Write a falsifiable acquisition hypothesis
For cybersecurity software, test whether analysts triaging authorized security telemetry experience a costly enough problem when alerts lack enough context to decide which investigation deserves attention to consider a bounded change. The decision owner hypothesis is a security operations lead evaluating a defined coverage gap, and a possible trigger is that the team adds a new environment without a corresponding triage workflow.
The current alternative, manual lookup across existing security tools, is the comparison point. Your experiment should discover whether the proposed workflow earns adoption despite switching effort. It should not treat a compliment about the product as proof of demand.
Run a bounded experiment
An example planning window is one week, but the buyer's availability and implementation needs determine the actual timing. Agree on a manageable number of conversations with the team running the test. That number is a planning choice, not an expected conversion rate.
| Stage | Action | Record |
|---|---|---|
| Prepare | Define the scope needed to evaluate a small, sanitized alert set in an explicitly authorized environment. | Inputs, access, owner, time boundary, and stop conditions. |
| Research | Use "security alert triage" "manual enrichment" and inspect the original source. | Source, date, observed problem, and unresolved questions. |
| Discover | Which authorized telemetry fields are needed to make the next triage decision? | The actual workflow and cost of the current workaround. |
| Check feasibility | What evaluation environment and approval process are available? | Confirmed requirements and unsupported needs. |
| Evaluate | Check whether an analyst can reproduce one triage decision from source evidence and documented enrichment. | A verifiable event, a blocked attempt, or an explicit refusal. |
Set decision rules before reviewing results
A refusal, failed pilot, or invalid hypothesis can be a useful result. Preserve it. Do not replace inconvenient outcomes with a different success definition after the experiment finishes.
- Continue the pilot only when its critical dependency is resolved: security claims require scoped validation; a demo does not establish protection or compliance.
- Stop pursuing a poor-fit account when it belongs to prospects requiring unauthorized scanning, unsupported certifications, or access outside the agreed evaluation.
- If the problem is not recognized in specific examples, revise the audience hypothesis.
- If the problem is recognized but implementation blocks the pilot, revise scope or capability assumptions.
- If the pilot runs, verify the value event: an analyst can reproduce one triage decision from source evidence and documented enrichment.
- If value occurs but the buyer will not continue, investigate the recurring need and the proposed commercial terms.
Keep a learning record another person can review
Use the illustrative signal “Analysts spend more time joining alert context than investigating it. We need to test whether enrichment helps on our own sample alerts.” to practice the distinction between evidence and inference before reviewing real records. By contrast, A public breach headline treated as permission to probe the affected organization. cannot establish the same buying intent.
Record what you planned, what actually happened, the source for each observation, and the decision you made. Keep invitations separate from replies and paid outcomes separate from expressed interest. DemandBolt's project and research workflows can hold the context while you decide the next experiment; the software does not guarantee that an experiment succeeds.
About these playbooks and examples
Prepared by DemandBolt with AI assistance as practical planning resources for people building and selling software. The category scenarios and message examples are illustrative, not quotations from real prospects or claims of customer results. Adapt the hypotheses to your product, verify original sources, and review capabilities before making an offer.
The workflow follows our first-customer guide and buying-signal review method. Our PyInvesting and Rae records distinguish actual internal work from targets. Published .