How to Sell to the CISO: David Gee, who is a ... CISO

[00:00:00] [SPEAKER_00] This episode is brought to you by FastRamp2Revenue, the done-for-you new hire sales program built exclusively for cybersecurity companies. We bring the process, the frameworks, the training and the coaching, you bring your content, and we customize everything for your market and for your company and run the entire program for you. You don't have to pull a single person off your team to do it. Proven at over 15 cybersecurity companies? Get your new reps selling faster.

[00:00:28] [SPEAKER_00] Visit unstoppable.do to learn more. You know when you're told, go sell this to the CISO, but not told how to do that, and you walk into a high-stakes, high-impact meeting and left to just kind of figure it out? Don't you wish there was maybe a book about how to sell to the CISO? And if it's going to be a book, maybe it should be written by a CISO. Yeah, well, I found it. And the author is joining us today.

[00:00:54] [SPEAKER_00] David Gee has been leading IT and security teams since the 90s. He's been CISO or CIO companies such as Eli Lilly, HSBC, and many others you recognize. And he's just retired and started writing books. One is called A Day in the Life of a CISO. And his latest is called How to Sell to the CIO and CISO. Yeah, really, these books exist.

[00:01:18] [SPEAKER_00] Oh, and these are not cute little e-books with 20 pages of generalities or just, you know, very basic advice. These are each hundreds of pages of detail, of specifics, of examples, of stories, the whole lot. And David joins us today. Frankly, we only scratched the surface in this interview, but we do talk about things such as why sometimes a CIO in the room might not be quietly working for you and might be working against you.

[00:01:46] [SPEAKER_00] We talk about what has to be true sometimes before a CISO might break a one-in-one-out rule that they might have. Why it matters, the career stage of the CISO, and what to say when you finally get to meeting with that person. So we talk about a whole bunch more. Here's David. Well, David, welcome to the podcast.

[00:02:16] [SPEAKER_02] Thank you, Andrew. Excited to be here.

[00:02:18] [SPEAKER_00] You know, I'm genuinely looking forward to the conversation. We haven't really planned out or scripted out anything we're going to talk about. It's going to be a little bit free-flowing, but you've written the book. And, you know, this is going to be fascinating, I think, for the audience to hear all about your advice and the world that you've been in.

[00:02:36] [SPEAKER_02] Can I wave it around?

[00:02:38] [SPEAKER_00] Yeah, yeah, go ahead. Do it. We're going to talk about this in depth. But first, David, you're not the first, but one of the first people to play the cyber go-to-market talk, spin the wheel game. We've got five topics today. Overrated or underrated cyber donut hot seat. It's personal. Visionary or smoking crack. And differentiation teardown. Are you ready for me to spin the wheel?

[00:03:02] [SPEAKER_03] Let's go.

[00:03:02] [SPEAKER_00] All right. All right. So we will come back at the end, and it's overrated or underrated. We're going to give you some things, and you're going to tell me whether you think they're overrated or underrated. But let's get into the episode. So let's think about this, right? So, David, you spent almost your whole career since the 80s in IT organizations.

[00:03:29] [SPEAKER_00] You've been leading IT organizations for a long, long time. For example, 15 years at Eli Lilly, including the CIO of the Americas, various financial organizations, including being CISO of HSBC. You retire, and then you write a book called How to Sell to the CIO in CISO. Why are you writing books for vendors and salespeople?

[00:03:49] [SPEAKER_02] Yeah, Andrew. I've also been selling all the time, right? So, you know, selling. I've been a partner at KPMG and EY, and so I was selling services. But I was also selling myself up to organizations, and so I was selling ideas. And so I've always, from a brand standpoint, thought of myself as to be a transformational leader. Okay, how do I make organizations transform when the teams that work with me transform? So how do I coach people to be their best versions of themselves? You know, I think about this from a scale of things.

[00:04:19] [SPEAKER_02] We all actually operate within a range, you know? Today, you're seven. Yesterday, you were eight. Next day, you're not getting so great. You operated six out of 10. So how do you coach people? So that's always intrigued me. So organizations can operate at higher bands and lower bands. So writing a book about that was sort of my journey of thinking about this. And if I go way back to, you know, I write for Foundry, CIO Magazine and CISO Magazine.

[00:04:45] [SPEAKER_02] I, you know, wrote a couple hundred articles, I think, you know, 9, 10, 15 years ago when I had some time on my hands. And then I always wanted to write books. That was the background. When I retire, I'm going to write some books. So prior to retirement, I said, okay, I'm going to retire at 65, okay? So it was two years ago I retired, and I told the office 15 months before I retired, hey, I'm going to retire about this day, July, about July, August. And I picked the 4th of July, by the way, is my retirement date, Independence Day.

[00:05:13] [SPEAKER_02] And so I had an opportunity to write my first book in that first 12 months or so as I, you know, started thinking about transitioning, that I want to transition to retirement, but actually not stop doing things because my wife said, like, horrified, you mean you're going to stop? I said, no, no, no, I'm going to be doing boards and advisory and stuff and, you know, write speeches and be keynotes. And then I said, so I wrote, I actually wrote a book, it just wrote autobiographical. And it was actually the aspiring CEO and CISO.

[00:05:40] [SPEAKER_02] And so this was the career guide to how do you become a CEO and CISO. And as I was writing this book, it became evident that actually, well, firstly, a lot of the people that write these, you know, in these roles are actually quite shy and they don't like to be open about things. But then I noticed actually as I launched this book and I did, you know, 20 or 30 events around the world doing this launch that salespeople were buying my book. 20% of the sales was salespeople. And I thought, that's interesting.

