Layer 8

Security is fundamentally about people, and everything we know about people is relevant to security. -- B. Schneier

Hallelujah!  A marketer who Gets It!

Also on my list of planned rants was the one about how I’m suffering from vendor fatigue.  I get bombarded with marketing email; I have newsletters that come to me directly and are forwarded by my boss; I read security news sites and security blogs and I go to conferences and I walk by booths and collect literature and I gotta tell ya, it’s all becoming a blur in my tiny mind.  I thought it was just me, but then I came across this marketer who said it even better:

One might assume that large outsourcing contracts that are multiyear, multimillion dollar deals are highly customized and tailored to each individual customer.  This just isn’t the case.  According to META Group (who has now been acquired by Gartner) in 2004 40% of outsourcing buyers could not differentiate the proposals between vendors.  Not on price, product, solution, approach, vision, etc.  This lack of differentiation is growing and expected by some to reach 60% by the beginning of 2007.  Without clear differentiation, these firms went with the provider they liked the best.

I think this is a problem across the board.  Yes, it’s a problem with huge outsourcers, who have often become that way because they developed an effective boilerplate that allowed them to achieve the elusive economies of scale.  (You don’t get that savings by spending time customizing and tailoring.)  But it’s also a problem with the flooded security market in general.

It gets worse when you add this gem, a combination of Mike Rothman and Scott Santucci:

Do Your Value Propositions Go to Eleven?

In Rob Reiner’s 1984 “rockumentary” This Is Spinal Tap, one of the main characters, Nigel Huffens, proclaims they are different than other bands because their speakers “go to 11.”

I cannot help but be reminded of good ole Nigel every time I talk to clients who are working on their value proposition. A few claims I’ve heard over the years:

“We are more scalable”
“We are truly global”
“We are more adaptive”
[we stop zero day threats with proactive protection and zero false positives is a common security claim]

Translation? “These go to eleven.“

The buzzwords are just getting ridiculous in this business.  Here are phrases and claims I’m really getting tired of hearing about:

  • stopping zero-day threats (tell me, exactly how do you do that?  Do you have a time machine and go back to 0-day-minus-1?)
  • risk management (sorry, guys, but it’s true; it’s overused)
  • regulatory compliance
  • leveraging synergies
  • return on investment / increasing value of IT
  • appliances that block spam, viruses, spyware, trojans, malware, worms, zero-day attacks, data loss, P2P, IM, and annoying PCI auditors (I just made that last one up)
  • anything using the word “appliance,“ “gateway,“ “shield,“ or “enterprise” in any way.

Mike and Scott go on:

Don’t laugh. It’s happening in your market too.

[NAC, extrusion prevention, email security - you name it and all of these markets have the same characteristics. Too many vendors, not enough differentiation.]

Why?

Anything you can say on your website, your competitors can say as well.

Let’s say your value proposition is different than anyone else’s and that you do come up with some concepts that resonate with customers as truly unique, and this helps get you traction. How hard is it for your competitors to steal this value proposition, reword it, and use it?

[I know this is true because it happened to me in every marketing job I’ve had. I came up with a cool term (like Early Warning System or Connection Control) and every other vendor talked about their capability to do this within a month. Literally a month. Of course, none of it was real - but it still confused the customer. That means longer sales cycles, etc.]

Not only can any vendor use those words, but the salespeople really don’t know what that MEANS.  Hell, I don’t know what it means.  The only possible differentiation of these products is at such a low technical level that there is no point in my talking to any salespeople at all about it, unless they’re actual sales engineers.  I want someone who can tell me exactly what they do differently so that I can decide whether or not it’s better for me.

As Scott says in his Seven Irrefutable Laws of Customer Centricity:

Customers buy solutions to their business problems, they do not buy products; and
Only a customer can call it a solution.

I’ll finish with another quote from Scott, because he just plain Gets It so well:

  • IT executives consider fewer than 5% of their vendors to be strategic.
  • The typical CIO does not meet with sales people.
  • New efforts are in place to shield IT executives from vendor sales people.
  • The overwhelming majority of IT executives (defined as the CIO or a direct report to a CIO) find sales people annoying and wasteful of their time.

All true.  My CIO generally doesn’t meet with vendors, and certainly not as a result of a cold call.  A couple of bozos have made the mistake of trying to shoehorn their way into a meeting with him by appealing to HIS management up the chain.  Big mistake.  We sat politely and unhelpfully while they made their (lame) spiel, and resolved NEVER to do business with them.  Don’t Be That Guy.

I spend a good portion of my day dodging sales calls from vendors who happen to have gotten my number, and deleting marketing email advertising tons and TONS of webcasts.  (Here’s a clue for you:  I spend my days either doing productive work myself, or helping my team in whatever way I can; I don’t have time to sit endlessly in front of my monitor and listen to webcasts.  I don’t do webcasts at all unless I’ve already decided to look seriously at piloting the product in question.)

Now, how can I get someone like Scott to front for all the good products I might want to look at?  Wouldn’t it be cool to have your own personal reverse-marketer, sort of like a Security Concierge?  grin

Posted by shrdlu on Friday, September 29, 2006
(2) CommentsPermalink blogmarks Favicon del.icio.us Favicon Digg Favicon Fark Favicon Furl Favicon Google Bookmarks Favicon StumbleUpon Favicon Technorati Favicon TailRank Favicon

Next entry: Mini-blogathon.

Previous entry: Rating your pentester.

Comments

LonerVamp United States on 09/29  at  12:47 PM:

Anything using “leverage” or “synergies” makes me giggle in ways I should not giggle at work. It’s true!

I think this relates a bit to your other post on pen-testing. Rather than just getting the scalable, standard response, something more customized, personal, and ultimately, a real solution in your eyes is needed.

On the path of becoming a manager someday, the one thing I really do NOT look forward to is the vendor and sales calls. I already get too many as a staffer, and I HATE them. “Don’t tell me I need that tool. I’ll tell you when your tool meets my needs. Until then, feel free to ping me on product updates if you want, but leave the sales pitches and buddy-buddying energies for other people.“

I think this is one place where consultants (read: experienced experts) will still be bank for years to come. What me, colleagues, and many other IT staffers and management want are real recommendations based on experience, knowledge, and true concern about the target environment. No sales pitch or vendor-led campaign can come close to having a security consultant who’s “been there, done that” say that product ABC will be the solution for X problem.

This is one major reason I watch as many blogs as I do. For those nuggets of, “we used this solution and it sucked” or vice-versa.

I hope you have a relaxing weekend! smile

LonerVamp United States on 10/09  at  12:50 PM:

“It makes a post on the log, or it gets the wand again…“

Page 1 of 1 pages

Add a comment

Name:

Email:

Location:

URL:

Smileys

Remember my personal information

Notify me of follow-up comments?

Submit the word you see below: