Cybersecurity · Pricing Negotiation Call
Cybersecurity Pricing Negotiation Script: Holding Your Number After the SOC Says Yes
The Head of Detection Engineering has already told her Director of Security Operations that your alert-triage layer is the pick. The 30-day replay against last month's alert metadata came back clean — you surfaced the credential-stuffing cluster that got bulk-closed on a Friday, and you didn't drop the two incidents they already knew about. The security review is closed, the SOC 2 Type II is in their GRC folder, the read-only API connector never touched an endpoint. There is exactly one thing left, and it's the number.
This call does not feel like a fight. That's the problem. The person on the other end is pleasant, technical, genuinely likes you, and is going to spend forty minutes doing five specific things: anchoring at half your quote, waving a co-managed MDR bundle that "includes dedupe anyway," dangling a logo they may not legally be able to give you, threatening to slide the PO past their fiscal close, and going quiet after every figure they name. Security buyers are unusually good at this — they negotiate SIEM ingest tiers priced per GB per day every single year, and they have watched their licence cap eat the budget line that used to fund headcount. They know how to make you pay for silence.
Your job is not to win. Your job is to hold price by trading, keep it warm enough that they still want to sign with you, and get off the call with a date, a signer, and a PO path. Everything below is meant to be said out loud. The numbers in the examples are placeholders — swap yours in before you dial, and write down your Ask, your Target and your Floor first, because if you don't set a floor, the floor becomes wherever the Director of SecOps stops pushing.
The pricing negotiation call script
Say it in your own words. The structure is the part that matters.
- 1
Before you dial: your three numbers and your cyber-specific trade list
Write these down. Not in your head. **Ask:** what's on the quote — say $198K/yr for the 12,000-alerts-a-day tier. **Target:** where you genuinely expect to land — $180K with a 24-month term and annual prepay. **Floor:** $165K, and only with 36 months prepaid, VP-approved. Below $150K you walk. Your trade list, industry version: | You can give | You must ask for | |---|---| | Discount points | 24 or 36-month term (matches their SIEM renewal cycle) | | Deferred start — sign now, first invoice at fiscal start | Annual prepay up front | | Onboarding / detection-content tuning fees waived | Signature by a named date | | A second tenant or non-prod environment for detection engineering | Anonymised case study, sector + size, quote from a named or unnamed exec | | Extra analyst seats | Three private reference calls under NDA, CISO-to-CISO | | Renewal uplift cap at 5% | Auto-renew clause left intact | | Net-45 terms | Their standard MSA, redlines dropped on uncapped liability | | Named security architect for the first 90 days + quarterly detection review | Intro to the sister BU / the EMEA SOC | Also know: who actually signs (CISO or CFO?), whether procurement re-opens the TPRM file at contract stage, when their SIEM licence renews, and whether their fiscal year ends before or after yours.
- 2
Open by making them re-state the yes
"Before we touch commercials — last week Priya told me detection engineering is aligned and this is the direction. Is that still where you are?" [Wait. Get the yes out loud.] "Good. Then I'm not going to re-demo anything. Let's spend this call on what has to happen to get it signed." Why: it is much harder to threaten to walk twenty minutes after confirming you've won. And re-pitching features tells them you think you can still lose — which tells them you'll pay to keep it.
- 3
Restate the case in their metrics, not your features
"Just so we're measuring the number against the right thing. What you gave us: 11,400 alerts a day out of the SIEM, four Tier-1 analysts, roughly 2,800 alerts per analyst per shift, and an alert-to-incident ratio somewhere north of 900 to 1. On the replay we collapsed that to about 340 things a human reads, and we surfaced the credential-stuffing cluster from the 14th that got bulk-closed at 4pm on a Friday. Your own dwell-time number on that one was nine days. That's the shape of it. The proposal on the table is $198K. So — what needs to happen to get this signed?" You are not justifying price. You are setting the ratio any discount gets measured against.
