# Anand Thangaraju

Anand Thangaraju writes about cybersecurity leadership and how security companies can sell to CISO buyers. Thangaraju also hosts CISO Strategy Salon events, bringing security leaders together to discuss practical challenges.

- Profile: https://b2binfluencer.marketing/creators/anand-thangaraju/
- LinkedIn: https://www.linkedin.com/in/athangaraju
- LinkedIn followers: 23,055
- Topics: artificial-intelligence, leadership, sales, cybersecurity
- Based on 23 dated posts, latest 2026-10-06

## Summary

Useful for security vendors selling to CISOs who need sharper buyer personas and sales enablement.

- Best for: Security vendors selling to CISOs that need to repair a generic pitch.
- Not for: Security awareness vendors calling employees the weakest link or pushing more training.
- Check first: Confirm sponsor policy, rates, and partnership details before contacting them.

### Takeaways

- CISO is not one buyer; there are at least eight buyer tribes.
- A practitioner's approval is not a purchase decision; security leaders approve spend.
- Blame system design, not people; use safer defaults and access controls.

## Main ideas

- **"CISO" is not one buyer — it is at least eight tribes**: Thangaraju argues that a single security pitch fails because CISO is a job title covering very different mandates, budgets and languages. They name examples: a global CISO with a $50M budget versus a director-level "CISO" managing $200K; a post-breach CISO rebuilding trust; a product/builder CISO focused on secure defaults; a field CISO on the vendor side; and a virtual CISO consulting between roles. A companion post makes the same point through reporting lines: to the CIO, the incentive is technical alignment, but security competes with IT priorities; to the CFO, budget authority comes with the risk that security is treated as a cost centre; to the CRO, revenue enablement brings pressure to compromise on deals; to the COO, operational integration can turn security into a checkbox. Their conclusion: no structure is perfect, and an involved board with proper oversight is what works.
- **A practitioner's approval is not a purchase decision**: The person who can tell you whether a product works is not the person who decides whether the organisation should pay for it. Practitioners ask whether the tool makes their job easier, detects what it claims and fits their environment. The security leader answers different questions: which problem is being solved, what changes after deployment, what the team has to operate, and how the spend stacks up against competing budget requests. The purchase may still have to clear IT, finance, procurement, legal and architecture. Thangaraju says founders respond to the stall by adding features, architecture diagrams and screenshots for the already-convinced technical buyer, while the person approving the investment still cannot see the return.
- **"Interesting" means browsing, not buying**: CISOs tell dozens of vendors a quarter, "this looks interesting," and founders hear a deal. Thangaraju distinguishes the two by behaviour: browsers ask for information, say they will think about it, or claim to always be evaluating; buyers ask how the product integrates with their stack, what the implementation timeline is, and for a reference customer in a specific sector. Their test is blunt: if a CISO cannot describe their budget cycle, procurement process and who else has to approve, they are browsing.
- **Blame the system design, not the people using it**: Thangaraju calls "humans are the weakest link" the most damaging myth in security because it shifts blame from the people who design systems to those who have to use them. Once blame shifts, nobody looks for the design fix. They cite the Verizon DBIR finding that the human element appears in roughly two-thirds of breaches, while the report's authors push back on the lazy reading: humans show up because environments are built so that one click or misconfiguration brings everything down. They also cite the UK NCSC calling the framing counterproductive, and Google's own account-takeover work, where security keys eliminated phishing compromise through a design change rather than more training. Their alternative: people are the largest attack surface and the best sensor network, so make the secure path the easy path.
- **Test your own controls against AI attacks, not just AI against you**: Security teams spend their time asking what AI can do to them and too little asking what their controls can do against AI. Thangaraju shifts the question from attacker capability to defender proof: if an agent exploits a vulnerability, do the controls detect it? If it uses a legitimate credential unusually, is that visible? If each action looks legitimate but the sequence is an attack, will detection and response recognise it? Can the SOC respond before the agent's next step? They cite NIST's work on AI agent hijacking to show why testing known attacks is not enough: fixing one attack does not protect against the next variation. Their distinction: a policy saying privileged access is restricted is an assumption; a control tested against a realistic attack is proof.
- **AI ended the knowledge moat; judgment, relationships, taste and conviction are left**: This is Thangaraju's leadership-side argument, not a sales or tooling one. Professionals built careers on knowing the right framework, control, vendor or answer, and treated that knowledge as their moat. An LLM now gives a competent answer on NIST CSF, zero trust or the OWASP Top 10, drafts a board memo on cyber-risk quantification, compares vendor stacks and explains a recent CVE. Information asymmetry has evaporated. What remains, in their list, is judgment (knowing which framework matters for this business and board, and when the textbook answer is wrong), relationships (the peer who takes an 11pm call during an incident), taste (separating signal from noise and knowing which risks to accept and own) and conviction (a point of view a model cannot generate because it did not live through the incident, layoff, acquisition or breach).
- **Vendor-free peer rooms — and a direct challenge to the channel model**: Thangaraju argues that practitioner-only spaces produce useful information. The enterprise software buying process is broken and legacy: endless sales pitches, filtered marketing decks and rigid RFPs do not move at the speed of modern risk, so CISOs bypass the noise through vetted peer rooms where they trade notes on vendors and niche point solutions. The same conviction runs through a separate peer-only meetup that challenges the channel model: buyers are done paying a margin for introductions they can make themselves; "exclusive partner with negotiated discounts" is not a moat; value-added resellers still winning cash in on procurement paperwork and bureaucracy; and everyone else is a purchase order with a logo on it.
- **Cyber risk has to be spoken in the language a board already uses**: This argument appears in Thangaraju's salon recaps and is attributed to a guest as much as to them. A CVE and patch backlog is an operational metric, not a risk metric, so boards cannot act on it and end up discounting the CISO along with it. Findings need to be translated into revenue at risk, customer trust, regulatory exposure or deal velocity; a finding that cannot be tied to one of those is a ticket, not a board slide. CFOs think in ranges and scenarios rather than red-amber-green, so the conversation needs the loss curve and the cost of buying the risk down. The maturity signal is a board that starts asking better questions, not a better dashboard.
- **AI and the CISO role belong in the same conversation**: Thangaraju consistently frames AI as a leadership issue, not a product category: how it changes the CISO role, personal productivity and what leaders are expected to do. That framing runs through the events they promote and recap. The healthcare salon focuses on the operational implications: attacker timelines compressing, sensitive data sprawling across cloud environments, and the question shifting from "what if" to "how fast can we respond".

