An inbound strategy for
Sweet Security.
A 90-day, $120K plan built for how cyber buyers actually buy in 2026, not the 2019 demand-gen playbook.
Security demand isn't a
lead-gen problem.
It's a
problem.
Which is why a 90-day inbound plan isn't a channel list. It's a sequence designed to take the buyer from passive awareness to technical curiosity to operational relevance to demo-worthy urgency.
Buyers don't search to buy. They search to solve a pain.
6 to 20 touches across peer, technical, and analyst surfaces before a demo feels rational. Gated PDFs don't earn that. Seeing yourself in the problem does.
Trigger
K8s migration, alert fatigue, a board question
Self-diagnosis
"What are we missing?" Sizing a blind spot
Peer research
Communities, podcasts, attack walkthroughs
Problem search
"How to detect runtime threats in K8s"
Demo
Only after "this is us"
Three motions, not one.
Demand Creation
Plant pain recognition before "category" exists in the buyer's head. Attack walkthroughs, runtime blind-spot framing, AI-workload risk narratives.
Demand Identification
Find accounts whose buying committee is already in motion. Through signals, not forms.
Demand Capture
Be the obvious answer when intent surfaces. Mid-funnel: problem-led queries, comparison pages. Bottom-funnel: branded terms, retargeting.
The product itself can be the demand engine.
Adding hands-on experiences to the site creates the "this is us" moment that earns a demo. For example: a runtime exposure check, an attack simulation walkthrough, a posture benchmark against industry peers, or a sandbox environment where buyers explore the product on their own terms.
Four moves that make the spend work.
Hands-on experiences on site
Interactive product moments: runtime exposure check, attack simulation, posture benchmark. The buyer sees their own risk, not a brochure.
Talk to a Cloud Security Expert
A mid-funnel CTA that is explicitly not sales. A practitioner conversation about the buyer's architecture and pain. Builds trust, surfaces real problems, lowers the cost of the eventual demo.
Podcasts & webinars as owned trust
Appear on practitioner podcasts, run quarterly technical webinars with researchers. Repeated exposure across trusted surfaces compounds credibility.
Common Room as the signal layer
Detect buying committees forming before they raise a hand. GitHub activity, community presence, peer conversations. Which accounts are in motion right now?
And that's Sweet's sweet spot: four moves that make three motions work as one system, driven by product experience.
Build the audience in M1. Harvest it in M3.
Start TOF-heavy to warm the pool, then shift spend to MOF + BOF as retargeting audiences build. By month 3, over half the budget targets mid + bottom funnel, where pipeline converts.
$800K pipeline. ~$200K projected ARR.
Monthly ramp
Key assumptions
Revenue lags pipeline by 3 to 9 months. The ~$200K includes Q1 SQLs that close in Q2/Q3. Q1 success = qualified pipeline that progresses, not deals that close.
What proves this is working, and by when.
Early validation
- High-intent traffic on product + architecture pages
- Engagement from ICP accounts (not raw volume)
- Technical content engagement depth
- Growth in branded search volume
Evaluation behavior
- Demo requests from ICP accounts
- MQL → SQL conversion rate growth
- Higher conversion from interactive experiences
- Multiple stakeholders from same account
I don't shut campaigns down based on short-term conversion metrics alone. In cybersecurity, intent formation takes time. The order is always scale → optimize → kill, never the reverse.
Double down on what's clearly working.
- SQLs and qualified demo requests from ICP
- Fast movement: awareness → evaluation
- Higher demo conversion from retargeting + product experiences
- Shorter time-to-demo from target accounts
Before killing anything, fix it first.
- Refine targeting and ICP filters
- Iterate creative and landing experiences
- Reroute mid-funnel to interactive CTAs
Only after optimization has had a fair shot.
- Low ICP-match traffic, persistently
- Demos without technical urgency
- High CPL with no downstream progression
- No evaluation behavior in 60 to 90 days
Account progression, not last click.
Top accounts by progression
Pipeline by month
SQL Pipeline- SQL creation from ICP accounts
- Multi-stakeholder engagement within target accounts
- Repeat high-intent behavior across sessions & channels
- Pipeline influenced by inbound touchpoints
- Opportunity creation & pipeline growth
- Raw lead volume
- MQL counts without downstream progression
- Vanity metrics (impressions, clicks) without pipeline impact
- Single-touch attribution models
Two defaults to deliberately skip.
Non-intent scale channels as primary engine
Meta and TikTok aren't where security buying committees research. The buyer signal isn't there. Spending here optimizes for the wrong audience.
Pushing cold audiences straight to "Book a demo"
A demo pulls in architects, SOC leads, procurement. Asking before trust exists positions the brand as aggressive. Lower-commitment, higher-credibility entry points first.
"Talk to a Cloud Security Expert" as a mid-funnel CTA.
A practitioner conversation, not sales. A real cyber expert listens to the buyer's architecture and pain, brainstorms possible solutions, including ones that aren't Sweet.
It builds trust and credibility, and dramatically lowers the activation energy for the eventual demo.
Three risks. Three assumptions. Three week-1 tests.
Sales cycle outruns the quarter
Enterprise cyber cycles can exceed 3 months, limiting visible SQL-to-close conversion in Q1.
Smaller-than-expected in-market pool
Active runtime security buyers may be a narrow slice. Pipeline ceiling becomes a market-size problem.
Weak retargeting intent depth
Remarketing audiences may not reach evaluation-stage intent fast enough for M3 BOF efficiency.
Active search demand exists for runtime security
If search volume is too low, the whole capture layer fails.
Interactive experiences beat static content
If not, the product-led motion collapses.
SQL conversion is truly multi-touch
If single-touch dominates, the attribution model needs rethinking.
What was hardest,
and what I'd want to know in week 1.
The hardest part of the brief was balancing short-term pipeline expectations with the reality of how enterprise cybersecurity buyers actually buy. Building a traditional SaaS media plan around lead volume is easy. Building one around trust formation, technical validation, and long evaluation cycles, inside a 3-month window, is not.
So I spent most of the time thinking less about channels and more about buyer behavior: where runtime security demand actually starts, what creates enough urgency for a demo, and how to prioritize signals of real evaluation intent rather than passive engagement.
In week 1, before scaling spend, I'd want to understand:
- Where inbound currently breaks down
- Which channels historically influenced real opportunities
- How technical buyers engage before becoming SQLs
- Whether the main gap is awareness, trust, or conversion efficiency
That context turns a generic B2B demand playbook into a plan that optimizes around how Sweet's buyers actually buy.
Thank you.
Excited to dig in on the questions. The assumptions are where this gets interesting.