Mobile Threat Defense (MTD) Selling to the CISO and Endpoint Management Lead — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **Mobile Threat Defense (MTD) Selling to the CISO and Endpoint Management Lead** is a 60-minute training for AEs, SEs, and channel managers running $75K–$550K ACV cycles against incumbents like **Lookout**, **Zimperium**, **Check Point Harmony Mobile**, **Pradeo**, **Wandera** (Jamf), **Microsoft Defender for Endpoint Mobile**, **MobileIron** (Ivanti), **NowSecure**, **BlackBerry CylanceMOBILE**, and **Quokka** (Kryptowire). The session teaches sellers to qualify against the **three-buyer reality (CISO, Endpoint Management Lead, BYOD/Compliance Officer)**, run a structured discovery on **mobile-phishing and supply-chain-app economics**, demo against the customer's actual mobile fleet, and trap-set the multi-year renewal at month 12. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why MTD Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. Mobile Threat Defense is the **forgotten endpoint** — most enterprises invest heavily in laptop EDR while leaving 30,000+ corporate mobile devices unprotected beyond MDM. Mobile is the new attack surface.

Set the frame on the whiteboard.

- **Three buyers, one blind spot.** CISO funds; Endpoint Management Lead picks; BYOD/Compliance Officer defends the privacy posture. **Lookout's 2026 customer survey** shows 73% of MTD purchases driven by a recent mobile-phishing or sideloaded-app incident.
- **Mobile phishing dwarfs desktop phishing.** **Lookout's 2026 Mobile Threat Report** shows **52% of users tap phishing links on mobile** vs. 8% on desktop. The CISO buys the mobile-phishing-catch metric.
- **MDM is not MTD.** **Intune, Jamf, MobileIron, Workspace ONE** manage devices; they do not detect threats. The CISO must explain the difference to the CFO.

End the segment with **Mark Roberge's** rule: *"Sell the mobile phishing prevented, not the device managed."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your mobile fleet — corporate vs. BYOD, iOS vs. Android, MDM vendor, security incidents in the last 24 months."
> 2. **Mobile-phishing baseline (10 min):** "What's your current mobile-phishing detection rate? **52% of users tap mobile phishing** per Lookout 2026."
> 3. **Sideloaded-app coverage (10 min):** "Are you detecting sideloaded apps and supply-chain-compromised apps? **Quokka** and **NowSecure** lead app vetting."
> 4. **MDM-MTD integration (10 min):** "Which MDM are you on — Intune, Jamf, MobileIron, Workspace ONE? Integration depth matters."
> 5. **BYOD posture (8 min):** "What percentage of your fleet is BYOD? Privacy-preserving MTD is required for BYOD compliance."
> 6. **OS-level threat coverage (7 min):** "Are you detecting OS-level threats — jailbreak, root, vulnerable OS versions? Most enterprises miss this."
> 7. **Renewal posture (5 min):** "When is your current MTD or MDM contract up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CISO + Endpoint Lead + BYOD?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[Phishing + Sideload 20 min]
    E --> F[MDM Integration + BYOD 18 min]
    F --> G[OS Threats + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[POC Deployed on 100+ Devices in 5 Days]
    I --> J[Joint Endpoint Lead Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **Sample-device POCs.** **No mobile-phishing test traffic.** **No MDM integration demonstrated.**

**Wins to coach.** **100+ corporate devices deployed.** Walk through **Lookout's and Zimperium's published POC agendas** — both deploy on a representative 100–500 device sample. **Phishing simulation live.** Run mobile-phishing simulations and deliver detection scorecards. **MDM-MTD integration demo.** Show conditional-access policy enforcement live with the customer's MDM.

End with **Andy Paul's** rule: *"Show the customer their mobile blind spot eliminated, not your detection rule count expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **Lookout**, **Zimperium**, and **Microsoft Defender for Endpoint Mobile** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The phishing-detection wedge.** Ask the CISO: *"What's your incumbent's mobile-phishing detection rate today? **Lookout** publishes 95%+ on novel mobile phishing."*

**Counter-move 2 — The Defender-gap wedge.** Ask: *"Defender for Endpoint Mobile covers Android well; how does it perform on iOS? **iOS coverage is the gap**."*

**Counter-move 3 — The BYOD-privacy wedge.** Ask the BYOD/Compliance Officer: *"Does your incumbent provide privacy-preserving telemetry that meets GDPR and Schrems II requirements? **Zimperi

Mobile Threat Defense (MTD) Selling to the CISO and Endpoint Management Lead — 60-Min Training

Direct Answer

Section 1 — Why MTD Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

Mobile Threat Defense (MTD) Selling to the CISO and Endpoint Management Lead — 60-Min Training

Direct Answer

Section 1 — Why MTD Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

What does the score mean?