The hardest sale in security is not a product. It is patching, across a group that has never done it consistently, to an executive committee that has never been asked to care. This is how one such case was written, and what happened after it was approved.
The situation
A manufacturing group with more than twenty plants patched each site its own way, mostly its Windows estate, with no view at group level. Asked for evidence that patching happened, the honest answer in the board paper was “informal data from IT staff”. Three intrusions in six months had each been contained by the end of the day and forgotten by the end of the week.
How the case was written
Not with features, vulnerability scores or vendor quadrants. The problem was framed in four plain verbs: see, assess, fix, verify. See what is on the network. Assess what is vulnerable. Fix it, by severity, with deadlines. Verify that it was fixed. An executive can hold four verbs in their head. Nobody can hold a scoring system.
Four tools were compared on the same four verbs, with a yearly cost for the group’s eight thousand assets next to each. The proof of concept put nine hundred agents on sixteen sites in three countries, and produced, for the first time, a number: how many machines, how many vulnerabilities on each.
Then the site IT directors spoke. On the record, in the paper, in their own words, from three continents: what they had seen in the proof of concept and whether they wanted it. The chief information security officer’s opinion was in the paper too, but it was not the opinion that carried it. Executives discount the person whose job is to ask for security budget. They listen to the people who will have to live with the tool.
The case also said, in writing, that a significant attack was likely within weeks or months, and that ransomware was the highest risk. It gave goals with dates: full visibility of the estate within three months, critical workstation flaws gone within six, a group policy with service levels by the end.
What happened
It was approved. Two months later, before the tool was deployed, the ransomware attack it predicted arrived, and the group lost three weeks.
The deployment then went fast, because the decision had already been made. Within a few months the tool covered six thousand systems, every known weakness in the directory had been closed, and the number the board now saw every month was about two hundred vulnerabilities per workstation on average, and falling. The trend was the point. A number that goes down is a programme. A number that is presented once is a slide.
A number that goes down is a programme. A number that is presented once is a slide.
What people get wrong
They lead with the technology. Executives do not buy scanners. They buy the worst case avoided: production stopped, data stolen, a customer contract at risk, and the cost of doing nothing next to the cost of doing something.
They make the CISO the only voice. The person asking for the money is the least persuasive person in the room, however right they are.
They present a state instead of a trend. “We have four thousand vulnerabilities” is a number nobody can act on. “We had six thousand last quarter, we have four thousand now, here is when we reach a thousand” is a programme with a budget attached.
They assume approval is deployment. The case was right, the money was approved, and the attack came anyway, because an approved budget patches nothing. The gap between the decision and the first agent is the most dangerous period in the programme.