Selling Security

Bruce Schneier makes some interesting points in his CIO piece How to Sell Security. 

Selling security solutions is a little like selling fridge lights in that the user value doesn't really come from the item purchased. Thus those selling infrastructure, whether it be security software or router hardware need to bundle it up in something that is intrinsically useful to the buyer. Why security firms bother with marketing and direct sales is a mystery to me. They need to focus their attention on channel relationships with value adding resellers.

But security bundled into a technology solution is not enough. Security is largely about users and not technology. The value adding vendors need to offer a security framework that embraces policy if they are truly interested in meeting the needs of the customer. Not easy to deliver, but not impossible.