Social Engineering the Social Engineers: How To Not Suck at Buying Software

David Girvin opens with his move from hands-on offensive security into the vendor side, going from pen testing and security leadership roles to working as a sales engineer. He frames the talk as a look at how security tools get purchased, seen from both the buyer's seat and the seller's, and argues that each side misreads the other's incentives. He walks through the sales pipeline in order: prospecting by sales development reps, discovery calls, proof-of-value trials, executive alignment, and procurement and pricing. Along the way he explains how compensation shapes behavior and why pricing complex platforms takes real discovery work.

The middle of the talk focuses on pitfalls. Buyers are urged to build a scorecard before evaluating, to confirm they have data access and staff time for a proof of value, and to define scope and success criteria in a shared document. He warns against vague marketing claims, hidden costs, curated sandbox trials that do not reflect real conditions, and buying one broad tool on the promise that it fixes everything. He also recommends asking partners and resellers whose interests they actually serve.

He closes by urging buyers to be candid about budget and decision authority, and sellers to be open about product limits. The takeaway is that a mutually beneficial deal holds up better than one won through pressure, and that a practitioner who understands the other side's constraints can negotiate outcomes that work for everyone involved.