Cybersecurity Reps Were Never Taught Discovery. Neither Were the People Managing Them.
A question I have been putting to people in cybersecurity sales, about half of them running teams, is whether cyber AEs have ever had to develop real discovery skill, or whether a decade of expanding budgets meant they never needed to. The answers came back faster and longer than I expected, and the useful part was not the agreement. It was where the agreement pointed.
The people who had spent time at established companies landed in close to the same place. Reps were never taught discovery. And in more than one case, the leadership above them could not have taught it either.
That second half is the part worth taking apart, because it changes what kind of problem this is. This piece covers why a training gap and a structural gap need different responses, what discovery quietly turned into, why the same decay shows up in deal management and technical scoping, how the teaching layer failed to form in the first place, and what rebuilding it actually asks of a sales organization.
A Training Gap and a Structural Gap Are Not the Same Problem
A junior AE who never learned discovery has a training gap. That is an ordinary problem with an ordinary solution. You put them next to someone who is good at it, you listen to their calls, you tell them what they missed and why it mattered, and in two or three quarters they are meaningfully better. Every functioning sales organization has run this play.
A sales organization where nobody above the rep can define what good discovery looks like has a different problem, and it does not resolve itself with a new methodology presentation. The methodology is not the missing piece. The missing piece is the person who can watch a call and say precisely where it went wrong, which is a skill that has to exist somewhere in the building before any framework can be taught from it. Buy the framework without that person and you have bought vocabulary. The reps will learn to name the stages of a deal they still cannot influence.
The distinction matters because the two problems produce identical symptoms on a dashboard. Win rates sag, cycles stretch, forecasts miss. A training gap and a structural gap look the same from the outcome side, and most organizations only look at the outcome side. I wrote about that measurement habit in why almost nobody measures what causes their number, and it is the reason this particular failure can run for years without being correctly named.
Discovery Quietly Became a Question List
What came through in the answers is that discovery has been redefined downward into a set of questions you get through. Discovery is finding the problem the buyer actually has and being useful about it. Those are not the same activity, and the first one can be performed convincingly without the second one happening at all.
One person described watching reps work down their questions and never get near what was actually driving the deal. Another described a vendor who wanted a meeting so badly they paid for the buyer's lunch to get one, after that buyer had already told them it was not a fit. A meetings quota got met. No discovery happened, and nobody involved would have described what they were doing as skipping discovery. On paper it was a qualified conversation.
This is the failure mode John McMahon spends most of The Qualified Sales Leader on, and I broke down what cybersecurity AEs should take from it separately. The short version is that questions are the instrument, not the objective. The objective is leaving the call knowing what the problem costs, who feels the cost, and what happens on a specific date if nothing changes. A rep who cannot answer those three things ran an interview, not a discovery call.
It Is Not Only Discovery
Discovery gets named first because it is the most visible. It happens early, it happens on a call somebody else can listen to, and its absence is obvious in hindsight. But it is not the only thing missing.
Deal management is in the same condition. Knowing where a deal actually sits, who still has not signed off, what has to happen after the champion says yes. When budget was abundant, deals closed on enthusiasm and nobody had to manage them, so reps learned to forecast on how the call felt. That habit survives the conditions that created it. Dixon and McKenna's analysis of more than 2.5 million recorded sales conversations found between 40 and 60 percent of forecasted B2B deals end in no decision rather than going to a competitor, with 56 percent of those losses driven by the buyer's own indecision. Catching that before it happens is deal management. It is not a reporting problem and a dashboard will not surface it, because on the dashboard the deal looks fine right up until it does not close.
This is also why buying MEDDPICC does not fix it. The framework is sound and widely adopted, and most cybersecurity teams still cannot point to a deal where it changed the outcome. I went through how each element breaks differently in cyber elsewhere. A rep who fills in the fields without knowing what a real answer looks like has produced documentation, not qualification.
