Is Any Security Marketing NOT Bullshit?

In this episode of Unspoken Security, host AJ Nash sits down with Emily Phelps, Director of Marketing Communications at CYWARE. They dive into the core challenges and strategies in cybersecurity marketing. Emily emphasizes the importance of not just attracting customers but ensuring they are the right fit to prevent churn and frustration. She highlights the need for authenticity in marketing messages, noting that misleading claims can harm both the company's reputation and customer trust.

AJ and Emily also discuss the essential goals of marketing within the cybersecurity industry, stressing the need to build and retain a loyal customer base. Emily shares her philosophy on marketing, focusing on creating value and clear, truthful communication rather than succumbing to the pressure of exaggerated claims. She underscores the importance of understanding the audience and articulating the unique value propositions of the company.

The conversation delves into the broader role of marketing in supporting the security community. Emily explains how effective marketing can bridge the gap between technical experts and the market, fostering better understanding and collaboration. This episode provides a candid look at the realities of cybersecurity marketing and the principles that drive successful strategies.

Transcript

Unspoken Security Ep 20: Is Any Security Marketing NOT Bullshit?

[00:00:00] 

Emily Phelps: It's not necessarily who does this one thing better, it's where is the right fit. So, I don't, as a marketer and maybe this is a bad way to think about this, I'm sure it is from a lot of business leaders, but I don't want just any customer to give us money. And then if they are not right, because that's just gonna create churn and frustration in the market that's going to proliferate among their network.

So my biggest concern when I think of it is, okay, we're getting business. Are they, are we retaining these customers? And if we are not, is it because we sold them a bill of goods that we didn't deliver on or is there, what's at play. Those, I think, can be the most telling metrics. And that's another thing.

We are constantly being measured. We want to show our work and we want to show our value. I can get you clicks. I cannot tell you the amount of people who've said, well, we [00:01:00] want to go viral. I said, well, I can make you go viral, but not in the way you want. You can't create, when I've spoken to nonprofits about communications, I can't tell you how many of them say, well, how do we just create our own ice bucket challenge

​AJ Nash:  Hello and welcome to another episode of Unspoken Security. I’m your host, AJ Nash. I’ve spent around nineteen years in the intelligence community, mostly in NSA, building privacy programs for about eight years now. I'm passionate about intelligence security, public speaking, mentoring, and teaching.

I also have a master's degree in organizational leadership from Gonzaga, go Zags, and I continue to be deeply committed to servant leadership. Now this podcast brings all those elements together with some incredible guests so we can have authentic unfiltered conversations on a wide range of challenging topics. It's not going to be your typical podcast. This isn't polished and finished up necessarily. We don't necessarily stick to the topic. Sometimes it's technical. Sometimes it's not. We'll talk about culture. We'll talk about people, a lot of different things. My dog makes appearances occasionally. She's not in the room today, so I think we're probably safe. People will argue and debate, swear. I'm definitely gonna do some swearing. And that's all just okay. Right? The whole point of this is to think of the podcast as a conversation. It's one of the conversations you might overhear at a bar after a long day at one of the larger cybersecurity [00:03:00] conferences, like the many we have every year. These are the conversations we usually have when nobody's listening. So today I'm joined by my former colleague and still good friend, Emily Phelps. She's a 20 year veteran in marketing and corporate communications with the last 10 years or so focused on the security industry. Emily currently serves as the Director of Marketing Communications for cyber fusion solution providers, CYWARE, where she leads the organization's content, public relations, analyst relations, and digital communications functions. She's been referred to as the marketing Swiss army knife and having seen her in action. I think that's a pretty apt nickname actually. Emily has both a bachelor's in journalism and a master's in public administration from Georgia State University. Emily, welcome to the show. Is there anything I left out that you want to add to that bio?

Emily Phelps: No, I think you covered we'll get to some of the nitty gritty in the podcast, but I'm just happy to be here cause you're my friend and I've been listening to your podcast and didn't think I'd be on it, but here we 

AJ Nash: There you go.

Well, that's, I mean, that's,  [00:04:00] frankly, that's one of the things we have here with flexibility, right. If it's not just, this is not one of those podcasts where it's all going to be practitioners all the time and technical, and let's talk about this threat actor in this group.

And this, I mean, we do a lot of that obviously, but I want to have a wider opportunity to speak about things in the industry. And frankly,  I want to talk about security marketing for good reason. So, it's a big part of our industry. And so, we had an opportunity to chat about it and you're, you've been doing this a long time.

I love working with you and you're one of those people that's really honest and authentic. I'm not going to have to hear a sales pitch for an hour. Nobody wants that shit. So I felt like this was a good opportunity. Yeah. And today, the topic today, I mean, we're going to ask a really subtle,  nuanced question. Is any marketing not bullshit? So, yeah. I've had a lot of people ask that question or only, I think the answer has been no. But  that's the question I want to get into today is any marketing, especially in our security industry, is any marketing, not bullshit. Because it's just a really frustrating

Emily Phelps: Thank you for having me.

AJ Nash: No. Oh, okay. Well, 

Emily Phelps: Oh no, I'm just

AJ Nash: Great. It's a short episode [00:05:00] this week, everyone. I'll see you next week. Emily will not be back based on this. She's sort of screwed everything up. No, listen, I get it. Like,  no. Right. So I think that's, listen, bet half the audience said the same thing. Yeah, half the audience said the same thing at the same time, I'm sure. So anyway, let's 

Emily Phelps: Since I got into communications. I started in public relations and was called a spin doctor. And I, throughout my career, it's always, and what's funny about that to me is the first thing I learned when I was still interning, when I was like six or seven, 19 was if you are working for a company that is doing unethical things in your field, you leave because what you have is your reputation.

And I've really taken that to heart. I really have. I understand people's frustrations where and why there can be this antagonistic relationship between marketers and product and practitioners. I do my part, I think, wherever I work to kind of bridge that gap because, [00:06:00] one, I think it's really helpful to really have an interest in whatever area you're working in.

I've worked for companies where I wasn't as enthralled by the kind of work. And I've also, and when I found cybersecurity, it kind of changed the game for me because I love it. I was fascinated and there's a very low threshold for this kind of bullshit. So that's the kind of marketing that I like.

If I don't, I think if all you're spewing is bullshit, then what you're doing is marketing. You're just plain old lying. 

AJ Nash: Exactly, well, and fine line there between marketing and lying or sales and lying sometimes. And,  I think it's interesting. You said that, 

Emily Phelps: think people find too much gray and I think we need to 

AJ Nash: yeah, A 

Emily Phelps: We got to clarify the gray area. Yeah, for 

AJ Nash: Great. Well, that's what we're gonna try to do today. Right. And get a better understanding and help folks. This is not obviously gonna be a discussion about the sales and marketing outright and certainly not gonna be a marketing,  a sales pitch or anything like that. But I think it's a good opportunity to say,[00:07:00] what's the good? What's bad? What can we do? Right. So I think jumping right in, like the first question, I'm a big believer in getting a baseline, make sure we all understand what we're trying to do and what the good is. Right. So I mean, what are the goals of marketing? Marketing has a function. It's valid.

It's valuable. There isn't a company on earth that doesn't have somebody doing marketing. So there's gotta be some reason that it exists and it works. So,  let's get a kind of a one-on-one of,  what are the goals of marketing? At least what are they supposed to be? Like what's,  what's the ethical proper way to do this?

What's the structure and the goals for

Emily Phelps: Sure. Yeah, well, the ultimate goal of any marketing function, whether it's cyber security or otherwise, is to reach and connect with your audience, articulate the value that your company provides and build and retain and grow your customers. And while that might not seem like a complex task it really is there.

