Anand Thangaraju writes about cybersecurity leadership and how security companies can sell to CISO buyers. Thangaraju also hosts CISO Strategy Salon events, bringing security leaders together to discuss practical challenges.
Useful for security vendors selling to CISOs who need sharper buyer personas and sales enablement.
Best for
Security vendors selling to CISOs that need to repair a generic pitch.
Not for
Security awareness vendors calling employees the weakest link or pushing more training.
Key takeaways
CISO is not one buyer; there are at least eight buyer tribes.
A practitioner's approval is not a purchase decision; security leaders approve spend.
Blame system design, not people; use safer defaults and access controls.
Check first: Confirm sponsor policy, rates, and partnership details before contacting them.
Main ideas
"CISO" is not one buyer — it is at least eight tribes · A practitioner's approval is not a purchase decision · "Interesting" means browsing, not buying
Anand Thangaraju writes about cybersecurity leadership, security-company sales, and the decisions CISO buyers face.
Their posts connect technical security questions to the organizational realities around them: who uses a product, who approves its purchase, and what that decision-maker is accountable for.
They also describe hosting CISO Strategy Salon gatherings through Alchemy Cyber and launching The Beyond CISO, a weekly newsletter about cybersecurity, leadership, technology, and the business of security.
Anand Thangaraju’s work is strongest when it turns a familiar security or sales problem into a practical question about incentives and systems.
In one post, they distinguish a practitioner’s proof that a product works from the business case a security leader must make to secure budget.
In another, they argue that blaming employees as the “weakest link” distracts from system design, then point to safer defaults and access controls as alternatives.
Their CISO Strategy Salon posts extend that interest in decision-making into peer discussion, including how to explain cyber risk in terms a board can act on.
Marketers selling to security leaders or seeking a business-oriented view of cybersecurity can follow them for these concrete reframings.
Ask for examples of their signature book or show if those matter to a campaign.
Thangaraju writes about the gap between security products and security purchases.
Read more
They argue that vendors misread their buyers: CISO is not one job, the practitioner who loves a product is not the person who approves it, and a polite "let's keep talking" is not a deal.
They apply the same systems view to defenders' work, arguing that blaming users—or testing AI's offensive capabilities without testing your own controls against them—hides the real problem.
Another cluster of posts focuses on the CISO room itself: peer-only dinners where vendors are kept out of the conversation, and board conversations where technical findings have to be re-priced as business risk.
"CISO" is not one buyer — it is at least eight tribes
Thangaraju argues that a single security pitch fails because CISO is a job title covering very different mandates, budgets and languages.
Read more
They name examples: a global CISO with a $50M budget versus a director-level "CISO" managing $200K; a post-breach CISO rebuilding trust; a product/builder CISO focused on secure defaults; a field CISO on the vendor side; and a virtual CISO consulting between roles.
A companion post makes the same point through reporting lines: to the CIO, the incentive is technical alignment, but security competes with IT priorities; to the CFO, budget authority comes with the risk that security is treated as a cost centre; to the CRO, revenue enablement brings pressure to compromise on deals; to the COO, operational integration can turn security into a checkbox.
Their conclusion: no structure is perfect, and an involved board with proper oversight is what works.
A founder pitched the same deck to three CISOs, and it failed three different ways because each tribe asks different questions. Thangaraju closes by asking CISOs which tribe they belong to and what pitch works on them.
A practitioner's approval is not a purchase decision
The person who can tell you whether a product works is not the person who decides whether the organisation should pay for it.
Read more
Practitioners ask whether the tool makes their job easier, detects what it claims and fits their environment.
The security leader answers different questions: which problem is being solved, what changes after deployment, what the team has to operate, and how the spend stacks up against competing budget requests.
The purchase may still have to clear IT, finance, procurement, legal and architecture.
Thangaraju says founders respond to the stall by adding features, architecture diagrams and screenshots for the already-convinced technical buyer, while the person approving the investment still cannot see the return.
A SOC analyst loves the detection, the threat hunter gets excited, and the security engineer runs the proof of concept and says the team should absolutely buy it.
Then the deal stalls, and the founder assumes the problem is pricing, competition, procurement or timing.
Thangaraju suggests asking instead whether the product reduces investigation time, improves visibility into a specific risk, cuts manual work, covers what the existing stack cannot, or addresses a known exposure without adding another team to run it.
CISOs tell dozens of vendors a quarter, "this looks interesting," and founders hear a deal.
Read more
Thangaraju distinguishes the two by behaviour: browsers ask for information, say they will think about it, or claim to always be evaluating; buyers ask how the product integrates with their stack, what the implementation timeline is, and for a reference customer in a specific sector. Their test is blunt: if a CISO cannot describe their budget cycle, procurement process and who else has to approve, they are browsing.
A founder spent four months chasing a lead they read as 80% done; Thangaraju reads the same conversation as 5% done. Their closing line: stop watering dead leads and find the prospects actually ready to buy.
