6 min read · Written by Grant Rayner on 01 Mar 2023
Share by emailIt’s relatively common for independent security professionals to fall into the trap of thinking they need to give the impression of being a large company. Perhaps they believe by doing so they will appear more credible to potential clients; clients they would otherwise not be able to attain as a single-person operation.
In trying to appear big, they will adopt a ‘corporate persona’. They may add a broad list of services to their website. They may even list offices in different countries. Of course, in doing so, they run the risk of misleading potential clients.
Trying to appear ‘big’ is a major mistake that will not only be an unnecessary distraction but will also increase competitive pressure.
In the following sections, I’ll provide some recommendations that will help you avoid some of the problems that come with over inflating the grandeur of your business. I’ll also share some ideas on how you can leverage the many strengths of being ‘small’.
As noted above, some independent security professionals will think they need to adopt a more corporate persona to be taken seriously by their clients.
Adopting a corporate persona is an entirely unproductive exercise. Doing so will place you in direct competition with your most serious competitors. It will also neutralise one of your biggest advantages: the ability to be personable with your clients.
As I continue this series of articles, I’ll be spending a lot of time talking about the importance of authenticity. At the end of the day, your clients won’t be buying services from your company. They’ll be buying services from you. They’ll buy from you not just because they believe you are sufficiently competent to deliver the work. They’ll do so because they like you. This type of client relationship is very sticky and establishing such relationships should be one of your primary objectives.
In short, don’t hide behind a made-up corporate persona.
It’s easy to add a laundry list of services to your website. You may think that this is an effective catch all. Surely someone visiting your site will be interested in at least one of the services you’ve listed?
The reality is that you’d be doing yourself a major disservice if you took this approach.
First, you’re over promising. No one can do everything. Nor do you want to do everything.
Second, you’re being potentially dishonest. More experienced clients will see through this and may not trust you.
Third, you’re unnecessarily increasing competitive pressure. Pretending to be a larger company puts you into the same competitive space as the large security consulting firms, who actually have the manpower resources necessary to deliver a broad range of services. By placing yourself into the same space as your most serious competitors, you’re only making life harder.
The better approach is to stay focused and stick to your specialities.
Social proof is critically important, particularly when your business is new. Clients will want to know you have a strong track record. For this reason, it makes sense to include a short list of clients on your website. There’s no need to list all your clients. Just four or five of the more recognisable brands should suffice. Be aware that some clients may not want their names to be listed on your website. Typically this isn’t personal, it’s just corporate policy.
It should go without saying that you should not list a client organisation where you haven’t actually worked with that organisation. Similarly, don’t list organisations that you may have worked with while at a previous company. These rules apply to your website and to proposals.
You can, however, privately share with potential clients that you have worked with specific organisations in the past, even if you did that work while at another company. This experience has value in the context of proposing a specific service and should be highlighted.
In the same vein as misrepresenting client experience, don’t include offices in locations where you don’t actually have an office. I’m not sure why people adopt this practice, but it’s obviously misleading. Even more so when you’re a single person company.
Instead, be clear on where you’re based and where you’re able to deliver services. As with services, it’s good to specialise in one or a few countries. That specialisation has value to prospective clients.
You should list the countries where you’ve worked on your website. Doing so demonstrates the breadth of your international experience. You can also list these countries in your proposals, where relevant to the client requirement.
There are no ethical concerns with listing all the locations you’ve delivered services, including locations where you’ve delivered services while you’ve been working at other companies. These are your experiences, and you carry them with you.
Your geographic experience is meaningful as an independent security professional, because there’s a big difference between where a large company has delivered services and where each of the consultants in that company has delivered services. For you, it’s one and the same. The countries you list will be the countries where you actually have project experience.
When it comes to your website and other company material, it’s okay to use the terms ‘we’ and ‘our team’, so long as the intent is not to deliberately mislead potential clients about the size of your company.
On my website, I use ‘we’ and refer to ‘our team’ when referring to activities the company is doing. When I refer to things I’m personally doing, I use ‘I’. The reason I take this approach is because the company is an entity and I’m an individual. Here’s a few simple examples: My company offers training services, I deliver the training. I’ve written a number of books, my company sells those books.
In summary of the points above, you need to be careful not to misrepresent your company. If you do so, you’ll be moving into unethical territory. Once potential clients understand you’ve misled them, they may be less willing to buy your products or services.
The good news is that you don’t need to take this approach. You certainly should have a professional presence (I’ll explain how you can do in the next article). But when it comes to showcasing your products and services, it’s better to appear focused and specialised. Emphasise your experience in your chosen field. That’s the reason organisations will choose to hire you.
Being big does not automatically equate to being professional. Quite a number of large security firms are surprisingly disorganised and inefficient. Your professionalism is defined by the quality of your products or services and your ability to deliver on your commitments. Let your products and services speak for the capabilities of you and your (small) company.
You should never be afraid of being small. In fact, I’d suggest that the pros of being small significantly outweigh the cons.
Let’s look at some of the benefits of being small.
It’s normal to feel as though you’re somehow at a disadvantage as a small company. You actually are at a disadvantage in some regards but, if you play to your strengths, you can still be successful.
The key is to understand that, as a small organisation, you can do things that big companies can’t do. As a result, you can be more competitive.
The following points highlight the comparative advantages of operating a small company as an independent security professional:
Of course, these advantages are all theoretical. Capturing the benefits of being small will require deliberate action on your part. For example, to be ready to move quickly on new opportunities and initiatives, you need to be able to learn of these opportunities in advance. You then need to have the necessary tools available to be able to leverage that opportunity. Otherwise, the opportunity will just pass you by. Larger companies will probably spot opportunities before you do, simply because they have more people looking.
In the next article, I’ll share exactly what it takes to establish a professional presence. As you’ll learn, it takes less than what you might think.