Andy ITGuy – Information Security Blog

Today Alan Shimel took me out to the wood shed and spanked me! So all in the spirit of good fun we’re gonna go toe to toe and work this out.

My job here is to manage the security program. Part of my responsibilities are to evaluate products and make recommendations based upon the defined requirements and the ability of a product to meet those requirements. My CIO’s job is to manage the entire IT organization and make sure that what we do matches up with the business requirements of the company. He does not evaluate and recommend products. If a sales persons goes to him he sends them the the appropriate department to talk to the SME.

Alan asks “But also who dropped dead and made Andy the single point of contact?”
Andy answers “My CIO made me that point of contact (although he is still living). At least until we are ready to move forward and his input is required.That does make me a gate keeper of sorts but only because that how we do things here.”

Alan asks “Is Andy not only making the technical decisions but the business and financial ones as well?
Andy answers “No, I’m not making the business and financial decisions but I do have significant input into the role of security in the business. That is what Security Managers do. They are given information regarding business needs, goals and requirements and they make decisions and recommendations based upon them.

Alan asks “Is Andy the person signing the checks?”
Andy answers “Again, No. I do work within a budget and also part of my job is to ensure that we are spending our budget dollars wisely. So, that’s kinda like saying what checks get signed.

Alan says “Here is what I have preached to sales people for years. It is imperative that they multi-thread into an account. Knowing the Andy’s of the world is not enough to get the deal done. A good sales person should have relationships with people up and down the organization, including the ability to pick up the phone and speak to the CIO (especially if it is not some Fortune 100 type company). Does Andy really relish his role as the gatekeeper? Is it an ego thing?”
Andy replies “I understand Alan’s point about having multiple levels of contact within a company because there are lots of people out there who will give you the run around instead of being honest and telling you the truth. Especially people in technology because many of them are just not good with people. I think that if you are getting the run around then going up the ladder is a fine plan, but if you have been given multiple valid reasons why this is not the time to move forward and you still try to push forward then you have issues. If I was in sales and really needed to make a sale I surely wouldn’t waste my time trying to sell to a company that has (I’ll say it once again) already given multiple valid reasons why this is not the time to move forward. I’d focus on a sale that I had a chance to make. Not to mention that having relationships also means that you maintain them at ALL levels. Do you really think that you are gaining anything by pushing when you have been told to wait? Is it beneficial to damage a relationship to make one sale? The security community is a small and often tight group of people. I’m amazed that almost everywhere I go I run into someone that knows someone else that I know. You make make a sale here while damaging a relationship but what about the next time we cross paths? The chances are VERY good that it will happen.

Here’s a little story that recently happened to me. I was at a conference and was introduced to someone by a friend. That person happened to work for a company in Atlanta and we exchanged cards. After the conference I was contacted by that person to talk about their product. I met her for lunch along with 2 others from the company. All 3 of them had worked together along with the friend who introduced us. We’re sitting in a restaurant and one of the says “Does any one know where so and so works now?” I said “Yeah, she’s my vendor x rep”. She had also worked with them. Then a few days later I get an email from another vendor rep who said “You remember the rep that I wanted to introduce you to from Vendor Y? Well, he told me that his wife had lunch with you the other day.” She was the one from the first company. It’s a small, small security world.

Alan says: “This salesperson was doing her job. She was not getting anywhere with Andy to her satisfaction and was multi-threading into the account. She could have been more up front with Andy about it, but my feeling is that anytime a security admin or manager “forbids” you from talking to other people in the organization they are overstepping their bounds and sending a message that this is not yet at the level of a real opportunity.
Andy replies: “Alan may have been reading another blog here because I can’t find anywhere in there where I “forbid” her from anything. Maybe he’s just drawing a conclusion. Kinda like the sales person concluded that I was only putting her off because I didn’t want to bother with her or be honest with her. I also question his definition of what her job is. Her job is to sell product. That means that she finds potential clients (me), find out what my needs are, determine what her product can do to meet those needs and convince me that her solution is the best one for my needs. Her job is not to try and make a sale to someone whose job is not to manage security for the company. You don’t go to the CMO to sell accounting software. If this were a small company where the CIO has more input in these decisions it would be different.

Come with me on a little journey. What if she had convinced him to buy her product? Well, that would only happen in one of a couple of ways. First, he decided to make the decision on his own not knowing what the business requirements for this product are. He has no business being CIO. Second, he comes to me and tells me that he wants it and asks for my input. I tell him we don’t need it at the moment, there are more pressing projects and I haven’t decided on a vendor. He still buys it. He has no business being CIO. So we now have a product that we don’t currently need, may not meet all of our requirements, may not be the best fit or the best value for us and I have another piece to force into my security program.
Who wins?
Not me. I’ve now got another product forced on me and I am learning that my input and opinion are not really valuable to the company so why not move on.
Not my CIO. He has lost my respect and possibly my services. Now he has to find someone else to come in and learn the environment, business and everything else.
Not my company. They just spend a lot of money that wasn’t necessary and may not meet their needs.
Not the sales person. She has damaged relationships with a potential customer down the road.
Not the vendor. They have now sold a product that if it doesn’t do as expected or doesn’t meet the business requirements will only cause the customer to have a bad taste in their mouth.
All of this could hav
e been avoided if the sales person simply chose to wait until next year when a “real” decision could be made.

