What makes a CISO trust a vendor?

Ryan points to evidence of understanding the buyer’s actual environment, honesty about limitations, and a value case that accounts for the operational load the product adds as well as what it removes.

Which sales behaviors get a vendor blocked by a CISO?

Manufactured urgency, pressure tactics, canned sequences, and pitching without having asked about the environment. Ryan is clear these do not merely fail, they can get a company deliberately excluded from future consideration.

What does a good design partnership look like from the buyer side?

One where value flows both ways. The vendor gets real deployment feedback, and the buyer gets genuine influence over the roadmap and a problem actually solved, rather than the status of being a logo.

Why does compliance evidence often fail a reality test?

Because it documents a control as designed rather than as operated. Ryan’s point is that the artifact and the actual state of the system drift apart, which is why evidence can be complete and still be misleading.

Inside the CISO Mind: Trust, Culture, AI, and the Sales Moves That Backfire

Phill Keaney-Bolland· Co-founder and Designer, YayaMarch 17, 20262 min read

With Ryan Lindley, Co-founder and CEO, Aegis Cyber

Listen on Spotify Listen on Apple Podcasts

Key takeaways

Every security product either reduces a CISO’s load or quietly increases it.
The CISO role still carries real ambiguity, and reporting lines shape outcomes more than org charts suggest.
Influence and people skills matter as much as technical depth in the seat.
Much compliance evidence fails a basic reality test.
Certain sales behaviors do not just fail, they get a vendor blocked.

The load test
Why the CISO role is still ambiguous
What earns trust, and what gets you blocked
AI adoption and downstream liability

The load test#

The sharpest idea in this episode is also the simplest. From the buyer’s chair, every product either lightens the load or adds to it. Security friction, engineer context-switching and the operational tax of another console are all real costs that vendors routinely leave out of their business case.

For founders, this is a useful lens to apply to your own messaging. If your pitch cannot say plainly what it removes, the buyer will assume it only adds.

Why the CISO role is still ambiguous#

Ryan is candid about a role that has not settled. Reporting structures vary, authority does not always match accountability, and the personal risk carried by the person in the seat is higher than most vendors appreciate. He talks about reducing internal tension through culture, influence and security champions rather than through mandate.

What earns trust, and what gets you blocked#

Ryan describes what actually earns his trust as a buyer, and the sales moves that shut the door fast. This is the section worth playing to a sales team. The behaviors that backfire are familiar to anyone who has watched a founder get impatient: pressure, false urgency, and pretending to understand an environment you have not asked about.

The pattern matches what we hear repeatedly. It was the canned drip campaign that turned one buyer off, not the product.

AI adoption and downstream liability#

The conversation turns to how CISOs should approach AI adoption and governance, including the liability that flows downstream from decisions made quickly. Ryan also discusses what a control plane across governance, risk and compliance could bring together, and why so much compliance evidence does not survive contact with reality.

Phill Keaney-Bolland

Co-founder and Designer, Yaya

Co-founder and designer at Yaya, and host of the Cult Products podcast. Fifteen years designing products, brands and UX across multiple industries before narrowing to cybersecurity, and lectures on design at Imperial. Works with cybersecurity founders on positioning, strategy and the website that has to carry a launch, across identity, cloud security, AI agents and software supply chain, including Twine out of stealth and Geordie AI, which won the RSA Innovation Sandbox in 2026.