Most Google Ads for MSPs bid on the wrong kind of keyword. There are three kinds in this market. The first kind doesn't exist. The second costs more per click than most MSPs want to spend, and it brings the wrong buyer. The third is cheap, specific, and almost nobody is bidding on it.
We pulled the US search volumes for all three tiers. Here they are, along with what each tier is good for, a budget model you can check against your own numbers, and the account setup that stops money leaking out of the campaign.
Search is still the cheapest qualified traffic an MSP can buy. The person on the other end typed a problem into a box and is waiting for an answer. The trick is buying the right searches, at a size your budget can actually carry, and sending each one to a page that answers it. Get any of those three wrong and Google will happily keep taking your money.
Kind one: the terms that don't exist
The way you describe your own service has no search volume.
| Keyword | US searches/month |
|---|---|
| it support for mortgage companies | 0 |
| cybersecurity for mortgage brokers | 0 |
| ria it support | 0 |
| financial advisor it support | 0 |
| insurance agency it support | 0 |
Thirty-seven vertical phrases we tested came back at zero. There's no auction to enter. Set any budget you like and Google has nothing to sell you.
If you've been running a campaign on these and wondering why impressions are so low, that's why. It's not your bid. It's not your quality score. Nobody is typing it.
Kind two: the terms that will eat you alive
| Keyword | Searches/month | CPC |
|---|---|---|
| soc 2 compliance audit | 1,300 | $268.50 |
| penetration testing services | 3,600 | $265.58 |
| managed detection and response | 720 | $188.10 |
| penetration testing cost | 480 | $150.07 |
| endpoint detection and response | 27,100 | $95.63 |
| soc 2 compliance | 12,100 | $72.45 |
| security awareness training | 14,800 | $69.31 |
| US averages, September 2026, from Google Ads data via DataForSEO |
These prices move. Cost per click changes month to month, by market and with the competition in each auction. Treat every figure here as a snapshot of one month, not a quote. Before you set a budget, check today's numbers for your own terms in Google's Keyword Planner.
At $265 a click, ten clicks cost $2,650 and buy you nothing but ten visits (September 2026 CPC data). Even ordinary MSP search gets pricey. Scott Millar says MSPs pay anywhere between $150 and $200 per click for those search results (How To Setup Paid Ads For Your MSP). Ten clicks at that price buy nothing but ten visits.
You're bidding against Vanta, Drata, Arctic Wolf and every MSSP with a funding round. They can lose money on a click for eighteen months. You can't.
There's a worse problem than the price. Somebody searching "endpoint detection and response" is usually a technical buyer comparing products, not a business owner looking for a provider. You'd be paying a premium for the wrong person.
Skip this tier entirely. It's the single most common way an MSP burns a Google Ads budget.
Kind three: the regulatory terms
Put the money here.
| Keyword | Searches/month | CPC | Competition |
|---|---|---|---|
| glba compliance | 1,000 | $20.18 | LOW |
| ftc safeguards rule | 590 | $9.77 | LOW |
| glba safeguards rule | 480 | $6.96 | LOW |
| ria compliance consultant | 320 | $53.89 | n/a |
| regulation s-p amendments | 140 | $9.39 | n/a |
| sec regulation s-p | 110 | $30.59 | n/a |
| written information security program | 50 | $13.98 | n/a |
| US averages, September 2026, from Google Ads data via DataForSEO |
A fraction of the price of the generic tier, and the intent is far better.
These swing more than the big terms because so few people bid on them. One more advertiser can double a price. When we pulled the same data a month later, "ftc safeguards rule" had gone from $9.77 to $18.44 and "glba compliance" had dropped from $20.18 to $6.71 (October 2026 CPC data). Still cheap next to the security tier, but check before you budget.
Think about who types "ftc safeguards rule" into Google at 9pm. It isn't a technical buyer comparing EDR vendors. It's a mortgage broker who got a letter, or a compliance consultant checking something, or an office manager who was handed a requirement and has no idea what to do with it.
That person has a deadline and no vendor in mind. That's the best position you can catch someone in.