[00:06:07] [SPEAKER_02] And then they would say, David, we don't understand the mindset, how these people think. Oh, okay. So, but I had thought about my book three being how to sell to the CEO and CISO. I just wasn't sure the market was ready for it. So fast forward, I started writing this book and then I said, well, actually, I'm actually worried that my colleagues don't want to share information. So how about I ask a few of them? Maybe, maybe I'll ask five or 10 or 15. I kept, I kept asking more and more people. Okay.

[00:06:33] [SPEAKER_02] So, and so Dan Love of a CISO was my second book, but that took me 15, 16 months to write because it was, you know, sometimes six months approval process for, now this is the White House CISO. Some years ago, well, under Trump's administration, getting those approval process takes five, six months. Right. So, yeah. And frustrating because it's 20 pages. Yeah. And so, again, this book, you know, 500 pages, a lot of people have sold that to salespeople because that's what I'm saying, the mindset.

[00:07:01] [SPEAKER_02] So I kind of knew there's a market there for me to do that. But I think the, fundamentally, Andrew, I think the whole idea around this book was, yes, there's an angle around as a CEO and CISO, you're frustrated how bad it is now. The process is kind of flawed, very spammy. You know, you feel like you're underwater because you're getting 100 emails from salespeople a week, you know, 20 to 30 LinkedIn requests coming through, invited for events every day of the week for lunch or dinner or breakfast or drinks.

[00:07:31] [SPEAKER_02] And so you're getting all this stuff happening to you, phone calls coming to your private phone numbers, someone wants to talk to you about stuff. And I thought to myself is actually, how do we change this? You know, back to my transformation thinking, how do we get best practices and put them into a book, right? And again, this is, say, thick. And get others to give me quotes and insights. So I had 55 others provide, I didn't put them on the covers, Tim, and provide quotations for me. And they do that more holistically.

[00:07:58] [SPEAKER_02] So, you know, it's vendors and CIOs and CISOs and research analysts and advisors. There's a CFO in there. There's a chief procurement officer there. So having our 360 review of things. So it's not just David speaking, but actually it's the industry talking about this is good, this is bad. And my hope was actually we create a way where that's the standard. We want this standard, a higher standard of level. And so that makes it all about change.

[00:08:25] [SPEAKER_02] So I'll just, I'll pause for a minute, Andrew, but change is really important for the C-suite, right? So if you can't get the right change happening, your job's kind of over, right? And so because they're frustrated with the process, they'll shut most people out and block you out.

[00:08:38] [SPEAKER_00] Yeah, for sure. And, you know, I'm glad you brought that up. But the book, I mean, both these books are 500 pages. But because you interject all the anecdotes and situations with all these other people, it doesn't feel like a 500-page read, I'm going to tell you, right? As you're going through it, it's like, oh, that's interesting. There's the, you know, the CIO from this company talking about something and the system from that company. It's really well put together. I find it really interesting going through it. Thank you. It felt like a jigsaw puzzle, by the way.

[00:09:07] [SPEAKER_02] It felt like a headache because you actually had all these voices talking to you and you're trying to then figure out how do I... You knitted together. Clustered in the right place. Yeah, yeah.

[00:09:15] [SPEAKER_00] Yeah. But I think you hit on something there at the start. You know, if I think about my selling career, David, I've been in cybersecurity sales world since 98, been at a bunch of different companies. And I would say my experience is that if we as a sales team, wherever I was, got, let's say, we wouldn't get as much to 100 hours. Let's say we got 100 hours of training in the year about to do our jobs and all the rest of it. And I would imagine maybe two hours of that 100 is about the people we sell to.

[00:09:44] [SPEAKER_00] And it's often a throwaway line, right? It's like, oh, this title cares about these three things. And that's it. And that's about it. And then, you know, the way that you get good is you put the hours in and you work and you contact, you talk to people and you build trust and you go from there. But the actual, look, here's how this all works behind the scenes and how these teams work. Just never had anything like that before.

[00:10:07] [SPEAKER_02] Yeah, it's fascinating. As I mentioned, I work as an advisor for a few select firms, right? From Silicon Valley, Tel Aviv, and so they're trying to get to my network. And I always tell them, you know what? I have a network. I value the network. It's growing. People trust me because I'm my next peer. So I can't just spam them because you asked me to. That would be going against my book, okay? But you need to have preparation. You need to be thinking about what's in their mind, what's on their agenda.

[00:10:34] [SPEAKER_02] They're initially something that, you know, often, Andrew, it's actually not actually written down. It's not. The strategy that's been written down and being executed often is too late because you've already, that's been sold to. It's the stuff that's happening, yeah? 12, 15 months out. Where it's probably not budgeted, probably not approved. But they're thinking, actually, I really need that because I'm thinking the business issue is going to be this. How do I address that? And trying to understand that in preparation, then, you know, then perhaps having that discussion. And it's a two-way discussion.

[00:11:04] [SPEAKER_02] It's not a pitch, right? It's really important. And I've seen it work really well where, you know, I'll give you a small example. We're working with a vendor and they're trying to get to this very large Australian company. And I said, well, I'm not going to just send this message to them. Let's give me something interesting. There's a business problem they have that you know about, right? And so he came back with an idea and said, look, this is a business problem. Gives you more security as you cut your costs. Yes. And so I flicked it to him, like literally two sentences and said, look, this looks interesting.

