Selling Fishing Lures

A wise salesman once said that fishing lures don't need to attract fish in order to be sold: they need to attract fishermen. As someone who grew up in a fishing family I can confirm that lures are often bought based on fisherman enthusiasm alone. Does this selection method lead to endless success in landing fish? No, it does not.

I fear that there is a similar dynamic at work in the cybersecurity market: products tend to be either pieces of technology, aimed at technologists, or management consulting services, aimed at executives. Strangely all of the latter are not actually geared toward managing cybersecurity group members. Instead these products aimed at managers are mostly training programs and procedural recommendations.

(There is a growing segment of technology-oriented consulting firms who are qualified to sell you training and procedures but this slice of the pie is small compared to the slice of the pie commanded by the usual management consulting suspects.)

Why aren't management consulting firms selling you services which help you manage the people who carry out your cybersecurity program? Because they have no such services to sell. The fishermen (executives) are comfortable with their lures (offerings) and not all the good about making sure that the lures work (that your cybersecurity is better as a result). As a CISO is must be a huge relief to know that your colleagues will all happily sign off on spending money on these programs because it is often not so easy to get them to sign off on spending money in other areas.

This is where Pythia Cyber's talent assessment offerings suddenly make sense: the CISO's colleagues will understand the notion of assessing talent, both internally (promotion or transfer) and externally (vetting candidates). These colleagues will understand that reducing the risk associated with staffing is valuable in a way that they might not grasp that spending on network intrusion detection hardware has a solid ROI.

Get some management consulting for your cybersecurity group which will actually help you manage your cybersecurity group. Get some real data on which to base your staff decisions. Hiring, promoting and grooming technical people in general and cybersecurity people in particular is hard. We can help. Ask us how.