Sales Strategies for Cybersecurity with Alice Shaaf

Every company has breakdowns in their revenue process. Sure thing. Deals slip into next quarter, competitors creep in and swipe deals away at the last minute. And deals getting single threaded that don't get to power. These are just a few examples of revenue leak, but there are a ton more and they're preventing your team from reaching their sales targets. That's why I'm such a big fan of Clary's. Revenue platform is the only tool that actually helps leaders take control of their revenue and thrive through any market conditions, especially when things get tough. You can't afford to miss a single detail, but you also can't be leading by gut. Clary combines the science and the art of sales and sales leadership. So go to clary.com if you want to answer the most important question in your business. Are you going to meet beat or miss on Revenue.

Foreign?

What up, everybody? Welcome to another episode of the live Better Sell Better podcast. This is your host, Kevin Dorsey, AKA kd, and we are going to dive into cyber security today. Because what you see on LinkedIn so often can be an absolute echo chamber of salespeople talking about how to sell to salespeople and salespeople talking about how to build a brand for salespeople. And yes, it sounds great and it's great and you're getting a side hustle and all these things, but how does it apply to cybersecurity? How does it apply to a super technical buyer? How does it apply to a buyer and a prospect that is inherently distrusted? They're not going to click on links. They know that you don't know their world and everything around it. So that is why I'm so excited. I have Alice Schaff with me on the show today because she's made that week from selling into sales, into marketing and education, into cyber security, now taking what she's learned and adapting it to a new industry in a new market. And she's going to be breaking down what she's learned, some of the differences and everything else today. Alice, welcome to the show.

Thanks so much, Kevin. I appreciate that. Lovely to meet you.

I'm, I'm pumped for this. So let's actually start this off with just that first, I call it aha moment. Like, when did you, when did it hit you that cybersecurity was a little bit different? Like what was like the light bulb moment of like, oh, I'm going to have to adapt here. I'm going to have to change a little bit. Like, what kind of like happened to kind of make that switch go Well.

I was working for, for Google Cloud through an acquisition with Looker Data analytics. And I, I was, you know, it was Covid. I was a bit excited to move into a new industry. I really wanted to discover like what, what, what's the next step for me? And I thought, okay, well, cyber security is the way to go. Everybody talks about it. That's, you know, that's always going to be needed. Especially you know, Covid hit and everything like that. Folks moved online. So I decided to take a new challenge and I joined a small startup that was focusing on cybersecurity back then. It was three years ago. And then, you know, I started prospecting and folks are just either not responding or, you know, negatively rejecting the information that I'm sending or even, you know, like just hang up the phone. And I wasn't used to it from Data analytics, like folks always want to talk to me. So I discovered that, you know, they're just afraid of strangers because stranger and especially if you're emailing them out of the blue, they're not gonna click on any links, they're not going to give you the time of day. Like they don't know you. So they're afraid of, of getting breached. That's their job, basically.

So then how. This is a two part question, right? Because one, this is a brand new industry, it's a brand new Persona, it's a brand new prospect. What did you do to get up to speed? Like, what did you do to start to learn their language, start to learn their, their problems, what they care about? Like, how did you get up to speed on this industry? And then we'll talk about some of the tactics you've used to start to crack in, like, how did you learn their language, their ideas, what they care about? All of those things in a new industry.

Yeah. So I think with every new industry and not even cyber, you gotta be where, where your audience is. So the place that the places they're hanging out in is where you have to be, whether it's LinkedIn and the forums and you know, the conferences they go to. You're just gonna have to interview these folks and treat it more of like, I want to learn from you because you're the, you're basically God, you're the big Expert. You have 20 years of experience working at this one company doing security. So who am I going to tell you that my little startup is going to revolutionize everything you're doing? Right. So it's more about learning from your audience as opposed to trying to educate Them your way and being very humble.