- 4
When they anchor low — ask, don't counter
They say: "Honestly, we budgeted about half that." Do not react to the number. Do not counter. Get curious about how it was built. "Help me understand how you got to $95K. Is that a line finance has already approved, or is it the number you'd like it to be?" Then, if it's real: "Okay. I can build you something at $95K. It won't be this. It'd be two log sources instead of eleven, no detection-content tuning, and no non-prod tenant for Priya's team — which means your rule changes go straight to production. Do you want me to price that version, or do we work on where the other hundred comes from?" **When they push price, you move scope. Never move price alone.**
- 5
Point at the budget line they haven't looked at
Security buyers almost always have a second wallet. Use it. "One thing before we squeeze my line. Your SIEM renewal is priced per GB per day, and you told me you're at 1.9 terabytes with three log sources you've deliberately not onboarded because you can't afford to ingest them. If we cut what actually has to be indexed and searched hot, that renewal conversation changes — and that's a different budget line than mine. Who owns that renewal? Because if it's the same VP, this stops being a $198K ask and starts being a swap." Same play with a co-managed MDR contract billed on volume: less volume for them to look at is a tier down at renewal.
- 6
The competitor / bundle quote
"That's a real number, I believe you. Send me the quote — not to match it, I want to see what's in it. Every time we've seen theirs, the connector and the detection-content tuning sit outside the licence and land as a change order in month four, and the suppression logic is theirs, not yours, which matters the first time an auditor asks who approved a rule." Then the question that ends it: "If they were free, would you still be buying them?" Nine times out of ten you get a version of "no, yours caught the thing theirs didn't." That answer is your leverage for the rest of the call. Never say the competitor is worse. Say exactly what is missing from the quote and what that costs in month four.
- 7
The reference trade — the cybersecurity version
Do not accept "we'd be happy to be a reference" as payment. And don't assume they can give you a logo — plenty of security orgs will not disclose their stack publicly, on principle. "I'd genuinely value that, so let's make it a real trade rather than a nice intention. Three options, you pick one: a named case study with your logo and a quote from Dana; or an anonymised one — 'a US healthcare provider, 9,000 endpoints' — with the metrics in it; or three reference calls under NDA, CISO to CISO, that I can use for twelve months. Whichever it is, it goes in the order form with a date. Four percent for the anonymised version plus the references. Can you commit to that, and does comms or legal need to approve it?" If they can't put a date and an approval path on it, the discount comes off — warmly. "No problem at all. Then let's leave that four out and talk about term instead."
- 8
The delay threat and the procurement stall
They say: "We might just push the PO to Q3." Don't panic and don't buy the quarter with margin. "That's your call and I'll still be here. Practically though — you've got two reqs unfilled at seven months and a night shift on on-call rotation. If this lands in Q3, what's Tier-1 doing between now and then? And Priya's detection-engineering roadmap for this half was partly built on not writing suppression logic by hand." Then solve the actual problem, which is usually cash timing, not decision: "If it's timing rather than the decision — I can do a deferred start. Sign this month, first invoice 1 July, price on this quote. You get the number, your budget lands in the right quarter." If it's procurement re-opening the TPRM file: "Your GRC team already closed the security review. Anything in a second pass is data-handling, not endpoint — same file, same diagram, same subprocessor list. I'll send it again today so it runs in parallel, not in series."
- 9
The silence
They name a figure and stop talking. This is where the margin leaks. **Rule: you may not improve your own offer twice in a row.** After they go quiet you have two legal moves — say nothing, or ask a question. [Count to seven.] "...What's your reaction to that?" Or, if you have to speak, speak about process: "What's the approval path once we've agreed the number?" Never fill a pause with a number. The pause was the tactic.
- 10
The concession ladder — decreasing, traded, explained
Every discount is (a) smaller than the last, (b) traded, (c) explained. Bad: 12% → 18% → 24%. You've taught them each ask is worth six points. Good: 7% for a 24-month term → 10% for annual prepay → 11% for signature by the 27th, final. Say it like this every time: "I can get to ten, and here's what I need to justify it internally: annual prepay instead of quarterly. If you can do that, I'll take it to my VP today. If you can't, I'm at seven." Discount services and fees before you discount the platform line. The platform line is your renewal baseline and your uplift conversation in twenty-four months.
