"They're just not seeing the value we have to offer!"

This is a common sentiment among cybersecurity founders. And it’s easy to understand why.

It’s frustrating to watch prospects line up to buy clearly inferior (and more expensive) products from larger vendors. Yet they do it over and over while ignoring smaller vendors.

And in the case of truly new products with no direct competitors? It’s even more frustrating. Frequently, exciting startups are ignored altogether by their intended market, despite their ability to address clear and present pain points.

Surely, if prospective customers truly understood the value your company had to offer, they would gladly pay for it… right?

What is value in B2B cybersecurity?

Generally, if your prospects aren’t buying from you — or they aren’t buying your solution category at all — there’s something deeper afoot than not recognizing the value you have to offer.

Why do B2B buyers consistently buy suboptimal products and services from big vendors when there are readily available and more valuable alternatives?

Is it an issue with the way buyers perceive value? For that matter, what is value?

Here’s a simplistic (and incorrect) model of how buyers perceive the value of B2B solutions:

So, let’s say a solution will make (or save) an organization $100k per year and it costs $20k per year. That’s a solid $80k per year of value.

If this were really how organizations behaved, buying processes would be simple.

Trouble is, this model fails catastrophically to explain what happens in the real world.

Even if we consider that Cost is much more than sticker price (it has to factor in implementation, training, loss of productivity, opportunity cost, etc.) reality simply does not support this model of B2B buyer behavior.

Specifically, it doesn’t account for two things:

1. Why so many (>40%) of B2B purchasing processes end in no decision.

2. Why large vendors win most deals even when their solution is inferior.

If the issue was purely that buyers don’t perceive value in a solution category, there would be no purchasing process. Either buyers would perceive the value and make a positive purchasing decision (regardless of which solution wins) OR they would not perceive the value and there would be no purchasing process. Organizations don’t commit time and resources to a purchasing process unless they are pretty darn sure there’s value to be had.

And if solutions were evaluated purely on Benefit - Cost, the best value solution would always win.

But this is not what happens. Buyers consistently begin purchasing processes that end in no decision. They also consistently buy suboptimal solutions even when they know they’re suboptimal.

So… what gives?

To understand how B2B buyers really decide, we need to consider two additional factors:

1. The real most important factor in B2B buying decisions (it isn’t value)

2. How buyers perceive risk

Let’s get into it.

What do B2B buyers optimize for?

I'm not certain of the origin of this idea. I've seen it stated by Rory Sutherland, Dale W. Harrison, and several others. Regardless, it holds true.

B2C buyers want a solution that is “good enough” for their purposes, not necessarily the one that’s objectively best. This is an energy saving response, as finding the best possible product or service is generally not worth the effort. Herbert A. Simon coined the term satisficing to describe this approach in a 1956 article for Psychological Review.

In the quest for such a product, consumers will generally prefer a “safe and decent” option to one that is potentially much better but may disappoint.

As a consumer, if I decide to take up running, what are the chances I'll opt for Nike running shoes vs. a brand I've never heard of? Pretty high, right? They might not be the best, but they are unlikely to be terrible. This is optimizing to avoid regret.

Anecdotally, I am a perfect example of a consumer who optimizes to avoid regret. If I buy something and it works okay, I'll probably buy it for the rest of time or until the product is discontinued. I choose the same food items from the same places over and over because, in most cases, I’d rather be safe than sorry.

B2B buyers, meanwhile, are primarily concerned with avoiding blame. Given the choice between an "OK" solution that will be easily accepted by colleagues and a potentially "great" solution that may attract criticism, which do they choose? Overwhelmingly, the answer is the safe option.

We talked about this in my last article. If their career is on the line, most people will choose a safe-but-suboptimal solution over a risky-but-potentially-outstanding solution.

This is a big part of why so many B2B buyers choose the largest vendor... even when their product is terrible. You've probably used Microsoft Teams, or SalesForce, or SAP, and thought: "why does anyone buy this crap?!" The answer is that if you buy from a big vendor and the solution is poor, the vendor gets blamed. If you buy from a small vendor and the solution is poor... you get blamed.

"Nobody ever got fired for buying IBM", after all.

It's not because big vendor solutions are universally great. It's because they are very unlikely to blow up in your face… and even if they do, it won’t be your fault. There is quite literally safety in numbers.

As a smaller vendor, these patterns are unpleasant to accept. But accept them you must.

Risk and the stages of innovation adoption

In short, risk is a key factor in all purchasing decisions. More accurately, perceived risk.

We can see this play out rather easily by looking at macro trends.

In Diffusion of Innovations — first published in 1962 — Everett Rogers provided a chart of how new innovations are adopted by different categories of buyers.

You know the one. It looks like this:

A slightly amended version of this chart (and concept) was popularized by Geoffrey A. Moore's Crossing the Chasm... but as is usually the case, it's well worth reading the original source material, even though it's based on adoption of innovations in agriculture.

Here are a few choice quotes from the book that highlight what we need to understand:

"Innovations perceived as most economically rewarding and least risky were adopted more rapidly."

"[...] the respondents in most of these studies are U.S. commercial farmers, and their motivation for adoption of these innovations is centered on economic aspects of relative advantage"

"The salient value of the innovator is venturesomeness. He or she desires the hazardous, the rash, the daring, and the risky. The innovator must also be willing to accept an occasional setback when one of the new ideas he or she adopts proves unsuccessful, as inevitably happens."

Nothing too surprising here, right?

Customers like low risk, high reward solutions, and their willingness to buy innovative products is heavily dependent on their risk tolerance.

Add this to our basic value calculation, and we have three variables that predict willingness to buy: benefit, cost, and risk. In reality, benefit and risk are both perceived more than they are calculated, while cost is generally estimated.

Innovators and Early Adopters have higher risk tolerance, while Laggards have extremely low risk tolerance. But in all cases, buyers are "running the mental maths" to determine whether the potential pay-off of a purchase outweighs the risk. It's just that their calculations are weighted differently depending on their risk tolerance… and their level of optimism.

(Rogers doesn’t use the word optimism. He describes earlier adopters as "less fatalistic" than later adopters — they perceive a greater ability to control their future.)

