“Security tools slow my engineers down”

CTO · Cyber security

For a CTO at a growing company, shipping speed is the goal, and anything that slows releases is a cost. Don't argue that security matters more. Start with their goal: ask where security currently holds up a release, then talk about removing that step, not adding one.

What the buyer says

Security tools slow my engineers down. Anything that adds friction is a no.

How to handle it

Listen

Listen for the experience behind it. "Anything that adds friction" usually comes from a tool that blocked builds, flooded developers with false positives, or added a manual sign-off.

Acknowledge

Agree that friction is a real cost. Engineering time is expensive, and a security step that slows every release without catching much is a bad trade.

Explore

Ask where security slows them down today. Is it reviews before release, findings that arrive too late to fix cheaply, or customers' security questionnaires that pull engineers off the roadmap? Ask what a security step that helped rather than slowed them would look like.

Respond

Show where your product removes a step, or moves it earlier so problems are cheaper to fix. If it adds anything, be specific about the cost and what it saves elsewhere, for example faster answers to customers' security reviews.

Say this
“That's fair. A security step that slows every release is a bad trade.”

Say this
“Where does security hold up a release today?”

Say this
“If this took a step out of your release process, would it be worth a look?”

Variations

VP of Engineering: “My team already spends too long on security reviews.”
Head of Platform: “Every tool you add, we end up maintaining.”

Questions people ask

How do you sell security tools to a CTO who worries about engineering friction?

Start with their goal of shipping quickly. Ask where security currently slows releases, then show how your product removes or moves a step rather than adding one, being specific about any cost and what it saves.

What objections do engineering leaders raise about security tools?

The common ones are slower releases, false positives that waste developer time, and tools that become one more system to maintain. Each points to a different concern, so explore which one matters before you respond.