Featured

Blogs

How to Sell Data Security to a CISO: Think Like One First

17 Jun 2026

Knowing how to sell data security to a CISO starts with understanding what actually keeps them up at night and this is rarely the conversation channel partners open with, XConnect set out to solve that. Exclusive Networks brought together the UK’s top security leaders to give the channel something more useful than your typical powerpoint presentation. Real perspective, from people who’ve actually lived the role.

The theme: Think Like a CISO.

First, Understand Why Data Is the Target

Dave Sheridan, former Global CISO for a major investment bank, opened with a story worth hearing.

Bank crime has evolved over the last fifty years. We’ve gone from armed robbery to cash-in-transit attacks to ATM skimmers. With every new route to crime blocked in turn. The attackers kept hitting walls.

So they changed their target.

They wised up and went, ‘Banks have got so much data, and there’s more value in data than there is in cash, because I can monetise every piece of data.'

That’s when the CISO role was born.

Adam Williamson, UK Country Manager at Exclusive Networks, was direct.

None of those technologies are there to secure anything but data. Data’s always been at the crux of our business. Data is the most important asset that any organisation has.

The numbers are huge. Global cybercrime is forecast to cost $10.5 trillion this year alone, by 2028, the world will generate 209 zettabytes of data and every 11 seconds, somewhere in the world, a new ransomware attack launches.

The more data there is, the bigger the target gets. And the pressure on security leaders just keeps growing with it.

How to Sell Data Security to a CISO: The Challenges You Need to Understand First

The CISO isn’t just thinking about threats. They’re juggling ownership, risk, regulators and board communication. All at the same time, all of the time.

Dave named one challenge that never really gets fixed: nobody fully agrees on who owns data.

Who’s responsible for data? I don’t know. Who’s respon… Ah, it’s the CISO’s responsibility. No, it’s my job to protect the business. Am I responsible for the data? Oh, no, it’s the CEO and the chief data officer. Is it? They’re just structuring how we’re using the data. No, it’s the business owner.

If the CISO doesn’t own the data decision, the conversation you need is broader than the one you’re probably having. Then there’s ransomware. Modern attackers don’t just steal data they also encrypt what’s left too. And if your backup is sitting on the same compromised network, you’ve got a very serious problem very fast.

“Have you got a third copy of the data anywhere?” “No.” “Okay. Hmm. That’s another issue then.”

Stuart Seymour, Group CISO of Virgin Media O2, spent the past year building a “minimum viable company” to avoid that debate during an actual crisis event. The findings actually surprised people.

From my own personal opinion, I found out some really curious things. One being that it’s not the immediate systems that one might expect which would be the ones we would recover first. For example, payroll might have a 30 day window within it depending on the timing of the incident. One of the first things that should be recovered, can anyone guess? The ability to get onto the network and authenticate. Without it there’s trouble.

Paul Colnan, CISO at NewDay, was responding to a question: how do you actually prove you can recover from a data incident, not just in theory but for real?

His answer set a clear bar for what he expects from partners:

Don’t just say, ‘I've backed up that data you said you need,' but let's rebuild the thing in a new region. Let's see that it does perform to the SLAs the business needs. That's the detail I'd love to get into.

Backing data up is the easy part. Proving you can get a business back on its feet, within the timeframes it actually needs, is something most partners never talk about.

Think Like a CISO.

Dave was direct about what most partner conversations look like from his side.

Don’t turn up and go, ‘Hey, I’ve got this new ransomware product. I’ve got this new XDR.’ So what? I’ve got a stack of them already.

The thing is, you might work through five different people before you ever get to a CISO. If at that point you come in unprepared, you’ve already lost them.

“If you can bring me something that’s going to help me make my life easier, I’m going to listen to you. If you’re just going to try and sell me a product, another agent to stick on the stack, I’m going to go, ‘No, thanks.’”

So the message was, do the research first, understand the business and find the real problems before you walk through the door.

Another example is Stuart’s team built a tool to put risk “in a pounds and pence level” for the board. They called the unit “lemons” to take the emotion out of the number. A CISO inventing a fake currency just to get a board to engage is a gap partners could help close.

Paul put it simply:

A lot of time I get sold products, and I think, ‘I don’t have that problem.’ Just, come and listen to what we’ve got to say. What our struggles are and then you can fit your solution in to work with us.

The Best Job and Worst Job in the World

Dave closed with - “This is the best job and the worst job in the world.”

Stuart was clear. - “Are you secure? My answer is never and I’ll never be. Are you resilient? Well, that’s another conversation.”

A CISO is never fully secure. They manage risk, but they never eliminate it. The overarching message of the day was to stop selling security as a finish line. Start helping them build resilience, the ability to recover faster, prove value to a sceptical board, and maybe sleep a little better on a Sunday night.

That’s a harder sell than a feature list, but it’s the only one worth making. Think like that, think like a CISO and you might just get a second meeting.

Want to go deeper? Watch highlights from the XConnect Data Security event featuring insights from our CISO speakers.

Latest blogs

View all blogs

Featured

Blogs

Why Continuous Assurance Is the New Standard for Data Security

Featured

Blogs

Data Storage Security: Why the Storage Layer Is The Biggest Unprotected Gap

Featured

Blogs