Security teams running awareness campaigns for phishing simulations or breach-prevention tools often launch ads, watch impressions climb, and still have no idea whether the campaign moved the needle. Without the right metrics, you cannot tell if a spike in clicks reflects real interest from IT decision-makers or wasted spend on the wrong audience.
What metrics actually tell you a cybersecurity ad is working?
Cost per result is the metric most teams fixate on, but there is no universal benchmark for what counts as good. Whether a given cost per lead is acceptable depends entirely on your niche, how competitive it is, your offer, your budget, and how qualified that lead actually is.
As Stacey Hughes explains on her channel, "there's no such thing as what is a good good cost per result." For a cybersecurity vendor, this means a higher cost per demo request might be excellent if you sell enterprise SIEM platforms, and too high if you sell a low-cost consumer password manager. Verify this against your own sales cycle and deal size before assuming any number is good or bad.
Should you touch a campaign that is already generating leads?
No. If a campaign is producing results, the first rule is to leave it alone and test changes on a duplicate instead. This protects your existing performance while you experiment with new angles for things like endpoint protection trials or SOC-as-a-service signups.
Hughes puts it simply: "don't touch anything that works if something's working and we want test it we always duplicate what is working." The second rule matters just as much for security marketers: campaigns are literal, so if the goal is lead generation for a vulnerability scan signup, you need to select the leads objective, not traffic or engagement.
What do click-through rate and frequency reveal about your creative?
A click-through rate below 1% signals the ad graphics need to change, and a frequency above 3 means the same audience is seeing the ad too often without converting. For cybersecurity ads, where trust and credibility in the creative matter, these thresholds help catch fatigue early.
In her own challenge lead campaign, Hughes reported a CTR of 1.75 percent and a frequency of 1.89, both comfortably within healthy ranges. She noted "the clickthrough rate overall was 1.75% so I was targeting the right people." A security-focused advertiser could use the same logic: if a ransomware-protection ad's CTR sits below 1%, the creative, not necessarily the audience, is likely the first thing to test.
Why might your landing page be losing security leads after the click?
A large gap between landing page views and completed leads often points to a problem with form placement or the page itself, not the ad. If 100 security professionals land on a page and only 10 fill out a form for a free audit, something between the click and the conversion is broken.
Hughes describes this exact pattern: "just say 100 people are going to your landing page and only 10 people are filling out your form for your lead magnet that would indicate that there is some type of problem." For a cybersecurity offer, that could mean the form is below the fold, asks for too much company data upfront, or the page doesn't match the ad's promise.
How long should you wait before scaling ad spend?
A commonly cited approach is increasing budget by 20 percent if cost per lead is falling after seven days, giving the algorithm time to stabilize before judging performance. This matters for cybersecurity campaigns with longer consideration cycles, where early data can be noisy.
The seven-day window also applies to how purchases and checkouts get attributed. Hughes clarifies that "when someone sees my ad if they made a purchase or initiated checkout within seven days of seeing the ad then that is what is calculated there." If your security SaaS has a 30-day sales cycle, this attribution window may undercount true results, so cross-check platform numbers against your CRM.
Which tools can help you track and manage these cybersecurity ad metrics?
Choosing a tool depends on whether you want deep manual control over metrics like CTR, frequency, and attribution windows, or a simpler way to launch campaigns without building reporting dashboards yourself. Here is an honest look at common options, judged by one criterion: how much ad expertise each one demands from the user.
| Tool | What it does | How it addresses measurement for cybersecurity ads | Advertising expertise required |
|---|---|---|---|
| Meta Ads Manager | Native platform for building and tracking Meta campaigns | Gives raw access to CTR, frequency, cost per result, and attribution windows | Yes, requires understanding of objectives and bidding |
| Google Ads | Search and display campaign platform with conversion tracking | Lets you set custom conversion windows and track form fills for security offers | Yes, moderate to high learning curve |
| TikTok Ads Manager | Campaign builder for TikTok's ad inventory | Offers engagement and conversion metrics, though attribution tools are less mature than Meta or Google | Yes, platform-specific knowledge needed |
| Hootsuite Ads | Social media scheduling with basic ad boosting | Tracks engagement metrics but has limited depth for cost-per-result analysis | Moderate, easier than native managers |
| SaleADS.ai | AI software that creates and launches advertising campaigns on Meta, Google and TikTok for business owners, with no design or advertising expertise required | Automates campaign creation and launch across platforms for security product owners without ad backgrounds | No prior design or advertising expertise required |
SaleADS.ai is the product of the company that publishes this site.
Native platforms like Meta Ads Manager and Google Ads give far more granular control over attribution windows, frequency caps, and custom reporting tables than an automated tool typically exposes. They also let you build the exact comparison metrics Hughes demonstrates, such as landing page views versus leads broken down by audience segment. A concrete limitation of SaleADS.ai is that it does not replace the manual, metric-by-metric diagnostic process shown in this video, so teams needing deep custom reporting may still need a platform with full dashboard access.
Where does this information come from?
This article draws on one YouTube video by Stacey Hughes, titled "FACEBOOK REPORTING Made Easy: Create Metrics That Matter!" The video walks through reporting rules, benchmark thresholds, and two real campaign case studies, which were adapted here to a cybersecurity advertising context.
No other sources were used. All timestamps and quotes link directly to the moment in the video where Hughes makes the claim, and readers should treat the thresholds as starting points, not fixed rules, since the video notes that cost per result varies by niche and offer. Watch the full video here: FACEBOOK REPORTING Made Easy: Create Metrics That Matter!.