How is sales done today in cybersecurity, and what’s actually new?

Lara B. — Building Cyberr

2026-08-31

The biggest shift in selling cybersecurity is that buyers are no longer really asking, “Do we need more security?” Of course they do. The question has become much harder: “Why do I need you specifically, and why should I add another vendor?”

That question very quickly turns into, “I don’t want another vendor,” and this is where a lot of cybersecurity sales teams are struggling.

Around 57% of organisations plan to consolidate cybersecurity vendors within the next two years , which makes complete sense when you look at what buyers are dealing with. They want fewer integrations, fewer contracts, fewer tools to manage and better visibility across the stack. For point solutions, that creates a pretty brutal sales environment.

The large players have responded to this incredibly well, and the message is basically the same one we have seen work across many other industries: “Don’t buy another tool. Replace three tools with us.”

That is a very strong position if you are Microsoft, Palo Alto, CrowdStrike or another company that can credibly sell consolidation.

For a smaller cybersecurity vendor, trying to play the same game is usually pointless. The stronger argument is much more specific: “We solve this particular problem dramatically better, and we fit into the stack you already have.”

But then you hit the next problem, which I think is even bigger.

Cybersecurity has a serious credibility problem.

A 2026 study of 320 enterprise security decision-makers found that 52% believe cybersecurity marketing lacks technical depth , while 49% say vendors fail to provide sufficient ROI justification . At the same time, peer recommendations were the number one discovery source, at 55% .

And of course they were.

Look at the average cybersecurity outbound message and you will find some combination of “AI-powered”, “next-generation”, “reduce risk”, “single pane of glass” or “protect your organisation from evolving threats”.

Buyers have heard this s* 100 times.

Change the company logo and half the messaging could belong to almost any security vendor.

Then AI entered the buying process, not just the product.

More than a third of security leaders already report using AI during product selection, and that is where things get much more interesting from a sales perspective. Buyers can now compare vendors, understand categories, check alternatives, research use cases, look at reviews and form a pretty educated opinion before a salesperson ever enters the conversation.

So now we are moving into a world where companies have to invest less purely in generating leads and much more in being discoverable and credible while the buyer is researching independently .

That means technical content, real practitioner voices, customer proof, community, reviews, strong comparison pages, clear use cases and a much better explanation of what you actually solve.

And yes, increasingly it also means making sure AI can understand what the hell your company does, because AI is becoming part of the research layer.

This changes sales too.

The traditional motion was heavily built around finding the buyer, getting the meeting, educating them and then running the sales process.

Today, in many cybersecurity categories, the buying process has already started long before sales arrives.

The salesperson is entering a conversation with someone who may already understand the category, know your competitors, have read what people think about you and have a shortlist in their head.

So the job becomes less about creating interest from zero and much more about earning preference inside a buying process that is already underway .

That, to me, is one of the biggest changes happening in cybersecurity sales right now.

And I’m not sure most cybersecurity sales organisations have fully adjusted to it yet.

8 reactions · 8 comments

Read and join the discussion on Cyberr