Sales Strategies for Cybersecurity with Alice Shaaf

What up, everybody? Welcome to another episode of the live Better Sell Better podcast. This is your host, Kevin Dorsey, AKA kd, and we are going to dive into cyber security today because what you see on LinkedIn so often can be an absolute echo chamber of salespeople talking about how to sell to salespeople and salespeople talking about how to build a brand for salespeople. And yes, it sounds great and it's great, and you're getting a side hustle and all these things, but how does it apply to cybersecurity? How does it apply to a super technical buyer? How does it apply to a buyer and a prospect that is inherently distrusting? They're not going to click on links. They know that you don't know their world and everything around it. So that is why I'm so excited. I have Alice Schaff with me on the show today because she's made that week from selling into sales, into marketing, marketing and education, into cyber security now taking what she's learned and adapting it to a new industry in a new market. And she's going to be breaking down what she's learned, some of the differences and everything else today. Alice, welcome to the show.

Thanks so much, Kevin. I appreciate that. Lovely to meet you.

I'm, I'm pumped for this. So let's actually start this off with just that first, I'll call it aha moment. Like, when did you, when did it hit you that cybersecurity was a little bit different? Like, what was like the light bulb moment of like, oh, I'm gonna have to adapt here. I'm gonna have to change a little bit. Like, what kind of, like, happened to kind of make that switch go?

Well, I was working for, for Google Cloud through an acquisition with Looker Data analytics. And I, I was, you know, it was Covid. I was a bit. Excited to move into a new industry. I really wanted to discover, like, what, what, what's the next step for me? And I thought, okay, well, cybersecurity is the way to go. Everybody talks about it. That's, you know, that's always going to be needed, especially, you know, Covid hit and everything like that. Folks moved online. So I decided to take a new challenge and I joined a small startup that was focusing on cybersecurity back then. It was three years ago. And then, you know, I started prospecting and folks are, or just either not responding or, you know, negatively rejecting the information that I'm sending or even, you know, like, just hang up the phone. And I wasn't used to it from data analytics, like folks always want to talk to me. So I discovered that, you know, they're just afraid of strangers because stranger. And especially if you're emailing them out of the blue, they're not gonna click on any links, they're not going to give you the time of day. Like they don't know you. So they're afraid of getting breached. That's their job, basically.

So then how. This is a two part question, right? Because one, this is a brand new industry, it's a brand new Persona, it's a brand new prospect. What did you do to get up to speed? Like, what did you do to start to learn their language, start to learn their problems, what they care about? Like, how did you get up to speed on, on this industry? And then we'll talk about some of the tactics you've used to start to crack in, like, how did you learn their language, their ideas, what they care about? All of those things in a new industry.

Yeah. So I think with every new industry, and not even cyber, you gotta be where your audience is. So the places they're hanging out in is where you have to be, whether it's LinkedIn and the forums and you know, the conferences they go to, you're just gonna have to interview these folks and treat it more of like, I want to learn from you because you're the, you're basically God, you're the big Expert. You have 20 years of experience working at this one company doing security. So who am I going to tell you that my little startup is going to revolutionize everything you're doing? Right. So it's more about learning from your audience as opposed to trying to educate them your way and being very humble.

Yeah, I think that's the key. Where I see a lot of sellers and sales leaders fail in new markets is they don't go in with humility. They don't go in trying to learn. They try to go in as like, all right, I've done this before. Let me execute my playbook versus going in and learning, right? Like, it's one thing when I look at my career that I've been very proud, proud of is all of my teams have been in different industries, every single. There's no overlap in any of the teams that I've built. I've always had to learn a new one. And I really try to go in that way and going, okay, what do.

I need to learn?

What do I need to understand about this industry, about this prospect, about what they care about and everything else, and I just love that. Let's double tap on that. How do you, how do you get that time of day with them? Right? Like, were you reaching out on to customers? Were you reaching out on LinkedIn? Like, how did you actually set up some of these conversations to start the learning process?

