AI Safety / Red Team Services Selling to the CISO — 60-Min Training

The account that stalls at the scoping call

A representative deal in this category looks like this. An enterprise financial services firm has shipped three production LLM applications in eighteen months: a customer service assistant, an internal document search tool, and a claims-summarization pipeline. The CISO learns about the third one from a slide in a board deck, not from a security review. Two weeks later a red-teaming blog post shows a jailbreak on a similar architecture at a competitor. The CISO opens a search for AI red team services with a budget number that is real but soft — somewhere between $80K and $250K depending on what the scope turns out to be.

The AE takes the first call, hears "we need AI red teaming," and sends a proposal for a point-in-time assessment: four weeks of adversarial testing, a findings report, a readout deck. It is a clean, defensible $95K engagement. It also loses, or wins and dies at renewal, for a specific structural reason: nobody in the buying committee owns the outcome of that report.

Here is the committee as it actually exists. The CISO owns the budget line and the risk register. The Head of AI or VP of ML Platform owns the systems being tested and controls whether the engagement gets environment access — which means they control whether the work is real or theatrical. The Compliance or GRC lead owns the regulatory framing (EU AI Act obligations, NIST AI RMF alignment, SOC 2 scope questions about AI systems) and, critically, owns the artifact that survives past the engagement. Some accounts add a fourth: the frontier-model vendor relationship owner, usually inside the platform org, who has a contractual relationship with Anthropic, OpenAI, or Google and needs to know whether testing violates any acceptable-use terms.

The stall happens because the AE ran a single-threaded cycle with the CISO. The CISO can approve $95K. The CISO cannot, on their own, get the ML platform team to grant model access to an outside tester during a quarter when that team is shipping. The deal enters a two-month access negotiation that the AE cannot see, and it is scored as "verbal, waiting on legal" in the forecast the entire time.

The second failure mode is subtler and shows up twelve months later. The engagement runs, the report lands, it contains fourteen findings across prompt injection, training-data leakage, and insecure output handling. The customer fixes six of them. At renewal, the CISO asks a reasonable question: "What am I buying this year that I didn't already get?" A point-in-time vendor has no good answer. A vendor who sold a retainer with a quarterly probing cadence has an obvious one — the model changed, the system prompt changed, the RAG corpus changed, and three of the fourteen findings were re-introduced by ordinary shipping. That is the whole renewal argument, and it has to be sold in month one or it does not exist.

The practical implication for a 60-minute Training session: the first fifteen minutes should not be about the product. They should be about the shape of the committee and the difference between selling a report and selling a cadence. Reps who internalize that distinction stop writing one-shot proposals, which is the single highest-leverage behavior change available in this category.

How the discovery and scoping mechanism actually works

The mechanism that converts an incident-driven inbound into a scoped retainer runs in four stages. Each stage has an exit condition, and skipping one pushes the failure into the next stage where it costs more.

Stage one: multi-threaded pre-brief. Forty-eight hours before the discovery call, the AE emails a one-page scoping worksheet to all three named stakeholders. The worksheet asks for four things: a list of production AI systems with deployment dates, any prior red-team or pentest activity touching those systems, the modalities in scope (text only, or image/audio/video), and the compliance frameworks the organization is being measured against. The purpose is not the data — it is forcing the three stakeholders to have a five-minute conversation with each other before they talk to you. If the worksheet comes back with contradictory answers about how many production systems exist, that contradiction is your most valuable discovery artifact.

Stage two: the sixty-minute discovery. Structure it as a fixed agenda, not a conversation that wanders:

