Customer discovery questions (or, better alternatives to “What keeps you up at night?”)

Whether you’re a founder, in sales, an account manager, or in almost any other customer-facing role, the most valuable thing you can do is ask your customers questions, and learn what their goals, incentives, and measures look like.

This is a short list of questions I’ve found lead to substantive discussion (these are geared toward cybersecurity teams, but most are broadly applicable):

Q: How is your team measured?

What I’m listening for:

• Objectives, ideally those that roll up and support the broader organization
• Cybersecurity maturity models or frameworks (NIST CSF, CMMC, C2M2, etc.)
• Compliance audits or certifications (SOC 2, ISO 27001, FedRAMP, etc.)
• Risk measures, commonly specific to realized risks (exposure or vulnerability management, third-party risk, etc.)
• Incident measures related to detection, investigation, containment, and response
• Other basic operational measures, like tickets or cases

Q: Where do your incidents come from?

This is a simple question, but sometimes it lands. If it’s helpful to follow with some elaboration, consider:

• Q: What controls are most useful in helping you identify higher severity incidents?
• Q: What data or tools do you find most useful for investigation? Response?

These can lead to useful insights related to control effectiveness, operational maturity, and incident management. A good organization can tell you how many incidents they have; a great team can speak to trends related to root cause, severity, cost, mean time to detect/respond, and more. Teams that are exceptional at incident management will use incidents as a key lever for driving continuous improvement and change.

Q: What does your roadmap look like for the coming months or year?

Here I’m listening for initiatives that:

• Align with what we do today, where we can satisfy the requirement or meaningfully accelerate progress
• Are on our roadmap, as this helps with prioritization, and reinforces that we have some shared vision
• Include tooling consolidation or platform migrations, which can indicate a natural entry point, or a risk if the consolidation cuts you out
• Aren’t on our radar at all, particularly those that factor into competitive losses

Q: If you could add a single skillset to your team today, what would it be? If you could add an entire team, what would you have them do?

What do they know they want? Usually, they’ll frame it around a specific, acute problem they can’t solve or solution they can’t build in-house.

Note: There’s a subtle but important difference between this type of question and “What causes you to lose sleep?” When asked about fears, a mature team will probably name a specific threat or risk. You can then explain how your product addresses it and hope they connect the dots — but unless that fear is your primary point of value, you’ve gone down a rabbit hole and likely missed the broader product story.