Security Marketing? Every Product Needs a Story!

Security. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Tim Peacock, a product manager for threat detection here in Google Cloud, and Anton Chuvakin, a reformed, tamed, captured former analyst and member of the security team here at Google. You can find this podcast wherever podcasts are distributed and at our website when, knock on wood, you're listening to this sometime in the future when we have launched it, but we haven't yet. In the meanwhile, you can follow us on Twitter as well at twitter.com/cloudsecpodcast. I couldn't be more excited about our guest today. Our guest is Kelly Anderson, rumored to be a mermaid, but definitely in truth a member of the product marketing team here at Google Cloud. Hi, everyone.

Tim, thank you so much. Wow, what an introduction, making my life goals come true before the podcast has even started by calling me a mermaid. So thank you so much. As Tim has said, my name is Kelly Anderson, and I currently lead marketing for reCAPTCHA Enterprise and Web Risk API. I'm currently marketing these products because I believe so strongly in my team's mission to secure every webpage on the internet in a simple and customer-centric way. Prior to the online fraud protection business, I was working in marketing for Google Cloud's security management and threat detection products, which Tim, shout out, hey. And that's how I know Tim. And then before Google, I worked in product marketing for Microsoft in Azure, marketed a variety of security products ranging from key management to security management and threat detection to confidential computing. into business continuity products. So it's great to be here, and I'm really excited to talk about security marketing.

Thanks for this intro, because I think we need to force all our guests to do the exciting intros like you just did. So this is like a note to self.

Love it.

So here's the thing. Marketing is occasionally reviled by security technologists. And if you follow social media, people sometimes make jokes about security marketing. So for our listeners who are security leaders or maybe security technologists, who don't have a marketing background, what is marketing really?

I laugh because I think it really depends on who you ask this question to. From my perspective, marketing is branding, marketing is demand generation, it is customer satisfaction, it's launching products, it's media planning, it's using analytics tools to better predict customer behavior, it's Being the voice of the customer, it's driving sales, it's strategically placing the product in the market, it's driving pricing conversations, it's executing, but my personal favorite is marketing is creating magic.

So that's a ton of different things that marketing can be. How does a cloud security product, service, business unit, company decide what kind of marketing they need?

So I think a strong marketing organization has all of the disciplines that I just talked about and hopefully more, but I think you know your company values marketing and needs marketing if you have these 3 things. The first thing is your company believes that they need to attract new customers to grow. The second thing is they would believe that the company needs to get more efficient or better with their resources. And then the third thing is your company believes that they need to stretch every dollar to maximize impact. So if your organization says yes to these questions, that is the first step. And then from there, you can build your marketing strategy.

The reason why people sometimes roll their eyes and say, oh, you're doing this, you're making the product look maybe better than it is or something.

Yeah.

So what makes for a great marketer in cloud security? Now, here are some of the technical people who would roll their eyes, but I wanna remind the listener that being able to talk about the value delivered by the product is super important, right? If people don't see why use a security product or a service, they won't, no matter how much safer it makes them. Like if you don't have a story that makes the product be clear to their needs, there's no point. So tell us a bit more about how to be a great marketer in this.

Yeah, Anton, that is a great point and you hit the nail on the head by talking about storytelling, right? So the first thing that I would say that makes a great marketer in cloud security strong storytelling skills. So storytelling is how we as human beings have communicated since the beginning of recorded history. Cavemen have used storytelling to share rituals and talk about hunting. The ancient Greeks have used storytelling to explain myths and legends. And so storytelling is such a core part of the human experience that as marketers, if we use storytelling, it allows us to build a deeper connection with our target audience Because we're connecting to them at that human level. So I'll give you an example. I could tell you about a new feature that Google Workspace has released, and I'm totally making this up, but let's say this feature helps customers prevent abusive users from disrupting meetings. And I can tell you the technical ways that this feature works. Or like if I put storytelling skills to work, I can tell you a story about how this feature has empowered healthcare professionals to have real and honest conversations with their patients about their health because this feature gives them the same level of confidentiality and trust as an in-person consultation would. The importance of storytelling leads me to the next thing that I think makes a great marketer in cloud security, which is as you are telling stories, talk to your customers like they're real human beings. In security, our target audience is some variant of security roles. We have security practitioners, we have security implementers, we have decision makers, or we have C-level folks. And a lot of times we can get so focused on the technical details of the product or using the right jargon so we can show our audience that we are one of them, but it can sometimes make our messaging really complicated and verbose. So we need to use conversational language to keep things simple and clear for our audience.

