to focus the focus of this whole process
was developed when I was out selling and
I was selling security stuff but I was
supporting and and selling with other
people who are selling all kinds of
stuff data center storage IP telephony
networking all kinds of stuff even
application developer in fact you can
use security to get into the door to
access the decision-makers in in a way
that you just cannot do with other kinds
of technology
you know the CIO doesn't want to talk
about storage but but if it's the latest
and greatest thing sometimes they will
talk about it but security just seems to
always be top of mind but there's a
disconnect there's a disconnect between
what's the messaging in the organization
and what the salespeople are trying to
do and a lot of times the people that I
meet in the sales side of the
organization are just making lots and
lots of calls in fact I was on the phone
with a guy the other day and he his
company has some really cool technology
they deal with security trends and
threat analysis to create information
that allows people to have a pro I'm
probably butchering this and I think
that person is probably gonna listen to
this but but they are creating the
intelligence that an organization needs
to defend themselves in a proactive way
getting away from perimeter security and
getting away from compliance oriented
security and getting focused on what's
happening and what's relevant to that
organization and being able to make
proactive decisions about what to do and
when those decisions get made it's more
than just defending the company its
messaging to to the customers like when
Target got hit you know there's there's
a whole sequence of events that have to
take place that's kind of immediate and
the more proactive you can be and the
more intelligence you've got the better
you're going to be and that's what his
company does but there's a disconnect in
the way that those things get messaged
and what those salespeople end up doing
and a lot of the salespeople that I work
with in my peak performers group are
making tons and tons of cold calls and
they're not getting to the people that
really matter and the message is
important the marketing is important if
you if you look at companies like Cisco
Oracle IBM these companies have had
strong marketing and have sustained them
so they've grown they've gotten big
they've you know they're huge
we could add HP up here as well and of
course they're getting very involved in
security right now if you if you watch
anything they're doing well you look at
companies like Wellfleet who used to
compete with Cisco and used to be the
same size of Cisco they're gone why
because they didn't have good marketing
and there were some other issues there
but but they were built by engineers
good technology no marketing to hurt the
other day 80% or 85% of the product
decisions that are made are already made
when they call you they've already gone
out to Google they've already done their
research and now they are shopping
they're shopping for what they're
shopping for the best price but when you
go after the ninety five percent to
people that don't need anything you need
something that you know they need but
they don't know they need okay let me
say that again you need something that
they don't know they need but you know
they do need it's got to be predictable
is what I call it and one of the things
I know they need they being anybody
especially people who are in
decision-making positions they need
security now here's the problem there's
actually several problems one is the
selling process is just too technical
there's also a marketing issue and the
marketing issue is this disconnect
between what marketing is doing in your
organization and what the sales group is
doing and if you could just imagine if
the marketing group had a strong
compelling message that everyone needed
that could reach out to the ninety five
percent move up the food chain get to
the people who make decisions and compel
them to meet with you and you had
qualified meetings imagine how much
easier sale selling would be now that we
also have an assessment problem there's
oh there's a lot of times there's an
assessment involved in the security
business and there should be this is a
great way to sell and assessments really
ought to convert seventy to ninety
percent of the time but most of them
only concert' convert about twenty
percent of the time and the reason that
is it's not because they're not urgent
issues they're it's because the way it's
packaged and delivered is not done
correctly okay and then the fourth issue
is that the presentation is boring and
here's what it looks like okay I go
through this in quite detail in quite a
bit of detail in my making money with
security program but
it's also in my bindle advisor class
where I talk about how presentations are
structured today most of them say you
know here's my company here's how big we
are here's what we have here's the
certifications we have here's the
products we sell here the people we've
done business with buy from us and it's
not that interesting okay it's boring
but we get in there with a compelling
predictably good presentation messaging
that's going to resonate that's going to
wake them up and that's what the house
and the cloud was built for to wake
people up and to get them from sitting
there passively to an urgent need and
that's why in the last five marketing
events I did following the making money
with security program and using the
event marketing success kit strategy we
have converted a hundred percent of the
audience attendees and these are
decision maker people these are above
the director level attendees and that
program shows you how to get them there
and how to move them to convert them
into the process into the assessment
process and then to convert them into
projects and manage services now how do
we change all this and here's we were
one want to focus in on the house and
the cloud material the house in the
cloud is built on this concept of impact
versus likelihood and if you've been
listening to me any time at all you know
I frequently refer to this graph this is
the reason why deals get held up because
everyone is out there focusing on impact
they're talking to their clients about
what would be bad if if something went
wrong what would the impact be you know
it would be disastrous you know you'd
lose this much money or you've got to do
