With a massive backlog of tasks, and a long list of challenges, to say I was thrown into the deep end was an understatement. I had to navigate through a tangled mess, create some structure, strategy, and priorities to provide a clear path forward.

Any time money is leaving a company, I make that my highest priority. 

As I dove deep into the Google Ads analytics, I quickly realized the company was bleeding about $1,000 per month for the past 3 years, and these ads were not bringing in any new leads.

For starters, the web development agency were running broad match keywords, set to worldwide targeting, on very general security search terms. This captured such a broad audience with no purchase intent. It was no wonder they weren’t moving the needle.

Their retargeting ads were atrocious, were targeting the entire site without any exclusion filters, had extremely low click-through, and high frequency. Meaning, a person who went to the careers page (aka not our target buyer) 8 months ago was still being aggressively targeted. When you target everyone, you target no one. Their $1,000 per month ad budget was being wasted on random people who had no intent to purchase, and it was being spread so thin that it was never going to work.

In the interest of time, I just turned off the ads completely. I would revisit it at some later date. There were other important issues I needed to address.

I looked at the data of closed-won and closed-lost customers and prospects. I wanted to see if I could identify any patterns. You can often learn a lot from your failures. Most of the buyers had a personal relationship with the Founder, so that wasn’t all that useful, and the few closed-lost prospects declined for various reasons from pricing / budget constraints, compliance, capacity, and so on.

If we were going to move forward with a more data-driven approach, we needed to define our ideal customer personas.

• Who are our ideal customers (industry, size, job titles, technology, location, etc.)
• What do they want, need, and value?
• What is the most effective way to reach them?

Upon some discussions, we determined our ideal customers met the following criteria:

• VP, Engineering, Head of Security, CTO
• Their reason to buy (pain point) – they build software, but lack in-house security expertise, finding staff (as was also true in our case) is difficult and expensive, and not needed on a full-time basis
• Verticals were: fintech, health tech, and eCommerce
• Size – mid to large enterprise 25-1,000 employees (too small of a company and they often don’t have adequate budget, and too large of a company (e.g. national bank), and we didn’t have the capacity)
• Location – North America, ideally US. Canadian companies tended to be more price sensitive

Forward Security’s main service was their application security risk assessment. I did a quick search in Google’s keyword planner and determined there was no search volume for that phrase. The more common terminology was “pentesting, or penetration testing”, even though that wasn’t completely accurate.

The market was uneducated, but we didn’t have time to educate them. 

Leaning into what the data was telling me, I created a pentesting page on the site along with some pentesting content. The idea was to use pentesting as a land and expand strategy. On the page, I created a section educating visitors about the limitations of pentesting and why they actually needed a comprehensive application security risk assessment, in which pentesting was just one of four things that were included.

I created a larger campaign called ‘Go Beyond Pentesting’ that was complete with social posts, video and blog content, and website messaging. I would eventually turn ads back on and target people searching for pentests, but would limit it to certain regions (major tech cities in the US) to maximize the budget.

I also broke apart the other pieces of the application security risk assessment and productized those – so now each of those had pages as well.