Prospect: You charge HOW MUCH per day?

Me: Standard rate of X

Prospect: We've NEVER paid that much per day before.

Me: I understand it seems like a lot. May I ask what the average length of your engagements were before?

Prospect: 2-4 mo.

Me: Were there fixed deliverables?

Prospect: Well we got a standard report.

Me: Let's talk a little bit about what makes us different.

1. If I'm there 4 months you just hired a CISO.

2. If all you get is a report, we were there a few days.

3. If deliverables aren't exactly as written in the SOW you don't pay.

4. We don't claim to be the cheapest. We aren't. We don't claim to know or do everything either. We are damn good at what we do. We do it in a timely and professional manner. We deliver tangible value. Most importantly, we won't milk the clock. Fixed time fixed deliverables.

Working with us means you are feeding MY family and my teams family. It means supporting important research and directing funds to smaller security startups, diverse and incredibly talented people. You aren't buying our next AD campaign. Those dollars save lives and protect data.

Prospect: OK looking at your SOW, it is 1/3 of the length of anything we've seen. It's 40% less expensive and has clearly defined deliverables. You're confident in this time frame?

Me: See line 3 "Any excess time required to meet the defined deliverables will be at our expense".

Prospect: Ah! OK. You make it really hard to say no lol.

Me: You shouldn't have to choose between cheap and good. We take pride in our work. We appreciate our customers trust. We don't have a fancy sales team or marketing. It's just us. We need your business. We want to earn it.

InfoSec HAS to change the way it does business. We don't need more flashing lights. We need more value and communication. We have to focus our work on bringing tangible and measurable results. If your organization wants REAL results and not just another report, please reach out.