Every cybersecurity vendor needs sales. But how should they shape their approach so it doesn’t come off as aggressive spam?
Check out this post by Mike Gallardo for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Geoff Belknap. Joining us is Alex Guilday, BISO, Royal Caribbean Group.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, Cyera
Full Transcript
Intro
0:00.000
[David Spark] Every cybersecurity vendor needs to sell, but how should they shape their approach so it doesn’t come off as just aggressive?
[Voiceover] You’re listening to Defense in Depth.
[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of the CISO Series. And joining me as my co-host for this episode, you love him. I know you love him, I get comments all the time, “Geoff is our favorite.” Actually, nobody says that, but they should be saying that.
They should be saying Geoff is our favorite just so I can pit you against the other hosts as who is the most loved host.
[Geoff Belknap] No, nobody, I don’t even say that.
[David Spark] Geoff Belknap, say hello to the audience.
[Geoff Belknap] Hey, everybody. I know I’m not the most loved host, but I still come back, and I love you even more, whoever you is.
[David Spark] Even if they don’t think you’re the most loved host?
[Geoff Belknap] I’m secure enough in my hosting-hood that I can accept that, and I will try to be better.
[David Spark] You’re a better person than I. If I’m not number one, I start yelling at people.
[Laughter]
[David Spark] Our sponsor for today’s episode, it’s Cyera. You know Cyera, secure your data wherever it lives. Cyera, more about that a little bit later in the show, and they have an awesome event coming up in November. We will talk about that. But first, let’s talk about today’s topic.
This is a topic really goes back to the origins of the CISO Series, and that’s cybersecurity sales. All right. You can have a great solution, but if you have a pushy sales process, few will ever buy it. Now, Mike Gallardo of Deel outlined his two-week sales structure on LinkedIn, which involves establishing your value prop, reaching out to prospects on email, phone, and social media the same day, sending two cold emails per value prop, making a total of six cold calls, and sending a breakup email.
It sounds aggressive to the recipient, but to the one trying to close sales, it may be seen as just breaking eggs to make an omelet. All right, Geoff. They may deem it necessary in a crowded competitive environment. It is super tough, I am not disagreeing it’s tough.
But I know on the receiving end, that kind of aggressive sales tactic is rough. Geoff, how do you feel?
[Geoff Belknap] Well, let’s just be clear. It is really rough. And I think the important thing to keep in mind here is that this general advice is probably very good for sales; however, in security especially, and probably tech sales in general, you really have to adapt the approach to the target.
And I think in this case, probably very few other targets get saturated with cold approaches like security professionals. So, I think we can talk a little bit about what works and doesn’t work with this approach, and I see there’s some great topics ahead of us, so let’s get into it.
[David Spark] I’m very excited to have our guest because our guest has lived on both sides of this equation. He used to be in cybersecurity sales himself. He now works as a BISO at Royal Caribbean Group, none other than Alex Guilday. Alex, thank you so much for joining us.
[Alex Guilday] Thank you for having me.
What would a successful engagement look like?
3:08.488
[David Spark] Jonathon Spencer of MBPS said, “Better off to start a bit lighter in the first days and increase the number of touches toward the end. It’s natural for prospective buyers to wait out sales outreach. Lots of sellers already follow the advice above.
Potential buyers have been conditioned to ignore outreach in the first two and a half weeks.” And Michelle Hecht of HiBob said, “I’d A/B test everything and decide what works best for my business. We’re playing the long game here. Give without expectations.” And Monesh K M of Kanoo Elite said, “From my personal experience, this might only work if we were successful in creating a personal connection with the engaging party.” All right, a couple things I want to qualify.
One is this post was generally about sales, it was not specifically about cyber sales, and I don’t think any of these three people I quoted are specifically in cyber sales. I will also reference Neil Saltman’s book which is on Amazon called Cyber Security Sales: A Buyer’s and Seller’s Perspective, where he actually quotes me talking about, heck, it’s just a very different industry.
Many of the traditional sales tactics don’t work in cyber, and you alluded to this at the beginning, Geoff.