[00:11:31] [SPEAKER_02] Are you interested in having a consideration of this, right? Within a few hours? Yeah. Wow. Let's have a look. But it was because the target message hit the spot in terms of the objectives was about increased risk, reduced risk, sorry, and lower cost. And it was a unique proposition in terms of category. So that meeting happened. And that was literally the way it should be, which is it's a need that hasn't been thought through that he wants to talk to. So for me, it was actually, wasn't work, it was easy, right?

[00:12:02] [SPEAKER_02] But for the, versus actually all the hard red, you know, sorry, red color, blue, opposite a blue ocean, it's all red. It's all sea of red, which is just blood and people don't enjoy it.

[00:12:12] [SPEAKER_00] Yeah, I noticed there's two CISOs contributed things to the book and it was an interesting contradiction from them and interesting on this topic, right? So one of the CISOs said, you know, it's astonishing how many vendors turn up and explain things to me and all the rest of it about this is happening and all the rest of it as if I don't know what I'm doing. And there's another one saying, you know, I want people to come in and tell me things I don't know, right? So how did you think about that?

[00:12:41] [SPEAKER_00] Like, do I want to be told about the future or do I want someone to listen to me about what I care about?

[00:12:47] [SPEAKER_02] And by the way, there's more than two. There may be about eight, I think. I think it depends. It goes down to the person's persona, Andrew, too, as well, right? And perhaps there's also in their mind, every C-suite person I know, right, they're overloaded. Their brain is overloaded.

[00:13:03] [SPEAKER_02] And so if they had a bad day and you're coming in trying to talk to them about stuff that's not on that list of 10 things on their head and it's number 11, you're going to get rejected because it just doesn't meet what's in their current mindset. And so it's tricky. And I understand it's a tough job, but that's where the magic happens, right? How do you read the signals? And I even talk about the fact that if you turn up for a meeting with me and I've just had an incident and I've said, look, I'll take it.

[00:13:32] [SPEAKER_02] You probably should say, no, look, David, go and deal with that because you're not going to be focused on what I want to talk about. Let me give you back the time. I'll come back to you in a few weeks' time. Now, I know that's hard because sometimes as a salesperson, you may have taken months or more to get that meeting, sometimes three months. But if you said that, I would actually respect that versus trying to give this message and you're not listening to me. And you look at your phone and you're going, oh, geez, I'm going to lose my job. And that's a hard trade-off, isn't it, to make that decision?

[00:14:00] [SPEAKER_00] Yeah. The example you gave was where trying to get to the system for the first time. Would you, the other approach that salespeople do is they'll work with the team, right? They'll work with the middle management team and build up, I don't know, knowledge and trust and all the rest of it. And then say, okay, now is the right way to go. Is that the best way to do it or?

[00:14:20] [SPEAKER_02] Yeah, no. Look, I think that warm introduction we talk about coming through champions is important. And so champions, and there are some C-suite people who said actually, you know, become this way, top down. I'm going to be a bit annoyed because you haven't worked with my team. But I've also seen when I was working as a divisor is that, you know, often the vendors start at the bottom, the technical folks, because they don't have the top of the relationships. And the truth is that you need both ways.

[00:14:47] [SPEAKER_02] You need both ways to work and you need that to come in where, you know, ideally, you know, your champion says, hey, Andrew, I've got an idea, which is I saw that we've got a gap in this. Are we thinking about doing something about that next year's plan, right? And so Andrew will go, oh, no, that's interesting. Let me think about that, right? And it depends on that relationship between David and Andrew, whether you actually give much credibility to that. But then you go in a conversation with having coffee with your mates or your girlfriends or friends. You'll say, hey, what are you doing about this?

[00:15:16] [SPEAKER_02] And you'll, oh, yeah, I'm doing that. So that sort of warm network peer thing is that there's a number of networks happening this way and that way, right? And so you're working both ways. And then you're saying, okay, hey, Dave, let's talk about that again. What's your idea? You know, what should we do? Who do we consider to solve that business outcome problem we have? And I think that's the dynamic that happens, right? It's not always just one conversation. It's many conversations.

[00:15:41] [SPEAKER_00] Yeah, it's not an easy formula, right? You have to really, that's where your EQ as a seller has to be really on point to understand all these different dynamics. One of the things I noticed about the book is there's multiple times throughout you write about the concept, obviously, of trust, right? And building trust. You talk about it being a bank account with deposits and withdrawals and things like that. Give us a sense of, you know, if I'm trying to work with a company, how do I really set out on the right foot and start building that trust along the way?

[00:16:10] [SPEAKER_02] Yeah, I think I've got a chart there somewhere, Andrew, that's called the three C's, right? And it's competence and competence, confidence. And what's the other one? And I'll get back to it. But I'll use the example because I think at the end of the day first, your first thing you notice is competence, which is this person I'm speaking to knows what they're talking about from a competence standpoint. They've got some domain knowledge on a topic that I'm curious about, right?

[00:16:35] [SPEAKER_02] And then the confidence part is that person's actually speaking to me and I get a good sense of presence. That person's actually, you know, a person that I could work with and there were elements of trust. Now, the third C, I'm trying to remember what it was, but eventually it was all about that I'm seeing you provide this service over time. And it's actually incredibly trustworthy.

[00:17:02] [SPEAKER_02] And you're actually giving me, there's not continuity, you're giving me what I expect you to do over time. So it's not actually something that you'll see initially, which is the, you know, the pure technical competence. You'll see, okay, delivery and it'll come back to me at the end, I think.

[00:17:18] [SPEAKER_00] Your competence, character and consistency.

