Finding the Next Opportunities in Cybersecurity
For Cisco Secure
Turned four unmet customer needs into specific opportunity spaces that informed Cisco Secure’s 3–5 year business roadmap.
Cisco Secure was deciding what to buy, build and invest in for the next 3–5 years, but its unmet customer needs were not yet specific opportunities.
My study was the second quarter of a multi-quarter program for Cisco’s Strategy and Innovation Office: quarter one named five unmet needs, and quarter three would weigh the opportunities I found. I led the qualitative deep dive while partners ran quantitative work, including market sizing.
My ownership
Aligned partners on the qualitative deliverables; handed the politicized Shift Left topic to a staff-level owner
Authored the discussion guide, conducted all 12 executive interviews, and ran the two-pass analysis that socialized the insights
Where is the real pain and friction in each need area, and how is it addressed today, if at all?
Business value of security
How do security leaders articulate value beyond risk scores?
Data compliance & regulation
Who owns compliance, and how do teams know they are compliant?
Fragmented cloud transition
How do teams approach migration, and how do security needs evolve?
Decentralized data & access
How do teams secure data and identity spread across many places?
Domain immersion through internal SME interviews, then 12 remote interviews with C-suite and senior security leaders.
Domain immersion
- Interviewed 5 Cisco network security engineers, who hear customer needs through sales
- 1:1s across Cisco teams
Participant profile
- 12 senior executives: CEOs, CISOs, CIOs, VPs and directors
- Large North American enterprises, Cisco Secure’s main market
- Recruited through GLG by responsibilities, not titles
Customer interviews
- 12 semi-structured interviews
- Remote, 60 minutes each
- Shifted from semi-structured to unstructured interviews
Analysis
- Inductive coding with thematic and narrative analysis in Dovetail
- Synthesis with affinity mapping in Miro
3 executives per area, plus secondary-topic questions
30 min topic, 20 shared, 10 open
Double-blind phone sessions
Narrative and thematic analysis; findings directional
Each need area narrowed to a specific opportunity space for Cisco Secure.
CISOs justify security to their boards in five business terms
Resilience, cost versus risk, brand value, competitive comparison and compliance requirements.
“Defense is one thing. Recovery & resilience is another.”
Define the value of security in these business terms, shifting it from a cost center toward a revenue-centric model.
Liability is hard to quantify, and non-human actors make it harder
Challenges center on organizational awareness and agreement, local laws, unclear liability and legacy technology.
“Are you going to be liable that it has the wrong input? I think that’s where the future is going to go.”
Liability from non-human actors, such as AI and robotic processes, that extends beyond existing legal frameworks.
Migration is manual and costly, and some organizations move back
Risk assessment, policy rewrites and compliance checks are largely manual; mismanagement and runaway spending push some back on-premises.
“We ended up having to go back into data centres because their spending was out of control.”
Solutions for reverse cloud migration.
Knowing where data lives and flows is a wicked problem
Data sits in third-party locations with little control, and its lifecycle is hard to see once it is shared.
“A lot of companies don’t even know what data they have or where it’s located.”
Use data immutability to track personal data and control where it flows.
The insights shaped the program’s market research and its long-term product bets.
- Informed market researchShaped the survey instruments and market study parameters used to gauge market sentiment.
- Set further researchIdentified four areas for further research within the unmet needs.
- Fed long-term betsPart of the program that informed acquisitions such as Splunk.
Next time, I’d recruit cybersecurity VCs, who see the whole landscape, not one organization.
What worked
- Internal SME interviews first, which gave the executive interviews direction.
- Recruiting by responsibilities, which got the right executives despite varied titles.
- Diagrams that made complex insights clear to technical and non-technical stakeholders.
What I’d do differently
- Recruit VCs in cybersecurity: they see how the whole landscape is evolving, while executives focus on securing one organization.
- Use a tool built for narrative analysis; Dovetail tags quotes, not the context behind them.