“We're compliant, we passed our audit”
Head of Risk and Compliance · Cyber security
Passing an audit shows that controls were in place when they were checked. It doesn't show they're working today, or that the audit covered what attackers actually go after. Respect the result, then separate compliant from secure: ask what the audit didn't test, and how they'd know if something changed the day after.
What the buyer says
We're compliant. We passed our audit last quarter.
How to handle it
Listen
Let them describe the audit and the standard behind it. The standard they mention tells you what was tested, and so what may not have been.
Acknowledge
Congratulate them properly. Passing an audit takes real work, and the person responsible for it deserves credit, not a lecture.
Explore
Ask what the audit didn't cover, how often controls are checked between audits, and how they'd know if something drifted the day after. Ask what the board asks them about, which is often broader than the audit.
Respond
Position your product as helping them stay compliant and show it continuously, not as a criticism of the audit. Where it closes a gap they've named, connect it to that gap directly.
Say this
“Congratulations. That takes a lot of work to get right.”
Say this
“What did the audit not look at?”
Say this
“If something changed the day after the audit, how would you know?”
Variations
- Data Protection Officer: “We've done our assessments. We're in good shape.”
- CISO: “We're certified. The board's happy.”
Questions people ask
How do you respond when a prospect says they're already compliant?
Acknowledge the work behind passing the audit, then separate compliant from secure. Ask what the audit didn't test and how they'd know if a control stopped working between audits. Position your product as helping them stay compliant all year, not just at audit time.
Is it a good idea to tell a buyer that compliant isn't the same as secure?
Not in those words: it sounds like a correction. Ask questions that let the buyer draw the distinction themselves.
More objections in Cyber security
- “We've never been breached”
- “My team can't take on another tool”
- “Security tools slow my engineers down”
- “Our managed service provider handles it”
Practise it before the real call
Free to start. No credit card.