How a Marketing Team of One 4.7×’d Demand-Gen Sourced Pipeline While Getting 3× More Efficient

At a glance

• 4.7× demand-gen sourced pipeline over four quarters
• ~300% improvement in pipeline-per-spend efficiency
• Rebuilt the engine from “demo-request-only” into a full-funnel system: clean targeting → demand creation → demand capture

The Overarching Challenge

When Timo joined in February 2024, Cyberhaven had been without a demand owner since November 2023.

The engine wasn’t a cold start—but it was neglected.

What existed was a functional set of campaigns and historical data… paired with a strategy that wasn’t sustainable. The system was doing “things,” but it wasn’t compounding.

Timo diagnosed three root problems.

The 3 Root Problems

1) Over-invested in demand capture

The messaging assumed people were already aware, already in-market, and ready to request a demo.

That’s a short-term sugar high. It’s not a strategy.

2) Single-channel reliance (and it was the wrong single channel)

Internally, LinkedIn was viewed as “too expensive,” Google as “too erratic,” and Reddit as “good CPMs but hard to scale.”

So the org gravitated to Meta because it could produce leads cheaply.

But in cybersecurity—where quality matters and buyers are skeptical—cheap leads can quietly become expensive pipeline.

3) Sloppy marketing → sales handoff

If leads take forever to get contacted, if reps don’t know why someone converted, and if follow-up is manual chaos, you’re burning budget twice: once in ads, once in lost conversion.

The Key Realization: “Brand Consistency Won’t Earn Attention”

Timo’s take was blunt: A pretty image and catchy headline won’t earn a security buyer’s attention.

Value does.

This mattered because it changed what “good marketing” looked like inside the company. Instead of optimizing for on-brand assets and safe copy, the strategy shifted toward earning attention (demand creation) while still building a scalable capture motion.

The Strategy: A 3-Part System

Part 1 — Map Target Accounts + Clean Audiences (reduce waste)

Cut spend that was guaranteed to miss. Tighten the “learning universe.”

Part 2 — Demand Creation (earn attention)

Industry experts. Reports. Assets buyers would actually want even if they weren’t buying today.

Part 3 — Demand Capture (convert + be memorable)

Still capture demand—but do it in a way that breaks through. Not “AirPods like everyone else,” but creative incentives people actually remember.

This system took time.

Timo’s warning: if leadership expects a turnaround in one quarter, run. It was 2–3 quarters of rebuild, then the hockey stick.

Part 1: How Cyberhaven Cleaned Targeting (and Why Primer Mattered)

Timo started with a practical premise:

When you’re new to a business, it’s easier to be confident about what you don’t want than what you do want.

So he emphasized exclusions first, then refined inclusions.

What he did

1. Deep market research in data security
2. Compared research to existing audiences (which were “spray and pray”)
3. Cross-checked against historical closed-won—but with skepticism
   
   • Cyberhaven’s ICP had moved upmarket since 2021
   • Old wins didn’t fully represent the current enterprise target

The “dynamic exclusions” loop (the hidden efficiency unlock)

The core operational win was live, CRM-driven exclusions:

• If an account flips to an active opportunity, mark it out of prospecting
• If sales flags an account as competitor / not a fit, suppress it
• Keep exclusions updated automatically across ad channels

This eliminated weekly manual list work and reduced “we paid to advertise to deals already in motion” waste.

Why pre-visualization mattered

Instead of uploading and praying (then discovering in-platform that the audience is garbage), Timo used a workflow where he could see the audience summary before launch.

Then he iterated quickly based on outputs (e.g., “why is this geography even in here?”), not just inputs.

Part 2: Demand Creation That Security Buyers Will Actually Engage With

Cyber buyers don’t want your product one-pager. They want signal.

Cyberhaven leaned into two formats that created trust and built retargeting pools:

1) Webinars with real industry gravity

Examples included:

• Former CISO at a major security org discussing AI + perimeter erosion
• Early engineer from CrowdStrike discussing endpoint agents (high credibility topic)

The goal wasn’t “run webinars.” It was: borrow trust and create assets that don’t insult senior buyers.

2) Document ads (high-intent without the hard sell)

Document ads were a standout because they reduce buyer risk:

• Give a preview (3–5 pages) so the buyer knows it’s not fluff
• Front-load: a “hook” page (even a sexy graph—yes, he contradicted himself, intentionally)
  
  • a summary
  • table of contents
  • then real chapter content
    

That preview acts like a trust contract: “we’re not wasting your time.”