Notably, this research is concerned with adoption of innovation categories (for want of a better word) rather than specific products. When new buyers enter the market for an innovation, they will still seek to minimize their risk when selecting a product.

How do buyers assess risk in cybersecurity?

So, risk is an important factor for B2B buyers, and that includes cybersecurity. How do we determine how risky a buyer might consider us to be?

The first step is to understand the different types of risk a buyer perceives. Jacob Jacoby and Leon B. Kaplan laid out five risk factors in The Components of Perceived Risk (1970/1972):

1. Financial — risk of losing money due to a failed implementation or unexpectedly high implementation or maintenance costs.

2. Performance — risk the solution will not work at all, or in line with expectations.

3. Physical — risk the solution will be unsafe, cause harm, etc.

4. Psychological — risk the solution will not "fit in well with your self-image".

5. Social — risk the solution will affect the way others think of you.

The authors also note an additional factor presented in Consumer Rankings of Risk Reduction Methods by T. Roselius (1971):

6. Time loss — risk of wasted time and effort due to a failed implementation, or one that requires unanticipated adjustments, repairs, or replacements.

While these factors are derived from studies of consumer markets, it's easy to see how these risk factors carry over to B2B buying scenarios.

Social risk translates closely to professional risk ("risk of blame”) in a B2B environment. For example, buyers may suffer a loss of political capital due to a failed implementation, and potentially career-harming consequences.

Physical risk may align with "security risk" (however you want to think about that). For example, the solution could literally create risk (e.g., because it includes vulnerabilities) or it could fail to provide the stated protective benefits, providing a false sense of security.

Security satisficing and blame avoidance

If we zoom out, we may uncover another consideration. Arguably, many organizations are not optimizing for "the best possible security program", but rather for "the security program nobody can blame them for if they get breached".

What is the value of a "better" security solution if it's less well recognized by the industry at large? An organization may in reality be "more secure" but that's not much consolation if the decisions that led there are harder to justify.

Jacoby and Kaplan offer a mathematical equation to calculate overall risk based on the factors above. If you're interested, you can find it in their paper. From a practical standpoint, I believe it’s more important to understand the risk factors and how they relate to your solution than it is to reach a definite figure.

While buyer risk is a real number, it's unlikely you'll be able to calculate it accurately, not least because it's unique to individual buyers. Again, different buyers have different risk tolerances, and may also be more or less sensitive to the various risk factors.

Still, understanding the components of buyer risk gives you a chance to de-risk your solution, which will positively affect your risk-adjusted value.

It’s not about value… it’s about risk-adjusted value

When you understand that B2B buyers optimize to avoid blame, it becomes obvious why so many B2B purchasing processes end in no decision. In many cases, the decision to “do nothing” simply has a higher risk-adjusted value than any available purchase.

It’s calculated like this:

Beyond the basic Benefit minus Cost calculation, we're factoring in the six risk factors described above… with the added challenge that we need to consider both risk to the buying organization and personal risk assumed by the individual(s) involved in the buying process.

When we consider this, it becomes easy to understand why so many buying processes end in no decision. It goes something like this:

1. Prospect perceives sufficient “raw” (i.e., non-risk-adjusted) value in a solution category.

2. Prospect appoints a buying group.

3. Buying group identifies potential solutions.

4. Buying group determines risk-adjusted value for solutions and the status quo.

5. Buying group makes a decision… often to do nothing.

Once raw value is perceived by a buyer, the purchasing process determines whether the risk-adjusted value is sufficient, i.e., whether the raw value weighs favourably against the various risks (personal and corporate) associated with making a purchase.

Risk-adjusted value is “felt” more than calculated

Generally, buyers don’t use mathematical equations to arrive at hard numbers for risk-adjusted value. Even in B2B, where purchasing is allegedly fact-based, emotion plays a huge role in the decision-making process. This is actually a good thing from our perspective, because it allows us to improve the risk-adjusted value of our solutions using both rational and emotional levers.

Of course, there is usually some risk associated with the status quo. If there wasn’t, there most likely would never have been a purchasing process — the status quo is simply not painful enough to justify doing something about it. But even if the status quo is painful, the risk-adjusted value of many solutions is simply not enough to justify purchase… even if nobody is happy with the way things are.

Finally, when B2B buyers do buy, they don’t choose the solution with the greatest perceived benefit. They choose the solution with the highest risk-adjusted value.

This is why so many organizations repeatedly buy from market leaders despite knowing their solutions are suboptimal. It’s less risky, particularly for the people involved in the purchasing decision… so even if the product is worse and more expensive than the alternatives, the final risk adjusted value is higher.

Three levers to improve risk-adjusted value

Simplistically, risk-adjusted value has three components: Perceived Benefit, Total Cost, and Perceived Risk.

That means you have three levers you can pull to improve your solution’s risk-adjusted value:

1. Increase the perceived benefit of adopting your solution.

2. Reduce the total cost of implementing and maintaining your solution.

3. Reduce the perceived risk of your solution (and your company).

Naturally, there are better and worse ways to do each of these.

Increasing the perceived benefit of your solution doesn’t necessarily require a large investment in R&D. In fact, many vendors have invested hugely in product development, only to discover customers simply didn’t perceive the extra “value” on offer.

Meanwhile, we don’t really want to influence the risk-adjusted value of our solutions by reducing the price, because we have margins to worry about. But we may be able to reduce the total cost to the buyer in other ways, e.g., by removing pain and cost from the implementation process.

And de-risking? There are a bunch of ways to do this, and I’ll cover some of them in another article. For now, simply understanding buyer behaviour and asking these types of questions is a good way to move forward.

For a little teaser, consider this: There is clear interplay between the risk reduction value of brand power and its price elasticity benefits. These are two sides of the same coin. If you're less risky to work with, you can be more expensive and still have a higher risk-adjusted value.

Food for thought.

Nearly 4,000 words in, I realised it would need to be a series.

This article takes a simple truth — that most of your potential buyers aren’t in-market right now — and explains the implications for business growth and effective marketing.

In future articles, I’ll cover more exciting topics. But as Dale W Harrison points out:

With that, let’s get to it.

The 95:5 rule: Most buyers aren’t in-market

The 95:5 rule states that during any given period, only a small fraction of buyers in your market (usually ~5%) are in-market to buy whatever you sell. The rest (~95%) are not.

