All case studies
Case studyCybersecurity servicesEnterprise B2BTwelve months

Yearly pipeline from USD 548K to USD 2.2M in twelve months

An enterprise cybersecurity services firm with a strong delivery record and no marketing function. Codax ran its growth department for twelve months and moved it from referrals to a system that produces four times the pipeline.

USD 2.2M

Yearly qualified pipeline, from USD 548K

61 / 35

Accounts engaged / into qualified pipeline

20 → 77

AI visibility score, out of 100

+74%

Combined audience, 28,500 to 49,681

At a glance

From a referral pipeline to a system that produces four times the volume

The situation

A security services firm with 50+ services, a Google Cloud partnership and no marketing function. USD 548K a year in pipeline, all from referrals and the founder's network.

The approach

One senior lead accountable for qualified pipeline. A month of assessment, three months of repair, content built from existing proof, and every channel tested before it got budget.

The impact

USD 2.2M yearly pipeline at month twelve. Site score from 51 to 80, AI visibility from 20 to 77, and a combined audience up 74 percent.

01 The situation

Strong capability that buyers could not see

The firm sold considered, multi-stakeholder security services and had never built a demand function. Every strength existed only in the room, and the firm rarely got into the room.

Exhibit 1. The client at the start

BusinessEnterprise cybersecurity services. 50+ services across security operations, cloud security and AI security.
CustomersEnterprise and upper mid-market, mostly banking, SaaS and insurance. Multi-year relationships, low churn.
BuyersTwo people on every purchase. The CISO judges capability, the CIO approves budget and risk.
PartnershipGoogle Cloud partner with Security Operations Service Delivery Expertise, among the earliest globally.
Route to marketFounder-led. Referrals and partner introductions. No marketing team, no outbound, no owned audience.
Pipeline at startUSD 548K a year, arriving irregularly, with no forecast.

Source: Codax assessment, month one

Exhibit 2. Five gaps kept those strengths from creating demand

GapWhat we foundEffect on the buyer
WebsiteScore 51 of 100, eight critical issues, 50+ services with no industry navigation, no tracking.The site did not match the firm's standing
PresenceFounder profile with 14,000 followers and no posting rhythm. No newsletter.Nothing to follow and no reason to return
Search and AIAbsent from category searches. AI visibility 20 of 100.Not on the shortlist buyers form before contact
PartnershipGoogle designation held but never marketed.Google had no reason to prefer the firm
InfrastructureNo CRM discipline, no lead definitions, no sending domains, no account list.No way to run or measure a campaign

Source: Codax assessment, month one

The brief from leadership

Make the firm visible at the standing it had already earned, then build a demand system the business could plan around. Measured on qualified pipeline agreed with the head of sales.

USD 548K

Yearly pipeline at the start

1

Person whose calendar capped growth

02 The approach

One team replaced five hires

Codax ran the whole function under one senior lead, inside the client's operating rhythm, and asked for about three hours a week from the client.

The Codax team, under one accountable lead

  • Growth leadOwns the pipeline number, runs the pipeline review, moves budget across channels
  • ABM and outbound leadAccount lists, buying-committee maps, sequences, reply routing
  • Content leadFounder voice, whitepapers, case studies, newsletters, webinars
  • Design and webBrand system, site, landing pages, campaign creative
  • Marketing operationsCRM, routing, tracking, dashboard

Exhibit 3. Three months of repair came before the first outbound sequence

M1M2M3M4M5M6M7M8M9M10M11M12
1 Assess
2 Fix
3 Build
4 Test
5 Scale

Nothing is sent until the foundation can carry it. Nothing is scaled until a test has shown it converts.

03 The work

What was done, phase by phase

The five phases overlapped by design. These are the decisions and results that mattered in each.

1

Assess

Month 1

A month inside the business before anything was built. Revenue, sales calls, delivery, customers, accounts, competitors and the technical stack were all reviewed.

Four findings set the plan for the year

01

Two buyers, not one

The CISO and the CIO ask different questions, so the plan ran two content tracks and two newsletters.

02

Existing proof was unused

The team, the customers and the delivery record became the case studies, the industry pages and the proof in every message.

03

The partnership was the biggest unused asset

The rare Google designation went to the centre of the content, events and partner programme.

04

Fix before outreach

Outbound to security leaders fails if the destination does not hold, so three months went to repair first.

2

Fix

Months 2 to 4

The site was rebuilt to pass a buyer's due diligence, and everything a campaign depends on was put in place first.

51 → 80

Site score, out of 100

8 → 0

Critical site issues

+79%

Monthly visitors, 2,800 to 5,000

Website

Full rebuild with service pages, industry pages for banking, SaaS and insurance, and tracking from day one.

Founder profile

Rewritten to the CISO's problem, with a weekly publishing rhythm.

Brand system

One identity across site, collateral, ads, email and events.

CRM and routing

Stages, lead definitions and alerts on every positive signal, agreed with sales.

Sending infrastructure

Secondary domains and six weeks of warming before the first sequence.

Sales collateral

Capability deck, one-pagers and industry pages from one story.

3

Build

Months 3 to 6

Existing proof became a content and inbound engine, with an asset for each buyer, and the Google partnership became a channel of its own.