And there's a lot of different schools of thought of marketing. So. When you get down to the fundamentals you'll hear a lot of people talking about the four P's of marketing, [00:08:00] and that's product, price, place, and promotion. Those are really the fundamentals. Now, you see a lot more marketing influencers, experts kind of try and redefine what those fundamental pillars are, but I really subscribe more to the I think I've told you before the Mark school of marketing than the Gary Vaynerchuk.

Gary Vaynerchuk is far, I'd say more widely known among non marketers, but I'd also say that a lot of what he focuses on is really just a very small niche. And I wouldn't consider his approach to be a very authentic, applicable view. It's very bombastic and he makes a lot of like very simple statements that aren't easy to back up where I think the Mark Ritz in the School of Thought, which I realize I'm getting very into the weeds, is very like, but it's all about like, having a strong foundation and doing the right [00:09:00] things and building a sustainable program that supports whether you're a business, a non profit a government agency, they all have marketers, right?

So, I, and when I'm not working, I'm also on the board of the ADL in the Southeast. They are a nonprofit. They are trying to facilitate ending hate and start. And the reason I bring that up is you would think that would not, that seems like a pretty straightforward message, but it's still hard to penetrate and get to the right people when there is so much noise.

So,  similar to how security people want to find the right, the signal through the noise. Marketers want to be the signal in the noise in a crowded market space. Yeah. And when you have that, and that's really when you get into the promotion and place of like where you're going to be reaching people, that's when you get and see some of those messages get either watered down or hyper, hyper, They [00:10:00] turn hyperbolic, 

And that's, I think, where you get that disconnect and that friction between,  a very technical, skeptical audience, not saying they shouldn't be, and a very kind of enthusiastic marketing function.

And it's really there's this need to start speaking the native language of the audience. And that's all, that can be a hard thing if you're not super passionate about learning because it moves so quickly. You can't just read an intro to cybersecurity and call it a day.

AJ Nash: Yeah. The industry changes too quickly. By the way, for anybody out there who knows who Gary Vaynerchuk is or knows him personally, feel free to pass along. I would love to have Gary on to rebut everything Emily said. Mostly because he has a massive audience, but  I think it's

Gary Vaynerchuk. Yeah. And I know Gary Vaynerchuk's work. I don't know him personally by any means, but I follow him. So I know who he is. And to your point, I don't know who Mark Ritson is now. I do now. Cause you mentioned it to me and I've looked at him a little bit and I'm fascinated [00:11:00] by it, but I didn't,  it sort of makes the point.

Gary Vaynerchuk is very much out there. You said,  kind of bombastic. He makes a lot of big statements. He's got a big audience and some very interesting stuff. But maybe not all the concrete results that come out of it. Right. Some of what he says is just. It's hard to action on, I think, in some cases, I like the guy as a,  I think it's personable but I think you make a good point in the distinction between the two styles, right? But yeah,  the discussion there is, so you're trying to build this audience, right? You're trying to create value and get customers, right? I mean, that's the goal of marketing, if I'm not mistaken,  you said to the four piece, right? It's product, price, place, promotion, right?  As somebody who's been on the marketing side a little bit now,  I do Intel, I do marketing, I do a little of everything.

It seems like these days I've always been in a lot of these meetings where it's like, all right, we need people to know we exist. And we need people to know what we

Emily Phelps: Sure, that's a good start.

AJ Nash: Yeah it's nice. Right. And we didn't know what we do. And then we need them to know why we're different. The differential differentiators make them want to see us and then value propositions and those things come into [00:12:00] play. And the goal, if I'm not mistaken, is to build the audience. And to build. I guess, in marketing, what they call top of the funnel. For those of you not in marketing, I'm doing all sorts of marketing stuff over the last few years, this giant funnel and top of funnels, basically everybody in the world who might fall into the funnel and be a possible customer, and then you kind of dribble your way down,  bottom of funnel and you get to talk to salespeople and hopefully you write checks and people make money, et cetera, and your lives get better as a process.

So,  this big top of funnel pieces is what you're going for, but.  where does the

Emily Phelps: that's part of 

AJ Nash: why is there so much pressure that it just becomes, like you said, hyperbolic,  I mean, like I said, I remember when claims to be reasonable. And now it seems like most marketing campaigns, these big ad campaigns, you read them and you're like, and that's. Who believes this anymore? Like we stop all threats.

You don't. You don't. So,  how have we gotten to that point? And who's believing it? What are we gonna do about that kind of stuff?

Emily Phelps: Right. So with cyber security marketing in particular, [00:13:00] with cyber security, there is a real problem to solve. And unlike a lot of industries, it's not necessarily competitor versus competitor that you can only think about as a marketer. You're also thinking about the industry, you have to think about the industry as a whole, and that there is an adversary as well, good, bad, or otherwise.

There are individuals and networks and groups of people who are working together to prevent your security. So, I think that purpose driven Industry makes the message important. Not that it's not in other industries, but I think that it is a very purpose-driven audience. It's not, it's expensive because it's difficult.

So this isn't about impulse shopping. I'm not, marketers in cybersecurity aren't trying to get you to buy a candy bar by the register at the grocery store nobody's ever gotten fired necessarily for buying a computer, but if you buy say 10, 000 of the wrong computer or millions of dollars of the wrong [00:14:00] services.

There are a lot of consequences, both internally and externally. And I think the challenge is you mentioned the funnel,  behavior, human behavior is really hard to track in a consistent way. Now we try to make sure,   when you're reaching the most people, you're thinking about awareness when you're, and this is all, of course, after a bunch of research is done to make sure not only that you're.

Messaging is right, but that your product is right. You're looking at your competitors. You're looking at the audience. You're looking at how the industry is moving. And as people start getting into that consideration phase, which is growing in its complexity, because more people are involved, you want to make sure that you are talking about your product.

You are clearly identifying how you're different in what you can do and backing that up with. And then in the decision,  when people are starting to make those decisions, you want to be accessible so that we're and have that foundation of credibility and trust, which [00:15:00] are maybe no more important to any other industry than security with buyers, with, peers that show why you should be considered and get kind of into that.

That's when you're going to get more into that kind of one on one conversation and or one to few as opposed to one to many that gets really into the details and needs to really clearly articulate what you do and how it's different and what you solve for the person who needs Your services or products in general.

So marketing really has to be this cross functional team that works with product, with engineering, with business leaders, because it's very easy, especially as companies grow for marketing to become this fragmented. group where every, where people are kind of going off on their own and we want everyone to have a cohesive message that's rooted in ground truth.

That was something that I learned very early on. Like you need [00:16:00] to have a cohesive message that is clear. No one's going to see your ad once and give you 2 million. If that were true, I would set up a billboard tomorrow. And I think we're,  to kind of get back to your question we're competing against each other.

We're competing with Google algorithms and social algorithms, all who incentivize this impulse click behavior. And we're seeing that some of those bombastic messages work to your point. What we've talked about, Gary Vaynerchuk, excellent brand builder. People know who he is. If you really, if we really looked at who has produced more effective marketers.

More business people. I don't know that he would come out ahead in that one. And that's where I think marketing has to really align to the goals of the business and to the goals of the security community at large. And that's hard. You want a security site, marketing people can learn cybersecurity, but you're never [00:17:00] going to have a marketer be as much of an expert as someone who's worked in it.

As a practitioner or in the space for 20 years. So there has to be a lot of open communication. And I think what happens is a few things I realized I'm just throwing all this at you, but I think you run into a lot of challenges to get everyone on that same page and not let the enthusiasm you have as a business of what you think you can do into these hyperbolic messages.

