Cybersecurity sales objections, questions and competitors

When they push back.

The objections cybersecurity buyers raise most, what to say in the next ten seconds, and what not to promise.

"That's a lot more than we budgeted."

What are you comparing it to, and what would it need to replace or reduce to be worth it?

Do not discount before you understand the comparison. Do not use fear to justify price.

"Swapping out our current tool is too disruptive."

What worries you most about switching: the rollout, a gap in coverage, or retraining the team?

Do not say switching is easy. Do not promise zero coverage gaps.

"We built our own detections and tooling."

That's a strong team. What does maintaining it cost you, and who owns it if a key engineer leaves?

Do not imply their work is weak. The engineers who built it may be your champions.

"This isn't a priority right now."

Understood. What is at the top of the list, and where does this gap sit compared to it?

Do not invent urgency or point to news of other breaches to create pressure.

"You'll need to pass our own security and privacy review."

Of course. What does your review cover, and can we start the questionnaire now?

Do not answer from memory or overstate certifications. Accuracy matters more than speed here.

"Microsoft (or our firewall vendor) already includes this."

It may. Which parts are you using today, and how well do they cover this gap?

Do not attack the incumbent. Do not claim gaps in their product without checking.

Every one of these is a deal that slips a quarter if you fumble it. Ghost puts the answer on your screen while the buyer is still talking.

Download for Windows Download for Mac

When they name a competitor.

Give them credit, then ask whether that vendor's strength matters to this buyer.

Palo Alto Networks

Palo Alto is a leader across network, cloud and SOC. How important is buying many of those from one vendor for you?

CrowdStrike

CrowdStrike is one of the best-known names in endpoint protection. Beyond endpoint, what else do you want from one platform?

Microsoft Security

Many teams already own Microsoft security in their licensing. How much of it is deployed, and where do you still see gaps?

Fortinet

Fortinet is well known for firewalls and secure networking. How much of your security plan is network-centered today?

Cisco

Cisco brings networking, security and Splunk together. How much do you want security tied to your network vendor?

Zscaler

Zscaler is a leader in cloud-delivered zero trust access. How far along is your move away from VPNs and the old perimeter?

SentinelOne

SentinelOne is a strong name in autonomous endpoint protection. What matters most to you after endpoint: cloud, identity or data?

Check Point

Check Point has a long track record in network security. How do you weigh that track record against where your environment is heading?

Wiz

Wiz is one of the best-known names in cloud security. Who owns cloud risk on your side, security or engineering?

Proofpoint

Proofpoint is a leader in email security and people-focused protection. How much of your risk starts with email and users?

Questions that qualify the deal.

Ask these on the first call. Then dig into the pain when they say it out loud.

Qualify

What are you running today for endpoint, identity, cloud and email, and where do you feel least covered?
Roughly how much of what your analysts look at turns out to matter, and what gets skipped?
If someone got in through this gap, what would it hit first, and who would have to explain it?
Is there a date driving this, like an audit, an insurance renewal, a contract renewal, or a board meeting?
Who has to approve this beyond your team, like IT, procurement, or the board?
Is this funded already, or would it come from consolidating tools you're paying for now?

Dig into the pain

"We have too many tools and consoles." Which tools overlap most, and which consoles do your analysts actually live in?
"We can't hire enough security people." Where is your team stretched most right now, and what work falls through the cracks?
"We don't know everything that's running in our environment." How do you find new assets, cloud accounts or identities today, and how fast?
"Compliance is eating our team's time." Which audits or frameworks take the most effort, and what part is still manual?

Know who is in the room.

Cybersecurity software protects a company's endpoints, networks, identities, cloud workloads, email and data. It also helps security teams find threats, investigate alerts and respond to incidents. Most companies run many security tools from several vendors, and a lot of buying is about closing a gap or consolidating overlap.