[00:17:21] [SPEAKER_02] Thank you. Thank you. And consistency is the piece that you get over time, which is, okay, contract signed. I now have the A team with me the whole time, not the B team put in, sorry. And so I think that matters because people judge you and keep judging you. And if you keep providing those three Cs and that trust gets built more and more from being distrusted to being more preferred and perhaps every now and then you'll be an MVP, right? But that's pretty rare.

[00:17:51] [SPEAKER_00] Yeah. My feeling is that the first contact on your site, people are very skeptical of the salespeople they're working with, right? They're like, you know, what's going to happen here?

[00:18:01] [SPEAKER_02] Oh, massively. No, it's actually distrust.

[00:18:03] [SPEAKER_00] Yeah. Distrust. There you go.

[00:18:05] [SPEAKER_02] Distrust. Yeah. It'd be the right place to start because of all the bad practices going on, right? You'd actually think, hi, okay. You got through to my phone number? Okay. What do you want, Andrew? Okay.

[00:18:15] [SPEAKER_00] So we're starting from a low point, right? So all we have to do is build. We don't have to lose at this point, right? So just try to gain, gain, gain. So if I look at competence, character, and consistency, any examples where the sales team or the vendor itself has just completely got it wrong in those areas that you can remember?

[00:18:34] [SPEAKER_02] I think I talk about, I mentioned before about bench strength's important because I think you see that consistency pieces, you know, being, they're willing all the stars, architects, and the likes for the sales. And then when the implementation comes, they disappear because they've been assigned elsewhere. Because look, in the day, right, if you're putting yourself on the line to actually put a change forward, all that sales process is great, but you actually want the outcome at the end. You know what I mean?

[00:19:00] [SPEAKER_02] And so that's where you care about, that getting the outcome, driving that change, being told, hey, David, that's pretty good. I like that, you know? A little pedal to the back. Not much pedal to the back. A little pedal to the back. Keep your job, right? Because I think that this whole psyche for these C-suite people, particularly CISOs, right? What's the average tenure is what? Two years? Three years? Right? So their career is not that long. So making a mistake is life-threatening for them and their own position.

[00:19:27] [SPEAKER_02] So they want to see consistency. They want to see performance. I want to see people giving them the best. And so that's important, I think.

[00:19:35] [SPEAKER_00] Yeah. You mentioned change a couple of times now, right? The idea, a leader is there not to just keep the lights on. They're usually there to make transformations and changes and things like that, right? I heard a great line from a CFO who was talking to salespeople. He said, you know, whatever you might think, really the purpose of the sales cycle is to build the business case for change, right? To help the company realize they have to do it and then how do they actually go do it. Does that ring true for you as you think back? I do.

[00:20:03] [SPEAKER_02] I do. And look, there's a lot of criticism of CFOs getting in the way. And so I think there's like a chapter 18 or 19 is about procurement and Beagle and all these parties. And so that overall role to play, right? So, you know, frustratingly for the vendor and also for the C-suite, they slow me down, right? They'll put in barriers that don't seem to help me because I want to get my outcomes. And so they're worrying about compliance. They're worrying about contract wording and IP wording and so forth.

[00:20:33] [SPEAKER_02] All those things I think are important, but actually you care about the change. You care about the outcome. And this is why you're there, I think, you know, when you think about it. This is why you're in chair. And clearly every C-suite person can be one of the new personas, whether you're a transformation or a more business focused or a risk-based person, but you care about change. Even the ones who are BAU care about change. It's a different degree.

[00:20:59] [SPEAKER_00] And how do you align that to the stage? You talk about the stage of the CISO's career, right? I think some might be early on, some might be more mature, you know, be in the role a long time. How do you align their appetite for change to how long they've been there?

[00:21:15] [SPEAKER_02] Yeah. And recently, you're back in my second book. You see that there are some CISOs that have in that book that have been there 18, 20 years, right? But that's the edge cases. Most have this two to three year. So I think looking at the chart, I sort of charted that if you're a typical CISO, you come in, you go, oh my God, this place is really going to be attacked. I'm going to be the one holding the can because it's going to fall over. It is such a bad state with such high risk. Why did that last person do this, right?

[00:21:43] [SPEAKER_02] And so they come in going, all gun to blazing, which we need to make these changes now. So they start high with, we need to do some action. And then they say, oh God, I'm overloaded. Let's back off a little bit. So they kind of be a U-curve, I think. I need to do more. My experience is the CIO is slightly different. CIO is a little bit different. They're more considered. They're more around, how do I build stakeholder engagement with my business partners? And so we start a lower curve, then say, I'm going to improve myself and then back off a bit. As they say, okay, I've done enough. I just need to sustain this.

[00:22:12] [SPEAKER_02] So I think that's the typical curve for the CIO and CISO. And you kind of watch those clues. You know, and I've seen CISOs come into roles and, you know, provide with 100 page presentations. I want to do all these things. I'm like, oh, here we go. Okay. And the answer is in between, right? Which is you need to be listening and seeing what's there and honoring the past and then say, how do I make it better? Which is always the good case. But the degree of change is the difference between different C-suite people and what's going to drive things.

[00:22:41] [SPEAKER_00] And when you say if someone's been there a while, their appetite for risk or change is lower or they've got more confidence and more credibility and talent?

[00:22:50] [SPEAKER_02] Well, I can't play the last guy anymore or the last girl anymore. It's on me. Look, I think they're in a different stage because they know what's worked. They understand change takes time. And, you know, getting things done that make an impact, you know, takes a few budget cycles. Yeah. And if you've been there for five years and you kind of know that, you know, you've done all these things, you probably get slightly more defensive because when things don't go well, they look at you to say, you've been here five years, Dave.