Yeah, I think that's the key, where I see a lot of sellers and sales leaders fail in new markets is they don't go in with humility. They don't go in trying to learn. They try to go in. It's like, all right, I've done this before. Let me execute my playbook versus going in and learning. Right. Like, it's one thing when I look at my career that I've been very proud of is all of my teams have been in different industries. Every single. There's no overlap in any of the teams that I've built. I've always had to learn a new one. And I really try to go in that way and going, okay, what do.

I need to learn?

What do I need to understand about this industry, about this prospect, about what they care about and everything else? And I just love that. Let's double tap on that. How do you, how do you get that time of day with them? Right? Like, were you reaching out on to customers? Were you reaching out on LinkedIn? Like, how did you actually set up some of these conversations to start the learning process?

Yeah, So I think LinkedIn is huge, especially these days. And because they added this feature where you could mark your profile as valid, like add an ID or add your information as an employee. So that makes you credible and that shows other people that you're a real person and you're not some kind of hacker that's trying to steal their information and attack them. And, and, you know, social, social hacking, social engineering, phishing, that's usually how these companies are getting attacked. So, like through an email, through LinkedIn, through LinkedIn, clicking in. So it's always going to be. They're always going to be mindful of who they're connecting with. So making sure to show them that you're a real person, that's gonna, that's gonna really help as well as going to conferences. So, like just going in person and meeting these people, introducing yourself, just, you know, shaking hands and not being scared to, to talk to strangers. I think that that would, that would definitely set you aside. I mean, sometimes I'm. I'm watching enterprise salespeople who are just hanging about and sitting at the booth and waiting for folks to come to them. Unfortunately, that's not the way it works. You know, you really find the best people by going outbound, by looking. You know, when. Usually when I'm in a room full of people, I'm like, okay, well, who should I talk to? And I'm Looking at the folks that look a bit more experienced that, you know, that maybe are not as usually the, the security people are, they're, they don't, you know, wear suits. They're not like all, all polished and everything. So they have a look to them and usually you get to, to recognize them and they're not, they're not the ones that everybody goes to usually. So you know, you could, you could really see who's, who's who. And then if you're in a group, you can definitely, you know, see who decision makers are because they're usually like more calm, like laid back, like they're not, they're trying not to get approached.

Yeah, you, you can tell they carry themselves in, in a certain way. And I, what I love about this is like I think people, sellers and companies, especially early stage companies, do not leverage events enough. It's like they think that they're just a lead gen platform and you have to get a booth. It's like you have to be where you're pro. That's the best place to learn because you can ask questions and you can hear the questions they ask. What are the sessions like? One of my favorites is like what sessions are the most filled. Those are topics they care about. All right. That helps me understand, right. Like where I need to focus. And yeah, there's nothing better than like sitting at a table and like talking and listening and asking questions. And so I love that. Now let's switch it then to then how do we actually start to apply this in the sales process? Because to your point, their whole job is to like question. Every piece of outreach they ever get. Right. Is to make sure nothing unknown gets in. Nothing can fish, no one can trick somebody. And so often it's like almost the harder you try to prove you're a human, the more suspicious it feels. Right. Whereas like, oh, like I'm a real person or whatever else. And they're like, no, that's even worse. So like how do you do that? How do you actually then build the trust when you're reaching outbound to these people through channels that they inherently distrust? Or like how do you start to build that pipeline up when they're not maybe going to click on a link or they aren't going to open their email, they've got firewalls preventing you from getting in. How, how do you do it?

