Mark Gibson

At resellers carrying many vendors, each rep relies on a handful of products they can explain and defend.

• Products outside that shortlist tend to come up only when a customer asks, rather than generating demand.
• They favor repeated practice with a business-focused risk narrative over another deck or product-training session.

Gibson describes work at Centrify with CDW, where sellers drew and role-played a Zero Trust story around executive concerns such as breach containment and financial exposure. They say deal registrations increased and partners created urgency in accounts the sales engineer had not touched.

Read original

They also argue that a good diagnosis is not enough: people respond differently depending on whether they have a reason or mandate to change.

At Infosecurity Europe, Gibson ran website diagnostics for attendees.

• A CFO considering an exit wanted to know more after scoring 20 out of 30.
• A newly appointed sales leader also wanted the breakdown after scoring 14.
• A long-tenured sales manager received the same score as the new leader but dismissed it.
• Gibson uses the contrast to argue that the trigger for looking matters as much as the diagnosis.

Read original

A single blended pitch can obscure the distinct problems each group came to solve. They propose identifying each customer group’s decision pattern, finding the overlap and differences, then building the go-to-market approach around those buying situations.

In a merger scenario, Company A’s customers wanted accountability for IT projects that ran over budget; Company B’s wanted to avoid six-month implementations.

• The combined message promised both enterprise depth and startup speed.
• Gibson says the result sent each company’s reps into the wrong conversations and left customers hearing noise.

Read original

If it is not visible in the company’s commercial story, new sellers may take longer to ramp and a future buyer may inherit a business dependent on specific people. They see the customer’s recognizable problem—not just proof points or product detail—as a test of whether that knowledge has been made transferable.

Gibson describes a Commercial Transferability Index and reports that, among more than 600 B2B websites, only three made the buyer’s moment of struggle recognizable in the opening hero. The gap can appear in the first line, even when a company has case studies, logos, and product depth.

Read original

They connect changing buyer behavior to commercial risk: if customers’ reasons to stay change, retention and ultimately valuation may be affected. They also argue that buyer research done before a deal can help a company act sooner after close.

In one post, Gibson describes customer switch interviews conducted before an investment committee meeting.

• They say the interviews identified three recurring entry points and a positioning platform that management could use from week one, rather than leaving market discovery until months after the deal.
• In another post, they link AI-related shifts such as seat compression and lower switching friction to questions about software durability.

Read original · Original 2

One post recommends fluency in quantified risk to shape buying conversations earlier; another argues that security teams should ask what attackers can reach after they gain access, not only whether malware can be stopped.

Gibson describes attackers using unmanaged devices, help-desk access, virtualization, and identity systems to move beyond endpoint defenses. They use those attack paths to reframe the question from stopping malware to understanding what an attacker can reach once inside.

Read original · Original 2 · Original 3

To understand how Mark Gibson thinks about channel enablement, start here.

Gibson describes the maths of a reseller's day: firms like Bytes Technology Group, Softcat, and CDW UK represent dozens of vendors and more than a hundred cybersecurity products, but no salesperson can confidently sell a hundred things.

• Each rep narrows the field to the three to five products they can explain without slides, draw from memory, and defend when a CFO pushes back on the spend.
• Those become the go-to plays; everything else appears only when a customer asks or an RFP names the vendor.
• Gibson calls that fulfilment rather than demand creation.
• At major resellers, roughly 85% of reps hand cyber conversations to a specialist within five minutes and never own the risk narrative.
• Gibson recounts a firsthand case at Centrify, where they worked with CDW as the primary channel.
• They and a colleague replaced the pitch deck with an immersive whiteboard storytelling workshop: sellers drew the Zero Trust story, role-played it, and repeated it under pressure until it was installed rather than delivered.
• Deal registrations then increased, and partners created urgency in accounts the specialist had never touched.
• The post closes with the question Gibson puts to any vendor betting on partners: have you installed a risk narrative your partners' salespeople can activate without handing the meeting to an SE?
• Information is forgotten; installation is available; activation creates demand.

