What Does Your Ad Account Reveal About Your Security Firm?

Your ad targeting configuration is a written description of your firm. Radius encodes the service area, interest selections encode who you consider a buyer, and uploaded audiences encode who your clients are. For an MSP or an incident response shop, that last one is client data sitting inside a third party ad platform.

If your SaaS inventory stops at the marketing tools, the ad account is on no list anywhere. It gets handled as a spend problem when it is also a data problem. The targeting panel inside a Meta ad account holds your physical footprint, your prospect definition and, if someone uploaded a list, your customer roster. This article reads that panel the way an operator would.

The technical walkthrough behind the examples comes from "The RIGHT Way To Do Facebook Targeting For Local Businesses" by Ben Heath (full video). It is a marketing tutorial for local businesses and it makes no security claims at all. That is exactly why it is useful here: it shows what advertisers are actually told to configure. Quotes are reproduced exactly as the automatic captions render them, artifacts included.

What does a radius setting disclose about a security firm?

It discloses where you work. The radius is a written statement of how far your engineers travel and where your clients sit. Anyone who sees the ad is, by definition, inside it. For a security firm that turns a marketing field into a published description of your physical service footprint.

Heath's instruction is to pick a center point and then size the area around it, and he frames the sizing decision in travel terms. At 1:34 in the video he says to "start by entering in the center of the location that you want to Target and then you can adjust accordingly the area around that location", and that the decision "really comes down to where are you willing to travel or where do you think your prospects are willing to travel".

For a general contractor that is a logistics question. For a firm doing on-site incident response, forensic imaging or physical assessments, the same number answers a different question for anyone reading it: how fast can this team be standing in my building.

What follows is our reasoning rather than anything the video says. A few things worth deciding before anyone touches that field:

• Whether your service radius is something you already publish. If your site lists offices and coverage areas, the ad adds nothing new and the concern is minor.
• Whether the radius implies staffing you would rather not confirm. A radius that reaches well past your own city implies people and vehicles to cover it. The 2:22 alternative Heath mentions, "current city only", implies a small team.
• Who signs off on the geography. In most firms nobody does, because it is filed as a marketing field rather than as a disclosure.

One thing that is in the video: the platform does not start neutral. At 0:47 Heath points out that the "default location will be the entire country in which you are based". Maximum spread is the starting state, and it stays that way until a human narrows it.

How small can a local audience get before interest targeting stops working?

Small enough that one interest can break it. In the source video a 25 mile radius holds 1 to 1.2 million people, and one interest with Advantage detailed targeting switched off cuts that to 71,000. A regional security firm starts below that ceiling, so the consequence is repetition, not reach.

The numbers in the video make the squeeze concrete. At 0:00 Heath refers back to earlier videos where he "might recommend not advertising to an audience less than half a million people", then says that is "not always possible with local businesses". At 3:55 a 25 mile radius around his own town returns an estimated "1 to 1.2 million" people, and he adds that he would want the eventual audience "to be above 250 000 people".

Then interest targeting collapses it. At 6:17, after picking one interest and switching off Advantage detailed targeting, he reports that the selection "brought our audience all the way down to 71 000 to 84 000 that's just not going to be big enough". The order matters. In the video the estimate does not move until the Advantage toggle is off, which is the moment the real number appears.

Now apply that to a security business. A regional MSSP does not sell to a metro. It sells to the IT decision makers inside the subset of local companies that fit its profile. Pull that count from your own CRM rather than from an article. Whatever number you get, it sits below every audience figure in the video.

What follows from that is reasoning, not sourced fact:

• Your ads become a persistent local signal. With a small pool the same people see the same creative repeatedly. That includes competitors, current clients, former employees and anyone doing casual reconnaissance on your firm.
• Campaign timing can read as news. A sudden heavy push on one service line in one metro is legible to people watching. Whether that matters depends on your book of business, so check it against your own client sensitivities instead of assuming it is fine.
• The temptation is to widen the map. Heath is direct about that at 7:50: "don't artificially increase the geographical area in order to make your audience size larger that's silly". In the same block he notes his own city has "only something like 110 000 people that live here" and accepts the small number.

Should a security firm upload its client list to an ad platform?

Not without a contract review first. The video's warm audience set loads the email list and website visitors, and its lookalike is seeded from website visitors of the last 180 days. If your email list holds incident response or compliance clients, membership in that list is itself sensitive information.

At 12:39 Heath lists the warm audiences to load into the retargeting ad set, including "people who are on our email list and people who have visited our website". Separately, at 9:25, he explains the lookalike he prepared: the 10 percent of people in the UK "that are most similar to the people that have visited our website within the last 180 days". The 180 day window belongs to that website visitor source audience, not to the retargeting set. The automatic captions drop the percent sign after each 10 and split lookalike into two words, which is why the quoted text reads the way it does.

None of that is a problem for a bakery. For a firm whose client list is the sensitive asset, it is a decision that belongs to someone with contract authority rather than to whoever has the ad account open. What follows is standard practice offered as judgment, not guidance from the video:

• Read the confidentiality clause in your MSA before any list leaves your systems. Security engagements often restrict disclosure of the relationship itself, not only the findings.
• Keep the marketing list and the delivery contact list separate at the source. Merging them once is very hard to unmerge.
• Prefer seeds that are not client identities. Website visitor audiences and content downloaders carry less contractual weight than a customer roster.
• Log what was uploaded, by whom, on what date, and where the approval came from. If you cannot answer that in a vendor review, the answer is that you do not know.
• Turn off the expansion defaults. Heath does this himself, saying at 10:13 that he would "get rid of Advantage Plus lookalike audience which expands it Beyond", and warning at 12:39 to "absolutely make sure that you don't have Advantage custom audience selected". He is optimizing for performance. You would also be containing scope.