- 11
Escalation — use the card once, and only to buy a trade
"Sixteen percent is outside what I can sign. I can take it to our VP, but I can't walk in with just a request — I need to walk in with a reason. Thirty-six months, prepaid, and the three reference calls, and I've got an argument. Give me that and I'll go fight for it." When you come back, come back final, and say why it's final: "He signed off at $172K on 36 months prepaid. He would not do it at 24. That's the trade, and that's where it stops." Don't play this card twice. Twice tells them there's another floor underneath.
- 12
Land it — say the whole thing back and get the date
"So let me say it back. $180K a year, 24-month term, annual prepay, anonymised case study plus three NDA reference calls inside 120 days of go-live, renewal uplift capped at five percent. Dana signs, procurement raises the PO off the existing vendor record, security review is already closed. You're signing by the 27th. Have I got that right?" Then the line that protects it: "And to be straight with you — this number is tied to those terms and that date. If the 27th moves, I have to re-approve it. I'd rather tell you now than surprise you in two weeks." Revised order form in their inbox within the hour. Fifteen-minute hold on Thursday to confirm legal's clear.
- 13
Staying warm the whole way through
You're on their side of the table, arguing with your own company on their behalf. Say it out loud, repeatedly: "I want to get this done." / "Let me see what I can build." / "I'll go fight for that." / "That's a fair ask, it's just not one I can sign." A firm no delivered warmly gets respected. A soft yes delivered nervously gets pushed again. A Director of SecOps who is good at this — and this one is — enjoys negotiating with someone who is also good at it. Their respect is the thing that stops the fourth ask.
How the call actually sounds
Prospect on the left, the rep on the right.
Rep
Before we get into the number — last week Priya said detection engineering is aligned and we're the pick. Is that still where you are?
Buyer
It is. Priya's happy. Dana's happy. Nobody's arguing about whether it works — the replay was the replay, you found the credential-stuffing cluster we bulk-closed. It's purely the number now. And honestly, the number's a problem. We budgeted about ninety-five for this.
Rep
Help me understand how you got to ninety-five. Is that a line finance has already approved, or is it the number you'd like it to be?
Buyer
It's what's left. Our SIEM renewal came back twenty-two percent up on GB per day — we're at 1.9 terabytes and climbing every time cloud spins up a new account. That ate the tooling line. So ninety-five is genuinely what I have, and I'll be straight with you, my co-managed MDR provider says they'll do dedupe in their portal at no extra cost when we re-tier in April. So there's a version of this where I do nothing and get most of the way there.
Rep
Two things in there. On the MDR: if they were doing it for free, would you still be buying us?
Buyer
...No. Their dedupe is IOC-level, it's not going to collapse the three noisy rules that make up most of our volume, and the suppression logic lives in their portal, not ours. Priya would lose her mind. But it's zero dollars, and zero is a number my VP understands.
Rep
That's fair, and I'd rather you told me. So let's deal with the ninety-five properly. I can build you something at ninety-five — it'd be two log sources instead of eleven, no detection-content tuning in the first quarter, and no non-prod tenant, which means Priya's suppression changes go straight to production with no staging. Do you want me to price that, or do we work on where the other hundred comes from? Because here's the thing I'd push back on: the money isn't gone, it moved. Your SIEM licence is priced per GB per day. If we cut what has to be indexed hot, that renewal is a different conversation, and that's not my budget line.
Buyer
[pause] ...Say I take that to Dana. She's going to ask why she's paying twice for the same problem. And look, I'll help you here — we'd be a great logo for you. Big name in our sector. That's worth something, right?
Rep
It genuinely is, and I'll price it rather than just thank you for it. Three ways we can do it: named case study with your logo and a quote from Dana; anonymised — 'US healthcare provider, 9,000 endpoints,' with the alert-to-incident numbers in it; or three reference calls under NDA, CISO to CISO, that I can use for twelve months. Which of those can you actually commit to, and does comms need to approve it?
Buyer
Not the logo. We don't disclose our stack, full stop — Dana's position is that publishing what we run is free reconnaissance for someone. Anonymised, probably. References, maybe two, and she'd want to vet who she's talking to.
Rep
Then let's write that version: anonymised case study plus two vetted reference calls, inside 120 days of go-live, in the order form with a date. That's four points. Which takes me to $190K. To get further than that I need term — a 24-month deal instead of twelve gets me to $184K, because I can amortise the onboarding across it.