The evergreen asset rule (to protect you from junior SDR follow-up)

Timo’s safeguard for follow-up quality was simple:

Have a small set of evergreen, universally relevant assets that won’t offend a senior practitioner if an SDR shares them.

For Cyberhaven, that included:

• High-credibility expert sessions
• Proprietary insights (e.g., annual AI adoption + risk report based on observable data, not survey vibes)
  

Part 3: Demand Capture That Converts and Sticks

Cyberhaven used incentives—but with discipline.

The reality on incentivized leads

Timo didn’t pretend incentives magically preserve quality.

They don’t.

What changed:

• Traditional demo ads: $850–$1,200 CPL (after accounting for layered retargeting costs)
• Incentive-driven ads: started around $150 CPL, then climbed and plateaued ~ $600 with saturation
• Conversion rate drop:
  
  • Baseline meeting → sales accepted opportunity: ~55%
  • Incentive leads: ~30%

The punchline: the math often nets out similarly—because the CPL delta is massive.

The guardrails

• Keep gift cards in the $25–$50 range
• Above $50, lead quality skews hard toward “gift hunters”
• Run incentives primarily at retargeting layers, not fully cold (unless you’re intentionally filling the database)
  

The “memorable” layer (where it gets fun)

They ran “crazy” giveaways (paintball guns, flamethrowers—limited batch, with liability waivers).

Not because it’s a gimmick.

Because it creates recall.

People literally came up at conferences remembering the campaign.

Some deals re-engaged 9–14 months later referencing those incentives.

That’s not a CPL story. That’s a mental availability story.

The Funnel Architecture (with real audience sizes)

Cyberhaven ran a 3-layer retargeting system:

Cold (Primer ICP audience)

• ~50,000 people

Retargeting Layer 1 (engaged with cold ads)

• ~10,000–15,000 people

Retargeting Layer 2 (high intent: engaged with mid-funnel content)

• ~2,000–4,000 people
• This is where most demo + capture ads ran

This matters because it prevents the classic failure mode:

You can’t scale by blasting the same demo ad at the same 2–3k people 20 more times. You scale by feeding the top so the bottom stays fresh.

Budget Allocation (and the “don’t cut awareness” lesson)

Timo allocated unusually top-heavy:

• ~40% top-of-funnel
• ~40% mid-funnel (docs, webinars, content retargeting)
• ~20% bottom-funnel capture
  

Leadership once forced a reduction in awareness spend (40% → ~20%). It nuked pipeline with a lag.

Timo’s early warning system was the retargeting pool itself:

• Layer 2 (30-day) shrank first
• Layer 1 (60-day) declined next
• Pipeline impact followed
  

Channel Notes (what worked where)

Meta

Strongest fit for audience matching + scaling, especially with clean ICP/exclusions.

LinkedIn

Helpful for validation + layering native filters on top of Primer-built audiences. Also solves the “LinkedIn doesn’t have the exact title/category we need” issue.

Google

Timo’s view: mostly demand capture (search). Match rates and platform dynamics made customer match audience approaches less reliable for their use case.

Sales/SDR Operationalization (what they actually did)

• Leads entered automated nurture + got added to retargeting pools
• SDR SLA was 24–48 hours initially (Timo hated it)
• Improved toward ~8 hours

The SDR playbook for mid-funnel leads was not “pitch.”

It was:

1. Understand why they engaged
2. Confirm pain
3. Offer the next best asset if they’re not ready
4. Run a stale revival dial-down every 60–90 days with context (“last time you cared about X…”)

In cyber, that non-pushy tone mattered.

The Outcome

Cyberhaven rebuilt demand gen into a system that compounds.

Not a set of campaigns.

Over four quarters, the results were:

• 4.7× demand-gen sourced pipeline
• ~300% improvement in pipeline efficiency (pipeline per spend)
  

And the qualitative win: demand capture stopped being the whole strategy. It became the end of a coherent funnel.

The Playbook in One Page

If you’re rebuilding demand gen with limited resources:

• Start with waste removal (audience hygiene + dynamic exclusions)
• Earn attention with credible content (experts + proprietary data)
• Capture demand with discipline (retargeting-first incentives, quality guardrails)
• Allocate budget to feed the funnel, not just harvest the bottom
• Treat retargeting pool sizes as leading indicators, not vanity metrics