Mastering Cybersecurity Discovery: Best Practices for Selling SIEM and MDR Services to Enterprise Customers

Tony DeGonia
February 10, 2025
Cybersecurity
Best, Customers, Cybersecurity, Discovery, Enterprise, Mastering, MDR, Practices, Selling, Services, SIEM, SOAR, to, XDR

Effective SIEM and MDR selling begins with structured discovery that identifies customer risks, operational gaps, and maturity levels. This article outlines key questions, engagement techniques, and positioning strategies to align managed security services with customer objectives.

Membership Required

You must be a member to access this content.

View Membership Levels

Already a member? Log in here

Tony DeGonia

Tony DeGonia is a seasoned Senior Sales Engineer specializing in SIEM, SOAR, MDR/XDR, SASE, Zero Trust, and enterprise network security design. With a proven track record supporting global and public sector environments, Tony delivers technical discovery, architecture development, POCs, and executive-level presentations for mission-critical cybersecurity programs. His experience spans AT&T Cybersecurity (SLED Public Sector), IBM Security QRadar Suite, Fortra Alert Logic, and multiple emerging security startups. Tony is known for his deep technical fluency across firewall architecture, threat detection engineering, cloud networking, encryption, and multi-vendor integrations — and for helping organizations turn complex security challenges into actionable solutions.

All Posts

Big “S” vs Big “E” — How Sales Engineering Really Breaks Down

I once had a more experienced Sales Engineer explain something to me that stuck—and I’ve found it to be consistently true over the years.

<div

Sales Engineers, Trust, and the Work That Actually Matters

In complex cybersecurity sales, the most effective Sales Engineers are not the ones who push the hardest. They are the ones who understand risk, context,

What makes a cybersecurity sales engineer?

A cybersecurity sales engineer bridges the gap between technical complexity and customer understanding by translating security capabilities into real-world business value. This article outlines the

Big “S” vs Big “E” — How Sales Engineering Really Breaks Down

I once had a more experienced Sales Engineer explain something to me that stuck—and I’ve found it to be consistently true over the years.

Sales Engineers, Trust, and the Work That Actually Matters

In complex cybersecurity sales, the most effective Sales Engineers are not the ones who push the hardest. They are the ones who understand risk, context, and consequence — and help customers navigate decisions they may not fully understand themselves.

What makes a cybersecurity sales engineer?

A cybersecurity sales engineer bridges the gap between technical complexity and customer understanding by translating security capabilities into real-world business value. This article outlines the core competencies required to succeed, including communication, technical depth, and the ability to guide customers through risk-driven decisions.

The Role of a Corporate Evangelist in Cybersecurity

A corporate evangelist champions a company’s security vision, helping customers understand the strategic value behind its products and roadmap. This article explains how trust-building, industry advocacy, and clear communication shape customer confidence and long-term adoption.

The Solutions Architect Journey in Cybersecurity: From Junior to Principal Architect

This article describes the progression from junior engineer to principal architect through increasing technical depth, architectural responsibility, and strategic influence.

Sales Engineer vs. Solutions Architect: What’s the Real Difference in Cybersecurity Pre-Sales?

While both roles blend technical and business skill sets, sales engineers focus on deal execution while solutions architects emphasize long-term design strategy. This article clarifies their responsibilities, overlaps, and where each position adds the most value in the sales cycle.

The Sales Engineer Journey in Cybersecurity: From Junior to Principal Architect

This article frames the sales engineer career path as one defined by growing technical credibility, customer influence, and revenue impact. It explains how senior SEs evolve into trusted advisors capable of guiding enterprise-wide security decisions.

Mastering Cybersecurity Discovery: Best Practices for Selling SIEM and MDR Services to Enterprise Customers

Tony DeGonia
February 10, 2025
Best, Customers, Cybersecurity, Discovery, Enterprise, Mastering, MDR, Practices, Selling, Services, SIEM, SOAR, to, XDR
Cybersecurity

What is WCCP?

This post introduces Web Cache Communication Protocol (WCCP), explaining its purpose in optimizing and redirecting network traffic. It provides a straightforward overview of how the protocol works and why organizations use it in secure network designs.

Leading U.S. Cybersecurity Awareness Company Unknowingly Hires Remote North Korean Hacker

Tony DeGonia
July 25, 2024
Awareness, Company, Cybersecurity, Hacker, Hires, Leading, North Korean
Business

This article recounts a real-world case where a security training firm inadvertently hired a North Korean threat actor through remote contracting. It highlights the importance of rigorous identity verification and supply-chain diligence in the modern workforce.

Ticketmaster confirms hack which could affect 560m

This article summarizes the Ticketmaster breach, detailing how threat actors accessed customer data on a massive scale. It emphasizes the broader implications for enterprise risk management, third-party security, and regulatory exposure.

What makes a cybersecurity sales engineer?

This updated version reinforces the essential attributes of a high-performing cybersecurity sales engineer, including communication, problem-solving, and technical fluency. It further highlights how customer engagement and value-driven storytelling shape successful security outcomes.

DNS: Types of DNS Records, DNS Servers and DNS Query Types

This article provides a comprehensive overview of DNS fundamentals, including record types, server roles, and how queries resolve across the internet. It offers readers a clear technical foundation to better understand DNS operations and troubleshooting.

The Top 6 DNS Attack Vectors per ChatGPT

This post outlines the most common DNS-related attack methods, explaining how each one threatens availability, integrity, or data confidentiality. It also provides guidance on detection and defensive practices for organizations.

The 10 Domains of Cybersecurity

This article breaks down cybersecurity into ten core domains that define a complete security program framework. It serves as a high-level guide for understanding organizational responsibilities and risk management across each area.