[Geoff Belknap] Yeah, exactly. And I think Michelle and Monesh, if you think about their advice through that lens, that every sales target and every industry is a little bit different, this makes a lot of sense. I certainly do not have a recipe for what is the best way to contact CISOs.
I wish I did. I’m sorry, I don’t. But if you buy my seminar… No, wait, sorry, habits. So, I think here, you should definitely be testing things. If anybody tells you that they have a perfect recipe to be able to contact security leaders, they are wrong because there is no perfect recipe.
But I think what I have experienced in my time is that I am either looking for a specific solution, and if you have that solution and you’re cold calling me and it connects right away, I will get you back. It does not matter how many emails you send me as a follow-up, I will not suddenly reply unless that message already connected.
And two, if I’m not looking for something right away, I’m looking for a relationship. I might be looking for something later. But if your approach to me is to annoy the ever living crap out of me, that’s probably not somebody I want to build a relationship with, and that’s not good.
Security is a long business and people want to be able to be in contact over a long time.
[David Spark] That is a very good point. All right. Alex, let’s just hear a little from before and after. I’m sure when you did sales, you heard many of these techniques, yes?
[Alex Guilday] Absolutely.
[David Spark] And did you do them yourself at one time?
[Alex Guilday] I did. I absolutely adhered to the drip campaigns and similar approaches, yes.
[David Spark] It was probably pretty rough, yes?
[Alex Guilday] Brutal. I felt guilty sending a lot of the outreaches, but I knew I had to stick to, or heed to the advice that was being provided. Follow these steps.
[David Spark] Yeah, yeah. And also probably you were younger at the time and you’re like, “Well, these people obviously know better than I, and they’ve got years of experience, and I just follow the playbook, and it’ll all come out even if it’s rough to get through it.”
[Alex Guilday] Basically, if you’re not selling and you’re not following the rules is different than if you’re not selling, but you’re hitting all the steps that they told you to follow, right? So, you are encouraged to stick to the process, the “proven process,” air quotes, right?
[David Spark] All right. So, when you moved in… By the way, before you did security sales, did you do any other kinds of sales prior to security sales?
[Alex Guilday] Oh, yeah. I think I started literally selling door-to-door vacuum cleaners.
[David Spark] [Laughter]
[Alex Guilday] I won’t drop the brand, but I mean, that’s where I really built my thick skin on rejection is just unsolicited…
[David Spark] Oh, people literally slamming doors in your face.
[Alex Guilday] Yeah, exactly, yeah, yeah.
[David Spark] [Laughter]
[Alex Guilday] So, ignoring emails is nothing.
[David Spark] Someone looking at you and saying, “No!” clunk.
[Laughter]
[Alex Guilday] Yeah, exactly, exactly.
[David Spark] So, yeah, what was the biggest learning you had making that leap over from essentially any other sales to cyber?
[Alex Guilday] You have a technical audience, right, and so they want to be informed, and you need to bring value to that conversation as far as showing that you have a solution that can solve their problem, right? That was the main observation I saw.
In the consumer space when I was selling other products, non-security, non-technical, you relied more on advertising. So, you already had a buyer who, they were interested, they were already informed on a set solution, right? So, solution of the vacuum cleaner.
They’ve heard the brand.
[David Spark] And you know what a vacuum cleaner does.
[Alex Guilday] Yeah, exactly. That was the biggest difference. I think security sales, it’s kind of like, all right, what do you got? Who are you again, and what do you have here? And then it’s a swing and a miss if you don’t have the right person in security.
If I’m trying to sell EDR, endpoint detection and response, to somebody who’s focused on policy, I’m barking up the wrong tree. So, you have to like evaluate and vet. Do you even have the right person that you’re reaching out to and sending blind, cold emails to?
Who’s losing out there?
8:18.648
[David Spark] Jeff Williams of AWS said, “I’d have blocked you three times by number five in your list. By number nine, I would refer you to the FTC for violation of canned spam.” Kevin Kuhr of ServiceNow, and both of these guys in cybersecurity, “Good grief! People don’t respond to sequences.
