Free ICP generator / Cybersecurity
Ideal customer profile for a cybersecurity company
Security buyers rarely wake up wanting security. They want to pass something: an enterprise customer's questionnaire, an audit, a bank partner's review, an insurer's renewal. That makes cybersecurity one of the clearest industries for trigger-based ICPs. The best groups are named by the demand they face, and the decider is often not a security person: at a 60-person software company it's the CTO or the head of sales trying to close a deal. Disqualifiers are about scope: companies that need a 24/7 operations centre when you sell project work, or that already have a full security team. Below is a worked example for Vantorel Security, a fictional firm, with each line tied to a page on its invented site.
Vantorel Security vantorel.example
Penetration testing and SOC 2 readiness for software companies. Vantorel Security is a fictional cybersecurity company. Its site is invented so the generator has something to read; yours fills in here.
B2B SaaS companies, 20 to 200 staff, facing their first enterprise deal
Best fit: pricing and 2 case studies- Who they areUS software companies selling to larger companies for the first time.From /pricing
- Who decidesThe CTO, often pushed by the head of sales.From /customers/lumenpay-ops
- Their painA 200-question security questionnaire blocking a signed deal.From /customers/lumenpay-ops
- What sets them offAn enterprise prospect asking for a SOC 2 report or a recent pen test.From /services/soc2-readiness
- Who to skipCompanies under 10 staff with no customers yet, and companies with an in-house security team of 3 or more.From /pricing
- Where they areCTO communities and the compliance-automation platforms Vantorel partners with.From /partners
Health-tech vendors handling patient data
Strong fit: 1 case study and an industry page- Who they areSoftware vendors selling to clinics or hospitals, 15 to 150 staff.From /industries/health-tech
- Who decidesThe CEO, with the compliance lead if there is one.From /customers/carewell-scheduling
- Their painHospital vendor reviews asking for a HIPAA risk assessment they don't have.From /customers/carewell-scheduling
- What sets them offA hospital system's vendor security review, or a first data incident.From /industries/health-tech
- Who to skipHospitals themselves (Vantorel doesn't do on-site hospital work).From /faq
- Where they areHealth-tech founder groups and hospital innovation programmes.Inferred
Fintechs entering bank partnerships
Test group: 1 blog post- Who they areFintechs with 10 to 80 staff building on a partner bank.From /blog/bank-partner-review
- Who decidesThe COO or head of compliance.From /blog/bank-partner-review
- Their painThe partner bank's due diligence list.From /blog/bank-partner-review
- What sets them offSigning a bank partnership term sheet.Inferred
- Who to skipLicensed banks with their own security teams.Inferred
- Where they areFintech compliance newsletters.Inferred
Positioning check
The homepage says "Enterprise-grade security for everyone", but your pricing and both detailed case studies are about getting a software company through its first enterprise review. Say that in the headline.
Now do yours
Same table, built from your own website. Group 1 is free, no email.
Questions
Who is the buyer for cybersecurity services at a small company?
Often not a security person. At companies under 200 staff it's usually the CTO, CEO or head of compliance, and the urgency comes from a deal, an audit or an insurer.
What triggers a company to buy a pen test or SOC 2 help?
An enterprise customer's security review, a regulator or partner's due diligence, a cyber-insurance renewal, or an incident.
How narrow should a security firm's ICP be?
Narrow enough to name the document your buyer is trying to pass. "SOC 2 for SaaS selling to enterprises" is easier to sell than "security services".