Well, I think leveraging the technical folks at your organization. Like for example, I work closely with our cto, Dmitry Reidman, he's the founder, he developed the product and really leveraging his network and the name that he's built for himself. He's been working in SBOM software, bill of materials since 2018. So he knows a lot of people. And just like using this knowledge and using his network, that, that really makes me credible. Right. So if you're in sales and whether it's a small company or a large one, and you use your technical experts and their network and even use the executive's network, that's really going to help and move the needle. And we also have an advisory board. So using these folks and using the names of the people who are credible in your space, that makes, that makes you look like you, you know, what you're talking about. And even going to their LinkedIn, like usually what I do, I would go to, I'm telling you a lot of secrets here, but I would go to their LinkedIn and I would look, look at their connections and I would immediately see like who I should be talking to. And I even like in my connect request I would put like, hey, I noticed you're connected with so and so like our advisor. Right. So you're probably following them. And, and I don't know if you guys are personal friends or whatever, I'd love to stay in touch and then, you know, you get going from there. But leverage your network.

Yeah, I think that is huge. Especially when you get into, I'll say very technical markets is they want to talk to people like them.

Yeah.

And it is very rare that a salesperson is like them. Right. Unless you can somehow convert a cybersecurity professional to come to the dark side of sales. It's really hard. There's not a lot of sellers that have cybersecurity experience, you know, so to leverage that network I think is key. And I'll throw this out to people listening like this never stops. Because then your customer's network is the network you start to work through. Right. Of like building out that referral network and interest. Because eventually like maybe your cto, your co founders networks run dry. But then every new customer is an opportunity for new access to network. And so how have you leveraged that at all yet where it's like with customers leveraging their networks for introductions or referrals or things like that.

Yes. But that's another thing that you have to adjust in cybersecurity. So I'm a huge fan of using your customers as your advocates. Right. But sometimes, and you know, often we have some public customers like Schneider Electric that are not shying away from announcing that they're using SBoM Studio with Cybeats and everything like that. But there are customers that I can't even say their name because they don't want to be recognized as using our software because it's sensitive. They don't want attackers and bad actors to know that what they're using. So how do you. You know how. Yeah. What are your thoughts? Like, what would you have done?

Okay. Yeah, no, it's. It's finding the ones that will. That's one. But the second area that I'll focus is I build a lot of this into pricing negotiations, where if they want a discount, I'm asking for referrals, whether it's public or private, where it's like, all right, maybe we're never announcing it, but I'll knock 10%, 15% off if you'd be willing to make 10 introductions over the next 120 days. Right. So I build it into the pricing negotiation of like, all right, you don't have to do it publicly, but could we do it here? Because that referral. Right. Is well worth the 10, 15% discount. Well worth. Right. Like, I will. Like, this is something I know I have a different stance on. I am a very, very proactive discounter, right. Because it's an opportunity to get something. I don't just want the deal. I would sell a deal at 15% off all day if that meant I got 15 introductions all day, zero hesitation. And so I'm very proactive with that. And what happens with this is once you get it cranking, when 30 to 35% of your new customers came from referrals, right? They are very open to referring because they were referred in, and so they already know people trust it. So then it starts to create a flywheel. So that's the other tactic I'll use. I build it into the pricing negotiation because they're going to negotiate, you know it, so why not get something from it? So that's the other part that I really try to leverage.

I like that. I think that's. Let's talk about something that I'm gonna use. Yeah, I mean, I think that that's. That's something that I'm definitely gonna use moving forward. So thanks for that. It's a good tip.

There we go. There we go. So then let's talk about now, because how big is the team right now? Or are you running this solo?

Right now it's me, but I'm gonna hire in the new year, probably four people.

There we go. So perfect. So what's Your plan to get the team up to speed on this? Because it's one thing for you to be able to do it. How are you thinking about onboarding these new reps to get them up to speed on cybersecurity? What you've learned the ins and outs of it, right? Like kind of what's that game plan looking like?