The precise ratio can be calculated if you know two things:

1. The inter-purchase period. How frequently the average buyer is willing to enter the process of making a purchasing decision.

2. The decision period. How long the average buyer takes to decide.

The inter-purchase period is not the same as a typical contract length. Many buyers prefer to continue using a somewhat sub-optimal solution rather than engaging in a costly, time-consuming, and politically charged purchasing process.

Similarly, the decision period is not necessarily the same as your sales cycle, since some of the decision work will generally happen before you’re aware an opportunity exists.

Also, note that decision periods don’t always end in a new purchase. Research suggests that >40% of purchasing processes end in no decision. I suspect that buyers with an existing solution in place — as opposed to new entrants to a market — are disproportionately represented in these non-decisions, but that’s based on anecdotal evidence only.

Moving on.

If you know the inter-purchase period and decision period for your market, you can calculate the ratio very easily using this formula:

For example, if the inter-purchase period is five years (60 months) and the decision period is one quarter (3 months), you get:

(3 ÷ 60) × 100 = 5%

Here, the ratio plays out perfectly: 5% of buyers are in-market this quarter, while 95% are not.

You may be thinking: “Well, you just chose those numbers to make the formula work,” … but they are the real average figures for B2B SaaS. They also play out pretty accurately for many cybersecurity tool vendors, and I can personally attest to that.

Naturally, the precise ratio varies depending on what you’re selling. If you sell security testing services, both the inter-purchase and decision periods could well be shorter. If you sell hardware, I’d expect the inter-purchase period to be longer, but I can’t verify that from personal experience.

If you don’t know the inter-purchase and decision periods for your market, the data is often available from analysts, or you can estimate using your own historical data and customer knowledge.

The 95:5 rule is the brainchild of John Dawes of the Ehrenberg-Bass Institute. You can read a reprint of his original article here. I learned most of what I know about it from Dale W Harrison, who has written extensively on the topic. This LinkedIn post of Dale’s provides an overview, plus a mathematical formula to calculate inter-purchase period using average annual churn rate.

You cannot make buyers come in-market

Entering a buying process sucks, particularly for high-priced solutions. It’s expensive, time-consuming, and depletes hard-won political capital. Worst of all, a buying process that “goes bad” (e.g., due to a failed implementation or a solution seriously underperforming) can be career-limiting for those involved.

Given all this — plus the fact that buyers are generally much less interested in your solution category than you are — do you really think some ninja marketing or sales tactics on your part will be enough to convince buyers to engage in a purchasing process that they weren’t already considering?

Now, of course, there are fringe cases. People do weird things from time to time. An organization that bought a new tool last year might be so frustrated that it’s already willing to engage in a new purchasing process.

These cases are still covered by the 95:5 rule. Why? Because the inter-purchase and decision periods are averages. An average inter-purchase period of five years allows for one organization to purchase four times in a decade, while another sticks with the same vendor throughout. Statistically, these cases fall within a normal distribution.

Even if they didn’t, we aren’t interested in fringe cases. That’s not how you’re going to hit your growth targets. Your approach to business and marketing should coincide with how most potential buyers behave, not how individual organizations behave.

Crucially, even when buyers do strange things, they don’t do it because a vendor told them to. They do it because they perceive a purchasing process to be less painful than whatever fallout they are currently experiencing. They may or may not be right about that, but they’re willing to roll the dice.

Note: What I’ve just said is a somewhat unpopular viewpoint. While things are finally shifting, the cybersecurity industry has been buried in “demand generation culture” for some time. Still, the fact that — across a market — it’s impossible to influence how frequently buyers buy is borne out by enormous quantities of real market data.

Okay… so what?

First, founders (and marketers) intuitively understand that not everybody is in-market.

If a prospect just bought from your competitor last month, there's nothing you can do to convince them to buy from you today… Unless they've had such a terrible experience, they are willing to go through the painful process of replacing their purchase already (not likely).

Still, many cybersecurity vendors act as though they don’t know this. They pile resources into short-term performance marketing campaigns while ignoring the rest of the market.

But we’re not going to do that. We want to understand what marketing can and can’t do, so we can act accordingly.

There are several implications of the 95:5 rule. For now, we’re going to focus on two of them:

1. It helps vendors set reasonable expectations for growth

2. It should inform the way vendors approach marketing operations

Let’s go.

The 95:5 rule helps us set reasonable expectations for growth

The obvious implication is this: you can’t win more deals than are available during a period.

In reality, it’s tough to win more than your share — dictated by your market share — of those deals.

You may be able to boost your win rate for buyers who are in-market (within reasonable limitations). But you can't expect to win more than a percentage of the available deals within a period.

Let’s look at some numbers, using the same five-year inter-purchase period and three-month decision period.

If your TAM is 10,000 accounts, 5% (500) will come in-market this quarter, plus any new accounts entering the market. If you simply maintain the status quo, you’ll win a proportion of these accounts equal to your market share.

• 3% market share = 15 + 3% of new entrants

• 6% market share = 30 + 6% of new entrants

• 10% market share = 50 + 10% of new entrants

In this case, we can multiply the result by four to get an annual figure.

Note: TAM is not just organizations that have or plan to buy your specific product type. It’s all organizations that experience the category of problem you solve to a degree that it’s worth expending resources on a solution. Security testing providers, in particular, will know there are many ways to skin a cat. In reality, you’re competing with a range of solutions, often including home-grown tools and systems.

At this point, you might be thinking…

I'm sure it is. Claimed win rates vary enormously — it should be easy enough to calculate yours. These figures don't reflect poor sales performance. They reflect that with a small market share, your sales team will not gain access to a large proportion of the accounts coming in-market.

For example, if you have 6% market share and your win rate is 20%, you're gaining access to 30% of opportunities (150 accounts) and closing 30 of them.

This follows the Rule of Market Share, which is explained very nicely by Dale W Harrison in this post.

If you follow this to its logical conclusion, you’ll notice large companies tend to win at every level:

• They have access to a higher proportion of accounts entering the market

• They win a higher proportion of the accounts they compete for

• They win accounts with less relative effort

…and they do all of this while (usually) charging a higher price. Why? Because one of the greatest benefits of a strong market position is reduced price sensitivity, which I’ll write about in the future.

