Welcome to the Dreamit Dose.
I'm Mel Shakir, MD of the Dreamit Securetech program.
In my previous Dose, we discussed the top 5 reasons
a CISO would buy your product.
Now let's talk about the exact opposite.
Here are the top 5 things that will get an instant no from a CISO.
Reason #1.
Potential to disrupt business.
Innovations like AI and SecOps are core value propositions of
many next-generation security solutions looking to identify
threats faster and streamline workflows.
Because such innovations are still new to most CISO organizations,
they remain highly skeptical of technologies that claim to make changes in real-time.
They can cause loss of data, block network traffic,
quarantine devices, lock out users, or
apply detrimental configuration changes that might be hard to roll back.
So be prepared to discuss how your solution can be deployed
in phases alongside existing technologies you're looking to replace
without causing disruptions.
Failure to do so will get you an instant no.
Reason #2. Missing key integrations and certifications.
This is all about leveraging the investments a CISO has
already made and providing assurance that your product
meets essential requirements.
If your product doesn't support key security solutions or applications
used by the firm, and you don't have the APIs
that a CISO's security engineering team can use
to integrate with homegrown tools,
your meeting will come to a swift end.
If your product does not support industry standards
that are applicable to your product category,
like the MITRE Attack Framework for classifying threats and alerts,
you'll hit a wall.
You can't go to a CISO with a SaaS offering and say you don't
have a SOC 2 certification.
They will not be able to go live.
There are many other certifications, such as Common Criteria,
that provide assurance your product meets the minimum requirements.
Reason #3. Creates a vendor dependency.
A major consideration for CISOs is a solution architecture
that prevents vendor dependency.
If your product is not built using a well-accepted technology stack
that has been standardized within the company, then it's a no go.
For example, your solution requires Hadoop Big Data Stack
but the company has little or no experience with it.
Even SaaS solutions need to provide confidence that the
content created within the platform can be easily exported
should they decide to switch vendors.
I.E. my data should outlive the vendor.
Also note that typically a CISO works with preferred service providers.
If your solution requires your own professional services for
implementation and ongoing management, it is grounds for an instant no.
Reason #4. Difficult to evaluate solutions.
We all know about the skills shortage in cybersecurity.
Knowing that CISOs are always struggling with staffing challenges,
you should be prepared to give the CISO's staff an experience
that is a productive use of their time.
If your product requires an extended pilot
for example to generate training data for your A.I. to work
and demonstrate value, it will probably derail your plans.
You must assume the CISO's staff is on a tight schedule
and be prepared to demonstrate value without their assistance.
Demo or mock data, to show the value of your solution,
is better than no data.
Because you have a limited window of opportunity to prove your worth,
you should commit to 2 to 3 use cases that you can successfully showcase
during the POC and establish ROI during this time.
POCs done in the cloud mean that there is no hardware or software to deploy
and no vendors to entertain on site. It can all happen remotely.
If the CISO's team cannot take your solution for a test drive
and be certain that it doesn't just look like a Ferrari,
but also drives like one, then be prepared for a no.
Reason #5. Complicated pricing or contracts.
Pricing needs to be predictable.
This means information needed to understand the cost of the deployment
should be readily accessible.
Examples... number of users, number of desktops, number of servers.
Whereas a number of events, or number of alerts, or number of API calls
are examples of information that is hard for a CISO to obtain
prior to deployment, making it hard to plan and budget.
Also, a la cart pricing options, rather than value packs,
make pricing unnecessarily complicated.
Perpetual licenses are less preferred than annual subscription licenses nowadays
because annual subscription licenses allow a CISO to walk away
should you not meet their expectations.
Finally, contracts that do not guarantee vendor performance
will get you an instant no.
Ok. Let's recap the 5 reasons a CISO will say no to your solution.
You do not have a plan or did not satisfactorily communicate
how your solution can be deployed in phases without causing any disruption.
Your missing key integrations and certifications that will prevent your solution from going live.
The proprietary nature of your product
creates a dependency on your product and pro services team.
Your solution is hard to evaluate or test drive in a reasonable time.
And finally, complicated pricing that makes it
hard to plan and budget and one-sided contracts
where you don't have skin in the game.
Remember CISOs typically have a technical background.
They enjoy a stimulating conversation and detest excessive salesyness.
So send your A team to speak with the CISO, and avoid a no.
That's it for this Dreamit Dose.
Be sure to watch the related dose, "Top 5 Reasons a CISO Would Buy Your Product".
Please leave your questions in the comments section.
If you find this video helpful, please Like and Subscribe.
If you are the founder of a great security startup,
email me at mel@dreamit.com or go to dreamit.com/apply.