Thangaraju calls "humans are the weakest link" the most damaging myth in security because it shifts blame from the people who design systems to those who have to use them.
Read more
Once blame shifts, nobody looks for the design fix.
They cite the Verizon DBIR finding that the human element appears in roughly two-thirds of breaches, while the report's authors push back on the lazy reading: humans show up because environments are built so that one click or misconfiguration brings everything down.
They also cite the UK NCSC calling the framing counterproductive, and Google's own account-takeover work, where security keys eliminated phishing compromise through a design change rather than more training.
Their alternative: people are the largest attack surface and the best sensor network, so make the secure path the easy path.
Phishing-resistant MFA instead of quarterly awareness quizzes; password managers instead of password complexity rules; just-in-time access instead of standing privilege. Thangaraju ends with an exercise: audit the last three executive decks for "human error" or "weakest link" and rewrite one without that framing.
Test your own controls against AI attacks, not just AI against you
Security teams spend their time asking what AI can do to them and too little asking what their controls can do against AI.
Read more
Thangaraju shifts the question from attacker capability to defender proof: if an agent exploits a vulnerability, do the controls detect it?
If it uses a legitimate credential unusually, is that visible?
If each action looks legitimate but the sequence is an attack, will detection and response recognise it?
Can the SOC respond before the agent's next step?
They cite NIST's work on AI agent hijacking to show why testing known attacks is not enough: fixing one attack does not protect against the next variation.
Their distinction: a policy saying privileged access is restricted is an assumption; a control tested against a realistic attack is proof.
Thangaraju cites benchmark numbers for scale: CVE-Bench, where a state-of-the-art AI agent framework exploited up to 13% of the real-world vulnerabilities in its benchmark, and Agent Security Bench, reporting attack success rates as high as 84.3% in some evaluated scenarios. They ask readers to run the AI-enabled techniques they read about against the environments they actually defend.
AI ended the knowledge moat; judgment, relationships, taste and conviction are left
This is Thangaraju's leadership-side argument, not a sales or tooling one.
Read more
Professionals built careers on knowing the right framework, control, vendor or answer, and treated that knowledge as their moat.
An LLM now gives a competent answer on NIST CSF, zero trust or the OWASP Top 10, drafts a board memo on cyber-risk quantification, compares vendor stacks and explains a recent CVE.
Information asymmetry has evaporated.
What remains, in their list, is judgment (knowing which framework matters for this business and board, and when the textbook answer is wrong), relationships (the peer who takes an 11pm call during an incident), taste (separating signal from noise and knowing which risks to accept and own) and conviction (a point of view a model cannot generate because it did not live through the incident, layoff, acquisition or breach).
Thangaraju's framing: knowledge got commoditized, but wisdom, trust and community did not. The professionals who thrive will decide the best, connect the widest and stand for something others can feel.
Vendor-free peer rooms — and a direct challenge to the channel model
Thangaraju argues that practitioner-only spaces produce useful information.
Read more
The enterprise software buying process is broken and legacy: endless sales pitches, filtered marketing decks and rigid RFPs do not move at the speed of modern risk, so CISOs bypass the noise through vetted peer rooms where they trade notes on vendors and niche point solutions. The same conviction runs through a separate peer-only meetup that challenges the channel model: buyers are done paying a margin for introductions they can make themselves; "exclusive partner with negotiated discounts" is not a moat; value-added resellers still winning cash in on procurement paperwork and bureaucracy; and everyone else is a purchase order with a logo on it.
Thangaraju recaps salons across cities, naming speakers and hosts: Marva Bailer, CEO of Qualaix, keynoting in Atlanta; a Miami Beach dinner co-hosted with Kashish Mittal; and an East Bay evening with a keynote from E'Jaaz Ali, CISO at Alameda Health System, and Asaf Kochan, co-founder of Sentra. The recaps repeatedly describe candid conversation without vendor pitches or polished narratives.
There is a tension between the format Thangaraju argues for and how it is funded.
The rooms are described as vendor-free for practitioners, yet the posts thank named sponsors and partners for backing the format.
One argues that a strategic-partner operating model is still needed as a buffer between the CISO and the thousands of vendors chasing the same budget.
Cyber risk has to be spoken in the language a board already uses
This argument appears in Thangaraju's salon recaps and is attributed to a guest as much as to them.
Read more
A CVE and patch backlog is an operational metric, not a risk metric, so boards cannot act on it and end up discounting the CISO along with it.
Findings need to be translated into revenue at risk, customer trust, regulatory exposure or deal velocity; a finding that cannot be tied to one of those is a ticket, not a board slide.
CFOs think in ranges and scenarios rather than red-amber-green, so the conversation needs the loss curve and the cost of buying the risk down.
The maturity signal is a board that starts asking better questions, not a better dashboard.
Thangaraju brought Kamran Husain, a CFO and board member, into a CISO salon so both sides could meet halfway on translating cyber risk into business risk.
The session produced the patch-backlog and loss-curve framing.