For brands planning a campaign

A useful spine for a channel-enablement brief: the deliverable is not more collateral but a short risk narrative reps can recall and defend.

• The workshop Gibson describes offers a concrete model for building it.
• The five-slot framing also explains how a vendor's win rate can erode even when the partner relationship looks healthy.

Useful for understanding how they run a diagnostic and what they think a score is for.

Walking the floor at Infosecurity Europe at ExCeL London, Gibson found nearly every stand talking about AI agents, autonomous SOCs, automation, and platforms, and almost none naming the situation that makes a security leader start looking in the first place.

• The messaging focused on suppliers: what they do, what they automate, how they are faster.
• Gibson ran four live website diagnostics on the show floor.
• A CFO scored 20 out of 30 and immediately wanted to know more because they were thinking about an exit and how clearly the company's value was communicated.
• A newly appointed sales leader scored 14 out of 30, asked for the full breakdown, and was already mid-rebrand.
• A long-tenured sales manager scored the same 14 and waved it away.
• Gibson's conclusion: the diagnosis was not the variable; the willingness to hear it was.
• People who act usually have a trigger such as an exit, a rebrand, a new leadership team, or slowing growth.

For brands planning a campaign

For a campaign selling a positioning or messaging diagnostic, this post offers both a caution and a design principle: the score alone rarely moves anyone, but a score tied to a live internal trigger can. It also lists triggers a vendor can probe before proposing diagnostic work.

It is a quick way to see the buyer-decision idea in action.

Gibson lays out a merger scenario with numbers attached.

• You acquire Company B, aim for £18M ARR by month 12, and reach month 6 at £9M with churn up 12% and pipeline in disarray.
• The integration team had built a unified go-to-market strategy in a conference room: new value proposition, new deck, new positioning.
• But Company A's customers bought because they could not explain to their board why IT projects ran over budget; Company B's customers bought because enterprise vendors took six months to implement.
• Two companies, two decision logics.
• The unified message tried to cover both, with lines like enterprise depth with startup speed.
• A's reps pitched speed to CIOs who cared about traceability, while B's reps pitched enterprise integration to founders who wanted to go live by Friday.
• Customers heard noise and conversion dropped.
• Gibson's diagnosis: the mistake was unifying before extracting why customers bought from each entity pre-merger.
• The fix is to extract both decision patterns, map overlap against divergence, and build per-door go-to-market rather than one-size-fits-all.

For brands planning a campaign

For a vendor repositioning after an acquisition or merger, this argues for extracting buyer decisions before writing a unified story. The overlap-versus-divergence map offers a usable workshop step and a way to explain why a merged message can reduce conversion even when each original message worked.

Gibson notes that private-equity firms measure the commercial engine well: pipeline, customer acquisition cost, net revenue retention, margin, RevOps.

• What they rarely measure, in their framing, is why customers buy.
• That knowledge usually lives in founders' heads, in the best rep's talk track, or with the operator who frames value in the room.
• If the reason stays attached to people rather than being translated into the commercial surface, founder dependency stays high, new reps ramp slowly, and at exit a buyer inherits an engine that depends on individuals.
• Gibson describes a Commercial Transferability Index built as a due-diligence lens, not a marketing score.
• The team has X-rayed more than 600 B2B websites, 482 of them PE-backed across 73 funds, and found that 87% score the buyer's situation two out of five or below, favouring product or category language.
• Across those 600 companies, the team found three where a buyer meets their own moment of struggle in the hero section, reads the first line, and recognises their own situation.
• Gibson says the failure is rarely in the proof; it happens in the first half-second of the hero.

For brands planning a campaign

Gives a positioning brief a concrete, testable target: rewrite the hero so buyers recognise their own situation, then measure it before and after. The three-in-600 finding is also a strong, specific hook for a campaign arguing that proof points and case studies cannot fix a first line that never makes buyers see themselves.

To see how they handle threat detail rather than strategy language, open this post.

Gibson argues ransomware no longer needs endpoints.

