Chief Marketing Officer / Europe
Three times accuracy had a measurable price
- Scudalpe revenue
- €81.2m
- 2025; marketing programme budget €4.3m
- Partner resellers and service providers
- 92
- 46% of new detection contract value in 2025
- Client organisations
- 1,340
- Northern Italy and Ticino; mostly 100–2,000 staff
Decisions & consequences
01Selling a NIS2 readiness review instead of a compliance package
When Italy brought the NIS2 directive into its law in autumn 2024, thousands of mid-sized firms became newly in scope. Our partners asked for a "NIS2 compliance pack" of monitoring, policy templates and training, and two competitors were already advertising compliance within ninety days. Our sales plan assumed €6.5 million of bookings in two quarters from such a bundle, with a campaign expected to generate 2,400 enquiries.
The difficulty was that no supplier can make a client compliant. The directive places responsibility for risk-management measures on the entity and its management body. A compliance package would invite a client's board to believe it had delegated that responsibility to us, and it could expose us to complaints about misleading advertising.
I proposed a fixed-fee readiness review instead: fifteen working days, a gap assessment against the risk-management measures, a list of decisions only the client's board could take, and a statement of which gaps our services could address. The sales director and two of our largest partners disagreed strongly. One partner, which sold about €1.7 million of our services a year, moved its NIS2 offer to a competitor. The chief executive supported the proposal after reading both papers.
We removed the word compliant from every campaign and from partner material eligible for co-marketing funds, trained all 92 partners and published a short guide to the decisions the law leaves with directors. Enquiries reached 1,420. Bookings in the first two quarters were €3.9 million.
By September 2025 we had completed 236 reviews at an average fee of €12,800, and 71 of those clients had added monitoring worth €4.6 million in annual contract value. No review produced a dispute over scope. The departed partner returned about half its former volume during 2025, after its clients asked for the gap reports. Our lawyer now approves a register of regulation-related claims. Next time I would involve partners in the wording before launch; I treated their objection as commercial when much of it concerned their customers' expectations.
Removing client logos that lacked current consent
When I became chief marketing officer in March 2022, our website displayed 48 client logos and eleven case stories. Sales teams used them in almost every tender. A review with our legal counsel found written consent on record for only 19 of the logos. Five of those 19 clients had since left us. Two of the case stories described incidents in enough technical detail to indicate which tools the client relied upon.
A logo on a security provider's website is not harmless decoration. It tells an attacker which company to study and hints at its defences. It can also breach a confidentiality clause the client negotiated carefully. Against that, the sales director argued that removing two-thirds of our visible references would damage our position in tenders at exactly the moment the new investors expected faster growth.
I recommended removing every logo and story without current written consent within thirty days, and replacing public endorsements with confidential conversations between security leads. The chief executive agreed, though he asked me to report the commercial effect to the board after a year. We reduced the website to 14 logos and four stories, wrote a consent form specifying each permitted use, and set a two-year renewal date for every item.
We asked clients whether they would speak privately with prospects under a non-disclosure agreement. Thirty-one agreed during 2023, and they took 118 calls that year. Opportunities that included such a call closed at 44 per cent, against 27 per cent for those without, although the clients involved were self-selected and I presented the figure with that caveat. We lost one tender for a regional water utility in which named public references carried ten points; we were two points short.
By 2025 we had 26 logos and nine case stories, each with a consent record approved by the client's security lead. The rule now applies from the start of every contract. I would ask for reference consent at signature from the outset, rather than repairing three years of informal permissions under pressure.
Ceding the smallest firms to vendor-run detection services
In 2023 two global endpoint-security vendors began selling their own managed detection services through Italian distributors, roughly 35 per cent below our price per protected device for small estates. Nine of our partners added them. Firms with fewer than 100 employees accounted for 31 per cent of our new detection contracts by number but only 12 per cent by value, and their first-year churn was 19 per cent against 6 per cent for larger clients.
The sales team proposed matching the vendors' prices for small firms. I believed that would turn a regional service into a discount product and still lose, because a vendor's own service suited a small firm running only that vendor's tools. The investor directors were concerned about the opposite risk: that slower growth in client numbers would look like weakness in the market.
I recommended that we stop marketing detection services to firms under 100 employees and concentrate on organisations of 100 to 2,000 people with mixed tools, factory networks and a need for on-site response. Existing small clients could renew on current terms or move, with our help, to a partner's alternative. We kept prices unchanged and published what they included: Italian and German-speaking analysts, a four-hour on-site window and monitoring of tools the client already owned.
We gave up about €1.6 million of annual new contract value from small firms. Our client count fell from 1,410 at the end of 2023 to 1,340 in 2025. Four partners left; seven joined, focused on larger manufacturers. The average value of a new detection contract rose from €38,000 to €61,000, and the gross margin on detection services rose from 41 to 46 per cent.
Twenty-three small clients told us they felt pushed away, and several were right. We gave them ninety days' notice and a list of partners. I would now give a year, introduce each client to a named partner, and say plainly that the change reflected our limits, not theirs.