Selling to a CISO Without the FUD: The Cybersecurity Discovery Meeting — a 60-Minute Sales Training

⚔ The Pulse Training

Who this is for: Cybersecurity sales reps running CISO discovery — AEs at CrowdStrike, SentinelOne, Palo Alto Networks, Microsoft Security, Wiz, Zscaler, Splunk, Okta, CyberArk, SailPoint, Tenable, Rapid7, Qualys, Arctic Wolf, Expel, Red Canary, Mandiant, Recorded Future, Snyk, BitSight, SecurityScorecard, Panorays, Black Kite, OneTrust, Vanta, Drata, AuditBoard; field reps at MDR / MSSP / VAR partners; specialist sellers at CNAPP, SSPM, DSPM, CDR, identity, SIEM, EDR/XDR, TPRM, GRC vendors.

Works from 2nd-year AE chasing a first six-figure logo to the strategic rep on a $5M ELA renegotiation. Works for prospects in financial services, healthcare + payer, retail, manufacturing + OT, SaaS / tech, public sector / federal, utilities, higher-ed. The CISO Discovery Meeting is the single hardest 60 minutes in B2B sales — the buyer was pitched by 11 vendors this quarter, sits on three competing CISO Slack groups, and ends 6 of 10 meetings with *"send me a deck"* (translation: never speaking to you again).

Drop into the next QBR or kickoff and run it live.

What your reps will leave with: A named, repeatable discipline — 5-STAGE RISK-FRAMED DISCOVERY (CONTEXT → CONTROL MAP → CONSEQUENCE → CADENCE → COMMITMENT) + THREE CISO LANGUAGES (BOARD / AUDITOR / OPERATOR) — for converting a CISO from cold-discovery to a scoped POC without a FUD slide, a competitor-breach name-drop, or a "97% of breaches" stat.

Plus verbatim language for each stage + Language, two live role-plays (mid-market CISO with budget cut + tool fatigue / enterprise bank CISO under OCC + NYDFS), a written commitment naming one stalled opportunity, and a printable one-pager.

What the sales manager / RVP should bring: (1) 3 recent lost-or-stalled CISO opportunities — the *"send me a deck"* ghosts, the procurement-bounced deals at week 8, the *"good enough incumbent"* losses. Reps will see themselves in Section 3. (2) Current discovery deck + security-questionnaire response library + printed SIG Lite + latest NIST CSF 2.0 mapping the SE team published.

(3) A whiteboard to score each rep's stalled CISO opportunity by which stage of the 5-STAGE collapsed + which Language they never spoke.

MEETING AGENDA -- 60 MINUTES

🎯 Bottom Line

A CISO does not buy fear. A CISO buys a defensible line item on a one-page risk register. Per Gartner 2025, global cybersecurity spend hits ~$215B — yet per (ISC)² 2024 the workforce is short 4M+ roles and most CISOs run 47-83 overlapping tools they cannot fully staff.

The CISO is not under-spending; she is over-tooled, under-staffed, and FUD-exhausted. The rep who runs 5-STAGE RISK-FRAMED DISCOVERY — CONTEXT, CONTROL MAP, CONSEQUENCE, CADENCE, COMMITMENT — and speaks BOARD + AUDITOR + OPERATOR in the same hour earns a scoped POC. The rep who opens with a Mandiant breach name-drop, a Verizon DBIR pull-quote, and a "97% of breaches involve..." headline gets the *"send me a deck"* exit at minute 14.

Five stages. Three languages. The risk register before the threat actor.

Always.

SECTION 1 -- THE COLD OPEN (0:00-0:05)

🟡 Coach Note

Do not open the corporate "Threat Landscape 2025" deck. Do not pull up the Verizon DBIR pie chart. Walk into the sales meeting, say the numbers, tell the story. The first 90 seconds set whether reps tune out or remember this on the next CISO call. Five minutes. Hard stop at 0:05.

The numbers, then the story.

The numbers. Per Gartner 2025: global cybersecurity spend ~$215B, ~15% YoY growth. Per (ISC)² 2024: ~5.5M working cybersecurity professionals globally, ~4M+ unfilled roles, 67% of CISOs cite staff shortage as #1 constraint. Per IBM 2024: $4.88M global avg breach, $9.36M US healthcare, 204 days median time to identify.

The CISO is over-tooled, under-staffed, and FUD-exhausted. Constraint is rep discovery discipline, not threat landscape.

The rep-side: top-quartile cybersecurity AEs convert CISO first-meetings to scoped POC at 32-44%; median sits at 9-15%. The difference is not pedigree or quota — it is whether the rep spent the first 20 minutes on the CISO's risk register or 8 minutes on the vendor's threat-landscape pie chart.

Math: 6 CISO discoveries/month at 11% POC conversion × $120K ACV = ~$95K/month pipeline. At 38%: ~$330K/month = 3.5x. One hour, right sequence.

The story. (Composite — swap in a deal the team recognizes.)

Daniel, 4-yr AE at a SIEM vendor. $400K ACV opportunity, mid-market e-comm CISO, 480-person org, 12-month POC budget approved. Daniel opened: "97% of breaches involve human element — Verizon DBIR 2024." Minute 4 on the Mandiant M-Trends dwell chart. Minute 8 the CISO checked her phone.

Minute 14: *"send me a deck and I'll circle back."* Three days later: *"Re-evaluating priorities — let's reconnect at RSA."* Zero POC. Lost $400K to the incumbent.

Same CISO, six weeks later, different rep, competing SIEM, after this training. Opening: *"Before I show anything — what did your board ask you about cyber risk in the last quarterly read-out?"* CONTEXT surfaces a board ask on third-party risk after a peer breach. CONTROL MAP surfaces a NIST CSF 2.0 Detect-function gap (Govern, added Feb 2024, exposed it on her self-assessment).

CONSEQUENCE dollarizes to $3.2M annualized loss-event estimate for the CFO. CADENCE: 6-week scoped POC, three use cases. COMMITMENT: executive sponsor is the CFO, not the CIO.

Closed the same $400K plus a 3-year framework. **Same CISO. Same need.

Different sequence.**

⚠️ Common Trap

*"Marketing built the threat-landscape deck and SE leadership approved it — that's how we open."* Three answers. (1) The threat-landscape deck is reference, not script — top-quartile reps pull it AFTER CONSEQUENCE lands, if at all. (2) Deck-as-opener is exactly why CISOs end 6 of 10 meetings with *"send me a deck"* — the *send-me-a-deck* signal is **CISO-code for "I've heard this 11 times this quarter, I'm done."* (3) Risk-framed discovery converts at ~3x the FUD-pitch rate per Forrester's 2024 buyer-behavior research on technology buyers.

Transition: "Next hour: 5-stage risk-framed discovery, 3-language CISO frame, two role-plays. Let's go."