That evening also covered agentic security from BlackHat, including the argument that the problem is agent sprawl without a reasoning layer, rather than agent count.
AI and the CISO role belong in the same conversation
Thangaraju consistently frames AI as a leadership issue, not a product category: how it changes the CISO role, personal productivity and what leaders are expected to do.
Read more
That framing runs through the events they promote and recap. The healthcare salon focuses on the operational implications: attacker timelines compressing, sensitive data sprawling across cloud environments, and the question shifting from "what if" to "how fast can we respond".
Thangaraju promotes the Mindfluence Leadership Event in Napa, May 3–5, 2026, with sessions on AI in the SOC and beyond, first-time CISO playbooks, translating cyber risk into business decisions, and leadership and succession.
They say they look forward to contributing on how AI is transforming the CISO role.
A separate recap covers an East Bay salon on AI-driven threats to healthcare, with keynotes from E'Jaaz Ali of Alameda Health System and Asaf Kochan of Sentra on data security posture management.
Explains why a security tool can win over users yet lose the deal.
Read more
Start here to see the difference between proving a product works and helping a champion justify the purchase.
Thangaraju contrasts practitioners’ questions about detection and fit with leaders’ concerns about risk, operating costs, and competing budget demands. The closing test: can the champion explain to the rest of the buying group why the company should buy?
For brands planning a campaign
For a vendor campaign, create separate content for practitioner validation and executive approval. Show the business outcome and case for purchase, not just product features.
Explains how security messaging can shift blame from employees to system design.
Read more
Start here for a concrete example of Thangaraju’s myth-challenging, recommendation-led style.
Thangaraju replaces the familiar “weakest link” framing with the idea that systems should make secure behavior easier. They make the argument actionable with examples such as phishing-resistant MFA and just-in-time access, then ask readers to revise a recent executive deck.
For brands planning a campaign
A campaign about security culture could use this framing to discuss safer defaults and resilient systems, rather than blaming users or promoting awareness training alone.
Explains why one CISO pitch may not work for every buyer.
Read more
Start here for Thangaraju’s segmentation of security leaders by role, budget, priorities, and reporting structure.
The post argues that CISOs are not one buyer persona, then shows how reporting to a CIO, CFO, CRO, or COO can create different incentives and conflicts. Its examples show how to connect organizational structure to sales messaging.
For brands planning a campaign
A vendor could build a campaign that adapts its examples and value case to the prospect’s mandate instead of reusing one CISO deck.
Explains what a CISO’s reporting line may reveal about security priorities.
Read more
Start here for a focused version of Thangaraju’s incentive-based approach to assessing a security organization.
Thangaraju maps reporting lines to competing pressures: revenue enablement under a CRO, cost control under a CFO, and operational priorities under a CIO. They conclude that board oversight can help address misaligned incentives.
For brands planning a campaign
For prospect research or a campaign brief, investigate who owns security decisions and what outcomes that leader is accountable for before choosing proof points.
Vendor-free practitioner events—and a challenge to the VAR model4
"CISO" is at least eight buyer tribes, not one persona2
AI in the SOC and the changing CISO role2
Practitioner love is not a purchase decision1
Browsers versus buyers: what a CISO means by "interesting"1
Retiring the "humans are the weakest link" framing1
Test your controls against AI-enabled attacks, not just AI against you1
AI ended the knowledge moat; judgment, relationships, taste and conviction remain1
Translating cyber risk into board and CFO language1
A weekly newsletter as a standing owned channel1
"CISO" is at least eight buyer tribes, not one persona
Thangaraju argues that treating CISOs as a single buyer is why security pitches fail.
Read more
The opening example is a founder who pitched one deck to three CISOs and lost three different ways: a global CISO with a $50M budget, a director-level "CISO" managing $200K, a post-breach CISO rebuilding trust, a product/builder CISO, a field CISO and a virtual CISO each ask different questions and use different language.
A companion post explains the incentives created by each reporting line: the CIO offers technical alignment, but IT and security priorities clash; the CFO brings budget authority, but security is treated as a cost centre; the CRO makes security a revenue enabler, but creates pressure to compromise on deals; and the COO offers operational integration, but security becomes a checkbox.
Their conclusion: no structure is perfect; an involved board with proper oversight is what actually works.
Builds each argument from a named archetype list, a short failure scene and a pros-and-cons table of reporting structures, then closes by asking readers which tribe they belong to.
For brands planning a campaign
Content that segments the CISO audience by company size, mandate and reporting line gives a security vendor a concrete way to fix a generic pitch. The eight-tribe framing, with its reporting-line trade-offs, works as a sales-enablement asset rather than a thought-leadership post.
A post on why security deals die after a successful demo: the SOC analyst, threat hunter and security engineer testing a product ask, "does it work?"
Read more
The security leader has different questions: which problem is being solved, what changes on deployment, what the team has to operate and how the spend is justified against other budget requests.
The purchase then has to survive IT, finance, procurement, legal and architecture.
