Helpdesk Harry
All posts

Paid ads ·

Google Ads for MSPs: The Cheap Terms Nobody Is Bidding On

Harry uses a magnifying glass to pick out one highlighted search result from a stack, with coins beside it

Most Google Ads for MSPs bid on the wrong kind of keyword. There are three kinds in this market. The first kind doesn't exist. The second costs more per click than most MSPs want to spend, and it brings the wrong buyer. The third is cheap, specific, and almost nobody is bidding on it.

We pulled the US search volumes for all three tiers. Here they are, along with what each tier is good for, a budget model you can check against your own numbers, and the account setup that stops money leaking out of the campaign.

Search is still the cheapest qualified traffic an MSP can buy. The person on the other end typed a problem into a box and is waiting for an answer. The trick is buying the right searches, at a size your budget can actually carry, and sending each one to a page that answers it. Get any of those three wrong and Google will happily keep taking your money.

Kind one: the terms that don't exist

The way you describe your own service has no search volume.

Keyword US searches/month
it support for mortgage companies 0
cybersecurity for mortgage brokers 0
ria it support 0
financial advisor it support 0
insurance agency it support 0

Thirty-seven vertical phrases we tested came back at zero. There's no auction to enter. Set any budget you like and Google has nothing to sell you.

If you've been running a campaign on these and wondering why impressions are so low, that's why. It's not your bid. It's not your quality score. Nobody is typing it.

Kind two: the terms that will eat you alive

Keyword Searches/month CPC
soc 2 compliance audit 1,300 $268.50
penetration testing services 3,600 $265.58
managed detection and response 720 $188.10
penetration testing cost 480 $150.07
endpoint detection and response 27,100 $95.63
soc 2 compliance 12,100 $72.45
security awareness training 14,800 $69.31
US averages, September 2026, from Google Ads data via DataForSEO

These prices move. Cost per click changes month to month, by market and with the competition in each auction. Treat every figure here as a snapshot of one month, not a quote. Before you set a budget, check today's numbers for your own terms in Google's Keyword Planner.

At $265 a click, ten clicks cost $2,650 and buy you nothing but ten visits (September 2026 CPC data). Even ordinary MSP search gets pricey. Scott Millar says MSPs pay anywhere between $150 and $200 per click for those search results (How To Setup Paid Ads For Your MSP). Ten clicks at that price buy nothing but ten visits.

You're bidding against Vanta, Drata, Arctic Wolf and every MSSP with a funding round. They can lose money on a click for eighteen months. You can't.

There's a worse problem than the price. Somebody searching "endpoint detection and response" is usually a technical buyer comparing products, not a business owner looking for a provider. You'd be paying a premium for the wrong person.

Skip this tier entirely. It's the single most common way an MSP burns a Google Ads budget.

Kind three: the regulatory terms

Put the money here.

Keyword Searches/month CPC Competition
glba compliance 1,000 $20.18 LOW
ftc safeguards rule 590 $9.77 LOW
glba safeguards rule 480 $6.96 LOW
ria compliance consultant 320 $53.89 n/a
regulation s-p amendments 140 $9.39 n/a
sec regulation s-p 110 $30.59 n/a
written information security program 50 $13.98 n/a
US averages, September 2026, from Google Ads data via DataForSEO

A fraction of the price of the generic tier, and the intent is far better.

These swing more than the big terms because so few people bid on them. One more advertiser can double a price. When we pulled the same data a month later, "ftc safeguards rule" had gone from $9.77 to $18.44 and "glba compliance" had dropped from $20.18 to $6.71 (October 2026 CPC data). Still cheap next to the security tier, but check before you budget.

Think about who types "ftc safeguards rule" into Google at 9pm. It isn't a technical buyer comparing EDR vendors. It's a mortgage broker who got a letter, or a compliance consultant checking something, or an office manager who was handed a requirement and has no idea what to do with it.

That person has a deadline and no vendor in mind. That's the best position you can catch someone in.

The catch is size. Those terms add up to about 2,700 searches a month across the entire United States. You won't build a pipeline on them alone. You'll pick up the in-market minority for very little, which is a different and still worthwhile thing.

The budget math

Arithmetic instead of a number pulled from the air. The conversion rates below are planning assumptions. Replace them with your own after thirty days.

Assume 8 in 100 clicks become a form lead, 4 in 10 leads book a call, and 1 in 5 booked calls signs.

1 client       needs  5 booked calls
5 booked calls needs  12.5 leads
12.5 leads     needs  156 clicks

The regulatory tier's blended cost per click was about $18 in September 2026, so 156 clicks cost about $2,800 per client acquired (September 2026 CPC data). Run the same sum with the cost per click in your own account, because that number will have moved. On the generic tier the same 156 clicks cost many times more.