So this is kind of something I can definitely relate to, but I also fear sometimes that when you present this vision of good marketing to technologists, they tell you, hey, hey, hey, these are just stories, give me the code. So what's your typical response to people who kind of like force against the storytelling argument and say, no, you don't need a story, just give me the code. As long as it does what I want, I'm okay. What's your response to this?

I think there's a place for both. I think that initially what draws your customers into products is story. And then once they are interested, 'cause usually the storytelling, we attach as marketers a bunch of different call to actions with that after you've told our story, like you can start to try the product in the GCP console, or we link you to documentation where you can actually read about the technical specs of that product. But I think, right, like what I was talking about with storytelling and how it allows you to connect at that human level, you have to lead with that first because that's what's going to capture your target audience and allow you to move them through a journey which will eventually take them to the technical specs of the product. But it's not as inspirational as a story. And so I think that it's going to make it a lot harder to get that initial buy-in from your customer if you're just leading with how things work and the technical specs.

Those users who ask for, just give me the code, I bet they're the same users that don't believe we need comments in code because code should be self-explanatory. So Kelly, you talk about cavemen and ancient Greeks. I assume your day-to-day doesn't actually involve hunting things with sharpened sticks and conversations at the agora. Take us into a day in the life of a cloud security marketer here at Google Cloud.

Oh goodness. I think I speak on behalf of this whole security marketing team when I say that, like, what Don't we do? We're creating security magic all the time. But it's like I told you earlier, it really depends on who you ask. I think that we all as marketers can agree that we're really focused on our customers. We do everything that we do to better understand and serve our customers. So I'll give you some examples of some of the things that our team is doing right now. We're conducting market research to learn more about our customers, like What are their pain points, their goals, their barriers? What's their role in the buying process? As well as learning more about the security market. Like what is the size and value of the market? Who is our competition? Who is my market? We develop messaging and positioning, and messaging and positioning is how you talk about the value of the product. And then the messaging and positioning helps us create a lot of content for our products, like our product webpages or customer-facing pitch decks for our sales teams to use. We launch a lot of products. I personally call my product launch days blastoff day. Hey.

I mean, no underwater metaphors? Okay, so you're departing from your mermaid roots.

I want both. I want the sun, moon, stars, and the ocean.

You wanna be the astronaut mermaid. This is awesome.

You can have it all. So before a launch, it's a lot of what I just mentioned about this market research and messaging positioning. And then after a launch, we focus a lot on enabling sales, driving demand for the products, and product adoption. We also work with press teams to support journalists as they amplify our product messages and write stories that showcase how Google thinks about security. We work with analysts to show them why Google Cloud security products are different from other security products in the market and help them help their customers that are inquiring about Google Cloud products. And we partner with a lot of marketing teams. We work with demand generation, digital marketing, social media marketing, industry marketing teams, our compete team. We have a customer experience team. And this is all to build awareness for our products to make sure that customers know that we have security products that can help their businesses.

That makes sense. And so some of it, what you described kind of sounds like what a traditional, typical marketing person would do, I guess. So what's different about cloud security marketing? as opposed to like regular old boring on-premise marketing? Is there still FUD? Are we still using the same things as other vendors or is there magic in our area here?