The stated failure pattern: founders add more features, architecture diagrams and screenshots to a pitch aimed at the engaged technical buyer, while the person approving the investment still cannot see what the organisation gets back.
The alternative answers are reduced investigation time, better visibility into a specific risk, less manual work, coverage the current stack cannot provide, and addressing a known exposure without adding another team to run it.
For brands planning a campaign
Supports content aimed at the internal champion: a business-case kit, a procurement-navigation guide or a piece on what a champion has to say when the vendor is not in the room. Uses Gartner research on buyer behaviour to frame the argument.
Browsers versus buyers: what a CISO means by "interesting"
Thangaraju describes a founder spending four months chasing a hot lead after a CISO said, "this looks interesting, let's keep talking"—a deal the founder read as 80% done and they read as 5%.
Read more
The distinction is behavioural: browsers ask for information, say they will think about it or claim to always be evaluating; buyers ask how a product integrates with their stack, what the implementation timeline is and for a reference customer in a specific sector. Their test: if a CISO cannot describe the budget cycle, the procurement process and who else has to approve, the prospect is browsing.
For brands planning a campaign
A qualification-focused piece—discovery questions that separate browsing from buying—is a practical asset for a vendor's sales team and reads as help rather than a pitch. The four-month anecdote gives it a usable opening scene.
Retiring the "humans are the weakest link" framing
The post calls the weakest-link line the most damaging myth in security because it shifts blame from the people who design systems to the people who use them.
Read more
It cites the Verizon DBIR finding that the human element appears in roughly two-thirds of breaches, while DBIR authors push back on the lazy reading: humans show up because environments are built so a single click or misconfiguration brings the house down.
It also cites the UK NCSC calling the framing counterproductive, and Google's account-takeover work, where security keys eliminated phishing compromise through a design change rather than behaviour change.
The replacement language: people are the largest attack surface and the best sensor network, and the secure path should be the easy path—phishing-resistant MFA instead of quarterly awareness quizzes, password managers instead of password complexity, just-in-time access instead of standing privilege.
The closing exercise asks readers to audit their last three executive decks for "human error" or "weakest link" and rewrite one without that framing.
Cites published research (Verizon DBIR, NCSC, Google) to challenge a common industry line, then gives readers a specific audit exercise.
Explicitly contrarian to the awareness-training category and vendor decks that open with the weakest-link line.
For brands planning a campaign
A strong message-level opening for identity, MFA and access vendors—but awareness-training pitches will meet direct resistance. Pair any campaign with architecture, defaults and resilience framing rather than more training content.
Test your controls against AI-enabled attacks, not just AI against you
The argument: security teams spend their time testing what AI can do to them and not enough time testing what their controls can do against AI.
Read more
Benchmarks show the scale: CVE-Bench, where a state-of-the-art agent framework exploited up to 13% of real-world vulnerabilities in its benchmark, and Agent Security Bench, reporting attack success rates as high as 84.3% in some evaluated scenarios.
The questions shift to the defender's side: if an agent exploits a vulnerability, do our controls detect it; if it uses a legitimate credential unusually, do we see it; if each action looks legitimate but the sequence is an attack, does detection and response recognise it; and can the SOC respond before the agent's next step?
NIST's work on AI agent hijacking supports the point that testing known attacks is not enough: fixing one attack does not protect against the next variation.
A policy stating privileged access is restricted is an assumption; a control tested against a realistic attack is evidence.
Leads with benchmark numbers, reframes the question from attacker capability to defender proof, and ends by asking readers which controls behaved differently in practice than on paper.
For brands planning a campaign
A precise technical hook for detection-engineering, adversarial-testing or purple-team offerings, and an opening to co-author content on running known AI-enabled techniques against real environments. The benchmark figures and the assumption-versus-evidence line give the piece its spine.
AI ended the knowledge moat; judgment, relationships, taste and conviction remain
The post argues that data and knowledge are no longer a competitive moat for security professionals: an LLM gives a competent answer on NIST CSF, zero trust or the OWASP Top 10, drafts a board memo on cyber-risk quantification, compares vendor stacks and explains a recent CVE.
Read more
The information asymmetry that made expertise valuable has evaporated. What remains in Thangaraju's list is judgment (knowing which framework matters for this business and board, and when the textbook answer is wrong), relationships (the peer who takes an 11pm call during an incident), taste (distinguishing signal from noise and deciding which risks to accept and own) and conviction (a point of view a model cannot generate because it did not live through the incident, layoff, acquisition or breach).
For brands planning a campaign
Fits leadership-development, community and professional-network brands more than tooling vendors. A piece on what security leaders should build instead of a knowledge advantage can draw directly on this four-part list.
Two posts show where the AI-and-CISO-role conversation sits.
Read more
One promotes the Mindfluence Leadership Event in Napa (May 3–5, 2026), listing sessions on AI in the SOC and beyond, first-time CISO playbooks, translating cyber risk into business decisions, leadership and succession, and identity in a post-perimeter world, and says the author looks forward to contributing on how AI is transforming the CISO role, personal productivity and leadership expectations.
