Michelle McLean spent a decade cutting her teeth as a tech journalist and analyst before moving into her first marketing role. Since then, she’s worked at nine startups, held four CMO seats, seen through an IPO, and witnessed a string of acquisitions. She landed at Avalor five months before the Zscaler acquisition.
I talked with her about how she earns the right to direct technical teams, how she uses AI, and why she thinks most companies use events as a substitute for an actual marketing strategy.
You spent your first decade as a journalist, not a marketer. How did that lead you to Zscaler?
I had such a fortunate start. My first decade was spent as a journalist and analyst, which meant I understood the industry before I ever went into marketing. You get a good understanding of how to put things in context working in those roles. But the bigger thing is you end up in rooms with leaders. I interviewed John Chambers at Cisco early on. I was lucky to have that kind of exposure.
Every new technology I covered made my world and my understanding a little bigger. Then I found I was drawn to the people. I found the leaders of these tech companies super inspiring.
That mix – the network, the ability to digest new information fast, the comfort with big-picture thinking – is what pulled me into the tech startup world. Most opportunities came through people I already knew. But one day I went for a coffee with someone who asked me why I kept doing the same job – product marketing – over and over. They asked why I wasn’t going for a CMO role.
My first opportunity at the CMO role came from someone I’d known for ten years – someone I knew would have my back while I figured out things nobody teaches you in advance, like how to talk to the board. The next three CMO roles came through recruiters – for executive roles, that’s how it tends to go.
My fourth CMO role, and my ninth start up, came with Avalor. It felt like getting the band back together – the team had loads of people I’d worked with before. We realized that our underlying technology, built to make sense of security data, could solve a raft of security problems.
About eight months out of stealth, Zscaler picked us up. I’ve been through a few acquisitions over the years – some big, some not so big – but this was an exciting opportunity. Part of me found it heartbreaking that we wouldn’t get to keep building it ourselves, but it was also just a spectacular opportunity. Zscaler customers are genuine fans – they love the Zscaler way – and we realized how rare it is to get access to that degree and that scale of customer devotion so early in a company’s life.
How has the way cybersecurity buyers evaluate vendors changed in the last five to ten years?
Unlike a lot of other tech, cyber needs to be done well. If you’re a startup, you’re always fighting a gorilla with a big platform play, and the response is always “yes, but you need best of breed.” You can’t have mediocrity in security capabilities.
Historically, being a major platform also comes with downsides. You innovate more slowly, you’re often locked into a closed system, and you end up offering “good enough” instead of the best thing available. I built a lot of my career on exploiting that tension, jumping into new corners of the attack surface – cloud, containers, Kubernetes, APIs – the surfaces that old tools can’t secure well.
What’s different now is how hard the pendulum has swung back toward platforms. It’s hard for a startup to get onto an approved vendor list today, because nobody wants to manage forty-eight different tools anymore. I still believe, however, you shouldn’t have to accept the classic downsides of a platform – slow, mediocre, closed – just because you want fewer vendors.
That’s what our data fabric technology brought into Zscaler when we joined. We came in with a single app built on it. We have five now, all pre-integrated, without the usual delay of stitching a platform together after the fact. It pulls in third-party data too; identity, EDR, whatever else a customer already relies on. It’s never just a Zscaler-only view of the world.
You’ve built a highly recognized brand around Zero Trust. Is that ever an issue when you’re trying to tell a broader story?
We’re so synonymous with Zero Trust after seventeen years in that space that getting customers to see us clearly for AI security, data security, or SecOps is hard.
In some ways, we have to step outside of how Zscaler is usually understood and come back in through a different door before customers will hear those other stories. That’s less of an issue with AI specifically, since the whole industry is screaming “what the f*** do we do about AI,” but everywhere else, it’s a real puzzle.
It shows up inside our own sales organization too, and I don’t think that’s unique to us. It isn’t natural for a rep who’s spent years selling the core Zero Trust platform to suddenly pitch SecOps with the same confidence.
Selling is a confidence game. If a rep doesn’t feel sure of the ground they’re standing on, they won’t bring it up with a customer, because the risk of getting caught out feels too high.
So, we keep the ask simple: connect the new capability to something the rep already understands well. Give them consistent, repeated enablement instead of a one-off training. Don’t put the entire burden of expertise on them. Our specialist sellers carry the technical depth.
