SIEM Software Selling to the Enterprise CISO — 60-Min Training

Stack You'll Run This Training Inside

Every AE in the room operates inside the standard RevOps stack. Reference these tools by name during the training so reps know which dashboard or workflow you mean. Pin the dashboard you'll inspect in Gong on a shared screen before the meeting starts, queue the most recent recording from Outreach as the coaching artifact, and have Clari open in a second tab for the post-meeting cadence updates. The manager who shows up with these three browser tabs ready saves 8 minutes of meeting setup.

• Gong at $1,600/user/year — call recording + AI coaching insights
• Chorus at bundled with ZoomInfo at $1,200/user/year — call recording within the ZoomInfo stack
• Outreach at $150/seat/month — sequence + cadence engine for follow-ups
• Salesloft at $125/seat/month — cadence + Drift conversation routing
• Clari at $75-$150/user/month — forecast accuracy + deal inspection
• Highspot at $58/user/month base, content-volume-tiered — sales enablement + playbook delivery

Benchmark Context

IDC ("Worldwide Sales Enablement Spending Tracker, 2026") reports that enterprise sales orgs spent $4.7B on structured manager training programs in 2026, growing 18% YoY. Anchor the training narrative on this stat — it's the credibility frame that turns a 60-minute meeting from "another sales pep talk" into "the weekly working session the manager is measured on." Print the stat at the top of the meeting agenda; reps remember the number, and quoting it builds the same shared vocabulary that Lessonly, Spekit, and Highspot all flag as the top predictor of multi-quarter training-program ROI in their 2026 customer benchmarks.

Section 1 — Why SIEM Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. SIEM is the single biggest line item in most security budgets — $3M–$22M annually at Tier-1 enterprises. Every renewal now involves the customer's FinOps team alongside security. The selling motion has changed.

Set the frame on the whiteboard.

• Three buyers, three priorities. The CISO measures detection coverage; the Head of FinOps measures cost-per-GB and total cost of ownership; the Detection Engineering Lead measures active-rule throughput. ESG's 2026 survey shows 41% of SIEM renewals now go through a formal cost-justification cycle.
• Per-GB pricing is on every CFO's audit list. Customers paying $3–$5 per GB hot-tier ingest are repricing or replacing at every renewal. Sellers without a credible cost-reduction story lose pricing power.
• Cloud-data-lake competition is real. Snowflake, Databricks, Google Chronicle, and Anvilogic now wrap detection-as-code over object storage at a fraction of legacy SIEM cost. Pretending the threat doesn't exist loses deals.

End the segment with Mark Roberge's rule read aloud from *"The Sales Acceleration Formula"*: *"Sell to the metric the CFO is auditing, not the metric your product team is shipping."*

---

Section 2 — The 60-Minute Discovery Block (15 min)

The discovery cadence the room must practice — verbatim. Pair AEs and roleplay — one plays the CISO, one plays the seller. The script:

> 1. Opening (3 min): "Walk me through your last 12 months of SIEM spend, ingest volume growth, and detection content additions. Where did the budget actually go?" > 2. Ingest baseline (10 min): "What is your daily ingest volume today by source — endpoint, identity, cloud workload, SaaS audit logs, OT? 800 GB/day is the 2026 enterprise benchmark; 2.5 TB/day is the Fortune-100 benchmark. Where are you?" > 3. Price-per-GB baseline (10 min): "What is your effective price per GB on the incumbent today after volume discounts? $1.50–$2.50/GB is the going rate; legacy Splunk customers often see $4+/GB without renegotiation." > 4. Storage tier mix (10 min): "What is your hot/warm/cold mix today? 40/35/25 is healthy; many enterprises still run 70/25/5 and pay for it. Where do you sit?" > 5. Detection content (10 min): "How many active detection rules do you run in production today? 400–700 active rules is best-in-class; below 250 correlates with 3x churn risk. What's your count?" > 6. Onboarding posture (7 min): "How long did your incumbent take from contract signature to first production dashboard? 45 days or less is best-in-class." > 7. Renewal posture (5 min): "When does your current SIEM contract expire? What contractual extraction friction would we need to navigate?"

Coach the room on the one-skill rule — every AE picks one inspection block per quarter. Force Management's playbook insists on one habit per call.

---

Section 3 — The POC That Wins (15 min)

The Proof of Concept is where SIEM deals are decided. Walk the room through three failure modes and three wins.

Failure modes to ban.

• Sample-data POCs. Demos on the vendor's sample data do not convince the Detection Engineering Lead.
• 30-day POCs. Too short to capture meaningful ingest patterns. Push for 60–90 days.
• Single-source POCs. Ingesting only endpoint data, not identity and cloud workload, fails to convince the CISO of full-estate coverage.

Wins to coach.

• Customer's real telemetry, sampled. Walk through Microsoft Sentinel's and Elastic Security's published POC agendas — both require the customer to send 30+ days of representative production telemetry.
• Side-by-side cost-per-GB. Show the customer's current $3+/GB cost vs. your modeled $1.80/GB on their data. Quantify the annual savings at their growth rate.
• Detection-content portability demo. Show how the customer's existing Sigma rules and KQL detections migrate to your platform. Detection-content portability is the single biggest objection in 2026.

End with Andy Paul's rule from *"Sell Without Selling Out"* — *"Show the customer their TCO reduced, not your platform expanded."*

---

Section 4 — Handling the Incumbent Trap (10 min)

The room will face Splunk in seven out of ten enterprise deals and Microsoft Sentinel in the rest. Coach the room on the three counter-moves.