Yeah, so I think, you know, the folks that I'm going to hire, they would have to have at least one year experience selling into cyber security because otherwise it's not something that you could teach. You have to live it recognizing the fact that folks are 20 years experts in this specific area and you are not like you gotta have at least one year dealing with all this rejection. And you know, folks are ghosting you and not wanting to talk to you. And you know, cybersecurity, it's even worse, especially if you're selling to it. For example, like we're selling to product security, which is a bit easier than selling to it because IT people, they just don't answer phone calls, they don't get on the phone, they don't want to talk to anyone. Right. So I mean, and the engineers is the same thing. It's, it's, it's difficult. And then having that experience that would be good. So that the profile of the people that I'm going to hire, they're going to be folks that people want to talk to and it could be about anything in the world. Like if you could talk to me about sports for five minutes or if you can talk to me about your travels or if you could talk to me about cooking or whatever, whatever you're interested in. I have to be somebody that can talk for a little bit about a lot. Right. So like I need to be interesting. And these folks that are dealing with security, it's not their entire life, like they're doing that, that's great for their job, but you could talk to them of other stuff and you can build their relationship like that. Like for example, I have a couple CISOs, chief security officers who are my personal friends already because we meet each other, we go to events together and you know, it's kind of like a closed, closed group where you meet these people again and again. So you become kind of friendly and they, you know, they ask about my family, they ask about my trips and it becomes like more of a trust based relationship that's more of a fun and not just work related. So really like being that person that would be communicative and wanting to maintain friendships for a Long time. I think that that would be good and, and that's hard to teach. So when you're asking me about my plan, what I'm going to teach them, first of all, I'm gonna hire based on this profile, right. And then when I'm, when I'm working right now, I really summarize everything in, in notes. So like, so they have some materials to fall back on, right. So everything's written down. Because when I came in cybeats day, they have a lot of written material and everything like that, but it's not digested into sales. So it's more of like documentation and you know, for security folks. Right. So like making it applicable to people that don't understand anything and even writing a little bit about like metaphors and how it would, how it would look like in terms of if we are talking about something else that's not specifically security. Right. Like, like comparing it to something else that, that usually would work in visualizing, like taking vid, taking a lot of videos and, and showing that that really would help.

Yeah, I was going to say big, big tip. I was like, record everything, every one of your demos, every one of your follow up calls. I'll record all, all of it if they let you. I know also in cyber security, sometimes they're like, no, you don't even get to record like the calls. But then you have all of that to really work on with the new ones. And you covered one of my favorite event topics. I don't know if people caught it or not. Going to an event with a customer is a gold mine. Right? And funny enough, I had never thought about this until one of my reps at Patient Pop. Liz Lee, shout out. Liz Lee, love you. She did this. She would like get in. She got invited to events from some of her customers and she went to a couple and then they were just introducing her to everybody. It's like, oh yeah, this is Liz. Like, you know, she helped me with my website like it was a gold mine. And so now anytime we go to event, we're like, who could we bring? Who could we bring that this would be actually a fun event for them. They'd enjoy it. But now we've got that CISO next to us, now we've got that CFO next to us. Just making introductions and everything. That was one of my favorite event tactics. So I wanted to make sure people caught that because that's a really, really good move to make there.

Yes. And in fact, even before I came in, our CTO went with with our customer to an event and that's how they got their second largest customer. So I'm definitely leveraging that and I'm glad you've mentioned that. And double click on it. Like, always, always be in touch with your customers on LinkedIn, because even if they don't invite you, you could see which events they're speaking at and you could just go there. Like, you don't have to get invited.

Yeah, no, it's like, all right, we'll just open the whole chest here for a second. Because what, like, instead of buying a booth at a lot of events, what many companies would be way better off doing is taking that 15, $20,000, paying for three or four of their customers to show up, and then throwing a really great dinner or like a small setting event that each of them can invite four to five people to. You will get more interactions, more out of your dollar, more everything. As opposed to dropping $25,000 on the booth for that SDR to stand there and hope people come by. Pay for three of your customers, throw an amazing dinner at like a steakhouse or whatever else and have them invite other attendees.

Game over.

That's, that's the move right there.

Yes.

So let's go one step further here. Sorry.

No, you're, you're on.

You're good.

You had a follow up question.