The other recaps a salon on the "Mythos era" and AI-driven threats targeting healthcare, with a health-system CISO keynote on patient safety, operational continuity and regulatory exposure, and a data-security vendor co-founder on data security posture management as sensitive data sprawls across cloud environments faster than teams can track.
The takeaway stated is that attacker timelines are compressing and overlooked data exposures are becoming material risk, shifting the question from "what if" to "how fast can we respond".
For brands planning a campaign
Places the AI-and-security-leadership theme squarely in rooms with CISOs and vendor founders. A vendor in AI security, identity or data-security posture can use it for event-adjacent or co-branded content without needing a new argument.
Translating cyber risk into board and CFO language
A recap of a salon that brought a CFO and board member together with CISOs to translate cyber risk into business risk.
Read more
The points that landed: a CVE and patch backlog is an operational metric, not a risk metric, so boards cannot act on it—and may discount both it and the CISO; findings need translating into revenue at risk, customer trust, regulatory exposure or deal velocity, and a finding that cannot be tied to one of those is a ticket rather than a board slide; CFOs think in ranges and scenarios, not red-amber-green, so the conversation needs the loss curve and the cost of buying it down; and the real maturity signal is a board that starts asking better questions, not a better dashboard.
For brands planning a campaign
A direct opening for risk-quantification, board-reporting and cyber-risk platforms. A practical piece on converting a technical finding into one board slide fits the event audience and the recurring theme across the salon series.
Vendor-free practitioner events—and a challenge to the VAR model
Several posts document the CISO Strategy Salon series across cities, described as vendor-free spaces where practitioners trade notes on vendors and niche point solutions.
Read more
One post says the enterprise software buying process is broken and legacy: endless sales pitches, filtered marketing decks and rigid RFPs cannot move at the speed of modern risk.
It argues that CISOs now bypass that noise through vetted peer spaces.
Recaps name keynote speakers, hosting venues and organisations thanked for sponsoring or partnering, and describe candid conversation with no polished narratives.
A separate post from a peer-only meetup challenges the channel model directly: buyers are done paying a margin for introductions they can make themselves; “exclusive partner with negotiated discounts” is not a moat; the VARs still winning are cashing in on procurement paperwork and bureaucracy; and everyone else is “a purchase order with a logo on it.”
Openly challenges the channel/VAR value proposition, which conflicts with channel-led campaign strategies.
For brands planning a campaign
Brand participation in this format works as substance-first and pitch-free; the editorial line is that pitches do not belong in the room. The VAR critique is usable content for direct-to-CISO go-to-market messaging, and the salon themes—board translation, AI, identity—indicate what the audience is already discussing.
The Beyond CISO is announced as a weekly newsletter covering cybersecurity, leadership, technology and the business of security, with the first edition out and plans to build it over the coming weeks.
Read more
Ask for details on format, length and audience.
For brands planning a campaign
A recurring owned surface where a long-running sponsorship, guest contribution or series sponsorship could sit, rather than a one-off post. Ask for the current cadence and audience figures before committing budget.
Thangaraju organizes the CISO Strategy Salon dinner series under Alchemy Cyber Inc.
Read more
They have hosted events sponsored by Vero Security and Metano, including one in partnership with Sentra. They also launched The Beyond CISO newsletter and posted about attending the Mindfluence leadership event in Napa.
Alchemy Cyber Inc
Disclosed partnership
Posts present Alchemy Cyber Inc as the company behind the CISO Strategy Salon dinners, with thanks to sponsors and references to the Alchemy team.
Read more
For a commercial relationship, ask whether Anand Thangaraju owns or works for the company.
Original disclosure
Alchemy Cyber Inc is proud to sponsor this vendor-free space for practitioners to come together and trade notes on their experiences with vendors and niche point solutions, filtering out the noise.
Anand launched The Beyond CISO, a weekly newsletter covering cybersecurity, leadership, technology, and the business of security.
Read more
Original disclosure
I'm launching The Beyond CISO, a weekly newsletter where I'll share what I'm seeing, thinking about, and learning across cybersecurity, leadership, technology, and the business of security.
Anand posted that they are attending the Annual Mindfluence Leadership Event in Napa and look forward to contributing to discussions on AI and the CISO role.
Anand Thangaraju writes about the space between a security product and a security purchase.
Read more
Their posts explain why the same pitch fails with different security leaders: they divide “CISO” into at least eight buyer tribes with different budgets and mandates, then show how each reporting line—to the CIO, CFO, CRO or COO—changes what that leader is rewarded for and what the structure pushes them to ignore.
A companion piece explains why a deal can stall even after practitioners love the product: the analyst who tests it and the executive who has to approve it need entirely different reasons to believe, and adding features for an already-convinced technical audience does not answer the second group’s question.
A second thread is aimed at defenders rather than sellers.
They argue that calling people the weakest link protects bad system design, and that teams spend time testing what AI can do to them without testing what their own controls can do against AI.