• Opening, 5 minutes. "Walk me through your production AI systems and what triggered this search." The trigger matters. A near-miss incident, a regulator letter, a customer security questionnaire, and a board question each produce a different urgency curve and a different budget ceiling.
• OWASP LLM Top 10 self-score, 12 minutes. Put the ten categories on screen and have the group rate their own exposure. You are looking for the gap between what the Head of AI rates and what the CISO rates. That gap is the deal.
• Existing testing activity, 10 minutes. "Who has tested these systems, and what was the scope?" Most accounts have had a traditional application pentest that touched the API surface and never probed the model. Naming that distinction precisely is how you earn credibility with the Head of AI.
• Multi-modal scope, 10 minutes. Image, audio, and video inputs expand the attack surface substantially and are the most common thing an incumbent generalist firm does not cover.
• Frontier-vendor relationships, 8 minutes. Which model providers are under contract, whether those contracts include any testing restrictions, and whether the account has an enterprise agreement that already includes some safety tooling.
• Compliance posture, 10 minutes. EU AI Act classification if they operate in the EU, NIST AI RMF alignment, whether AI systems are in SOC 2 scope, and what artifact an auditor will ask for.
• Retainer posture, 5 minutes. "How do you currently fund ongoing security testing versus project work?" This question determines whether a retainer is a budget-structure conversation or a budget-creation conversation.

Stage three: the scoping workshop. Book it inside five business days of discovery, while urgency holds. This is where scope becomes a number: systems in scope, modalities, depth of probing, environment access model, reporting cadence.

Stage four: proposal with a cadence. Not a report — a program with a first-quarter deliverable and a recurring probe schedule.

The exit condition that reps skip most often is the one in the middle: environment access path identified. If nobody in the room can name the person who grants access to a staging environment with production-representative data, the proposal will sit unsigned regardless of how good it is. Ask it explicitly, get a name, and put that name in the CRM as a required contact.

The numbers a rep actually needs to hold

Be careful here — this category has less public benchmark data than most, and quoting a fabricated statistic to a CISO is a credibility event you do not recover from. What follows is deal-structure arithmetic a rep controls, not third-party market research.

Deal shape. Engagements in this space commonly run from the low tens of thousands for a single-application assessment up to seven figures for a multi-system, multi-modal program with a standing retainer. Your own pricing sheet is the authority; the number to internalize is the ratio. A one-shot assessment priced at X typically supports a retainer of roughly 1.5X to 2.5X of annualized value for the same account, because the retainer covers re-probing after model updates, new-system onboarding, and advisory hours. If your average one-shot is $95K, the retainer conversation is a $150K–$240K conversation. That delta is why the retainer framing matters more than any discovery technique.

Time allocation inside the sixty minutes of Training. Five minutes on why this category differs, fifteen on the discovery structure, fifteen on scoping, ten on the incumbent, ten on pricing, five on renewal trap-sets. Reps retain the discovery agenda if they role-play it once in the session; they do not retain it from a slide.

Cycle length. Incident-triggered cycles compress dramatically — a near-miss can move an account from first call to signature in three to five weeks. Regulator-driven and budget-cycle-driven searches run one to two quarters. Forecast them differently. The most common forecasting error is applying the incident-cycle velocity assumption to a compliance-driven deal, which produces a quarter of slipped commits.

Coverage math for scoping. The OWASP Top 10 for LLM Applications gives you ten named categories. Scope in terms of coverage against that list, per system, per modality. A concrete scope line reads: "Three production systems, text and image modalities, full coverage against all ten OWASP LLM categories, with prompt injection and insecure output handling probed at depth." That sentence is worth more than three pages of methodology narrative, because Compliance can paste it into an audit response.

Retainer cadence. Quarterly is the defensible default. Monthly probing is hard to staff and hard for the customer to absorb — findings arrive faster than remediation capacity, and the customer starts ignoring reports, which kills renewal. Annual is indistinguishable from a one-shot. Quarterly matches the rhythm at which most organizations actually ship model and prompt changes.

Discount authority. Multi-year retainers justify tiered discounts — a common structure is a modest year-two reduction and a larger year-three reduction on a three-year MSA, contingent on something you get in return: case-study rights, a reference call quota, or a logo usage grant. Never give the tier without the trade. Reps who discount unilaterally train the account to expect it at every renewal.

Verification. Every price, discount tier, and SLA number a rep quotes should come from the current internal pricing sheet, not from memory or from a competitor's published page. Confirm before the pricing call.

Trade-offs against the incumbent and the alternatives

You are rarely selling against nothing. Four alternatives compete for the same budget, and each needs a different counter.

