Chapter 4: Self-Preparation: Soft Skills – Selling Information Security to the Board


‘People buy people first, and everything else second.’

Good sales people recognise this instinctively. Poor sales people are smarmy, incongruent or irritating. Non-sales people don’t even try.

So, what sort of people do people buy? The answer is that ‘people like people like themselves’. Most people recognise the broad truth of this statement: their friends have similar interests and lifestyles. Most people marry within their culture, social class, religion and racial background. People are just more comfortable with people like themselves.

Your senior management, however, are not necessarily people like you; they may not feel comfortable with you and, if you persist in speaking tech, they may not even understand you. And, if you persist in displaying how much you know about your subject, they’ll find you irritating. If you’re good at what you do, you’re good at what you do: you don‘t need to show off your technical knowledge all the time. Business managers are not equipped to assess your technical competence. They assume that, because you have the role that you do, you are competent to do your job. What they are interested in is whether or not you can help them to do theirs.

So, how do you get senior management to ‘like’ you? The answer is not to try to be likable, or to pretend to be like them: all the time we see politicians trying to be like the ordinary person in the street and we find it false, hollow and condescending. You can, however, without being either false or condescending, dress and behave in a way that informs the person with whom you are talking about how you want to be treated. If the executives in your business wear suits, polished shoes and have their hair done regularly, you’re unlikely to be taken seriously if you wear Converses, dirty jeans and have unkempt hair. Facial jewellery, neck bolts and other marks of ‘individuality’ are likely to mark you out as someone ‘not like us’. Outsiders rarely get a proper hearing and so, if you want to successfully sell information security to the board, you have to present yourself in a way that enables you to be considered as a possible insider.

Appropriate dress is just a starting point. You need to empathise with your prospect. The truth is that you can’t actually begin to empathise with someone until you’ve made an effort to understand them. The idea that you must walk half a mile in a person’s shoes before you can understand their approach to the world is a good one.

There are five tools for understanding other people: who, what, where, when and how. Any one of these five words, put in front of a sentence, creates what is known as an ‘open question’. An open question is one to which the answer cannot be either just ‘yes’ or ‘no’.

‘Are you interested in my proposal for deploying an IDS?’ is likely to get either a ‘yes’ or a ‘no’ answer. Unless that is the answer you want, asking this sort of question (a ‘closed question’) is not a good move.

‘What advantages could we get from stopping hackers before they get into the network?’ is an open question: one to which neither a ‘yes’ nor a ‘no’ would make sense as an answer. Open questions encourage the person to whom it is directed to open up and, in their answer, to provide more information that enables you to start understanding their attitudes, objectives, needs and wants.

It’s important, when you’ve asked a question, to shut up and wait for the answer. Rhetorical questions are those which contain their answer – and an emotional charge: ‘wouldn‘t our shareholders want us to protect the network from hackers?’ Most senior managers don’t like being posed rhetorical questions, mostly because they suspect that the issue is more complex than the question implies.

Ask a question, and then use your eyes and ears in proportion to how many of them you have, in relation to the number of mouths you have: watch for your listener’s reactions and listen to their words. Bear in mind that, in most communications, only seven per cent of the message is contained in the words themselves. 38% of the message is conveyed by tonality, and 55% is conveyed by body language. That’s why it’s so easy for e-mail messages to provoke unintended consequences and misunderstandings, and why telephone selling can be so difficult. Many top managers and top sales people want to meet face to face, because they know that they will only give, and get, the complete communication in that situation.

While some sales people will want to get familiar with a suite of communication skills, most people have a latent talent for recognising people’s actual emotions about a subject, from their physical behaviours while listening to a proposition or answering a question. That information should be treated as information: it needs to be explored.

Follow-up questions should attempt to open up areas of concern and discomfort, so that issues can be identified and resolved; other strands of questions should develop areas of agreement and common purpose, as it is from these areas that understanding will grow.

Finally, a word on written communications: senior management expect to see written communications that are syntactically and grammatically acceptable, that follow standard spelling and typographical conventions and which, above all, follow a fairly standard format in terms of structure and layout. While I’ll return to the subject of proposal writing later in this pocket guide, it’s worth bearing in mind that clearly written communication is important in establishing yourself as a credible contributor to corporate life.