Buyer
One-sixty. [silence]
Rep
[seven seconds] ...What's your reaction to $184K?
Buyer
My reaction is that I've got a competing quote at a hundred and forty and I'm choosing not to use it. And frankly, if we can't land this, I'll just push the PO to Q3 and re-run the whole thing then. Nobody's going to fire me for waiting a quarter.
Rep
Send me that quote — not to match it, I want to see whether the connector and the content tuning are inside it or land as a change order in month four. And on Q3: that's your call and I'll still be here. But practically — you've got two reqs unfilled at seven months, a night shift on on-call rotation, and 2,800 alerts per analyst per shift. What's Tier-1 doing between now and July? If it's cash timing rather than the decision, I can solve that without either of us losing anything: sign by the 27th, first invoice 1 July. You get this price, the spend lands in the quarter you have money in.
Buyer
...That's actually the real problem, yeah. Cash, not the decision. If you can do deferred start, and you can get me under one-eighty, I think I can walk that into Dana this week.
Rep
Here's what I can do and it's the last move I've got. $180K, 24-month term, annual prepay, first invoice 1 July, uplift capped at five percent at renewal, anonymised case study and two reference calls inside 120 days — written into the order form. I need prepay to justify the deferred start internally; if it goes quarterly I'm back at $190K. Can you commit to prepay?
Buyer
Prepay I can do — it's easier for me than quarterly, procurement hates raising four POs. Give me until Thursday to get Dana's signature path confirmed.
Rep
Done. Revised order form in your inbox within the hour, and I'll hold fifteen minutes Thursday to confirm legal's clear and the PO's raised off the existing vendor record. One thing so I'm not surprising you later: this number is tied to prepay and to signature by the 27th. If the 27th moves, I have to take it back for re-approval. I'd rather say that now than in two weeks.
Objections you will hear
What they say, and what you say back.
| Objection | How to answer it |
|---|---|
| “"Our SIEM renewal came in twenty-two percent up on GB per day. That's where the money went — I don't have a tooling line left."” | "Then let's not fund this out of the tooling line. Your licence is priced on ingest. You've got three log sources you've deliberately not onboarded because you can't afford them — that's a visibility gap you're carrying on purpose. If we change what has to sit indexed and hot, the renewal number moves, and that's a different wallet than mine. Who owns that renewal? If it's the same VP, this is a swap, not an ask." |
| “"My MDR says they'll fold dedupe into the April re-tier at no extra cost."” | "Ask them one question: is it IOC-level dedupe, or does it collapse the three rules that make up most of your daily volume? And where does the suppression logic live — their portal or yours? Because when the auditor asks who approved a suppression, 'our MDR' is not an answer that closes the finding. Also, they bill you on volume they have to look at. They are not structurally motivated to reduce it. Separately — if they were doing it for free, would you still be buying us?" |
| “"I've got a competing quote at forty percent less and they'll throw in the SOAR connector."” | "I believe you, and I'd like to see it — not to match it, to read it. Every time we've seen that quote, the detection-content tuning and the false-positive baselining sit outside the licence and arrive as a change order around month four, and the connector is one-way. Send it over and I'll tell you exactly which lines aren't in it. If I'm wrong about that, I'll say so." |
| “"We'd be a great logo for you — that has to be worth some points."” | "It is, so let's price it properly instead of me thanking you for an intention. Named case study, anonymised case study with the metrics in it, or NDA reference calls — pick one, put a date and an approval path on it, and it goes in the order form. Four points for anonymised plus two references. If Dana's position is that you don't disclose your stack — which is a completely reasonable position — then we do the anonymised version and I'll write it so it's useful without identifying you." |
| “"Nobody gets fired for waiting a quarter. We'll just push the PO to Q3."” | "That's your call and I'll still be here. Two practical things though: your two open reqs are at seven months, your night shift is an on-call rotation, and Tier-1 is reading 2,800 alerts a shift between now and July — so somebody's carrying that. And if it's cash timing rather than the decision, I can fix that at no cost to either of us: sign this month, first invoice on 1 July. You keep this price, the spend lands in the quarter you're funded in." |
| “"Procurement wants to re-open the third-party risk questionnaire before we can raise a PO."” | "Fine — and it's the same file, because there's nothing to deploy. Read-only API into the SIEM you already own, no agent, no kernel driver, no golden image change. I'll resend the SOC 2 Type II, the pen test summary, the data flow diagram and the subprocessor list today so your GRC team isn't chasing. Can we run that in parallel with legal rather than in series? Otherwise a six-week review becomes twelve and we both miss the 27th." |
| “"My CISO is going to ask why we're paying you when we already own a SIEM, a SOAR and an MDR."” | "Give her this answer: the SOAR runs playbooks after a human decides something matters, and the MDR is priced on volume it has to look at. Neither of those changes what your analyst reads first. We sit at ingest and collapse duplicates and known-benign into one item, and nothing is deleted — everything stays queryable and retained for the auditor. The measurable claim is your alert-to-incident ratio and your dwell time on the ones you confirm. You already ran the replay; those are your numbers, not mine." |
Questions reps ask about this call
- How do I stop a security buyer's low anchor from resetting the whole negotiation?