Story time: The joys of selling for IBM

Around 2016, I met up with some clients at InfoSec Europe. Among them were two senior sales guys who had worked together at IBM and were now heading up sales for a cybersecurity startup.

They described the effort required to close deals at their current company, which was significant and time-consuming, and compared it to their experience at IBM:

This is an extreme example. We’ve all heard the phrase “nobody ever got fired for buying IBM” and understood the implications. But just because IBM is an extreme example of market position (and brand) doesn’t mean we can’t learn something from this.

Specifically, this: your success in a period isn’t based on your marketing effectiveness during that period.

If it were, IBM would do no better than any other vendor. Instead, success is based on your business and marketing effectiveness in previous periods — the longer you’ve been going, and the more success you’ve had, the more and easier you’ll win deals as they become available.

IBM has 124 years of repeat exposure, product use, media prominence, and promotion under its belt. This is what marketers mean by brand, that sense of significance in an average buyer’s mind. If you don’t have it, you’ll forever be fighting tooth and nail for a small proportion of deals.

We see this happen constantly in cybersecurity.

If you’re in the endpoint protection space, you’re up against Microsoft, Crowdstrike, SentinelOne, and Palo Alto Networks — all companies with substantial market position and brand recognition.

Does that mean you’re doomed to languish in insignificance forever? No.

But it does mean you’ll need to do something significant — and be patient — if you want to grow your market share in a space they currently dominate.

The reasonable response: Market to the 95%

The 95:5 rule gives us a picture of how a market works and an indication of our likely success in a period.

If we want to do better than that, what options do we have?

1. Gain access to more of the opportunities coming in-market

2. Improve our win rate

Preferably, both.

Can you win more accounts by becoming considerably better at performance marketing and sales? Yes, to an extent, but there are hard limits on this… and a strategy that revolves around sales excellence is unlikely to be scalable. If every opportunity requires a huge amount of sales effort, you’ll still get crushed by larger competitors who don’t have to work so hard.

What’s the alternative? I’ll get to that. First, we need to consider how buyers make decisions.

Not all buyers follow the same process. Suggesting they do would be absurd. Still, there are commonalities that we can learn from and account for.

When a buyer comes in-market for a high-priced solution to a painful problem, their first step will generally be to create a consideration shortlist. Think of this as their “day 1 list”.

• This might be delegated to someone other than the decision maker… or not.

• There may be research involved in the shortlisting process… or not.

• They may reference Gartner MQs… or not.

You can’t influence any of this. It happens before you’re even aware an opportunity exists.

The important thing to remember is that if you’re not on this list, there’s a very high chance you won’t be getting that sale. Even if research is involved in creating the list, buyers will generally prefer vendors they already know.

I have a little insight here that might interest you.

Story time: Young Pete’s first lesson in professional risk

A long time ago, I worked for a large government organization in the UK. I spent two years in procurement, followed by two years as an IT project manager. During those years, I helped design the procurement model for large purchases, was on the buying group for a VERY large financial services contract, and was later responsible for several large IT system purchases.

Here are a few things I learned:

1. Buyers don’t want to add extra vendors to their consideration set — it adds more work.

2. The personal risk associated with major purchases is real.

3. Even when buyers use a points system vs. features to select a vendor, those systems are often “stacked” so the preferred vendor wins.

Here’s the thing. If one of the purchases I was responsible for had “gone bad”, there’s a very high chance I would have lost my job. At the least, it would have seriously harmed my career prospects.

Even as a clueless twenty-something with a high risk tolerance, I was acutely aware of this. I was far better off selecting a safe-but-sub-optimal solution over a potentially better but high-risk option.

Guess what I did. For the most part, I chose the safe option. I took one major risk, which thankfully worked out. This is a whole story, which I may tell another time.

Why is this important? Because it forces us to consider…

How to be considered by more buyers

So, we’re trying to gain access to more opportunities. To do that, we need to be on the day 1 list. How do we do that?

Simple: buyers must know who you are AND mentally link you to their category of problem.

This is where marketing to the 95% of accounts that aren’t in-market comes in. Specifically, we need marketing that creates long-term memory structures that link your company to the types of problems you address.

To understand how this works, we’ll turn to Les Binet and Peter Field’s book The Long and Short of It.

Note: I’m only covering Promotion here, and in a very simplified way. Product, Price, and Placement are all crucial, and they only become more important as your company grows. Still, since everyone loves Promotion so much, I thought I’d start here.

The first thing to understand is that long-term marketing effects are not an accumulation of short-term effects.

Short-term campaigns are generally fact-based and target logical thinking patterns. That’s System 2 thinking for fans of Daniel Kahneman. This works well for performance marketing designed to capture in-market buyers… but very poorly for instilling long-term memory structures. In practice, that means performance marketing does a poor job of helping out-of-market buyers remember who you are when they eventually come in-market.

Long-term campaigns are less factual and more emotional. They appeal to Kahneman’s System 1 thinking, and (with repeat exposure) are much more effective for building long-term memory structures. These campaigns produce some short-term effects, but are much more effective for producing long-term effects that build over time — particularly six months and up. Note that “appealing to emotions” does not have to mean FUD.

Source: The Long and Short of It, Les Binet and Peter Field

The graph above — reproduced with the author’s permission — shows two things:

1. Short-term rational campaigns are useful for short-term sales uplift, but do not compound over time to produce long-term sales uplift.

2. Long-term emotional campaigns, on the other hand, do compound over time, resulting in long-term sales uplift.

The “crossing point” between short- and long-term campaigns is around six months. So, if campaign performance is judged over less than six months, rational campaigns will appear more successful. However, over the long term, emotional campaigns are almost twice as likely to produce substantial profit growth.

We need both.

Even when buyers know who you are and link you to their problem category, they still need prompting. Short-term performance marketing is intended to influence buyers as they come in-market, and it’s markedly more effective when buyers have been “primed” through repeat exposure to long-term brand marketing campaigns.

Notably, companies should try to reach their entire market with long-term campaigns, while short-term campaigns are generally more targeted.

In The Long and Short of It, Field and Binet recommend a 60:40 budget split between long-term and short-term marketing. In more recent research, they concluded an ideal split may be closer to 50:50 for B2B companies.