Now check it against what a client is worth. MSP Launchpad's planning number is a smallest contract of $2,500 a month kept for eight years, which makes one client worth $240,000 before upsells or referrals (Proven Systems & Playbooks for MSP Lead Generation). About $2,800 to win a client like that is a small slice of the first year alone.

The economics work. The budget most MSPs set doesn't.

At $25 a day, about $760 a month at September's $18 blended price, the same math gives you 42 clicks, 3.4 leads, 1.4 booked calls and roughly a quarter of a client per month (September 2026 CPC data). One new client every three to four months.

That's not a broken campaign. That's a campaign sized for data collection being judged as though it were sized for pipeline.

Setting it up so it doesn't leak

Exact and phrase match only. Broad match on "compliance" will spend your entire budget on people writing college papers. Google will push you toward broad match. Decline.

Build the negative list before you launch, not after. Start with jobs, salary, certification, course, training, free, template, definition, meaning, reddit, and the names of software products you don't sell. Then add to it weekly from the search terms report. This is the single highest return maintenance task in the account.

One ad group per rule. Safeguards Rule in one, Reg S-P in another, GLBA in a third. Different reader, different anxiety, different landing page.

Send them to the page about the rule. Not your services page, and never the homepage. Somebody searching "ftc safeguards rule" wants to know what the rule requires. Give them that, then offer the gap review at the bottom. If you don't have those pages yet, that's the overlap with SEO for MSPs, and the same pages do both jobs.

Turn on call reporting and record. Much of the value from these terms arrives as a phone call, not a form. If you're not tracking calls you'll conclude the campaign is failing while it's working.

Set a shared budget cap and check the search terms report weekly. Ten minutes. It's where the waste hides.

Geo-target wider than you think. These are national terms with low volume. If you'll serve a client two states over, don't restrict to a fifteen mile radius and cut your already thin volume in half.

About that Google Ads credit

If you've got a $500 or $1,000 promotional credit sitting in an account, this is exactly what it's for. At September's $18 blended price on the regulatory tier, a $1,000 credit is 55 clicks (September 2026 CPC data). That's a real test of whether the offer converts, funded by Google.

Don't spend it on the generic tier. At September's prices a thousand dollars is four clicks on "soc 2 compliance audit" (September 2026 CPC data).

Where Google fits against everything else

Google catches demand that already exists. That's its whole job and it does it better than anything else. The limit is that the demand has to be there first, and for most MSP verticals it partly isn't.

So run search on the regulatory tier permanently, because it's cheap and the intent is hard to beat. Then create demand elsewhere. LinkedIn reaches the named role. Meta reaches the owner operator who never searches and brings back your website visitors for pocket change.

Search first, because it's the cheapest qualified traffic you'll ever buy. Just don't expect it to be the whole plan.

Clicks are the start. What you need at the end is a decision maker on a call. We book sales meetings with decision makers straight onto your calendar, and you pay only when they show up. Meetings, not leads. See how it works for MSPs.

Keyword volumes and cost per click are Google Ads data from DataForSEO, US, pulled September 2026 unless marked October. Cost per click changes over time, so check current prices before you budget. Conversion rates in the budget model are stated assumptions, not measured results.

Frequently asked questions

How much should an MSP spend on Google Ads?

More than most start with. MSP Launchpad suggests about $5,000 a month in most markets, or about $3,000 where clicks are cheaper, which should bring three or four good leads a month after the first month (Proven Systems & Playbooks for MSP Lead Generation). A smaller budget is a data collection exercise. Fine, as long as nobody judges it as a pipeline.

What keywords should an MSP bid on in Google Ads?

Regulation names. Terms like glba compliance, ftc safeguards rule and glba safeguards rule are cheap, low competition, and searched by someone with a requirement and no vendor in mind. Skip the expensive security tier such as penetration testing services and soc 2 compliance audit, where you bid against funded software companies for technical buyers.

Why are my MSP Google Ads getting no impressions?

You are probably bidding on terms nobody types. Phrases like it support for mortgage companies, ria it support and insurance agency it support came back at zero US searches a month. There is no auction to enter, so no bid or quality score fixes it.

Should an MSP use broad match keywords?

No. Use exact and phrase match only. Broad match on a word like compliance spends your budget on students writing papers. Google will push you toward broad match. Decline it.

What negative keywords should an MSP add in Google Ads?

Start with jobs, salary, certification, course, training, free, template, definition, meaning, reddit and the names of software you don't sell. Then add to the list weekly from the search terms report. A trainer on Robin Robins' channel calls the negative keyword the most important keyword type in a campaign (How To Get More Web Traffic With Google Ads).

Where should MSP Google Ads send traffic?

To a page about the exact thing searched, never the homepage. Someone searching ftc safeguards rule wants to know what the rule requires. Give them that, then offer the gap review at the bottom. One ad group per rule, each with its own page.

Meetings, not leads.

We find business owners who need IT help and book them straight onto your calendar. You pay only when a decision maker shows up.

See how it works