All we’re really asking the account team to do is open the door using the relationship they’ve already built, then walk through it together, side by side, instead of carrying the whole conversation alone.
How do you build trust with the engineers, researchers, and product teams?
You have to understand the tech well enough that they respect you for it. Marketing can get a bad name when technical depth is lacking. Especially in cyber, you really need to know what you’re talking about. There’s no shortcut.
I’ve been mistaken for a product manager, and even for an engineer, at more than one company over the years. Partly that’s because I love going deep for its own sake. Mostly it’s because depth is the only way to earn the right to direct their work, instead of just admiring it from a distance. I can’t do their job for them, and I’m honest about that.
I can, however, tell technical people what a genuinely excellent piece of research must contain to be useful for a customer. They already have the technical detail, the ‘what’. What they need help with is the ‘so what’ that comes next, that is, the next 3-4 things a customer should do.
The job is constantly pulling the conversation back to whoever’s going to consume it. It was the reader when I was a journalist, the client when I was an analyst, and the customer now that I’m on the vendor side. Promoting the product is the least interesting thing you can say to anyone, so that’s rarely where I start.
Being helpful, keeping pace with a technical conversation internally even if I can’t be hands-on-keyboard – that is what earns the credibility internally to come in later and help shape how the story is told.
I’ll often go to a researcher and say, gently, “I think you’re saying this, tell me if I’ve got it wrong?”. That lets them see whether their writing is clear, for example, instead of me rewriting it. That’s how you build a partnership, instead of a one-way editing relationship.
Are you using AI to help create content, and how is it useful?
The approach breaks down the moment you treat the AI’s output as the finished product instead of an ingredient. I use it as a thought partner, shaping a rough outline or testing whether an idea holds together.
I also use it to grind through monotonous tasks, like writing eight email variants for a single launch. When I refined the same prompt over and over for that email project, what came back sucked – I could not use it. But buried in there were pithy lines scattered all throughout, and that alone made the exercise worthwhile, even though the emails themselves were incredibly poor.
The other place it earns its keep is finding holes in work I’ve already done. I’ll feed it everything I’ve put together and ask directly what’s missing. Sometimes what comes back is garbage. Sometimes it’s a real catch that improves the content.
Either way, you have to be as hard on it as you’d be on any other source, because it’s very good at making you feel like you did great work even when the suggestion underneath is nothing new. It’s remarkably easy to get flattered by AI, which isn’t useful.
What’s the uncomfortable truth about cybersecurity marketing most vendors won’t say out loud?
People think events are magic. I don’t agree. I know that’s an unpopular thing to say in this industry. Certain kinds of events, in a certain number, are essential for awareness, and you do have to show up. But smaller companies especially tend to over-rely on them.
Salespeople sometimes equate events with marketing, which drives me up the wall, because an event is the least creative, least controlled thing you can possibly do as a marketer.
What I’d push back on hardest is the idea that showing up at an event puts you at the center of an industry conversation. It doesn’t – it’s just one slice, at a point in time. Take our own Zscaler Zenith Live event. We draw close to four thousand people, mostly customers which feels enormous in the room, and it’s easy to think the whole Zscaler universe has turned up. It hasn’t. We have ten thousand customers, and maybe two thousand of them were there.
Getting overly excited about the size and energy of a room, and mistaking that feeling for market coverage, is a mistake I see constantly. I include myself in that group. I’ve fallen for it too. Events also cost a sh*tload relative to what they return. You have to do some of them. But treating them as your marketing strategy is lazy, because it lets you skip the harder work.
What you need is a sustainable pipeline, and that only comes from relentless, content-driven effort, across a broad range of “channels,” over a long stretch of time. It means showing up and being useful long before someone has an active project in front of them, because the odds you’ll catch them at the exact right moment they need your offering are very low. You’re buying space in someone’s brain. You have to earn that space well in advance, not in the thirty seconds you get with them at a booth.
Michelle McLean is Senior Director of Marketing at Zscaler. She previously held marketing leadership roles at Avalor Security, Salt Security, StackRox and ScaleArc.
About Bora
We’re Bora. We work with security companies to turn complex technical capabilities into clear, credible market narratives.
Get in touch for a free 30 minute consultation. If we’re not the right fit, we’ll help find someone who is.