That’s how your company can be considered by more buyers as they come in-market. But how do we get them to choose you?

Becoming a “safe option”?

Never underestimate the importance of being a “safe” option for your buyers.

Bad purchasing decisions torch hard-won political capital and can be career-limiting for buyers. Unless your product is low-cost (and there’s more to cost than sticker price) most people won’t be interested in “giving you a chance”.

So, what makes you a safe choice?

Size is a good start. The larger you are, the less likely your solution will be bad enough to explode in the buyer’s face. But buyers don’t look up financial statements to figure out which vendors are the biggest. Instead, they use a heuristic: how often they hear from and about you compared to your competitors.

Marketers refer to this as your Share of Voice (SoV). Field and Binet define this as:

There’s a bit more to it. If you completely waste your communications budget, you aren’t achieving a commensurate SoV. Conversely, if you’re talked about a lot (and positively) you might achieve an outsized SoV compared to your spending. But all else being equal, it’s about your comms budget.

Now the fun part.

If you can achieve Extra Share of Voice (ESoV) — that is, SoV above what would be expected for your market position — you can signal to buyers that you are more significant than your market position suggests. In fact, they don’t know or care what your market position is in reality. They assess your significance based on your SoV.

The formula is simple:

If you have 10% SoM and achieve 20% SoV, your ESoV will be:

20% - 10% = 10 percentage points of ESoV

Field and Binet found that sustaining 10 points of ESoV will drive 0.5 points of SoM per year. So, if you have 10% SoM and sustain 10 points of SoV, you can grow to 10.5% SoM after one year, 11% SoM after two years, and so on.

Over time, you’re slowly capturing an increasingly large proportion of in-market accounts. In a large and/or rapidly growing market, this can result in significant business growth.

You should aim to achieve ESoV across brand and performance marketing. Again, we’re looking to build awareness with buyers before they come in-market AND give them a nudge when they come in-market.

Note: There’s a lot more to this topic than I’ve explained here. If you want to know more, I strongly encourage you to read The Long and Short of It by Les Binet and Peter Field.

Achieving ESoV often requires segmentation

If you’re thinking “achieving ESoV sounds expensive,”... you’re right. Achieving 10 points of ESoV as a vendor with 10% SoM means spending double the amount.

This is an argument in favour of segmentation and targeting for smaller players within a market. Realistically, it’s very costly to maintain significant ESoV across the entire market, particularly if you haven’t been funded to the gills.

This is a big topic. In simple terms, you’re focusing your efforts on a segment of the market that’s large enough to satisfy your growth objectives but small enough that concentrating your spending will allow you to achieve significant ESoV.

The elephant in the room

You’ll note that the promotional programs run by most cybersecurity vendors look nothing like what I’ve described here. Most are all-in on short-term performance marketing with occasional nods to brand marketing that are really performance marketing in disguise.

It’s tough to go against the flow, but it is your best bet for long-term growth.

Keep the 95:5 rule in mind. Market both to the 95% of buyers who aren’t in-market and the 5% who are. Remember, you’re trying to gain access to a higher proportion of available deals and improve your win rate… without relying on repeated heroic sales efforts.

I have nothing against salespeople. I know and have worked with tons of great sellers. But a business strategy that demands continuous and outstanding performance from every member of its sales team is just not scalable.

Final caveat: When it is all about sales

If you’re a very early-stage startup with no brand awareness and limited funds, you will naturally lean more heavily into generating immediate results. That generally means short-term performance marketing, high sales effort, and leveraging founder relationships.

Still, don’t completely take your eye off the long-term. Once you have a foothold, you must invest in long-term marketing if you want rapid growth.

That’s the reasonable approach to growth. But…

What if I don’t WANT to be reasonable?

Now we’re talking.

Very few of the cybersecurity founders I’ve met started their company with the dream of retaining a small market share year after year. Actually, I’m not sure I’ve ever met a founder who wanted that.

Usually, their dreams involve disruption, rapid scaling, and other high-energy phrases.

So… how does an account acquisition rate in line with your market share sound to you? Is that enough to satisfy your growth targets?

In a stable market, probably not. In cybersecurity, it may be because the market growth rate has historically been very high. If your market is growing at 10% YoY, you can retain exactly the same market share while also growing at 10% YoY.

On the other hand, growing at a rate higher than your market share — which is the same thing as growing your market share — is a difficult and slow process. It can be done, but change at this level takes a long time to play out, and it's both difficult and expensive.

So, what are your options?

As Mats Georgson is fond of pointing out, there are examples of companies that grow faster than we can explain using marketing theory. Not just that, they’ve done it without spending outrageously more than their competitors on promotion. You can see Mats’ analysis of 150 companies that fit this description here, and I’d encourage you to do so.

There are five cybersecurity companies on Mats’ list, but there are many more examples of rapidly growing cybersecurity companies. Richard Stiennon’s Cyber 150 is a good place to start.

What are these companies doing? And can we learn anything from them?

I’m so glad you asked. I’ll be back and writing about precisely that topic… soon.

A function we all know is essential, particularly to achieve the kind of growth demanded by venture capital firms, has been relegated to the incremental task of “generating leads” for sales.

I say we all know marketing is essential because we do. Better marketing = better business.

We’ve seen it a million times.

We all have closets and cupboards full of branded goods. We’ve heard that “nobody ever got fired for buying IBM” and understood its truth and the reasons behind it.

Why do some vendors explode while others languish in irrelevance? It can’t be explained purely by the quality of their solutions. Several factors are at play, and marketing is one of them.

But most business leaders don’t understand the mechanisms involved in good marketing. And what they’ve seen over the years from marketing departments has led them to despair of ever benefiting from it themselves.

So here we are. Cybersecurity marketing teams are glorified BDRs with big budgets and unattainable performance targets.

Naturally, there’s plenty of noise and blame-throwing going on, and no shortage of people proposing solutions. Often, VERY LOUDLY.

