Why does job title targeting fail for cybersecurity ads?
========================================================
Publicado: 2026-09-05
Original: https://saasinsiderhub.site/posts/why-does-job-title-targeting-fail-for-cybersecurity-ads/

You build an audience of "CISO, Security Director, Head of InfoSec," launch, and the leads that arrive cannot sign anything. Meanwhile the person who signs never told a platform that their detection coverage has holes. Demand generation for a security product breaks at the targeting layer for a reason most ad advice never touches.

Job title targeting fails because the person who evaluates a security product is often not the person who signs the contract, and neither lists a problem on a public profile. Title filters match what someone declared about themselves, not the risk they carry. Creative that names the problem lets the right readers self-identify.

## Why do cybersecurity leads from job title targeting never have budget?
Leads from title targeting often lack budget because a security purchase collects several signatures. A detection engineer tests the tool, a compliance lead checks framework mapping, a CISO defends the spend, and procurement rewrites the contract. One title reaches one seat at a table where any of the others can stop the deal.

Check these four failure modes against your own closed deals before blaming the creative:

- The evaluator is not the signer. You optimize for demo requests from practitioners who have no budget line.
- Titles are unreliable strings. "Security Architect," "Staff Engineer, Detection," and "IT Manager" can be the same job at three companies.
- The blocker is invisible. Legal, procurement and the platform owner rarely appear in any audience you can build, and they stop deals anyway.
- Self reported profiles lag reality. Someone updated their title once, two roles ago.

## What do you use for targeting when nobody admits they have a security problem?
Target the symptom instead of the confession. An ad implying the reader's environment is exposed asks for an admission few people make in a feed. A description of a workday they recognize, like an alert queue that never clears, asks for nothing. Put that symptom in the copy and let the platform find whoever responds.

This is the part of the Sabri Suby video that carries over to this market. He says the algorithm analyzes your image, copy, offer and landing page to find the person to serve the ad to, described at 2:24, and his conclusion at 9:38 is that "the creative is the targeting now."

Symptoms that work as targeting inputs for security buyers:

- Tool sprawl after an acquisition
- An audit deadline with evidence collection still manual
- A SIEM bill growing faster than the log volume it covers
- An on call rotation covered by fewer people than it was designed for

## How do you write a security ad that the right person self-selects into?
Name the job the person does, not the title they hold. A line like "for teams running detection on a SIEM they inherited" describes a week the reader recognizes, which a title filter cannot do. Suby's argument is that the platform then reads that specificity and goes looking for more of the people who react.

He calls the inserted category word an identity trigger. At 4:00 he describes it directly: "It is a category word that is what we call an identity trigger and it also feeds the algorithm to know who it should be going out there and looking for."

For a vendor in this market, the identity trigger is usually a stack or a mandate rather than a demographic. Run one control ad, then variants that swap in the specific context:

Variant swaps in | Reader it pulls
The framework | SOC 2, HIPAA, PCI DSS teams facing an audit window
The stack | Teams on a specific EDR, cloud provider or identity layer
The team shape | One person security teams, MSSP operators, platform teams doing detection part time
The event | Post incident review, post acquisition consolidation, first hire into a security role

## Is broad targeting safe for a cybersecurity vendor?
Broad targeting is workable for a cybersecurity vendor when the creative does the filtering. A generic security message handed to a broad audience can collect students, job seekers and curious IT hobbyists. A message naming a specific stack and a specific failure narrows the responses at the creative level instead of the panel.

Suby's argument for that trade is about context volume. At 9:38 he says: "if they have a limited context window for your ads, then the amount of people that they can target for that creative is also going to be limited." His summary of the tactic, at 10:26, is "Broad targeting with super specific creative is the new meta."

Where this gets harder here than in ecommerce:

- Claims go through review. Long form copy that names outcomes may need legal or compliance sign off before it runs.
- Lead quality is not a click. If your CRM counts a form fill as a lead, broad will look great and close nothing. Score on qualified opportunity, not volume.
- A countable market punishes waste. If your buyer list is a set of named accounts you could count by hand, cheap reach is not automatically progress.The test costs one duplicated ad. Suby's instruction at 10:26 is to duplicate your interest stacked winner, strip the targeting, run both side by side and check your CPAs after seven days. Swap CPA for cost per qualified opportunity before you read the result, because a form fill and a real opportunity are not the same event in this funnel.