SECTION 2 -- THE TEACH (0:05-0:22)

🟡 Coach Note

Seventeen minutes. Do not lecture for seventeen minutes — you will lose the room by minute 9. Split into two halves: 5-STAGE RISK-FRAMED DISCOVERY (12 min, ~2.5 min per stage) + Three CISO Languages (5 min, ~1.5 min per Language).

Pause after each stage for one clarifying question. End-of-section test: any rep can recite all 5 stages in sequence, all 3 Languages, and the verbatim cue under each without notes.

Part A -- The 5-STAGE RISK-FRAMED DISCOVERY Framework (12 minutes)

Five stages every top-quartile cybersecurity AE runs in every CISO meeting. Most lost deals collapse at Stage 1 (rep never asks about the board / risk-register context, jumps straight to capability pitch) or Stage 3 (rep states the threat as a headline instead of a dollarized loss event the CISO can take to the CFO).

Stage 1 -- CONTEXT (5 min)

Set meeting expectation. Ask about the CISO's board context. NO product. NO deck. NO threat actor names.

🎤 Verbatim Script -- The CONTEXT

*"Before I show you anything, three quick questions. One — what did your board or audit committee ask you about cyber risk in your last quarterly read-out? Two — if your CFO walked in right now and asked you to defend the cyber line item on next year's budget, what's the first sentence out of your mouth?

Three — where on your risk register are you most exposed today — not in headlines, in the register itself?"*

Get the verbal yes. Disclose what you're NOT going to do today (no demo, no FUD, no product talk until you understand the register). The CISO has been pitched by 11 vendors this quarter who skipped this. You are the first rep to ask about the board.

Common trap. Skipping CONTEXT and opening with *"let me show you what we do"* — the CISO spends the rest of the hour waiting for the pivot. Or asking *"what are your biggest security challenges?"* — the dead-on-arrival question every rep asks, signals you have a script not a conversation.

Stage 2 -- CONTROL MAP (8 min)

Map the CISO's environment to a recognized framework — NIST CSF 2.0 (preferred) or CIS Controls v8 IG1/IG2/IG3. NO product mention. Whiteboard or shared screen.

🎤 Verbatim Script -- The CONTROL MAP

*"If we map your environment to NIST CSF 2.0 — Govern, Identify, Protect, Detect, Respond, Recover — where do you score yourself today, on a 1-to-5 maturity scale, function by function? Govern is the new one as of Feb 2024 — most CISOs are still calibrating. Where do your auditors agree, and where do you and your auditors disagree?"*

The CONTROL MAP is the conversation no vendor has. Every CISO has a NIST CSF self-assessment or a CIS v8 IG-level map. Most reps don't ask. Asking signals you understand the CISO's actual operating language and gives you the exact subcategory your offering should map to in the Stage 5 commitment.

Common trap. Skipping the framework and asking about products in use (*"are you using Splunk or Sentinel?"*) — turns discovery into a competitive sniff, not a control-coverage conversation. Or pretending to know NIST CSF 2.0 when you don't — CISOs can smell it in 30 seconds. SEs on the call should know all six functions cold.

Stage 3 -- CONSEQUENCE (8 min)

Dollarize the gap. Convert the control-coverage shortfall into a loss-event estimate the CISO can take to the CFO. NO threat actor name-drops. NO competitor breach references.

🎤 Verbatim Script -- The CONSEQUENCE

*"You scored yourself a 2 on Detect for cloud workloads. If we estimate that gap conservatively — one ransomware incident per 24 months, $4.88M IBM industry average, your industry segment around $5.5M, downtime cost in your peer set ~$280K/hour, customer-notification + regulatory + legal at ~$1.4M — annualized that's a loss-event estimate of roughly $2.7-3.2M per year carried on the risk register.

Is that the order of magnitude your CFO uses, or is your finance team running different numbers?"*

Dollarize, then defer to her math. The honest answer for most CISOs is *"we use FAIR methodology"* or *"we cap at Hiscox / Beazley premium impact."* You're not selling the number; you're earning the right to be on the risk-register conversation. NEVER reference a specific named competitor's breach — the CISO almost certainly knows that CISO or sits on the same industry roundtable.

The named-breach reference will end the meeting.

Common trap. *"97% of breaches involve human element — Verizon DBIR 2024."* Aggregate FUD stat, no relevance to her register. Or *"look what happened to [named competitor] last quarter."* CISOs ALL know each other. Naming a peer breach is the single most reliable way to end the meeting in under 90 seconds.

Stage 4 -- CADENCE (5 min)

Scope the POC. NOT a generic 90-day eval — a tightly-scoped use-case POC tied to the CONSEQUENCE estimate, with success criteria the CISO can show her board.

🎤 Verbatim Script -- The CADENCE

*"What we'd propose is a 6-week scoped POC against three specific use cases — the cloud-workload Detect gap, your ransomware blast-radius containment, and one third-party access scenario your TPRM team flagged. Three success criteria, defined by you in writing before kickoff, that you can take to your board read-out in October.

If we don't hit them, we shake hands and you've still got the control-map data we built together. Sound fair?"*

Scoped POCs close 3-4x more often than open-ended evals. Per CSA + Forrester 2024 buyer-behavior research, the #1 reason POCs stall isn't technical — it's lack of pre-defined success criteria the CISO can defend to the board. Write the criteria with her; do not propose them to her.

Common trap. *"Let me set up a 90-day eval and we'll see where it goes."* No scope, no exit, no success criteria — guaranteed POC purgatory. Or *"our standard POC is..."* — every standard-POC pitch tells the CISO her environment doesn't matter to you.

Stage 5 -- COMMITMENT (4 min)

Name the executive sponsor. Calendar the next meeting. Confirm the security questionnaire path. NO signed-MSA-tonight.

🎤 Verbatim Script -- The COMMITMENT

*"Three things to lock in regardless of next step. One — who's the executive sponsor for this on your side? Often the CFO when it's a risk-register conversation, sometimes the CIO when it's operational, sometimes the Chief Risk Officer if you report into risk.

Two — your procurement/security-review timeline: SIG Lite vs full SIG, FedRAMP/SOC 2/ISO 27001 evidence, your standard MSA red-lines — let's get my SE on with your GRC team next week. Three — second meeting calendared before I leave to walk the POC scope with whoever else needs to be in the room."*

Calendar the second meeting BEFORE you leave. Highest-correlation predictor of closed-won deal per every B2B sales benchmarking study published since 2018.

Common trap. *"Should we kick off the POC this week?"* — false urgency, the CISO has a 9-month procurement cycle she controls. *"I'll send the SOW and follow up"* — produces zero second meetings; calendar in the room.

Part B -- The Three CISO Languages (5 minutes)

Three languages every CISO speaks every day. The rep must speak all three in one meeting. Speak only OPERATOR (toil, MTTR, alert fatigue) → you sound like a junior SE; speak only BOARD (loss-event dollars) → you sound like a McKinsey consultant; speak only AUDITOR (control IDs) → you sound like a GRC vendor.

