How to position a cybersecurity startup

Positioning a cybersecurity startup means deciding, in language your buyer already uses, which problem you solve, who you solve it for, and why you are the credible choice over the alternative they would otherwise pick. It is a decision made from four inputs and tested against real customers rather than settled in a leadership workshop.

Here is the test that matters. A prospect sits through your pitch, likes it, and then has to explain your company to a colleague who was not there. If what comes out of their mouth is generic, your positioning is not working, however good the deck was.

Why security positioning fails

• Feature parity. In a mature category, whether that is endpoint, GRC, or resilience, everyone ships the same capability list within two quarters, so the list cannot be the difference.
• Vocabulary collapse. Platform, end-to-end, AI-powered, and single pane of glass now carry no information for this buyer. They are filtered out on sight.
• The wrong audience. Positioning written for analysts and investors instead of the practitioner who has to defend the purchase internally.
• Too many audiences at once. A message stretched to cover the CISO, the GRC lead, and the board says nothing precise to any of them.

The four inputs

Positioning is a decision made from four things, in this order.

• The problem, as the buyer experiences it. Not the technical gap, the operational consequence they get asked about by someone senior.
• The real alternative. Usually not a competitor: a spreadsheet, a services firm, an internal team, or doing nothing for another year.
• The proof. What has to be true for a skeptical practitioner to believe you, and what evidence you can actually produce today.
• The language. The words your best customers already use, taken verbatim from calls rather than invented in a workshop.

Everything else, including the category question, follows from those four. Deciding the category first is how companies end up defending a name nobody asked for. We covered that in naming a category.

The traps

Three specific traps show up repeatedly in security, GRC, and resilience startups.

Positioning against the giant. Defining yourself as the alternative to the market leader makes them the reference point and you the footnote. It also borrows their credibility on terms you do not control, which we wrote about in the danger of a positioning loan.

Positioning on the threat. Fear moves attention, not budget. A buyer already knows the threat exists; what they lack is a defensible reason to spend on your response to it rather than someone else’s.

Positioning on the roadmap. Claiming what the product will do next quarter puts your credibility on a schedule you will probably miss.

A test you can run this week

• Ask five customers why they chose you, in their words. Record the phrasing.
• Ask sales what they say when a prospect asks how you are different. Compare it to the site.
• Read your homepage headline and ask whether a competitor could put their logo on it. If they could, it is not positioning.
• Ask a prospect to describe you back to you after the call.

The gap between those four answers is your positioning work, and it is usually more specific and less grand than the leadership team expects.

If you do not have five customers yet, or the market shifted and the customers you have bought a different product than the one you now sell, run the same exercise on the people who did not buy. Non-buyers and stalled deals are more informative at that stage, because they show you where the fit is missing instead of confirming a fit you already have.

When positioning becomes a category question

Sometimes the honest finding is that no existing category holds what you do, and the buyer has no budget line for it. That is a category creation problem, which is a longer and more expensive road. The conditions that justify taking it are in category creation in cybersecurity.

Questions people ask

How long does positioning work take?
Four to eight weeks for a company with customers to interview. The interviews are the constraint, not the writing.

Who should own positioning in a startup?
The founder or CEO decides it; marketing articulates and defends it. Positioning delegated entirely to marketing tends not to survive the first sales objection.

Do we need a new category to stand out?
Usually not. Most companies win by being unmistakably specific inside an existing category the buyer already funds.

How do we position for both practitioners and the board?
One problem statement, expressed in two registers, with the same underlying claim. Different messages for each audience is how companies end up sounding like two companies. More in one message, fragmenting market.

Related

• Naming a category — when the name is the work.
• Positioning for many audiences — practitioners, buyers, boards.
• Case study: WorldSafe — brand and GTM built from scratch.
• Case study: iluminr — Capability Intelligence, named and recognized.
• Positioning and narrative as a service — how we run this work with companies.