[00:23:18] [SPEAKER_02] Now, right now in today's age, it's the AI era. Okay. And I'd argue that for most organizations, they aren't well protected for that new control plane. They're just fighting the last four still. And they're asked to do that with the same team and the same budget. And so they're feeling a bit exposed. Most CEOs and C-sos feel a bit exposed right now because they've been told top down from the board, go and make this AI thing happen. But you say, oh, but, but, but. And they're like, oh, no, no, just go and make it happen. Right. We want to don't be the puppet of no.

[00:23:48] [SPEAKER_02] Don't be the one saying no. So they're in a tricky situation that they're trying to take the organization from a cyber standpoint, but understand this new AI induced threats is huge. And I'd argue after Rance, we're probably number two ish. Right. It's coming up for the charts with the rocket. Yeah. So they're feeling very vulnerable, I think.

[00:24:07] [SPEAKER_00] I think you're right. One of my clients right now is in that space. And they say, when they talk to people, the phrase is, we feel like the train's left the station and we're trying to catch up and figure out how do we protect ourselves.

[00:24:19] [SPEAKER_02] And it's going, and it's going fast. It's going faster with no brakes. Right. So yeah.

[00:24:23] [SPEAKER_00] Yeah. It really is. The only thing that you mentioned, you mentioned CIO and CISO there before, you said that there's sometimes tension between the two. There's always harmonious. What's going on there? What's the dynamic that we don't see from the outside?

[00:24:33] [SPEAKER_02] I think I read an article for CIO Magazine about the CIO CISO tensions like three years ago. Okay. And what surprised me, having been a CIO for 20 years, Andrew, was then purposely going into the role of a CISO because I wanted to do that because I wanted to do something different, different industries, different countries, and going to HSBCI at office to be a CIO as well. But then I thought going in there that actually he would get it. And then I realized actually, wait a minute. Hang on a minute.

[00:25:01] [SPEAKER_02] Most CIOs I work with actually just cared about digital change, driving change, because that's what they got the pass from the head and bonuses. Right. But cybersecurity, that's just actually, there's no upside. This is just downside. Okay. So I found that many CIOs I work with when I was a CISO were so negative to cybersecurity and not really supportive. You know, superficially, they were supportive. But actually, a great example I love to give is that many, many years ago, I was

[00:25:31] [SPEAKER_02] HSBC, mobile banking in the US, which is not huge, was being hacked by a bot. Okay. And it brought down the mobile banking service in the US. And I then said, okay, so is that the same version we have in Asia? Oh, well, no. It's three countries in Asia. At year 19, actually have the same version. So I remember talking to the CIOs and said, look, I need your support here. We have this big issue in the US.

[00:25:58] [SPEAKER_02] We'll put a bot agent in place to help alleviate this for the time being. But actually, currently, you're at risk because they could target you next. And these CIOs were saying, no, I don't want to do this. And I said, well, sorry. This is not a choice. You're going to tell me when. Is it next month or the month after? But it's going to happen to you, right? You're going to get it targeted because it's a very easy switch for these guys to figure out the same version.

[00:26:24] [SPEAKER_02] And it kind of shocked me that a CIO would push you back on that because they're worrying about experience. I said, well, when you're out, that's a really bad experience. Okay. So please don't say this is not something you're going to do. And I saw that happen a few times, which surprised me. Then I realized that, yeah, they don't get it.

[00:26:43] [SPEAKER_00] Yeah. I think everyone who's been in this industry and the sales side for a while has got that story about the company that didn't invest. The CISO couldn't justify to someone to get something. And suddenly something bad happens and the budget suddenly becomes available like three times over is the reaction that you get sometimes.

[00:26:59] [SPEAKER_02] I mean, look, this story goes on forever because I've had examples where there's one chief risk officer in my book who actually used to be a CISO. And when he came into a job after being a BCG cyber consultant for 10 years, he became a chief risk officer and he said, I want the CISO under me. And I saw that happen across a few organizations where they separated the CISO from the CIO because the CIO was telling them, don't disrupt the business. Don't annoy them. Go and keep them happy.

[00:27:28] [SPEAKER_02] And so having that separation of reporting, I've seen that across at least three different companies where they've said, okay, we need independence. We need you to be able to secure the organization and not worry about availability of systems as much.

[00:27:40] [SPEAKER_00] And what's the relationship with the CFO like usually?

[00:27:44] [SPEAKER_02] You know, I did, I was so laughing. I did a lunch with Palo Alto a couple of years ago and it was actually in Sydney here. And I wanted to have the CFO, it was a global CFO from Palo Alto in town. They wanted to have a CFO CISO lunch. And so I remember having the conversation saying, well, when I was in this role and I saw this guy, I'd run away because it would be. And I said, no, I ain't joking.

[00:28:08] [SPEAKER_02] Like, however, there's truth in that because you know the CFO sees you as being a biggest spender. Not sure I really understand why you're spending money, why it keeps going up. You know, why is it different? You know, why are we spending more money on you than we're spending on other areas of the business? But then how do you switch that around to be more along the lines of having the CFO as your biggest ally? Why?

[00:28:34] [SPEAKER_02] Basically spending the time to make him or her understand why and, you know, how do you use their language and how do you use risk quantification language so you can start to put financial terms around. Here's the risk in financial terms. It's, you know, was X billion dollars of risk. We reduced that to 800 million, still a big number, but we reduced that by these investments.