Your internal audiences too, and  your founders, your leadership is extremely invested in the success and believe in the product as they should. But you're dealing, not you're trying to reach. You're trying to reach someone who's much more skeptical and you have to show your work.

Don't tell like you really have to lead with that mentality and manage expectations for a lot of internal stakeholders with these [00:18:00] messages. Yeah, it worked for big companies when they came out with it early, but you can't just steal and repurpose and expect the same outcome.

AJ Nash: Right. That makes sense I mean, that's, no that's fine. That's we have at it. That's what we have editors for, but no, I think it's all really good content. I, it's all good content. It, and it makes sense, right? I mean, you covered a lot of pieces that are important on this. I think you might've jumped in a little bit to the next question.

I was going to go, which is fine. I mean, these kinds of all mush together occasionally. But I think you've. You've made some really good points there. I, frankly, that last point that you put in there, the last couple I thought were really interesting. Listen, you can't just repackage somebody else's,  work and get the same results.

Don't expect that. First of all, they did it first. Their company may be different than you, their product or service might be different.  Nike had wonderful success with just do it. I'm pretty confident nobody else could just come out with the same thing and get the same result. That's not how it works. It's, so I think that's important to

Emily Phelps: Yeah. I would like to see another shoe provider come up with a slogan. I would 

AJ Nash: Almost identical. If they do, it probably comes out of China. I mean, it might be done. Yeah. Right. It might be done in [00:19:00] China. Like they might've done it there and,  and whatever the biggest manufacturer of shoes in China has made about the same campaign, but you can't do that.

Right. And I think the other piece that you hit on something really interesting that you went through very quickly. So people might've even missed it,  the owners, right. Your leadership team, they're all really invested in this. Right. And so they have an opinion, but they're also not the audience.

So being able to find that balance of, Hey, how do I put together a campaign and a messaging campaign and work with sales and work with these organizations to have authenticity and to have accuracy throughout and have it be   compelling enough that we think it'll work well in the market and bring an audience but still be truthful  and please our internal audience because well, leadership might not be the audience. They are the ones that write the checks and they won't let things out the door. And I've seen a lot of conversations where you get going and then,  the marketing team's really excited about it, maybe even the CMO is. And then the CEO goes, well, wait a minute now let's do this instead.

And they add like 68 different words to it to change everything. [00:20:00] And they're like, well, hold on. We don't actually do these things. Yeah. But just tell them it's very exciting. And I'll bring them in and you're like, Whoa, that's a. That's a problem, boss. And then you end up going around in circles with the boss to try to find that middle ground of, well, what's truth? And  what's, where do we want to define those things?

Emily Phelps: And what matters to your audience? I mean, I remember specifically at one company where we were trying to establish a new category and we wanted to say we were the leader in that category. Well, nobody cares if you're a leader in a race, no one else is running. And I mean, it's not that's a bad idea, but.

I I think there's this resistance to having any sort of vulnerability that you're building something new and that's different. So, you can't be the established leader in something that doesn't exist. I mean, like, it just doesn't mean anything to anyone. You say it, it'll read on a, like, you can try, you, you try see how well it resonates.

AJ Nash: How dare you 

Emily Phelps: The thing is, there's a [00:21:00] lot of ways, there are a lot of ways to, there are a lot of ways to pressure test this messaging. You can do focus groups, you can do surveys, you can have an advisory board. The challenge is those things take time to do them right. They often take money and they have, and they're seen as a cost center, not an investment.

And they're really an investment. You can do all, you can get all the data you want through,  in terms of quantitative data. It won't really give you legitimate validated insights into behavior. That's something you need to do that takes a little more effort. And there are a lot of companies that have this, like, well, if I don't have the ROI, then I'm not going to invest in it.

And even, like I said, like the Mark Ritsons of the world are like, well, then you're missing a lot of opportunity and you're not building sustainable growth. And that's what I would like to see a lot of. Leaders really adopt this idea of [00:22:00] sustainable growth. We know we want to grow fast.

We know that the market is moving fast, but we don't want to just make, we want to make an educated guess. We don't want to just throw stuff to the wall and see what sticks. And,  sometimes you have to do that. If you and if they're cheap or inexpensive tests do it. But if you really, if you were going to go big, then shouldn't you make sure that The people you're trying to reach can relate to what you're saying more than you just like the sound of it.

I write a lot of stuff personally. I would not use that language with a technical audience necessarily because it's not. They don't care about those words or that message. So,  that's why we say like, it's about listening first, listen first, it's slow. Or there was some article or book called don't just do something, sit there because you have to like, take that time.

And understand what [00:23:00] you're trying to, not just what you're trying to do for the business, but what someone wants from your business, if anything,

AJ Nash: Right. Yeah. Yeah.

I mean, 

Emily Phelps: this all 

AJ Nash: Our job is supposed to solve, help people solve their problems. Right. So you gotta know what the problem is first, what, or at least what they perceive the problem to be. So, it brings me to the question. Again we've dumped, jumped into some of this already, which is great, but  we talked about the purpose of marketing really in detail, I think at this point, but knowing that, like, why is marketing in the security industry specifically so damn hard and therefore, why is it so full of bullshit? Like, I mean, I've got my ideas obviously. I've been on multiple sides. I've been a customer in the financial space on the vendor side both, outwardly helping people buy products and services.

I've been a customer within a vendor, which is kind of all the above I've done,  Intel, I've done marketing, I've done all these, But bits and pieces and, to me, I always see the hardest part being that it's just, there's a lot out there, right? It's a busy industry.

There's a lot of really cool products and tools and differentiating can be really [00:24:00] difficult. In all honesty, you pick a category and I could probably give you three or four vendors and say, any one of them is good. Well, why choose one over the other? I don't know.

I mean, it's going to depend on you. Maybe you like the look and feel of this. Maybe you like the process of that. Maybe it integrates better here. Maybe you just like working with these people more than the other ones, but functionally, they're probably gonna be pretty similar. There are very few sections in our industry where I think there's just a world class leader.

And then everybody else is just way behind in the pack. Right. There's a lot of really good technologies, but I mean, is that part of it? Is that what, just asked, like, is that what makes it so hard and so full of bullshit? Is that part of it? What else is in there? That's making this so difficult get, 

Emily Phelps: I think there's that, that's part of it. Right. I think that can be part of it. I think there, there's a lot of things at play as to why you see a lot of bullshit. Some of it, and I would say that this is the smallest percentage, is that some people will say anything to win. I don't think that is the majority.

I know a lot of people in marketing across cybersecurity, across other industries, and not one person I have worked with and liked working with [00:25:00] has adopted that mentality, but I do know people who have been willing. I've also worked at places where I've seen competitors literally steal stuff from our website, re cut 

AJ Nash: Yep. Word for word. 

Emily Phelps: put it on theirs. They're, right, there are people who will do those shortcuts, and that stinks. The majority of it comes from a few different things. We've touched on a few of them. Is that you're really balancing all these stakeholders, and too many cooks. It's not good. There's also these, there are knowledge gaps when you're talking about a very fast paced evolving industry that is also young.

This is not manufacturing where some of the fundamentals haven't changed in a hundred years. Of course, manufacturing has changed. There are technologies and changing, but I just mean, overall, we've been manufacturing things a lot longer than we have been. Stop it. Trying to stop breaches and cyber incidents.