So I was gonna get off of events. So we keep going on events here real quick and then we're gonna pivot into the sales process.

Yeah, I think if you're low budget, I would say leveraging a large conference. Like, for example, we have RSA in San Francisco for cybersecurity. So we, we are hosting the, the A meetup over there for folks who are working specifically on SBoM. So, you know, really attracting people by knowledge sharing. And also, like, you don't have to pay for their tickets because everybody's coming in anyway. Right. So catch them by asking them to present something or perhaps, you know, making it like a fun dinner like you described. But yeah, sometimes you don't have to pay for customers to come. They're already there. Right?

Already there. I love that. So now let's keep going down. Right, so we've been talking a little bit like pipeline generation. Let's actually now get into the sales process because I think this is also a place that a lot of people miss is cybersecurity. People don't want to talk to salespeople, like even once they're in the sales process. Like once they're in a super technical, like Even that sales process can be challenging. So, like, how do you weave this through all the way to close? Right. It's one thing to get their attention, but now that you're in the sales process, how do you continue to engage, build rapport, and eventually, you know, drive it to close with again, there's a lot of distrust there. There's a lot of hesitancy to do things. So how do you then continue the sales process throughout this?

So I think the rapport is really important because when people buy, they usually buy from people they like. And how you become likable is if you become interested in what they're doing. And it doesn't have to be about cyber security. It can be about their children, it can be about their vacation, it can be anything. So when you're asking more of like these personal questions of, and getting to know somebody on a personal level, that, that can really help your, your way into a deal and, you know, getting introduced and getting all the, all the good stuff that you wanna, you wanna get into when you're, you know, doing discovery and when you're negotiating and meeting other stakeholders, right? So like, really build up that relationship with your champion and then the decision maker as well and make it personal because nobody wants to talk to sales. That's true. And also this year I actually decided I'm gonna take classes to better myself in cybersecurity. So I'm taking the IS C2 certification. And, you know, first I wanted to do the cissp, which is, you know, that's a, that's a huge leap. But I'm probably going to start smaller and do the cc, which is like the beginner. The beginner one. And that would make me credible to talk to them because I'm going to know what, what they know, right? Like, it's not like, it's not like some kind of secret. You can really become an expert in something if you take a class and you learn it.

Oh, man. All right, so I give you a little bonus one here too. If you're going through a certification, one of the best notes you can send to like, prospects is I'm going through this. Any tips?

Yes.

It's just such a light touch to make. But if there's people like, hey, I'm preparing, like, I'm giving this any advice for me as I do this as a like is like, people love to share that advice and such. Such a easy piece of outreach, such an easy way to get a conversation going. So I love that. I think I heard you say you're already doing that. So you're like, you're going through it and then you're reaching out to prospects and letting them know.

It's a huge topic of conversation when. Yeah, yeah.

Okay. So then as we kind of start to wrap this up, right, so we've talked about learning, which I hope people are understanding of. Like, you have immersed yourself in the prospects world. You have interviewed customers, you've interviewed prospects, you're getting your own certification, right, within this process, which I think is gold. And then you are working very, very closely on the person side of it. I think a question that I'll bring up is, you know, in sales, right, we tell people all the time it's like, all right, there's the rational, you know, logical side and there's the emotional side, right? Like how do you connect, you know, call it like, you know, cybersecurity, threat detection, things like that to the like personal goals of the prospect, right? Because it might be harder. Like, oh, like, because in sales, right, you're going to make more money, you're going to generate more pipeline. Like how do you weave that through to like what the real benefit will be to them in cybersecurity? Because it's almost like insurance, right? It's like you're selling something that ideally you never think about where you never have to use it, but it's there. So like how do you connect that dot, those dots to them to really see the value in this?