Alternative one: the existing application pentest vendor. The account already pays a well-known offensive security firm for annual application testing, and that firm has added an "AI testing" line to its statement of work. The honest wedge is scope depth, not competence: a generalist pentest typically probes the API and infrastructure around a model and treats the model itself as a black box. Ask the specific question — "Did their report include adversarial prompt testing against your system prompt, and did it cover training-data or retrieval-corpus leakage?" — and let the answer do the work. If they did cover it well, say so and reposition to cadence rather than depth.

Alternative two: build it internally. Larger AI-native organizations staff their own red teams. This is a legitimate choice and arguing against it wholesale makes you look self-interested. The real trade-off is independence and breadth: an internal team knows the system better than you ever will, and is also the team that built it, which is exactly the blind spot external testing exists to cover. Auditors and regulators generally weight independent assessment differently from self-assessment. Position as complement, not replacement — an external quarterly probe validating internal continuous work is an easier sell than displacement.

Alternative three: a tooling purchase instead of a service. Several vendors sell AI security platforms and runtime guardrails — HiddenLayer, Lakera, Protect AI, Robust Intelligence, and Cranium AI are recognized names in this space, positioned variously around model security, guardrail APIs, ML supply-chain security, and AI risk posture. A CISO under budget pressure may prefer a platform line item over a services line item. The counter is not that tooling is bad; it is that tooling enforces policy and services discover what the policy should be. Scanning tools find known patterns. Adversarial human testing finds the thing nobody wrote a detector for. Most mature programs run both, and the sequencing argument — assess first, then instrument against what you found — is usually the honest one.

Alternative four: do nothing this quarter. The most common competitor. The counter is never fear-based; CISOs are professionally immune to vendor fear. It is the compliance calendar. If the account has an EU AI Act obligation, a SOC 2 audit window, or a customer security questionnaire that now asks about AI systems, the do-nothing option has a dated cost. Find that date in discovery and let it set the timeline.

The disqualification branch matters. In a category where the buyer is a security professional, an AE who says "based on what you've shown me, your current coverage is adequate for these two systems — call me when the multi-modal work ships" gets the next deal. Reps under quota pressure skip this and carry dead pipeline for two quarters.

Pitfalls that kill these cycles, and the fix for each

Selling the report instead of the program. Covered above, and it is the number one pitfall, so it earns a place in the pitfall list too. Fix: never send a proposal whose only deliverable is a document. Every proposal has a first deliverable and a recurring cadence, even if the recurring portion is small in year one.

Letting procurement negotiate alone. In services deals, procurement's only lever is rate and hours, so a procurement-solo negotiation always compresses scope. Fix: a standing policy that pricing conversations include the CISO and the economic buyer. Deliver it as a category norm, not as an ultimatum: "We don't single-thread pricing on security programs — the scope trade-offs need the person who owns the risk in the room." Reps need this exact sentence in the Training session because they will not invent it under pressure.

Overpromising coverage in the proposal. Writing "comprehensive AI security assessment" into a statement of work creates an unbounded obligation. Fix: scope by named system, named modality, and named framework categories. Specificity protects delivery margin and makes the renewal expansion conversation possible — you cannot expand a scope that was already described as comprehensive.

Ignoring the frontier-vendor terms. If the account uses a hosted model under an enterprise agreement, testing may touch acceptable-use provisions. Fix: raise it in discovery, before scoping. It signals maturity, and finding it late converts a signed deal into a legal review.

Delivering findings without remediation guidance. A list of vulnerabilities with no prioritization or fix path lands on an already-overloaded platform team and produces resentment rather than renewal. Fix: every finding ships with severity, exploitability in their specific deployment, and a concrete mitigation. The Head of AI is the renewal's silent voter.

Treating the Head of AI as a blocker. Reps who route around the platform team because "the CISO owns the budget" lose access and lose the technical champion simultaneously. Fix: give the Head of AI something they want — early visibility into findings, no surprises in the readout, and credit in front of the CISO for systems that tested clean.

No adoption or engagement signal before renewal. If the only touchpoint between quarterly reports is an invoice, renewal is a coin flip. Fix: a short monthly scorecard call, fifteen minutes, showing what changed in their systems and what the next probe will target.