So you have these technical gaps. I am [00:26:00] certainly not the first to say marketers and cyber security need to really get to know the product and really need to get to know the industry. And I'm not saying everyone needs to get like their CIS SP or maybe there's a better certification, but you have to, we have to know.

When, not only when we're writing stuff that sounds bullshitty, but if we're being told stuff that sounds bullshitty, and again, I don't think that this is intentional, I think we have a lot of people make mistakes, people, human error is the thing, and even in, whether it's product or engineering if it, if people are talking past each other, or if we're just really excited about the possibility of something.

Is it really able to do what you think it can do and are or are we overstating it because the marketers don't know any better because you're not going to have a 20 year veteran of both marketing and cybersecurity in one. So really, there is a shared responsibility to make sure [00:27:00] that what we're saying is accurate.

Now, there's also. You talked again about the funnels when you're trying to talk to people broadly, you really have to broaden the message. So it is going to, we are in a way as an industry, all trying to solve the same problem, not the same way. Obviously, endpoint security is not going to be the same as like, as, threat intelligence and other technologies and other solutions, excuse me, but if we're all trying to enable either businesses or organizations or healthcare companies and entities, critical infrastructure to operate without interruption, that's what we're trying to, we're trying to stop the adversary from disrupting business life as we know it, stealing IP, we're all trying to do that.

So. Right. So, and that's what people are, when you're thinking of people are trying to come up with these bold statements that catch your eye, that, [00:28:00]  don't get,  downgraded by the Google gods, but that still resonate with someone you're trying to like,  so there's, there are all these bouncing acts.

You want to talk to people, but you have to talk to Google. I mean, there's if you have the greatest product and you're on page three of Google. No one's going to find you,  I mean, so, so there you're, it's all these balancing acts,  and it's a lot of different opinions. I always say people need to have like a tiger team, especially if you're trying to kind of infuse, which I always recommend a personality into your brand.

Nobody wants to talk to a robot. That just sounds like a bullhorn for their message. People are not receptacles for your sales pitch. That is not what people are. People are concerned about what they have to do. And if you can solve a problem, the best thing to do is not say, well, I [00:29:00] can solve it in five minutes, if you can't.

A bait and switch is never gonna be a sustainable way to grow your business. But if you can illustrate That you understand what is getting in their way, and if you can do it the way that they speak, or as a human would talk to another human, that goes a long way. So if I'm ever trying to do something kind of funny, like not making fun of breach victims, or punching down at people who've been like,  victimized by online, like criminals, but you can of poke fun at some of the frustrations that we all can relate to I think that goes a lot further than saying we stop all breaches or store is dead or whatever like next thing you know we all know it's an evolution and I think we get in our own way sometimes when we're trying to please our internal stakeholders while still and thinking of all these [00:30:00] different audiences with one message we really have to get much more strategic and much more effort.

We have to stand up when we sit when someone says, no, I want you to say that we are number one in this thing. Are you show me,

AJ Nash: Right.

Emily Phelps: does that 

AJ Nash: Well, 

Emily Phelps: Does 

AJ Nash: I think And I think you made a good point, which I've seen  challenges with for others in the past. You mentioned that you need to be familiar with the product, right? That, that marketers really should be familiar with

Emily Phelps: Absolutely. 

AJ Nash: because I think one of the challenges you can run into is, so you've got a product team, right?

And they've got a job that they do and they've got KPIs and they've got all these requirements, right? And  they've got promises they've made to whoever the CTO or the Chief Product Officer or the CEO or whoever. We're going to build this thing. And it's going to do all these things.

And it's going to have all these capabilities, right? Well, they may start ranting and raving about how great this product is. Hey, we've done it. We've achieved our goals.  here we hit our marks, but does it really do those things? It's in their best [00:31:00] interest to claim victory. To stay on task and to stay on time, et cetera.

Even if they think well, it might do some of those things or it does it, but it's super unstable. They won't mention that part. Right.

So they're going to talk about how great they've done and how great their product is not always, by the way some organizations work just the opposite.

They're really conservative and they never launch anything. But some we're going to do this,

Right.

And so marketers need to be in a position to POC the product to test the product to say, okay, these are the claims you guys are telling us you want us to start amplifying and building campaigns to show us and like, can we get a demo?

Can you show us how it does the things you're saying it does? And if the product can't prove that it does those things. Then maybe it's time to go back to the board and say, well, hold on a second. Let's reconsider what our message is going to be.  we're not going to mute it down and say, well, we blocked 28 percent of the threats.

I mean, nobody's going to put that out, right? I get that, but let's take a look at what we really can say we do. We'll put it in the best light, but let's not say we do all the things that we said we were going to try to build that maybe we didn't actually accomplish just because you guys needed to do that to meet your [00:32:00] and make your bosses happy. I think it's important. And I don't see enough of that in my limited time, at least working with some of the marketing folks. I haven't seen enough of that where the marketing folks actually know the product inside and out, know it really well. I see a lot of chief officer, chief technology officers, chief marketing officer and chief executive officer, here's what we've accomplished.

Here's what we can do. Here's what we're capable of. And then the messages start getting built. And I'm not. I mean, there's a trust that goes in there and you'd like to think everybody you work with is trustworthy and they're not going to set you up to fail. I'm not gonna lie, but maybe they're not, maybe they're just being very optimistic in their interpretation of how the platform works or how the tool works or how their services results or whatever it is.

Right. So I think you made a really big point there that marketing teams, if you're going to put something out there, your name's on it, right? So make sure you know the product or the service whatever it is you guys are putting together and that the claims that go out there aren't ridiculous, or you're willing to live with the ridiculousness. If you want to say we block a hundred percent of the threats, well, it's going to be really tough when you go to the trade shows and that's the big sign over your booth.

You're going to be [00:33:00] very busy. 

Emily Phelps: legal team is going to be, your legal team is not going to be happy. And don't know that's what anyone expects. I think the opportunity is, there are a lot of technologies, there is a lot of opportunity for personalization, it's harder at the top end in terms of messaging, but it's not necessarily who does this one thing better, it's where is the right fit. So, I don't, as a marketer and maybe this is a bad way to think about this, I'm sure it is from a lot of business leaders, but I don't want just any customer to give us money. And then if they are not right, because that's just gonna create churn and frustration in the market, that's going to proliferate among their network.

So my biggest concern when I think of it is, okay, we're getting business. Are they, are we retaining these customers? And if we are not, is it because we sold them a bill of goods that we didn't deliver [00:34:00] on, or is there, what's at play. Those I think can be the most telling metrics. And that's another thing.

We are constantly being measured. We want to show our work and we want to show our value. I can get you clicks. I cannot tell you the amount of people who've said, well, we want to go viral. I said, well, I can make you go viral, but not in the way you can't create when I've spoken to nonprofits about communications, I can't tell you how many of them say, well, how do we just create our own ice bucket challenge?

Do you remember the ALS, the bucket challenge? It when that, that I can't, you can't bottle that and then just unleash it. That's not how it works. Now I can make you go viral, but you're not going to like the outcome because the only time you can really kind of push that forward is if you do something controversial and negative, because that is what creates that impulse reaction.

[00:35:00] That is why a lot of social media is kind of a hellscape. It's bad. So, we don't want that. We want to be able to attract eyeballs, but we, and we want to be able to show, hey, these metrics are growing, you can also game the system in a way that doesn't support them. And that's what I want to see people avoid.

And I don't know if it's different, obviously there are a lot of factors, but I am sure some marketers feel pressure, especially in a down economy to show, okay, well, all these numbers are going up and there are shortcuts you can take, but those don't always pan out. Meanwhile, there are other tactics you can employ that are much harder to measure, but that are more resonant with the people you're trying to reach.

