Your Security Buyers Are Fact-Checking You

A SOC analyst spends the day triaging alerts that are mostly noise. A CISO has to defend every number she brings to the board. Then both of them open a vendor launch page and read that the product "stops 99.9% of threats." You've lost them, and you lost them in the headline.

Security marketing has a credibility problem, and it's mostly self-inflicted. The PMMs I've worked with rarely make things up. They inherit. A number from an old customer pilot shows up in a pitch deck, then a blog, then a press release, and by the third hop nobody remembers it came from one customer, on one workload, over six weeks. I call this stat laundering. The number survives. The caveats don't.

Here's how we stop it when we embed with a security PMM team.

Build the proof inventory before the message house

Most launches run in this order: positioning, messaging framework, then someone asks "can we find a stat for pillar two?" By then the message is approved, and the pressure is to find something that fits.

Flip it. Before anyone writes a pillar, inventory what you can actually prove:

• Customer results you can cite by name, or at least by segment
• Customer quotes and reviews you have permission to use
• Benchmark or lab data with a documented method
• Analyst research you're licensed to quote
• Product facts engineering will sign their name to

Then write messaging that stays inside that inventory. A pillar with no proof behind it isn't a pillar yet. Either you go get the proof or the pillar comes out. It feels slower. It isn't, because it heads off the fights with legal and product that stall launches in the final week.

Give every claim an expiration date

A claim ledger is a spreadsheet. Nothing fancy. One row per claim that appears in external content, with five columns:

• Claim: word for word, as published
• Evidence: a link to the primary source, not to the deck that quoted it
• Scope: which customer, which workload, what time window, what sample size
• Owner: the person who can defend it if a customer or reporter asks
• Expiration date: when it gets re-validated or pulled

That last column is the one almost nobody has. A detection figure from a benchmark eighteen months old describes a product you no longer sell, tested against attacks that have since changed. When the date passes, the claim stays out of new content until someone re-checks it.

Small and specific beats big and vague

There's a belief in security marketing that the bigger number wins. With this audience I think the reverse is true. Two versions of the same (hypothetical) claim:

• "Reduces alert volume by up to 90%."
• "A regional bank cut daily alerts from about 4,000 to 600 in its first 90 days, mostly by suppressing duplicate identity alerts."

The second one looks smaller. I'd still bet on it in a real evaluation. It gives the reader a customer to compare themselves to, a baseline, a time frame and a mechanism, and a skeptical buyer can ask about it on a reference call. "Up to 90%" gets one reaction from a practitioner: "up to" means "once, at best."

If a claim doesn't state the conditions under which it's true, the buyer will assume the worst ones. And say what the product doesn't do. One honest limit next to your strongest claim makes that claim easier to believe. Almost no security vendor does it.

Let customers sound like customers

Customer quotes should be your strongest proof. In most security marketing they're the weakest, because they don't sound like a person. "Vendor X has transformed our security posture and empowered our team to focus on what matters most." No CISO has ever said that out loud. Buyers can tell it was written by marketing and approved by a customer too busy to object.

What works better:

• Capture it verbatim, then leave it alone. Record the interview with permission and pull the quote from the transcript. Trim for length, drop the "ums," and stop. A made-up example, but the kind of thing people really say: "We were drowning. Now the night shift mostly leaves me alone." That beats any polished version, because it sounds like someone who lived it.
• Ask for specifics, not praise. "What do you like about us?" gets adjectives. "What did your team stop doing?" and "What would you tell a peer who's evaluating us?" get stories.
• Attribution is proof too. A name and title beats "CISO, Fortune 500 financial services," which beats "security leader." Log the approved attribution and approval date in the ledger. Quotes expire too: when your customer changes jobs, check whether the quote can stay.
• Keep reviews independent. Third-party reviews carry weight because the vendor didn't write them. In the US, the FTC's 2024 rule on reviews and testimonials bans fake reviews (AI-generated ones included), undisclosed reviews by employees and incentives tied to a particular sentiment. Asking happy customers to write a review is fine. Paying for five stars isn't. Review platforms have their own rules on how vendors can quote them, so read those before you paste a review into a deck.

Treat analyst quotes as regulated speech

Analyst citations are where good teams get into real trouble. Gartner's Content Compliance Policy requires vendors to submit external materials that quote Gartner for review, bars language that implies endorsement (it names words like "validated" and "testament"), and requires an objectivity disclaimer when you cite placement in research such as a Magic Quadrant. Break the rules and you can lose the right to quote them for a while.

Yet "validated by analysts" still turns up in launch drafts all the time. Put analyst quotes in the ledger with the exact approved wording. Nobody paraphrases an analyst. Ever.

Underneath all of it sits the FTC's advertising substantiation policy, which has said since 1984 that you need a reasonable basis for an objective claim before you publish it. Before, not after a prospect asks.

Read it like a hostile buyer before it ships

Have someone who didn't write the piece answer four questions:

• Could a competitor's PMM dispute this line with a screenshot?
• If a prospect asked "compared to what?", do we have an answer?
• Would our own customer recognize the result, or the quote, we're attributing to them?
• Would I be comfortable seeing this sentence quoted in a Reddit thread about vendor nonsense?

If any answer is shaky, fix it now. It's a lot cheaper than fixing it after the thread.

Honesty is a positioning advantage

Claim discipline usually gets filed under risk management, which undersells it. In a category where most vendors make the same claims with bigger numbers, the one that states its conditions and admits its limits sounds like the only adult in the room. Security buyers notice. They're paid to.

If you want to start this week, skip the full ledger. Take the ten claims and quotes on your homepage and try to fill in the five columns for each. The ones you can't fill in will tell you more about your messaging than any audit.