Far too many vendor demos are falling short on just delivering the basics of what a security professional expects to see. Isn’t the point of a vendor demo to get the potential buyer interested in the product?
Check out this post from Adam Palmer for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Geoff Belknap. Joining is Ken Beasley, BISO, Kaiser Permanente.
Join the conversation on LinkedIn
Huge thanks to our sponsor, Fenix24
Full Transcript
Intro
0:00.000
[David Spark] Far too many vendor demos are falling short on just delivering the basics of what a security professional expects to see. Isn’t the point of a vendor demo to get the potential buyer interested in the product?
[Voiceover] You’re listening to Defense in Depth.
[David Spark] Welcome to Defense in Depth. My name is David Spark, I am the producer of the CISO Series, and joining me as my co-host, one of your favorite, I know it. You tell me that, or I’m pretending you tell me that, or Geoff tells me that people have been telling me that, and I don’t know that. It’s Geoff Belknap. Geoff, say hello to the audience.
[Geoff Belknap] Hey everybody, and I know you’re lying, but I love it anyway, so keep it coming.
[David Spark] By the way, I will take a compliment even if it’s a lie. How do you feel, Geoff?
[Geoff Belknap] Yeah, I don’t want to know.
[David Spark] [Laughter]
[Geoff Belknap] Let me just live in my fantasy that not everybody hates me.
[David Spark] I’m with you on that. I will take a compliment even if you really don’t mean it.
[Geoff Belknap] Especially if you really don’t mean it.
[David Spark] I’ll take it any way you want.
[Geoff Belknap] Yeah.
[David Spark] I’ll accept it in the same way. By the way, we have other programming on our site, CISOseries.com. Just go to CISOseries.com. You’ll find lots of other wonderful programming and many past episodes to this very show. Our sponsor for today’s episode is Fenix24. Redefine cyber resilience. These guys are experts. They have enormous experience in dealing with pretty much the worst day of your life, and they can prevent you from having it as well. You’re going to want to hear what I have to say about them a little bit later in the show.
Let’s begin with today’s topic, Geoff, and that is demos. Now, show me the product in action and explain the value. That seems like two table stake items when it comes to a vendor demo. Adam Palmer, who we’ve had on the show before, he’s the CISO over at First Hawaiian Bank, he found it frustrating how often these key items, seeing the product in action and explaining the value, are left out in a demo. If it seems so obvious and their goal is to sell, why are they leaving these very basic things out of demos? What do you think, Geoff?
[Geoff Belknap] I think a lot of times, people forget that demos are not about impressing a Gartner analyst. It’s about helping demonstrate the value of your product and how fast I can derive value from that. And the world has changed. Most products and most teams that buy them expect to be able to implement the product themselves and see the value very soon or right away, and that’s very uncomfortable for some sales teams. So, I think we’ve got a great guest today. I think we’re going to have some really great conversation about how we might shift this and have it be more of a win for everybody going around.
[David Spark] Yes. The point of today’s conversation is really to be a win-win for everybody. We want the vendors to deliver more, and we want essentially the potential buyers to get what they’re hoping to hear.
[Geoff Belknap] Just a chain of wins. A win chain, if you will.
[David Spark] We expect this whole show to be like that. The person to join us for this very conversation is a BISO over at Kaiser Permanente, thrilled to have him on. First time he’s ever been on our show before. It is Ken Beasley. Ken, thank you so much for joining us.
[Ken Beasley] Glad to be here.
Would this work?
3:12.793
[David Spark] Nadeem Rehman of Goldmark Real Estate said, “If I’m watching a demo and still wondering what a tool actually does, we’ve already lost the plot. Show me the interface, the workflow, the friction points, and how you eliminate them. Bonus points if you demo with my data or a scenario that mirrors my environment. Don’t pitch features. Solve problems. I’m not here to admire your roadmap. I’m here to see how you reduce risk, save time, or make my team smarter. If your demo doesn’t map to my top three headaches, it’s a missed opportunity. Frame the story like a breach report. What went wrong, why it mattered, and how your tool would have changed the outcome. That’s how you earn trust and budget. A great demo makes me say, ‘That solves my problem my way, and I can deploy it without a six-month change management saga.'” That is definitely the quote you want to hear.