## How do you retarget a security buying committee that went quiet?
Retarget with a different offer, not with the same demo request. A stalled deal usually stalls for a named reason, like deployment risk, data residency or an unfinished internal review. Each of those reasons deserves its own ad and its own next step, not a louder version of the first one.

Suby's framing at 13:38 is blunt. The "number one reason why people didn't buy is that that offer wasn't right for them." His retargeting stack starts with objection handling, and he is explicit at 14:26 that "the first ad that we like to put together is an objection handling ad."

Mapped to a buying committee in this market:

- Objection ad for the evaluator. Deployment time, agent footprint, what breaks during rollout.
- Proof ad for the sponsor. Named customers in the same regulated segment, if they let you name them.
- Different offer for the blocker. A completed security questionnaire, SOC 2 report access, or an architecture review document instead of a demo.
- Value first offer for everyone. An audit or assessment where the buyer keeps something usable whether they purchase or not.Suby's own conversion claim for mirroring the winning ad headline on the landing page is "a bare minimum of 15 to 20%", stated at 12:02. Treat it as his reported result on his own accounts and measure yours before assuming it transfers.

## Which tools help a small security vendor run this without a media team?
Three jobs have to be covered by a small vendor without a media team, which are producing creative variations, buying the media, and staying in contact with a list through a long cycle. No single tool on this list covers all three. The table shows what each one does and where each one stops.

Tool | What it does | What it solves for targeting in this market | Where it stops | Assumes ad experience
Meta Ads Manager | Buys and manages ads across Facebook and Instagram | Cheap volume for testing which problem statement gets a reaction | Audience data is self reported and interest based, not verified employer data, so a named account list needs another channel | Yes, campaign structure, pixel and event setup are on you
Google Ads | Buys search, display and video placements | Captures buyers already searching a category or a competitor name | Search only reaches problems the buyer has already put into words | Yes, keyword and match type management required
Canva | Design tool for producing static and video creative | Lets one person produce many creative variants per week | It produces files, it does not buy media or reach an audience | No
Mailchimp | Email campaigns, lists and automation | Keeps contact with known evaluators across a long buying cycle | Works from a list you already have, so it does not create new demand | No, but the list and the copy are yours
Hootsuite | Schedules and publishes social posts across accounts | Maintains presence between deals | Publishing and scheduling only, so creative production and paid distribution sit elsewhere | No
SaleADS.ai | AI software that creates and launches advertising campaigns on Meta, Google and TikTok for business owners, with no design or advertising expertise required | Turns a written problem statement into launched campaigns without hiring a media buyer | You still write the problem statement and the offer, and it does not run your compliance review or your account based sales motion | No, though the problem statement and the offer are still yours
SaleADS.ai is the product of the company that publishes this site.

## What else do people ask about targeting cybersecurity buyers?
Does broad targeting work for enterprise deals with a large buying committee? It works for the top of the funnel, where the goal is finding practitioners who recognize the problem. It does not replace an account based motion for the committee itself. Use paid to create the internal champion, then work the account through sales.

Should we exclude job seekers and students from security campaigns? Exclusions help, but creative filters harder. An ad written for someone who already owns the problem gets ignored by people who do not. Check your form fills for personal email domains and company size to see how much noise you actually have.

How many creative variants does this require? Enough to keep testing weekly. Suby's recommendation at 2:24 is to dedicate one hour per week to producing fresh creative from your winning offer.

What metric should a security vendor optimize for? Cost per qualified opportunity, read at the business level rather than the ad account level. Suby makes that same level distinction for blended return on ad spend at 16:02, and on why the number has to be one you trust he says at 16:50: "Data gives you confidence."

## Where does this information come from?
The advertising mechanics in this article come from "Learn 97% of Meta Ads in Under 19 minutes" by the Sabri Suby channel, a 19 minute video with 296,171 views on the transcript used here. Suby opens at 0:00 saying he has "spent over $300 million on meta ads".

Taken from the video: the identity trigger concept for inserting a category word into winning creative, the claim that the creative now carries the targeting signal, the broad versus interest stacked seven day test, the objection handling retargeting sequence, the one hour per week creative block, the business level rather than ad account level reading of results, and his reported 15 to 20 percent conversion lift from mirroring ad headlines on the landing page.

Not from the video: the buying committee structure, the symptom based targeting inputs, the compliance and lead quality constraints, cost per qualified opportunity as the metric, and everything specific to how security vendors sell. The video is a general Meta Ads tutorial. It never mentions cybersecurity, SIEM, SOC 2 or any security topic.