One last thing and then I’ll stop.
Alan said: “I really think it is more about Andy’s ego than any real threat.”
Andy replies: I can assure you that my ego was the least of the things that were hurt. At least from a “who does he think he is?” perspective. I must admit that it was a little bruised because by going “over my head” he basically said “I know that Andy has already spent lots of time and effort telling me all of the reasons why this wouldn’t happen this year but I think he is lying to me so I’m going to go to the CIO and try to sell him my product.” Maybe I’m over reacting a little here but I did tell her why I wanted her to wait and she still thought I was giving her the run around.

This is a continuation of my earlier post. I’m adding to it for a couple of reasons. I wanted to tell more of the story than time permitted on the bus this morning and I received a pretty good comment from a former sales person looking at this from the perspective of a sales person. I’m going to post Sam’s comment and then reply to it while adding more details.

Having been in that (sales) role many times, I have to say that your statement cries out “pigeonhole”. In other words, a statement people would tell a salesperson in order to get them off their back, but without intention of follow up. I can’t tell you how many times I’ve heard someone tell me something similar and never, ever follow through with their word (i.e. will talk to you after the first of the year – yeah, right). I’m just scratching the surface on this comment, though.

On top of this, it sounds to me like you’re making a business decision based on a personal experience with a salesperson. That doesn’t sound like the right thing to do, either. What if the company offered a great solution? You’re going to pass it up because a salesperson ticked you off???

I’m not saying you are, but my experience has been that many customers lie just as much as their sales folks do. Two sides to each coin.

Sam, You make some good points and I realize that you are talking in generalities and not specifics, but I still get to reply because it’s my blog. While I will admit that in the past I have put sales people off by telling them “we’ll talk later” but I also usually tell them “You call me”. That way it’s clear that the ball is in their court. I may not be interested now but in a few weeks or months I may be. I always try and be honest with them and let them know if what they are selling fits any of my needs. If it doesn’t then I tell them “Not now, maybe later”. If I really want their product then if I don’t hear from them w/i the set time period I’ll reach out to them or someone else that can get me the same product.

This case was a little different. She had been pushing me to try and get this ordered before the end of the year. I had told her numerous times that I did not need her product at this time. It would be nice to have and would provide added security. It would also be easier to manage than the 2 or 3 free products that I’m currently using to do the same thing. I had also told her that even if I did want and need it right now that there was no way that I could get it through procurement in time to get end of year pricing. I explained to her that our procurement process is painfully slow and that no matter how important it was or what level of management wanted it things would not speed up to the point to have it approved by end of year. I explained that since it was not a need that I would not be able to get management sponsorship to “rush” it through. I explained that by waiting until next year I was not putting myself in a bad position. I also explained that the company would rather pay more and NOT rush than rush and make a wrong decision. I also explained that I was still evaluating other vendor offerings to meet these needs and that I had NOT made a decision as to which one I would choose. Yet she still made the decision to go to the CIO and try to tell him how much he needed this product. He didn’t even know that I was evaluating products because it’s not high enough on my list to let him know yet.

As for the “making a business decision based on a personal experience with a salesperson” comment you are right. I’m making the conscious decision to not do business with her based on several factors. First, I had made it clear that we were not ready to purchase a product. Second, I had given her a time to get back to me to further discuss this. Third, I had told her that talking to the CIO would produce no results because he does not evaluate and recommend products. Forth, She is extremely pushy. Fifth, She lied to the CIO and told him that I wanted the product and that we had a conference call lined up for the following day. Sixth, she pissed me off. Seventh, there are several other vendors that do the same thing just as well as her product. Now I can get passed number 6 because I’ve been pissed off by sales people before and still bought from them. Not to mention I’ve pissed off my fair share of people in the past. I have a very hard time getting past number 1-4 because I had been clear in making my needs, wishes, desires, etc known. I can’t get past number 5 because the combination of 1-4 plus 5 shows that she has very little personal integrity. If she is willing to lie and go behind my back to make a sale how can I be expected to trust her in what she is telling me regarding the product, service, etc… (Lets not go into the “everyone lies” bit b/c even though any lie is not good there are limits).

This will be short and to the point. If you WANT to sell me your product do NOT do the following.

Call my CIO and try to convince him that he needs your product AFTER I have told you to wait until after the first of the year to talk more with ME about this!

I don’t know if this sales person reads my blog or not but if you do you have absolutely no chance of selling me your product now. Not here. Not at any other company that I may work for in the future.