Can we please stop bludgeoning cybersecurity buyers?

Attention seeker overload is alive and well in Cybersecurity

Everyone is trying to get the attention of the same people: CISOs, security leaders, buyers, budget holders, practitioners with influence. Their inboxes are rammed, LinkedIn is worse, every event claims to have “the right people in the room”, and somewhere between marketing automation, SDR cadences, intent data and “conversational” everything, we seem to have decided that being able to reach someone means we’re entitled to keep doing it.

Newsflash: We’re not.

Dearest Sales and Marketing friends, we need to stop confusing reachability with permission.

You cannot just bludgeon someone into submission.

Access isn’t an open invitation

Digging up someone’s email address in ZoomInfo technically means you can email them (as long as you’re following the related compliance rules, obvs.). Spotting them in a Slack or Discord community means you know they’re there. Pulling up their LinkedIn profile just means they’re on LinkedIn.

None of that gives you carte blanche to chase them across every available channel until they crack.

And “conversational marketing” deserves a special (hell) mention here. If by conversational you mean appearing in someone’s WhatsApp and attempting to start an unsolicited sales conversation, guess what… that conversation is likely to be short and very likely sharp.

We’ve also developed some spectacularly aggressive habits around the idea of “intent”.

Someone changes job and on a dashboard the “FRESH MEAT” alert starts excitedly flashing away. Suddenly vendors descend en masse because a new CISO must obviously be desperate to rip out their entire stack before they’ve worked out where the toilets are.

A company raises funding and apparently that means everybody with a security product now has a compelling reason to get in touch.

Someone speaks on a panel and hearing them answer a question becomes justification for “I really enjoyed your thoughts on…” followed three lines later by a demo request.

Silence is more than golden, it's key information

Then the barrage of follow-ups begins, and this is where it goes from mildly irritating to frankly ridiculous.

A couple of sensible attempts? Fine. We’ve all meant to reply to something and forgotten. I’ve seen something go past at a moment where I’m in the middle of something else, and the second reminder has actually been helpful.

But at some point, we need to accept that silence is key information.

If email one didn’t work, email two might be reasonable. By email six, multiple LinkedIn messages, a voice note, and another “just bubbling this back to the top of your inbox”, perhaps consider the possibility that I HAVE noticed you.

I’m simply choosing not to engage. That is allowed.

Your outreach sequence is not a relationship

Bothering your perceived economic buyer to the point where they start mentally drafting a court order hurts rather more than the opportunity sitting in your CRM.

It hurts you, it hurts the company whose logo is attached to every ill-thought-out message you send. It hurts the next company you work for too, because people remember names as well as brands. And frankly, it hurts anyone else who comes along afterwards with the first, second, third, or ninety-bloody-third variation on the same “if I just do this enough, eventually someone will definitely bite” playbook.

People talk amongst themselves in this industry too, so it doesn’t take long for news to get around.

Yes, of course this also happens outside of cybersecurity. I was in my first CMO role for less than a day before the first chirpy outreach message duly rocked up in my LinkedIn DMs. The following day, a host of unsolicited emails started arriving, most of which wound up in the spam folder, tbh. It wasn’t long before the follow-up tsunami kicked in.

And I don’t think I’m special in remembering when people behave this way. Push hard enough and I will remember you long after I’ve forgotten whatever it was you were trying to sell me.

When eventually you turn up somewhere else, it’s a new role, new wares to flog, same damn approach. Except now, everything you touch starts with significantly less goodwill.

NEW ACHIEVEMENT: You are now Excrement Midas.

So, putting the muck spreader to one side for a minute…

It's easy to just poke holes in what doesn't work, but let's talk about what does. For me, overwhelmingly, it's recommendations and positive reputation. And I’ve got a good personal example I can share:

Once upon a time, there was Technology Leaders Club (also known as Rela8). And there still very much is. They run events for senior tech and security people, and they put a lot more thought into who’s there and why than just packing a room.

When I was leading international marketing at a large cybersecurity vendor, their CEO, Paul Gibson, emailed me several times after my then VP of EMEA Sales had given him my details. We’ll say three or four attempts at most.

And reader, I ignored him.

Because I get a frankly absurd number of approaches from events companies, especially in cybersecurity, so he was starting in an already noisy category. He tried a few times, gently, and then went back through the trusted route.

My VP mentioned that Paul had got in touch because he couldn’t get a response from me, and basically asked: “Can you please just take his call?”

He told me the events were more expensive than some of the alternatives, but they were really high quality, and Paul was a genuinely good guy.

That was what earned Paul the call.

And, ngl, even after the call I was still somewhat sceptical, despite thinking, “okay, this does actually sound pretty good”.

We started small. They delivered. Really damn well.

So we invested more, then considerably more. And over time, I got to see much more than the end product. I got to know Paul, the team, and the culture he had built around the company. The quality held up, the relationship deepened and, over time, that grew into a working partnership. To the point where I now genuinely class Paul as a friend.

Ultimately, that investment built over time because the trust did.

Paul wasn’t trying to bludgeon me into anything with those few gentle outreach attempts, and my VP didn’t try to force my hand either. A trusted recommendation got him through the door, and everything after that was earned.

Trust creates its own momentum

And this is exactly why the story matters in cybersecurity too. We sell into a market where trust carries a ridiculous amount of weight. Buyers are not just asking whether your product works; they’re asking whether you understand their world, whether your judgement is sound, and whether they’d trust you when things get ugly. A recommendation might get you through the door. What happens next decides whether you stay in the room.

Which brings me nicely back to why behaviour and brand are intrinsically linked. How you show up to buyers is part of your brand, whether Marketing intended it to be or not.

The person hammering a buyer with increasingly desperate follow-ups is shaping how that company is perceived. So is the salesperson who knows when to stop. So is the founder who treats people well, the event team that delivers what was promised, and the customer willing to recommend you because their own experience has been consistently good.

That is how reputation gets built.

I didn’t become a Technology Leaders Club advocate because Paul finally found the magic number of emails to send. I became one because the recommendation got them a chance, and the experience kept backing up what I’d been told.

That, right there, is brand doing serious commercial legwork.

And it’s also why badly judged outbound can do far more damage than the numbers in your CRM will ever show. Whilst we're at it, we really need to stop treating sheer persistence as some sort of virtue just because the CRM can make a pretty dashboard out of it.

There are plenty of tools that can help you find someone.

There are far fewer shortcuts to being the one they choose to answer.