He does note at 10:13 that "look like audiences typically do perform well particularly for local businesses", and he makes an exception to his own audience size floor for them. That is a real trade-off rather than a reason to skip the review. The technique works. The open question is what you feed it.

What does a compromised ad account expose at a security company?

More than budget. In our assessment an ad account with admin rights holds the uploaded customer audiences, the website visitor audiences, the billing details and the ability to publish under your own brand. For a security vendor, an attacker posting from your page is a credibility problem before it is a financial one.

The video does not touch this at all. What follows is ordinary access control practice applied to a system that rarely reaches the asset list:

• If ad platform administration is attached to someone's personal social profile, that personal account is now in scope. It needs the same authentication requirements as any other privileged access.
• Named accounts only. A shared login on a marketing tool is still a shared login.
• Agencies, contractors and the freelancer who built one campaign years ago all sit in the access list until somebody removes them. Review it on a schedule.
• Offboarding checklists that cover email and VPN but not the business manager leave a door open.
• Put the ad account in the asset inventory and in the vendor risk register. If it holds customer audiences, it holds customer data.

How can a security firm run local ads without publishing its buyer profile?

Broad targeting. Leaving detailed targeting empty means the platform holds your geography, age range and creative, and nothing about who you consider a buyer. The source video treats this as a normal option rather than a fallback. For a firm that does not want its prospect definition sitting in a config field, that matters.

At 5:30 Heath describes "open targeting otherwise known as broad targeting" and spells out what stays inside it: "age range gender if required the local area". In that setup, he says, "we wouldn't add in any detailed targeting options at all we would just leave that open and that may well be one of our best performing options".

The trade-off, and this part is our judgment rather than his: broad targeting hands more of the decision to the platform, so you will pay to reach people well outside your buyer set, and you lose the ability to test messaging against a defined interest group. Whether that waste is acceptable depends on your cost per qualified conversation, which is a number only you have.

Which tools handle ad targeting, list storage and creative for a security firm?

Different tools touch different pieces of the problem. One holds the targeting config, one holds the list, one makes the images, and none of them make the confidentiality call for you. Here is what each does and where each falls short for a security firm specifically.

Disclosure: SaleADS.ai is the product of the company that publishes this site. It is listed as one option among several, and its limitation column is written to the same standard as the others.

Can competitors see the ads my security firm is running?

Assume yes for the creative. Treat what the ad says, where it points and which page runs it as public information. Before you launch, check whether the platform you advertise on publishes an ad transparency library, then look your own page up in it. Targeting is not published the same way.

The configuration stays private, but it leaks by inference. A competitor who keeps seeing your ad in one city has learned your radius covers that city. This is inference, not disclosure, and how much it matters is a judgment only you can make about your own market.

What is a safer seed audience than a client list?

Anything that is not a client identity. A whitepaper download list, a webinar registration list or a website visitor audience all describe interest rather than an existing engagement. The distinction that matters for a security firm is contractual: a roster of incident response clients discloses relationships, while a content audience discloses only curiosity.

The video uses exactly this kind of seed. Heath's lookalike is built from website visitors rather than from customers, which happens to be the lower exposure choice, although he selects it for reach rather than for confidentiality.

Is a local audience of 70,000 people too small to advertise to?

Not according to the source video. Heath lands on roughly "70 75 000 people" for his own city, carries on anyway, and warns at 7:50 that stretching the map to inflate the number is "silly". His adjustment for a small pool is broader targeting inside the same area, not a bigger area.

Who should own the ad account at a small MSP?

That is a policy call rather than a technical one. Whoever owns it should hold both contract authority and access review responsibility, because the account contains client data and publishes in your name. In most small firms that points at whoever signs client agreements, with marketing holding daily access under a named account.

That split is our reasoning, not a standard anyone publishes. The test to apply is simpler than the org chart: if the person who can upload a client list cannot also read the contract that governs it, the ownership is in the wrong place.

Does broad targeting hurt ad performance?

The source video does not treat it as a downgrade. Heath calls open targeting a setup that "may well be one of our best performing options" at 5:30, and he builds it as one of his ad sets rather than as a fallback. What you give up is testing messaging against a defined interest segment.

Where does this information come from?

Every quoted line, every audience figure and all of the advertising mechanics come from one source, "The RIGHT Way To Do Facebook Targeting For Local Businesses" by Ben Heath, at https://www.youtube.com/watch?v=Bts3_LQtJ0M. Everything about disclosure, confidentiality and access control is reasoning applied on top of it, labeled as such in each section.

From the video: the center point and radius method, the country wide default, the estimated audience for a 25 mile radius, the 250,000 person floor, the interest selection that dropped an audience to 71,000 to 84,000, the warning against inflating geography, the 10 percent lookalike with its 180 day website visitor source, the warm audience list, the Advantage toggles and the definition of open or broad targeting.

Not from the video: attack surface disclosure, contractual confidentiality, ad account access control and asset inventory. The video is a marketing tutorial for local businesses and makes no security claims. No statistic, breach figure, vendor benchmark or price appears anywhere in this article beyond the numbers Heath speaks aloud on screen.