[00:28:58] [SPEAKER_02] And so trying to speak to him or her in the language helps, but, you know, also understand that they had the power to block you, right? So there's a whole bunch there about business case in the book around how do you work through that? How do you start to help yourself? Because rather than being the victim, you know, and having that vetoed by CFO and procurement team because they often report to the CFO, really important to get the change happening.

[00:29:24] [SPEAKER_00] How could a vendor help a CISO with that?

[00:29:27] [SPEAKER_02] Oh, easily. And to talk about the book, firstly, you know, the vendor knows best practice cases. The vendor knows, you know, what business case turns and has worked elsewhere and provide ensuring those examples that, you know, obviously they have to be changed and adapted for each client. But as you say, look, we've worked with a company that's similar to yours, similar scale to yours over here. And they've had the success getting it approved and getting it in.

[00:29:55] [SPEAKER_02] And here's their business case, the identified template. That's really helpful. Because when you're building a business case, you want to get it to work, but you need that sort of data, right? And so, and sometimes I talk about the book, sometimes actually, you know, you want to maybe introduce the CFO to the CFO to say, hey, we can introduce your guy to this lady who's actually has approved this and endorsed this. So those, those sort of connections are important, I think, to provide that context.

[00:30:23] [SPEAKER_00] Yeah. I think you said in the book that, you know, the CFO is interested in soft savings, but really cares about hard savings. But security never or rarely produces on its own. It's not like you invest this much to get hard savings. It seems like almost every big purchase must be a real wrestle to try and figure out how to get it justified.

[00:30:42] [SPEAKER_02] Oh, massively. Massively. And, you know, we're all being crowded out now with AI investments, right? So it's one pot of money still, right? So we forget that actually most of the C-suite people don't have much discretionary funds. It's all fixed in with different contracts, with different staff. And so there's a little bit of skinny room to play with. And yeah, so it doesn't matter how big your budget is. So the same deal applies. Yeah, you have constraints.

[00:31:07] [SPEAKER_00] Did you ever do much work with true startups, earlier stage startups when you were in the world?

[00:31:13] [SPEAKER_02] Yeah, I did. I did. I did a lot of work as a VC and probably back in the days, Andrew, I was probably meeting 25 to 30 startups a month around the world. Because I was curating them, doing innovation workshops and going to big companies and then saying, look, once a quarter, I've got this, what are you interested in? I've got startups and blockchain, cloud, you know, whatever the themes were at the time.

[00:31:41] [SPEAKER_02] And having them pitch, three or four of them pitch to the executive group because people are trying to be innovative and get ideas in. But I always thought that actually there's a purity in the small guys because they can't afford to be everything. They need to be very good at what they do. And so therefore, even cybersecurity is the same thing. How do you do more with less? And so that thinking, I guess, applies to big organizations as well as small ones.

[00:32:05] [SPEAKER_00] I'm always fascinated that, you know, who actually are the CISOs or the CIOs who want to work with startups? You take it at a risk, right? It's like, you know, it could be career limiting or it could be a big win. You know, you must see a certain type of person who wants to do that.

[00:32:22] [SPEAKER_02] But I think there's a type, but it also depends on the topic because, you know, like I talked a lot of, you know, again, I get approached by a lot of early stage companies. And so they're, you know, these are new best of breed, best of breed products. And so the, as a chapter, I came up with as a chapter 15 about best of breed versus packages, right?

[00:32:45] [SPEAKER_02] And I started writing this one and it was sort of interesting because you fundamentally know that if I've got a, the average CISOs has got 85 products or 89 products, I think it was something like that, and 29 vendors. Okay. So, you know, the CFO is telling you, hey, stop buying new crap from new vendors. Can you just use the vendors we have? Because we can get a better pricing deal and negotiate better. So that's what you're hearing in your voice all the time. So you need to say, okay, I'm going to incur the wrath of the CFO because I want to have one in, one out. So kids are now about the same, right?

[00:33:15] [SPEAKER_02] I'm going to invest in this because it's a new category that my current guys don't have this, but it's really important to me, right? So it's something about AI observability or something that's actually new. And so I can't go back to this existing stack. I didn't think I'd find something new. Okay. It's worth there for me considering going through the extra problems with procurement, extra, you know, intensive POCs to make sure there's no constraints and issues with the technology stack versus working with someone I know.

[00:33:45] [SPEAKER_02] The devil I know. And so it's a really interesting problem. And I think as I started writing the book, at that chapter, I realized people are thinking package versus best of breed versus AI, right? Can I just use AI for everything? And I was like, oh, not yet. But that's how people start to think about, you know, I don't need a package. I don't need best of breed. I just say, I can do everything. I said, well, maybe not.

[00:34:10] [SPEAKER_02] But I'm hearing that now in board meetings, people start saying, you know, we'd use AI instead of that package. There's probably some truth in there. Maybe we can use AI for some of the functionality, but definitely not all of it.

[00:34:20] [SPEAKER_00] I heard someone say the other day, you know, why don't we just, why don't we throw out Salesforce and you build our own AI driven CRM as well? You know, you got 500 salespeople and you got, you know, a few thousand customers. Do you really want to do it like that? Because you're going to take a lot of risk by trying to build it yourself.

[00:34:37] [SPEAKER_02] Yeah. Yeah. What's the, what's the upside for you? You know, when you think about back in the days, Andrew, the, you know, the, with for Lily and we had, I don't know, you know, 45 to 50 CRM systems throughout the world. Right. And so one of the things we did with a few other colleagues of mine, other CIOs, we standardized to have, let's have one platform for one platform, one server, one process, global process around the world. And we're going to just pilot that in one year. We had this ambition. We kind of did, kind of did that.

