Threat Intelligence Selling to the SOC Manager and CTI Lead — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **Threat Intelligence Selling to the SOC Manager and CTI Lead** is a 60-minute training for AEs, SEs, and channel managers running $90K–$650K ACV cycles against incumbents like **Recorded Future**, **Mandiant Threat Intelligence** (Google Cloud), **CrowdStrike Falcon Intelligence**, **Anomali**, **EclecticIQ**, **ThreatConnect**, **Flashpoint**, **Intel 471**, **Silent Push**, and **DomainTools**. The session teaches sellers to qualify against the **three-buyer reality (CISO, SOC Manager, Cyber Threat Intelligence Lead)**, run a structured discovery on **finished-intelligence-to-action economics**, demo against the customer's actual threat surface, and trap-set the multi-year renewal at month 12. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why Threat Intelligence Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. Threat Intelligence (TI) sales are **deeply technical**. The CTI Lead is often a former intelligence analyst from NSA, GCHQ, or military intelligence. Generic feature-pitch tactics fail in the first 5 minutes.

Set the frame on the whiteboard.

- **Three buyers, three priorities.** The CISO funds; the SOC Manager operationalizes; the CTI Lead is the technical evaluator. **Recorded Future's 2026 customer survey** shows 71% of CTI decisions decided by the CTI Lead.
- **Finished intelligence beats indicators-only feeds.** Customers no longer buy IOC feeds alone — they buy **analyst-finished intelligence reports** (PIRs satisfied, attribution, intent assessments).
- **Operationalization is the value metric.** A TI feed that does not integrate with SIEM, SOAR, EDR, and ticketing is shelf-ware. **Recorded Future**, **Mandiant**, and **CrowdStrike Intel** lead on operationalization depth.

End the segment with **Mark Roberge's** rule: *"Sell the analyst hours saved, not the feed volume."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your current TI program — feeds, finished reports, PIR list, integration points."
> 2. **PIR baseline (10 min):** "What's your current priority-intelligence-requirement list — geopolitical, sector-specific, brand-monitoring, executive protection?"
> 3. **Operationalization baseline (10 min):** "What percentage of TI signal is auto-actioned in your SIEM, SOAR, or EDR? Best-in-class is **70%+ auto-actioned**."
> 4. **Finished-intelligence cadence (10 min):** "How many finished intelligence reports does your incumbent deliver monthly? Top quartile delivers **20+ targeted reports**."
> 5. **Attribution depth (8 min):** "Does your incumbent provide attribution down to threat-actor group with confidence ratings? **Mandiant** is the benchmark."
> 6. **Brand-monitoring telemetry (7 min):** "Are you monitoring brand impersonation, executive impersonation, and supply-chain telemetry? **Flashpoint** and **Silent Push** lead."
> 7. **Renewal posture (5 min):** "When is your current TI contract up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CISO + SOC Manager + CTI Lead?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[PIR + Operationalization 20 min]
    E --> F[Finished Intel + Attribution 18 min]
    F --> G[Brand Monitoring + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[POC Connected Within 7 Days]
    I --> J[Joint CTI Lead Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **IOC-feed-only POCs.** **No-PIR-mapping POCs.** **30-day POCs.**

**Wins to coach.** **Custom PIR mapping delivered.** Walk through **Recorded Future's and Mandiant's published POC agendas** — both customize the PIR list per customer before the POC. **Finished intelligence reports delivered weekly.** Deliver **3+ targeted finished reports** within the POC window. **Operationalization demo live.** Show TI signal flowing into the customer's SIEM and SOAR with auto-action workflows.

End with **Andy Paul's** rule: *"Show the customer their analyst time freed, not your feed expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **Recorded Future**, **Mandiant**, and **CrowdStrike Falcon Intelligence** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The operationalization wedge.** Ask the SOC Manager: *"What percentage of your incumbent's signal is auto-actioned? **Top quartile is 70%+**."*

**Counter-move 2 — The attribution-depth wedge.** Ask the CTI Lead: *"Does your incumbent provide threat-actor attribution with confidence ratings? **Mandiant** publishes named-actor attribution publicly."*

**Counter-move 3 — The finished-report cadence wedge.** Ask: *"How many finished reports does

Threat Intelligence Selling to the SOC Manager and CTI Lead — 60-Min Training

Direct Answer

Section 1 — Why Threat Intelligence Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

Threat Intelligence Selling to the SOC Manager and CTI Lead — 60-Min Training

Direct Answer

Section 1 — Why Threat Intelligence Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

What does the score mean?