• PUNK SPIDER ran Akira from an unmanaged device and encrypted over SMB; in one case, the entry point was a webcam nobody was patching.
• SCATTERED SPIDER did not touch endpoints either: they called the help desk, got access, moved through vCenter, mounted a domain controller disk, pulled Active Directory credentials, and deployed ransomware directly to ESXi, reaching credential access in about three hours.
• BLOCKADE SPIDER moved across edge, identity, SaaS, and virtualization, and changed EDR policy to ignore a staging directory.
• Gibson points to 87% of intrusions now spanning multiple attack surfaces and reframes the question from can we stop malware to what can an attacker reach once they are in.

For brands planning a campaign

A ready-made content angle for identity, containment, or exposure-management vendors: shift the buyer's question from prevention to reachable attack path, using named threat activity as evidence. The specific time-to-credential-access figure gives a technical campaign credibility.

Useful for seeing how they address their private-equity audience and frame buyer evidence as financial protection.

Gibson argues that public SaaS volatility is the headline, but the real risk sits in the durability assumptions behind a decade of software buyouts: recurring revenue, high switching costs, and predictable expansion.

• AI is quietly testing all three through seat compression, faster feature replication, lower switching friction, longer buying cycles, and sharper CFO scrutiny.
• For UK mid-market private equity, Gibson frames this as a durability story rather than a growth story and lays out the chain: when buyer logic changes, switching costs erode; when switching costs erode, retention weakens; when retention weakens, valuation follows.
• Most software investments, they say, are still underwritten on internal narratives such as we solve X, our ICP is clear, and switching costs are high.
• Customer evidence replaces those assumptions.
• Gibson lists pre-deal customer signal validation, revenue protection in equity events, portfolio-wide buyer logic extraction, and buyer facilitation before CRM expansion, and calls GTM precision a capital-protection mechanism.

For brands planning a campaign

For a vendor selling to or through PE-backed software companies, this offers a commercial framing: buyer evidence protects retention and therefore valuation. A positioning or messaging diagnostic can be presented as durability evidence rather than a marketing project.

They cite third-party data and frame buyer interviews as a pre-close activity, showing who they are speaking to and how they position the research.

Gibson opens with a change in fundraising conversations: limited partners are no longer asking what your thesis is, but what your evidence is.

• They argue that a value creation plan built around hiring stronger management and fixing the messaging is not differentiated, because every fund offers a version of it.
• They cite Bain & Company 2026 private-equity report data showing distributions as a percentage of net asset value below 15% for four consecutive years, and argue this is not primarily a liquidity problem but a consequence of portfolio companies acquired at high multiples that underdelivered commercially because go-to-market was never built around buyer evidence.
• They describe an engagement where customer switch interviews conducted before investment committee identified three recurring entry doors and a single positioning platform that unified messaging, sales design, and segment prioritisation, letting the management team activate a validated commercial motion from week one.
• They contrast this with supply-side due diligence, where funds ask customers what they value, confirm the thesis, and file the report.

For brands planning a campaign

Supports a pre-close or pre-investment pitch for buyer-interview work and gives a fund a one-sentence formulation to use. For a cybersecurity vendor, the transferable idea is that switch interviews conducted early produce a positioning platform rather than a pile of confirmations.

Brian Krause and Gibson replaced the pitch deck with a whiteboard storytelling workshop in which partner sellers drew the Zero Trust story, role-played it and repeated it under pressure.

• In Gibson's account, deal registrations increased and partners created urgency in accounts the vendor's own sales engineer had never touched.
• Their diagnosis of why normal enablement fails is specific: at major resellers, most reps hand cyber conversations to a specialist within five minutes and never own the risk narrative.
• The meeting goes technical, the buyer hears features, the CFO hears cost, and quantified financial exposure never enters the room.
• Slides, product training and differentiation charts build product knowledge, not conversational confidence.

An immersive whiteboard storytelling workshop built around executive struggle moments—breach containment failure, financial exposure and board pressure, lateral movement and segmentation drift—repeated under pressure rather than delivered as a deck.