Do you not do it because you can't measure it? [00:36:00] Or do you do the,

AJ Nash: Yeah, well, it's a good point. And something you mentioned is  wanting the right customer, right? So,  as you said, that might be controversial on who you're talking to. So I, and I think it is depending on who you're talking to. So if you're a seed company, you're a series company. Most of those companies, I feel like this might be the dirty little secret in the industry and maybe people aren't gonna want to hear me say this out loud.

And maybe it's just my perception I'm wrong, but my perception is, you build a company  your first generation customers are mostly donors they're going to come in and they're going to be your beta testers and your donors. I mean, you hope you've built such a great product and service that they'll stick around for the long term. But I know a lot of companies that come in and they're like, all right, we're going to build something. We're going to make a lot of noise about it. We're going to get excited about it. And then we're going to learn as we go and we're going to do it at the expense of our first generation customers.

They're going to pay us and we're going to use that money to build things. We're going to, we're going to say we're going to do stuff, but the truth is we're going to start doing it and we're going to actually build it once they give us the money to build it and we'll keep moving forward from there and we're going to churn that first generation.

They're,  [00:37:00] unwitting donors in a lot of cases. But the challenge I think that comes with that, and by the way, for anybody who disagrees with me, feel free to come on the show and yell at me if you want and prove me wrong. But for those who disagree, I think  the flip side of it is if you're truly innovative, if you have a new thing that nobody's done from scratch, you're also probably going to start as a seed company, whatever.

So both of those things exist. You may have the wild, new, amazing technology, you may just have something that's just coming up and you're going to claim things that aren't there. So you can build the technology as you go. And so it makes it very difficult for people to know. I'm not saying Buy anything from a seed or series a company, but a lot of times those are some of amazing things, but I think it's important to really be skeptical  of those companies early on and really push,  when they have the big marketing and say, okay, really take a look at their POCs because a lot of them are looking for first generation customers that can help them build to the second generation customers.

And if you choose to stay, that's great. And if you don't, thanks for your donation for the year. Your ARR was very useful and now we're going to [00:38:00] build something else. Whereas more mature companies,  as you're talking about now, you want to, I want to, customers are going to stay right. Churn is a nightmare for a more mature company. It costs a lot of time and energy and money to save customers,  to keep them together. It's easier, it should be easier to save a customer than find a new one, but also you can burn a lot of energy keeping customers are unhappy if you bullshit them to get them in the door and they spent a lot of time explaining to you how disappointed they are with what they bought which is,  why some of them turn out.

Right? So the more mature company, I think you're right. I think that's at that point. It's like, Hey, we got to really make sure our messaging ties to our product because we don't need to be turning people. We want to keep growing and growing. The first generation of a smaller company may be okay with churn. So I think it's important to know where the company is at the maturity level or the experience level. And I wonder if that doesn't affect, and I don't know if you have an answer to this one, but I wonder if that doesn't affect how they approach their marketing strategy.

Emily Phelps: Oh, I'm sure it does. You wouldn't have a startup necessarily market the same way like an IBM or a big company would because, you [00:39:00] know, There's just number one. You're not necessarily trying to reach the same people. So when you're a big company and you sell an established product in an established category, you're going to attract people who want that tried and true way of doing things.

And it's not that startups can't do it that way. But usually when you're thinking of a startup, you're thinking of Someone who wants to maybe deliver the same outcome, but in a more innovative way, and there is plenty of market for that because there are people, there are companies that are tired of the same thing.

Way of doing things that they treat, especially in cybersecurity, they might think of it as treating more of the symptom and not the root. And so there are reasons to, for both, and there's an appetite for both. And again, like, I know I kind of dive into, we've talked a lot about the similarities between the marketing industry and the security industry, but I think one of them is just how [00:40:00] diverse they both are in terms of the different domains.

And what those capabilities can do and the need to really. Understand and have that level of self-awareness of who you are and what your risk tolerance is. Whether, and if you're a bit startup, you have a lot more latitude.  That's why they, I've worked at startups a lot of times, especially at the early stage, where you, your goal is to fail fast.

And I think when you're investing in a series A or early stage startup. I don't think there's so much that it's you're a bait and switch. You have to worry about, I think when you're going in with a company, you have as a customer of that startup, if at least in the ones I've worked at, there is a lot of reciprocity where you get to help shape what this product is becoming and really in real time, see how that value can evolve. And that's a really exciting [00:41:00] prospect for some people. Others, you 

AJ Nash: good 

Emily Phelps: a huge company, yeah.

AJ Nash: Yeah. I mean, that's a good point. I bagged on it. I should get the positives, right. If you do get in with that,  small startup, right. And like you said, you really, you can really shape it. Yeah. No, you can really shape it. You're right.

And I've worked again, I've worked with small startups too. And a lot of times the messaging has been, listen, we're going to be here for the long haul. We want to be partners with you. And the advantage of working with a company like that it's, I think it's about expectation management.

All right. If you're coming to go, Hey, listen, they're new. They're trying to do something that's been done before. Clearly it's not gonna be all polished. It's not gonna be all perfect, but we can be here and beta test with them and help make it better. And we have great influence on what it's going to be, we can be a partner going forward. And the good news is if you stick it out, if you're able to do that and go, Hey we'll go for the bumps in the road. First of all, you get a better deal. Price wise usually that company will raise prices on others, but you'll be fine because you were first and you have a chance to really shape that product in a way you couldn't any other way, unless you built the company yourself, which you probably can't do. So, I mean, there are benefits to going with these smaller, newer, innovative companies, just as long as the expectation management is [00:42:00] there. If a company who's seed round, they're brand new and they come out and say, we've solved it, this problem that nobody's been able to solve for years.

Trillions of dollars have been spent on it. We solved it. I'd be very skeptical of that. I'd certainly have the discussion, I suppose. And maybe that's why the marketing works. Cause it's enough to get your attention and get you in the door, but I'd be very skeptical of it, but if they come in and go, Hey, listen, we have a new idea on how to do this.

We've had some success in it. We really think there's promise here. We want to work with some folks together as a team to develop this next generation technology. That's going to revolutionize things. Then I think you're like, all right, cool. Do I want to be a teammate with us?  do I want to be a partner on this as we go forward, maybe even a partial investor in this. And everybody ends up being on the same page going in, as opposed to the startup that just says this wild thing, but it seems to work. The shiny object,  people show up and go, well, let's throw money at that. They've,  you get the Right.

Lloyd leader goes, well, they said they've solved it. Why are we wasting money on these expensive guys? We can go this guy who's cheap and new, and they said they've solved it and they get sucked into being that first generation investor for somebody accidentally.

So, I mean, I think

that's, 

Emily Phelps: Look, it can happen to large companies too. Yeah.

AJ Nash: Totally. Oh, yeah, it can happen with anybody.

Listen,

there's plenty of 

Emily Phelps: [00:43:00] There's, there are so 

AJ Nash: You let them. Yeah, I mean, AI is a good example. Listen, I

Emily Phelps: Sure.

AJ Nash: just, let's just sit and talk about generative

AI for all the amazing things that AI is doing and AI has changed the world and it's all great. And I can still pick an argument with most of these chatbots very quickly and get them to just go totally off the rails or give answers that just are wildly inaccurate. There's great potential in this technology, but those who've said, that's it. We've solved it. The world's totally different now is going to take everybody's jobs away. And,  it is all right. There's a long way to go. People and generative AI together are going to be superheroes, I think, but we're super villains, but AI in itself, isn't just replacing all of us. But boy, you wouldn't know that if you read the marketing. You wouldn't know it. You'd think it was over. Like it was over for a bunch of us. We should all just walk off cliffs like lemmings because there's nothing left for us to do. The machines have won and we're done for yeah, that's right.