Both posts end with something readers can run: strip the weakest-link framing out of one board deck, or take a known AI-enabled attack technique and try it against an environment you actually defend.
A related post makes the leadership version of the same point: knowledge has stopped being an advantage, and judgment, relationships, taste and conviction are what remain.
The third strand is a running account of the rooms they convene.
CISO Strategy Salon recaps document what practitioners say out loud: vendor-free peer dinners beat sales pitches and RFPs; value-added resellers are mostly cashing in on procurement paperwork now; and a CVE and patch backlog is an operational metric a board cannot act on unless it is re-priced as revenue at risk, customer trust or regulatory exposure.
Their weekly newsletter, The Beyond CISO, is the place to follow this continuously rather than post by post.
He works the founder-to-CISO sale from the inside, much as Thangaraju does.
Read more
He runs a cybersecurity go-to-market podcast built around thousands of introductions between founders and security leaders, and makes the same central argument: the vendor never closes the enterprise deal; the internal champion does, after five to twenty meetings and sales cycles running nine months or longer. Both treat AI agents as a new buying category rather than just a new attack technique, and write about why customers stop renewing products that still work.
Tsanev mostly interviews founders and CISOs, reporting what they tell him.
His framing relies on practitioners’ second-hand accounts, while his own commentary focuses on deal mechanics and market structure.
Thangaraju writes first-person analysis and puts questions directly to readers.
Tsanev’s AI material is more product-specific, built around a particular vendor’s positioning for securing AI agents, skills and plug-ins.
He addresses the same governance question Thangaraju raises: where the CISO should report, and how independence from IT, direct access to the CEO and regular board engagement shape whether security is prioritised.
Read more
Both argue that a title tells you less than structural position, and urge security leaders to translate controls into outcomes executive teams care about: money moving incorrectly, customer trust and operational resilience.
Keating advises CEOs and mid-market organisations on specific exposures, including Microsoft 365 business email compromise, credential theft, OAuth consent and inbox forwarding rules, as well as fractional-CISO engagements. Thangaraju focuses on buyer behaviour and vendor strategy, with much less platform-level control detail and no equivalent advisory offer.
He shares Thangaraju’s core claim about system design: decades of spending on encryption, detection and response have not moved breach rates because the exploited surface is human, not digital.
Read more
Both build the argument from the same Verizon breach-report range and look beyond attacker capability to ask what the defence actually does under pressure. They also conclude that training and behaviour programmes are the wrong answer.
Ellingson works at the threat-report and architecture level.
He reads CrowdStrike, WEF and CISA material directly, extrapolates attack scale, speed and scope a decade out, and argues for removing humans from the authentication loop entirely, framing it as the elimination of an attack class.
Thangaraju raises the design point but focuses on buying, leadership and control-testing questions, stopping short of prescribing a specific architecture.
Anand Thangaraju's LinkedIn account shows 23,055 followers as of 9 October 2026.
Read more
That is a modest figure for a paid placement, making the audience's composition more important than reach.
The content suits campaigns aimed at security decision-makers: posts distinguish among CISO buyers—the global CISO with a large budget, the director running a small one, the post-breach CISO, the builder CISO, and field and virtual CISOs—and argue that one pitch cannot serve them all.
Other posts trace how a security leader's reporting line shapes what they are incentivised to buy, and why a practitioner who loves a product is not necessarily the person who approves the spend.
The posts also cover security system design: one argues that "humans are the weakest link" should be retired in favour of making the secure path the easy path; another makes the case for testing existing controls against realistic AI-enabled attacks rather than assuming a written policy holds.
Anand Thangaraju's partnership activity centers on the CISO Strategy Salon, a dinner series they run through Alchemy Cyber in cities including Miami Beach, Atlanta, the Bay Area, and the East Bay.
Read more
Individual evenings are backed by a named security vendor — Metano, Sentra, and Vero Security appear in their posts as sponsors or partners — while the room remains vendor-free for CISO and practitioner guests.
They also credit co-hosts and venues by name.
No sponsor policy, rate card, or partnership inquiry page appears in the posts, so ask directly about terms.
Sponsor a CISO Strategy Salon dinner
Buyer requirement
Anand's posts name the vendors backing each evening: Metano sponsored the board-governance salon, Sentra partnered on the East Bay healthcare salon, and Vero Security sponsored the Atlanta salon.
Sponsorship buys association with the room, not a pitch slot: Anand describes the Salon as a vendor-free space for practitioners to trade notes on what actually works.
Sponsors should expect to back an event in a specific city and support the conversation rather than run a product demo.
Cities and dates are published on the events calendar; sponsors must ask directly about scope, cost, and benefits.
Co-host a Salon with a local leader or partner
Buyer requirement
Some Salons partner with a named person who anchors the evening locally — Ed Pascua in Atlanta, Kashish Mittal in Miami Beach — and Alchemy thanks these partners publicly in the event write-up.