The CISO needs all three from one rep.

Language 1 -- BOARD (loss-event driven, dollarized)

For the CEO + CFO + audit committee. Loss-event-driven, dollarized, mapped to risk-register categories: confidentiality, integrity, availability, regulatory non-compliance, third-party concentration. NEVER threat-actor-named.

🎤 Verbatim Script -- BOARD Language

*"The board cares about three numbers: probable annualized loss exposure, residual risk after controls, insurance coverage cap. We reduce probable loss on the Detect gap from ~$3.2M to ~$1.1M annualized — a $2.1M residual reduction your insurer rewards in renewal pricing."*

Common trap. Speaking BOARD-only — fine for 5 min, then she needs auditor + operator proof or you're a strategy consultant pitching a tool you don't understand.

Language 2 -- AUDITOR (control-mapped, framework-specific)

For her auditors + GRC team + regulator. NIST CSF 2.0 subcategory (DE.CM-01 continuous monitoring), CIS v8 Control + Safeguard (Control 8 Audit Log Management, Safeguard 8.5), ISO/IEC 27001:2022 Annex A (A.8.16), SOC 2 TSC, PCI-DSS v4.0, HIPAA Security Rule, NYDFS Part 500 sections.

🎤 Verbatim Script -- AUDITOR Language

*"We map to NIST CSF 2.0 DE.CM-01, DE.CM-09, DE.AE-02, and to CIS v8 Controls 8, 13, 17. For SOC 2 Type II we generate control-coverage attestations your auditors drop into workpapers — saves your GRC team ~40 hours per audit cycle. Want the mapping doc sent to your GRC lead?"*

Common trap. Vague *"we map to NIST CSF"* without subcategory IDs — worthless to the GRC team. SEs MUST recite subcategory IDs cold.

Language 3 -- OPERATOR (toil, alert-fatigue, MTTR)

For her SOC analysts + detection engineers + IR responders. Toil-, alert-fatigue-, MTTD/MTTR-reducing. Specific to SOC day — false-positive rate, alert volume/shift, time-to-triage, time-to-contain, integrations with existing SIEM + EDR + ticketing + SOAR.

🎤 Verbatim Script -- OPERATOR Language

*"For your SOC — we reduce alert volume per analyst per shift by 40-60% by deduplicating across your Splunk + CrowdStrike + Okta telemetry, and cut MTTR on cloud-workload alerts from ~4 hours to under 45 minutes. Want a call with my detection-engineering lead and your SOC manager?"*

Common trap. OPERATOR-only → you sound like an SE not an AE. Pretending to know the SOC stack — if you don't know she runs Splunk + CrowdStrike + Okta + Jira, you skipped prep.

🎯 Bottom Line

5 stages + 3 Languages. Both together = 32-44% POC conversion + multi-year framework agreements. Stages without Languages = a rep who closes one POC and never expands into the enterprise; Languages without Stages = a rep who sounds smart for 45 minutes and never gets a follow-up meeting.

SECTION 3 -- THE DISCUSSION (0:22-0:32)

🟡 Coach Note

Whiteboard up. Write CONTEXT / CONTROL MAP / CONSEQUENCE / CADENCE / COMMITMENT across the top in 5 columns. Each rep audits their last stalled CISO opportunity out loud — which stage broke down, what the CISO said, what's been written (or not) in the 90 days since.

Count to five after each prompt. Silence forces engagement. If vague: *"verbatim — what exactly did you say in CONTEXT? Did you actually ask about the board read-out, or did you skip to the demo?"*

Prompt 1 — "Name your last stalled CISO opportunity. Org size, segment, last 3 interactions." Force specifics: *"480-person Toronto fintech, CISO Priya Mehta reports to CRO, first meeting March 4, last touch April 18 'circle back at RSA'."* No vague *"a deal that ghosted us."*

Prompt 2 — "Which of the 5 stages broke down?" Most admit CONTEXT (skipped board read-out), CONTROL MAP (didn't know NIST CSF 2.0 added Govern in Feb 2024), CONSEQUENCE (FUD-pitched instead of dollarized), CADENCE (generic 90-day eval), or COMMITMENT (forgot sponsor).

Manager: *"CONTEXT is the contract. CONTROL MAP is the language. CONSEQUENCE is the math.

CADENCE is the scope. COMMITMENT is the sponsor. Skip any → zero POCs."*

Prompt 3 — "When is it OK to mention a competitor's recent breach by name?" Answer: almost never, and never by name. CISOs sit on each other's roundtables. Naming a peer's breach is the most reliable way to end a meeting. Say *"a peer in your segment"* — never the name.

Manager: *"If you can't resist, save it for when the CISO names it first."*

Prompt 4 — "Did you ask which framework — NIST CSF 2.0 or CIS v8?" Most assumed NIST CSF. Some regulated buyers prefer CIS v8 IG1/IG2/IG3; FedRAMP buyers map to NIST 800-53 + FedRAMP overlay; banks layer FFIEC CAT + NYDFS Part 500. Manager: *"Wrong framework = wrong language. Ask; don't pick for them."*

Prompt 5 — "Did you name the executive sponsor at COMMITMENT?" Most assumed the CISO was the buyer. Often CFO when risk-register-driven, CIO when operational, Chief Risk Officer at banks/insurers, General Counsel when privacy/regulatory. Manager: *"Single-threading on the CISO loses the deal at procurement."*

Prompt 6 — "ONE concrete next move. Verbatim." Each rep names ONE CISO + ONE move + ONE verbatim line. Manager: *"Recorded where applicable, or detailed Salesforce / HubSpot note within 14 days, reviewed in 1:1."*

SECTION 4 -- TWO-PERSON ROLE-PLAY (0:32-0:52)

🟡 Coach Note

Pair reps. If odd number, the manager takes the extra rep. Two scenarios, 10 minutes each, 60-second reset between. Rep plays CISO in Round 1, switches to rep in Round 2.

Walk the room. Listen for whether the rep actually runs CONTEXT verbatim in Round 1 (the board-read-out question is the diagnostic), and whether they hold CONSEQUENCE discipline without name-dropping a peer breach. Mark which stage each rep skips; that's the data for the next 1:1.

Role-Play 1 -- Mid-Market CISO With Budget Cut + Tool Fatigue (10 min)

Setup: **CISO Priya Mehta, 320-person Toronto fintech SaaS, inherited 47 security tools, board cut FY26 cyber budget 12% citing "macro tightening", explicit directive to CONSOLIDATE — not add — for 18 months. Stack: Splunk + CrowdStrike + Wiz + Okta + KnowBe4 + Tenable + Cloudflare + Zscaler + 39 others.

