Welcome to the Dreamit Dose.
I'm Mel Shakir, and in my role as Securetech MD at Dreamit,
I talk to CISO's every single week.
To keep the organization safe, a CISO depends on as many as 50
to 100 different products across multiple categories.
When a CISO is dealing with so many products and vendors,
there's a full gamut of emotions at play.
So here are the 5 things that will help alleviate a CISO's
emotional response and get attention on your product.
#1 is need.
No CISO is going to buy your product if it does not address
a need they have.
It is however possible that they may not know
that they have that need.
On top of the CISO's mind is always the fear of getting hacked.
So products that provide a clear view of the threat landscape
always score high on need.
Examples are discovering or blocking a new exploit or malware.
Another example is the massive work from home situation due to
COVID-19 that created a need overnight to implement security solutions like
MFA (multifactor authentication) in a hurry.
These are times a CISO will exercise discretionary spending.
A second category of products, that are need-based,
are those driven by strategic priorities.
Such as reducing the cost or complexity associated with security operations,
or projects driven by macro or micro trends such as new privacy regulations
or the company's move to the public cloud
creating a need for cloud security or dev sec ops tools.
Most of the spending on strategic projects is planned and budgeted.
Remember needs driven by pain. And to manage pain you need a pill.
But not all buying happens due to pain.
So #2 is return on investment (ROI).
As a startup, you may be ahead of the market with a next-gen product.
As a result, there may be no defined categories or analyst reports
and it may not seem like a clear need to the CISO.
To demonstrate ROI, you have to quantify the outcomes as metrics.
There is a well-known quote…
"You can justify or manage, what you don't measure".
These words ring especially true in the security operation center (SOC).
Examples of cost savings and time savings metrics are
FTE or full time employee gained, and MTTR or meantime to remediation.
FTE gained from automation also helps with the cybersecurity skills shortage.
Lower MTTR implies improved analyst productivity and response
such as faster threat detection due to automation
and improved integrations or workflows.
These are all powerful motivators for any CISO.
A demonstrable ROI is like vitamins.
It can catapult a product to a must have.
#3 is credibility with peers.
CISO's talk with other CISO's.
Your success story with a peer CISO will get you instant street credibility.
If need and ROI won't seal the deal,
a good referral from a fellow CISO likely will.
As a startup, you may not have enough customer references.
But referrals from peer CISO’s, who have signed up to be design partners,
or completed successful POC's are also just as valuable.
Remember logos are important.
But logos become actionable only when they are referenceable.
#4 is timing.
It is important, but not always.
Because increasingly yearly planning exercises are getting more and more agile.
Micro budgets happen several times a year,
so CISO's can react more quickly.
Sending a proposal to a CISO right after budget is obviously not great timing.
But there are other types of timing that are important.
For example, product renewals, product end of life, and product depreciation.
Remember, CISO's are always looking to consolidate tools and vendors.
So proposals to replace legacy tools, nearing end of life,
with your next-gen product in a budget neutral fashion
(i.e. no added costs), are always received favorably.
#5 is vision.
This is all about making it personal.
Vision is a hallmark of all good CISO's,
and good leaders are always ahead of the curve.
To grab a CISO's attention, your story should clearly establish
how your solution will fit into their broader vision and roadmap.
All good CISO's recognize
that innovation lives with startups, not large companies.
It is much easier to influence and shape a startup's roadmap
to fit their requirements, and of course
they can get a better bargain from a startup.
So now we know how a CISO thinks and feels.
But how do we get to specifics that are relevant to their organization?
Well, do your homework.
Find champions within the company and do a prep call with these champions
before meeting the CISO.
Oftentimes, sales teams will gather such intel from direct reports
or fellow vendors or service providers.
What are the needs? What projects are in the pipeline?
Be prepared to discuss the ROI and your success story
with the CISO's they are likely to know.
Find out how the incumbent products,
that you are looking to displace, are performing.
And if all roads lead to a dead end, you can always lead
the discussion with probing questions and listen to what
the CISO has to say.
Every CISO I know will gladly share their priorities and vision with you.
All you have to do is ask.
Well that's it for this Dreamit Dose.
Be sure to watch 2 other related doses.
Nailing your first meeting with a prospect,
and how to crush your demo when pitching.
Please leave your questions in the comments section.
And if you find the video helpful, please like and subscribe.
We have a lot more coming.