A vendor or regional partner taking this route should bring more than payment: a venue, local relationships, or a keynote-grade speaker.
The partner's public credit reaches the same CISO audience.
Back a practitioner meetup or channel discussion
Buyer requirement
Beyond the Salon dinners, Anand hosts smaller peer sessions built around a single operator question, such as a vendor-free meetup on what value-added resellers are actually for, co-run with Pradeep Aswani.
The audience is narrower than a Salon, and the discussion is deliberately candid.
A partner supplies the topic and the room; the format produces a small-group conversation.
Anand says an operating model for strategic partners came out of that session.
Strong fit for a security vendor selling to CISOs that needs to repair a generic pitch.
Read more
The campaign should build demand and sales-enablement content around CISO buyer personas, reporting-line incentives, and the gap between practitioner approval and executive purchase.
Anand Thangaraju’s posts already do the diagnostic work.
One opens with a founder pitching the same deck to three CISOs and losing three different ways, then separates at least eight buyer types, including a global CISO with a large budget, a director-level security leader with a small one, a post-breach CISO, a product CISO, a field CISO, and a virtual CISO.
A companion post ties buyer behaviour to reporting lines: reporting to the CIO, CFO, CRO, or COO creates different incentives and conflicts.
Another explains why practitioners can love a product while the deal stalls: the SOC analyst, threat hunter, and security engineer answer whether the product works, while the security leader answers whether the organisation should spend money on it.
Their writing also covers the system-design side of the campaign.
They argue for retiring the weakest-link framing and making the secure path the easy path, with phishing-resistant MFA, password managers, and just-in-time access replacing awareness theatre.
The commercial format supports the fit.
They run a CISO dinner series and a weekly newsletter, giving a vendor the option to seek a co-host or sponsor position for a vendor-free practitioner conversation, or place the argument in the newsletter, subject to terms agreed directly.
The LinkedIn follower count is 23,055, but audience composition and engagement, seniority, and employer breakdowns are not published.
Ask for audience details and sponsorship terms before committing budget.
When to choose a specialist
Poor fit for a security awareness-training vendor seeking a campaign that calls employees the weakest link and argues that more frequent training or phishing simulations reduce breach risk.
Read more
This is a poor fit, not a neutral one.
Anand Thangaraju explicitly calls the weakest-link line one of the most damaging myths in security because it shifts blame from the people who design systems to the people who use them.
They cite the Verizon DBIR finding that the human element appears in roughly two-thirds of breaches, but also use the DBIR authors’ own pushback: humans show up because environments are built so one click or misconfiguration causes damage.
They cite the UK NCSC calling the framing counterproductive and Google’s account-takeover work, where security keys eliminated phishing compromise through a design change rather than behaviour change.
Their recommended replacements are phishing-resistant MFA, password managers, and just-in-time access.
They also ask readers to audit recent executive decks for 'human error' or 'weakest link' language and rewrite one without that framing.
A training-volume campaign would fight their stated position and likely read as an example of the pitch problem they already warn about.
The same mismatch appears in their event work: the CISO Strategy Salon is described as a vendor-free space for practitioners, and a separate peer meetup openly challenges the channel model, calling VARs that only supply introductions 'a purchase order with a logo on it'.
A vendor whose message depends on blaming users would need to change its argument or choose a different creator.
A worked campaign example
Worked campaign angle for improving demand and sales enablement: 'One demo, four business cases.' Start with Anand Thangaraju’s founder failure scene: the same deck pitched to three CISOs fails in three different ways.
Turn it into a diagnostic asset for the vendor’s sales team.
First, create a CISO buyer map that identifies each prospect by mandate and reporting line, not title alone.
Use their CIO, CFO, CRO, and COO reporting-line trade-offs to show sellers what the buyer is incentivised to protect or avoid before the demo.
Second, build a two-track proof plan.
For practitioners, show integration, detection behaviour, implementation timeline, and a reference customer in the buyer’s sector.
For approvers, show the business outcome: reduced investigation time, less manual work, coverage the existing stack cannot provide, and a known exposure addressed without adding another team to run it.
Publish a long-form post around the founder story, with the buyer map and discovery question set as a portable asset.
Third, create a champion kit that answers the question from their post on why security deals die after the demo: can the champion explain to IT, finance, procurement, legal, and architecture why the company should buy it?
Give the champion a one-page business case that converts a technical finding into revenue at risk, customer trust, regulatory exposure, or deal velocity, following their board-risk translation post.
Fourth, add an optional event layer: if sponsorship terms are agreed directly, the vendor backs a CISO Strategy Salon dinner or a smaller practitioner meetup, with no pitch slot, and uses the room to test the buyer map.
This angle draws directly on Thangaraju’s material rather than a generic 'know your buyer' campaign.
Before budget approval, ask for commercial terms and measured audience details; don’t imply that Thangaraju endorses the vendor or that event sponsorship buys a pitch.