For brands planning a campaign

For a vendor selling through resellers, budget for partner-facing workshops that give reps language to frame risk in business terms and hold the first fifteen minutes of a meeting—not another training module. Pick a small set of struggle moments and test whether partner-sourced deal registrations rise in accounts your own team has not worked.

Examples: Source 1

To test the gap, they ran four live website diagnostics on the show floor.

• One CFO scored 20 out of 30 and immediately wanted more because an exit was on their mind; a newly appointed sales leader scored 14 and wanted the full breakdown with a rebrand already under way; a long-tenured sales manager scored the same 14 and waved it away.
• Gibson concluded from the three reactions that the diagnosis was not the variable: the CFO had a reason to look, the new leader had a mandate to change, and the sales manager had years invested in the current story.

A thirty-second website diagnostic with no email gate, run in the moment and used to open a conversation rather than produce a report.

For brands planning a campaign

Lead with the buyer's reason to look—an exit, a rebrand, a new leadership team, slowing growth—not with capability. A free, ungated diagnostic is a usable entry point, but aim the message at buyers who already have a trigger: the same score produces enthusiasm in one audience and defensiveness in another.

Examples: Source 1

They report examining more than six hundred B2B websites, 482 of them private-equity-backed across 73 funds, with 87% scoring the buyer's situation two out of five or below in favour of product or category language.

• Across those six hundred companies, they found three where the buyer meets their own moment of struggle in the hero and recognises their own situation.
• Their argument is that transferability rarely fails in the proof—case studies, logos and product depth can all be present—but in the first half-second of the hero.

A scored site review with published aggregate findings, used as a due-diligence lens rather than a marketing score, plus a founder-departure test: if the founder and the best rep left, would the reason customers buy still be visible?

For brands planning a campaign

A hero-copy audit that asks whether the first line names the buyer's situation, not the product, is a concrete deliverable for a vendor or investor. Aggregate benchmark numbers make the argument memorable, while the founder-dependency framing gives a sales or PE audience a reason to care beyond brand polish.

Examples: Source 1

Gibson attributes the result to an integration team that built a unified value proposition in a conference room without first extracting why customers bought from each entity.

• Company A's buyers wanted to solve an accountability gap with their board; Company B's buyers wanted to escape six-month enterprise implementations.
• The blended propositions—enterprise depth with startup speed, fast deployment meets robust integration—sent each set of reps into the wrong conversation, and customers heard noise.

Extract customer decision patterns before any messaging work, map overlap against divergence, then build a go-to-market for each door rather than one-size-fits-all.

For brands planning a campaign

For acquirers and merged teams, sequence buyer-decision research ahead of repositioning, and allow separate messaging by entry door after the merger instead of forcing one story. The framing also works for a single vendor serving two distinct buying triggers: name each door's problem rather than averaging them into one line.

Examples: Source 1

Value-creation plans that amount to hiring stronger management and fixing messaging are, in their words, not differentiation, because every fund says a version of it.

• They cite Bain's 2026 PE report data on distributions below 15% of net asset value for four consecutive years and read it less as a liquidity problem than as portfolio companies bought at high multiples underdelivering commercially because go-to-market was never built on buyer evidence.
• Their example is a fund running customer switch interviews before investment committee that identified three recurring entry doors and a single positioning platform, letting the management team act from week one rather than discovering the market in months three to nine.

Customer switch interviews conducted during diligence, producing a documented commercial playbook the fund can describe in one sentence at close.

For brands planning a campaign

There is a sellable pre-close research offer here: buyer-decision interviews timed to diligence that shorten post-close commercial velocity. For a vendor rather than a fund, the transferable point is that evidence gathered before a deadline beats discovery after it, and the deliverable should be a positioning platform, not a report.

Examples: Source 1

Recurring revenue, high switching costs and predictable expansion underwrote a decade of software buyouts, and they argue AI is quietly testing all three through seat compression, faster feature replication, lower switching friction, longer buying cycles and sharper CFO scrutiny.

• They set out a chain: when buyer logic changes, switching costs erode; when switching costs erode, retention weakens; when retention weakens, valuation follows.
• Much underwriting still rests on internal narratives—we solve X, our ICP is clear, switching costs are high—and Gibson argues that in 2026, assumption is no longer underwriting discipline; customer evidence is.