Reports to CTO. Rep is selling a Cloud Detection & Response (CDR) platform competing with Wiz Defend + Sweet + Stream.Security + Permiso + the Falcon Cloud Security module the CISO already owns. Rep must run the full 5-STAGE, must NOT name a competitor's breach, must surface consolidation (CDR replacing 3-5 point tools), must propose a scoped POC tied to a NIST CSF subcategory, must NOT promise "we stop ransomware."**

🎤 PROSPECT SCRIPT -- Priya Mehta

Posture: Smart, time-starved, FUD-exhausted, sitting on Slack with 12 other fintech CISOs comparing tool stacks, primary directive from the board is CONSOLIDATE, not ADD. Engages if (a) no FUD slide, (b) the rep maps to the consolidation directive (replacing 3-5 tools, not adding a 48th), (c) the rep dollarizes without name-dropping a peer breach.

Deflection 1 (min 6): *"I already have Splunk + CrowdStrike + Wiz — what exactly am I ripping out, and what's the migration risk if you're wrong?"*

Deflection 2 (min 11): *"Your slide says you stop ransomware. So did the last three vendors who pitched me this quarter. Prove it without a logo slide, without naming a customer breach, and without quoting Mandiant."*

Deflection 3 (min 16): *"Board cut my budget 12%. Even if I love this, where do I find the money?"*

🎤 REP SCRIPT

• Min 0-5 (CONTEXT): *"Priya — three quick questions before I show anything. What did your board ask about cyber in the last quarterly read-out? If your CFO walked in and asked you to defend the cyber line, what's your first sentence? Where on the register are you most exposed?"* (Priya: "Board wants tool consolidation, CFO asks return on 47 tools, register flags cloud-workload Detect.")
• Min 5-13 (CONTROL MAP): *"NIST CSF 2.0 — including the new Govern function — where do you score yourself function by function? Where do auditors agree or disagree?"* (Priya: Govern 2, Identify 3, Protect 4, Detect 2, Respond 3, Recover 3.) *"On CIS v8 you're at IG2 — anywhere auditors are pushing toward IG3?"*
• Min 13-20 (CONSEQUENCE + Deflection 1): *"Detect score 2 on cloud workloads, conservatively one incident per 24 months at $5.5M segment avg — about $2.7M annualized on the register. Is that the order your CFO uses?"* Deflection 1: *"We don't replace Splunk; we feed it. We don't replace CrowdStrike on endpoint; we extend it into cloud workloads where Falcon Cloud Security has documented gaps. We MIGHT replace 3 of your 47 — your CWPP, standalone cloud SIEM connector, runtime workload tool — if the POC proves it. We run in parallel; no production cutover until you're satisfied."*
• Min 20-26 (CADENCE + Deflection 2): *"6-week scoped POC, three use cases — cloud Detect, ransomware blast-radius containment, one third-party access scenario your TPRM flagged. Three success criteria you write before kickoff, ready for October board read-out."* Deflection 2: *"No logo slide. No Mandiant quote. Write the three criteria. We hit them or we don't. If we hit, you've consolidated 3 tools. If we don't, you keep the control-coverage data."*
• Min 26-30 (COMMITMENT + Deflection 3): Deflection 3 (budget): *"Three sources. The 3 tools we replace at $40-90K/year each. Your insurer typically rewards a measurable Detect-gap reduction at ~7-12% premium. Q4 unlocks if we deliver the October read-out number. Sponsor — CFO or CTO? SE on with your GRC next week for SIG Lite + SOC 2 Type II?"* (Pull up calendar.)

60-Second Reset

🟡 Coach Note

Sales Manager calls out: "Switch sides — 60-second reset." Reps put papers down. Stand up. Stretch. Sip water. Sit back down with the OTHER role's paper. Take 30 seconds to read silently. Then go.

Role-Play 2 -- Enterprise Bank CISO Under OCC + NYDFS Part 500 + 400-Question SIG (10 min)

Setup: **CISO Janet Okafor, F500 US bank, reports to Chief Risk Officer (NOT CIO), under OCC Heightened Standards (12 CFR 30 App D) + FFIEC CAT + NYDFS 23 NYCRR Part 500 (revised 2023) + GLBA + PCI-DSS v4.0. Every vendor completes a 400-question SIG + custom bank addendum, requires FedRAMP Moderate + SOC 2 Type II + ISO 27001:2022, 9-month procurement, mandatory executive sponsor.

Janet sits on 14 vendor advisory boards. Rep is selling TPRM competing with BitSight + SecurityScorecard + Panorays + Black Kite + ProcessUnity + OneTrust + Whistic. Rep must use 5-STAGE to surface what makes this TPRM credible for a Tier-1 bank, dollarize third-party concentration risk using Cyentia/BitSight 98%-connected data, NOT pitch generic "risk scores", speak AUDITOR fluently on NYDFS Part 500 third-party provisions, name the right sponsor (Chief Risk Officer, not CISO).**

🎤 PROSPECT SCRIPT -- Janet Okafor

Posture: Senior, scarce, regulator-scarred, sits on 14 advisory boards already so vendor flattery is dead, primary fear is a third-party breach showing up in an OCC exam finding or NYDFS enforcement action, secondary fear is procurement burning 9 months on yet another tool that doesn't differentiate from BitSight.

Deflection 1 (min 5): *"How are you different from BitSight, SecurityScorecard, Panorays, and Black Kite? Honest answer in 60 seconds. I have all four pitches on file."*

Deflection 2 (min 10): *"Our procurement cycle is 9 months and you need executive sponsorship to clear it. I sit on 14 vendor advisory boards already. Why should our Chief Risk Officer champion you when she's already over-extended?"*

Deflection 3 (min 15): *"Your SIG response will take my GRC team 6 weeks to evaluate, and our custom bank addendum has 127 additional questions. Why is the procurement burn worth it?"*

