Marketing Security Products to Skeptical Buyers

Short answer: enterprise security buyers discount your claims because verifying untrusted assertions is their job description, and you are an interested party making assertions about their threat model. What moves them is evidence they can check without your help — participation in an independent evaluation whose methodology is published, a benchmark they can reproduce in their own environment, a written statement of where your product fails, and named references who agreed in advance to take the call. The 99.9%, the "best-in-class", the logo wall: the committee filtered those out before your rep dialled.

This is not a security post — I am a marketer who builds software, not a threat researcher. It is about the evidence layer underneath the marketing, and every external number in it is linked to its source.

The skepticism is trained, not personal

Enterprise security runs on one assumption: treat input as hostile until proven otherwise. Least privilege. Zero trust. Signature verification. A security engineer spends their working life assuming the confident assertion in front of them was written by someone with an incentive to mislead.

Your marketing page is an unauthenticated input from an interested party. It gets the same treatment, and taking that personally is the first mistake. It is also warranted. In August 2024 the FTC took action against camera vendor Verkada, whose privacy policy claimed it used "best-in-class data security tools and best practices to keep your data safe" while, the FTC alleged, failing to implement appropriate security — a hacker reached 150,000 live camera feeds. The same complaint charged that employees and a venture investor posted positive reviews without disclosing the relationship (FTC press release, 30 August 2024).

Two months later, the SEC charged four public companies — Unisys, Avaya, Check Point and Mimecast — with materially misleading disclosures about the SolarWinds intrusion, with penalties ranging from $990,000 to $4 million (SEC press release 2024-174, 22 October 2024). One of the four sells security software.

A buyer who has read either of those stories is not being difficult when they ask which corpus your detection rate came from. They are doing the job they were hired for.

The person you convince still has to defend the choice

Gartner puts the typical B2B buying group at six to ten stakeholders, each arriving with four or five independently gathered pieces of information they then have to reconcile (Gartner, The B2B Buying Journey). Gartner's 2025 sales survey found 74% of B2B buyer teams show what it calls unhealthy conflict during the decision process (Gartner newsroom, 7 May 2025).

So your champion is not the audience. Your champion is a courier. Whatever you hand them gets carried into a room containing at least one person whose professional incentive is to find the hole in it — usually the person who owns the risk register.

Write for that room. The useful question is not "does this page persuade the reader" but "does this page survive being forwarded to a hostile reviewer with no context".

What a claim is worth depends on who can check it

Here is the audit I would run over a security vendor's homepage. Left column: the claim as written. Middle: what the buyer does with it, unprompted, in the first ten minutes. Right: the artefact that would have made the claim stick.

The pattern down the right-hand column: every artefact is something the buyer can verify without believing you first.

Independent evaluation is the only claim that transfers

The clearest example in this industry is MITRE's ATT&CK Evaluations. Scenarios are built from attributed threat intelligence, the methodology is published, and per-technique results are published for every participant at evals.mitre.org. The 2025 enterprise round ran Scattered Spider and Mustang Panda scenarios across eleven participating vendors (SecurityWeek coverage).

The most important design decision in that programme is the one vendors complain about: MITRE does not rank participants. It states plainly that the evaluations do not rank vendors, and publishes the evidence for buyers to interpret themselves.

That refusal is the source of the credibility. An evaluation that declares a winner is a marketing asset; an evaluation that refuses to is a measurement. If you participate and land mid-pack, you still beat every competitor who did not participate at all — because a skeptical buyer reads non-participation as a decision, and they are usually right.

A badge is worth exactly the evidence behind it

Take the CISA Secure by Design pledge. Seven goals, covering MFA, default passwords, vulnerability classes, patch uptake, a vulnerability disclosure policy, CVE record quality, and intrusion evidence for customers. Good goals. But CISA's own page says the pledge "is voluntary and not legally binding" and that "CISA does not enforce nor verify adherence to the pledge" (CISA Secure by Design Pledge).

A buyer who reads that page — and the technical evaluator will read that page — now values your badge at the level of the self-report behind it. So publish the self-report. Dated progress on all seven goals, including the two you have not moved on, beats a logo in your footer by a distance.

Publish your own unflattering numbers

This is the strongest credibility move available in any category, and almost nobody makes it: publish a number that damages you.

It works because it is expensive to fake. Anyone can commission a favourable benchmark. Nobody publishes their bad quarter for fun.

I do this on this site with my own traffic. Over the 85 days to 3 September 2026, santoshpaudel.me got 22 clicks from 4,553 impressions — a 0.48% click-through rate across roughly 390 indexed URLs. The United States produced 970 impressions at an average position of 38.8 and zero clicks. Russia produced 1,320 impressions and zero clicks. Nepal produced 8 clicks from 74 impressions at position 9.2, a 10.8% CTR, and it is the only healthy number in the set.

The pattern inside those numbers indicts my own writing. Posts where I documented building something — Claude Code, Supabase, Vercel, the actual commits — sit between positions 2.8 and 15.5. Posts titled some variant of "[industry] content marketing" sit between 46 and 81. Same author, same domain, same quarter. Of 279 posts, about 150 average 380 words with no table, no code, no internal link and no image.

Publishing that costs me nothing except ego, and it does more for my credibility than any case study I could write, because a fabricated version of it would be an absurd thing to fabricate. I apply the same rule to what I build: my agent system writes proposals into an approval queue rather than holding write access, and I say publicly that this is because I do not trust it with the live tables yet.

