Building a Cyber GTM Machine: A Guide for Founders Heading Into a Growth Round

Today, Horizon3 announced a $250M Series E — massive congrats to the team! I was lucky enough to see the making of this hypergrowth cyber startup firsthand when I spent ~16 months as an Operator in Residence helping Horizon3’s Founder & CEO Snehal Antani and the team build and scale the business en route to a $100M round last June. One of Horizon3's many strengths is the exceptional go-to-market engine they’ve built over the last two years.

This post is for cyber founders and operators who want to supercharge their own GTM efforts.

In early rounds, a well articulated product vision, early traction, or a few compelling logos can carry a fundraise. As momentum builds, growth investors look for something different: a repeatable GTM machine. In essence, a systematic approach to go-to-market where investment dollars have a reasonably understood return. In the cybersecurity world, where acquiring a customer is expensive and reaching buyers is difficult, the bar for a great GTM organization is high.

At Horizon3, we targeted our most attractive customers and created a framework for how late stage investors would evaluate our go-to-market. The three lenses are: efficiency, velocity, and predictability. Running through the below analyses 12–18 months in advance of a growth round will put a company in the best possible position, and give operators more confidence in allocating finite resources.

Finding Your GTM Sweet Spot

One fundamental challenge many cyber founders face is prioritization in a large, horizontal market. The product that serves a 200-person company can solve the same challenges for an organization magnitudes larger. This can be a gift and a curse. A company that can sell to everyone usually ends up selling to no one particularly well, or leads to reps being focused on segments with worse economics. Not all customers are equally valuable.

We ran a detailed analysis to identify which segments offered the best growth and unit economics — our GTM sweet spot — where deals had the highest ACV, fastest sales cycles, and strongest win rates. With four customer segments and two go-to-market channels, we evaluated 12 cohorts across multiple dimensions. The “Difficulty Ratio” distills these findings and highlights the most attractive opportunities.

The Difficulty Ratio

‍

Our analysis revealed mid-market deals had comparable sales cycle days (and deal complexity) to further downmarket deals, but had several times higher average selling prices per deal. Focusing our GTM resources on mid-market accounts rather than SMBs, for example, drove a significantly stronger return on GTM efforts. When we overlaid retention cohorts by segment, we better understood how customers were retained and grown, and ultimately understood which customers became higher lifetime-value customers. Furthermore, mid-market focus kept transaction volumes high, which meant more at-bats to build the GTM muscle and bought product time to mature enterprise features. It also spared the forecast from the make-or-break lumpiness of big enterprise deals. Ever since Wiz went top-down enterprise from day one with ripping success, founders have been copying that playbook. However, most aren’t Wiz. Moving upmarket too early means learning to sell on your longest, lumpiest, and most expensive deals which can be a punishing training ground.

Difficulty Ratio by Segment

‍

A single snapshot tells you where your sweet spot is. Running the same analysis over multiple years keeps you honest about whether the GTM programs you’re investing in are actually producing better deals with higher contract values and shorter sales cycles. At Horizon3, segments dramatically improved on either or both dimensions and win rates stepped up considerably alongside them. Results like that don’t happen by accident. They were the work of CRO Matt Hartley and VP RevOps Drew Mullen, who built the machine deliberately, quarter by quarter. Watching them operate was a masterclass in GTM execution.

Difficulty Ratio Multi-Year Comparison

‍

Cyber vendors can sell to many verticals, but industries with greater pain points or regulatory and compliance pressures often have a higher propensity to buy. At Horizon3, we analyzed win rates by vertical and found discrepancies of 25%+ which enabled us to target verticals and buyers with a higher likelihood to convert to closed-won, ultimately driving a better return on GTM investment.

Win Rates by Industry

‍

Propensity to buy by vertical is important to consider, but doesn’t tell the whole story. Emerging technologies don’t become linearly adopted as famously articulated by Geoffrey Moore in Crossing the Chasm. Markets evolve by hitting inflection points. Pentesting is a well-established professional services market and software vendors have only captured an estimated ~5–10% of market penetration today. This leads to a more complicated GTM question: how do we effectively target the early adopters in the market? These individuals have certain personality and mindset characteristics, so understanding what industry groups they are associated with and the thought leaders they follow on LinkedIn can be helpful indicators. Marrying these characteristics with intent and technographic data to understand what is in their stack allowed us to understand which customers are more likely to be early adopters and willing to partner with an emerging tech startup.

