[BEST OF] What CISOs Hate + The Alternative

Dear cybersecurity vendors, please stop doing this. Do THIS instead.

Today, I'm doing something special because, well, it's my birthday weekend.

I wanted to celebrate and gift you with a nice, little package of the best of the worst.

What does that mean?

Well, in every episode I ask my guest one critical question:

"What's the worst thing you've experienced from a vendor?"

So, I've compiled a nice little sh*tlist.

What's more, I always ask my guest:

"What's the alternative?"

Because what does it help us to hear complaints without learning how to do things better?

So, do me a favor, have a listen.

And if you want to spoil me for my birthday, apply those insights.

Stop Doing This:

• Coming in and spouting quantum and AI and ML and not being able to back it up
• Using people as a stepping stone to get to the CISO
• Overpromising and underdelivering, which gives a false sense of security; then move on and ghost your client
• Using **‘**Backdoor’ sales tactics to sell your tool when the buyer already told you no
• Using a person’s passion as a way to pitch and sell your tool
• Blaming security professionals for flaws or product defects
• Turning on buyers, using fear, and making people feel bad in email threads because they didn’t respond a day or two after your sales pitch
• Scaring people into buying something that ultimately they may never use
• Drinking so much and getting frat boy drunk. It’s not healthy. And, frankly, embarrassing AF
• Sending a calendar invite as if you've already had a conversation with the security practitioner
• Ambulance chasing
• Taking advantage of negative press for other entities is not a good move as a vendor

Do This Instead:

• Don’t use the “soldiers” and “lieutenants” as a stepping stone; treat them with respect and empower them.
• Stop overpromising and underdelivering.
• Stop selling false promises; it’s better to have no security than a false sense of security.
• Demonstrate how you solve the security practitioners’ problems and do so transparently.
• Build an authentic relationship; roll up your sleeves and work with the security practitioner on solving a problem.
• Show cybersecurity pros how your solution is going to make their lives easier in easily digestible formats that are not intrusive.
• Work with them to understand the problem.
• Provide much more trusted sources for ways that they can go and self-verify.
• Frictionlessly get buyers to information in trusted ways so they can make wise and educated decisions.
• Have honest, realistic conversations about what your audience's current state of affairs is and what they might need.