Cybersecurity That Sells: Building Trust in ICT Sales Pitches

Threat

A circumstance, actor, or event that could cause harm, such as a ransomware group, phishing campaign, insider, or power outage.

Vulnerability

A weakness that a threat could exploit, such as missing patches, weak access controls, or an insecure configuration.

Control

A safeguard that prevents, detects, responds to, or reduces the impact of harmful events.

Incident

An observed or suspected event that jeopardizes confidentiality, integrity, or availability.

Business impact

The consequence for organizational objectives, such as lost revenue, customer harm, downtime, legal exposure, safety effects, or reputational damage.

Residual risk

The risk that remains after controls and other treatment actions have been applied.

Identity and access management (IAM)

The processes and technologies used to verify identities and control access to systems, applications, and data.

Multifactor authentication (MFA)

Authentication that requires more than one factor, making a stolen password alone less useful.

Encryption

A method of protecting data so it generally requires the correct cryptographic key to be read.

Security monitoring

Collecting and analyzing security signals to identify suspicious activity and support investigation.

Recovery time objective (RTO)

The target maximum time to restore a disrupted service.

Recovery point objective (RPO)

The maximum tolerable amount of data loss, measured in time.

Stakeholder persona

A decision-maker or influencer defined by responsibilities, incentives, authority, and risk perspective rather than job title alone.

Current-state gap

The difference between how security work happens now and the outcome the buyer needs to achieve.

Target state

A defined future condition that describes the desired security outcome, process, or level of assurance.

Buying criterion

A verifiable requirement used to compare solutions, usually including priority, evidence, and an accountable stakeholder.

Risk-based discovery

Questioning that starts with business processes, threat scenarios, consequences, and desired outcomes instead of a feature checklist.

Unauthorized assessment

Security testing or system examination performed without explicit written authorization, agreed scope, and appropriate rules of engagement.

Asset

A resource, process, relationship, or capability that creates business value or supports critical operations.

Risk

The possibility that a threat event exploits an exposure and causes harm to an asset or business objective.

Control

A safeguard, process, or capability used to reduce the likelihood or impact of a risk, improve detection, or support recovery.

Operational resilience

The ability to sustain or restore critical operations when disruption occurs.

Feature-advantage-benefit

A translation method: what the solution does, how it changes a condition, and why that change matters to the customer.

Value hypothesis

A testable statement that a proposed control can improve a customer-specific outcome by changing a relevant risk.

Certification

A formal assessment against a certifiable standard by an authorized certification body. Example: ISO/IEC 27001 certification.

Attestation

An independent practitioner's report on management's assertion and controls against defined criteria. Example: a SOC 2 report.

Penetration test

A scoped, time-bound technical assessment in which testers seek and validate exploitable weaknesses.

Vulnerability management

The ongoing process of inventorying, prioritizing, remediating, verifying, and reporting vulnerabilities.

SBOM

A formal record of software components and their supply-chain relationships.

VEX

A vulnerability-status statement that adds product-specific context, such as affected, fixed, mitigated, or not affected.

Responsible security claim

A specific statement supported by evidence that also states its relevant scope, assumptions, or limits.

Absolute guarantee

A promise of a universal outcome, such as "never breached" or "always compliant," that security teams generally cannot support.

Shared responsibility model

A model that allocates security tasks between a provider and customer; the exact allocation varies by service and configuration.

Unknown-answer protocol

A disciplined response: acknowledge the question, state what is known, avoid speculation, identify the owner, and establish a follow-up path.

Escalation

Routing a question to the qualified legal, security, privacy, engineering, or product specialist who can provide an approved answer.

Evidence

Verifiable support for a claim, such as approved security documentation, an assessment report, a policy, a contract term, or a technical record.

Regulatory relevance

A reason a regulation may affect a customer's buying criteria. It is not a legal conclusion that the regulation applies or that a solution creates compliance.

NIS2 Directive

Directive (EU) 2022/2555, which replaced NIS1 and requires national implementation. It can drive supplier-security, risk-management, and incident-readiness questions.

DORA

Regulation (EU) 2022/2554 for digital operational resilience in the financial sector. It has applied since January 17, 2025 and highlights ICT third-party risk.

Cyber Resilience Act

Regulation (EU) 2024/2847, focused on cybersecurity across the lifecycle of covered products with digital elements made available on the EU market.

SEC Item 1.05

The Form 8-K item used by domestic SEC registrants for disclosure of material cybersecurity incidents, generally within four business days after a materiality determination.

Evidence map

A controlled mapping from a buyer question to an approved artifact, such as an assurance report, security white paper, incident process, SLA, or contract provision.

Buyer priority

The business or operational outcome the buyer is trying to achieve, such as continuity, faster service delivery, lower audit burden, or customer trust.

Risk narrative

A plausible explanation of how a threat, weakness, or operational gap could affect a buyer priority. It should be specific and not fear-based.

Bounded claim

A claim limited to the documented service scope, operating assumptions, and supported capabilities. It avoids guarantees such as "prevents all breaches."

Evidence-backed differentiation

A competitive claim supported by reviewable artifacts, such as an architecture diagram, control mapping, assessment scope, test result, or service commitment.

Shared responsibility

The documented allocation of security tasks between provider and customer, including configuration, identity inputs, monitoring, escalation, and incident actions.

Security call to action

A specific next step that advances evaluation, such as a threat-model review, architecture workshop, evidence review, or scoped proof of value.