Never counter a number with a number. Answer with a question about how it was built: "Is that a line finance has approved, or is it what you'd like it to be?" In security, "we budgeted half" very often means the SIEM ingest renewal took the tooling line — which is a funding-source problem, not a value problem. Once you know which it is, move scope rather than price: offer a genuinely smaller deal at their number (fewer log sources, no content tuning, no non-prod tenant) and let them decide whether that's the product they actually want.
- What should I trade for in a cybersecurity pricing negotiation when the buyer won't give me a logo?
Assume from the start that a named case study may be off the table — many CISOs and Directors of SecOps refuse to publish their stack because it hands an attacker a reconnaissance map. Don't treat that as a dead end. Offer three tiers: named case study, anonymised case study with the alert-to-incident and dwell-time numbers in it, or a fixed number of NDA reference calls with a named spokesperson and a twelve-month usage window. Whatever they pick gets a date and goes in the order form. Other high-value trades that cost you nothing: 24 or 36-month term aligned to their SIEM renewal, annual prepay, auto-renew left intact, and dropped MSA redlines.
- They're threatening to push the PO to next quarter. Do I discount to hold the quarter?
No — diagnose first. Ask whether it's the decision or the cash. If it's the decision, more discount doesn't fix it and you've just paid for nothing. If it's cash timing, a deferred start solves it for free: sign this month at this price, first invoice on the date their new budget opens. Then make them do the cost-of-delay math out loud, in their own metrics — two unfilled reqs, on-call night coverage, alerts per analyst per shift between now and then, and whatever the Head of Detection Engineering had scheduled that now slips.
- How much discount is normal on a security tooling deal, and how should I structure it?
Set your own Ask, Target and Floor before the call rather than working from a rule of thumb — and know both the number that needs approval and the number where you genuinely walk. What matters more than the size is the shape: each concession must be smaller than the last, traded for something named, and explained. Seven points for term, three more for prepay, one final point for a signature date is a ladder that says you're approaching a floor. Ten, then fifteen, then twenty says there is no floor and invites a fourth ask. And discount fees and services before the platform line — the platform line is your renewal baseline and your uplift conversation in two years.
- What do I do when the buyer names a number and then just goes silent?
Nothing, for about seven seconds. The rule is that you may not improve your own offer twice in a row. After they go quiet you have exactly two moves: stay silent, or ask a question. "What's your reaction?" is the safest one. If you have to talk, talk about process — "What's the approval path once we've agreed the number?" Filling a pause with a sweetener is how a friendly call costs you thirty points, and experienced security buyers who negotiate GB-per-day licence tiers every year use the pause deliberately.
- How do I practise this without burning a live deal?
Roleplay it out loud with the specific tactics stacked, because reading the script isn't the same as holding your nerve through a seven-second silence. DrillCall lets you run a Director of Security Operations who anchors at half, waves a co-managed MDR bundle, dangles a logo they can't legally give you, and threatens the Q3 PO — then goes quiet. Run it until you can say "that's your call and I'll still be here" warmly, and until every concession that leaves your mouth arrives attached to something you asked for in return.