When I speak to marketers, they tell me:

• “Our targets are disconnected from reality”

• “We’re sick of being lapdogs for sales, who never appreciate us anyway”

• “We struggle to stand out in such a crowded market”

• “Business leaders don’t understand marketing”

• “We spend most of our time trying to meet KPIs that don’t serve the company’s interests”

When I open LinkedIn or go to conferences, I hear all sorts of suggestions about how to fix this:

• “Just do better messaging”

• “We’ve got to be data-driven”

• “Marketers should focus on brand”

• “We need more and better content”

• “Gotta have sales alignment”

And this is just a taste.

Marketers get no support from SMEs. Founders want to see concrete results. Marketers have heard they should speak to customers… but half the time, they aren’t allowed anywhere near them. Brand. Email. Messaging. Customers. KPIs. ABM. Insights. Sales. Revenue. Pipeline.

The problems and solutions are seemingly endless… and all the while, people are being laid off and leaving the industry at the fastest rate I’ve seen in my 11 years as a cybersecurity marketer.

But here’s the thing.

While painful, these are symptoms of the problem. They aren’t the problem itself, and worse, they don’t clearly point to the real problem.

The missing foundations of cybersecurity marketing

So, what is The Big Problem with cybersecurity marketing?

My thesis is this: marketers have become obsessed with marketing operations while forgetting about marketing foundations.

(It’s actually worse. Marketing teams have become obsessed with promotional operations at the expense of literally everything else. We’ll come back to that.)

What I mean by foundations is all the information gathering, groundwork, and planning necessary to conduct operations in a focused, intentional, and effective way that supports business objectives. Not exactly revolutionary, but very definitely missing en masse from the cybersecurity industry.

Here’s a visual metaphor.

Consider the Parthenon: a temple in Athens, Greece. You probably recognize it.

Source: Britannica

Nice, right? It turns out if you want to build a temple with 100,000 tons of marble — and have it still standing almost 2,500 years — you need some pretty strong foundations. This is what they look like:

Source: The Acropolis in the Age of Pericles, Jeffrey M. Hurwit (loc.gov)

Reportedly, in some places, these foundations are around 1.5 times deeper than the height of the building above. I’m no expert, but I’d imagine the solidity of these foundations may be part of why the Parthenon is still there after nearly 2.5 millennia.

If you want to build something big and impressive, you need four things: material resources, solid foundations, vision, and execution.

In the context of a cybersecurity marketing program, this means…

The diagram below shows how this all fits together, with the help of my child-grade drawing skills.

When I talk about marketing foundations, I’m really talking about the first three columns in this diagram. Every cybersecurity marketing team has execution — even if it’s often limited to promotions — but a great many pay only lip service to resources, foundations, and vision.

Of course, my diagram is oversimplified. The real world is rarely this straightforward. Still, as I walk through each of its components, hopefully it will become clear why each column rests on those that came before it — and that a lack of any one component will inevitably harm the final result.

Let’s get into it.

Resource gathering: Something doesn’t come from nothing

What resources do we need to get started? Quite simply, knowledge.

I’ve been in the cybersecurity industry for 11 years. During that time, I’ve met…

• Tons of highly competent marketing operations people.

• Many great product marketers.

• A decent number of excellent strategists.

• Some marketers with a really solid grasp of marketing theory.

But marketers who have the necessary skills for their function plus a strong grasp of their customers and the industry/sector they occupy? I’ve met less than five.

Keep in mind, I’ve worked with more than 70 cybersecurity companies and hundreds of marketers. For all that, I’ve met a single handful of people who possess all of the raw materials needed for effective marketing. Oddly enough, they’re in extremely high demand.

But I’m not here to malign people. I’m here to explain why this is a problem.

Across the board and in almost every field of human endeavour, there has been an industrial-scale rejection of genuine knowledge in favor of synthetic “insight”. In marketing, this presents as the wholesale embracing of MarTech and AI tools designed to replace learning, thinking, and understanding with the passive acceptance of superficial ideas, half-truths, and comfortable lies.

It would be funny if it weren’t so harmful.

I have more to say, but this isn’t the time. If you want to go down that rabbit hole, check out Clark Barron’s work. For now, it’s enough to say that what cybersecurity marketers really need is knowledge.

Not data. Not information. Not “insights”. Not AI sludge.

Actual, in-depth, real-world knowledge. Specifically, in three areas:

1. Customer

2. Industry context

3. Product

I’ll go through the basics of each here. There will be a lot more on these in the future.

Customer knowledge is essential. If you don’t have it, you’re dead in the water.

And I’m not talking about “Cedric the CISO” style personas. This is what most marketers are used to, and these documents are rightly and universally reviled.

Customer knowledge can be broken down into three categories: The person (or people) you sell to, the organizations you sell to, and the main problem your product solves. That’s it.

Person. Organization. Problem.

Simple. It looks something like this:

I can hear some of you groaning: “This is too much… How is org structure relevant?!”

It may not be.

But let’s say you’re selling to hospitals in the US. Many have IT departments that are organized quite differently from similarly sized organizations in other industries… and it matters very much if you want to sell them certain types of products.

The table above isn’t exhaustive. It’s illustrative. In practice, you’ll figure out what you need to know by rolling up your sleeves and getting to work.

Industry context is simply gaining an understanding of the space you inhabit. Honestly, this barely happens in cybersecurity marketing, and when it does, it’s often done in a misguided way.

Understanding the space you inhabit isn’t about getting certifications or doing an ethical hacking course, though you may find that helpful. It’s about understanding the logical processes, forces, motivations, and pressures that make up the “stuff” of your industry and sector, as well as the concepts and theories that guide them.

This is something people miss when it comes to IT. No matter how many 1s and 0s it’s wrapped in, there is always a process. Software and hardware aren’t magic boxes that spit out answers. They’re bundles of processes that can be understood and explained… often fairly simply. You don’t necessarily need to be able to do the operational processes, but you do need to understand how they work and what they achieve.

The same goes for security.

Security is a distinct field with its own body of theory and practices. It can be implemented in an IT context, but it isn’t just “part of IT”. If you really want to understand the space you’re in, it would benefit you to look beyond “cyber” and learn the basics of security.

Here’s a list of knowledge categories you may want to investigate. Again, it’s not exhaustive.

You’ll notice that this goes beyond IT and security, and way beyond the confines of the specific sector your company occupies.