Yeah, So I think LinkedIn is, is huge, especially these days. And because they added this feature where you could mark your, your profile as valid, like add an ID or add your information as an employee. So that makes you credible and that, that shows other people that you're a real person and you're not some kind of hacker that's trying to steal their information and attack them. And, and you know, social, social hacking, social engineering, phishing, that's usually how these companies are getting attacked. So like through an email, through LinkedIn, through LinkedIn, clicking in. So it's always going to be, they're always going to be mindful of who they're connecting with. So making sure to show them that you're a real person, that's gonna, that's gonna really help as well as going to conferences, like just going in person and meeting these people, introducing yourself, just, you know, shaking hands and not being scared to, to talk to strangers. I think that, that would, that would definitely set you aside. I mean, sometimes I'm watching enterprise salespeople who are just hanging about and sitting at the booth and waiting for folks to come to them. Unfortunately, that's not the way it works. You know, you really find the best people by going outbound, by looking. You know, when, usually when I'm in a room full of people, I'm like, okay, well who should I talk to? And I'm looking at the folks that look a bit more experienced that, you know, that maybe are not as usually the security people are. They don't, you know, wear suits. They're not like all, all polished and everything. So they have a look to them and usually you get to, to recognize them and they're not, they're not the ones that everybody goes to usually. So, you know, you could, you could really see who's, who's who. And then if you're in a group, you can definitely, you know, see who decision makers are because they're usually like more calm, like laid back, like they're not, they're trying not to get a point approach.

Yeah, you can tell they carry themselves in a certain way. And what I love about this is like, I think people, sellers and companies, especially early stage companies, do not leverage events enough. It's like they think that they're just a lead gen platform and you have to get a booth. It's like you have to be where you're pro. That's the best place to learn because you can ask questions and you can hear the questions they ask. What are the sessions like? One of my favorites is like, what sessions are, are the most filled. Those are topics they care about. All right, that helps me understand, right? Like where I need to focus. And yeah, there's nothing better than like sitting at a table and like talking and listening and asking questions. And so, so I love that. Now let's switch it then to. Then how do we actually start to apply this in the sales process? Because to your point, their whole job is to like question Every piece of outreach they ever get, right? Is to make sure nothing unknown gets in. Nothing can fish, no one can trick somebody. And so often it's like almost the harder you try to prove you're a human, the more suspicious it feels, right? Whereas like, oh, like I'm a real person or whatever else. And they're like, no, that's even worse. So like, how do you do that? How do you actually then build the trust when you're reaching out to these people through channels that they inherently distrust? Like, how do you start to build that pipeline up when they're not maybe going to click on a link or they aren't going to open their email? They've got firewalls preventing you from getting in. How, how do you do it?

Well, I think leveraging the technical folks at your organization. Like, for example, I work closely with our cto, Dmitry Reidman. You know, he's the founder, he developed the product and really like leveraging his network and the name that he's built for himself. He's been working in SBOM software, Bill of Materials, since 2018. So he knows a lot of people. And just like using, using this knowledge and using his network, that, that, that really makes me credible. Right? So if you're in sales and whether it's a small company or a large one, and you use your technical experts and their network and even use the executive's network, that's really going to help and move the needle. And we also have an advisory board, so using these folks and using the names of the people who are credible in your space, that makes you look like you know what you're talking about. And even going to their LinkedIn, like usually what I do, I would go to, I'm telling you a lot of secrets here, but I would go to their LinkedIn and I would look, look at their connections and I would immediately see like who I should be talking to. And I even like in my connect request I would put like hey, I noticed you're connected with so and so like our advisor. Right. So you're probably following them and, and I don't know if you guys are personal friends or whatever. I'd love to stay in touch and then you know, you get, you get going from there. Leverage your network.

I think that is huge, especially when you get into I'll technical markets is they want to talk to people like them.

Yeah.

And it is very rare that a salesperson is like them. Right. Unless you can somehow convert a cybersecurity professional to come to the dark side of sales. It's really hard. There's not a lot of sellers that have cybersecurity experience, you know. So to leverage that network I think is key. And I'll throw this out to people listening like this never stops. Because then your customers network is the network you start to work through. Right. Of like building out that referral network and interest because eventually like maybe your cto, your co founders networks run dry. But then every new customer is an opportunity for new access to network. And so how have you leveraged that at all yet where it's like with customers leveraging their networks for introductions or referrals or things like that.

Yes. But that's another thing that you have to adjust in cybersecurity. So I'm a huge fan of using your customers as your advocates. Right. But sometimes, and you know, often we have some public customers like Schneider Electric that are not shying away from announcing that they're using SBOM Studio with, with Cybeats and everything like that. But there are customers that I can't even say their name because they don't want to be recognized as using our software because it's sensitive, you know that they don't want adapters and bad actors to know what they're using.