They respond to genuine outreach built on great research. If you can solve a problem and help them, they’ll immediately respond. If you don’t get a response, please don’t linger around like a seagull, but rather focus on your craft and identify new contexts.” And lastly, Howard Holton from GigaOm, who we know very well, “Exactly what message do I need to send to a cold email to say, ‘Piss off’?
You are recommending 14 attempts with zero responses before saying goodbye. You create salespeople I ban and I have never, ever bought from an unsolicited phone call. Not once, never will.” So, it’s interesting. The first three comments, I believe, were from people who were in sales, not in cyber.
This segment, all cyber people, a very different take. It’s just, look, understand my problem. Give me a reason. And if it doesn’t work, just go away, move on. I mean, that’s kind of a really basic, hyper simplistic model, Alex, yes?
[Alex Guilday] Absolutely. I mean, unfortunately it’s a numbers game. And so, I’m thinking back, I was a business major. So, in my marketing classes, I can remember the discussions of it takes eight interactions. I don’t know if that’s the magic number or not, but it takes eight interactions to trigger a response action, and that’s not necessarily a purchase.
That’s just let me go to their website or let me call them or something like that, right? That’s the numbers. And these salespeople, salespeople are financially motivated, right? And so, they’re going to play that numbers game. I think that we have a very exhausted audience receiving all of this outreach, but I don’t think it’ll go away because the data shows that more outreach increases closed deals.
[David Spark] Okay. I throw this to you, Geoff. We’ve talked about this a lot on this show, a lot. And it’s a simple answer, but difficult to execute. I think that’s really the headline here, isn’t it?
[Geoff Belknap] It really is, and I think at the end of the day, Alex is right. The motivation for the person sending you the message is not to annoy you. They don’t want to annoy you. If you run into that person on the street, it is not the same person who is sending you messages over and over again.
They’re following guidance for their job. They’re doing their job. Now, sometimes they get bad guidance or I’m sure there are some bad eggs, but the reality is they know that this will work. This is like spammers. Why do they keep sending spam? It’s ridiculous.
Well, because it works, eventually gets them to the target. I think the other side of this is, and we’ve talked about this a bunch, we can’t only expect salespeople to fix this, right? If there is a systemic problem, like in this case, where it is hard to get people to know about your product, you can’t just expect the salespeople to solve it.
We as security leaders also need to offer other opportunities, and I think one of the things we’ve talked about before is if you are in the market for something, try posting about it. I know that will get you a flood of interest. There are other ways to interact with the market space other than just beating people up about cold calls.
Sponsor – Cyera
11:45.356
[David Spark] Before I go on any further, I do want to tell you about our sponsor, and that is Cyera. We love having Cyera as a sponsor. Now, I don’t need to tell you AI is here and it’s moving fast. I’ve watched it move at a rapid clip in two years myself.
But with every new system, tool, and integration, your data and your security posture are under more pressure than ever. And that’s where, get ready for this, the DataSecAI Conference comes in. It’s happening November 12th and 13th in Dallas. That’s in 2025.
DataSecAI25, remember that, is the industry’s leading conference at the intersection of cybersecurity, data governance, and AI innovation and hosted by AI and data security leader, Cyera.
Now this isn’t just another tech event. It’s a conference built by the industry, for the industry, designed to help CISOs, data leaders, and business technologists rethink what’s possible, share real-world strategies, and collaborate on the future of AI security.
You’ll hear from the top voices driving transformation across sectors, from enterprise CISOs to AI threat intelligence experts, and walk away with the insights you need to scale secure innovation. If your job touches security, AI, or data, you need to be at DataSecAI.
And I will just say this, this is their second one. I was at their first one last year, and it was an awesome event. Great part about this event is there is no cost to attend. All you have to do is bring your perspective and join the conversation. Simply go to Cyera.com and click the DataSecAI link.
It’s at the very top of the page. Cyera.com, click the DataSecAI link at the top of the page.
Where does this effort fall flat?
13:38.204
[David Spark] Todd Miller of Taylor Corporation said, “I’ve heard a stat that at any given time, as few as 5% of our ideal customer profiles are in the market and prepared to engage. If someone is looking for a quick transaction, this process may work just fine.
