Sales & CISOs - What not to do...

Sales "Don'ts"

?Cold Call. Honestly, the instances where a cold call materializes into a deal are miniscule. No one likes being caught off guard - it doesn't garner trust to want to work with you

?Cold Email. We're security professionals who constantly tell our organizations not to click on links from people you don't know. The fact that I ended up on your email list without my permission is problematic and not a good start to a business relationship.

?Add your pitch to your connection request (or InMail) to me on LinkedIn. Instant "Ignore" for me here...I don't know you and by pitching me before we have any interaction says to me that you are more important than anything I have going on.

?Pitching me without any prior interaction. Similar to above, if I've never had an interaction with you, why would I "bite" on the very first pitch?

?Asking for 15 minutes of my time. If I said "Yes" to everyone who asked for 15 minutes, I'd be fully booked until the end of the year (no exaggeration).?

?Talk bad about competitors. This is unattractive and actually makes you look worse for knocking others down. It's one thing to be honest but do it in a professional way that doesn't tear them down. I frequently ask, "What does your competitor do that's a differentiator to what you offer? What do you do that is a differentiator from your competitor?"

?Lack understanding of what you're selling or overconfidence of what you're selling. Not being equipped to answer questions, failing to understand how your product/service fits into the security stack, how your clients leverage (specifically clients who are my size/industry) the product/service or being too confident in your offering are not good things. It's good to be confident in your offerings but overconfidence is a turnoff.?

?Reply to a post on LinkedIn that, "Having my product would have solved this or prevented this". I promise you that no CISO looks at that and says, "Good point, let's talk - I want to buy your product". Unnecessary, self-serving and counterproductive.?

?Unclear intentions. Don't tell me you want my feedback on your product when what you really want is a new customer. Don't say you love my LinkedIn posts and want to talk only to get on my calendar to pitch me. BONUS: If your title isn't clear that you're a salesperson but you are, change that or be upfront about it.?

?"Click here to book my calendar". No, just no.?

?Sign up for our whitepaper or some other "free" collateral. As a cyber professional who deals with privacy matters, giving you my information only to be added to your mailing list, have people start calling my office looking for me is not something I want to do.?

?"What are your initiatives for this year?" - I am not going to answer this unless we have a relationship and trust has been built. My initiatives can highlight gaps in my environment and can be pretty sensitive in nature.

CISO "Dont's"

?"Just give me the price". This is flat out lazy and not fair to salespeople. Would you go to a grocery store and ask the cashier to just give you the price for your groceries? No, you wouldn't because you understand they couldn't possibly know what all you needed. If you are the LEAST bit interested but cost is a prohibitor, say that!

?Unrealistic pricing expectations. Vendors have to make a profit so trying to get things "at cost" or with the smallest margin possible doesn't help our much needed vendors stay in business. I'm not saying to not negotiate a great deal, I'm saying to be realistic...

?Ghosting. I touched on this last week but if you actively engage with a vendor, see some demos, see pricing or have had conversations, be a good person and clearly lay out why you are not interested. You're forgetting that a sales team put a ton of effort to align resources to show you a demo, worked with their finance team for pricing and have superiors to which they are reporting status on. Ghosting them makes you look bad and leaves others hanging in the balance because you're not honest enough to close out the opportunity.?

?Withhold budget cycle information. If you're not up front with your budget cycle and have to tell someone in May that you can't get anything on the budget until January, you're wasting their time to "jump" and react on something that can't possibly pan out until much later in the year.

?Write off companies entirely with "I'm not interested" or "We're all set". Thanks to @Asa Hunt for adding this to my post yesterday. His comment was that when we, CISOs, say this what we're saying is, "We don't have any room for improvement or are intimately familiar with the entire vendor landscape". I agree with this sentiment and see it is a pitfall some CISOs make.

?Talk down to salespeople (or anyone). You may think you're hot stuff and see yourself as being better than salespeople but reality check: you're not. They are people too and deserve respect. Would you appreciate an executive team member talking down to someone on your team? Probably not.

?Ignore all salespeople connection requests.?

?Only work with large corporations. I think of that older quote, "No one ever got fired for recommending Cisco". Nothing against Cisco or other large corporations but I think you're limiting yourself if you only work with more widely known vendors. Some smaller shops have INCREDIBLE offerings and usually better customer service or a more flexible product...

?Implement the same thing at each new job you take. Every environment and its needs are different...Don't let your previous bias come into play and possibly shortchange yourself (and the environment)

?Don't make assumptions. Companies grow, offerings shift, products/services improve...Don't write a company off because they were missing X feature back in 2007.

For both groups here, I'd say don't take everything personally! Opportunities that don't work out, products that don't deliver, executives that say "No", budgets that aren't open are not a personal affront to your livelihood. A rejection of the offering is not a rejection of you personally...