The catch is size. Those terms add up to about 2,700 searches a month across the entire United States. You won't build a pipeline on them alone. You'll pick up the in-market minority for very little, which is a different and still worthwhile thing.
The budget math
Arithmetic instead of a number pulled from the air. The conversion rates below are planning assumptions. Replace them with your own after thirty days.
Assume 8 in 100 clicks become a form lead, 4 in 10 leads book a call, and 1 in 5 booked calls signs.
1 client needs 5 booked calls
5 booked calls needs 12.5 leads
12.5 leads needs 156 clicks
The regulatory tier's blended cost per click was about $18 in September 2026, so 156 clicks cost about $2,800 per client acquired (September 2026 CPC data). Run the same sum with the cost per click in your own account, because that number will have moved. On the generic tier the same 156 clicks cost many times more.
Now check it against what a client is worth. MSP Launchpad's planning number is a smallest contract of $2,500 a month kept for eight years, which makes one client worth $240,000 before upsells or referrals (Proven Systems & Playbooks for MSP Lead Generation). About $2,800 to win a client like that is a small slice of the first year alone.
The economics work. The budget most MSPs set doesn't.
At $25 a day, about $760 a month at September's $18 blended price, the same math gives you 42 clicks, 3.4 leads, 1.4 booked calls and roughly a quarter of a client per month (September 2026 CPC data). One new client every three to four months.
That's not a broken campaign. That's a campaign sized for data collection being judged as though it were sized for pipeline.
Setting it up so it doesn't leak
Exact and phrase match only. Broad match on "compliance" will spend your entire budget on people writing college papers. Google will push you toward broad match. Decline.
Build the negative list before you launch, not after. Start with jobs, salary, certification, course, training, free, template, definition, meaning, reddit, and the names of software products you don't sell. Then add to it weekly from the search terms report. This is the single highest return maintenance task in the account.
One ad group per rule. Safeguards Rule in one, Reg S-P in another, GLBA in a third. Different reader, different anxiety, different landing page.
Send them to the page about the rule. Not your services page, and never the homepage. Somebody searching "ftc safeguards rule" wants to know what the rule requires. Give them that, then offer the gap review at the bottom. If you don't have those pages yet, that's the overlap with SEO for MSPs, and the same pages do both jobs.
Turn on call reporting and record. Much of the value from these terms arrives as a phone call, not a form. If you're not tracking calls you'll conclude the campaign is failing while it's working.
Set a shared budget cap and check the search terms report weekly. Ten minutes. It's where the waste hides.
Geo-target wider than you think. These are national terms with low volume. If you'll serve a client two states over, don't restrict to a fifteen mile radius and cut your already thin volume in half.
About that Google Ads credit
If you've got a $500 or $1,000 promotional credit sitting in an account, this is exactly what it's for. At September's $18 blended price on the regulatory tier, a $1,000 credit is 55 clicks (September 2026 CPC data). That's a real test of whether the offer converts, funded by Google.
Don't spend it on the generic tier. At September's prices a thousand dollars is four clicks on "soc 2 compliance audit" (September 2026 CPC data).
Where Google fits against everything else
Google catches demand that already exists. That's its whole job and it does it better than anything else. The limit is that the demand has to be there first, and for most MSP verticals it partly isn't.
So run search on the regulatory tier permanently, because it's cheap and the intent is hard to beat. Then create demand elsewhere. LinkedIn reaches the named role. Meta reaches the owner operator who never searches and brings back your website visitors for pocket change.
Search first, because it's the cheapest qualified traffic you'll ever buy. Just don't expect it to be the whole plan.
Clicks are the start. What you need at the end is a decision maker on a call. We book sales meetings with decision makers straight onto your calendar, and you pay only when they show up. Meetings, not leads. See how it works for MSPs.
Keyword volumes and cost per click are Google Ads data from DataForSEO, US, pulled September 2026 unless marked October. Cost per click changes over time, so check current prices before you budget. Conversion rates in the budget model are stated assumptions, not measured results.