Occasionally, the timing may be perfect or lucky. The real question is, are you building relationships for the long term?” That is extremely good point. And O’Ryan McEntire of Shimmer said, “Honestly, if you hit me up 50 times in two weeks, you are not endearing yourself [Laughter] or your brand to me at all.
I would be pretty pissed and actively motivated to never buy from you. This is too much and feels non-consensual. It’s certainly not a buyer-centric approach. No response is a clear response. I think both Todd and Orion make their point clear is, look, not everybody’s in a buying mode.
You’re in a constant selling mode. You have to find that. But really, the success comes from the long-term relationships. And if you’re green to the market, the answer is start. Yes, Geoff?
[Geoff Belknap] Absolutely. Yeah. Look, I am not a sales or marketing expert. I do have a business degree.
[David Spark] But you are the receiver of sales tactics.
[Geoff Belknap] I have participated in sales marketing, I am the receiver of a great amount of sales and marketing, and I cannot stress enough Todd’s advice. Let me give you some potential advice that’s worth everything you’re paying for it right now.
[David Spark] Which is, by the way, nothing. Just wanted you to know, it doesn’t cost anything to listen to Defense in Depth.
[Geoff Belknap] Which, just to be clear, nothing, but you’re also welcome to Venmo me however much money you’d like. What I would recommend is, if you are selling security products, stop cold calling. Now, that’s not saying stop reaching out to people who you don’t know.
I’m saying stop thinking about it as cold calling. Think about it like this. It is your job as somebody who is selling in InfoSec to start to get to know everybody in security. Build your network. Meet people. Look at it from the perspective of like I don’t even have anything to sell.
I just want to figure out who are the security leaders in the space and who reports to what, who’s next and up and coming. Because the security space is so small. Everybody knows everybody. People move around. And even if you someday move from one company selling a security product to another company selling a security product, you’re going to want to use that network to introduce people to your product.
And if you build that network and you build those book of relationships, it doesn’t matter what you’re selling at the time. They will want to have a conversation about you, and you will know what’s coming. I think that relationship selling is really what works very well in the security space, especially because at any given moment, we’re not a buyer for any given thing.
[David Spark] All right. I’m going to ask you this question, Alex. It’s tagging off of what Geoff just said. And answer it from either when you were in sales or now as you work as a BISO because I’m sure you’re on the receiving end as well. It doesn’t always happen direct.
Sometimes you hear it from a trusted source, “Oh, I’ve got a relationship good at this,” or “I met this person at the event.” Like, how often does the information come to you indirectly rather than a direct pitch, whether you were selling or buying on either end, or a potential buyer for that matter?
Does it happen often?
[Alex Guilday] I don’t think it happens often, but I do know that if somebody that I trust endorses a vendor, and by bringing it to my attention, that’s what I’m deeming as the term endorses, I already am trusting the product or the service, right? So, if Geoff comes to me and says, “Hey, Alex, I want to talk about this really cool thing that I just saw,” I’m automatically more engaged and interested because I know and trust Geoff.
He wouldn’t bring just smoke to me, right? It’s something that he felt compelled to bring this to me.
[David Spark] And by the way, we hear the CISOs, BISOs, they listen to other CISOs and BISOs.
[Alex Guilday] Of course, yeah, yeah. I don’t know how, I can’t answer the question how the frequency and how often, quantify that, right? But I do know the impact of when it does happen, it is a better success.
[David Spark] I guess it’s answering it in the same way because it’s coming from not a direct source being the salesperson. It’s coming from an indirect trusted advisor. And I’m assuming that’s how you get a lot of yours as well.
[Alex Guilday] Or just someone’s opinion who I value, right?
[David Spark] Right. Exactly.
[Alex Guilday] Geoff, you’re a smart guy and I trust you, so yeah.
[Geoff Belknap] Well, I don’t know if I would chalk myself up for either of those things, being smart or trustworthy, but what I will say, and I am curious if Alex experiences this too, in my network of friends and other professionals that are in these roles, the most common thing that I see people asking is, “Hey, I need to buy a thing like this.
Has anybody got any experience with it or something like it?” And those conversations are super valuable. Now you cannot pay – I mean, I guess you can pay – but you cannot pay for that kind of advertising, and it only comes from you built a relationship with myself or Alex or somebody who used your product.