No, it's finding the ones that will. That's one. But the second area that I'll focus is I build a lot of this into pricing negotiations where if they want a discount, I'm asking for referrals whether it's public or private where it's like, all right, maybe we're never announcing it, but I'll knock 10%, 15% off if you'd be willing to make 10 introductions over the next 120 days. Right. So I build it into the pricing negotiation of like all right, you don't have to do it publicly, but could we do it here? And because that referral. Right. Is well worth the 10, 15% discount. Well worth. Right. Like I will. Like this is something I know I have a different stance on. I am a very, very proactive discounter. Right. Because it's an opportunity to get something. I don't just want the deal. I would sell a deal at 15% off all day if that meant I got 15 introductions all day, zero hesitation. And so I'm very proactive with that. And what happens with this is once you get it cranking, when 30 to 35% of your new customers came from referrals, they are very open to referring because they were referred in. And so they already know people trust it. So then it starts to create a flywheel. So that's the other tactic I'll use. I build it into the pricing negotiation because they're going to negotiate, you know it. So why not get something from it? So that's the other part that I really try to leverage.

Yeah, I mean, I think that's something that I'm definitely gonna use moving forward. So thanks for that. It's a good tip.

So then let's talk about now. Cause how big is the team right now? Or are you running this solo?

Right now it's me, but I'm gonna hire in the new year, probably four people.

So what's your plan to get the team up to speed on this? Cause it's one thing for you to be able to do it. How are you thinking about onboarding these new reps to get them up to speed on cybersecurity? What you've learned, the ins and outs of of it.

Right.

Like kind of. What's that game plan looking like?

Yeah, so I think, you know, the folks that I'm going to hire, they, they would have to have at least one year experience selling into cyber security. Because otherwise it's not something that you could teach. You have to live it. Recognizing the fact that folks are 20 years experts in this specific area and you are not like you gotta have at least one year dealing with all these rejection. And you know, folks are ghosting you and not wanting to talk to you. And you know, cybersecurity, it's even worse, especially if you're selling to it. For example, like we're selling to product security, which is a bit easier than selling to it because IT people, they just don't answer phone calls, they don't get on the phone, they don't want to talk to anyone.

Right.

So I mean and the engineers is the same thing. It's, it's, it's difficult. And then having that experience, that would be good so that the profile of the people that I'm going to hire, they're going to be folks that people want to talk to and it could be about anything in the world. Like if you can talk to me about sports for five minutes or if you can talk to me about your travels, or if you could talk to me about cooking or whatever, whatever you're interested in. I have to be somebody that can talk for a little bit about a lot, right. So like I need to be interesting. And these folks that are dealing with security, it's not their entire life like they're doing that, that's great for their job. But you could talk to them of other stuff and you can build their relationship like that. Like for example, I have a couple CISOs, chief security officers who are my personal friends already because we meet each other, we go to events together and you know, it's kind of like a closed, closed group where you meet these people again and again. So you become kind of friendly and they, you know, they ask about my family, they ask about my trips and it becomes like more of a trust based relationship that's more of a fun and not just work related. So really like being that person that would be communicative and wanting to maintain friendships for a long time, I think that that would be good. And that's hard to teach. So when you're asking me about my plan, what I'm going to teach them, first of all I'm going to hire based on this profile, right? And then when, when I'm working right now, I really summarize everything in notes. So like, so they have some materials to fall back on, right? So everything is written down. Because when I came in cybeats day, they have a lot of written material and everything like that, but it's not digested into sales. So it's more of like documentation and you know, for security folks, right. So like making it applicable to people that don't understand anything and even writing a little bit about like metaphors and how it would, how it would look like in terms of if we are talking about something else that's not specifically security, right. Like comparing it to something else that usually would work in visualizing like taking a lot of videos and showing that really would help.

Yeah, I was gonna say big, big tip. I was like record everything, every one of your demos, every one of your follow up calls, record all of it. If they let you. I know. Also in cybersecurity, sometimes they're like, no, you don't even get to record, like, the calls. But then you have all of that to really work on with the new ones. And you covered one of my favorite event topics. I don't know if people caught it or not. Going to an event with a customer is a gold mine. Right. And funny enough, I had never thought about this until one of my reps at Patient Pop. Liz Lee, shout out. Liz Lee, love you. She did this. She would, like, get in. She got invited to events from some of her customers, and she went to a couple and then they were just introducing her to everybody. Oh, yeah, this is Liz. Like, you know, she helped me with my website like it was a gold mine. And so now anytime we go to event, we're like, who could we bring? Who could we bring that this would be actually a fun event for them. They'd enjoy it. But now we've got that CISO next to us. Now we've got that CFO next to us. Just making introductions and everything. That was one of my favorite event tactics. I wanted to make sure people caught that because that's a really, really good move to make there.