Pre-deal customer signal validation and portfolio-wide buyer-logic extraction, positioned as a capital-protection mechanism rather than a growth tactic.

For brands planning a campaign

For vendors selling into or alongside private equity, the durability argument is a stronger hook than AI features: offer evidence on why customers stay rather than claims about switching costs. For anyone messaging a PE audience, answer whether the buyer logic is defensible.

Examples: Source 1

Fluency in loss-event frequency, magnitude, and how controls actually reduce risk lets a vendor shape the conversation early and define the decision framework — where the competition is not and margins are better, they say. They tie this to FAIR-CAM and the wider shift toward quantifying risk reduction and recovery.

This post recommends another author's book rather than presenting Gibson's own framework, so it shows their stated priority — quantified risk language — more clearly than it shows a method they have built.

For brands planning a campaign

For a security vendor, a campaign built around loss-event frequency and control effect positions the product inside a decision framework the buyer adopts, rather than in a late-stage feature comparison. It also points to partnering with or amplifying risk-quantification voices rather than producing another capability message.

Examples: Source 1

One states flatly that the industry spent years selling faster detection and attackers responded by moving faster than detection can matter.

• With 29 minutes to breakout and 72 minutes to exfiltration, it concludes the buying decision has changed while most vendors have not noticed.
• The other walks through intrusions that never touch endpoints: ransomware run from an unmanaged device and encrypted over SMB, an entry point in an unpatched webcam, a help-desk call that reached a domain controller in three hours to credential access, and an attacker changing EDR policy to ignore a staging directory.
• Gibson cites 87% of intrusions spanning multiple attack surfaces — a figure they say appears across different datasets — and reframes the question from whether malware can be stopped to what an attacker can reach once they are in.

Attacker-path narratives with named threat groups and specific timings move the buying question from prevention to containment and reach.

For brands planning a campaign

A containment-and-reach message offers a defensible alternative to detection-speed positioning, particularly with a board audience: quantify what is reachable after initial access instead of implying faster detection would have prevented the incident. Threat-specific narratives give sellers concrete language for that conversation.

Examples: Source 1 · Source 2

The posts don’t explain Gibson’s relationship to the business; ask whether they own it, work for it or partner with it.

View example

The post does not state Gibson's role or the dates, so no ongoing relationship is claimed.

View example

Gibson uses CDW to illustrate how channel attention works, not as a disclosed commercial partner.

View example

They use the event to argue that security marketing describes supplier capability instead of the buyer’s situation. Ask whether Gibson attended under any sponsorship or other terms; the post doesn’t say.

View example

They ask whether vendors relying on partners can count on those partners’ salespeople to carry the risk narrative without handing the meeting to a sales engineer. This is commentary, not a stated engagement.

View example

Doyon scores thousands of sales and customer-success calls to show how reps qualify; Gibson draws on channel meetings and website diagnostics to show how buyers decide.

Doyon's evidence base is call data on sales and customer-success roles, qualification depth, and revenue-organisation design. Gibson focuses on buyer triggers, website copy, and whether partner sellers can carry a risk narrative unaided.

Read original · Original 2

They write practitioner-level posts with numbered, usable tactics.

Diller applies the argument to commercial landscaping businesses, marketing systems, and getting more return from video and case-study assets. Gibson applies it to cybersecurity and software go-to-market, buyer-recognition testing in the opening line, and channel seller confidence.

Read original · Original 2

Knight works on organisation design, incentives, product enablement, and account expansion after the first sale. Gibson focuses on the buyer's reason to act, the message that names it, and the partner sellers who have to deliver it.

Read original · Original 2

Doyon's posts report scoring more than 11,000 MEDDICC calls and assessing roughly 500,000 Aircall and 500,000 video calls.