They used it successfully, and now they’re going to be an honest representative of that product to somebody else who needs it.
[David Spark] Your current customers are your best sales.
[Geoff Belknap] Exactly. And honestly, even if they have not had a perfect experience, that is okay. Now, if they have had a terrible experience, they are also going to market that terrible experience. So, I would encourage you to take care of your customers.
[David Spark] And by the way, that’s why customer relations as a job role is so important for literally this point.
[Geoff Belknap] So important.
[David Spark] Because if you see a relationship going south, you want to take care of it. I mean, probably in your own industry, in the Royal Caribbean, you’re dealing with this all the time, I’m sure. Because you’re a service industry.
[Alex Guilday] Of course. I do want to chime in specifically on O’Ryan’s comment around the 15-touch campaign, and it feels non-consensual. I totally feel that. Maybe this is trade secret, I don’t know, but I think the audience will benefit. I remember in my sales days, we would pre-program these 15-touch campaigns.
I’d never hit 15. But if any response came back, it disengaged the campaign. So, if you want an outreach, number one, if you reply and say, “No, thanks,” that might stop the next 14 touches from coming your way. It disengages. Not always, but that’s what my plans did.
[David Spark] So, it’s interesting you say that because I have jumped down people’s throats when I do respond to their messages and they just let their drip campaign go, ignoring my responses, and that is infuriating.
[Alex Guilday] Oh no.
[David Spark] Infuriating.
[Alex Guilday] Yeah. [Laughter] That is. And I, as a professional courtesy because I’m a recovering sales professional, right, I politely do articulate and say, “I have no interest at this time in personally exploring this further. Please suppress any further outreach for at least 90 days.” If you’re working with a decent human being, they disengage you, they put a note on their file, and they leave you alone for 90 days.
If they’re terrible, they will come back tomorrow and just keep doing what they’re doing, hoping that numbers work in their favor. But I find that professional to professional, it’s helpful for me, just slimming down my inbox volume that’s coming in.
What else are we missing?
20:44.094
[David Spark] Daniel Ibarra of KCV Capital said, “Interesting that everyone hates to be sold, but everyone has to sell. Cold calling is a fact of life. You can’t rely on just word of mouth or referrals.” For some, you can actually.
[Geoff Belknap] Yeah.
[David Spark] That’s my comment. “Until you have perfect information on your products, current vendor, other prospects, budget to buy something new, you have to do some level of outreach.” Okay. So, there are people that argue that cold calling’s inevitable.
And I should also mention, and I’ve seen this before, for every CISO that’s complaining about cold calling or any security professional who complains about cold calling, people say, “Why don’t you look in your own backyard? I bet you your company is cold calling people for their customers too.
So, it’s probably happening within your own four walls as well.” Geoff?
[Geoff Belknap] There is cold calling and then there’s cold calling.
[David Spark] All right. Say no more. We’re wrapping it up.
[Laughter]
[David Spark] Go ahead.
[Geoff Belknap] Yeah. I think there’s cold calling where you’re specifically trying to make it a transactional engagement of like, “Please call me back so we can set up a meeting so I can get my numbers done or so I can buy this thing. I have a widget to sell.” And then there’s cold calling.
That’s like, “Hey, I’m Jane or John Doe and I’m in this space and I would love to connect with you at some point, build a relationship,” whatever your approach is there. That’s just like, hey, would love to talk to you at some point about whatever.
There is a better approach when it’s, “I just want to connect with you. Let me know when it’s convenient. That’d be great.”
And then there’s also what Alex referenced, which is like, “Just back off. If I respond and I tell you to back off, you’re going to have to respect it.” I’m looking at you, the people who call my mobile phone twice in a row so that I think it’s an emergency and then tell you to send me an email and then don’t and you keep calling.
You’re not doing me any favors. And by the way, I have a – I’m on a rant now – I have a phone contact in my phone called Salesperson Do Not Pick Up that is now 180 phone numbers long, so feel free to join that list if you’re going to be that person.
[David Spark] Really? Wow.