🎤 REP SCRIPT

• Min 0-4 (CONTEXT): *"Janet — what did your board's risk committee ask about third-party cyber in the last read-out? Where does third-party concentration sit on the register? What did your last OCC exam or NYDFS Part 500 (g)(7) assessment surface?"* (Janet: "Risk committee wants quantified third-party exposure. Register flags concentration in top 12 critical providers. Last OCC finding was third-party monitoring frequency.")
• Min 4-10 (CONTROL MAP + Deflection 1): *"NIST CSF 2.0 for third parties — Govern (new Feb 2024) + Identify ID.SC + Protect PR.IP + Detect DE.CM-06 external service provider monitoring — where do you score, where do auditors disagree?"* Deflection 1 (vs BitSight/SecurityScorecard/Panorays/Black Kite): *"60 seconds. BitSight + SecurityScorecard = outside-in attack-surface scoring. Panorays + Black Kite layer questionnaire automation. We're inside-out evidence — we ingest actual SOC 2 Type II reports, ISO 27001:2022 certs, FedRAMP packages, SIG responses from your top 200 third parties, normalize against NYDFS Part 500 (g)(7) + FFIEC CAT, surface control failures specific to your bank's register — not a generic A-F score."*
• Min 10-17 (CONSEQUENCE + Deflection 2): *"Per Cyentia + BitSight, 98% of orgs connected to at least one breached third party in 24 months. Your top 12 critical providers represent ~$14-22M annualized third-party exposure on the register, before insurance recovery. Reducing concentration 30% — measurable — is what the risk committee wants quantified."* Deflection 2 (sponsor + 14 advisory boards): *"I'm not asking your CRO to champion a tool; I'm asking her to champion a measurable reduction in the third-party number. Different ask. I'd rather you NOT sit on our advisory board — I'd rather she write the success criteria for a 90-day proof-of-value tied to the OCC finding."*
• Min 17-22 (CADENCE + Deflection 3): *"90-day proof-of-value, scoped to your top 12, three success criteria you write tied to the OCC finding + NYDFS Part 500 (g)(7) + your insurer's renewal quote. After 90 days you have NYDFS-ready third-party assessment documentation regardless."* Deflection 3 (procurement burn): *"SIG + 127-question addendum: our SIG response is current Q1, we send Q-by-Q updates so GRC doesn't re-evaluate cold. FedRAMP Moderate ATO + SOC 2 Type II + ISO 27001:2022 + HITRUST + CAIQ. Customer-success lead at JPM ran our procurement in 5 months — happy to intro. The burn is worth it only if the PoV lands; you control that."*
• Min 22-25 (COMMITMENT): *"Three lock-ins. Sponsor: CRO, given report line. SE meets your GRC + procurement next Tuesday for SIG addendum + evidence library access. Second meeting with CRO + GRC lead, week of the 21st."*

🟡 Coach Note

Walk the room. Rep will want to (a) name-drop the MOVEit or Snowflake-customer breaches by name (DO NOT — bank CISOs all know each other), (b) pitch generic "risk scores" against BitSight (loses on differentiation), (c) skip the regulator-specific framework language (loses on AUDITOR credibility), (d) single-thread on the CISO (loses at procurement because sponsor is the CRO).

Make the rep re-deliver the BitSight differentiation + the named-sponsor framing + the regulator-specific subcategory language. Highest-leverage drill in the training.

SECTION 5 -- DEBRIEF + COMMITMENTS (0:52-0:57)

🟡 Coach Note

Pull the room back together immediately. Three debrief questions, then commitments. The ritual is the only part that moves next quarter's POCs + closed-won + ACV expansion + multi-year framework agreements.

Debrief 1 — "Which stage felt strongest? Which weakest?" Reps over-index on CADENCE (they love proposing POCs) and COMMITMENT (they want the next-meeting calendar). Under-index on CONTEXT (skipped the board-read-out question) and CONSEQUENCE (FUD-pitched instead of dollarized).

Manager: *"CONTEXT is the contract. CONSEQUENCE is the math. Without the contract the rest of the hour is a sales pitch the CISO is waiting to end.

Without the dollarized math the gap is a headline, not a risk-register line item."*

Debrief 2 — "Which Language did you never speak?" Most will name AUDITOR (couldn't recite NIST CSF subcategory IDs or CIS v8 safeguards) or OPERATOR (didn't know the CISO's SOC stack well enough to talk MTTR + alert volume). A few BOARD (couldn't dollarize without falling back on aggregate FUD stats).

Manager: *"Naming the missing language is how you fix it. Document the missing language in your CRM — bring the SE who speaks it on the next call. Single-language sellers get one POC and never expand."*

Debrief 3 — "Who's the CISO you'll re-run discovery with this month?" Each rep names ONE from their stalled-CISO list. Manager: *"Email or LinkedIn note: 'I want to redo our conversation differently, 45 minutes next week, no demo, no deck, no FUD — I want to walk your NIST CSF 2.0 map with you and dollarize one gap.

Worth 45 minutes?' Then run CONTEXT for the full 5 minutes, CONTROL MAP for the full 8 minutes before any product talk. CRM note in Salesforce / HubSpot within 14 days for 1:1."*

🎤 Commitment Ritual (Verbatim)

Manager says: "Open Salesforce / HubSpot on your phone. Four lines. Line 1: target CISO — name, org, segment, last interaction.

Line 2: stage you'll lead with — CONTEXT / CONTROL MAP / CONSEQUENCE / CADENCE / COMMITMENT. Line 3: ONE verbatim language change — actual words. Line 4: meeting you'll log in CRM within 14 business days.

Read all four aloud."

Coach the vague (*"I'll be more customer-centric"*): *"What words exactly? Read the CONTEXT opener. Out loud now."*

Manager closes: "In our 1:1 within 14 business days I'm pulling Salesforce / HubSpot detail on this exact CISO, and we'll walk through the CONSEQUENCE dollarization for the 8 minutes where you converted a control gap into a risk-register line item. Not whether you got the POC — whether you ran the 5 stages and spoke all 3 Languages. POCs follow process.

Closed-won follows POCs. Always have."

SECTION 6 -- LEAVE-BEHIND WALKTHROUGH (0:57-1:00)

🟡 Coach Note

Hand out the printed one-pager. Walk it 30 seconds per section. Tell reps where the digital version lives (sales-enablement portal + CRM attachment). Keep one in the discovery binder next to the call-prep checklist.

📋 Leave-Behind -- The "CISO Meeting Pre-Flight Checklist" One-Pager

PRE-FLIGHT (night before):

• [ ] Read prospect's 10-K Item 1C cyber risk + last 3 annual report cyber mentions
• [ ] Pull SEC 8-K cyber disclosures (post-Dec 2023 SEC rule)
• [ ] Identify regulators + frameworks: NIST CSF 2.0, CIS v8 IG, ISO 27001:2022, SOC 2, FedRAMP, HIPAA, PCI-DSS v4.0, NYDFS Part 500, FFIEC CAT, GDPR, DORA
• [ ] Identify report line: CIO / CFO / CRO / GC — sponsor maps to report line
• [ ] Identify SOC stack — SIEM, EDR, identity, ticketing — from job posts + GitHub + LinkedIn
• [ ] SE on call who can recite NIST CSF 2.0 subcategory IDs + CIS v8 safeguards

THE 5-STAGE RISK-FRAMED DISCOVERY:

#	Stage	Verbatim Cue (memorize)	Time
1	CONTEXT	*"What did your board ask you about cyber in the last read-out? If your CFO asked you to defend the cyber line, what's the first sentence? Where on the risk register are you most exposed?"*	5 min
2	CONTROL MAP	*"If we map to NIST CSF 2.0 — including the new Govern function — where do you score function by function? Where do your auditors agree or disagree?"*	8 min
3	CONSEQUENCE	*"At that maturity level, conservatively annualized loss exposure is roughly $X-Y. Is that the order your CFO uses?"* (NEVER name a peer breach.)	8 min
4	CADENCE	*"6-week scoped POC against three use cases, success criteria you write before kickoff, ready for your next board read-out."*	5 min
5	COMMITMENT	*"Sponsor — CFO / CIO / CRO / GC? GRC + procurement meeting next week? Second meeting calendared before I leave."*	4 min

