Cyber Security Marketing Playbook

The enterprise infosec and cyber security industry is a staggering $376B by 2029, but it’s an increasingly competitive space.

After more than 6 years of work as a cybersecurity marketing agency, we’ve built a successful cybersecurity playbook example for customer acquisition that consistently gets results in building top-of-funnel leads and nurtures them through to closing.

I’m excited to share the customer acquisition strategies, user targeting, keyword research, marketing messages, offers, and design tactics that have helped our cyber security clients to deliver massive results.

Table of Contents:

1. Clarifying What a “cyber security company” is
2. Why Cyber Security Marketing is Super Hard?
3. Knowing Your Customers and ICPs for Audience Targeting
4. Choosing Your Marketing Channels and Budget Allocation
5. Marketing Messages, Creative & Ad Copy
6. Landing Pages and Offers
7. Nurture and Upgrade
8. Wrapping it Up

Clarifying What a “cyber security company” is

Any company that’s in the business of handling security infrastructure could be considered a cybersecurity company.

This could include a litany of security-related sub-industries:

• Data Security
• Cloud Security
• Endpoint Security
• Network Security
• Email Security

Why Cyber Security Marketing is Super Hard?

It’s not the simplest solution to sell for a whole host of reasons…

• Software engineers don’t like ads or sales outreach. They don’t like being sold to and 100% of them have ad blockers enabled. Forget about pushy sales tactics or lazy ad campaigns working on these folks.
• It’s damn expensive. Expect to pay $10, $20, or sometimes $30 just for a click on Google Ads or LinkedIn Ads in this coveted audience.
• It’s complicated. It’s easy to understand t-shirts or home repair services, not everyone can wrap their head around a cyber security platform. It’s not necessary to be a data engineer as a marketer, but understanding the challenges a customer faces and how your solution works is key.
• There are 2 buyers to win over. There is the end-user who is a security engineer, and there is the tech exec who holds the budget. Both have different priorities and both need to be bought in.

Knowing Your Customers and ICPs for Audience Targeting

Our recent blog on ICP creation for B2B marketers goes into great detail about building your ICP (ideal customer profile – or target audience) but I’ll provide an overview version here. Once we have the ICP built, we’ll use this for sales and marketing activities including:

• Sales outreach list building
• Linkedin Ads audience targeting
• SEO content creation
• Google Ads keywords consideration
• PPC landing page messaging
• Offer and funnel development

One of the challenges of marketing for cyber security solutions is that, as mentioned above, you have 2 buyers: the tech exec and the end-user engineer. With that in mind, you want to create an ICP for each.

And beyond that, you’ll have multiple ICP’s segmented by industry, company size, location, and possibly other criteria.

Let’s start with just one audience and build the tech exec and end-user engineer.

The Tech Exec ICP

New security investment discussions can start at the top or the bottom. But generally, if tech leadership is bought in, the deal is done. Let’s build this user profile, note that depending on your cyber security solution that can vary wildly but below is a fairly broad list of people who handle data.

Job Titles: CTO, Director of Engineering, CISO, Chief Data Officer, Chief Information Officer, Data Protection Officer, VP of IT, Head of DevOps, Engineering Team Lead

Most enterprise-level security companies are in these regions but again, definitely refine this for your company. If your budget is smaller, even just start with only the US or specific regions of the country where your customers are most likely located.

Locations: US, Canada, UK, Australia

Select a company size and revenue level that is ideal for your solution.

Company Size: 50 to 200 employees

Revenue: $10M to $100M

Remove non-buyers from targeting to save the budget.