Crossing the Chasm

‍

In cyber, this matters enormously. Many categories still have only single-digit market penetration, making innovators and early adopters the ideal customers for startups. These customers adopt for fundamentally different reasons, tolerate rough edges, are willing to co-create the product, and can be comfortable buying partially into the vision as much as the product today.

Knowing where your technology sits on the curve changes how you read your own funnel. Low penetration with strong early-adopter traction is just the shape of an early market. However, mistaking it for a mainstream motion is how founders over-hire reps for demand that isn’t there yet.

Efficiency

To this point, we’ve spoken about some of the underlying thinking of GTM efficiency. Investors diligence it through quantitative metrics. These have been written about exhaustively elsewhere (for example, here and here), so the below is a summary. Understanding these metrics in advance of a fundraise — and the operational levers to drive improvement where needed — is key.

• Sales cycle days, average contract values, and win rates over time: Three of the most critical metrics to understand. They provide insight into how the GTM is performing and changing. Early in a company’s life, experimentation is important to find what works. Understanding how tactical changes or experimentation impact these metrics will lead to improvement. What investors find compelling is when a founder can point to tactical levers that have led to historical improvements and will continue to improve metrics over time; it demonstrates mastery and control over the business.
• CAC payback and net sales efficiency: Benchmarks vary by business model — a PLG motion looks nothing like an enterprise sales motion on CAC, but the discipline of understanding your unit economics deeply is universal. Growth-stage cyber typically lands around 13–24 month CAC payback and 0.5–1.0x net sales efficiency. As always, the segment view beats the blended number. If enterprise segments pay back in 12 months and SMBs take 36, you don’t have an efficiency problem, you have an allocation problem.
• Marketing ROI, by channel: At Horizon3, we ran what we called “Marketing Moneyball.” We benchmarked every channel against a return on pipeline and return on closed-won bookings. Some channels were well above our benchmarks, and we leaned harder into those areas. Where there was underperformance, we tactically fixed them or dialed down investment to re-allocate to higher returning channels. The right benchmark depends on a company’s LTV:CAC, but the discipline is universal: make every line item defend itself. In cyber, where so much pipeline runs through partners, that scrutiny has to extend to the channel too. It is also important to understand which channels require longer upfront investment initially, but pay dividends in the long-run — such as channel relationship building.
• AE quota & support ratios: Understanding the economics across the lifecycle of the customer is key — from Account Executive to Sales Engineer to Customer Success in post-sales, as well as the corresponding support layers. AE quota should be a healthy multiple of on-target earnings (ideally over 4x once ramped). Get a good feel for the historical track record of supporting headcount to keep and deepen those customer relationships, for example the number of customer support folks per customer by segment. All those pieces combined provide insight into fully loaded economics across the multiple layers of the GTM org.
• Gross Margins: In cyber, and particularly in a more AI-native world, being able to surgically decompose COGs to explain which costs scale with revenue, what doesn’t, and how initiatives can improve unit margins is critical.

We avoided the trap of trying to be everything to everyone. We poured energy into Ideal Customer Profile accounts and channels that mattered most. This discipline meant that every dollar of go-to-market effort produced a high return, and influenced every part of our GTM strategy: from GTM direct team targets to marketing event selection to channel partners. The rigor here was key. It’s how a young company with big ambitions ensured its resources were spent in the right places, at the right time.

Velocity

Velocity is the question of whether your GTM engine is generating the fuel it needs to hit your targets, and effectively scaling the team to close bookings. Two key things matter: pipeline and capacity.

Pipeline generation & source. You must be able to show a clean, rising line of pipeline created by quarter. Investors want to know you can reliably generate pipeline, because everything downstream depends on it. But not all pipeline is created equal. Pipeline generated through pure direct outbound scales with headcount, whereas pipeline via channel partners or referrals carries leverage if executed well, as it grows without a one-to-one increase in your own cost base. So the question isn’t only “is pipeline growing?”, but “how is the mix shifting toward sources that create leverage and scale?”. Furthermore, having a good mix of channel sources is helpful to build redundancy in hitting pipeline targets as there is natural seasonality (e.g., Black Hat in August every year) and risk in being single-source dependent.