THE THREE CISO LANGUAGES:

Language	Audience	Speaks in	Common rep failure
BOARD	CEO / CFO / Audit Committee	Probable annualized loss, residual risk, insurance impact — dollarized, NEVER threat-actor-named	Aggregate FUD stats instead of register-specific dollarization
AUDITOR	GRC, Internal Audit, External Auditor, Regulator	NIST CSF 2.0 subcategory IDs (DE.CM-01), CIS v8 controls + safeguards (8.5), ISO 27001:2022 Annex A, SOC 2 TSC, PCI-DSS v4.0, NYDFS Part 500, FFIEC CAT	Vague "we map to NIST" without subcategory IDs
OPERATOR	SOC Analysts, Detection Engineers, IR Responders	Alert volume reduction, MTTR/MTTD, integrations with existing SIEM+EDR+ticketing, false-positive rate	Pretending to know the SOC stack

5 PHRASES THAT WILL END THE MEETING EARLY:

• [ ] *"97% of breaches involve human element..."* (aggregate FUD = instant tune-out)
• [ ] *"Look at what happened to [named peer competitor]..."* (CISOs all know each other; named-breach reference = meeting over)
• [ ] *"We stop ransomware."* (so did the last three vendors; unprovable claim)
• [ ] *"We're the leader in [Gartner MQ quadrant]..."* (the CISO has read the MQ; you're not adding info)
• [ ] *"Let me show you the platform first..."* (skipped CONTEXT; you're a vendor not a partner)

3 PHRASES THAT EARN A POC:

• [ ] *"What did your board ask you about cyber in the last read-out?"* (CONTEXT opener)
• [ ] *"Where do you score yourself on NIST CSF 2.0 — including the new Govern function?"* (CONTROL MAP opener)
• [ ] *"What if we wrote 3 success criteria you can take to the October board read-out, and ran a 6-week scoped POC against them?"* (CADENCE close)

NEVER DO:

• Open the threat-landscape deck before CONTEXT lands
• Quote Verizon DBIR aggregate stats in the first 20 minutes
• Name a competitor's recent breach (CISOs ALL know each other)
• Promise *"we stop ransomware"* — unprovable, FUD-adjacent
• Quote Mandiant dwell time without tying it to her actual environment
• Pitch "free risk assessment" without a written scope
• Single-thread on the CISO — sponsor is often CFO / CRO / GC
• Propose a generic 90-day eval — propose scoped POC with written success criteria
• Vague "we map to NIST CSF" without subcategory IDs
• Pretend to know the SOC stack you didn't research
• Speak only one of the three Languages
• Ask "what are your biggest security challenges?" — dead-on-arrival question

OUTCOME LINE:

• Wins: Full 5-STAGE + Three Languages live + framework-specific subcategory mapping + dollarized CONSEQUENCE + scoped POC with written success criteria + sponsor named in the room → 32-44% POC conversion + 60-75% POC-to-closed-won + multi-year framework agreements + reference customer outcomes
• Losses: Threat-landscape deck at minute 4 + DBIR pull-quote at minute 6 + named-breach reference at minute 9 + generic 90-day eval pitch + single-threaded on the CISO → 9-15% POC conversion + 20-30% POC-to-closed-won + send-me-a-deck purgatory

🎯 If You Only Remember One Thing

You don't sell a CISO by scaring her — you sell a CISO by writing a defensible line item on her risk register that she can take to her board, her auditor, and her SOC manager in the same week.

How This Training Sits Inside Your Cybersecurity Sales Motion

This is the foundational CISO acquisition discipline — the conversation that determines whether your quarter hits ACV targets AND your customer base expands into multi-year framework agreements. Composes with SE-led demos, RFP response, channel + VAR motion.

The 5-Stage Risk-Framed Discovery Flow

The Three CISO Languages — Mapping to Audience

📚 Sources, Frameworks, And Research Cited

The 5-STAGE RISK-FRAMED DISCOVERY framework, the Three CISO Languages frame, and the 32-44% POC conversion benchmark draw on a specific body of cybersecurity industry research, regulatory references, and recognized control frameworks. A sales manager or RVP should be ready to cite these by name.

Frameworks (AUDITOR vocabulary). NIST CSF 2.0 (Feb 2024) — six functions (Govern NEW, Identify, Protect, Detect, Respond, Recover), 22 categories, 106 subcategories; de-facto US private-sector framework, mapped by OCC + FFIEC + NYDFS + SEC cyber rule. CIS Controls v8 — 18 controls, Implementation Groups IG1 (basic), IG2 (mid-market), IG3 (enterprise/regulated) + 153 Safeguards.

ISO/IEC 27001:2022 + Annex A (93 controls, 4 themes). SOC 2 Type II (AICPA TSC). PCI-DSS v4.0 (March 2024 effective, March 2025 full enforcement).

HITRUST CSF (healthcare). FedRAMP Moderate / High (ATO via PMO). CSA CAIQ.

Regulators. SEC Cybersecurity Disclosure Rule (Dec 2023 — 8-K Item 1.05 + 10-K Item 1C). OCC Heightened Standards (12 CFR 30 App D). FFIEC CAT + IT Examination Handbook.

NYDFS 23 NYCRR Part 500 (revised 2023 — CISO certification, MFA, third-party (g)(7), incident reporting). HIPAA Security Rule (45 CFR 164 Subpart C). GLBA Safeguards Rule (revised 2023).

CCPA + CPRA. GDPR. DORA (EU, Jan 2025).

Research. IBM Cost of a Data Breach 2024 — $4.88M global, $9.36M US healthcare, 204-day mean time to identify. Verizon DBIR 2024 — 68% human element, 32% ransomware/extortion (use sparingly — #1 FUD-flag CISOs cite). Mandiant M-Trends 2024 — global median dwell 10 days (down from 16 in 2022), ransomware median 5 days.

Gartner 2025 — ~$215B global spend, ~15% YoY. (ISC)² Workforce Study 2024 — ~5.5M professionals, 4.0M+ unfilled roles. SANS CTI Survey + SANS State of ICS/OT.

Cyentia / BitSight — 98% of orgs connected to at least one breached third party in 24 months. Forrester Tech Tide / Wave on TPRM, CDR, SSPM, DSPM, GRC, identity.

TPRM evidence vehicles. Shared Assessments SIG — 1,800+ question evidence-collection; SIG Lite (~300), SIG Core (~700), SIG Custom (bank/insurance addenda). CSA CAIQ for cloud. VSAQ (Google-originated). HITRUST Shared Responsibility Matrix.

