Who buys this before it's a category, and how do I reach them?

You are selling a product for a problem your buyer has not ranked yet. Nothing about that resembles the sales funnel you will run later, because there is no demand to capture. Demand is what you are there to create. The early motion is narrower and more personal than anything that comes after it. You find the people already living with the symptom, you recruit a handful of them, and you turn what they say into the vocabulary the category will eventually use.

Sell the symptom, not the category.

You cannot generate demand for a name that does not exist, but the symptom already has sufferers. Lead with the incident shape, the thing the buyer's team lived through last quarter, described in their words rather than yours. The people who respond to that description are your market, whatever the analysts are calling the space this quarter.

Your early language does two jobs. The words your first customers use to repeat your pitch to their boss become the category's first vocabulary, and if you chose them well, the category ends up speaking your language. Write down what they say back to you.

Pick the segment that decides fastest.

You choose your first segment by how fast it decides, not by how big it is. A mid-sized company decides in a quarter. A large regulated one takes most of a year, and its yes is the start of a procurement process rather than the end of one. In our portfolio the companies that started mid-market learned their motion in two quarters and then moved up with a record. The companies that started with the largest logos spent the same two quarters in a single security review and learned nothing they could repeat. Go where the decision is fast, and take the record upmarket later.

Recruit the first customers. Do not close them.

You are choosing the people who will define the product, not filling a quarter. Pick design partners for three qualities: they feel the symptom acutely enough to spend real attention on it, they can reference you publicly later, and together they are varied enough in size and industry that what you learn from them generalizes. A design partner who wants a private consultancy is a cost with a logo on it.

They pay. Discounted, capped in number, with the end of the discount written into the contract. What the money buys you is evidence: a procurement path walked end to end, a renewal that forces the value conversation, and an endorsement that cost the endorser something. Get the right to name them in writing at signing, as a term of the deal and not as a favor afterward.

The security review is part of the motion.

You will treat the security review as something that happens after the sale, and in this market it is part of the sale. A buyer's engineer researches you before returning your email, and a buyer's risk team reviews you after the champion says yes. Both read the same package: the architecture page, which says what the product touches, what privileges it needs, what data it sees and stores, where it runs, the tenant boundary, how it fails, and what the buyer must run themselves; your policies with dates and owners; your latest penetration test letter; and a disclosure policy, all behind a trust center. Build it before the first conversation, because it is how a stranger decides you are a peer rather than a vendor.

Know what practitioner ground buys.

You earn security buyers through their peers or not at all. Opinions in this industry form in practitioner spaces: open source and the README, the community Slack, research written by practitioners that gets read precisely because it is not vendor content, and the hallway at a regional BSides more than the show floor at RSAC. A cold email sequence competes with hundreds of others. A practitioner saying that your product works competes with nothing. Presence there builds slowly, which is why it works, and a fast follower cannot buy it in a quarter.

Know what it buys, though. Original research, working in public, and free tools earn genuine standing with the community that admires the work, and that community rarely holds the budget. We have watched research programs defended as pipeline for years. If it is pipeline, make it prove that with opportunities it sourced. If it is brand, or credibility in front of a future acquirer, say so and size the spend that way.

Keep warm pipeline separate from cold.

You will start with deals sourced through your investors and your own network, which is fine as a start and dangerous as a measurement. Warm deals do not test the cold market. Report warm and cold pipeline in separate columns from the first deal, because warm pipeline flatters every conversion rate it touches. And notice the moment an investor has to intervene personally to shake a deal loose. What you have learned is that your team does not control the account, not that the deal is close.

Arm the champion.

Your champion does most of the selling in rooms you will never enter. Give them documents, not enthusiasm: a one-page problem statement in the buyer's own vocabulary, the security review already answered, a deployment plan sized to one quarter, and the budget line named so that nobody has to invent one in the meeting. The champion's real question is whether choosing you will embarrass them, and every document exists to answer it.

Learn the buyer's calendar.

Your forecast runs on your quarters, and the buyer buys on theirs. Their fiscal year sets when budget exists. Their renewal dates with adjacent vendors set when a bundle can absorb you. Their audit cycle sets when an obligation becomes urgent. Ask every champion for those three dates in the first meeting, and put them on the opportunity. A deal that slips past the buyer's fiscal year costs a year, not a quarter.

Stay founder-led, and run one motion.

You are the sales team until the motion repeats without improvisation. The point of founder-led selling is not heroics. It is the record. Every call adds an objection, a budget line, a document procurement asked for, and the exact words that moved the room, and those pages are what your first sales hire will run. Hire the first seller to run the motion you wrote down, not to find one.

Run one motion at a time. A self-serve tier bolted onto a company grinding through enterprise proofs of concept produces sign-ups that convert to nothing, while the enterprise deals stall on features the same engineers were pulled away to build. We have watched it more than once, and where two motions coexist, effort drifts toward the easier one, including the founder's. A free tier is prescribed as a cheap experiment. It is not cheap. Its cost lands on the motion that was already working.

Write the corpus.

You keep one document, the corpus, that the whole company can read, and you add to it after every buyer conversation. It has these fields:

• The buyer's words for the symptom.
• The obligation each account is measured on.
• The function that signs, and the budget line.
• The objections, and what answered each one.
• The documents procurement asked for.
• The stages each deal passed through, and how long each took.
• The three dates from each account: the fiscal year, the adjacent renewals, the audit cycle.

That document is the company's first real asset. It is what makes the first sales hire possible, what tells you when the motion repeats, and what an acquirer's diligence reads to decide whether the revenue is repeatable.

Let the channel pull.

Channels get offered before you are ready for them, and a channel amplifies demand. It does not create it. A master agreement with a large reseller, a marketplace listing, a household-name partner: each produces press and near-zero volume until the product has pull of its own. We have watched two companies with substantially the same partner access produce opposite outcomes, and the difference was whether the product could stand without the partner. Sign a channel after you have repeatable direct demand that a partner can simply fulfil.

Three things the channel pitch leaves out. The highest-yield early partner is often the services firm already inside the account rather than a reseller, because if your product produces a finding that implies a project, you manufacture their next statement of work. Selling through providers does not remove the enterprise cycle, it hides it, and the revenue arrives as a few large, long-dated contracts, the least forecastable line in your plan. And you should set up the ability to transact on a partner's paper before a buyer asks, because a large buyer asking to purchase through a vendor they already have under contract is a solved problem if you prepared and a lost quarter if you did not. The managed-provider world is a market of its own rather than a channel, and the provider is the customer.