this or else you're going to lose this
and the problem is the decision maker is
sitting there or a lot of times we're
selling this to the influencer who
really doesn't care about any of this
and and when it gets bubbled up to the
person who's going to make a decision
they're looking at the impact and
they're going well we know that but
what's the likelihood what's so
likelihood this is going to happen now
they don't go back to the salesperson
and say what's so likelihood they say it
to themselves what's the likelihood you
know what's the likelihood that I'm
going to get in the car accident today
you know it's that kind of thought do I
really need to put my seatbelt on today
is it okay if my five-year-old sits in
the front seat today because like
there's no traffic and we're just
driving
on the road you know it's that kind of
likelihood thinking and the problem is
they are ignorant as to what the real
likelihood is and this is what the
salespeople ought to be focused on when
I go into a company with an assessment
or a security discussion I want to move
them to want to know the likelihood I
want to show them why they need that and
I want to show them that I can get it
for them they understand the impact I
get that it's bad but if there's no
likelihood it doesn't matter and so what
I'm going to do is I'm going to show
them a way to get to that likelihood or
at least a good a good estimate of what
that likelihood looks like and when I do
that and that's what the house the cloud
does it it creates that opportunity then
it leads to conversion and if I really
do the right kind of assessment it will
always lead to conversion and I'll spend
a little bit of time I don't think I'll
have a lot of time for that in this
session but in the making money with
security program I go through about an
hour on the assessment process and show
how the assessment ought to be organized
how do the deliverable should look how
the deliverable should be done what data
collect and even what kinds of questions
to ask in the process and what to go
through to gather the information you
need to deliver that assessment but who
advises these executives on data risk on
data security you know IT doesn't in
fact there was a great article in The
Wall Street Journal not too long ago
Mike McConnell who used to be an advisor
to the White House is talking about
information security and he he
recognizes there's a huge wall between
IT and the executive management team and
he says in the article this wall has to
come down but you know what that is that
is hopeful thinking wishful thinking but
it's not going to happen and having
worked in IT for a long time the the
barrier between IT and the executive
management is big and it's not coming
down anytime soon so who is going to
advise the executives on risk mitigation
and it's got to be it's got to be you
it's got to be the the third party
person who can look in and see the
issues and see the risk and help them
because they're not going to go to IT
and their compliance officers not going
to do it either
now the key ingredients to becoming that
advisor are pretty simple the trusted
adviser
must be what trusted well that's you
know it's one of those character issues
that that everyone just needs to develop
a trustworthiness but then there's this
ability to advise ability to advise on
things that matter and so building
expertise in understanding information
security concepts is important now I
want to be quick to say this is not
about the product this is not about
sales people learning more about
firewalls or reading the data sheets
that come from the information security
providers that you deal with let your
engineers do that your consultants do
that what you should be thinking about
is what are the trends out there at the
Wall Street Journal level critical that
is what makes the sale that's what gets
you away from the product and turns you
into the consultative sale and creates
that trusted advisor mentality now
number two we've got to have predictive
messaging if we're going to be marketing
successfully marketing good marketing is
getting the right message to the right
people at the right time
security marketing is about content
marketing it's about information
marketing and so what we want to do is
understand the concepts and so there's a
few of them on here first of all if we
look at CI a confidentiality integrity
availability these are the three pillars
of security if something needs to have
confidentiality meaning it needs to stay
private it needs to remain confidential
like credit card numbers account numbers
health care information all those things
are governed by federal standards like
HIPAA and GLBA and sarbanes-oxley and
other requirements out there but really
anything that a company considers to
have a high need for confidentiality
like company secrets for instance is a
security issue
it's conversions all about conversion
and then I've got to have something to
convert them to and I love converting to
an assessment at that point in other
words let me get that person worried by
giving them the facts giving them the
information and then show them that I
have a way to determine their impact
likelihood and that's the effective
assessment process now just any
assessment is going to convert maybe 20%
of the time but see that's not good
20% of the time is lousy it's a failure
in my opinion I'm looking for 70 80 90
percent conversion about that what I'm
trying to
here is create a vision with my audience
by showing them the the major issues
that they have against the major assets
that exist so rather than looking at
internal and external or networks and
perimeter or in no devices and something
else I'm looking at information this is
the most important information your
company has you told me that in the
interview this this and this and you're
prioritized it for me and they should
have they can they can do that and then
I've gone out and I've looked at how you
work I've looked at your workflow I your
end-users I've looked at at what their
computing on their platforms and how
they compute and how they interact with
their clients and the web services that
use the cloud services they use you know
the average major enterprise company out
there is operating on somewhere between
250 and 300 cloud applications today so
where's their data they don't know well
I've done a lot of work with PwC worked
on projects with them and I've done a
lot of work with Accenture and these are