CISO peer networks (context for *"sits on 14 advisory boards"*). ISC2 + ISSA + ISACA + InfraGard; FS-ISAC, H-ISAC, E-ISAC, R-H-ISAC, Auto-ISAC, A-ISAC. Closed-door: Evanta CISO Executive Summits, Gartner CISO Circle, Forrester Security & Risk Council, Wisp / CISO Tribe.

Vendor landscape (OPERATOR vocabulary). EDR/XDR: CrowdStrike, SentinelOne, Microsoft Defender, Palo Alto Cortex, Trellix. SIEM: Splunk, Sentinel, Sumo Logic, Elastic, QRadar, Exabeam, Securonix. CNAPP: Wiz, Prisma Cloud, Orca, Lacework, Aqua, Falcon Cloud Security.

CDR: Sweet, Stream.Security, Permiso, RAD Security. SSPM: AppOmni, Adaptive Shield, Obsidian, Reco. DSPM: Cyera, Varonis, Sentra, Dig, BigID.

TPRM: BitSight, SecurityScorecard, Panorays, Black Kite, ProcessUnity, OneTrust, Whistic. GRC: Vanta, Drata, Hyperproof, AuditBoard, Archer, ServiceNow. Identity: Okta, Entra, CyberArk, SailPoint, BeyondTrust, Ping.

MDR/MSSP: Arctic Wolf, Expel, Red Canary, Deepwatch, eSentire, Secureworks. Threat Intel: Recorded Future, Mandiant, CrowdStrike CAO, Anomali, Flashpoint.

Trade press. Dark Reading + The Record + KrebsOnSecurity + The Hacker News + BleepingComputer + CSO Online + SC Media + Cybersecurity Dive + InfoSecurity Magazine.

📊 The Numbers Behind The Training

The cold open lands harder when the sales manager can quote real benchmarks. The tables below pull from IBM Cost of a Data Breach 2024 + Verizon DBIR 2024 + Mandiant M-Trends 2024 + Gartner 2025 + (ISC)² 2024 + Cyentia/BitSight third-party research + Forrester buyer-behavior research.

CISO Buyer Reality — 2025 Benchmarks

IBM Cost of a Data Breach 2024 — By Industry Vertical

Cybersecurity Sales Conversion By Discovery Discipline Tier

Why CISOs End Cybersecurity Sales Meetings Early (Forrester + Evanta + Gartner CISO Circle)

NIST CSF 2.0 Function-Coverage Maturity Self-Scoring (Cross-Industry Average)

Tool Consolidation Economics (Mid-Market 250-1,000 Employees)

Mandiant M-Trends 2024 — Detection + Response Benchmarks

Cyentia + BitSight 3rd-Party Risk — TPRM Reality

Pattern: Stage 3 CONSEQUENCE (dollarizing the gap WITHOUT a named peer breach) and Stage 2 CONTROL MAP (framework-specific subcategory fluency) are the hardest to install — reps default to DBIR aggregate stats and vague framework references. The weekly CRM CISO-discovery-note audit by the sales manager is the single biggest predictor of cohort POC conversion lift at 90 days. The Three Languages frame adopts faster (most reps reach 80%+ BOARD + OPERATOR adherence by week 6) because the language is concrete; AUDITOR language (subcategory IDs) takes 8-12 weeks of SE shadowing to install.

⚠️ Counter-Case: When The Framework Fails

Failure Mode 1 -- Threat-Landscape Deck Before CONTEXT

Most common single failure. Rep opens the firm's "2025 Threat Landscape" deck at minute 4 because it's the polished asset marketing built. Per Forrester, 38% of CISO early-exits trace to opening FUD. The deck is reference, not script — top-quartile reps pull it AFTER CONSEQUENCE lands, if at all.

Failure Mode 2 -- DBIR Pull-Quote in the First 20 Minutes

*"68% of breaches involve a human element — Verizon DBIR 2024."* CISO has read the DBIR. CISO has been pitched the DBIR in 8 of her last 11 vendor meetings. The DBIR is the single most-cited FUD-flag in CISO peer groups. Save it for the leave-behind, never the opener.

Failure Mode 3 -- Named Peer Competitor's Breach

Rep references a recent named breach (the named bank, the named retailer, the named SaaS) to land urgency. CISOs ALL know each other. She sits on the same Evanta panel as that CISO. Naming a peer's breach is the single most reliable way to end a meeting in under 90 seconds — and to be named in the next CISO Slack thread as "the vendor who used Jane's incident in their pitch."

Failure Mode 4 -- Vague "We Map to NIST CSF" Without Subcategory IDs

Rep says *"we map to NIST CSF"* and stops. CISO's GRC team needs subcategory-level mapping (DE.CM-01, PR.IP-09, GV.OC-03) or it's worthless for the audit workpapers. SE on the call MUST be able to recite the subcategory IDs cold.

Failure Mode 5 -- Generic 90-Day Eval Pitch

*"Let me set up a 90-day eval and we'll see where it goes."* No scope, no success criteria, no exit — guaranteed POC purgatory. Top-quartile POCs are 4-8 weeks, scoped, with three CISO-written success criteria tied to the next board read-out.

Failure Mode 6 -- Single-Threading on the CISO

Rep treats the CISO as the buyer + economic decision-maker + sponsor. Often the CFO is the budget owner, the CRO is the sponsor at banks, the GC is the sponsor when privacy/regulatory drives, the CIO is the sponsor when it's operational. Single-threading loses the deal at procurement.

Failure Mode 7 -- Promised "We Stop Ransomware"

SEC Marketing scrutiny aside, the CISO has heard *"we stop ransomware"* from the last three vendors. Unprovable claim = trust evaporates. Honest framing: *"we measurably reduce ransomware blast radius by [X] and median containment time from [Y] to [Z] in your peer set's POCs — and here are the three success criteria you'd write to test that."*

Failure Mode 8 -- "We're the Leader in the Gartner MQ"

The CISO has read the MQ. The CISO has read the Forrester Wave. Saying *"we're a Leader / Visionary"* is not new information; saying it suggests you don't have a better story than the analyst gave you. Drop quadrant-positioning from discovery openers.

Failure Mode 9 -- Pretending to Know the SOC Stack

*"You're probably using Splunk, right?"* — guessing in front of a CISO signals zero pre-meeting prep. Research the stack (job posts + Glassdoor + GitHub + the CISO's own conference talks + the LinkedIn page for the SOC manager) before the meeting. Know the SIEM + EDR + identity + ticketing + SOAR + threat intel feed.

Failure Mode 10 -- Asking "What Are Your Biggest Security Challenges?"

Dead-on-arrival opener. Signals you have a script not a conversation. Every CISO has been asked this question by every junior AE in the last 24 months. Replace with the CONTEXT triplet: board read-out / CFO defense line / register exposure.