Who buys and who signs

Economic buyer: The CISO, or the CIO or CTO where there is no CISO. The CFO, CEO or board gets involved after an incident or for large platform deals.
Champion: A security architect, SOC manager, or security engineering lead who feels the gap every day.
Users: SOC analysts, incident responders, security engineers, IT admins, cloud and platform engineers, GRC and compliance staff.
Blockers: IT and infrastructure (agent deployment, performance, change windows), procurement and finance (tool sprawl), legal and privacy (data handling), and engineering teams worried about slowdowns. Existing vendor relationships and enterprise agreements are a quiet blocker.

Signs the deal isn't real

Nobody can name the risk or gap this tool closes.
The CISO or security lead has not been in a meeting.
A proof of value with no success criteria or end date.
They just signed a multi-year platform deal that covers this area.
The evaluation exists only to meet a procurement rule that requires several quotes.
No one owns deployment or the tool after purchase.
They want help writing the RFP but will not share who else is in it.
Budget depends on an incident that has not happened.

20 words cybersecurity buyers use

SOC: Security operations center, the team that watches and responds.
EDR / XDR: Endpoint detection and response; extended detection and response across more data sources.
SIEM: Security information and event management, the central log and alert system.
SOAR: Security orchestration, automation and response.
MDR: Managed detection and response, an outsourced SOC service.
Zero trust: Verifying every user and device on every request instead of trusting the network.
SASE / SSE: Network and security delivered from the cloud.
IAM / PAM: Identity and access management; privileged access management.
CNAPP / CSPM: Cloud security platforms; cloud security posture management.
MTTD / MTTR: Mean time to detect and mean time to respond.
Attack surface: Everything an attacker could target.
Alert fatigue: Analysts overwhelmed by too many low-value alerts.
GRC: Governance, risk and compliance.
Proof of value (POV): A hands-on test in the buyer's environment.
Tool consolidation / platformization: Moving from many point tools to fewer platforms.
Do you support OIDC?: A standard way to prove who someone (or a pipeline) is, without sharing passwords or long-lived keys.
How do you handle least privilege?: Give each person or tool only the access it needs, nothing more.
Do you support SCIM?: Automatic adding and removing of user accounts from the company directory, like Okta or Entra ID.
What is the blast radius if something goes wrong?: How much breaks if one thing fails or one mistake is made.
Can we enforce policy as code?: Rules written as code that run automatically to block changes that break them.

Selling cybersecurity: questions

What objections come up when selling cybersecurity software?

The most common are: "That's a lot more than we budgeted", "Swapping out our current tool is too disruptive", "We built our own detections and tooling", "This isn't a priority right now", "You'll need to pass our own security and privacy review" and "Microsoft (or our firewall vendor) already includes this". Each one above has a line to say back and what to avoid.

What discovery questions should I ask a cybersecurity buyer?

Start with: What are you running today for endpoint, identity, cloud and email, and where do you feel least covered? Roughly how much of what your analysts look at turns out to matter, and what gets skipped? If someone got in through this gap, what would it hit first, and who would have to explain it? Is there a date driving this, like an audit, an insurance renewal, a contract renewal, or a board meeting?

Who are the main competitors in cybersecurity software?

Buyers most often compare Palo Alto Networks, CrowdStrike, Microsoft Security, Fortinet, Cisco, Zscaler, SentinelOne, Check Point, Wiz and Proofpoint.

Who buys cybersecurity software?

Economic buyer: the CISO, or the CIO or CTO where there is no CISO. The CFO, CEO or board gets involved after an incident or for large platform deals.

How does Ghost help on cybersecurity calls?

Pick the cybersecurity market pack in Ghost's setup and every card on this page loads into Ghost. When a buyer raises one of these objections or names one of these competitors on a live call, Ghost shows you what to say on your screen, hidden from screen shares and recordings.

Other markets

CRM Cloud infrastructure Data and databases DevOps and developer tools Observability ERP Collaboration HCM and payroll Analytics and BI ITSM and IT operations Supply chain Marketing automation Contact center and CX Finance and spend Ecommerce PLM and CAD Healthcare EHR Payments and POS Applicant tracking

Cybersecurity software: what buyers say on the call, and what to say back.