Yeah, I think it's important to first understand their job and folks that just starting out. Like I worked a lot of SDRs in a couple years and when they're just starting out, they don't even know what a security engineer does in their job or an architect. So use Google. Ask Google. What does this person do? Or even read job descriptions of people who are looking for these security architects or product security people. Application security, right? Read the job description and see what are the requirements to become somebody like that. And then you learn what they're actually doing in their job. And then when you go and speak to them, you can ask them about that. And then you ask, you just ask very encouraging questions of open ended, like how do you do this process? And maybe they don't even want to tell you. So then you have to play a little game. You get it? You got to say, oh, you know, I am talking to a lot of people like you. Application security, product security managers usually tell me in your space that this is a challenge for them. Is that the same for you? So like insecurity when you're asking these questions, sometimes they're not going to want to tell you because it's either exposing them somehow or making them vulnerable or they just plain don't want to engage. Right, because they don't trust you. It's a lot about trust. So you gotta give them some info before. Did I answer your question or was it something else?

Yeah, that's exactly what I'm. What I'm looking for there, right? Because it is, it's like, you know, how, how do you keep that process going and connected to them? And again, I hope people are picking up on the trend here. You have to the prospect that's the only way you can apply sales tactics to a new industry is how will it apply to them there in their world, in their role in their space. So, no, this is really, really solid stuff here. So I gotta ask you the last question, right, that I always ask because the name of this podcast is Live Better Sell Better. Because I also have this weird idea, right, if we took better care of ourselves, had more joy, more energy, more fulfillment, all those things, the sales would get better too. What would your live better advice be for people?

Listening Exercise. It's huge. I mean, I was an athlete for 10 years of my life professionally in rhythmic gymnastics and you know, that really like build me up for the drive to exercise and everything like that. But I think it really goes a long way. Whether you're a parent or you're taking care of somebody, you really have to be 100%. And getting that energy from exercise, that's huge. If you're not really into exercising, just try walking. I mean, just try like 15 minute walk outside and breathe some air and take a break. So really like doing, doing for me. I lift weights and I do a lot of yoga and I jump rope. You know, there are a lot of stuff that I'm doing, but you don't have to be that extreme. Like you don't have to run a marathon. Just start with 15 minute walk. What do you do?

If we weren't recording right now, I should have it. I have a treadmill, right? Well, I try to do a lot of things. So, like I follow the acronym. I made this acronym called germs. So GERMS is my acronym for living better and it's for gratitude. Exercise, reading, mindfulness meditation, set my intentions and sleep. Like that's germs for me. And like, if I do that, I tend to live better, which lets me lead better, which lets me sell better. But under my desk, right now if we weren't recording. So I've already done an hour and a half on my walking treadmill today. So I have a treadmill under my desk so I can lift up my, my desk, I fold the treadmill out and I get my steps in while I'm on calls and things like that so I can stay moving because otherwise I'll just sit here all day and work. Yeah, that's no good for anybody.

I'm glad, I'm glad you've mentioned the awesome, Alice, this.

Keep going.

Yeah, I'm glad you mentioned the meditation aspect because that really is rewiring your brain every morning or evening and you know, making, making it a bit easier to deal with everything. So I like that as well. And getting good sleep, obviously, you know that that's a given. You have to do that.

Sale sales are stressful. Leadership is stressful. We got to do things to bring it down and to make sure that we are in a good place. So, Alice, this was, this was amazing. Where can people find more of you? Are you putting out content anywhere? Like, where can people connect with you?

I'm on LinkedIn, Alice. Shaft. So look me up. And love to connect with folks and learn new things and share ideas. Always open to it. Awesome.

Well, I really, really appreciate this because I think these are learnings that people can apply to any industry. But if you really want to break into some of the tougher ones, some of the ones where it's a little bit more technical, I think these are just must do tactics. So, Alex, thank you for the time, the energy engagement today. Really, really appreciate it. I'm sure we'll be in touch again soon.

Thanks, Kevin. I appreciate that. Thanks so much. Thanks for hosting me. Bye, everyone.