Yes. And in fact, even before I came in, our CTO went with, with our customer to an event, and that's how they got their second largest customer. So I'm definitely leveraging that and I'm glad you've mentioned that. And double click on it, like, always, always be in touch with your customers on LinkedIn, because even if they don't invite you, you could see which events they're they're speaking at and you could just go there. Like, you don't have to get invited.

It's like, all right, what is. We'll just open the, the whole chest here for a second. Because what, like, instead of buying a booth at a lot of events, what many companies would be way better off doing is taking that 15, $20,000, paying for three or four of their customers to show up, and then throwing a really great dinner or like a small setting event that each of them can invite four to five people to. You will get more interactions, more out of your dollar, more everything, as opposed to dropping $25,000 on the booth for that SDR to stand there and hope people come by, pay for three of your customers, throw an amazing dinner at like a steakhouse or whatever else and have them invite other attendees. Game over.

That's.

That's the move right there. Yeah.

I think if you're low budget, I would say leveraging a large conference. Like for example, we have RSA in San Francisco for cyber security. So we, we are hosting the, the a meetup over there for folks who are working specifically on S Bonds. So, you know, really attracting people by knowledge sharing. And also like, you don't have to pay for their tickets because everybody's coming in anyway. Right. So catch them by asking them to present something or perhaps you know, making it like a fun dinner like you described. But yeah, sometimes you don't have to pay for customers to come. They're already there.

I love that. So now let's keep going down. Right? So we've been talking a little bit like pipeline generation. Let's actually now get into the sales process because I think this is also a place that a lot of people miss is cybersecurity. People don't want to talk to salespeople like even once they're in the sales process. Like once they're in a super technical. Like, like even that sales process can be challenging. So like, how do you weave this through all the way to close? Right. It's one thing to get their attention, but now that you're in the sales process, how do you continue to engage, build rapport and eventually, you know, drive it to, to close with Again, there's a lot of distrust. There's a lot of hesitancy to do things. So how do you then continue the sales process throughout this?

So I think the rapport is really important because when people buy, they usually buy from people they like. And how you become likable is if you become interested in what they're doing. And it doesn't have to be about cybersecurity. It can be about their children, about their vacation, it can be anything. So when you're asking more of like these personal questions of and getting to know somebody on a personal level that, that can really help your, your way into a deal and you know, getting introduced and getting all the, all the good stuff that you want to, you want to get into when you're, you know, doing discovery and when you're negotiating and meeting other stakeholders. Right? So like really build up that relationship with your champion and then the decision maker as well and make it personal because nobody wants to talk to sales. That's true. And also this year I actually decided I'm going to take classes to, to better myself in cyber security. So I'm taking the IS C2 certification. And you know, first I wanted to, to do the cissp, which is, you know, that's a. That's a huge leap. But I'm probably gonna start smaller and do the cc, which is like the beginner. The beginner one. And that would make me credible to talk to them because I'm gonna know what. What they know, right? Like, it's not like. It's not like some kind of secret. You can really become an expert in something if you take a class and you learn it.

Oh, man. All right, so I give you a little bonus one here, too. If you're going through a certification, one of the best notes you can send to, like, prospects is, I'm going through this. Any tips?

And I do it a lot.

It's just such a light touch to make. But if there's people like, hey, I'm preparing, like, I'm doing this. Any advice for me as I do this? As it, like, is like, people love to share that advice and such. Such a easy piece of outreach, such an easy way to get a conversation going. So I love that. I think I heard you say you're already doing that. So you're like, you're going through, and then you're reaching out to prospects and letting them know. So then as we kind of start to wrap this up, right, so we've talked about learning, which I hope people are understanding of. Like, you have immersed yourself in the prospects world. You have interviewed customers, you've interviewed prospects. You're getting your own certification, right, within this process, which I think is gold. And then you are working very, very closely on the person side of it. I think a question that I'll bring up is, you know, in sales, right, we tell people all the time, it's like, all right, there's the rational, you know, logical side and there's the emotional side, right? Like, how do you connect, you know, call it like, you know, cybersecurity, threat detection, things like that, to the, like, personal goals of the prospect, right? Because it might be harder to, like, oh, like, because in sales, right, you're going to make more money, you're going to generate more pipeline. Like, how do you weave that through to, like, what the real benefit will be to them in cybersecurity? Because it's almost like insurance, right? It's like you're selling something that ideally you never think about, where you never have to use it, but it's there. So, like, how do you connect that dot those dots to them to really see the value in this?