Technical scoping is the same story, and in cybersecurity it costs more than it does almost anywhere else. The buyer's environment is heterogeneous, the integration surface is large, and the gap between what the product does in a demo and what it does in their stack is where deals quietly die during the security review. A rep who cannot scope accurately either overpromises and loses the account later, or underpromises and loses the deal now.
All of it is one skill showing up at different points in the deal, which is finding out what is actually true and then acting on it. Discovery is that at the beginning. Deal management is that in the middle. Scoping is that at the technical layer. They decay together because they were never separate.
Why the Teaching Layer Never Formed
Sales organizations promote the people who hit number, which is reasonable and mostly works. It stops working when the reason someone hit number is not transferable, and in cybersecurity through the last decade a great deal of it was not. A rep who cleaned up in an uncontested category with an expanding budget learned something real about that situation and very little about creating urgency where none exists. Several people told me the gap only surfaced when they moved into a crowded market and found the same approach stopped working.
Promote that rep and you get a manager who knows their own deals were good but cannot decompose why, which is the problem I described in your best rep's brain doesn't scale. The knowledge is real and it is trapped. One layer of that is survivable. Two layers of it and the organization has genuinely lost the ability to teach the thing, because everyone who could have has either left or was never able to articulate it.
The market covered for this the entire time. I made the fuller version of that case in the decade when the market ran discovery for cybersecurity AEs, and the two arguments fit together. The market doing the work is why the skill was not needed. The missing teaching layer is why it cannot simply be picked up now that it is.
In fairness, not everyone I asked agreed with the framing, and the disagreement was sharper than the agreement. The pushback was that discovery is not what decides deals anyway. Data moats decide them. Channel relationships and incumbency decide them. Qualification decides them, or product-market fit does. That argument has real merit and it is worth stating at full strength rather than knocking down a weak version of it. But it runs into itself. If differentiation between products is narrowing, and what carries the weight is expertise, relationships, and knowing which problem is actually worth solving, then the person in the room became the variable. That is a discovery argument wearing different clothes.
The Conditions That Hid It Are Going Away
A decade of expanding security budgets hid all of it. When categories were uncontested and money was moving, you could take orders and call it selling, and the results were good enough that nobody had reason to look closely.
That is changing on both sides of the deal. Futurum's 1H 2026 survey of 929 global enterprise cybersecurity buyers found consolidation intent rose to 42.0 percent while expansion intent fell to 35.8 percent, the first period in that series where consolidation clearly outpaced expansion, and the share of organizations expecting a budget increase over the next twelve months fell to 67.2 percent from 73.2 percent six months earlier. On the seller's side, RepVue's Cloud Sales Index closed 2025 with cybersecurity at 37.9 percent quota attainment, last among every sub-vertical it tracks and well below the 43.83 percent the overall index posted that quarter.
Neither number is a verdict on the reps. Both are what it looks like when a category stops supplying the part of the job that used to arrive for free.
What Rebuilding It Actually Takes
Start by finding out whether you have a training gap or a structural one, because the answer determines everything after it. Sit with three recorded calls from three different reps and try to write down, for each, what the buyer's problem costs and what happens if they do nothing. If you cannot do it from the recording, the reps did not get it. If you also cannot say what they should have asked instead, the gap is above the rep and hiring more reps will not touch it.
Then be honest about whether anyone in the building can teach it. Not who has the title, and not who hit number in a market that no longer exists. Who can listen to a call and name the specific moment it went wrong, and say what the better move was. If that person exists, their job just changed and their calendar should reflect it. If they do not exist, you are hiring for it or buying it, and it is worth saying that plainly rather than routing the budget to another platform and hoping.
And change what gets inspected. A pipeline review that asks about stage and close date will get answers about stage and close date. A review that asks what this problem costs the buyer, who else has to agree, and what happens on a date certain if nothing changes will surface the gap immediately, and reps will start finding those answers on the call because they know the question is coming.
Budgets are tighter now and the categories are crowded. The skill nobody taught them is the one the job now requires.