And lastly, Jim Sneddon, who’s CIO over at Agentantics said, “I used to run teams of sales engineers, and we always tried to do the following in demos. Research your customer/sector and identify common pain points that you can solve in their industry. Here is a tool/product/solution, and here are the top three use cases that our customers see value from. Ask about the customer-specific pain points and quickly show how you can address them and how. If you can’t, tell them straight up. If you are not confident you can reduce risk, increase efficiencies, or reduce costs, then you should not be sat in front of the customer.” Very wise words here. All right, great advice all the way around. I think it just comes down to address the buyer’s needs. Yes, Geoff?
[Geoff Belknap] Yeah, absolutely. And the other thing that’s changed here is not just the buyer’s needs. You need to really address a problem that the buyer has, and I think Jim gives some really good advice here, but we’ve kind of moved past the point where you would do a demo before you understood what the pain point was, before you were solving with the customer.
[David Spark] You’re right. I have a canned demo. I do it the same way every time, here it is.
[Geoff Belknap] That’s great for trade shows. That’s great for webinars where you’re trying to generate interest and understand who has a problem that you solve. But if you’re sitting down for a demo, presumably they’ve already identified a problem, they’ve already identified that you solve that problem, and you better be showing me that it’s solvable. Beyond that, it really is better to just not do a demo. The best demo is if your product is a freemium product or something that I can implement just in a small way, a couple of licenses on my own, that is the world’s best demo is that my team already tried it, they love it, and now they want to see what else that there is to know about it.
[David Spark] That’s a really good point. Ken, your thoughts on this? I mean, it’s really understanding your pain points. Have you had demos come and did their open source intelligence on you and had a basic understanding of where you were at and were able to target the demo to you specifically?
[Ken Beasley] Yeah, I’ve had a little bit of both. So, I’ve had some vendors who during our initial kind of quick chat about, “Hey, can I get on your calendar to show you our product or service?” And I say, “Yeah.” So, we have a kind of a basic understanding of what my needs are and what I’m looking for on the demo. We get on the call, and they have the right sales engineer, they have the right environment set up, they have scenarios built for what we discussed, and I’m able to see how their product adds value and meets my needs. And then on the contrary, I’ve had situations where vendors show up, the things that we talked about on the initial chat don’t make its way into the presentation or the demo, and I’m sitting through 45 minutes of About Us slides and discovery questions. Kind of feeling like I’m in an interrogation rather than beginning of a partnership.
[David Spark] By the way, everyone I hear says kill the About Us slides, the Meet the Team slides.
[Ken Beasley] Yes, they have to go.
Does anyone understand what’s going on?
7:10.728
[David Spark] Ludvik Jerabekof Proofpoint said, “When an organization doesn’t share the problems they’re trying to solve, you walk in as an engineer like a blind person with a long pole, carefully feeling your way around, hoping to find what’s really there. The meeting ends up feeling generic, more like a search for problems than a path to solutions.” We’ll address that.
Wyman Bartlett of Hilton Grand Vacation said, “Use less internal/product terminology. Instead, use more standard industry language. If I need to watch a video on your password-protected training sitejust to understand thearcane trademark names for your flavor or feature, then you’re already losing me.” By the way, I used to work for companies that had the most bizarre names for their products that nobody could understand at all. But the first thing about what Ludvik said iswanting to know the problems they’re trying to solve. A lot of people are not eager to tell you what keeps them up at night, right, Ken? So, you should do some basic open source intelligence before you ask that question. We’ll get to that, but you can’t ask it upfront, can you?