CISOs today are inundated with vendor outreach and the volume forces them to ignore most of it. Much of the real buying now happens behind closed doors in peer groups and consultative sessions with trusted partners, long before a rep ever gets a meeting. A partner-first motion is a force multiplier in security: partners bring credibility and access to rooms a startup can’t get into themselves. Plus pipeline from channel partners generally has a higher win rate and closes faster if you build the system correctly. At Horizon3, channel sourced pipeline grew more than 9x over two years and became a major contributor to exceeding our goals. The velocity story that lands with investors isn’t “our pipeline is growing;” it’s “our pipeline is growing and an increasing share of it comes through leverage we can scale.” As a result, Horizon3 is now widely recognized as channel-first with a loyal, rapidly expanding ecosystem and class-leading inbound deal registration volumes.

Sales capacity. Velocity isn’t just generating demand, it includes building the quota-carrying capacity to close it. Capacity is the ramp-adjusted cumulative quota-carrying ability sales headcount has to hit the forecasted number. Generating pipeline doesn’t mean much if you don’t have the capacity in your team to work deals and close them.

Rep Ramps by Segment

‍

AE ramp time. A new AE typically takes six to twelve months or longer to fully ramp depending on their focus segment, so every month you’re able to shave off compounds across the whole team. It’s important to track how reps are ramping against their intended curve to understand if they are being supported enough to be effective. Being able to decipher if issues are individual or systemic is critical to understand the tactical ways to solve the problem and confidently scale capacity with more reps as targets become more ambitious. By continually monitoring time-to-productivity by segment, you can build hypotheses to tactically cut this number, such as optimizing sales rep ratios (e.g., SEs, CAMs, managers) or targeting common issues across the team for enablement.

Predictability

Predictability is harder won in cyber as deals slip on security reviews, procurement involvement, competing budget demands, and champions leaving. The average CISO tenure is about half the tenure of the average C-suite role, which means predictability is all the more valuable to demonstrate.

Sales team health: Together, three data points tell you whether the GTM org is repeatable and consistent: quota attainment by rep, pipeline coverage across reps, and historical win rates by rep. Average quota attainment of 80-90% is great, but investors want to see contribution across the team rather than a handful far above plan and the rest well below. Pipeline concentrated in two or three reps or wild outliers in win rate are indications of potential fragility or a sales org that hasn’t quite become systematic.

Conversion rates by stage, over time: A predictable machine has stable, known conversion at each step: MQL to SQL, SQL to POV, and POV to Close. When those rates hold quarter over quarter, you can forecast; when they swing, you can’t. Investors will rebuild your forecast using your stage rates, so the goal is to know them cold and be able to show they are steady or improving. In cyber, the POV is where deals are won and lost, and is the most valid benchmark — this is the stage that will face the most scrutiny.

GDR and NDR: Predictable revenue starts with the revenue you already have. Gross dollar retention tells you how sticky the product is due to customer satisfaction; net dollar retention tells you whether customers are accruing more value over time. A book of business that retains and grows is the most predictable revenue you own. The best way to analyze GDR and NDR is by segment cohorts. Cyber has a structural renewal risk other categories don’t in the frequency of champions changing roles. CISO tenures are short, and a new security leader often re-evaluates the stack. Strong GDR despite champion turnover is proof the product delivers unequivocal value.

Historical beginning-of-quarter pipeline coverage: Most teams convert ~25% of pipeline, so ~4x unweighted coverage at the start of a quarter is a good rule of thumb to hit a target number. Weighted coverage, which applies historical win rates by stage, is the more honest read. The discipline that signals a machine is having that coverage in place before the quarter starts, consistently, rather than scrambling to build pipeline mid-quarter for deals that can’t close in time. This is one of the strongest signals an investor can get on the predictability of the funnel.

You don’t need a perfect score on any of these. What matters is being able to talk about each one honestly with data, at the rep and segment cut. That will put you ahead of most companies at this stage.

‍

The Real Work

If you’re a year or two from a growth-stage round, here’s where to start: pick the one lens where you have the least clarity today — velocity, predictability, or efficiency — and build the muscle to talk about it with data, and at the appropriate segment, channel, and/or cohort cut.

This work is important not because investors require it (though they do), but because it will help you more intelligently run your business. The companies that raise from strength weave a compelling narrative and back up in cold detail how the next dollar in becomes the next dollar of durable growth.

That’s the machine. Building it makes you a better company, and provides you the focus and rigor needed to consistently perform and compound.