DevSecOps Tooling Selling to the Head of Platform Engineering — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **DevSecOps Tooling Selling to the Head of Platform Engineering** is a 60-minute training for AEs, SEs, and channel managers running $150K–$1.2M ACV cycles against incumbents like **Snyk**, **GitHub Advanced Security**, **GitLab Ultimate**, **Checkmarx**, **Veracode**, **Sonatype Nexus**, **Mend.io** (WhiteSource), **Wiz Code**, **Aikido**, **JFrog Xray**, **Endor Labs**, and **Semgrep**. The session teaches sellers to qualify against the **three-buyer reality (Head of Platform Engineering, Head of Application Security, CISO)**, run a structured discovery on **PR-merge-time and false-positive economics**, demo against the customer's actual repos, and trap-set the multi-year renewal at month 12. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why DevSecOps Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. DevSecOps tooling is **bought by the Head of Platform Engineering with a CISO co-signature**. The developer experience is the primary metric — a scanner that blocks PR merges with high false-positives drives platform engineering to disable it within 90 days.

Set the frame on the whiteboard.

- **Three buyers, one user experience.** Head of Platform Engineering picks; Head of Application Security operationalizes; CISO funds. **Snyk's 2026 customer survey** shows 67% of decisions decided by Head of Platform Engineering.
- **PR-merge time is the make-or-break metric.** A scanner that adds **30+ seconds** to PR-check time triggers developer revolt. Best-in-class adds **under 8 seconds**.
- **False-positive rate determines adoption.** Above **15% FPR**, developers ignore alerts. **Semgrep** and **Endor Labs** lead on low-FPR static analysis.

End the segment with **Mark Roberge's** rule: *"Sell the PR-merge time saved, not the rule count shipped."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your CI/CD pipeline — repos, languages, build tools, scanners deployed today."
> 2. **PR-merge baseline (10 min):** "What's your current PR-check time impact from security scanning? **Sub-8 seconds added** is best-in-class."
> 3. **False-positive baseline (10 min):** "What's your current FPR on security findings? **Under 15%** is best-in-class; legacy SAST clusters at 40–60%."
> 4. **Coverage baseline (10 min):** "What's covered today — SAST, SCA, secrets, IaC, container, license? Most enterprises need **5+ scan types**."
> 5. **Repo coverage (8 min):** "What percentage of repos are scanned in CI today? **95%+** is best-in-class."
> 6. **Reachability analysis (7 min):** "Does your incumbent prioritize vulnerable dependencies by reachability, or alert on all? **Endor Labs** and **Snyk Reachability** lead here."
> 7. **Renewal posture (5 min):** "When is your current DevSecOps contract up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{Platform Eng + AppSec + CISO?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[PR Time + FPR 20 min]
    E --> F[Coverage + Repo Scan 18 min]
    F --> G[Reachability + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[POC Connected to 5+ Repos Within 5 Days]
    I --> J[Joint Platform Eng Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **Sample-repo POCs.** **No PR-merge-time benchmark.** **No FPR delta vs. Incumbent.**

**Wins to coach.** **Real production repos onboarded.** Walk through **Snyk's and Semgrep's published POC agendas** — both connect to 5+ real production repos in under 5 days. **PR-merge time delta delivered.** Show **PR-check time before/after**. **FPR delta delivered.** Show **FPR before/after** on the same vulnerability set.

End with **Andy Paul's** rule: *"Show the customer their PR queue cleared, not your rule count expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **Snyk**, **GitHub Advanced Security**, and **Checkmarx** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The PR-merge time wedge.** Ask the Head of Platform Engineering: *"What's your incumbent's PR-check time impact today? **Sub-8 seconds** is best-in-class."*

**Counter-move 2 — The reachability wedge.** Ask the Head of Application Security: *"Does your incumbent prioritize vulnerable dependencies by reachability or alert on all CVEs? **Reachability cuts FPR by 60–80%**."*

**Counter-move 3 — The coverage-breadth wedge.** Ask: *"How many scan types does your incumbent cover — SAST, SCA, secrets, IaC, container, license? **5+** is best-in-class."*

Show **Force Management's command-of-the-message** rule: *"Displace on developer experience, not on rule count."*

---

## Section 5

DevSecOps Tooling Selling to the Head of Platform Engineering — 60-Min Training

Direct Answer

Section 1 — Why DevSecOps Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

DevSecOps Tooling Selling to the Head of Platform Engineering — 60-Min Training

Direct Answer

Section 1 — Why DevSecOps Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

What does the score mean?