How to sell your soul, err, your security program

Jenn Gile opens by noting that security programs often get labelled a cost center and resisted by engineering, finance and procurement. She argues the fix is mostly about relationships and messaging rather than tools, and borrows methods from product marketing.

The core of the talk is a five-step process. Map the buying committee into technical champions, budget holders and influencers. Interview stakeholders with open-ended questions about their goals and metrics before raising security at all. Turn the findings into personas, then write a messaging guide covering the problem, its business impact, value propositions, supporting evidence and a call to action. She illustrates this with an SCA tool rollout pitched to engineering.

To finish, she recommends validating the messaging with a small group, rehearsing it through role play, and using generative AI to summarize recorded interviews and translate security metrics into terms engineers already use. Audience questions covered small versus large organizations and how to persuade a reluctant leader. Her takeaway is to treat the program as a product and learn what stakeholders value before pitching.