Exclusions: current customers, your company employees, your career page visitors, competitor companies, current deeper funnel leads (if this is a top-of-funnel campaign)

Other more specific company criteria that necessitate your data solution:

• Relevant tech stack users (eg, AWS, GCC)
• Industry (eg, Healthcare, Retail)
• Data sensitivity level
• Users of an inferior competitor

What’s important to them:

• Low-risk, proven, reputable solution and provider
• Price and value
• Helps them achieve their department performance goals

The End-User Developer

Job Titles: Software Engineer, Database Engineer, Developer, DevOps Engineer, Cloud Architect, Data Architect, Data Protection Officer, Software Application Engineer

This is where you can reach the more generic job titles with relevant roles.

Member Skills: cyber security, security networks, DevSecOps

Job Functions: IT, Engineering, Research, Operations

Note: Company/Location/Exclusion data is the same as the Tech Exec level

What’s important to them:

• Achieve the data-related result your solution offers
• Ease of use and implementation
• Level of support
• How it’s technically better than their current solution

Exclusions!

Be sure to also set up exclusions for users like: employees, existing customers, competitors, cybersecurity marketing and PR or sales roles, and other non-buyers.

Choosing Your Marketing Channels and Budget Allocation

Where should you focus your marketing efforts? There are a few baseline channels nearly every cyber security marketer should start with.

These are your “performance marketing” or “direct response” channels that generate qualified leads almost immediately and efficiently.

I’m talking about Google Ads, LinkedIn Ads, and SEO.

Google Ads

Google Ads are most effective when your solution category is widely known, and even better when your brand has some awareness already. If your solution is a brand new category, then users won’t be actively searching for it yet – in which case you can still run some Google Ads but it won’t be your biggest digital marketing channel.

The primary components of Google Ads are keywords, ad copy, bidding, budgeting, campaign structure, and landing pages.

Keywords

Choosing the right keywords is the foundation of a successful paid search program. This is highly specific to your cyber security solution so I’ll list a few methods to find keywords and universal keyword types.

The objective is to find relevant, affordable, winnable competition, conversion-intent queries.

Keyword Research Methods:

• Simply brainstorm keywords and create a list of what customers would be searching to find you.
• Review your organic ranking terms in Google Search Console
• Use Google Keyword Planner or a tool like Ahrefs for suggestions, search volume estimates, competition level, and projected cost per click.
• Competitor keyword list analysis using SEMRush or SpyFu.

Universal Keyword Types

• Brand – protect your brand by bidding on it (eg, Materialize, Materialize Database Tool)as well as owned production solution names. Pro tip: be sure to register your brand name trademark with Google to prevent competitors from using it in their ads.
• Competitors – intercept relevant competitor search traffic by bidding on variations of their brand (eg, Oracle alternatives, Oracle competitors, Oracle pricing, Oracle reviews) and negative match terms like login, and customer support.
• Niche Solution – the most specific term to what your main cyber security offering is (eg, cloud-native security, pen testing, etc)
• Niche Problems – the main challenge that your solution solves (eg, faster database, secure third-party data)
• Niche Events – if your audience attends a major conference specific to your industry, then bidding on those terms can be affordable and relevant (eg, KubeCon, AWS reInvent, RSA conference)

Bidding

Each click on Google is a little auction between the advertisers on that search term. The higher your bid – and quality score, the better chance you have of ranking at the top and earning that click.

There are 11 bidding strategies of writing this, see the Google Ads Bidding Strategies: The Ultimate Guide from AdEsspresso if you want to go into the weeds here.

1. Target CPA (Cost Per Acquisition)
2. Target ROAS (Return On Ad Spend)(Return On Ad Spend)
3. Maximize Conversions
4. New: Maximize Conversion Value
5. Enhanced Cost Per Click (ECPC)
6. Maximize Clicks
7. Manual CPC Bidding
8. CPM Bidding (Cost Per Thousand Impressions)
9. CPM Bidding (Cost Per Viewable Thousand Impressions)
10. CPV Bidding, (Cost Per View)
11. Target Impression Share Bidding

But generally speaking, here are some good rules to follow:

• Use Manual CPC or ECPC to launch new campaigns – Google Ads won’t have data to automate bidding when you start, so it’s algorithm can’t really work effectively. Find a reasonable CPC bid to start using the Keyword Planner Forecasting tool. Bid higher if you aren’t getting enough clicks or if CPA is below target, bid down if you’re getting too many clicks without conversions or the CPA is above target.
• Use Target ROAS to prioritize direct sales efficiency (after the campaign has at least 30 conversions) – set a target ROAS that is profitable and move it up or down depending on if you want more volume or efficiency.
• Use Target CPA to prioritize leads efficiency (after the campaign has at least 30 conversions) – set a target CPA that is profitable and move it up or down depending on if you want more volume or efficiency.

As a side note, Bing Ads is a channel to consider once you have Google Ads performing and scaled. It has a fraction of Google Ads search volume but is less competitive so clicks are cheaper. You can also clone your Google Ads account into Bing fairly easily so you don’t need to rebuild everything. Bing does particularly well for older demographic audiences.

LinkedIn Ads

LinkedIn is where B2B marketing happens. It’s an engaged, business-minded platform that’s built for support efficient ad programs.

However, it’s not cheap. In fact, it’s damn expensive. Your tech exec audience is probably going to be in $15+ CPC range. That means every click needs to have a high chance of turning into a lead, and every lead needs to be qualified and have a change of turning into a meeting and deal.

The secret sauce to successful lead gen on LinkedIn is audience targeting and segmentation with robust remarketing.

The good news is, we already covered ICP creation earlier. So you simply need to apply the audiences you created into the LinkedIn Ads platform to get up and running. And as we also already covered, you can segment by criteria like:

• Geographic location
• Experience level or role and member skills
• Industry
• Funnel offer

We’ll get more into LinkedIn Ads messaging in the marketing message section below.

SEO

General SEO best practices still apply here with the need to optimize 3 main pillars:

• On-page – keyword research, content optimization, and content creation
• Off-page – link-building both internal and external
• Technical – ensuring your site is easily understood by search engines, optimally indexed, and loads quickly

More specifically to the cyber security industry, creating the right type of content is crucial to the success of an SEO program.

There are a few categories of content to create for SEO:

• Informational industry posts – these attract link equity and generate new user traffic. These can include blogs, glossary pages, ultimate guides, and how-to guides.
• Thought leadership posts – earn social shares and reach the tech execs
• Product/Service/Solution pages – these are where the real leads come in
• Docs pages – highly trafficked by software engineers and help with brand domination

The process for SEO content creation begins with keyword research and much of it was touched on in the Google Ads section. But unlink Google Ads keyword research, SEO is where you can also focus on more informational keywords along with the transactional searches.

And one other keyword research method for SEO is called “striking distance keywords. These are the terms that your website and pages already rank on. It’s easier to move up from say rank 12 to rank 1 than from rank 1,000 to 1. These are usually where to start when planning SEO priorities as they will yield results fastest.

When you’re creating SEO content, always start with SERP analysis. Meaning reviewing the Google search engine results page to see what type of content ranks highest. It could be “what is” posts, product pages, docs pages, videos, best-of lists, or something else. Whatever the format, that is was Google prefers for top-ranking content so likely what you’ll need to create.

As you plan the page to create, use an SEO content brief to outline the important on-page elements including H1, Meta title, URL, and so on. Planning the content sections by evaluating competitors and using a tool like Surfer can also be helpful. 

Awareness Digital Marketing Channels

Once you have the big 3 direct response channels chugging along, you can consider increasing awareness channels if you have the capacity to manage multiple online campaigns.

Cyber security companies can put their brand and marketing messages in front of detailed customer profiles through programmatic display ads (eg, Choozle), tech site placements (eg, The New Stack, Stack Overflow, TechTarget), and contextual ads (eg, Outbrain, Taboola).

Marketing Messages, Creative & Ad Copy

A strong, relevant, intriguing marketing message will hook your target audience to engage and click your ads.