Counter-move 1 — The cost-curve wedge. Ask the Head of FinOps: *"What is your incumbent's published roadmap for moving 60%+ of your data to cold tier? If the answer is unclear, FinOps will run the TCO model and present alternatives at next QBR."*

Counter-move 2 — The detection-content portability wedge. Ask the Detection Engineering Lead: *"How many of your custom Sigma rules and KQL detections would migrate to a new platform without rework? Panther and Anvilogic publish detection-as-code portability tooling. If your incumbent doesn't, why not?"*

Counter-move 3 — The onboarding-velocity wedge. Ask the CISO: *"How long did your incumbent take from go-live to first production dashboard? Best-in-class is 45 days. If your incumbent took 120+ days, the customer-success cost is hidden in your subscription."*

Show Force Management's command-of-the-message rule: *"Displace on the customer's audit list, not your feature list."*

---

Section 5 — Pricing Conversation and Procurement (10 min)

Coach the room through the three pricing landmines.

Landmine 1 — Per-GB-only vs. multi-SKU pricing. Per-GB pricing is dying. Layer per-asset, per-rule, and per-outcome SKUs on top to capture value the per-GB SKU cannot.

Landmine 2 — The reserved-capacity discount trap. Reserved-capacity discounts that lock the customer into 3-year commitments without elasticity backfire. Offer commitment-tier pricing with ingest banding instead.

Landmine 3 — The procurement-only meeting. When procurement requests a meeting without the CISO and Head of FinOps present, refuse. Force Management's playbook calls this the "no procurement-only" rule.

---

Section 6 — The Trap-Set for Renewal at Month 24 (5 min)

The renewal sale begins on day one. Coach the room on the four month-24 trap-sets.

Trap-set 1 — Live dashboard at day 45. Land the first production dashboard within 45 days of go-live. The number locks in the onboarding velocity narrative for the renewal.

Trap-set 2 — 400 active rules by month 9. Land 400+ active detection rules within 9 months. Below 250 is renewal-risk red.

Trap-set 3 — Cold-tier migration completed. Land 40%+ of storage in cold tier within 12 months. The migration becomes the FinOps win story at QBR.

Trap-set 4 — FinOps co-built dashboard in QBR. Build the cost-per-GB and tier-mix dashboard into the QBR from day one. By month 24, the dashboard is the renewal narrative.

Close the session by reading Jeb Blount's rule from *"Fanatical Prospecting"* aloud: *"The renewal is sold on day one, not on day 365."*

---

Related on PULSE

• [Top 10 sales enablement drills for enterprise software reps](/knowledge/st0638)
• [Top 10 sales training workshops for enterprise software teams](/knowledge/st0637)
• [Identity Verification (IDV) Software Selling to Fintechs and Banks — 60-Min Training](/knowledge/st383)
• [Fraud and AML Software Selling to Tier-1 and Tier-2 Banks — 60-Min Training](/knowledge/st382)
• [Manufacturing ERP Software Selling — 60-Min Training](/knowledge/st349)
• [AI Safety / Red Team Services Selling to the CISO — 60-Min Training](/knowledge/st412)

FAQ

What is the typical deal size for enterprise SIEM sales? Deal sizes in this space usually range from $400K to $8M in annual contract value (ACV), depending on the customer’s data volume and retention needs. Expect multi-year commitments, often 3 to 5 years, with initial pilots starting around $100K–$300K.

How long does a typical SIEM sales cycle take? The cycle from first contact to close generally spans 6 to 18 months for enterprise deals. This includes discovery, proof-of-value, procurement, and security reviews, with larger deals often taking longer due to multi-stakeholder alignment.

Who are the key decision-makers in an enterprise SIEM purchase? You’ll usually need to engage three distinct buyers: the CISO (security strategy), the Head of FinOps (budget and pricing model), and the Detection Engineering Lead (technical fit and daily use). Each has different priorities and must be convinced separately.

How do you handle price-per-GB and storage-tier objections? Focus on the customer’s actual ingest profile and retention tiers, not just a flat per-GB rate. Ask about their hot, warm, and cold storage split, then model how your pricing aligns with their data lifecycle—often revealing that a seemingly higher per-GB cost is cheaper overall.

What is the best time to start the renewal conversation? Begin discussing renewal around month 24 of a 36-month contract. This gives you a full year to address any dissatisfaction, demonstrate value, and trap-set the renewal before competitors get a chance to disrupt.

How do you differentiate from incumbents like Splunk or Microsoft Sentinel? Highlight your unique strengths—such as lower total cost for high-volume environments, faster query performance, or simpler deployment. Avoid attacking competitors directly; instead, show how your solution fits their specific ingest and detection needs better.

Sources

• Gartner — Magic Quadrant for Security Information and Event Management (2026)
• Forrester — The Forrester Wave: Security Analytics Platforms (2026)
• IDC — Worldwide SIEM Market Tracker and Forecast (2026)
• ESG — Cost of SIEM and FinOps Pressure Survey (2026)
• Microsoft — Sentinel Pricing and Commitment Tier Documentation
• Splunk — Cisco Acquisition Investor Briefings (2026)
• Force Management — Command of the Message and MEDDPICC Reference (2026)
• Mark Roberge — "The Sales Acceleration Formula" Premium-Pricing Chapter
• Andy Paul — "Sell Without Selling Out" Discovery Cadence
• Jeb Blount — "Fanatical Prospecting" Renewal-First Doctrine