← Back to blog

Twenty touches, zero conversions: a funnel autopsy

In July I sat down and counted every real market touch the product had received. It came to fewer than twenty. Conversions: zero. This is the autopsy I wrote that day, including the part about what a zero with that sample size actually tells you, which is less than it feels like.

The funnel, honestly

ChannelEffortResult
Landing pageBuilt, properly positioned copyTraffic in the single digits. No inbound.
Direct outreachA handful of prospectsTwo committed to a proof of concept. Both went dark.
Paid adsTwo campaignsZero leads.
Founder contentSixteen-post plan writtenNever published — conflict with my then-employer
Community presenceOne product postPermanent ban from the largest general MSP community
Proof assetsNone public—

What zero does not tell you

Start here, because it is the part people get wrong in both directions.

With fewer than twenty touches, zero conversions carries almost no statistical information about the proposition. I had not learned "service providers do not want this". I had learned "this channel mix, at this level of trust delivery, converts at zero" — which is a fact about my distribution, not about the product.

The opposite error is equally available and more comfortable: treating the zero as pure noise and carrying on building. That is how people spend two years on something nobody asked for. The discipline is to hold both — the sample is too small to indict the proposition, and the things it does indict are real and fixable.

The ads were never going to work

Two campaigns, zero leads, and I want to be clear that this was the expected base rate rather than bad luck. Paid ads from a company page with no followers, no visible human, and no social proof, selling a security product to people whose entire job is being suspicious of unknown vendors — that converts at approximately zero everywhere, for everyone. The money was not wasted on a bad campaign. It was spent on a mechanism that cannot do the job it was given.

The ghosted proofs of concept

Two prospects said yes and then disappeared. This is the highest-signal event in the whole funnel and I did not treat it as such at the time.

The pattern has a name: activation energy exceeding felt pain. Look at what "yes" actually committed them to — sign a trial agreement, run a preparation script, grant a dozen directory permissions, stand up a cloud subscription, provision a model, deploy a container, then wait for incidents to occur. For a committed buyer that is a day's work. For a curious one it is a cliff, and there was nobody standing at the top of it with them.

They were not lying when they committed. The pain of alert overload simply was not burning hotter than the effort plus the internal justification cost of proceeding. That is a product-onboarding failure wearing the costume of a sales failure.

The fix costs nothing and I did not do it. One line to each vanished prospect: "No pitch — closing the loop. What stopped it: effort, risk, timing, or the product itself?" Two answers to that question are worth more than both ad campaigns combined.

The messenger problem

The only channel in the plan that could have built the kind of trust this product needs was the content series — a practitioner writing publicly about the problem. It was written and never published, because at the time it conflicted with my employment.

That single constraint removed the one mechanism that could do the job, and left every remaining channel doing work it is structurally incapable of. Ads cannot establish that an unknown vendor is credible. A landing page cannot. Cold outreach from a name nobody recognises cannot. All three were being asked to substitute for a person with a track record, and none of them substitutes for that.

The community ban compounded it. One product post in a vendor thread, permanent ban — which, on reflection, is the channel working exactly as designed rather than an injustice. Communities trust people with a history, not brands with an announcement. The competitor who owns that community earned it through years of named individuals participating before ever selling anything. That is simultaneously why I lost the channel and the exact playbook I should have been running.

The ratio nobody wants to compute

Roughly ninety-five per cent of effort went into the engine. Intellectual property protection alone received more engineering hours than lead generation received in total — for a business whose binding constraint was never capability.

The uncomfortable reading is that I worked on the engine because the engine is tractable. Distribution is not tractable in the same way; it does not produce a green test run. Given a hard problem with no feedback loop and an interesting one with a fast feedback loop, I picked the interesting one for three months straight and told myself it was sequencing.

The strongest evidence I had — real attack chains investigated end to end, real cost and latency numbers, real reports — was sitting in a private vault while prospects looked at a landing page and a deck. Claims, not evidence. This log is the correction, and it is eleven chapters late.

Who is writing this

I am Ivan Melekhin. Twenty-five years in cybersecurity, most of the last decade running security operations — building and operating distributed SOC and MSSP teams across Asia-Pacific, with a long detour through OT and maritime environments. This log is the build record for an autonomous SOC investigation agent I started in January 2026, written as the decisions happened rather than tidied up afterwards. I am on LinkedIn if you want to argue with any of it.