Pick Val Tsanev when the vendor's problem comes later in the sales cycle: a nine-month enterprise deal, a champion who cannot carry the business case, or a renewal under question even though the product works.
Read more
Their material draws on a reported 4,000-plus one-to-one meetings between security founders and CISOs over five years.
The two posts address decisions Thangaraju's posts do not: the founder does not close the deal, the champion does; qualification and champion buy-in can take five to twenty meetings; and CISOs are cutting products they can no longer defend.
A specialist vendor must show why the remaining 20 to 30 percent of capability a buyer cannot get from a platform they already pay for merits another contract, integration, dashboard, and CFO conversation.
For a vendor losing renewals to 'good enough' incumbent coverage, or whose deals die months after a positive demo, this is a closer match than a buyer-persona map.
Tsanev's posts draw largely on interviews and founder accounts, alongside Tsanev's own business context, including a partnership with the company featured in one episode.
A campaign would therefore generalise from reported patterns rather than close readings of named CISO behaviour.
The posts do not segment CISO buyer types or distinguish practitioner approval from executive purchase.
They offer a podcast-and-GTM framing, not the system-design argument in Thangaraju's posts: retire weakest-link language in favour of phishing-resistant MFA, password managers, and just-in-time access.
Ask for buyer-persona mapping, discovery questions, and a champion kit if the campaign needs those sales tools.
Pick Patrick Keating when the buyer is an SMB or mid-market chief executive or board member rather than an enterprise CISO, or when the vendor sells email and Microsoft 365 security, identity governance, or fractional CISO services.
Read more
The M365 post frames email as a financial system and M365 as a Tier-0 business asset for SMB leaders, then gives three 2026 planning points: 'we have MFA' is not a strategy because MFA alone does not stop business email compromise, token abuse, or OAuth persistence; resilience beats assumptions; and the real question is whether the business can stop fraud quickly.
The governance post synthesises peer-reviewed research on where the CISO should report, finding that independence from IT, proximity to the chief executive, and board-level visibility matter more than title.
A vendor whose product protects mail flow, identity, or conditional access would get an executive-facing argument with citations and an explicit governance frame; Thangaraju's posts instead speak to the sales conversation with CISOs.
Keating writes to chief executives and boards, and the posts promote a service offer — business-first security assessments, fractional CISO work, and a direct invitation to a chief-executive conversation.
A vendor campaign would sit inside the consultancy's own demand generation and would need to be separated from it contractually.
The posts offer no sales-pitch repair: no buyer-persona segmentation, treatment of reporting lines as qualification signals, or champion kit.
A vendor whose real problem is a deal stalled after a strong technical demo would be borrowing a governance and resilience argument while building the pitch fix elsewhere.
The comparison rests on two posts, one a 2026 roadmap pitch to SMB leaders; ask for more examples if the campaign needs evidence beyond those topics.
Pick John Ellingson when the vendor's problem is category-level disbelief rather than a weak deck: the buyer does not accept that the current security architecture can hold, and the campaign needs a quantified, long-horizon threat case to open the argument.
Read more
One post reads the CrowdStrike 2026 Global Threat Report straight — attack volume up 89 percent year over year, breakout time down to 29 minutes, 82 percent of intrusions using no malware — and projects scale, speed, and scope ten years out.
Its conclusion: 'AI-enabled attack' stops being a category and becomes simply what attack means.
The companion post argues that the industry has spent 40 years and hundreds of billions treating cybersecurity as a technology problem while 68 to 82 percent of breaches involve a human element, and concludes that better training, MFA, and deeper behavioural analytics are the wrong fixes.
For a vendor selling structural change rather than an increment on an existing stack, this is a stronger opening than a persona exercise.
The ten-year figures are Ellingson's own extrapolation from the cited reports, labelled as such.
The second post ends on a specific product category that removes humans from the authentication loop.
A vendor whose product does not do that would be borrowing a thesis that ends elsewhere; a campaign that reads as an endorsement of that category carries a real risk.
The trade-off is a macro thesis rather than a sales fix, with borrowed forecast numbers the client would need to stand behind.
Ask for sales-enablement material if the campaign needs to address why CISOs reject a deck.
Anand Thangaraju has 15 LinkedIn posts covering buyer segmentation and reporting-line incentives, sales qualification, why practitioners and approvers need different reasons to buy, retiring the "weakest link" framing in favour of system design, testing your own controls against AI-enabled attacks, translating cyber risk for boards and CFOs, the CISO Strategy Salon series, and the launch of The Beyond CISO newsletter.
The posts have no publication dates; the only time reference is a Mindfluence leadership event listed for 3-5 May 2026.
Anand Thangaraju had 23,055 LinkedIn followers on 9 October 2026.
Similar-creator comparisons are based on six further posts from three cybersecurity creators dated January to October 2026, judged on ideas, teaching approach and format rather than audience size.
The posts here do not provide engagement or demographic breakdowns, sponsor terms or rate cards, campaign performance data, or information about a signature book, show or fuller career history; those gaps are noted where they affect a decision.