[00:35:04] [SPEAKER_02] We took us more than, more than a year, but we ended up finding that we need to have two levels. You know, one for mature companies and one for the less advanced countries. And then we had to, but having those ambitions were important. And then you say, how do you work towards that? And this is better than being fractured and splintered and having 50 versions of stuff.

[00:35:21] [SPEAKER_00] Right. Well, I guess with that change, there's a lot of risks that you have to manage as well, right? It's this, you know, if this doesn't quite go right.

[00:35:27] [SPEAKER_02] Oh yeah. No, no. It's, it's like change, change, change management is often the biggest risk because people don't like to make, you know, brush the teeth with the left hand. Like they like to use the right hand. But your change management's difficult for the C-suite to manage because they get, they get the flack.

[00:35:43] [SPEAKER_00] My impression these days is that typically the vendor doesn't get too much involved in the, in the change process afterwards. We obviously help and they got customer service, you know, CS, customer success folks. But it's not like we're all embedded in your change is, is what I'm sensing. Is that? Yeah, I think that's pretty fair.

[00:36:02] [SPEAKER_02] I think the difference I'd say, Andrew, is when you, when you're working towards a major transformation and you've done a partnership with some big, of these big integrative firms. And I've seen that happen a few times in my career where you actually want that firm to be embedded. You want the firm to have skin in the game. So in which case they, you know, will support you during and post. And then people don't realize who actually, who's the, who's the staff, who's the contractor, who's the vendor because you're actually so embedded. But that's probably the exception rather than the rule.

[00:36:30] [SPEAKER_02] But in those transformations, you don't have that level of teamwork that you will fail because it'll be transactional basis, which, you know, you do this and I do this and you're on a contract and I do this. And this is, hey, we want an outcome. How do we work towards that? And so every now and then that occurs and, and they're often what the CIs will refer to as the MVPs. So I have one or two MVPs they work with across their whole career and that they drag them in and engage those people as thought leaders.

[00:36:59] [SPEAKER_02] And, you know, I've got this idea, Andrew, what do you think about this? Even though it's nothing to do with you, okay, because they'll trust you over a number of years. And that's, that's the ultimate level of trust where you've built that relationship over, you know, battle scars, so to speak. And you're willing to ask your opinion about other stuff.

[00:37:15] [SPEAKER_00] Yeah. I want to finish off with talking quite tactical things, David, if you don't mind. Let's say that, you know, startups in cybersecurity, they've been working with the team and now they've got the meeting with the CISO or the CIO. Let's say the CISO. How do they approach that meeting to make sure, you know, this has got to be a good half hour, right? Let's make sure we get high value, high impact. What should they be thinking about?

[00:37:39] [SPEAKER_02] Well, firstly, they've tuned into the fact that they understand there's a business problem to solve, right? Prior to the meeting, having all that, you know, coffees with their staff members, architects, other people that could be champions to help them get info around the problem. And as much as possible, because it's often very confidential that something happening here, we're looking at this topic, trying to work through that and say, well, look, you know, there's something here we could perhaps share with you that could be of interest to you.

[00:38:08] [SPEAKER_02] So I had a conversation with a startup actually a few days ago on this topic and I remember there's a little sound buddy gave me, which I took away, which is we're doing work around data. And I said, okay, great. And he said, oh, you know, you realize that actually AI alerts are nine times more chatty than other alerts. I said, oh, wait, wait, wait, stop there. Nine times more chatty. I think that's interesting. So if I'm a sock and I'm taking all these data inputs, then actually there's so much more chaff to work through, right?

[00:38:38] [SPEAKER_02] Oh, that's really interesting. I love that angle. That's an interesting angle, which is, so your product actually helps cut through that and reduces that chatter by 50%, which is reducing the cost basis. I get it. Okay, got it. I love it. All right. I might put it on work with you because you've got something that's interesting. And so to me, having that little sound bite that relates to that environment and the context is important. So the preparation is important, I think.

[00:39:04] [SPEAKER_00] But you started off there by saying the business problem. You didn't start off by saying you should be thinking about your product or, you know, some new stuff you do or that, right?

[00:39:13] [SPEAKER_02] No, no. And you get that from all the quotations of others which have said, don't come in with the solution talking about features. Talk about the, look, can I just clarify what I understand your problem you're worried about now is this. Is that right? Is that this is a problem because we think there's going to be creating more risk or there'll be some third-party risk? You know, try to get that clarification and that helps build that business case for, because that business case is in his, him or her's head right now, right?

[00:39:41] [SPEAKER_02] It's not actually articulated on a paper. But they're thinking about actually, I can actually promote this to be number five maybe from being number 10 because I can see that this is something that could be done. And it seems like it's done elsewhere in the country and it's worked and it's got these returns. And yeah, maybe, you know, maybe I can, I'll just switch it around. And that, that's how strategy is made, right? It's, it's done in the head and then put on paper and how do you get into their heads that there's something that they haven't thought about.

[00:40:07] [SPEAKER_00] And then in that scenario, obviously made up, but would you trust your team to have evaluated the vendor to say, yeah, this is the right product and you don't really want to get too involved in that?

[00:40:20] [SPEAKER_02] It's yes. That's my answer. I think every CEO and CEO is slightly different. They may be, they have less trust for their team. It depends on your operator's manager and whether you do. But it also depends upon how strategic this, this widget is, right? If the widget's really strategic to you and your career, then you won't just, you won't trust it as much because you actually want to make sure you're all over it. Because at the end of the day, it doesn't matter if it fails because you'll still be blamed anyway as the top guy. So you want to make sure that you put your finger all over it and get involved in it to a degree, not run the POC, right?