It’s a lot, and I can only say you didn’t pick the easiest industry. I’ve been doing this for 11 years, and I can have a sensible conversation with pretty much anyone about pretty much anything to do with IT security and a bunch of related fields. This is only because I’ve spent thousands of hours learning, writing, and talking about it.

Great Big Important Note

I put customer knowledge first on the resource list because everything we do is ultimately for their benefit. But… if you can’t hold up your end of a conversation that spans a range of interconnected topics, often including some that aren’t directly covered by cybersecurity, your customers and prospects WILL NOT open up to you.

They’ll see you as “just another marketing numpty” and you’ll get the bare minimum from them. Worse, you probably won’t even realize it.

You don’t have to know as much as a practitioner about their field of speciality. I don’t. But you do need to know enough to ask the right questions, understand the answers, and dig deeper where necessary.

The good news is if you structure your learning sensibly, you’ll know more than 99% of your peers within a few months.

OK, that’s enough. Moving on.

Product knowledge is precisely what it sounds like. This is where most marketers start, and understandably so. It sets the context for everything else.

If you don’t know what your company does in great detail, you’re going to struggle.

You can start with:

That’s the basics of gathering information resources. As you might expect, this stage is continuous. Gaining more knowledge in one of these areas will help you gain more knowledge in the others, in true virtuous cycle fashion. Something like this:

Before we move on, I want to share a few thoughts that might help you along the way:

• I want you to reject the idea that technical concepts are “too complicated for marketers,” or that learning this stuff isn’t your job. They aren’t, and it is.

• I see a lot of talk about marketing “getting a seat” at various tables. Understand that it’s not always departments that get a seat… it’s people. If you demonstrate competence, there’s a good chance you’ll get asked to be involved.

• Attempting to completely eradicate wasted time from the information gathering process will inevitably cause you to miss something important. Not everything you learn will be usable, but equally, some things that seem irrelevant may prove extremely valuable.

Foundations: Because building stuff on sand doesn’t work

I contend that the foundations of cybersecurity marketing are Segmentation, Targeting, and Positioning (STP) grounded in market analysis and business context.

That’s a lot of big words that basically mean: you need to know who you’re trying to sell to, where to find them, and what value you have to offer them… and you need to be sure your choices are suitable in light of your objectives, market conditions, and the current state of your company.

I understand that “STP” comes loaded with a ton of negative sentiment and experience. Last week, I had a conversation with a cybersecurity marketer where I mentioned STP. Her response:

Look. When something is done badly for long enough, it becomes associated with that badness. This is why many marketers hate customer profiling… because every persona they’ve ever seen was unusable. But doing something badly and getting bad results tells you nothing about the thing itself.

STP is not MarTalk. It’s the foundation of marketing, the literal groundwork that underpins every marketing output.

And, like brand, it exists whether or not you do it intentionally.

Targeting everyone with a mediocre value proposition is an STP decision. Usually not a very good one, but an STP decision nonetheless.

I’ll write more about this in the future. For now, I’ll explain what I mean and why it’s important.

Segmentation is the process of dividing your potential market into smaller, defined groups with similar needs, characteristics, pain points, behaviors, accessibility, etc. In the cybersecurity industry, this is typically done by industry, location, and regulatory coverage, but there are other options.

Targeting is about assessing and selecting one or more segments to focus your energies on. Some vendors go so far as to build their products around specific segments, but more commonly (though not necessarily correctly) targeting just informs messaging and promotion.

Positioning is… hard to define. Though many experts have tried, I’ve never found a definition that I think truly grasps the essence of what positioning is and why it’s important.

• April Dunford talks about “positioning as context” in her book, Obviously Awesome. She states that “products are exceptional only when we understand them within their best frame of reference” and contends that this is achieved with positioning.

• Ever the pragmatist, David Ogilvy defined positioning as "what a product does, and who it is for".

• Kotler and Keller define it as the “act of designing the company's offering and image to occupy a distinct place in the mind of the target market”. This is similar to definitions given by Al Ries and Jack Trout.

• Mats Georgson talks about Demand Point Constellations (DPCs) as a key element of positioning. It’s a great concept that builds on common techniques. If you haven't already, you should absolutely check out Mats’ analysis of 150 rapidly growing companies (spoiler alert: they didn’t do it with promotion alone).

It’s all in the mind

Ries, Trout, Kotler, and Keller are right when they say we’re trying to position our products in the minds of our target market… but that’s something we can only influence and not control. More on this another time.

If I’m forced to pick a definition, I’m going to slightly amend David Ogilvy’s:

More than this, positioning is the distillation of everything we’ve done up to this point. You can’t hope to position a product effectively if you haven’t acquired the knowledge we discussed in the last section — and you certainly can’t do it without segmentation and targeting.

Finally, positioning usually includes a high-level messaging component. Part of the work of positioning is determining what value you have to offer, and it’s difficult to do that without turning it into words. These might not literally be the words you share with your market down the line, but they will at least be the heart of it.

After positioning, you will know what you want to say, even if you don’t yet know how to say it.

Finally, we need two more components: market analysis and your business context.

In an ideal world, we’d sell our stuff to the widest possible market. So why don’t we?

It’s partly because building products for “everyone” often results in something that’s of limited value to any one individual. But it’s not just this.

It’s also because we don’t have unlimited resources — we can only effectively market and sell to a limited number of individuals and organizations. For companies that aren’t in a leadership position within their sector, STP is a way to maximize the utility (read: growth) of limited financial and operational resources.

So why are market analysis and business context important?

Well, you probably have internal targets. You may also have pressure from investors to achieve a certain amount of growth. Given this, the segment(s) you propose to target must be:

1. Large enough to sustain the growth you want to achieve; and,

2. Small enough that you can target them effectively with your resources and infrastructure.

Naturally, as you achieve growth, you may revisit your STP to reflect your new position in the market and (hopefully) greater resources. This is how Salesforce gained a foothold in a highly competitive industry, and we all know how that played out. In this industry, Asimily is a good example of a vendor that started with a narrow focus (US healthcare) and widened its gaze once it had achieved growth.

So that’s the foundations.

Before we move on, I will note that there is some iterative-ness between resource/knowledge gathering and STP. You don’t want to squander time learning about customers and segments you aren’t going to target, but to some degree it’s inevitable. There’s a high likelihood that some of your efforts will be “wasted” on segments that looked promising but ultimately aren’t.

