About the client
Cybersecurity services firm
The firm protects enterprises that cannot afford a breach. Its practitioner team watches client environments from its own security operations centre, detecting and responding to threats as they happen, and secures the cloud platforms and applications those businesses run on. It is one of a small number of Google Cloud security partners, and most of its clients are banks, financial services firms and SaaS companies.
A security operations centre that detects, investigates and contains threats for clients.
Securing the platforms and software clients run their business on.
Security strategy, risk and compliance work alongside CISOs and their teams.
At a glance
Strong delivery, a Google Cloud partnership and no marketing function. All pipeline from referrals.
Three months fixing the foundation, then content from existing proof, and every channel tested before it got budget.
Yearly pipeline of $2.2M, a site scoring 80 and a firm named in Google AI answers.
01 The situation
The firm sold considered security services to enterprises and had never built a demand function.
Services across SecOps, cloud and AI security
2
Buyers on every deal: the CISO and the CIO
Yearly pipeline, all from referrals
Exhibit 1. Five gaps, and what each one cost
Score 51 of 100, eight critical issues, no tracking.
Did not match the firm's standing
Founder with 14,000 followers and no rhythm.
Nothing to follow or forward
AI visibility 20 of 100.
Not on the buyer's shortlist
Google designation never marketed.
No reason for Google to prefer them
No CRM discipline, domains or account list.
No way to run a campaign
The brief from leadership
Make the firm visible at the standing it had already earned, then build a demand system the business could plan around, measured on qualified pipeline agreed with the head of sales.
4x
The growth that followed
12
Months
02 The approach
Codax ran the whole function under one senior lead and asked for about three hours a week from the client.
The Codax team, under one accountable lead
Exhibit 2. Three months of repair came before the first outbound sequence
Nothing is sent until the foundation can carry it. Nothing is scaled until a test has shown it converts.
03 The work
The five phases overlapped by design. These are the decisions and results that mattered in each.
1
Month 1
A month inside the business before anything was built.
01
The CISO and the CIO ask different questions, so the plan ran two content tracks.
02
The team, customers and delivery record became the proof in every message.
03
The rare Google designation went to the centre of the plan.
04
Three months went to repair before any sequence was sent.
2
Months 2 to 4
The site was rebuilt to pass a buyer's due diligence, and everything a campaign depends on was put in place first.
Site score
Above the 75 average for top sites
AI visibility
Named in Google AI answers
8 → 0
Critical site issues
Monthly visitors, 2,800 to 5,000
6 weeks
Domain warming before the first sequence
Rebuilt with service and industry pages, and tracking from day one.
Rewritten to the CISO's problem, posting weekly.
One identity across every touchpoint.
Stages, definitions and alerts agreed with sales.
3
Months 3 to 6
Existing proof became a content engine with an asset for each buyer, and the Google partnership became a channel of its own.
Customer interviews turned into proof for ads, outreach and sales.
A gated report on running a modern SOC.
A cyber risk playbook for the second buyer.
Weekly posts from a monthly recorded interview.
Two newsletters, built from the same proof
The Google partnership
The designation went on the site, the founder profile and every partner directory. Content and executive sessions were co-hosted with Google for CIO and CISO audiences.
$132K
Yearly partner-sourced pipeline
3
Executive sessions with Google
4
Months 4 to 8
Each channel ran as a four to six week test against the same account list. These are the winners, and how far ahead they finished.
Sector
Banking and SaaS over insurance
Sender
Invitations signed by the founder
Advertising
Founder ads over company ads
Whitepaper
Gated over ungated
Webinar topic
SOC operations over compliance
The security operations offer also beat general services on replies and meetings, and every sequence and ad moved to it.
One quarter, one campaign
A single story built around the security operations report, run across outbound, LinkedIn, email and retargeting against one account list.
410
Report downloads
24
Discovery calls
$364K
Qualified pipeline added
Yearly pipeline from events
Average touches before the first call
8 in 10
Opportunities touched by three or more channels
Median from first touch to first meeting
5
Months 7 to 12
From month seven, budget and volume moved to what had converted.
List depth doubled in banking and SaaS.
All invitations, sequences and paid social in his name.
LinkedIn reach pointed at the titles outbound was working that week.
Founder and company page weekly, newsletters monthly.
04 The impact
Exhibit 3. Yearly qualified pipeline, USD
Yearly pipeline is quarterly qualified pipeline multiplied by four. Source: CRM, as reported with the client's head of sales.
Exhibit 4. From thousands of accounts researched to 35 in qualified pipeline
Researched
Profiled against the ICP, then narrowed to the working list.
Deeply engaged
Several interactions and a meeting with the committee.
Qualified opportunity
Scoped need, budget owner and a next step in the CRM.
Exhibit 5. The audience grew 74 percent, from 28,500 to 49,681, and it belongs to the client
Exhibit 6. Results arrived in the order the method predicts
Client perspective
“We had used agencies before and got activity reports. What was different here was that they spent the first quarter fixing things I would have told them to skip, and then gave me a pipeline number my head of sales actually agreed with. Twelve months on, most of our first conversations are with people who already knew the firm. I would not say it was fast. I would say it worked, and it is still running.”
“The first time a CISO referred to our SOC report before I had said anything, it was clear the system was working.”
Start here
Findings shared in full, with a prioritised repair list, before anything is agreed.
