Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

#cisos fail with fear #cybersecurity #leadership

16 Jan 2026 · 1 min

Watch on YouTube

1:20

In this brief YouTube dialogue, two speakers denounce the use of fear, uncertainty, and doubt (FUD) as a sales tactic aimed at CISOs and junior security staff. Speaker A condemns vendors who lead with fear, arguing that such an approach instantly discredits them in the eyes of knowledgeable executives. Speaker B expands on the short‑term effectiveness but long‑term damage of fear‑based pitches: they may generate initial revenue, but repeated scares erode credibility, expose the vendor’s incompetence, and leave the organization stuck in a cycle of unresolved security problems. Both agree that reliance on fear signals a lack of true risk understanding. The recommended alternative is a risk‑based communication style that first articulates concrete risks, explains potential consequences, and then offers clear remediation options, positioning the vendor as a trusted partner rather than a scare‑tactic salesman.

No FUD, no fear, uncertainty, and doubt. This is a story that is relevant. I hate anybody that's selling with, as an executive and every one of the CISOs that you've probably known, if you come at me with fear, I'm immediately dismissing that you know anything what you're talking about.
And I hate it when CISOs go in there and it's normally junior ones and they're using the fear, uncertainty, and doubt. And the reality is it works the first few times. You're going to get a bag of money. But then the expectation is, well, you fix the problem. Security is fixed, right? And no, you're going to keep coming back with more fear, more fear, and they get tired of it very quickly. And then they realize you're just incompetent and you've burned your credibility. So if we have to resort to just fear tactics, it is a sign that we don't understand our risks. We can't explain them. And we can't put together a good perspective that articulates it in a way, yes, there will be fear, but we don't lead with that. We lead with risks. We show consequences. We give options for resolution.
That's it. It's risk-based, man. It's not fear-based.
Yeah.