Cover art and collateral drift. A small but real one for sales enablement: training decks and page covers built for this topic get reused across unrelated security categories and stop matching the content. Keep the asset tied to the topic it was made for.

Related questions

Should the first engagement be a paid pilot or a full assessment?

A scoped paid pilot on one production system, delivered in two to three weeks, outperforms a free proof of concept. Free work gets deprioritized by the platform team and produces no urgency. A small paid scope creates access, a real finding, and a natural expansion conversation.

Who signs — the CISO or the Head of AI?

The CISO almost always signs. The Head of AI decides whether the engagement is real by controlling environment access, and the Compliance lead determines whether the output has a second life in an audit. Sell to all three; route signature through the CISO.

How do I handle "our model vendor already handles safety"?

Acknowledge it as partly true — frontier providers do substantial safety work at the model layer. Then redirect to the application layer: system prompts, retrieval corpora, tool-calling permissions, and output handling are all customer-owned surface that no model provider tests for them.

What does a good statement of work actually name?

Named systems, named modalities, named framework categories, environment access model, reporting cadence, and an explicit exclusions list. The exclusions list is what makes expansion possible later and what protects your delivery team from unbounded scope.

Is quarterly probing overkill for a small AI footprint?

For one or two low-risk internal systems, semi-annual can be honest. Say so. Selling a quarterly cadence into an account that ships model changes twice a year produces a renewal conversation you will lose on value grounds.

FAQ

How long should the training session actually run?

Sixty minutes, split roughly five on category differences, fifteen on discovery structure, fifteen on scoping, ten on the incumbent, ten on pricing, and five on renewal trap-sets. Include one live role-play of the discovery agenda — reps retain the sequence from practicing it once, not from reading a slide.

What is the single most common reason these deals stall?

No identified environment access path. The CISO approves budget, but the platform team controls access to systems with production-representative data. If discovery ends without a named person who can grant that access, the deal sits in legal-and-access limbo for months while the forecast says "verbal."

Should reps quote specific vendor prices from competitors?

No. Quote your own current pricing sheet and nothing else. Competitive pricing in this category is deal-specific and rarely published accurately; a rep who quotes a wrong competitor number to a CISO loses technical credibility permanently and hands the incumbent an easy correction.

How do I frame the OWASP LLM Top 10 without sounding like a checklist vendor?

Use it as a shared vocabulary for scoping, not as the methodology. The value is that Compliance can map your coverage statement directly into an audit response. The testing itself should go deeper than any published list, and saying that plainly is what separates you from checkbox competitors.

What belongs in the first quarterly report to set up renewal?

Severity-ranked findings, exploitability described in their specific deployment, concrete mitigations, and a short section on what changed in their environment since scoping. That last section is the renewal argument in embryo — it demonstrates that the attack surface moves and that a point-in-time assessment decays.

Is multi-modal coverage worth scoping if the customer only ships text today?

Scope it as a priced option, not as included work. Customers who plan image or audio features within a year will take it; customers who do not will remember that you offered rather than assumed. Either way you have created a defined expansion path for the year-two conversation.

Sources

• https://owasp.org/www-project-top-10-for-large-language-model-applications/
• https://www.nist.gov/itl/ai-risk-management-framework
• https://csrc.nist.gov/pubs/ai/100/2/e2025/final
• https://artificialintelligenceact.eu/
• https://atlas.mitre.org/
• https://www.cisa.gov/ai
• https://www.ncsc.gov.uk/collection/machine-learning
• https://www.anthropic.com/research
• https://www.sans.org/cyber-security-courses/

Related on PULSE

• MDR (Managed Detection and Response) Services Selling to Mid-Market — 60-Min Training
• Penetration Testing Services Selling to Tier-1 Enterprises — 60-Min Training
• Post-Quantum Cryptography (PQC) Crypto-Agility Selling to the CISO and Chief Cryptographer — 60-Min Training
• Hardware Security Module (HSM) Selling to the CISO and Cryptography Lead — 60-Min Training
• Merchant Services and POS Selling — 60-Min Training