[00:40:49] [SPEAKER_02] Or POV, but actually say, okay, put your best people onto it and say, I want you to look at this. I want to give it a good sense. Will it actually create what we think it will create and not create issues for us elsewhere?

[00:41:00] [SPEAKER_00] Yeah, I would imagine if it's going to be on, for example, every single desktop and therefore people are going to complain if something happens, you probably want to be more involved.

[00:41:08] [SPEAKER_02] Yeah. Yeah. There's definitely a radar there, Andrew, which is you're sensitive to that noise. And bear in mind too is that in the CIO CISO roles, there's a lot of envy because you're getting all the cash, they think, right? Your peers think, oh my God, Dave is getting all that money, all that time. What the hell? You know, he doesn't use it properly. He doesn't really, you know, I need my project to get off the line and I can't get funded. So they don't give me any favors, right? There's a bit of competition going on there and politic going on there.

[00:41:37] [SPEAKER_02] And so you're aware of that. You're aware that that's behind it, but you've got to be above that, so to speak, right? And then, okay, how do I help you? I'm sorry. You know, let's get on with it. Let's smooth it over so it doesn't have an issue.

[00:41:49] [SPEAKER_00] Yeah, it's funny what you say about money. I remember I went to a prospect years ago and the sister was mad, like spitting mad because he was struggling to find some budget. And the network team went out and spent like $15,000 on a massive printer to print out some network diagrams. He's like, how come we can do that and I can't get any budget printed?

[00:42:07] [SPEAKER_02] It's unfortunately normal. It's normal. Things aren't distributed that well. So no, no. I think that's why the CFS role is really important to actually try to help redistribute the wealth.

[00:42:17] [SPEAKER_00] Right. Let's wrap up here, David, with the end result of the spin the wheel game right here. Are you ready to see what the questions are?

[00:42:26] [SPEAKER_02] Yeah, go.

[00:42:27] [SPEAKER_00] All right. So we've landed on overrated or underrated. The first one, you have to tell me whether you think this is overrated or underrated. Meeting the founders of a startup.

[00:42:37] [SPEAKER_02] Oh, founders are, as a person who worked with VCs, definitely it's important. I think it's, I'm not sure underrated is the right thing, but actually it tells you a lot about the company culture. And it's one of the, you know, if you're a VC, you invest upon a number of things, the product and how unique it is, but you also invest upon the founders being amazing. So no, it definitely is important. Okay.

[00:43:02] [SPEAKER_00] Funny you mentioned VCs. So overrated or underrated, cyber VCs.

[00:43:08] [SPEAKER_02] Gosh, I don't want to say anything too bad about anybody here.

[00:43:11] [SPEAKER_00] No names.

[00:43:12] [SPEAKER_02] No, no, no. I think they serve a really good purpose in society to put money into investments. Obviously these days, every cyber VC is a cyber AI VC. And so that's the thing I'd say is that, look, at some stage the AI bubble will pop. And it'll be, AI is going to be important for sure. It's just probably the AI piece is overrated right now. And it'll come down a little bit and then it'll, but it's significant, I think. Sure.

[00:43:40] [SPEAKER_00] Yeah. I'll flatten out a little bit. All right. Last one, overrated or underrated? Social events with vendors, games, dinners, things like that.

[00:43:47] [SPEAKER_02] Yeah. You know, it's interesting. I was asked this question yesterday for a major vendor. And I said, look, in my book, I've got a chart there about dinners, right? And I said, well, there's criteria, which is number one, do I have a board meeting tomorrow or not? I don't. Okay. I'll probably go for dinner. What is my friend Andrew attending?

[00:44:07] [SPEAKER_01] That's good. Okay.

[00:44:08] [SPEAKER_02] Is the venue going to be cool? You know, so I know the venue's going to be cool. And then, oh, is the content going to be interesting? So there's all this criteria. So I think to me, to answer your question is that people do value those, but often not for the reasons why you think. It's other reasons. And then, oh, the content is interesting as well. I'll go there. But it's not necessarily top three. Right.

[00:44:28] [SPEAKER_00] Right. Yeah.

[00:44:29] [SPEAKER_02] It's other things combined with the speaker or they're giving away David's book. And that'd be cool. And so all that is part of the package, I say. Good. Good answer.

[00:44:39] [SPEAKER_00] All right, then. Well, listen, David, absolute pleasure chatting to you. The books are available. The two I've got, anyway. A Day in the Life of a CISO. Personal mentorship from 24 battle-tested CISOs. And the second one is, literally, how to sell to the CIO and the CISO. I'll put these links in the show notes for everyone to be able to click through and more of them.

[00:45:00] [SPEAKER_02] Fantastic. And one of my friends told me that it was so cool that you did the American flag.

[00:45:08] [SPEAKER_01] I said, no, that wasn't the intention. I was just trying to be catchy.

[00:45:13] [SPEAKER_00] If you're speaking to a UK audience, you would say the Union Jacks. There you go.

[00:45:16] [SPEAKER_01] Yeah, that's it.

[00:45:18] [SPEAKER_00] David, thanks a lot for joining us. Really good fun.

[00:45:20] [SPEAKER_01] Thank you.

[00:45:33] [SPEAKER_00] Hey, Andrew here. One last thing. If you enjoyed this episode, will you do me one small quick favor? And that's just send it to a friend. Simple as that. Your podcast player will have a share button somewhere. Click that and then text it, slack it, email it, whatever is easiest for you, to someone you know who you think might want to listen. That's the best way you can support this show. And I really appreciate you for doing this.