6 Counter-Intuitive GTM Lessons from ForAllSecure’s Cybersecurity Journey

Fear sells in cybersecurity. Or does it? In a recent Category Visionaries episode, ForAllSecure founder David Brumley revealed how rejecting industry marketing conventions helped drive their growth. Let’s unpack six key go-to-market lessons from their journey that challenge conventional wisdom.

1. Technical Credibility Trumps Fear-Based Marketing

While most cybersecurity vendors lead with breach horror stories, ForAllSecure took the opposite approach. “The biggest thing that we do when we go in is we don’t try to use fear,” David explains. Instead of playing up catastrophic scenarios, they focus on building trust through radical honesty about their capabilities.

“We’re never going to tell you that we found every issue. People who do are flat out lying to you,” David notes. “But for us, our goal is just to every time we tell you something, we can show you an actual exploit, we can prove it.” This transparency-first approach particularly resonates with companies where security directly impacts operations.

2. Embrace Early Criticism as Market Education

When ForAllSecure published their groundbreaking research in 2010, they faced significant industry pushback. “I remember sweating over Christmas once as a very famous security person in the enterprise space was making fun of the work,” David recalls. Rather than getting defensive, they focused on proving their technology through achievements like winning DARPA’s Cyber Grand Challenge.

The lesson? When pioneering new approaches, criticism often indicates you’re challenging valuable assumptions. David’s advice: “Don’t spend a lot of time actually looking at what other people say… The more time you look at what other people are saying, the more time you’re sinking into something that’s not bringing value to you or your company.”

3. Find Your Natural Market Through Usage Patterns

Instead of trying to serve everyone, ForAllSecure discovered their ideal customers through actual usage patterns. “When you look at our customers, like Cloudflare and Roblox, a hack brings down their entire business,” David shares. “If someone takes down a Cloudflare node, they’re not making money.” This insight helped them focus on companies where security and business operations are inseparable.

4. PLG Can Accelerate Enterprise Sales

ForAllSecure’s shift to product-led growth yielded unexpected benefits beyond bottom-up adoption. “The other kind of unexpected advantage of the PLG Motion is it just reduces the time for those enterprise customers to do a pilot because often they’re already using it,” David explains. This hybrid approach helps bridge the gap between purchase decision and implementation.

5. Engineer Buy-in Matters More Than You Think

The PLG transition revealed an overlooked internal dynamic. “The typical engineer never saw the results of their work at our company,” David notes about their previous model. “They released a new feature would go out and then CS would take it and release it to the enterprise customer.” Direct customer visibility through PLG boosted engineering engagement and product quality.

6. Don’t Let Analysts Define Your Category

Rather than trying to fit into analyst-defined categories, ForAllSecure focused on technical differentiation. “I think that the categories are really defined by the analysts, and the analysts really don’t know what they’re doing,” David candidly shares. Instead, they invest in educating analysts about “what are the real differences between the tech out there and why one might succeed and one might not.”

The Bigger Picture

ForAllSecure’s journey challenges several common B2B GTM assumptions. Their experience suggests that in highly technical markets:

• Radical honesty can outperform fear-based marketing
• PLG and enterprise sales can be complementary rather than competitive
• Category creation matters less than genuine technical differentiation
• Internal stakeholder buy-in is as crucial as customer adoption

Their land-and-expand metrics validate this approach. As David notes, “I don’t think we’ve had anyone reduce the size of mayhem.” The key lesson? Sometimes the best GTM strategy is simply being ruthlessly honest about what you can and cannot do, while ensuring your technical capabilities back up every claim.

For B2B founders, especially in technical markets, ForAllSecure’s experience suggests that challenging industry marketing conventions while doubling down on technical excellence can create powerful differentiation. The trick is having the courage to maintain this stance even when it goes against established industry practices.