The Security Expert on ‘How to Sell Security’
Bruce Schneier, the world famous security expert writes about “How to Sell Security”
(This essay originally appeared in CIO).
Isn’t it strange that someone known for his security and threats expertise writes about selling?
Prospect and Utility Theory
His first approach is a mathematical/statistical one: the Prospect Theory, as one could expect from a security expert.
He explains that people have subjective values for gains and losses.
Then he elaborates on Kahneman’s and Tversky’s experiments contradicted Utility Theory.
Good read, about the psychology of the buyer weighing risks and costs based upon tests and probability.
Conclusion is the decision maker having the choice between taking a small sure loss (the investment in the security product), and a large risky loss (damage, hazard).
Selling security
The argumentation concerning the selling comes down to:
How to sell the investment in security, that has to protect the investor against the unknown cost of a risk?
The decision makers and takers need to:
- Understand the risk
- Be able to estimate the costs involved with the hazard
- Understand the method of the solution.
- Be confident with the solution.
- Trust the Vendor and the salesman.
Thus the buyer needs to see the risk and has to be convinced of the effectiveness of the product, solution or service works, without actually ever being capable to test it in real life before buying, still being able to estimate the cost.
The problem is if you invest the money, there is no immediate return as one has to wait for the breach to happen.
Spam filters are of a different kind
This is the reason why spam filters are selling like candy: the CEO immediately sees the effect in his email inbox.
That is an easy sell:
Just install the appliance as a demo and a week later the company can not longer live without it.
Spam filters are security too, but their apparent convenience and benefit puts them in another league.
Selling fear
One solution is to stoke fear. Fear is a primal emotion, far older than our ability to calculate trade-offs.
And when people are truly scared, they’re willing to do almost anything to make that feeling go away; lots of other psychological research supports that.
So fear sells, even for complicated technical solutions.
Maybe fear is in the security market even more important, as the ROI is difficult to understand and hardly to calculate.
Turning the negative into a positive sales
Security is about avoiding a negative, and the salespeople need to turn this into a positive in order to sell their security solution, by
- Using ROI (Return On Investment) models
- Claiming the solution or service will take care of the security
- The buyer can focus on doing his business.
Security expert into Selling
So why is Bruce Schneier writing about selling?
Maybe he found out that selling is the most important part in the business of a company?
Switching career from security to sales? Probably not.





