Let’s break this down by paid search ads and paid social ads:

Paid Search Ad Copy

Search ads are short and need to give the searcher enough information that your page has what they’re looking for. We meticulously organize keywords into themed ad groups so that we can create highly customized, relevant ads that jump out to users.

Here’s an example. When a user Googles for a specialized “time series database”, our client InfluxData dominates the ads – also using the space-taking site links pushing AWS below the fold.

The best-performing ads include:

• The search term in the headline
• A strong call to action (eg, Start a Free Trial, Get a Demo, Download Our Guide to IoT Data Monitoring)
• A descriptive summary of what you offer to attract relevant clicks and dissuade crap clicks.
• As many relevant ad extensions as possible.
• High relevance and tailoring to the user’s search

Paid Social Media Ad Copy

On LinkedIn and potentially other social media ad channels, you can incorporate a visual along with your text ads. Keep in mind that the graphic is more impactful on the results than the text in most cases.

LinkedIn has a number of ad formats available but we primarily focus on just 2: Lead Gen Form Ads (80-90% of budget) and Conversation Ads (10-20% of budget).

Lead Gen Form Ads are our preferred ad format to drive new leads and can also help nurture leads. They are low-friction since the ad and form submission are self-contained (there is no landing page).

Let’s take a look at an example for our client SingleStore.

The best-performing ads include:

• Bold, contrasting colors and visuals
• A strong call to action (eg, Start a Free Trial, Get a Demo, Download Our Guide to IoT Data Monitoring)
• A descriptive summary of what you offer to attract relevant clicks and dissuade crap clicks.
• As many relevant ad extensions as possible.
• High relevance and tailoring to the user’s search

Go deeper with LinkedIn Ads and see 141 examples in this monster post from B2BHouse.

Landing Pages and Offers

Landing Pages

Too many marketers don’t consider the landing page part of their domain. Big mistake. It’s a key component of the conversion funnel and even the best ad campaigns don’t work if the landing pages don’t turn traffic into hot leads.

But to summarize here, the main things to include on your landing page are:

• Just like your ad copy, the landing page is tailored to the keyword and/or user visiting the page.
• A great headline, sub-heading, and button that tell them (1) what you do (2) why they need it (3) how to get it – call to action.
• A problem-solution-result paragraph that tells them you know what is irking them, how you can solve it, and how their life gets awesome afterward.
• Use client logos, testimonials, and/or badges for instant credibility

Here is a good landing page example for our client, DataStax for users searching for a NoSQL database:

Offers

Now, you may be disappointed to know that every lead isn’t ready for your hour-long sales meeting. You have to warm them up to build trust and show them what you can do before they’ll commit time to explore your solution further.

Offers should align with funnel levels, each one being more engaging and close to closing.

• Top of Funnel – informational downloads, reports, whitepapers, guides
• Middle of Funnel – webinars, case studies
• Bottom of Funnel – product trials, demos, sales meetings

Just like everything else to this point, the more relevant and tailored to the prospect that the offer can be, the more likely they’re to convert.

Nurture and Upgrade

Retargeting users throughout the funnel is one of the best ways to nurture them through digital marketing using all the data you’ve collected.

But don’t just create one retargeting tool. Segment it by the page they visited, the level of engagement, and demographic data where possible.

By segmenting, you can then serve them an ad and offer that aligns with where they are.

Many of our clients offer a free trial or open-source version (free). Upgrading these users to a paid or hosting plan is where they generate revenue. So creating a campaign to focus on your free users is an easy win.

You’ll want to create a funnel landing page that highlights the benefits of the upgrade. 

Wrapping it Up

 Marketing cyber security has a lot of moving parts and things to get right. From reaching the right people to serving them a strong ad message to giving them an offer they can’t resist.

We’ve covered how cyber security marketers can achieve all 3 of these tasks. But if you’d like to work with a partner that’s generated thousands of B2B tech customer leads then schedule a discovery call today.