## Work to read

- [The practitioner who loves your product may not approve the purchase](https://www.linkedin.com/posts/athangaraju_the-person-who-loves-your-security-product-activity-7511456027620372481-1xv4)
- [Your people aren’t the weakest link. Your system design is.](https://www.linkedin.com/posts/athangaraju_your-people-arent-the-weakest-link-your-activity-7510370672305463298-l4bV)
- [I just watched a founder pitch the same deck to three different CISOs](https://www.linkedin.com/posts/athangaraju_i-just-watched-a-founder-pitch-the-same-deck-activity-7434270059755204608-E6Ur)
- [The incentive drives the outcome](https://www.linkedin.com/posts/athangaraju_show-me-the-incentive-and-i-will-show-you-activity-7434628673011585026-ebpB)

## Brand relationships

- **Alchemy Cyber Inc** (disclosed_partnership)
- **CISO Strategy Salon** (disclosed_partnership)
- **Vero Security** (sponsor)
- **Metano** (sponsor)
- **Sentra** (disclosed_partnership)
- **The Beyond CISO** (owned_business)
- **Mindfluence** (mention)

## Partnerships

Anand Thangaraju's partnership activity centers on the CISO Strategy Salon, a dinner series they run through Alchemy Cyber in cities including Miami Beach, Atlanta, the Bay Area, and the East Bay. Individual evenings are backed by a named security vendor — Metano, Sentra, and Vero Security appear in their posts as sponsors or partners — while the room remains vendor-free for CISO and practitioner guests. They also credit co-hosts and venues by name. No sponsor policy, rate card, or partnership inquiry page appears in the posts, so ask directly about terms.

## Alternatives

- Val Tsanev: Pick Val Tsanev when the vendor's problem comes later in the sales cycle: a nine-month enterprise deal, a champion who cannot carry the business case, or a renewal under question even though the product works. Their material draws on a reported 4,000-plus one-to-one meetings between security founders and CISOs over five years. The two posts address decisions Thangaraju's posts do not: the founder does not close the deal, the champion does; qualification and champion buy-in can take five to twenty meetings; and CISOs are cutting products they can no longer defend. A specialist vendor must show why the remaining 20 to 30 percent of capability a buyer cannot get from a platform they already pay for merits another contract, integration, dashboard, and CFO conversation. For a vendor losing renewals to 'good enough' incumbent coverage, or whose deals die months after a positive demo, this is a closer match than a buyer-persona map.
- Patrick Keating: Pick Patrick Keating when the buyer is an SMB or mid-market chief executive or board member rather than an enterprise CISO, or when the vendor sells email and Microsoft 365 security, identity governance, or fractional CISO services. The M365 post frames email as a financial system and M365 as a Tier-0 business asset for SMB leaders, then gives three 2026 planning points: 'we have MFA' is not a strategy because MFA alone does not stop business email compromise, token abuse, or OAuth persistence; resilience beats assumptions; and the real question is whether the business can stop fraud quickly. The governance post synthesises peer-reviewed research on where the CISO should report, finding that independence from IT, proximity to the chief executive, and board-level visibility matter more than title. A vendor whose product protects mail flow, identity, or conditional access would get an executive-facing argument with citations and an explicit governance frame; Thangaraju's posts instead speak to the sales conversation with CISOs.
- John Ellingson: Pick John Ellingson when the vendor's problem is category-level disbelief rather than a weak deck: the buyer does not accept that the current security architecture can hold, and the campaign needs a quantified, long-horizon threat case to open the argument. One post reads the CrowdStrike 2026 Global Threat Report straight — attack volume up 89 percent year over year, breakout time down to 29 minutes, 82 percent of intrusions using no malware — and projects scale, speed, and scope ten years out. Its conclusion: 'AI-enabled attack' stops being a category and becomes simply what attack means. The companion post argues that the industry has spent 40 years and hundreds of billions treating cybersecurity as a technology problem while 68 to 82 percent of breaches involve a human element, and concludes that better training, MFA, and deeper behavioural analytics are the wrong fixes. For a vendor selling structural change rather than an increment on an existing stack, this is a stronger opening than a persona exercise.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/