[Ken Beasley] It depends. I guess for me, if it’s kind of a cold call and they’re saying, “Hey, we want to show you a product and do a demo,” that’s one thing. But if I am on the hunt for something because we have a pressing need, I’m a little bit more willing to share the context. But what I will say, and I would tell anyone to do, and I do this, is get a non-disclosure upfront, right? We signed that, now I can talk to you a little bit more openly about what I really need for your solution to solve for, and also give you some real context, right? So, I think that’s been very helpful in how I’ve approached these, but I don’t sign the non-disclosure, right, with every demo, right? It’s the ones that I really know, and I’ve done a little bit of research on my own and talked to some of my peer CISOs about this particular product and knowing that, hey, this may ultimately be something that can meet a need.
[David Spark] Have you sent an NDA before you have a discussion with a vendor so you can be a little bit more upfront, Geoff?
[Geoff Belknap] it really depends. I haven’t done that recently, and I really would rather not, for all the same reasons that I imagine Ken wouldn’t. The reality is, if it requires me to go into that level of depth to figure out where I might have to disclose something I don’t want to disclose publicly, to figure out whether your product would solve any problems for me, there’s probably an issue with the marketing, and the reality is the product probably isn’t going to work. If I get to a demo phase, and it requires NDA to disclose sensitive information to implement the demo, that makes sense, I kind of get that.
But again, this is where I would say the best thing you can do as a vendor is make it so I can demo your product on my own, on my own terms, five licenses or whatever it is, where I can pay some small amount of money to just try it. Let my engineers fiddle with it themselves. We will figure out directly if that solves the problem, and then that way it’s a warm inbound. You don’t have to guess. I think, though, the reality is it has to be really easy for me to figure out quickly whether you solve a real problem for me, and I have to be able to communicate that clearly to you. Otherwise, there is a problem with your go-to-market strategy.
[David Spark] But let me ask you about that. That’s a good example of like you may get a license or a handful of licenses and let me test it out myself in a sort of a freemium or cheap model. In any of those cases, did you get a sales engineer to sort of help your team sort of do the initial implementation? This sounds different than a POC, or is it the same as a POC?
[Geoff Belknap] I think it’s a little bit different, and I think the answer isif I need a sales engineer, then I wouldn’t say it’s the wrong product for me, but that helps me understand that this may be more difficult for me to implement on my own. Now, look, if I’m installing a CRM or an ERM product, I get it. We’re really changing our business process. If you are deploying a 2FA authenticator, I’ll lean on Duo, they sort of were great at this, especially in the early days. They would say like, “Look, our product is so easy to use. You can have five license of it for free,” whichplenty of people did just for their home networks. “Here’s all the documentation. Here’s all the scripts you need. Go.”
Now, you could certainly reach out to a sales engineer and say, “I’m a big company, and I’d like some help with this,” and they would be happy to help, but you’re already now at the stage of like, “I’m convinced this is for me.” And so, my message to people is, your product should be that easy to installthat you really don’t need a sales engineer unless you’re at the point now where you’re like, “How do I scale this? How do I use this distributed management system?” Stuff that you wouldn’t do on your own anyway.
[David Spark] Do you like the try before you buy model inthe way that Geoff’s describing unlike a POC, Ken?
[Ken Beasley] Yeah, I mean, I’ve worked at some pretty big organizations in the past. I’ve also led some small organizations. And what I’ll say is that for the smaller organizations, unfortunately, you don’t have the resources, and sometimes the technical skills that you have on staff need supports from sales engineers. And so, you have to have them a little bit more involved in those situations, where obviously in bigger organizations, you’ve got a bigger talent pool, and you most likely won’t need that type of support from the vendor. But yeah, Ilike to use my own data when possible because I can see the value and I can run queries and things that I’m looking for specifically. So, I do like to test it live, if possible.
