Venturing into a security transformation exercise, executives or other stakeholders who are trying to build a customer success program for the first time are most concerned with how to achieve value creation/realization the fastest.

What are the key recommendations for an organization venturing into a security transformation exercise?  To figure this out, VMblog reached out to industry expert and Netskope Director of Customer Experience, Amit Kandpal.

VMblog:  How does a vendor guide a security transformation exercise with an end goal to become a long-time partner?  What is also needed from the customer in order to receive insightful vendor recommendations for quick time-to-value from Day One?

Amit Kandpal:  The number one question I get from professionals in this field, and from executives or other stakeholders that are trying to build customer success programs for the first time, is how do I achieve value creation/realization the fastest. To do this, both the vendor and the customer must come together to articulate key short-term and long-term security strategies and priorities. Without this conversation and exchange of ideas and expectations, a long term partnership can not be achieved, and a customer may not see this partnership offering the initial value promised. Once these strategies and priorities are identified, the vendor can recommend the right implementation roadmaps. A successful roadmap will enable the vendor to assign the right resources with relevant skills, while also accommodating longer-term priorities where necessary. 

VMblog:  What metrics of success should security transformation exercises be measured against?

Kandpal:  Most mature vendors have a framework based on their experience with other customers to capture the key target business outcomes of the program and translate those into specific metrics based on customer context. These can relate to business agility, reduced total cost of ownership, and savings from breach avoidance (among others). Depending on the desired outcome, the metrics of success will differ for each customer and help to further establish a more unique framework for each program. This framework, when built correctly, is extremely helpful for the teams that work with the customer directly, and leaders like me behind the scenes in order to detect any deviation from the optimal path early on, tracking the agreed metrics and making the right interventions when required.

VMblog:  What should a customer ask a vendor in order to ensure the expected impact?

Kandpal:  A surprising number of transformation initiatives lack the due diligence to understand and implement the right level of resources required at all stages of the program. For example, in my experience, the effort and time required to establish an effective Data Loss Prevention program is something that most customers tend to underestimate by a large margin. To avoid this confusion and ensure the success of a security transformation exercise, a customer should start by asking the vendor they are working with for best practices and case studies from similar industries and complexity. A good case study will provide a framework based on rigorous data which can be customized based on complexity, required velocity, and any other considerations.

VMblog:  When building customer success programs with security transformation exercises, why is it important for customers to focus on outcomes rather than replicating an existing way of doing things with a new solution?

Kandpal:  Remember that transformation is not migration. I have seen this distinction getting lost especially for organizations used to doing things in a certain way for a long time. It is important to remember that new technologies enable transformation precisely because they have a different and better take on the same problems. The Customer Success team of a vendor works with hundreds of customers trying to solve different flavors of the same challenges, and it always makes sense to check with them for evolving best practices.

VMblog:  Why is solution training and enablement an important investment in such security transformation exercises?

Kandpal:  Lack of investment in training and enablement is something that happens more often than one would expect due to the perpetual race against time security teams experience. While vendor Customer Success and Support teams are always there to help, there is no substitute for the understanding that must accompany the capabilities and functionality of a solution. Fortunately,  most mature vendors have a variety of training options ranging from self-service to customized in-person ones that will make such an investment highly personalized for each customer.

VMblog:  What does a vendor need to help manage internal customer resource transitions in order to prevent any delays, pauses, or setbacks?

Kandpal:  When on a customer call, the one update that always makes my heart sink is the news that someone critical, either from the operational or executive team, is moving on to a different opportunity. Of course, this happens a lot as we continue to face the current red-hot market for security talent we find ourselves in. The worst-case scenario for the whole engagement is not having a sponsor or an operational team for an unknown period of time. Momentum is crucial for transformation programs, and once stalled, it can lead to a vicious cycle of no value hence no focus and limited resources from the already stretched teams. This sometimes can lead to the eventual demise of the entire program.

To combat these roadblocks, the most successful customer-vendor relationships have redundancy built into team resources, schedule regular planning calls, and track any resourcing risk on an ongoing basis. Customers also make it a priority to nominate a replacement early, when required, and give the vendor enough time to make sure there are no disruptions to the program. With that said, any Customer Success team would be delighted to inform and train the new stakeholder or team if given the opportunity and time to do so.

VMblog:  Why are cadence calls, Quarterly Business Reviews, and Customer Advisory Boards useful when conducting security transformation exercises?

Kandpal:  I can usually take a look at our internal systems of records for Customer Success and make a fairly accurate prediction about the health of the program when reviewing attendance for the last few cadence calls and Quarterly Business Reviews. If I have to pick one single factor of ongoing success, it would be an enthusiastic sponsor attending QBRs regularly, asking the right questions (relating to value, accountability, resources required going forward, the product roadmap, etc.), and providing the required level of sponsorship to move around any obstacles. Regular QBRs where all internal and vendor teams walk away with a shared and clear understanding of target business outcomes, the high-level tactical plan, respective roles and responsibilities, and the path forward to address any dependencies/risks are the hallmarks for the most successful transformations.

##