AssetWhat it wasIts job
Case studiesCustomer interviews written as case studies and proof statementsUsed in ads, outreach, sales follow-up and the site
Report for security leadersA gated report on running a modern security operations centreAnchor for the CISO track and webinars
Playbook for CIOsA cyber risk playbook for the second buyerAnchor for the CIO track
Founder contentWeekly posts from a monthly recorded interviewProfile engagers fed to outbound
Two newslettersMonthly, one for security leaders and one for CIOsSubscribers from 0 to 5,119 and from 2,000 to 6,317

The Google partnership

The designation went on the site, the founder profile and every partner directory. Content and executive sessions were co-hosted with Google for CIO and CISO audiences.

USD 132K

Yearly partner-sourced pipeline

3

Executive sessions co-hosted with Google

4

Test

Months 4 to 8

Each channel was introduced as a controlled test of four to six weeks, against the same account list. Budget followed the result.

What was testedThe testResult and decision
SectorBanking, SaaS and insurance, same offerBanking and SaaS replied at twice the rate. List depth doubled in both
OfferSecurity operations outcome against general servicesSecurity operations won. Every sequence and ad moved to it
SenderFounder-signed against company-signed invitationsFounder-signed drew three times the CISO acceptances
AdvertisingFounder ads against company page adsFounder ads at 2.4 times the click-through
WhitepaperGated against ungatedGated produced three times the qualified conversations
Webinar topicSOC operations against compliance readinessSOC drew twice the CISO registrations

One quarter, one campaign

A single story built around the security operations report, run across outbound, LinkedIn, email and retargeting against one account list, with every touch pointing at one booking flow.

410

Report downloads

24

Discovery calls

USD 364K

Qualified pipeline added

5

Average touches before the first call

8 in 10

Qualified opportunities touched by three or more channels

41 days

Median from first touch to first meeting

USD 247K

Yearly pipeline from events

5

Scale

Months 7 to 12

From month seven, budget and volume moved to what had converted. Every scaling decision traced back to a test.

DecisionWhat changedBased on
Focus on two sectorsList depth doubled in banking and SaaS, insurance held at low volumeSector test
Founder as the senderAll invitations, sequences and paid social moved to the founder's nameSender and advertising tests
Paid aligned with outboundLinkedIn reach pointed at the titles outbound was working that weekJourney analysis
Fixed publishingFounder and company page weekly, two newsletters monthlyReputation and inbound data

04 The impact

Yearly qualified pipeline grew from USD 548K to USD 2.2M

Exhibit 4. Yearly qualified pipeline, USD

548K
Start
1.07M
Month 6
1.69M
Month 9
2.21M
Month 12

Source: CRM, as reported with the client's head of sales. Yearly pipeline is quarterly qualified pipeline multiplied by four.

Where it comes from

Referrals continued throughout. On top of them came outbound against the account list, webinars and executive sessions, inbound from search, AI answers and newsletters, and Google partner referrals.

What counts

A scoped need, a named budget owner and a next step recorded in the CRM. Reported from one dashboard shared with the head of sales.

Exhibit 5. From thousands of accounts researched to 35 in qualified pipeline

Thousands

Researched

Profiled against the ICP, then narrowed to the working list.

61

Deeply engaged

Several interactions across channels and a meeting with the buying committee.

35

Qualified opportunity

Scoped need, named budget owner and a next step in the CRM.

Exhibit 6. The audience grew 74 percent, and it belongs to the client

MeasureStartMonth 12Change
Site score, of 1005180Above the 75 average for top sites
AI visibility, of 1002077Named in Google AI answers
Monthly site visitors2,8005,000+79%
Founder followers14,00019,245+37%
Company page followers12,50019,000+52%
Newsletter, security leaders05,119Launched month three
Newsletter, CIOs2,0006,317+216%
Combined audience28,50049,681+74%

Source: Codax site audit, LinkedIn and newsletter data

Exhibit 7. Results arrived in the order the method predicts

  1. Month 1Assessment complete. Account list agreed with sales. Plan signed off.
  2. Month 3Site live. Founder publishing weekly. Newsletters launched.
  3. Month 4First sequences live. Sector and offer tests begin.
  4. Month 5First marketing-sourced qualified opportunity.
  5. Month 6Yearly pipeline USD 1.07M. Budget moved to banking and SaaS.
  6. Month 9Yearly pipeline USD 1.69M. Google AI search names the firm.
  7. Month 12Yearly pipeline USD 2.2M, produced on a predictable cadence.

Client perspective

“We had used agencies before and got activity reports. What was different here was that they spent the first quarter fixing things I would have told them to skip, and then gave me a pipeline number my head of sales actually agreed with. Twelve months on, most of our first conversations are with people who already knew the firm. I would not say it was fast. I would say it worked, and it is still running.”
Founder and PresidentEnterprise cybersecurity services firm
“The first time a CISO referred to our SOC report before I had said anything, it was clear the system was working.”
Head of Sales

Next case study

USD 1.02M ARR closed from LinkedIn and email, channels that had produced none

AI healthcare, seven months

Read the case study

Start here

Every engagement begins with an assessment of what is already running

Findings shared in full, with a prioritised repair list, before anything is agreed.

What you receive

  • A written report of everything found
  • A prioritised repair list
  • A first read on the account list
  • A recommended plan across the five phases
Start with an assessment