Failure Mode 11 -- Quoting Mandiant Dwell Time Without Relevance

*"Median ransomware dwell time is 5 days per Mandiant."* So what? Tie it to her actual environment or don't say it. *"Your Detect score 2 + median external-source detection 22 days = you'd find a ransomware actor at day 22, not day 5"* is useful; the aggregate stat alone is FUD.

Failure Mode 12 -- Sales Manager Doesn't Audit Weekly CRM CISO-Discovery Notes

Kills 60-75% of rollouts per the same coaching-cadence pattern visible across every B2B sales discipline. ~30-day half-life un-coached. Reps revert to threat-landscape deck + DBIR opener + single-threading by week 4. One CISO discovery per rep per week reviewed in 1:1. Non-negotiable.

Common Sales Manager Objections

1. "My reps already know discovery." Pull last 90 days of Salesforce / HubSpot CISO discovery notes. Bottom-quartile have meeting-summary templates citing DBIR; top reps have CONTEXT answers + NIST CSF self-score + dollarized CONSEQUENCE + scoped POC criteria + named sponsor. Audit, don't assume.

2. "FUD works in cybersecurity." Did once. Doesn't now. Per Evanta + Gartner CISO Circle 2024, CISOs explicitly rank "FUD-based pitching" as the #1 reason they cut a vendor from consideration in the first meeting. The market matured past FUD around 2020.

3. "Our SE team handles the framework conversation." Wrong. The CISO needs the AE to demonstrate framework fluency in the first 15 minutes — or the meeting ends before the SE call gets scheduled. AEs must be able to map to NIST CSF 2.0 + CIS v8 IG levels in CONTEXT + CONTROL MAP.

4. "Reps don't have time for 60-min discoveries." 30-min capability pitches close at 9-15% POC conversion; full 5-STAGE closes at 32-44%. Math favors the longer meeting on every CISO opportunity above $75K ACV.

5. "Senior reps don't need this." Pre-2020 senior reps trained on a vendor-driven FUD-as-opener motion. The buyer changed. The motion didn't update. Old habits (DBIR pull-quote, MQ positioning, named-breach urgency) now close meetings instead of opening them.

6. "We're a security platform — buyers love what we do." Buyers love what you do AFTER you've earned the right to show them. CISOs do not "love" platform pitches; they tolerate them. The rep's job is to earn the demo, not skip to it.

7. "How do I know it's working?" Three 90-day signals: CISO discovery → POC conversion +12-22 pts per rep / framework-specific subcategory mapping cited in 80%+ of CRM notes / sponsor named at COMMITMENT in 70%+ of meetings / second-meeting-calendared rate above 65% / 12-18 month net-new-ARR lift.

When To Run A Second Time

Re-run every 90 days with fresh stalled-CISO audits + updated regulatory bulletins (SEC cyber rule + NYDFS Part 500 amendments + FFIEC CAT updates + new NIST CSF informative-references). Rotate role-plays from last quarter's stalled CISO opportunities. Third run, swap archetypes — healthcare CISO under HIPAA Security Rule + 405(d) HICP, federal CISO under FedRAMP High + CMMC 2.0, PE-owned CISO under sponsor-driven CapEx scrutiny, EU CISO under DORA + NIS2, OT/ICS CISO under TSA Pipeline Security Directive + CISA SBOM expectations, retail CISO under PCI-DSS v4.0 + state breach-notification laws, SaaS CISO with $30M ARR and 200-customer SOC 2 audit fatigue, healthcare-payer CISO under HHS-OIG + state insurance regulator + HITRUST.

🔗 Related Pulse Content

Fifteenth entry in Pulse Sales Trainings (/sales-trainings/), ninth industry-specific training after st0007-st0014. st0001-st0006 covered B2B SaaS motions; st0007-forward pivots to industry-by-industry coverage. st0015 = cybersecurity AE + CISO discovery — the hardest 60 minutes in B2B sales, inside the NIST CSF 2.0 + CIS v8 + ISO 27001:2022 + SOC 2 + FedRAMP + SEC Cyber Rule + OCC + FFIEC + NYDFS Part 500 + HIPAA + PCI-DSS v4.0 + DORA perimeter.

Companion entries planned: st0016 federal (FedRAMP / CMMC 2.0 / FISMA), st0017 OT/ICS (TSA / CISA / NERC CIP), st0018 GRC automation (Vanta / Drata / AuditBoard), st0019 identity governance (CyberArk / SailPoint), st0020 healthcare cyber (HIPAA / HITRUST / 405(d) HICP), st0021 MSSP/MDR partner, st0022 cyber insurance carrier-side, st0023 privacy + data governance (OneTrust / TrustArc / BigID).

Cross-references to st0001-st0006 SaaS arc translated for cybersecurity: st0001 discovery → CONTEXT (board read-out replaces "what are your goals"); st0002 single-threading → COMMITMENT sponsor naming; st0003 objection recovery → 5-STAGE deflection on *"send me a deck"* + *"we already have BitSight"*; st0004 cold-call opener → CONTEXT verbatim; st0005 demo discipline → CADENCE (scoped POC AFTER CONSEQUENCE, CISO-written success criteria); st0006 pricing → CADENCE + COMMITMENT (ELA, multi-year framework).

Cross-reference to st0007-st0014 — what transfers: verbatim language on load-bearing moments + CRM-reviewed coaching cadence. st0007 surgeons hear OR/Evidence/Outcome; st0014 HNW prospects hear FRAME/LIFE/MONEY/GAPS/PATH; st0015 makes CISOs hear CONTEXT/CONTROL MAP/CONSEQUENCE/CADENCE/COMMITMENT.

st0014 is the closest sibling — regulator-overlapped, multi-stakeholder, buyer pitched by many vendors, rep wins by speaking buyer's operating language (Three Pillars there; Three Languages here). What does NOT transfer: cybersecurity requires the deepest TECHNICAL framework fluency (NIST CSF 2.0 subcategory IDs, CIS v8 safeguards, ISO 27001:2022 Annex A) + the highest VENDOR-LANDSCAPE fluency (know the CISO's incumbent EDR + SIEM + identity + GRC + TPRM stack pre-meeting).

The compliance overlay is industry-vertical-specific.

Adjacent Knowledge Library entries: NIST CSF 2.0 walkthrough + CIS v8 IG-level guide + ISO 27001:2022 Annex A + SOC 2 Type II evidence + FedRAMP Moderate vs High + PCI-DSS v4.0 changes + NYDFS Part 500 + SEC cyber rule + DORA + CISA Zero Trust Maturity Model + cyber insurance + BitSight/SecurityScorecard/Panorays/Black Kite TPRM-scoring comparison + CNAPP vs CSPM vs CWPP vs CIEM + CDR/CADR + SSPM vs DSPM.

q9601 fractional CFO maps onto the CFO-as-cybersecurity-sponsor conversation.

Hub: /sales-trainings. Canonical: /sales-trainings/st0015.