the things that I've seen first of all
an assessment is a marketing tool it's
and what I mean by that is it's a way to
get the right message to the right
people at the right time okay that's
what marketing is and that's what
assessments do and they convert when
they're done properly the adviser is
there to develop a roadmap here we are
now here's we're going there selling a
future a result not a methodology not a
product and then they're associating
their fees with the value that company
is going to receive and they're
presenting in a way that resonates with
that or with that group of people with
the people who are going to benefit from
it which is typically not IT how do I
get to these people and that's that's
where the the house MacLeod book really
comes into play and as I go through the
presentation this is what I'm doing in
the making money with security program I
am showing the salesperson how to put
together the presentation and what
principles behind that presentation
actually cause it to convert that
customer so this is this is going to be
a piece of what I actually use in the
luncheon learns that I do so if you have
the event marketing success kit which is
also available on my website in that kit
I actually show you how to construct the
presentation and how to convert the
people from sitting in their office to
coming to the event
into an assessment and then into a
project and in into managed services
okay that whole sequence of conversion
is the event marketing success kit the
making money with security program is
the messaging and the security sales
value proposition behind all that and of
course you could use other messaging in
an event but I found that the making
money with security message is the most
compelling and delivers the highest
conversion rate now the house the cloud
in the coverage model was named the
house in the cloud book is really the
house the cloud in the coverage model or
in this framework is actually three
questions the house the cloud in the
coverage model it's four pieces and
these four pieces you know 95% of the
time when when Nate Freeman when I
interviewed him last week he commented
several times
I'm surprised when this doesn't work cuz
it always works and every once in a
while if something's not you know if I
don't do it right or something like that
you know I don't get the response I'm
looking for I'm kind of like surprised
because it always works and I'll tell
you what my success rate with this has
been very very high well that's why the
conversions been so high because it
works now this framework consists of
three questions a house a cloud in the
coverage model okay so I'm going to take
you through these things very quickly
and show you how they work
first of all the three questions okay
the first question comes up and I'm
going to just take you through this kind
of like I want to give you an example I
want to go back to that firewall
opportunity that I had years ago when
this really first started to gel and and
use that as the example because it is
just a great example okay it's a
firewall upgrade and the IT organization
does not want the upgrade okay so so
I've got this lead you know quote lead
hand to me by a manufacturer vendor
partner who says here's someone who has
to upgrade their firewall and they want
to quote and we'd like to convert them
to our product and here's a lead right
so your job your mission is to drive for
hours from here meet with their IT
person convince them to consumers our
brand firewall and sell it okay and
you're gonna get like 10 points a margin
on this what you and I know is not even
worth making the drive right so so it's
not what we did in
said we used a process that I go through
in some detail in the making money with
security toolkit here I show how we got
access to that decision maker I don't
have time to go through that here today
but I do that in some detail and it
worked it got us to the executive vice
president of operations for that
organization and so when I sat down with
that person as well as the IT person and
there was also an IT director in the
room at the same time the first thing I
did was move away from the firewall
conversation and ask that executive what
are you really trying to protect here in
this organization and they started to
share with me now the IT person one to
answer here but but we don't want to
here network firewall data center disk
we want to hear what data and what
things are really essential what kind of
company's secrets are you're really
trying to protect here what's important
and so that person began to share is
financial institution some of the things
that they're really trying to protect
and when they finish that took him like
20 minutes to do this and they did all
the talking I'm just like taking notes
feverishly here when they were done I
said well what threatens that stuff like
what are you afraid of and I'm thinking
you know it's a contractors is it
competition is it people overseas is
that it nation state-sponsored attacks
is it you know what is it and so and so
he began to talk about some of the
people who have access to this data they
were doing a lot of third-party
processing and they've got contractors
on site and so forth and so he gave me
about ten minutes on that and then I
said well how comfortable are you with
your ability to detect and respond
before something happens before
something bad happens and I think he
looks over his IT person and I said well
I'm not interested in the IT person's
response here because you're liable for
this well how comfortable are you right
now with your ability to know what's
going on out there and he said well not
barrier I don't really know I you know I
don't even know how to answer that
question ready works have you ever
thought about how security works and
security works on this impact likelihood
thing right
we understand impact and I've already
talked about this I won't go into detail
but I go into a lot of detail in the in
the in the toolkit here because it's
it's critical to really understand be
able to operate with this thing and
convert the sale
okay but how does security work so I got
up and I drew a house on the board and I
said let's talk about a physical
structure out there like your house and
let's talk about how you secure your
home okay
so this is the house in the house in the
cloud it's your house and the question
is how do you secure your house and so