Well, and you can see it, like, I mean, I know it's affected marketing. People are saying, Hey, we don't need to hire marketers. We'll just have AI, right copy for us and write ads for us. I fear it tremendously in the Intel community, in the Intel [00:44:00] space, I've seen people talk about end-to-end automated AI intelligence.

You don't need people anymore.  The AI can read all the stuff. It can analyze all the stuff. It can write your answers and it's all going to look, feel and smell like Intel. It's just all bullshit. It doesn't have any of the confidence language that goes in there. It doesn't have nuance. And somebody's going to take that and go, well, I can buy this really cheaply instead of all these expensive people who think they're so smart. And You're great and you keep making decisions off that until something blows up in your face and you realize how very devastating it was to just believe that the machines knew everything. And  

Emily Phelps: And I think you're always going to find those, I think you're always going to find the early adopters who want to just go all in, and maybe this is the optimist in me, that you're going to see that most people approach it with a skeptical eye. I don't know if they're as skeptical as you and I are. I use generative AI in my work.

I've never, And I never will just put a prompt in and then think that's it. It all sounds the same. It's got so many errors. It is a [00:45:00] tool. And just like I wouldn't hand you a hammer and say, well, here, your fence is done. Like I, or that probably not a but like, you know what I mean?

Like, but to me, that's kind of what I'm seeing is that there's, there is a lot of hype around, new technologies. There always is. There's always going to be something. There was the EDR boom and the XDR boom. And then there's the soar and sin. And there's always something to distract you from a cohesive, Long term strategy, and I don't love that.

That is just, I think that AI can make a big difference in making a good product better. I don't think it's going, anyone who says AI is going to replace people is afraid of the wrong thing with AI, quite frankly. That's not what you should be afraid of. And that's not what I, in my view, Business leaders, and there have been some who publicly said, Oh, we laid off 1800 people because of AI [00:46:00] that's happened recently.

That's stupid. And no one believes it. No one that is why you were laying off all these people. And I find it infuriating, which again, it goes back into that hype cycle, that outrage machine. That is, we could talk about that in a whole other podcast you ever wanted. What you're doing is, my fear is, if we don't start taking it down a notch when it comes to these hype cycles if we're just, it's just going to become a race to the bottom.

We're going to lower our standards, like if we think that the output that AI can do can mimic the context and nuance that experience can provide. It's just, that's not how AI is, they're large language models. They are not sentient beings. just not the same thing. It can 

AJ Nash: exactly. 

Emily Phelps: go faster. It cannot replace what you are doing.

AJ Nash: Right.

All right. So listen, we've talked. 

Emily Phelps: really hard [00:47:00] to, oh, yeah.

AJ Nash: Yeah, sorry about that. So we've talked about the fundamentals, obviously with the marketing piece. And we've talked about,  really, some of the challenges in the security industry and why there's so much bullshit in it.

So I like to give some hope to people, right? Some optimism. So, the third question we put together for today was knowing all this, like how can security practitioners, especially CISOs, frankly how do they combat all the bullshit? Like, how are, what do we have,  you're a marketing expert.

You've been doing this 20 years, 10 in the security space. Right. So as an insider, like, what do you see as some tips and tricks to say, Hey, listen, this is a way to, to see truth from fiction, maybe, or to suss it out a little bit better.  what are some of the tips that you think would make sense to say here's a way to understand what you're hearing and,  and how to kind of sift through it.

So you can make sense of it and hopefully end up with the best tools and services to get you what you need.

Emily Phelps: Right. Well, you just listen to me. I'll steal your right to your right now. I think that there's a responsibility on both sides. Like marketing has to [00:48:00] get to catch up to the technology marketers do. And we also have to kind of understand how we can. Make sure that when we are creating promotions, where we are reaching out to our audience, we are keeping our customers in mind, our audience in mind, and that things like SEO and search and these algorithms play a role in helping give that lift, but we shouldn't be writing for these machines because that's one thing that just is a recipe for just bombastic Nonsense.

And,  we've seen that one thing Google has even changed with their algorithm is it really is starting to prioritize human to human language. So whenever you see, like, in today's complex threat landscape, nobody talks like that. Everyone has written that sentence. I have written it more times than I'd like to admit.[00:49:00] 

And now I'm not going, I, it just gets you started. And I just cross it off. Like I just, at one of the startups, I was at, they literally called me in a chief bullshit officer because I would see the the jargon and I would just use my little digital red pen and I'd be like, no, you're not saying this doesn't mean anything to anybody, this is horse shit.

Like, and I just, I was very fortunate that I worked with some very open minded, like not precious about what they sent me. And we really worked together to create an identity that was real and kind of strip out all that stuff that gets stuck in your taxonomy that really doesn't benefit you.

I think what others can do, I think the marketers have to. Get better at listening. We have to really start listening to what CISOs are saying. We have to start listening to the conversations that security practitioners are having. You [00:50:00] can find a lot of really honest feedback if you look and it's not a place to get defensive.

It's a place to learn. I cannot tell you things I have learned when I have just gone to cybersecurity subreddits. And just pay attention, not to manipulate them with my message, but to really understand. What's number one their humor? They're very funny. You, I think anybody who has a very high stress job Often copes with humor and I do enjoy that, but also if I'm not there to sell to them, I'm there just to, sometimes I have questions that I will ask and I will be candid about who I am, or sometimes I will just listen to like what they're talking about and get a sense of like the frustrations so that I don't do the same things.

I don't want to make anyone's job harder. I look at my job. I look at marketing as well as to. Get people the information they need the right way when they need it so that their jobs can [00:51:00] get easier. Now, when it comes to how CISOs and security practitioners can do it, I think I've told you, I think it's similar to how you establish your intelligence requirements.

I think you have to have a very clear idea as to what you want. I think you have to really understand. What you don't want and I think that you can there are a lot of resources out there to kind of help you wade through all that whether it's Analyst firms. I mean there are obviously the big ones like our forester, but there's 451 there's tag.

There's all sorts of Christina Richmond is one of my favorite people and she, it's such an open book about like how you like what information is going to be valuable and there's so many of these resources available that are that have don't necessarily have a dog in the fight of a vendor versus vendor, but who really want to see movement in the space go [00:52:00] forward.

And that's what I think is a really good step. I think  understanding your risk profile, your risk tolerance when it comes to whether or not you want to work with a big established company that may do things in a very rigid way, it may not, or one of these disruptors and try to do something different.

It's about having, asking a lot of questions, the proofs you'd mentioned, the proofs of concepts, really don't be, don't shy away from asking questions, both of your audience, of your networks, of different vendors, think about things in different ways and what it's, and what the outcomes are you want.

We think a lot about the short term, and I get why. And the role of a CISO is extremely hard. And this is another thing I think is very common with marketing that I've talked about is you're trying to prove something. You're trying to almost prove a negative. Like [00:53:00] I am, this program is why we didn't get breached.

This campaign is why we had this amount of business. Like it's not easy. So there has to be a lot of outcome-driven questions. And a lot of.

Of kind of synthesizing what all this marketing means, trying to get past that and get into sometimes it's just about getting on the phone and having a conversation, which no one hates to do more than I do. I hate being on this site. This is not a phone, but sometimes it does mean that like finding a community of practitioners or and really getting people's experiences. That's what I say. I know there's a lot of good marketers out there who have found the same kind of challenges I have. And there's some folks started this cybersecurity marketing society because we're all kind of over that and want [00:54:00] to have, want to do what I've talked about, I'm certainly not unique in this area, like we all want to be providing value, we all want to be getting to the right people, nobody wants to contribute to unhappy customers or a bait and switch.