Yeah, I think it's important to first understand their job. And folks that just starting out, like, I worked a lot of SDRs in a couple years. And when they're just starting out, they don't even know what a security engineer does in their job or an architect. So use Google, ask Google what does this person do. Or even read job descriptions of people who are looking for these security architects or product security people. Application security. Right, ready job description and see what are the requirements to become somebody like that. And then you learn what they're actually doing in their job. And then when you go and speak to them, you can ask them about that. And then you ask, you just ask very encouraging questions of open ended like how do you do this process? And maybe they don't even want to tell you. So then you have to play a little game. You get it? You got to say, oh, you know, I am talking to a lot of people like you. Application security, product security managers usually tell me in your space that this is a challenge for them. Is that the same for you? So like insecurity when you're asking these questions, sometimes they're not going to want to tell you because it's either exposing them somehow or making them vulnerable or they're just plain don't want to engage. Right. Because they don't trust you. A lot about trust. So you got to give them some info before.

Yeah, that's exactly what I'm, what I'm looking for there, right? Because it is, it's like, you know, how, how do you keep that process going and connected to them? And again, I hope people are picking up on the trend here. You have to understand the prospect. That's the only way you can apply sales tactics to a new industry is how will it apply to them there in their world, in their role in their space. So no, this is really, really solid stuff here. So I gotta ask you the last question, right. That I always ask because the name of this podcast is Live Better, Sell Better. Cause I also have this weird idea, right? If we took better care of ourselves, had more joy, more energy, more fulfillment, all those things, the sales would get better too. What would your live better advice be.

For people listening exercise? It's huge. I mean I was an athlete for 10 years of my life professionally in rhythmic gymnastics and you know, that really like build me up for the drive to exercise and everything like that. But I think, I think it really goes a long way. Whether you're a parent or you're taking care of somebody, you really have to be 100% and getting that energy from exercise, that's huge. If you're not really into exercising Just try walking. I mean just try like 15 minute walk outside and breathe some air and take a break. So really like doing, doing for me. I, I lift weights and I do a lot of yoga and I jump rope. You know, there are a lot of stuff that I'm doing, but you don't have to be that extreme. Like you don't have to run a marathon. Just start with 15 minute walk.

I have a treadmill. Right. Well, I try to do a lot of things. So like I follow the acronym. I made this acronym called germs. So GERMS is my acronym for living better and it's for gratitude, exercise, reading, mindfulness meditation, set my intentions and sleep. Like that's germs for me. And like if I do that, I tend to live better, which lets me lead better, which lets me sell better. But under my desk right now, if we weren't recording. So I've already done an hour and a half on my walking treadmill today. So I have a treadmill under my desk so I can lift up my, my desk. I fold the treadmill out and I get my steps in while I'm on calls and things like that so I can stay moving because otherwise I'll just sit here all day and work. Yeah, that's no good for anybody.

Yeah, I'm glad you mentioned the meditation aspect because that really is rewiring your brain every morning or evening and you know, making, making it a bit easier to deal with everything. So I like that as well. And getting good sleep, obviously you know that that's a given. You have to do that.

Sales are stressful. Leadership is stressful. We gotta do things to bring it down and to make sure that we are in a good place. So Alice, this was, this was amazing. Where can people find more of you? Are you putting out content anywhere? Like where can people connect with you?

I'm on LinkedIn, Alice. Shaft. So look me up. And love to connect with folks and learn new things and share ideas. Always open to it.

Well, I really, really appreciate this because I think these are learnings that people can apply to any industry. But if you really want to break into some of the tougher ones, some of the ones where it's a little bit more technical, I think these are just must do tactics. So Alice, thank you for the time, the energy engagement today, really, really appreciate it. I'm sure we'll be in touch again soon.