we started to list things on the board
on the whiteboard so I'm standing up
he's sitting down and I'm asking him in
the group anyone what do you do to
secure your house and they're saying
things like well we've got you know
fences and doors and locks and windows
and alarms and and dogs and well we're
in South Carolina at the time we got
handguns you know all kinds of stuff and
so when we listed all that stuff on the
board we came out with a list like this
doors windows locks fence alarm motion
detection crime watch monitoring dogs
guns police insurance k12 things and I
said you know this is what we've been
taught this is what we believe to be
securing our home or whatever it is
we're doing but you know all security
works exactly the same whether it's
health security or a digital security or
it's a it's a bank or it's a military
installation or it's a prison an office
building like the one we're in right now
all these things operate on the same
principle and these things that I listed
the doors the windows the motion
detection the dogs the gun these are not
what secured your home but we've always
been told they are and of course they
had a puzzled look on their face at this
point and I drew lines between the doors
windows locks fence and the alarm motion
detection Crimewatch monitoring and
between the dogs guns police and
insurance I've got three groups of four
I draw the cloud the cloud is the third
component of the matrix and in the cloud
I'm showing them what the networks look
like if we look at today's networks we
got your private network your trusted
network um we've got the cloud out there
the internet not not the cloud you know
application but the internet and of
course the Internet is completely open
and hopefully your personal network is
secure at some level but what's securing
it firewalls VPN or encryption passwords
and what is that all
stuff is protection column column one
stuff and then the last piece of this is
the coverage model this is what security
ought to look like protection detection
response across the top and then down
the side of a matrix a three by three
matrix we have administrative technical
and physical and so in the nine boxes
that sit among these headings we've got
things that are protection and
administrative or detection and
technical or detection and physical or
response and technical and we're able to
fill this in but we don't fill it in in
the meeting we just show them this is
what it ought to look like but most of
our decisions including the meeting I
was in at that moment was focused on
picking out a firewall which is a
protection technical but without the
nine box matrix in place and so there
are five critical components of
marketing they are simple concrete
disruptive credible emotional simple
concrete disruptive credible emotional
it turns out that all sales are
emotional there's a lot of reasons why
explain a little bit about how to work
those emotions in a sales process in the
making money with security I go into a
little bit of the biology of how the
mind thinks and how it processes
information including your presentation
which shows you how it needs to be
presented now I'm not talking about
manipulation here I'm just talking to
you about what works you know when I
when Hollywood put together a movie what
works you can take two movies that are
that are both factual and present one
one way and nobody will watch it and
present it in another way and everyone
watch it and it will get high rating but
it needs to be visual that's what
concrete means so concrete means they
can see it so when I talk about ports
and layers and protocols they can't see
it but when I talk about homes and
protection detection response and dogs
and guns and things like that they can
see it and as I create this emotional
picture I'm able to move through that
it's got to be urgent that's what I'm
looking for in the assessment I'm
looking for the urgency can you imagine
if you had a pipe leaking in your wall
and you you sense that it was leaking
maybe you heard it you call the plumber
the plumber comes over investigates
and determines sure enough there's a
pipe in the wall that's leaking and so
he comes back to you and he says you
know I really think there is a pipe in
there leaking let me go back to the
office and get together with my guys
we'll put together some options a
proposal for you and I'll send that to
you on Monday
what are you gonna do are you gonna wait
until Monday no your house might be
completely dissolved you know today's
houses are building sheetrock and it
just dissolves when there's water and
then mold is going to grow in there and
it's going to be a disaster and it's
urgent
like a pipe burst well if data truly is
leaking out of the organization right
now is that more critical or less than a
pipe work product services everything
now how do we get that opportunity we we
have to create the opportunity to give
this message this kind of messaging to
the executive in an urgent way and
that's what educational marketing is
about and there's a lot of ways to do it
but cold calling is not the way to do it
you can you can start out with some kind
of campaign even using landing pages and
and sending them different things
sending them a recording of an interview
with a security specialist or sending
them a book like my data at risk book
these things were built to get people
thinking about it and then inviting some
of the technical people to webinars is
good but executives to luncheon learn so
don't don't it you don't want to invite
technical people to lunch and learns
because it's it's too costly and they're
not able to convert to what you need but
if I invite the technical people to
educational webinars educational and I
invite the executives to luncheon learns
and I use the event marketing Lunch and
Learn process in the success kit it
shows you how to convert everybody
through to the assessment and how to
convert the assessment to the project
then okay and what I'm doing is I'm
casting a net wide and I'm pulling these
people in through different means to get
to the point where I've got an asset
owner in a live meeting whether it's a
Lunch and Learn event or it's a briefing
inside a company or some other kind of
small group meeting that allows me to
move those people to quantify those meet
people and kind of parse my audience and
get to the people that really matter and
move forward with
assessment on those people
you