business-strategy

# Business Strategy Skill ## Purpose Guides strategic business development, market positioning, and revenue optimization for cybersecurity consulting services, with emphasis on consultative selling, transparency, and practical security expertise. ## Rules ### Market Positioning (MUST) **MUST:** - Position Hack23 as transparent security experts (not FUD-based vendors) - Emphasize 30+ years of hands-on experience - Highlight public ISMS as unique competitive advantage - Showcase open-source contributions as proof of expertise - Focus on developer-friendly DevSecOps approach **MUST NOT:** - Use fear, uncertainty, doubt (FUD) tactics - Make unsubstantiated security claims - Oversell or over-promise capabilities - Compete on price alone without value differentiation ### Consultative Selling Approach **MUST:** ```markdown 1. Discovery Phase - Understand client's business objectives - Identify security pain points and gaps - Map security needs to business outcomes - Assess current security maturity 2. Solution Design - Align security controls with business goals - Reference ISMS policies for credibility - Provide practical, implementable recommendations - Estimate realistic timelines and costs 3. Value Communication - Quantify risk reduction in business terms - Show ROI of security investments - Reference similar client successes (case studies) - Demonstrate expertise through technical depth 4. Partnership Approach - Position as security partner, not vendor - Offer ongoing support and guidance - Share knowledge through documentation - Build long-term relationships ``` ### Target Markets & Personas **Primary Markets:** - Swedish organizations (GDPR, NIS2, ISO 27001 focus) - Mid-market companies (50-500 employees) - Tech startups needing security foundations - Regulated industries (finance, healthcare, government) **Key Decision Makers:** - **CTO/CIO**: Technical depth, architecture alignment - **CISO**: Compliance frameworks, risk management - **CEO/CFO**: Business outcomes, ROI, efficiency - **Engineering Leaders**: DevSecOps integration, tooling ### Service Portfolio **Core Services:** ```markdown 1. ISMS Implementation - ISO 27001:2022 compliance - Gap analysis and remediation - Policy development and documentation - Internal audit preparation 2. Security Architecture Review - Threat modeling and risk assessment - Defense-in-depth design - Cloud security (AWS focus) - Application security review 3. DevSecOps Integration - CI/CD security automation - Infrastructure as Code security - Container security - Security testing integration 4. Compliance Support - GDPR compliance assessment - NIS2 readiness evaluation - CIS Controls implementation - NIST CSF alignment 5. Security Training - Secure development practices - Security awareness programs - Hands-on technical workshops - Executive security briefings ``` ### Partnership Strategy **Technology Partners:** - **AWS**: Cloud infrastructure expertise - **GitHub**: DevSecOps platform integration - **Security Tool Vendors**: SAST, DAST, SCA tools **Channel Partners:** - Management consulting firms (security add-on services) - IT service providers (security capabilities) - System integrators (security architecture) **Referral Network:** - Legal firms (GDPR compliance clients) - Accounting firms (audit preparation clients) - Business consultants (growth-stage startups) ### Sales Enablement Materials **MUST MAINTAIN:** ```markdown 1. Case Studies - Client industry and size - Initial challenge/pain point - Solution implemented - Measurable outcomes - Client testimonial 2. Service Descriptions - Clear scope and deliverables - Typical engagement duration - Prerequisites and dependencies - Pricing guidance (ranges) 3. Technical Assets - Architecture diagrams - Security assessment templates - Sample ISMS policies - Threat model examples 4. Competitive Positioning - Differentiation matrix - Unique value propositions - Competitor comparison (fair, factual) 5. ROI Calculators - Risk reduction quantification - Compliance cost avoidance - Efficiency gains - Incident prevention savings ``` ### Revenue Model **Service Pricing:** - **Hourly Consulting**: Premium rate for expertise - **Fixed-Price Projects**: Defined scope and deliverables - **Retainer Agreements**: Ongoing support and advisory - **Training Programs**: Per-participant or per-session **Value-Based Pricing:** - Align pricing with business value delivered - Consider client budget and industry norms - Offer tiered service packages - Provide flexible engagement models ### Metrics & KPIs **MUST TRACK:** ```markdown Pipeline Metrics: - Lead generation sources - Conversion rates by stage - Average deal size - Sales cycle length - Win/loss analysis Revenue Metrics: - Monthly Recurring Revenue (MRR) - Annual Contract Value (ACV) - Revenue growth rate - Customer acquisition cost (CAC) - Customer lifetime value (CLV) Client Success Metrics: - Client retention rate - Net Promoter Score (NPS) - Upsell/cross-sell rates - Reference/referral rates - Project completion rate ``` ### Compliance-Driven Selling **Key Compliance Drivers:** ```markdown 1. ISO 27001 - Required for enterprise buyers - Public sector procurement - Partner requirements 2. GDPR - EU market entry requirement - Data privacy compliance - Breach notification obligations 3. NIS2 - Critical infrastructure sectors - Supply chain security - Incident reporting requirements 4. Industry-Specific - PCI DSS (payment processing) - HIPAA (healthcare) - SOC 2 (SaaS providers) ``` ### Thought Leadership **MUST:** - Publish technical blog posts on security topics - Share ISMS policies and documentation openly - Contribute to open-source security projects - Speak at security conferences and meetups - Participate in industry working groups **Content Topics:** - DevSecOps best practices - Compliance automation - Practical threat modeling - Security architecture patterns - ISMS implementation lessons learned ## Examples ### Elevator Pitch Template ``` Hack23 helps [TARGET COMPANIES] achieve [BUSINESS OUTCOME] by [SECURITY SOLUTION] using our transparent, practical approach to cybersecurity, backed by 30+ years of experience and a public ISMS that proves our commitment to security excellence. Example: "Hack23 helps Swedish tech companies achieve compliance and build security trust by implementing practical ISO 27001 ISMS frameworks using our transparent, open-source approach, backed by 30+ years of hands-on security experience." ``` ### Value Proposition by Persona **For CTOs:** "Integrate security seamlessly into your development pipeline with DevSecOps patterns that don't slow down innovation." **For CISOs:** "Achieve compliance faster with proven ISMS frameworks, threat models, and security architectures you can reference and customize." **For CEOs:** "Reduce business risk and build customer trust with transparent security practices that differentiate you in the market." ### Case Study Template ```markdown ## [Client Industry] Security Transformation **Client**: [Size, Industry, Location] **Challenge**: [Specific pain point or requirement] **Solution**: [Services delivered] **Outcomes**: - [Measurable result 1] - [Measurable result 2] - [Business impact] "[Client quote about experience and value]" ``` ## Related Policies - [Hack23 ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC) - Security framework - [ISO 27001 SKILL](../../compliance/iso-27001/SKILL.md) - Compliance framework - [Security Architecture SKILL](../../architecture/security-architecture/SKILL.md) - Technical depth ## Related Documentation - [business-development-specialist Agent](../../../agents/business-development-specialist.md) - [marketing-specialist Agent](../../../agents/marketing-specialist.md) ## Tools - **CRM**: Track leads, opportunities, and client interactions - **LinkedIn Sales Navigator**: Prospect identification - **PandaDoc/DocuSign**: Proposal and contract management - **HubSpot/Salesforce**: Marketing automation and pipeline management