165: Building Cybersecurity Products People Will Pay For (ft. Mark Carney)

The dangerous gap between “like” and “buy”

It’s safe to say that Mark’s career has given him a well-rounded perspective. He’s built products, sold products, serviced products, and advised on products in the cybersecurity space. This 360-degree view has made one tough, but important truth obvious:

“People can say that they like what you do, but that’s very, very different than them getting out of their pocketbook and spending money on it. That is two different scenarios, completely different scenarios.”

This is how it goes in many social or professional settings - people are nice. They will be supportive, offer suggestions, say that it’s great and never buy. Mark learned to find design partners who would be brutally honest about budget, replacement vs. net-new spend, and whether they’d actually pull the trigger.

120 CISOs in six months

When building Secure Blueprint, Mark didn’t send out async surveys or run a few user interviews. He talked to 120 CISOs over a 6-month period. It’s worth noting that in these conversations, he wasn’t asking about UI preferences, he was mapping their operational reality:

Budget cycles and how they allocate CapEx vs. OpEx

How they report progress to boards

How products fit into maturity assessment processes

The goal is to understand if your product would be integrated into daily workflows or become a “once a month nice-to-have.” The former gets adopted. The latter gets churned.

The vaporware market

With 10,000+ cybersecurity products in the market, Mark sees a bit of an ugly pattern. There’s quite a bit of ‘buzzword bingo’ and empty promises make it nearly impossible for customers to identify real innovation.

“You can have to wade through all of the vaporware. And when you sort of peel it back, there’s nothing there. Literally, like there’s nothing there. Or what they claim is literally not accurate.”

Everyone is slapping “AI-powered” or “cloud-native” on their pitch decks. CISOs wade through pitch after pitch, and even 25-year industry veterans like Mark get confused by the marketing fodder.

Simplicity could be your competitive advantage

CISOs speak one language to their technical teams and another to the board. If they can’t translate your value prop up the chain for budget approval, your product dies.

“The more you simplify things, the more you can amplify things. If you overcomplicate things because it’s a tech sell, then as soon as the technical seller goes up for budget, you lose translation.”

Proximity to customers creates velocity

Mark has led both massive teams and small ones. His current approach at Evolve favors small, senior teams — not because small is necessarily better, but because proximity to customers creates speed.

“The more layers you have, the further away they are to the customer and the farther away they are to the purpose.”

When developers see client data in real-time and make decisions based on what’s happening right in front of them, they don’t wait for tickets. They solve problems.

TL;DR: Build at the intersection

Cybersecurity products succeed when they balance technical depth, business viability, and operational reality. Stay close to customers, simplify ruthlessly, and know the difference between someone thinking something is interesting vs. handing you a credit card.hnical depth, business viability, and operational reality. Stay close to customers, simplify ruthlessly, and know the difference between "that's interesting" and "here's my credit card."

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.peopleofproduct.us