An Information Security Place

I went out to see one of our customers this week who had their web app pwned a while back.  This is the second client since I have been with Accuvant that we were trying to help via our security assessment services who got smacked around before they could make up their mind to spend the money or not.  It has been several weeks since they were attacked, and they are still running around like school girls with their hair on fire. 

Yes, they are making a lot of progress (much of it due to us having a couple of guys helping them out for the last 4 weeks).  But the point is that they could have avoided all this craziness and stress if they would have made the right choice in the first place.  Like I have said in the past, business decisions have to be made.  But when you are a financial company that serves a lot of customers, you need to make sure due diligence is performed.  Sitting on your hands is not an option.

Vet

I had a discussion the other day with one of the sales guys I support.  His contention is that it is the sales person / account manager that matters most in the customer relationship.  Basically, SE’s come and go, but the important thing is if the AM stays the same.  They are responsible for the relationship.

While I tend to agree with that, I also know that when I was in the trenches, I was particularly interested in the engineer because I needed to know that he / she could provide a sound solution and back it up with support (or get the support I needed).  The AM was good for lunch, and there was the occasional AM that was fairly technical.  But on the whole, I had problems if an engineer quit one my VARs because I would essentially have to retrain the new VAR so they were knowledgeable about my environment.

So what do you think?  Answer the poll on the right bar if you get a second.  And I consider this poll entirely scientifically accurate, by the way.

Vet

I have worked for three consultant / VAR types over my career, but I have never been pure pre-sales until this job.  And because of that, I am always working very close to the sales people and even our regional director of sales.  So I am getting very familiar with the end-of-month / quarter / year sales dash that happens.  But up to this point, I have never been close to our VP of Sales during this time.  Well, today I get to be in the same room as one of our sales guys, our regional director, AND our Eastern VP of Sales.  And I have never laughed so hard (internally) in my life.

Calling sales people, telling them to go smack our customers and get them sign PO’s.  What’s our number now?  Hey, just got another one for $7000 in GP!!  WOO HOO!!  Bob just got a last minute deal!  Add another $3500 in GP!  Damn, Susie’s account just pushed to next month!  That sucks!

I swear, it is like being in a cat herding contest!

Of course, it is instructive for me as well.  I have never been this close to the sales side of the house, so I need to soak this up so I can use it later in whatever job I end up in.  If I ever go back to the trenches, I will definitely have more ammo to get better deals.

Vet

One of the biggest things I have learned since I have been in IT is that you have to develop the skill of managing customer expectations (to clarify, the term “customer” means the people for whom you are doing your job - clients, users, etc.).  If your customer believes you can perform a service that you cannot, then you have not done a good job in managing expectations, and you will likely end up dissapointing him and hurting the professional relationship. 

From the sales POV, if a customer believes that a certain product can perform functions that it cannot, then the customer’s expectations have not been managed.  The customer has to know what a product is capable of and how it will fit and perform in his network.  If this is not fully explained, then the sale can turn into a disaster.

This is a hard thing to do when it comes to sales since customers often do research when looking into a solution, and the marketing departments of companies typically make it sound like their product can cure world hunger and make you a sandwich at the same time it is keeping your network totally secure (and it does all that in a nice little 1U appliance that takes five minutes to install and configure).  And whether we like it or not, customers will often believe the claims because they want the claims to be true.  They need a widget that will cure their ills, and many are short-sighted enough to try to find that widget.

So as the sales person and sales engineer (often the same person), it is imperative that the expectations for a product are managed up front.  If the customer calls you in and says that the brochure for XYZ Security Widget says that it can perform a certain function, you have to be able to explain if the claim is true or not.  You have to make it clear that often case studies are done in pristine situations.  And you also have to clarify that the “setup” of the widget (yes, the one that takes only five minutes) in a network often means that it was simply screwed into a rack, plugged into the network, and assigned an IP address.  There is usually little to no configuration done on the widget, and it is absolutely worthless in this state.  You have to enlighten the naïve customer by telling him that trade rag product reviews are often rigged (it sucks, but it is true).  You have to do all of this because you want to maintain the customer as a customer.

You also have to elucidate and educate because you will be trying to sell professional services to install the widget for the customer, and they are going to balk big time when your statement of work says 40 hours instead of five minutes.  And they are going to balk again when you try to sell a training class that takes 4 days and costs $2000 a head.

So if you want to keep your customers, manage their expectations.  Make sure they know what the real deal.  You will help them avoid many unpleasent situations (also, be sure to let them know, in a non-braggy way, what unpleasant situations you helped them avoid - they will appreciate it more).

Vet

[ev type="youtube" data="0OTgb3KO7QM"][/ev]

Well, I am back from our annual sales kickoff meeting. The week was rough, but the content was great, especially the last day (we had a three of our top SE’s teaching our processes and how to be a more effective SE - the sales people were in there as well, so they got a good idea of what we have to deal with). I am more jazzed up now about working for Accuvant. The people I met were great. Everyone is stoked about 2007. I am convinced more than ever that this was a good move for me.

I know. Everyone is highly motivated by these meetings, and it will probably wear off. I agree to a point, but what you have to understand is that I have never worked anywhere that I felt like a part of something good. This is the first company that I am proud of being a part. It is a good feeling. Maybe that’s a little cheesy, but that’s the way I feel.

It was held at Copper Mountain in Colorado. Very nice location, but we never had any time to get out and enjoy it since we were in meetings the whole time. Oh well.

