Selling Fishing Lures

A wise salesman once said that fishing lures don't need to attract fish in order to be sold: they need to attract fishermen. As someone who grew up in a fishing family I can confirm that lures are often bought based on fisherman enthusiasm alone. Does this selection method lead to endless success in landing fish? No, it does not.

I fear that there is a similar dynamic at work in the cybersecurity market: products tend to fall into one of two categories. The first category consists pieces of technology, marketed to technologists for use by technologist, which makes sense. The second category consists of management consulting services, marketed to executives but aimed at technologist procedures and processes, which doesn't really make sense.

(If you want help with the technical side of cybersecurity, why not go to a specialist firm, such as Pythia Cyber or CI-Discern, instead of a general-purpose management consulting firm?)

Why aren't management consulting firms selling you services which help you manage the people who carry out your cybersecurity program? Because, unlike Pythia Cyber, they have no such services to sell. The fishermen (executives) are comfortable with buying the management consulting firm lures (offerings) and not all that good about making sure that the lures work (that your cybersecurity is better as a result). As a CISO, the good news is that getting buy-in from your fellow executives is easier when the services are marketed to your fellow executives but the bad news is that many of these services are NOT geared toward managing cybersecurity personnel, they are geared toward measuring conformity to industry norms.

This is where Pythia Cyber's talent assessment offerings suddenly make sense: managers and leaders in any department will understand the notion of assessing talent, both internally (promotion or transfer) and externally (vetting candidates). Managers and leaders in any department will understand that reducing the risk associated with staffing is valuable because all managers and leaders face these same issues. Certainly they will understand using talent assessments and associated management consulting which are specific to cybersecurity staffing and management.

Get some management consulting for your cybersecurity group which will actually help you manage your cybersecurity group. Get some real data upon which you can base your staff decisions. Hiring, promoting and grooming technical people in general and cybersecurity people in particular is hard. We can help. Ask us how.