQUIREMENT

This play requires HHS breach database pattern analysis combined with external vulnerability scanning of prospect's network to identify matching risk profiles.

If recipient is MSP, helps them protect healthcare clients; if internal IT, helps prevent breach.
PVP Internal Data Strong (8.8/10)

MSP Average Resolution Time Benchmarking

What's the play?

Pull actual ticket metrics (first-reply time, resolution time) from prospect's PSA and benchmark against aggregated customer data to show exactly where they're losing efficiency.

Why this works

Specific to MY actual performance - verifiable. The comparison to top quartile is helpful context. Actionable - tells me exactly where I'm losing efficiency. Low commitment ask.

Data Sources
  1. PSA Integration (ConnectWise/Autotask) - first-reply time, resolution time
  2. Internal Atera Benchmarks - aggregated performance data across MSP customers

The message:

Subject: Your average ticket resolution is 4.7 hours Pulled your ConnectWise data - average first-reply time is 2.1 hours, full resolution averages 4.7 hours. Top-quartile MSPs run 0.8 hours first-reply and 2.3 hours resolution by automating triage. Want to see what they're automating that you're not?
DATA REQUIREMENT

This play requires PSA integration providing ticket metrics (first-reply time, resolution time) and benchmarking against aggregated customer data.

Helps the MSP improve SLA compliance and client satisfaction scores.
PQS Public + Internal Strong (8.7/10)

Healthcare Network Vulnerability Scan

What's the play?

External vulnerability scanning of prospect's publicly visible IP ranges combined with HHS breach database correlation to identify vulnerabilities matching recent breach patterns.

Why this works

Specific scan of MY network - verifiable and scary. 847 is a huge number - creates urgency. The HHS breach correlation is non-obvious synthesis. Easy routing question.

Data Sources
  1. External Network Vulnerability Scanning - CVE detection on exposed IP ranges
  2. HHS HIPAA Breach Notification Database - breach descriptions, CVE citations

The message:

Subject: 847 CVEs active on your network right now Scanned your publicly visible IP ranges - 847 unpatched CVEs detected across 23 exposed endpoints. 340 of those CVEs match vulnerabilities cited in recent HHS breach reports for healthcare providers. Who's managing your patch compliance currently?
DATA REQUIREMENT

This play requires external vulnerability scanning of prospect's IP ranges combined with HHS breach database correlation analysis.

The synthesis of breach patterns with live network scanning is unique and defensible.
PQS Public Data Strong (8.1/10)

SNF Medication Error Deficiencies

What's the play?

Target skilled nursing facilities with recent CMS deficiency citations for medication errors (F755) - these typically stem from EHR documentation gaps that real-time monitoring addresses.

Why this works

Specific facility name and month - they researched us. F755 citation is real and concerning for our rating. The EHR connection isn't obvious - makes me think. Easy routing question.

Data Sources
  1. CMS SNF Quality Reporting Program Data - facility_name, deficiencies, survey_date, F-tag citations

The message:

Subject: 3 medication errors at Sunset Manor in October Sunset Manor's October survey cited 3 medication administration errors - F755 deficiencies. These typically stem from EHR documentation gaps that real-time monitoring catches before surveyors arrive. Who's handling your survey prep for the next visit?
PQS Public + Internal Okay (7.9/10)

Fortinet Firewall Vulnerability Alert

What's the play?

Combine external IP/firmware detection with HHS breach database analysis linking specific CVEs to reported incidents - alerting healthcare IT managers to actively exploited vulnerabilities on their firewalls.

Why this works

Insanely specific - my exact IP and firmware version. The CVE and breach correlation is terrifying. But is this just fear-mongering? How do I verify the 12 breaches claim? The question is good but the tone feels slightly salesy.

Data Sources
  1. External IP/Firmware Detection - firewall model, firmware version, IP address
  2. HHS HIPAA Breach Notification Database - breach descriptions, CVE linkages

The message:

Subject: Your Fortinet firewall running vulnerable firmware Your Fortinet FortiGate at 203.0.113.45 is running firmware version 6.2.4 - that version has CVE-2023-27997 actively exploited. 12 healthcare breaches in the past 90 days traced back to this exact vulnerability. Is someone already scheduling the firmware update?
DATA REQUIREMENT

This play requires external IP/firmware detection combined with HHS breach database analysis linking specific CVEs to reported incidents.

The synthesis of breach attribution with live network scanning creates urgency.

What Changes

Old way: Spray generic messages at job titles. Hope someone replies.

New way: Use public data to find companies in specific painful situations. Then mirror that situation back to them with evidence.

Why this works: When you lead with "Your network scan shows 847 unpatched CVEs" instead of "I see you're hiring for IT roles," you're not another sales email. You're the person who did the homework.

The messages above aren't templates. They're examples of what happens when you combine real data sources with specific situations. Your team can replicate this using the data recipes in each play.

Data Sources Reference

Every play traces back to verifiable data. Here are the sources used in this playbook:

Source Key Fields Used For
CMS SNF Quality Reporting Program facility_name, deficiencies, quality_measures, enforcement_actions Skilled Nursing Facilities with medication error deficiencies
HHS HIPAA Breach Notification Database covered_entity_name, breach_date, breach_description, individuals_affected Healthcare breach patterns, CVE correlation
PSA Integration (ConnectWise/Autotask) ticket_volume, resolution_time, first_reply_time, customer_mrr MSP operational efficiency benchmarking
External Network Vulnerability Scanning ip_address, cve_detections, firmware_version, exposed_endpoints Healthcare network vulnerability identification
Internal Atera Benchmarks aggregated_performance_metrics, automation_adoption_rates MSP performance benchmarking