Sponsor – Fenix24
12:31.365
[David Spark] When a ransomware attack hits, the key question becomes clear. How fast can you get back up? The moment your systems go down, revenue, operations, reputation, and trust begin to slip away. In that moment, you need more than a plan. You need a team that knows how to restore your business while the pressure is highest. And that is what Fenix24 delivers. Fenix24 is recognized as the leading breach recovery company in the world, and the first civilian cybersecurity force built for modern cyber warfare. Their team has completed hundreds of ransomware recoveries, including support for major global enterprises, and they bring operations back online far faster than industry norms. They do not rely on theories or generic checklists. They embed with your team, work with your forensics partner and breach counsel, and handle the work required to rebuild infrastructure quickly and safely.
Now the advantage of Fenix24 begins before an attack occurs. Their cyber resilience program provides clarity, hardening and protection to withstand threat. They deliver asset visibility, realistic assessments, continuous protection of backups and infrastructure, and a recovery force. Even identity systems and backups are secured and ready for rapid restoration. Will your backup survive a breach? One way to find out is to go visit their site, fenix24.com, and when you go, let them know you heard about them from the CISO Series.
What would a successful engagement look like?
14:10.711
[David Spark] Mariusz Przybyla of ProLimes said, “Great demos start before the screen share. If a vendor hasn’t spent time asking sharp discovery questions to pinpoint the CISO’s pain, the demo is guesswork. No discovery, no demo.” Good point. David Higgs of Rapid7 said, “Some of the best sales engagements I’ve had with customers spends the majority of time in discovery and then maybe even just demonstrating three key features that map to pain points are extracted. They may have only seen 10% of the platform at this point, but the combination of that and the in-depth discovery is where they see the value of the person on the end of the call being able to help them with their problems.” It’s a good point. You don’t need to show everything. Show them enough to get them excited.
And Ran Nahmias of Tamnoon said, “The foundation of a successful demo starts with learning the CISO’s actual challenges and current priorities. Too many assume the problem they solve exists and is top of mind, often not the case. Next, align the value to that context, then earn the right to demo.” So, here’s what I want to dig into, Geoff. How do others find out about your needs without asking the blatant question of what keeps you up at night? Like what are ways people have addressed it with you or have done it without your help?
[Geoff Belknap] Well, I think first of all, if you sell a specific product and you’re not a consulting organization and you want to get into what keeps me up at night, that’s not a specific question. Like, that’s going to the dentist and going like, “How are you feeling?” Like, don’t you want to have a conversation about my teeth? I can tell you about what’s going on in the rest of my body, but you’re not going to solve those problems. So, I do think there has to be some leaning into precision Q and A, like do you have a problem in this area? Do you need something that solves this problem? We need to evolve a little bit as a sales organization. And this is where I’ll do my usual pitch of don’t start the conversation with the CISO. Figure out who usually has your problem, it’s some engineering or operations team in the security organization. Talk to those people. They will tell you what their problem is, and their problem is not all the things in the world that keep me up at night. It’s a thing that they specifically are supposed to solve and it’s hard for them to do. Make their life easier and they will do all of the work selling your product to me.
[David Spark] Yeah, and that’s a really good point because that’s ultimately what you want. You want to win over the people who work for you and for them to come to you, and correct me if I’m wrong, to say, “We love this.” And then them playing it out to you, “It saves us this time, it does this for us, it reduces this risk.” Where you, who implicitly trust your team because you hired them and you work with them, you don’t have to go through the process ofhow do I trust this salesperson kind of a thing.
[Geoff Belknap] And more importantly, it does not help my team for me to sell them on a product. I can certainly say, and I’m sure Ken runs into this too, “Hey, why don’t you take a look at widgets.org?” or whatever, and they will because they have been asked by the boss. But coming the other way around from the ground up is going to be a way higher value.
[David Spark] Right, just to point out, and I’ve done this myself, you say, “Go take a look at widgets,” and they come back to you, and they tell you, “Well, widgets is stupid, it’s idiotic,” and you just throw up your hands and go, “Okay, thanks for letting me know.”
[Geoff Belknap] Well, wait, or worse, they go, “Uh, I guess this is fine, let’s spend a zillion dollars on this,” and then you do. And then they’re like, “Why did you buy this? We hate this.” That’s not a great outcome.
