Which channels produced closed security deals?

Conference spend is among the largest line items in security marketing and the least measurable. A badge scan becomes a conversation, the conversation becomes an evaluation months later, and no click-based tool connects the two.

Because the badge-scan list is just another source export, events attribute like any other channel here. For several teams this is the first defensible number they have had on the largest thing they spend on — in either direction.

A security company evaluating an attribution platform has to put it through the review it applies to everything else: what runs on the product surface, what data leaves, which subprocessors are involved. That review is often longer than the evaluation of the product itself.

There is nothing to install here. Two exports, reconciled after the fact, with no tag on any surface and no live connection to a CRM. That is a shorter conversation with your own security team, which for this segment is a feature rather than a convenience.

A security contract signed at two hundred thousand dollars is worth several times that if it renews for four years, and considerably less than its first invoice if the customer leaves after a difficult deployment. Marketing is measured on the signature. The renewal is treated as a customer success outcome, which it largely is, but the channel that produced the account is never told whether the customers it brought in stayed, and that silence is why acquisition gets funded on cost per closed-won deal and nothing else.

Run the report across several years with renewals included and the ranking moves. Two channels acquiring at the same cost are not equivalent when one produces security teams who deploy the product properly and renew without a conversation, and the other produces buyers who were closing an audit finding and never intended to keep it. The renewal revenue says which is which, and it says so in dollars rather than in the anecdotes that usually decide these arguments internally. It is also the only comparison that treats a four-year customer and a one-year customer as the different outcomes they always were.

Where a renewal is signed by somebody who never appeared in a lead file, which most often means a new security leader who inherited the deployment, it is not handed to the acquiring channel for convenience. It matches on the contact or it does not, and where it does not the revenue sits in Direct / Unknown. That is a smaller claim than a lifetime-value model makes and a sturdier one, which is the reason the figure survives a board member asking how it was produced.

A large share of security revenue reaches the vendor through somebody else: a reseller, a distributor, a managed security provider embedding the product inside their own service, an incident response firm making a recommendation in the middle of a breach. Those deals appear in the CRM with a partner name attached and a marketing source of nothing at all, and they are usually excluded from attribution work entirely on the grounds that marketing did not produce them. That is true, and it is also the reason nobody in the building can say what the partner motion is worth relative to anything else the company funds.

That exclusion hides two things worth knowing. The first is how much of the year the partner motion actually carries, which is a strategy question rather than a marketing one and is frequently answered from impression. The second is that partner-sourced revenue is not free: it costs margin, enablement, development funds and a channel team, and none of that can be compared with paid media unless both are ranked against the same closed revenue in the same table. Ranking both against the revenue that actually closed is the only arrangement in which that comparison means anything at all.

Deal registration lists go into the lead file, each row tagged with the partner as its source. Each named partner ranks on closed-won revenue next to paid social, next to events, next to search, so a reseller producing a steady flow of mid-market deals and one producing a single enterprise win a year stop being summarized as one line. It can be the first time a vendor sees all three motions in one ordering, and it settles arguments about where the next hire should go faster than pipeline reporting ever has.

Security has an unusually large amount of demand that no system records. An analyst evaluation places you on a chart and inquiries rise for a quarter. A researcher on your team publishes something that circulates in a private forum. A practitioner recommends you in a community of nine thousand people. None of that produces a click anybody can price, and pretending otherwise is how attribution tools end up crediting branded search with the entire effect of a reputation built over years.

The honest treatment is to leave it unattributed and then size it. Direct / Unknown is reported and never spread across the paid channels, so its size becomes a measurement in itself. If it is forty per cent of closed-won revenue, that is forty per cent of the business arriving on reputation, and the marketing question changes from how to bid harder into how to feed the thing that is already working without anybody funding it properly. A share that large is a strategy input, and inflating it away with a model removes the one honest signal on the page.

Some of it can be pulled out with modest effort. A webinar registration list, a research download list, a community event sign-up, everyone who requested a copy of a threat report: each is a file of people with contact details and each ranks on closed revenue like any campaign. Every one you supply moves revenue out of the unknown bucket, and what remains after that is genuinely unknown. Saying so plainly is more useful to a security buyer than a model would be.