I could barely breath up there. I think it is somewhere around 9,500 feet where we were staying. Since I live in Houston, which is about 6′ about sea level, I was completely unprepared for the thin air. I had a headache the whole first day and was gasping for air all night when I was trying to sleep. That REALLY sucked. I got about an hour of sleep that night.

I got used to it the next day, but I was so friggin’ tired that I still don’t remember much of the day. I slept like a baby the second and third night, and I was fine just walking around. Next time I will be taking as much of this advice as I can.

Vet

A while back, when I was in the operations side of security, I wrote a series about how to be a good security admin / manager.  It was fairly successful and got some good play out there in the blogosphere, so I figured that I would write something akin to those posts in a blatant attempt to drive more traffic to my site. 

Oh yeah, and I, ummm, want to make a difference in the security industry, or something… whatever.

So, how to be a good SE.  First, let’s define the term “SE”.  In many to most cases, that term means System Engineer.  In my case, it means Security Engineer.  Both perform the same function, however.  At least they do in what I am referring to here, and that is in their pre-sales role.

A pre-sales SE is often perceived as the salesperson’s lapdog, to be ordered around and told where to go and when to be there.  This may be the perception, but it is almost always not the case.  The real truth is that the SE is the one who follows the salesperson around and makes sure the salesperson is telling the customer the truth.  For example: “No, Bob, this product cannot call down lightening and destroy hackers attempting to break in to the website.” 

If you can’t tell, I have been reading “The Dilbert Principle”.

But in all seriousness, the reality is that the SE’s number one job is to protect the customer from making mistakes and buying the wrong product for their needs.  That is also the salesperson’s job.  And though I can say with all seriousness and honesty that all of the salespeople I have met at Accuvant truly are honest and try to protect their customers, this is not always the case out there.  A salesperson has a quota, and they have pressure to meet that quota, and they don’t always have their customer’s best interests in mind.  So the SE has to be that buffer.  And when an SE meets with customers, he is EXPECTED to be that buffer that the technical people at the customer need.

In case you didn’t get that, I’ll type it again.  The SE is EXPECTED to be the buffer.  That means that the SE is expected to be honest in his appraisal of the situation.  He is looked at as the guy who works for a living, just like the technical people in the trenches.  He is supposed to be the guy who knows what the technical people are going through day after day, dealing with users, management, etc.  Even if the SE has never held a true operations type job, he still will be perceived as such.  That perception is what garners trust in the SE, and that trust CANNOT be broken.

What many people may not know is that pre-sales SE’s typically get bonused on sales (they don’t get the same compensation as salespeople, but they do not have as much at stake either).  And just like salespeople, SE’s with VAR’s (like me) are often approached by manufacturers with incentives to push their product (these are often very good - money, electronics, etc.).  This is called a spiff.  These two things together can cause serious temptation for the SE to not make the customer’s needs the number one concern.

But if you are and SE, or are considering a move to this type of position, you MUST be able to resist this type of temptation.  Notice that I am not saying it is wrong to accept these types of rewards (most of the time, you cannot take an SE job without the bonus, and I would personally think you are a little crazy if you didn’t take it - and taking a spiff is not wrong if you made an honest sale and kept the customer’s need on the forefront).  But you must be able to look long term.  The desire for an immediate reward must be superseded by the customer’s needs. 

And when the SE does resist the immediate gratification, he will almost always see a long-term return that comes from a relationship with the customer because that customer knows he can trust the SE.  It is often the case that once a relationship is established with a customer, the SE is the person who is contacted most.  That is because the SE has direct knowledge and contacts with people who can solve the customer’s problems.  So creating that bond of trust will lead to dividends for the SE’s employeer, and the SE as well.

So all that in a nutshell is this: create REAL trust with the customer by keeping his / her needs first.  You may have to wait a little longer for your reward, but it will be a greater reward after all is said and done. And just so you know, I do not mean only monetary reward.  The reward of being trusted and held in high esteem is also a reward, and it can be more valuable than any earthly possession.

Vet

In my previous stint for a reseller, I was in the trenches doing implementations with very little pre-sales work.  But now, in an almost pure pre-sales engineering role, I get the benefit of seeing things from a reseller’s point of view and the manufacturer’s point of view.  Instead of having my head down letting all the sales people play their games, I get to be right in there with ‘em.  And I am getting to see a world that I have never seen.

I knew there were a lot of things about the IT and security world that I did not know.  I know there still are.  But the distinctions I find between the end-user world (security and IT management) and the reseller and manufacturer world are spectacular.  And to be honest, even though the differences are obvious, it is hard to put a finger on it.  Really defining it is difficult.

I guess it may come down to the basic pressures of the job being different.  A security or IT manager has day-to-day pressures of taking care of a network and the staff that runs it.  A sales person (even a sales engineer) does not have that constant pressure.  So the intensity in the look just doesn’t seem to be there.  Yes, the sales folks have to meet quota, but that’s not a constant, daily driving force.  Deals usually come in bits and spurts.  Thought the sales person always wants that next deal, the over-arching responsibility of a day-to-day operation is not there, and it shows.  Even the sales engineer, who many times has been in the shoes of a security or IT manager or admin and has dealt with those pressures, knows that the anxiety of operations is not there, and it shows there as well.

I know I will learn more differences over the coming months as I get used to the job.  And I know that I will not be able to share some of those differences (I can’t give away all the secrets - my boss reads my blog sometimes).  But if I ever do get back into security management, I know the knowledge will serve me well.  Not that I plan on leaving any time soon.  This is too much fun!