The security equivalents are not hard to find:

• —Your false positive rate at a stated production event volume, not in the lab.
• —The attack classes your product does not cover, named.
• —Median and worst-case time from CVE publication to detection shipping, with the bad month included.
• —The last incident you handled badly, and what changed afterwards.

Each of those is something your competitor will not publish, which is the entire point.

Score your claims before the buyer does

Before a page ships, I run its claims through a scoring pass. The weighting below is mine, not research — but it forces the argument to happen inside your building instead of in the evaluator's Slack.

from dataclasses import dataclass

@dataclass(frozen=True)
class Claim:
    text: str
    third_party: bool      # evidence produced by someone who does not work for you
    method_public: bool    # the buyer can read how it was measured
    reproducible: bool     # the buyer could re-run it in their own environment
    limits_stated: bool    # you named the conditions where it does not hold
    named_reference: bool  # a named customer will take the call

# My weighting, not research. Third-party evidence and reproducibility carry the
# most weight because they are the two things a buyer cannot fake on your behalf.
WEIGHTS = {
    "third_party": 30,
    "method_public": 20,
    "reproducible": 25,
    "limits_stated": 15,
    "named_reference": 10,
}

def score(c: Claim) -> int:
    return sum(w for k, w in WEIGHTS.items() if getattr(c, k))

def verdict(s: int) -> str:
    if s >= 70:
        return "survives review"
    if s >= 40:
        return "needs one more artefact"
    return "will be discounted to zero"

def audit(claims):
    return [(c.text, score(c), verdict(score(c))) for c in claims]

if __name__ == "__main__":
    # Invented example claims, scored. Not real product data.
    claims = [
        Claim("Blocks 99.9% of threats", False, False, False, False, False),
        Claim("Median detection latency 4.2s on the published test corpus",
              False, True, True, True, False),
        Claim("Our detection counts, linked to MITRE's published evaluation data",
              True, True, True, True, True),
    ]
    for text, s, v in audit(claims):
        print(f"{s:3d}  {v:<28} {text}")

    assert score(claims[0]) == 0
    assert verdict(0) == "will be discounted to zero"
    assert score(claims[1]) == 60 and verdict(60) == "needs one more artefact"
    assert score(claims[2]) == 100 and verdict(100) == "survives review"
    assert sum(WEIGHTS.values()) == 100
    print("ok")

Output:

  0  will be discounted to zero   Blocks 99.9% of threats
 60  needs one more artefact      Median detection latency 4.2s on the published test corpus
100  survives review              Our detection counts, linked to MITRE's published evaluation data
ok

The middle row is the interesting one. A published, reproducible, caveated benchmark still scores 60, because you ran it yourself. That gap is exactly what independent evaluation buys, and why it is worth the engineering time to enter one.

Where this changes the funnel

Discovery calls stop being qualification theatre

The most valuable question on a first call with a security buyer is not about budget or timeline. It is: what evidence would settle this for your team? Then stop talking and write the answer down verbatim, because they will tell you precisely which artefact unblocks the deal. My discovery call framework covers the rest of the sequence, but that one question does most of the work in this category.

The commitment ladder has different rungs here

A reference call is an enormous ask early on — it spends your customer's goodwill and your buyer's political capital. A benchmark repo they can clone is a tiny one, and it produces a stronger signal, because they generate the evidence themselves. Order the asks accordingly; the commitment ladder is the model I use for sequencing them.

On LinkedIn, publish the method, not the claim

Nobody in this audience reshares "we block 99.9% of threats". They do reshare a post explaining how you measured false positives and what you found when the number moved the wrong way. That is also the only kind of LinkedIn presence that survives contact with an engineering audience.

What I could not source

I went looking for a controlled study on enterprise security sales-cycle length, and on buying-committee size specific to security software. I did not find one I would put my name to. Plenty of vendor blogs quote confident averages; they trace back to other vendor blogs, or to survey panels with no published methodology. So the Gartner figures above are general B2B research and I have left the security-specific version out, rather than launder a number I cannot check. That omission is this post's own argument, applied to itself.

FAQ

How do you market a cybersecurity product to enterprise buyers who are skeptical of vendor claims?

Stop asking to be believed. Replace each assertion with an artefact the buyer can verify independently: participation in a public evaluation with published methodology, a benchmark harness they can run in their own environment, a written list of what your product does not do, and references who have pre-agreed to take the call. Then publish at least one number that hurts you.

What proof do enterprise security buyers actually accept?

In rough order of weight: results from an independent evaluation that publishes its methodology and refuses to rank vendors; benchmarks the buyer reproduces themselves; a compliance report they can read in full, exceptions included; named customer references in their own vertical; and your own published failure data. Vendor-commissioned research and paid placements sit at the bottom, because both are purchasable.

Do certifications like SOC 2 or ISO 27001 convince security buyers?

They clear a gate; they do not win a deal. Any serious evaluator reads the report rather than the badge, and goes straight to the exceptions. Treat certifications as table stakes and spend your effort on the evidence that differentiates — which is usually the material you are most reluctant to publish.

Should we publish our false positive rate?

Yes, with the conditions attached: the event volume, the tuning state, the environment. A stated FP rate with visible caveats is more persuasive than a better rate with none, because the caveats are what prove the number was measured rather than chosen.

Selling something technical to buyers who have been lied to before? I build the evidence layer — the benchmark, the methodology page, the honest numbers — and the content that carries it. See my services or get in touch.