• The findings offer detail a campaign aimed at partner reps can act on: discovery is not one call but a process spread over several meetings; reps routinely tick MEDDICC boxes without capturing anything qualified, so "we're trying to improve CAC" gets recorded as Metrics while the baseline, the financial impact, and the internal owner stay unknown; and Decision Process is consistently the weakest category, with procurement, legal review, and sign-off paths surfacing late enough to stall deals.
• For a cybersecurity vendor whose partner reps open with product features and hand the risk conversation to a specialist, this is the same failure seen from the other end of the microscope.
• Doyon is the better pick when the deliverable is an audit grounded in what reps and customer-facing teams actually say, with a coaching loop attached, and when the vendor can supply its own call recordings.
• Gibson's work starts from a narrative and installs it by rehearsal; Doyon starts from a corpus and reports what is missing.

The method is conversation analytics and qualification discipline, not channel enablement or positioning.

• Gibson's posts do not cover reseller ecosystems, distributors, or partner-sourced pipeline, and they do not describe a buyer-struggle test like the one they ran on the show floor, where the same score produced action from a CFO and dismissal from a long-tenured sales manager.
• A vendor that hires Doyon for a partner workshop would be carrying call-scoring practice into a task it was not built for, and would still have to write the narrative and design the rehearsal itself.
• The trade is measurement depth and scale in exchange for the workshop format and the first-line messaging test; ask for recent work on indirect or partner-led sales motions before assuming the call findings transfer.

Examples: Source 1 · Source 2

His posts are written for acquisition-heavy, fragmented service businesses and make a specific commercial argument: growth that depends on the owner's relationships is fragile, while growth supported by repeatable systems such as brand authority, inbound demand, and a credible digital presence is more transferable, which matters in valuation conversations.

• The video post offers a practical version of the same idea, listing twelve ways to get more from footage already shot, from putting a clip on the matching service page to embedding it in a written case study, a paid landing page, a digital proposal, a recruiting process, or a looping segment in a tradeshow booth.
• A PE-backed platform that needs to show organic demand generation alongside its acquisitions, and to squeeze more out of content it has already paid for, gets a usable programme here.
• It shares the premise behind the diagnostic work Gibson describes: the buyer-facing surface should carry the reason customers buy instead of leaving it in a few heads.

The sector is the limit: the posts deal in commercial landscaping, lawncare, tree service, and pest control, with no cybersecurity, software, channel, or partner-enablement material to compare against a campaign aimed at cybersecurity channel partners.

• The valuation argument leans on private-equity reports rather than a documented client engagement, so it reads as reasoning from the field rather than a measured result.
• A vendor that picks Diller for a cybersecurity campaign aimed at channel partners is importing a method and a market framing into unfamiliar ground, and gets an asset-distribution plan rather than a workshop or a scored buyer-struggle diagnostic.
• His strength is making existing content work harder across many placements; ask for evidence that his approach translates to cybersecurity channel partners, particularly when the goal is to explain why partner reps avoid a risk narrative.

Examples: Source 1 · Source 2

His posts argue that you get the behaviour you design for: if structure, targets, and compensation still point at new-logo acquisition, that is where the energy goes, however clearly the strategy asks for stronger qualification, better fit, and more expansion.

• The application to channel work is explicit: a proposition delivered through partners has to be easy to explain internally first, because if it is hard internally it will be harder for a partner to sell externally, and a genuinely complementary suite should make expansion feel obvious rather than forced.
• He also applies the same logic to buy-and-build, where an acquired customer base may give scale on paper but has not bought into the wider group proposition, so expansion starts with plain communication about what is changing and why.
• That is the right starting point when the vendor's partner programme fails because Product, Marketing, Sales, and Customer Success are measured on different things and no one owns the partner-facing message.

The posts are essays that end in a question to the reader, offering frameworks and reasoning rather than a run-of-show or an observable result.

• A vendor choosing Knight for a channel workshop aimed at partners gets a diagnosis of why the organisation resists change, but still has to build the workshop, write the narrative, and design the test.
• The trade is organisational depth in exchange for a ready mechanic.
• The two posts span 4 and 22 September 2026; ask for audience and client details before judging their relevance.

Examples: Source 1 · Source 2