We want to do the right thing. So, boring marketing, bad marketing, it doesn't mean it's a bad product. But it does mean we also need to reward what we consider honest marketing.  I talk about it across industries. Clicks their impulse control, like all of that behavioral psychology behind that kind of creating that noise is all in, negative emotions, positive,  fear, fear based messaging.

Now, I think people have gone so far the other way to be overly confident. And I think we need to make a concerted effort to. [00:55:00] Don't just give someone your business because you think that their messaging is authentic, but certainly think about if someone is telling you something that sounds too good to be true, and someone is telling you something that seems plausible.

See how that where those conversations go and I think most of the time you'll find that the more reasonable conversation you'll be. There will be less over promising and under delivering and you'll see kind of the opposite and be able to kind of build out a program or a relationship with a vendor that is more beneficial than just, well, I'm going to give these people my money because they say they can solve this problem and I can't imagine any CISO really does that.

I mean, 

AJ Nash: and I don't they do, but 

Emily Phelps: just like buys all in. 

AJ Nash: Yeah,

I don't think, I don't think anybody just buys based on the marketing. Right. But I think the challenge is if we reward, I think a lot of folks reward these [00:56:00] grand claims. Because listen if you're a CISO, you don't have time or security practitioner, you don't have time to check out 10 vendors, right? So it just seems like there's this constant one upsmanship because the bigger the claim, the bolder the claim, the CISO might say, okay, I'm only going to pick three vendors. So now it's going to be the three that gave the most wild, amazing claims. I'm willing to look at it. And of course you're not going to buy based on the claim, but if that's the claim that gets you in the door if the key to entry is to claim, you could do anything and everything and be amazing, even if it's way beyond reality, if that's the key to get in the door, then everybody's going to be using that.

They're all going to be making that same claim that we want one bigger after the other, and that company, that is, maybe they're boring. Maybe their marketing team's not great, or maybe they're just, they're really dedicated to ethics to the point of being super authentic. They're going to get drowned out.

They're gonna be left behind, even though they're probably as good or maybe better in the neighborhood, at least, and they're honest and they're direct, but they're not willing to say. Things they know are untrue just to get your eyeballs, just to get you,  to say yes to a POC or a discussion and they're going to get [00:57:00] left behind.

I mean, I tend to be somebody who's gotten to a point of saying, Hey, listen, when I walked down the halls at the conferences with somebody who says,  ransomware is dead. We've ended all these, whatever it is, that's a company I probably won't even bother to talk to because I don't know. It's not true.

Like it's not a thing, right? We block a hundred percent of no, you don't, I mean, I'm probably just going to skip them because I, to me personally, my opinion is you almost have to punish those groups to say, Hey, listen, this marketing campaign doesn't work. You've gone too far. If you want to say you're the best, you want the leader and you have stats to support it.

That's one thing to say, we do a hundred percent, this thread is dead forever. No, I'm not even probably going to waste my time lying to hear your pitch because that's what you're, that's your goal. Your goal is just to draw attention. You're a carny barker, just trying to get somebody to the two year booth, and it doesn't matter if it's true or not. And I feel like we keep rewarding that in the industry. A lot of people keep rewarding that mentality. And again, if you only have so much time, if three or four companies are what you have time to work with, and you're just going to pick the three that had the biggest, wildest claims.  I think that's really problematic. I know going all the way back to episode one [00:58:00] of Unspoken Security, nice call back here. Neil Bridges was the guest in episode one. And the topic was through the eyes of a startup. See, so I believe it was the name of the topic. And I know Neil had mentioned, he talked about vendors and smashed a few of them along the way.

But he said for him,  he seeks out trusted outside opinions, basically other CISOs, friends, people he knows and trusts and says, Hey man, I got all these claims from all these different vendors. Are you familiar with any of them? Have you worked with any of them? Are you familiar with their products?

Are you familiar with their people? And I wonder if that isn't part of a solution for this is to say, Hey, great. We always make wild claims. Let's talk to anybody who's worked with any of these folks for, oh, it might turn out, well, I've never seen their product, but I know their CMO and this is where that person used to be.

And here's all the claims they used to make and you know where that company is now they're not doing well or the opposite. I know their guy or gal, and

these claims they made someplace else. It was all true and they were great to work with. Right? So I feel like maybe there's an opportunity to have more of a networking as a bolster against some of these things, I just tired of the claims working to get you in the door and that's what they're trying to do.

Emily Phelps: Right. And that's where a lot of this is going. I mean, just thinking about when I started earlier in my career where, you [00:59:00] know, kind of social media was emerging. And this was even before I was in cyber security. If you think about where it is now, it used to really be kind of like a promotional channel.

Like, that's what people used it for. And To me, it's not now. It's all about these kinds of networks and online communities. The reality is people are online. That's where a lot of people work after work, we have a lot of online communities and using a channel as a bullhorn is not a great use.

Even I think Forrester put out a paper a few years ago that talked about if you can't do social media, for example, correctly, then just don't do it because there's not. a reason to just add to the noise. Now, sure people still do. I'm sure that people want to have this presence because when someone searches your company, they are searching for you, have a presence on these.

But I think where it's going is creating networks. Now, I'm not saying create a street team like you're a 90s band, like, [01:00:00] like a college garage band, but I hang out posters everywhere. But I do think that there is an opportunity to provide a more human side of your business through these online networks, like for the business.

And I think these businesses have to be accessible without it going right to a salesperson. Nobody wants people to approach these sales calls with anxiety because they don't want this hard sell. And I'm not, and I don't think everyone does that, but there's an idea that's what they're going to get.

And so, whether it's, I think companies can make their tech team available, make their executives available, give away what you can for free. I think that's always a really good strategy and maybe you can't do a free trial. But one of the things I know that CYWARE has done is they have these free tools, like we have some intelligence feeds that they're open [01:01:00] source that we curate, but we are not a feed provider.

There are other tools that they've built out. Secureworks did that when I was there where they created this free honeypot because the goal is create things that are going to be useful for the people who you want to attract. Don't expect something in return, but try and earn their attention to build that trust.

Because right now, the trust between buyers and companies and vendors is very low. And it does, I don't think it has to be.

AJ Nash: No, I think that's a good point. And freemium, the freemium model you're talking about, which I've been familiar with too.

I think that can work really well. Right. And I think organizations who want to invest in freemium as a way to earn the business, right, earn that trust, as opposed to just going out and having these massive billboards and campaigns that just sell things that may or may not exist, I'd consider that to be a more ethical way to try to prove we deserve your business.

We're good enough. We'll show you, we'll give you some things that make you better right now, just to prove how much we trust what we do and for a little bit more money,  you can have more things. So. [01:02:00] All right, cool. So I think, listen, we're coming up to the end on time here. I think we've done a, I think you've done a great job here of explaining what marketing is, why it's so challenging in our industry.

Some of the things that can be done to make it better, both from the practitioner and CSO side, and frankly, putting a lot of the weight back on marketers to stop being bullshit artists. I mean, I think the answer to the question is, 

Emily Phelps: Most of them are not.

AJ Nash: Right. Is any marketing not bullshit?