There's so much magic. I love that you asked this question because in regards to on-premises marketing, we took this position at Google Cloud that we believe that moving to the cloud can help make organizations more secure. We recently did a security insights survey where we found that 84% of respondents believe that the cloud's infrastructure is as secure, if not more secure, than their on-premises infrastructure. So we built a story around that. We believe that the cloud is more secure because we built a global platform, right, that we used for a really long time for YouTube or Gmail. We've extended that platform to our customers. to build and run applications, and then have those applications collaborate in a secure environment and stay protected. Or from the GCP console, we now have a single console where our customers have a much easier time managing users and devices and applications with cloud identity. We also secure endpoints and access platforms with Chrome and Android. And so, We are showing customers that we protect them in Google Cloud from the user to the device, to the application, to the platform. And so for a while, our marketing was focused around telling this story and talking about the benefits of the cloud. But then COVID-19 happened, and that changed our strategy, and it changed our story. What we saw was that during the first few months of the pandemic, a lot of organizations that we thought would slow down migrating to the cloud actually accelerated their migration to the cloud and using cloud-based services. And so, as you can guess, like, they obviously did that to help manage this new normal that we all have of having a remote or distributed workforce and conducting their businesses fully online. And so the story really shifted, and now it became about telling stories that show customers how we're making their new normal, their business running in the cloud safer and why Google Cloud is best positioned to enable that success.

Fascinating. I hadn't thought about the COVID shift and how marketing is going through here. So thinking about all of the things that we do, what are the things that are easiest or hardest to do at Google? And don't tell me MSAs, because I know how bad those are.

This first one, I think, Tim, as a product manager, you can relate to, and I know, Anton, you definitely feel this as a marketer, are customer references, right? Because we know from working with our customers, no one likes to talk about their security challenges. And I get it, because a huge reason for that is they don't want adversaries to know their strategies, or how their environment is or was configured. And so, something that we try to do in Google Cloud Marketing is show how our customers' adoptions of Google Cloud security products help their business. So, I love to tell stories about how Google Cloud security products are protecting businesses' brands, so their reputation, their bottom line, that's their revenue, and most importantly to them, their customer relationships. I think another challenge that we have as marketers is internal, which is showing the value of storytelling and how we talk about our products to the market. 'Cause Tim, like you said, we're a tech company, and in Google Cloud Security, we are designing security products for security professionals. We work with a lot of security professionals at Google. And so sometimes there's this tension between product and marketing where my more technical stakeholders want to tell the customer, just as Anton was saying earlier, like the specs, right? Exactly how a feature or product works. to drive that product or feature adoption. And I get where they're coming from because like this feature or their product, it's their baby. They have been working really hard on this thing. And then marketing wants to tell a story that shows the value and the benefits of a particular feature or product to drive product adoption. And so as a marketer, a lot of times what I do is I'll just take my technical stakeholders on the customer journey and show them that, hey, I'm still talking about your feature Or your product, and we will get to the technical specs or implementation. But storytelling, right, is that gateway to talk about the product or the feature in a much more personal way, in a way that can resonate with our customer and get them to ultimately do what we're trying to have them do.

So this sounds like some kind of a balancing act, I guess, between the discussion about features and specs if customers want to, but also about value and kind of a high-level story. To me, I don't want to lose the story ever because to me, you would not sell to enough people if you lose the story. There is no story, there's no product.

Exactly.

So let me touch on the other thing that's been interesting in this market. Of course, we all know that there are roughly, you know, 1,800, maybe 2,000 security vendors. And cloud security is such a space that's evolving. New vendors are coming in all the time. We had a couple on the podcast here.

Yes.

So there's a lot of noise. A lot of people are talking about cloud security at the same time. And of course, we have, you know, 3 cloud providers like ourselves. And well, to others.

Who will remain nameless.

So how do you talk about products so that they stand out from the noise so that you don't sound like 400 other vendors? How do we do that?