[David Spark] You askthem, “Give me the truthful thoughts. I have no idea about this.” All right, the same to you about like what’s the best way people learn about you or sort of begin the conversation with you, Ken?
[Ken Beasley] Yeah, I think I agree with Geoff. I think if you get to the people that have the problems, that are responsible for solving the problems and have to do that work, and they begin to bring these products to you and say, “Hey, I think this is something that we really should implement in our organization,” it’s stronger than the other way around, right? Where the CISO is coming down and saying, “Hey, try these products out,” and sometimes the CISO may really like a product, but I think you’re going to have better success if the teams that are responsible for solving the problems are bringing those solutions forward.
[David Spark] Very good point. By the way, do you ever give feedback during the demo? Like, “You really shouldn’t approach me like this.” Like, “It’d be better if you did this.” Ken, have you ever done that?
[Ken Beasley] Oh, well, yeah, I’ve had some demos. If I can recall, they just kind of like shut it down and it’s like, “Hey you’re taking me on this About Us journey and really, here’s the problems we’re trying to solve.” And then when you try to get them to focus on your pain points, they kind of keep going around the road, kind of like it’s on a roadmap type of thing. And I’m like, “Wait a minute, the product doesn’t meet our needs, and we really can kind of shorten the call.” I don’t stay on the calls if I get to a point where I know you can’t deliver and everything is on a roadmap. So, yeah, I’ll just have to shut those calls down to save some time.
[David Spark] By the way, have you, during a demo, edited and said, “Guys, we’re going down the wrong path. I need you to do this,” Geoff?
[Geoff Belknap] Oh, yeah. I’ll say, A, I really try not to go to demos because I’m not the one that’s ever going to use the product, I’ve just come to accept this. And then B, if I am going to go to a demo or if one of my team’s going to get a demo, what I would do is explain it before time, like, “Great, let’s schedule a demo, but here are the ground rules. If there’s going to be a slide, and you have to do the, “We’ve got giant market share,” slide, like by all means, do one slide or two. But if we’re spending time on slide as the demo, instead of clicking through actual live version of the demo, like then don’t bother. That’s not a demo.
[David Spark] I will add this, Hadas Cassorla, who’s been on our show before, she was the CISO. She actually sends a message out to the team, so the day before the demo goes, “Here’s what we want to hear. Here’s who we want in the room. Here’s what we do not want to hear.” And so,many of the things that have been brought up, like don’t give us the history of the company, don’t give us the founder list or anything like that. The reason you’re giving a demo is because we’re interested in your category of product. You don’t need to sell us to say, “X number of people are having this problem.” Like, we’re already there. Let’s start at that point. Andwhat you need the day before sounds like a good way to get them on board. Yes? Let them know ahead of time, make it valuable for everybody.
[Geoff Belknap] The best thing you can do is set expectations because then they have a chance of meeting them. If you make them guess, I don’t know why you would play that game, but sure, that’s an option.
I didn’t think of these options.
20:49.237
[David Spark] Martin Kuppinger of KuppingerCole said, “Sometimes despite a specific request for a demo, there just was no demo. Frequently demos are highly generic, but what really helps the vendors are concrete use cases for demos. While I like getting a very short general impression of the user experience and fundamental and especially differentiating concepts and features, the best way to get a good demo is to find some few, a few here, use cases, scenarios you’d like to see covered, and define, restrict the time for the demo. To be fair, many demos I’ve seen were good. Not all though. And notably, screenshots are not a demo. I will also point out PowerPoint isn’t. Sofunny. I was just asking somebody about doing a demo on one of our shows, and they said, “Well, is it PowerPoint?” And I go, “No. I said demo. I meandemo.” [Laughter]They always ask that. So, Ken, I’m sure you’ve had this situation where you request a demo and you don’t actually get a demo.