The answer is yes. I mean, a lot of the marketing is not bullshit, there's a lot of bullshit out there. And that's the challenge we're trying to get through. And

I  I hope that this has done wonders to help some folks understand why it exists and how to counter it and how to not feed into that and maybe how to even punish organizations that are participating in bullshitting so that we have less of it in an industry going forward.

Emily Phelps: Or just not reward, just don't reward. 

AJ Nash: Exactly. As long as you keep going. Oh, wow. That's quite a claim. I'm sure it's shit. But you know what? I should go check those guys out. Well, then it worked like it. It isn't really good. If you say I think they're full of

shit, I'm go check them out. Well, then that works. Yeah. I'm going to go prove they're full of shit by demonstrating their product.  having them demo their [01:03:00] product. Well, then they won. The whole goal was to get you to do the demo. They don't care if you did the demo because you're excited because you think they're stupid and you want to prove them wrong. If you're willing to put your time into seeing their product, they won. If you look at a marketing campaign and go, God, what garbage? The next answer should be, I'm not doing business with them until they give me something better. Unless again, unless somebody, a colleague or a close friend or somebody who knows things goes Oh, no, they actually can do everything they say, but otherwise I'm just going to pass on that product or service and be like, listen, that's the only way I can deal with this.

I think the only way that there's an appropriate answer is no, I can't give you my time. I'm not going to come in. It's just like trolls on the internet. And I make this mistake sometimes, but I'm going to prove this guy wrong. And I pick a fight and I spent 20 minutes with somebody who I don't know and don't care about to try to explain something and bring in all the facts and data.

And then they just pretend it didn't exist anyway. And you just realize what a waste of my time and energy. This was. My answer should have been that guy's full of shit and everything. He says is nonsense block and move on. And I think that's what we got to do with some of these vendors as well. So listen we're up on time.

As I said, I want to [01:04:00] get to the closer question. The name of the show is Unspoken Security with that in mind, every guest. and you're on the hot seat today. Every guest gets asked the same question. You don't get out of it.  Unspoken Security. So, with that in mind, you need to tell me, please, and tell the audience something that to this point in your life has,  has gone, you haven't told other people has gone unspoken.

So,  what's your story? What do you got

Emily Phelps: Okay, so very little in my life has gone unspoken, which you could probably tell often I talk and our long friendship. But this is something I haven't told a lot of people. It just hasn't come up because when it happened, I was working two jobs in graduate school, but I got a ticket for not wearing my seatbelt while I was wearing my seatbelt and I was enraged.

enraged. I was pulling into my work parking deck and I got pulled over and I was like, what? I do not like, I am a rule follower. I just am for the most part. I don't like that. And he comes in and he's like, the police [01:05:00] officer said, well, I'm giving you a ticket for not wearing your seatbelt. I just looked down and looked at him and it was very clear.

And he said, well, I didn't see it. So he gave me the ticket. Now I'm short, I'm five feet tall. And I had, it was winter, and I had a big furry collar, like, almost a famous kind of coat, picture like a Penny Lane coat. So I'm sure he couldn't see it over the shoulder, but you saw when you stopped, did you? I mean, I put on my seatbelt when I like, go from one part of a parking lot to another part of a parking lot.

Like, if I'm in a shopping center. And it was cheap, and I was going to fight it and like, go to the court date. But I, like I said, I was in graduate school and it was set for when I had my hardest final. So I was like, I'm just going to pay it, but I'm really upset. Cause I have to check this bus and say that I was guilty and I was not guilty.

And I was in, I was enraged. I was so furious. 

AJ Nash: Uh, yeah, I can imagine. mean, 

Emily Phelps: yeah.

AJ Nash: It's ridiculous, mean, it's [01:06:00] ridiculous, right? I mean, you had it on and I understand, I mean,  listen, from the police standpoint, for anybody who might listen to this, I know people stop and then they slap their seatbelt on real quick. And I'm going to assume he was able to see that you hadn't done that.

You haven't been scrambling in your seat or whatever.  it's yeah, it's a, it's an unusual story.  I generally don't

Emily Phelps: Yeah. Like maybe he didn't look yeah, but yeah, I'm

AJ Nash: Yeah, I mean, who gets a ticket for things

they actually weren't doing wrong, 

Emily Phelps: I'm still mad.

AJ Nash: Meanwhile, I get pulled over somewhat regularly.

I just got pulled over again a few weeks ago. And I get warnings all the time. So,  I moved back to Minnesota, spent a couple of years now. I think I just did the math. I think I've been pulled over six times now since I got back. To my home state and I've got six

Emily Phelps: And you've not gotten a ticket. Wow.

AJ Nash: Every time it's the same story,  I have a clean record of course, and so I get a warning and therefore I continue to have a clean record, so I get warnings. I'm actually reasonably convinced it's because I'm retired military and they see my military ID and my driver's license and let me go, but Now that I've said that, I'm sure I'm going to get a ticket and get in all sorts of I'm stupid, but but yeah, the opposite 

Emily Phelps: might. You 

AJ Nash: I'm breaking the law regularly and not getting [01:07:00] tickets. You are obeying the law and our world class rule follower and picked up a ticket that you were forced to pay. I've actually gone to court and beaten that shouldn't have been beaten. So, yeah we're definitely on the opposite side of this coin. It all balances out, I guess that's how it works. Like the,  the system all gets its money. It just gets it somehow. And I'm just on the opposite 

Emily Phelps: I mean, it was just a $17 ticket at least. Like, if it was a ticket, but yeah, no. It was, but I was, it was the principal. And if it had been for any other final, I would have told my professor, like, no, I will take it early, but I'm fighting this. But it was my final. I needed every second to study.

And I just could not. And it was my last semester. So,

AJ Nash: it's good

prior, good 

Emily Phelps: it's not on my record this was, I was in graduate school. Oh, but so mad.

AJ Nash: Yeah,

Emily Phelps: You can picture my angry face. I don't get very angry very

AJ Nash: It's a very feisty, five foot tall woman, just very feisty. All right. So listen, we're going to wrap it up for today. Emily, I can't [01:08:00] thank you enough for coming on.  I really appreciate it.  I love working with you and,  one of the reasons I wanted to have you on the show, it's,  it's an unusual topic.

We haven't done a lot of marketing type stuff but I think it's important. We all deal with this in the industry, all this marketing bullshit. And I thought, well, bring somebody on who's not a bullshitter and who's good at marketing to tell us what the challenges are and how we can overcome it.

So I appreciate you making time to come on the show. It's been great,  spending time with you today. Is there anything I missed? I'll give you one last shot. Anything you want to jump in and then we miss before we wrap this up. Otherwise I'm going to, I'm going to close this up and give some folks the rest of their day. Anything we missed that you want to hit some last notes.

Emily Phelps: No, I mean, I think we kind of covered all of it. I think it's an evolving relationship. And I, I would just say,  as we marketers work hard to get further into the weeds of the product and of the tech space,  we just wanna make space for where we can speak authentically and not get beat down immediately.

Just let's think that there's a lot of [01:09:00] opportunity for us to work together. Basically, I just want everyone to be friends.

It's the mom 

AJ Nash: It's like, it's a great, it's a great motto. We should all be friends. I agree. All right. Well, with that, listen, again, I want to thank you for being on the show. Thank everybody for listening and watching, please like, and follow and subscribe and leave good comments. If you have great things to say, I'd love to hear it.

If you have negative things to say, you can keep them to yourself.  but no, you can. Send me messages if you want AJ at unspokensecurity.com. If you want to, or wherever you can figure out how to do it, subscribe to all the great podcast places, or come see our website at unspokensecurity.com. Again, thanks everybody for taking the time. And until next time this has been another episode of Unspoken Security.