The vast majority of cyber deals die at the budget allocation, says Adam Anderson, co-founder of Threat Captain, a cybersecurity sales enablement platform. They fail because somewhere between the IT person who understood everything and the CFO who controls the checkbook, your message got lost in translation. But those checkbooks are open.
- According to CyVent, hybrid MSP/MSSP firms reported an average monthly recurring revenue of $8,900 per security client in 2024, more than double the revenue generated from traditional IT clients.
- A ConnectWise survey showed 57% of SMBs said cybersecurity is their #1 priority, up from 43% in 2024—and nearly half would switch providers for a stronger cybersecurity solution.
The money is there. The demand is there. So why are so many deals dying before they reach the finish line?
The Nerd Trap
"Most people get into cybersecurity, we think in a particular way," Anderson said. "Our brains operate in a fairly logical way, and it's baffling to us when we show a logical risk that needs to be addressed, and the business people don't immediately make the jump to want to do something about the data we show them. What actually happens is there's a translation problem. It's not that they aren't concerned, it's that they are confused with our messaging."
So, don’t assume the job is done when you have a great conversation with their IT director and another tech person who gets everything you're saying. You leave thinking the deal is locked. But that IT person doesn't speak business either, or they have no idea how to frame the case to leadership. Unfortunately, your champion was never equipped to carry the message forward.
Friendship Isn't Trust
Cybersecurity conversations should be uncomfortable, says Will Brooks, vice president of wholesale at Ukon, a cyber insurance broker. You're talking about risk, about what happens when things go wrong, about spending money to prevent threats that haven't materialized yet. Therefore, it’s important not to confuse relationship building with friendship building. "We trick ourselves into thinking that if I just make a really good friend with this person, then when the need finally arises, they'll come back around to me."
That approach might grow your business to $5 million in 20 years. It won't hit your sales targets this quarter. Real advisory relationships require permission to be uncomfortable, to challenge assumptions and to have hard conversations. If you're not uncovering actual problems, you're just vibing. People need more than vibes to justify spend.
Quotas Without Playbooks.
Another pattern that probably sounds familiar: Management sets a quota. That's it. No direction on how to get there, no key performance indicators to track, no playbook to follow.
"That is probably the biggest issue we run into," Brooks said. "You have a bunch of nerdy people who want to sell cyber. Awesome. You have really vibrant, awesome people who can connect with others. Great. Now go sell cyber and hit this much money without any sort of direction on how to do so."
But KPIs aren't quotas. They're the breadcrumbs that tell you whether your system is working:
- How many discovery calls are you booking?
- How many prospects are moving to the second conversation?
- What percentage are getting budget approval?
These and other clear guidelines help guide what kinds of conversations cyber sales requires and shouldn’t be left to sales staff to develop on their own.
Show Cost Right Up Front
Saving the pricing for the last slide is a great way to kill your pitch, Brooks says. He says ITSPs build excitement with features and benefits, and then: "Oh yeah, and it's going to be this much a month."
Instead, "Tell me what I'm going to pay initially and then get me excited about why," Brooks said. "Justify why it costs that. That totally changes the way you think about it." Additionally, focus on the numbers that move deals. Business owners don't buy on impact; they buy on likelihood, Anderson says. You can show them a scary number about potential breach costs, but if they don't believe it's likely to happen to them, they won't act.
"If a cyber incident seems scary but not likely, they're going to be very hesitant to deploy capital on it,” Anderson said. This is where most risk assessments fail. You show them the holes in their posture, list all the vulnerabilities and it just doesn't land. That’s because buyers don't know how to think about the information.
Anderson suggests reframing the conversation around the different ways attackers can get in. The MITRE ATT&CK framework identifies 14 tactics adversaries use to breach organizations. Explain those as doors that need locks, and the conversation shifts easily from abstract risk scores to something a business owner can visualize, quantifiable business impact they can actually engage with.
Downtime is another cost that helps close cyber deals. Ask them: If you were down for an hour, what would that cost you? That question opens doors to the COO, to real business conversations, to discussions about disaster recovery that make sense in their world. Now they're thinking about lost productivity, interrupted operations, the scramble to get back online.
Worth Remembering
Translate cyber risk into business risk. Come with data but come ready to collaborate. The goal isn't to have the right answer, but to start a conversation where the prospect helps you understand what the right answer looks like for their business. And you help them grasp cyber risks and costs in tangible, motivating ways. A few reminders before your next call:
- Stop selling to the IT person alone
- Lead with price
- Track KPIs, not just quotas
- Sell likelihood, not impact
When you do that, you're advising. And advisors get a budget, not crickets.
GTIA members, get more sales tips and tactics on the Member Portal!
Not a GTIA member yet?Join now.
