the day-one shortlist: most security demand is decided before the first form

A security buyer who fills in your demo form has usually already decided who they will talk to. The form is where you first see them. It is rarely where they first saw you. A funnel that starts counting at the form fill measures the last third of a decision and reports it as the whole thing.

the list is written before the research starts

6sense’s 2025 buyer experience report, a vendor survey of about 4,000 B2B buyers, puts two numbers next to each other. Buyers made first contact with a seller about 61% of the way through their buying process, down from 69% in the previous edition. And the vendor that won was on the buyer’s day-one shortlist 95% of the time.

How far into the buying process buyers first contact a seller

2025 report61%

Previous edition69%

It is a vendor survey, and 6sense sells software built on this idea, so read it as a direction rather than a law. But the direction matches what Gartner found when it asked buyers how they spend their time: only about 17% of a complex B2B purchase goes to meeting potential suppliers, all of them together. With three vendors in the running, each one gets a small slice of that.

Put the two together and the funnel looks different. Most of the decision happens in places you do not see: a peer chat, a colleague’s previous job, a partner’s recommendation, an analyst note, a conference talk two years ago. Your demo form catches the buyers who already chose to include you.

most of your market is not buying this quarter

John Dawes of the Ehrenberg-Bass Institute, in a 2021 paper for LinkedIn’s B2B Institute, put the idea into a number: at any given time, roughly 95% of potential business buyers are out of the market for a category. They have a contract, a tool that works well enough, or a budget that renews next year. Dawes himself calls the 95% an illustration, not a measurement. The real share depends on how often your category gets bought.

Security fits the pattern well. Most products renew on one to three year terms. A company that bought a new email security tool last spring is not shopping for one this autumn, however good your campaign is. When it does shop, the list it starts from is built from what it remembers.

That gives a funnel two separate jobs:

1. Be remembered by the people who are not buying. This is the larger audience, and the one most funnels ignore because it produces no form fills.
2. Be easy to choose for the few who are. Fast answers, clear pricing logic, references, a partner who can quote.

Most pipeline reviews only measure the second job. Then the team cuts the budget for the first one because “it doesn’t convert”, and two years later the shortlists stop including them.

what gets you on the list in European security

The sources of a shortlist are not mysterious. In security sales across Europe, they tend to come from a small number of places:

• Peers. A CISO asks two other CISOs what they use. You cannot buy your way into that conversation. You can make sure the people who use your product are happy enough to mention it.
• Partners. In much of Central and Eastern Europe, the integrator or reseller who already serves the customer proposes the vendors. If your partner’s sellers do not remember you, the customer will not hear your name.
• People they have met. Local events, user groups, a talk that was useful. Small and repeated beats large and once.
• Things they have read. Guides, comparisons and plain explanations that answer a real question. The ones that stay useful for years do most of the work.
• Regulation pegs. NIS2 and DORA have pushed security onto agendas where it was not before. Content that explains what a rule requires, in plain words, gets saved and forwarded.

None of these show up as a lead on the day they happen. They show up a year later as a demo request that “came from nowhere”.

measure the part you cannot see, roughly

You will not get clean attribution for any of this, and that is fine. A rough signal you read every month beats a precise one that measures the wrong thing. Three cheap ones:

1. Ask on the form. Add one open text field to the demo request: “Where did you hear about us?” Keep it optional and free text. Read every answer. Patterns appear within a quarter: a partner’s name, an event, a guide, a colleague.
2. Ask in the first call. “Who else are you looking at, and how did that list come together?” Buyers usually answer. If the list was formed by a consultant or a partner, you learn who shapes demand in that account.
3. Track shortlist rate, not lead count. Of the deals your team heard about, in how many were you invited from the start, and in how many did you join late? Late entry is a sign you were not on the day-one list. Compare win rates for the two groups in your own CRM; that number will tell you more than any benchmark.

what this means for the next campaign

Before planning the next quarter of lead generation, ask one question in the planning meeting: “If none of our target accounts are buying this quarter, what will they remember about us when they are?” If nobody can answer it, the funnel is only working on the 5%.