[Ken Beasley] Yeah, I’ve had that before.[Laughter] And you kind of sit there and you’re kind of dumbfounded. Like, okay, wait a minute. I thought we were going to be demoing your product, right? Because for me, the demo is the discovery. Like I want to see your UI, your UX. I want to see the workflow and that’s going to generate more questions. But if I’m just seeing PowerPoint presentation or slides or just theoretic talk, it really doesn’t help me at all.
[David Spark] Geoff, your take on getting a demo scheduled but not actually getting a demo. Has that happened?
[Geoff Belknap] It absolutely has happened, and I think the best thing for everybody in those scenarios, even though it’s going to be very uncomfortable for you and the sales team’s not going to love it, is to just go, “Timeout. Like this isn’t a good use of time. If there’s a deck that you want me to look through, send it. I’ll take a look through it, but if we’re not actually going to demonstrate the product, then this isn’t a demo, and let me know when we can schedule that and then get your time back.” I’ll just say, it’s one thing to misunderstand if you miscommunicated but if you schedule a demo and you said demo and if someone has done the great work of sending ahead of time what they expect from a demo, and you’re flipping through 60 slides, you should be expecting the person to walk away.You have made a mistake.
[David Spark] I know there’s a lot of demos that begin, “I know we’re going to do a demo, but I just want to kind of set the stage of…” and then the slide deck is like, “No, don’t even bother. Just get to the demo. Just straight ahead. No need for it.”
[Geoff Belknap] It really tells me how the relationship is going to go if you can accept the ego bruise of skipping through the showoff slides to actually get to the demo. Or worst case, if I told you what I needed and you presented a bunch of slides anyway, I know that you’re not interested in what I care about. You’re interested in just closing the deal transactionally, and that’s not a good sign.
Closing
23:39.581
[David Spark] Ken, we’ve come to the part of the show where I’m going to ask you what is your favorite quote and tell us why.
[Ken Beasley] Well, my favorite is Ran from Tamnoon, I think, “The foundation of a successful demo starts with learning the CISO’s actual challenges and current priorities,” is spot on. I would agree with that 100%.
[David Spark] Yeah. I mean, I will just say Ran’s right, but it is not easy to get that, what he’s saying. So, easy said, not easily done. Would you agree with that, Ken?
[Ken Beasley] I would agree with that.
[David Spark] All right, Geoff, your favorite quote and why.
[Geoff Belknap] I mean, that was a good one. I think a lot of people definitely drink their own champagne enough to think everybody needs the thing they have, but I appreciate people who think about it differently. But I think Nadeem nailed this right out of the gate from Goldmark Real Estate and going to just trim it here and focus in on the part that I think is really important is, “A great demo makes me say this solves my problem my way and I can deploy it without a six-month change management saga,” and I think that is so real. Like if you are giving a demo or you are being demo’d to, that is really the win signal. It’s like in your brain, I’ve gone like, “Ah, yes, I have seen what convinces me that this solves a problem and that it will work in my environment and I will be happy with this product.” That is easy for me to be demo’d to, to just sit there and react and go, “Oh, yeah, great. I’m impressed.”
But the amount of pre-effort needed to land that is why I point people to let people figure this out on their own. Because maybe it takes them three weeks of fiddling with it to figure that out, or it’s going to take a lot of effort from the sales team to understand ahead of time what are the problems you need solved? And are we convinced ahead of time that we can show that those problems are solved? Do not demo until you get to that state, regardless of how hard somebody asks, because you’re just rolling the dice at that point.
[David Spark] Very good point. Well, that brings us to the tail end of this show. I want to thank you, Ken, for joining us today. And Geoff, as always, we greatly appreciate it. Huge thanks to our sponsor, and that would be Fenix24. Remember, go to fenix24.com to find out whether your backups will survive a breach. You want to be with a team, well, who has really seen the worst and well, these guys have seen the worst. When you go check them out at fenix24.com, let them know you heard about them through the CISO Series. Thank you so much, Ken. Thank you so much, Geoff. And thank you to our audience, as I always say and always mean, and I’m not going to start talking in my earnest voice anymore. We greatly appreciate your contributions and for listening to Defense in Depth.
[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.