[Geoff Belknap] I digress. Yeah.
[David Spark] Okay. I’m going to let you close this one out. I think we’re in agreement that the relationship building is what works, Alex. And your advice sort of in closing here, to the person who thinks they need to cold call, and let me ask you, in cybersecurity sales, did you have much success with cold calling?
[Alex Guilday] When I think about that, you have to get your name out there. You have to do that cold calling. That is the fact of life, as Daniel so eloquently said. I would say, though, the deals that I closed could not be accredited to effective cold calling.
But a cold call starts something else, right? A cold call generates some, feeds into something that does grow into something that is a warm lead. So, it’s never going to go away, I don’t think that you can be effective without it.
[David Spark] It’s an effort to do something and it’s an effort to make a personal contact, but there are a lot of other things that can be done, like going to events in your area where you can actually meet people face to face, where it’s hard for people to tell someone to piss off when they’re right in front of the face versus click, hang up.
And same thing with the cold email or just hit delete. It’s an easier rejection, if you will.
[Alex Guilday] And that’s where I look into the marketing psychology of it, psychology of it all, right? Maybe I see an annoying email, and I delete it, but then I do bump into somebody at a conference, and they say their company name and now I have a little bit of recognition.
I don’t know what they do. I remember seeing that logo, and now I am in a conversation with this person. So, the science of what feeds into the signed contract, there’s probably a whole series of events. And just like we started out with the eight touch points, it was the email that I deleted, the one cold call that I hung up on, and then the one interaction with the person.
We hit it off at a conference and it all took place. Could it have just been only the meeting, the interaction at the conference? Maybe.
[David Spark] It could have. And that’s a good point.
[Alex Guilday] The other two touch points might have added to that point.
[David Spark] Very good point.
Closing
24:47.330
[David Spark] Well, that brings us to the end of our conversation here. Thank you very much, Alex. Thank you very much, Geoff. And now I’m going to ask you, Alex, which quote was your favorite and why?
[Alex Guilday] I really did enjoy O’Ryan McEntire’s quote. I think he articulated what many of us all feel, and for some reason I hear it in like Gilbert Godfrey’s voice for some reason.
[Laughter]
[David Spark] But he’s the one, just to remind you, he’s the one who talked about the 15 times too. It sounds non-consensual, feels non-consensual. Yeah, it’s kind of non-consensual there. All right, Geoff, your favorite quote and why?
[Geoff Belknap] I’m going to go back to these first couple of quotes from Michelle Hecht from HiBob, and Manesh from Kanoe Elite, which are just A/B test. See what’s working.
[David Spark] Yeah, don’t take our advice.
[Geoff Belknap] Yeah, by all means, do not take my advice. Go figure out what’s going to work for you, but I think please take away from me that there’s cold calling and then there’s cold calling. And if you’re cold calling with intent to conduct a transaction, it’s going to fail, and people are going to get annoyed.
If you are cold calling in order to build a relationship and meet people and to sort of drive things, and there are other things other than just cold calling, like David said, meet people, build your network. Don’t just build your prospects.
[David Spark] Very good point. Well, thank you very much, Geoff. Thank you very much, Alex. Alex, are you hiring there over at the Royal Caribbean Group?
[Alex Guilday] Absolutely are. I would encourage if you are interested in starting a cyber career or furthering your cyber career, rise with Royal. Go to our Royal Caribbean Careers page and check it out.
[David Spark] And could they reach out to you as well if they find a job that’s of interest to them?
[Alex Guilday] Anytime. I’m available over LinkedIn. Happy to talk with anyone.
[David Spark] We will have a link to his LinkedIn profile for the blog post for this very episode.
[Geoff Belknap] Or message me and I’ll give you his personal cell phone number. It’ll be great.
[Alex Guilday] [Laughter]
[David Spark] Thank you very much, Alex. Thank you very much, Geoff. And more importantly, thank you to our sponsor, that’s Cyera and their DataSecAI Conference that is coming up this November 2025. Remember, go to Cyera.com and click the DataSecAI link at the very top of the page.
Thank you again. As always, we greatly appreciate your contributions and listening to Defense in Depth.
[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.
If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.