Marketing security to C-levels

While the RSA 2008 show floor engendered the usual feelings of euphoria I had the most valuable learning experience at a breakfast meeting hosted by Marci McCarthy of the Executive Alliance. Marci has been building a successful business around the idea of creating an Academy Awards for security professionals. I have participated in a few of her events over the years and was always impressed at her team's ability to fill a room with IT execs.

As an introduction to what her program is all about she invited security marketing folks to a panel discussion with three of her past award winners: Bob Frank of AAA , Suzanne Hall of Lerner Enterprises and Craig Shumard of CIGNA . These where top-flight CISOs who where more than candid about what works and what does not when trying to get your product or service in front of them.

What does NOT work:

Email: All three panelists expressed disgust with unsolicited emails. They delete them without opening them. Often they will add the sender to their spam filters.

Webinars: Educational webinars are often something they will have their team members tune into but they hate the barrage of sales calls that are kicked off they provide contact info.

Direct mail. Do not bother. The more elaborate the piece the more they wonder how the vendor could afford to squander so much money. One panelist mentioned though that he loved the ear-buds for an ipod that vendors send (respond and we will send you the matching iPod!). He says he loses his ear phones all the time so these freebies make great replacements. In other words, they don't help to generate a call back from the prospect.

Phone calls: Three years ago I took on the task of getting sponsors for the Detroit Security Summit. I was shocked at how no one ever returned calls. The day I showed up for work as CMO at Fortinet my phone rang non-stop with people selling advertising, direct mail, lead gen, etc. I soon figured out why people did not pick up their phones anymore.

The panelists all had the same experience. They do not answer the phone. They have their admins screen calls. Sometimes aggressive sales people would try social engineering techniques such as pretending to be a brother or sister. Don't even bother cold calling C-level execs was your message.

What works:

Word of mouth and networking. These execs, like most in my experience, rely heavily on interaction with their peers. The best way to reach them is through their peers and by implication helping to facilitate peer to peer communications.

Referrals. Yes these work. But do not call in and leave a message that "so and so said I should talk to you". Have so-and-so call or email the prospect directly.

Articles and case studies. At least one of the panelists read trade journals and would follow up on interesting news announcements or case studies that addressed a current issue he was having.

Analysts. Two panelists use Gartner Magic Quadrant's as litmus tests and advise vendors to get on them. The third said they were not as important.

No real surprises here but to have these three all speak with the same voice really helps explain why direct mail response rates are so low (<1%) and why phone calls are almost useless. If you are marketing to the C-Level you have to be imaginative and offer value for their time.

Tomorrow: Stiennon’s Best of RSA 2008 Picks.

Update:  Executive Alliance can be found here .  The Info Security Awards can be found here.