Mod 11 · Trigger Events

Cyber buying is mostly event-driven.

Twelve events that make buyers move. The trigger decides which categories activate, who joins the committee, how fast the deal closes, and what the buyer will actually accept. Selling without naming the trigger is selling into the wrong urgency.

Crisis-tempo (days to weeks)

Breach

Breach / Incident

The organisation gets hit. Confirmed compromise, lateral movement, data exposure, or active intruder. Real or imminent, not theoretical.

Days to a few weeks Open →
Ransomware

Ransomware Scare

Not a hit, but close. A peer organisation gets ransomed publicly, a board reads about it, a regulator sends a notice, or an MDR partner flags activity that looks pre-ransomware.

Weeks to one quarter Open →

Quarterly cadence

Insurance

Cyber Insurance Renewal

The annual cyber-insurance renewal application arrives. Premium quotes depend on specific controls — MFA, EDR, immutable backup, MDR coverage, patch cadence.

30 to 60 days before renewal Open →
Customer Review

Customer Security Review

A prospective or existing customer triggers their vendor-security process. Questionnaires, evidence requests, on-site assessments, trust-center reviews. Often blocking a sale or a renewal.

One quarter Open →
Audit

Audit Deadline

A SOC 2, ISO 27001, PCI, HIPAA, FedRAMP, or internal-audit cycle is approaching. Evidence has to exist, controls have to be operating, the auditor has to be satisfied.

One to two quarters out Open →
Renewal Spike

Tool Renewal / Cost Spike

An incumbent vendor sends the renewal quote with a substantial increase (often double-digit percent, sometimes a multiple). Or finance flags the cumulative spend across overlapping tools.

Tied to the renewal date — typically 60–120 days out Open →
AI

New AI Initiative

The organisation rolls out generative AI, autonomous agents, or model-based features. Data goes into models the security team did not approve. Agents act with permissions nobody mapped.

Tied to the AI rollout schedule — usually weeks to one quarter Open →
Board

Board Pressure

The board asks the CISO uncomfortable questions. Often follows a peer-organisation incident, a regulatory development (SEC cyber disclosure), or a new board-level risk-committee mandate.

One quarter to align with the next board cycle Open →

Multi-quarter / structural

Cloud Migration

Cloud Migration

The organisation moves a workload, a business unit, or the whole estate to AWS, Azure, GCP, or a multi-cloud architecture. Security tooling built for on-prem stops applying.

Migration cycle (often 6–18 months) Open →
M&A

M&A / PE Rollup

The organisation acquires a company, or gets acquired, or is part of a PE platform that just bought add-ons. Two or more security stacks need to converge.

90 days post-close for the priority items; 6–18 months for the full converge Open →
New CISO

New CISO

A new CISO joins. First 90 days = listening tour. Days 90–180 = strategy. Day 180+ = budget decisions on what gets kept, killed, or replaced.

Days 90–270 from the CISO's start date Open →
Regulation

Regulatory Change

A new regulation passes or an existing one is amended — NIS2 transposition, DORA enforcement, NYDFS amendments, state-level privacy laws, SEC cyber disclosure rules. Affected organisations need to demonstrate compliance by a deadline.

Tied to the regulatory effective date or the first enforcement cycle Open →