As a product marketer, the first thing I'm going to say is it starts with creating differentiated messaging and positioning. Once you've established what makes your product different, the next thing that you need to do is reflect that difference in every piece of content that you create. So at Google Cloud, we position our security products and show how they're different from our competition based on features, so product characteristics, price, quality, and use. And with positioning, this is so important, and I feel some marketing organizations sometimes undervalue this. Positioning is all about getting into the mind of your customer first. Right? So before your competition, and then it allows you to build a leadership position in your customer's mind so that as the product or the features progress, however the product evolves, it still holds that number one spot in the customer's mind. I like to think about it a lot like your first love, right? It will always occupy a special place in your heart, but with positioning in the prospect's mind. And so with differentiated messaging and positioning, it's about establishing that your products are different and then holding that leadership position that will continue to make the product relevant to your customers as the product evolves over time. I think another thing that, you know, we're doing at Google Cloud and is a really strong defense against the noise is running strategic marketing campaigns. And what this means is, how do we reach out to our target audience? This can be by segment, vertical, region, like it really just depends on what the product's goals are. And as we reach out to our target audience, we can do this through emails or other digital formats like a webinar or Twitter or web pages. And we share with them the value of our security products and then leave with them a call to action So that they either can do something that will help them learn more about the product, or we just give them information to learn more about the product. And then the last thing, because again, great marketing involves storytelling, is creating compelling stories and contents, right? Like, we can take the differentiated messaging and positioning and run campaigns targeting the different target audiences that we want to go after. Through email or webinars or social media. It's in a way why customers remember why our products are the best solution for their particular challenges.

What I'll say on that one is one of the reasons I love working with Kelly is when we were putting together demos and talks, there was always a story that Kelly was putting into it. And, you know, some of my colleagues would just want to talk about technical capabilities of their product. And Kelly would always put a narrative around it that really brought the thing to life and made the talk so much more engaging. So I want to circle back up kind of to the start of where we were and ask you sort of the second-to-last question here, Kelly. How is cloud marketing helping our users stay ahead of adversaries? Because that's really the most critical thing here is we're all here to help our users from getting popped. So what's marketing doing to really help users from getting popped?

So I could keep it vague, right? And just say, oh, so many things, all the things, but I'll name a few, maybe we can link to them in the podcast. The first thing that we do is we provide customers on our Google Cloud Security page security insights. And this is a report that helps them stay up to date with the role that security is playing in today's IT strategies. We also provide customer case studies on all of our different security product pages to show how customers in either their industry or similar industries are using our Google Cloud Security products. We also host quarterly Google Cloud Security Talks, which Tim and Anton, I believe that you have made guest appearances on.

Yes.

So if you've listened to their talks, great. If you haven't, stop listening to this podcast. No, I'm just kidding. Go listen to their Google Cloud Security Talks after this. But our Google Cloud Security Talks, it's a great way for us to share the latest and greatest with our products, and how our products are helping to make a more secure world, especially right now during COVID-19 with securing a new normal. We host webinars on BrightTalk and Cloud OnAir. Cloud OnAir is another Google Cloud channel to host and show how products are addressing a lot of current and pressing security issues. We are publishing blogs on the Google Cloud Blog, which hopefully you found out about the Google Cloud Podcast from their announcement on the Google Cloud blog. And this is where we post a lot of updates, so you can stay up to date on all of our latest feature and product announcements. And I saved the best for last. We have this amazing podcast to help customers learn more about how we're thinking about security at Google Cloud.

Kelly, you just named so many awesome resources. We will be linking to those In the podcast notes. We'll be linking to them on the Twitter account. Folks, that brings us to our closing time. Thank you so much for joining us today on the Cloud Security Podcast by Google. Kelly, thank you so much for being, uh, the best mermaid and marketer we've had on the show so far, and I suspect into the future for a long time. So with that, you can find this podcast on Google Podcasts or wherever you get your podcasts. You can follow us all on Twitter as well, twitter.com/cloudsecpodcast. My co-host @anton_chuvakin and myself @timpeacock. Please do tweet at us, email us, argue with us. If we like or hate what we hear, we'll invite you onto the next episode. And we promise that joining us here is more fun than arguing on the internet. So with that, we will see you on the next Cloud Security Podcast.

Security.