How Network Traffic Can Mask A Serious Cyber Threat

This post explains how normal-looking network traffic can hide malicious activity, especially when attackers deliberately mimic expected patterns. It highlights the importance of behavioral analytics and anomaly detection in uncovering hidden threats.

Can Cybersecurity be Automated?

This article examines the capabilities and limitations of automation in modern cybersecurity operations. It explains where automation enhances detection and response and where human judgment remains essential.

5 Common Indicators of a Phishing Attempt

Phishing is one of the most common and effective cybersecurity attack vectors, accounting for roughly a quarter of all ransomware attacks between 2019 and 2021, according to research from Cloudian.

5 questions every higher-ed security leader should ask

Tony DeGonia
December 17, 2020
5, cyber, education, higher, leaders, questions, security
Cybersecurity

This article presents five strategic questions that help higher-education CISOs evaluate their security posture and operational readiness. It emphasizes planning, resource allocation, and the unique risks facing academic environments.

Building A Home Cybersecurity Lab

This guide explains how to build a personal cybersecurity lab for training, testing, and hands-on experimentation. It covers essential tools, recommended setups, and the value of a safe environment for skill development.

Prevent WordPress hacking using this Pen Testing guide

Tony DeGonia
July 22, 2019
Guide, hacking, Prevent, Test, wordpress
Sales Engineering

This article walks through practical penetration testing techniques to identify and resolve vulnerabilities in WordPress sites. It stresses proactive hardening, plugin evaluation, and continuous security monitoring.

Hacking WordPress: Building the Lab

This companion article explains how to set up a controlled environment to practice WordPress exploitation techniques. It guides readers through safe tooling, sandboxing, and preparation for ethical testing.

10 Steps to Creating a Secure IT Environment

Tony DeGonia
March 19, 2019
10, create, environment, IT, Secure, steps, ten
Sales Engineering

This article outlines ten actionable steps to build a secure technology environment across users, systems, and policies. It emphasizes layered defenses, staff training, and continuous security governance.

The Dark Web has a Serious Deduplication Problem

This post describes how poor data hygiene and duplicate content on the dark web reduce the reliability of leaked datasets. It examines what this inconsistency means for threat intelligence accuracy and breach impact analysis.

WannaCry (2017): The Ransomware That Moved Like a Plague

Everything that could blink or beep was suddenly held hostage. WannaCry used EternalBlue, a Windows exploit pulled straight out of the NSA’s toolkit and dropped online by the Shadow Brokers like some chaotic “free sample.”

NotPetya (2017): The Malware That Pretended to Be a Ransom Attack… Then Destroyed Everything

It began in Ukraine — inside a widely used tax accounting software called M.E.Doc. Attackers compromised the update server and delivered a poisoned software patch to businesses across the country.

Lizard Squad’s Christmas Chaos: The DDoS That Took Down Gaming (2014)

Christmas morning, 2014. Kids open new Xbox Ones and PlayStations. Parents are half-awake with coffee. Millions of people try to log in. And nothing works.

Heartbleed: The Bug That Bled the Internet Dry (2014)

In early 2014, security researchers discovered something that felt unreal — a flaw that let attackers silently siphon memory straight out of servers. Not files. Not logs. Memory. Raw, unfiltered thoughts of machines.

The Sony Pictures Hack: The Movie That Started a Cyberwar (2014)

Employees panicked as machines shut down, phones died, and entire servers started erasing themselves. Backup drives were overwritten. Render farms collapsed. Years of unreleased scripts, HR files, payroll, emails — all dragged into digital oblivion.

The Yahoo Mega Breach: 3 Billion Accounts Exposed (2013–2014)

Tony DeGonia
December 23, 2013
3 Billion, Accounts, Breach, Exposed, Mega, Yahoo
Tales From The Hack

Yahoo thought it was just another day in 2013. But deep inside their authentication systems, attackers were already rummaging around like they owned the place.

Target POS Breach (2013): The Christmas Heist Nobody Saw Coming

Snow was falling. Christmas music played in every Target store. Parents were hunting for deals. Kids were begging for toys. Target’s network was buzzing with the electrical joy of capitalism.

RSA Breach (2011): The Day a Spearphish Sank a Giant

RSA wasn’t supposed to be vulnerable. They were the company that made security tokens for militaries, governments, and Fortune 500s. Their job was to guard secrets — not lose them.

Stuxnet: The Virus That Sabotaged a Nuclear Program (2010)

Tony DeGonia
July 4, 2010
2010, Centrifuge, Destroyed, Iranian, Nuclear, Program, Stuxnet
Tales From The Hack

The Iranians believed their centrifuges were secure — isolated from the internet on an air-gapped network. But Stuxnet didn’t need the internet. It needed a USB stick.

The Worm That Crashed the Early Internet (1988 — The Morris Worm)

On a cold November night in 1988, the glow of a lone monitor lit up a quiet lab at Cornell University. Robert Tappan Morris — 23 years old, brilliant, restless, and carrying the curiosity only early hackers possessed — leaned back in his chair as he compiled the final lines of code.

Captain Crunch & The 2600 Hz Whistle: The Toy That Opened the Phone System

Long before ransomware, zero-days, or nation-state APTs, the world’s most powerful communications network could be hacked with a plastic toy whistle from a cereal box.

Technical Resources

Forms & Calculators

Technical Learning

Articles & Reading

Mastering Cybersecurity Discovery: Best Practices for Selling SIEM and MDR Services to Enterprise Customers

Membership Required

Tony DeGonia

Share:

More Posts

Send Us A Message

More Great Reads

Sales Engineer Cloud

Sales Engineer Cloud is in Beta