Vision: You need a destination to know if you’ve arrived

Strategy is a massive topic, and we’re hardly going to cover it here. Again, this is something I’ll write about (probably at great length) in the future. For now, there are a few things to understand.

First, business strategy and marketing strategy are two sides of the same coin. You can’t logically have a strategy for a single business function if you don’t have one for the business as a whole. At the same time, your STP outputs are only meaningful if they influence your overall business strategy.

For instance, the decision to target specific market segments doesn’t just affect marketing, it affects the entire company.

Your proposed positioning can and should influence how you develop your product over time, and that’s the primary source of your company’s value. If all those knowledge resources you’re gathering aren’t being used to improve the company as a whole, they are being severely underutilized.

In short, marketing and the business are inseparably connected, and trying to create a marketing strategy in isolation is a highway to producing a document that gets filed away forever and never looked at. This, unfortunately, is the fate of most strategies.

Second, while strategy is notoriously difficult to define, a good strategy is quite easy to recognize. If positioning is context, strategy is direction. It should:

• Set out what you’re trying to achieve

• Define the space you hope to achieve it in

• Provide a broad outline of your approach

• Get out of the way and let people do their jobs

You don’t hire people so you can micromanage their every move. A good strategy sets the direction for operations, and gives the operators freedom to act as they believe is appropriate to take the company in that direction.

From there, KPIs are the tool we use to check whether we really are moving in that direction, and if we’re moving at an acceptable pace.

One of my biggest bugbears about KPIs is that they are often chosen “because this is what everyone does” rather than to guide operations and determine effectiveness against clear success criteria. I’m not going to get into KPIs and performance tracking here, but suffice to say, you don’t choose KPIs until after you know what you’re trying to achieve and have set your direction.

Finally, while STP isn’t a strategy in itself, it’s a major component. If you have sensible outputs from your STP process, you already have a better strategy than most of your competitors.

A typical strategy for cybersecurity vendors is “we’re going after the enterprise.” Aside from the fact that this isn’t a strategy, it’s also generally based on the dubious assumption that winning a small number of large accounts is the best path to growth. That may be true, but it usually isn’t, and it’s almost never helpful.

Still, this is what you’re up against.

Pillars: The 4Ps of marketing

So the foundations are in place. Now we can build something on top of them.

This is where the pillars — the 4Ps — come in. Everything up to now is designed to support operations in these areas, just as the Parthenon’s pillars rest on countless tons of stone foundations.

We’re out of the realms of foundations, so I’ll keep this part short.

Marketing should at least influence all four pillars.

Product isn’t owned by marketing. That ship has sailed. But it should be influenced by marketing. If not you, then who? Software developers and security practitioners are not the experts in your customer’s problem — you are. Or, at least, you should be.

Price is treated like voodoo and generally done badly. Most companies just “do what everyone else is doing,” not realizing that their competitors are also trying to copy them. Price is now completely severed from marketing at many cybersecurity companies — a trend I’d like to see reversed.

Placement is a weird one. Performance marketing is kind of like physical availability for digital and remotely delivered solutions, so in a sense, marketing does own it. Placement might also include partner and channel strategies, which may or may not be owned by marketing.

Promotion is clearly owned by marketing — in fact, it’s all that many marketing teams do. Do it in line with your strategy, keep building your knowledge resources, and always keep your STP outputs at hand to guide your approach.

Allegedly, there are now more Ps: Purpose, People, Pandering, and so on. Forget about them. They are either:

1. Already covered by the 4Ps

2. A strategy consideration

3. Irrelevant

Finally, there are strategic elements to each of the pillars. If you decide it’s important to have a defined strategy for one or more pillars, make sure it’s in line with your higher level strategy and follow the principles from the previous section.

Wrapping up: You can’t just treat the symptoms

If the Ancient Greeks had built the Parthenon on poor foundations, it would have collapsed a long time ago, and we’d never have heard of it. This is similarly the fate of a disappointing number of cybersecurity vendors — all of which, I assume, were launched with the best intentions and a cool product to sell.

More commonly, though, cybersecurity vendors with poor marketing foundations don’t fail… they just chronically underperform.

It’s actually quite difficult to go out of business in a market that has grown at a staggering rate for two decades and is awash with venture funding. On the other hand, it’s very easy for a vendor to limp along, never quite achieving the growth and recognition it could potentially have.

I should know. I’ve seen it over and over for the last 11 years.

That’s why I wrote this article. I’ve seen the inner workings of more than 70 cybersecurity marketing teams. I’ve seen what works, what doesn’t work, and what differentiates successful vendors from chronic underperformers.

And frankly, I don't believe I've said anything controversial here. It's just this:

• Product, Price, Placement, and Promotion are the pillars of marketing. Everything we do falls under one of these.

• You can't do them effectively or monitor your success if you don't have a strategy. What does "effective" even mean if it's not measured against anything?

• Your strategy will suck if you don't know who you sell to or what value you provide. Arguably, you shouldn't have a business if you can't answer this.

• You can't know this if you don't understand your customer, industry, and product. Something doesn't come from nothing — you need raw materials.

This also explains why treating the symptoms of failing marketing doesn’t work:

• Tighter messaging? Okay, but for whom, about what, and why should they care?

• More focus on brand? Sure, but again, who do we target and what’s in it for them?

• Better KPIs? Absolutely. But what are we trying to achieve, and how do we know it’s sensible?

And the ever popular (unspoken) assumption: “We just need to do more and better”.

Well, knock yourself out, I guess. It’s worked so far, right?

Business is fundamentally about value exchange. Marketing is supposed to facilitate the exchange. This is what the 4Ps are all about. But marketers can’t execute on the 4Ps without raw materials (knowledge), foundations (STP), and vision (strategy).

So what now?

Well, if you’re a cybersecurity marketer, I’d encourage you to start gaining relevant knowledge and speaking to your business leaders about the need for stronger foundations.

If you’re a founder, I want you to understand that marketing isn’t just about promotion — it’s the entire process of exchanging value with an appropriate target market. If you treat it as “just promotions”, you’re very likely hamstringing your chances of achieving growth.

And if you’d like some help…

Well, this is what I do. I build cybersecurity marketing foundations.