Candor growth playbook

Fix the number today, then audit every sample case and FAQ for the same kind of slip. Go further and turn the demo into proof: make each sentence in the AI summary link to the event rows behind it (the platform already shows an evidence chain of "6 events, 4 sources, 3 attachments"). Generate the demo summary and the event rows from one data file so they can't drift apart again. Rewrite the Gartner FAQ to name the actual categories in plain words (data loss prevention and insider risk management), or remove it. Then use "every sentence in a Candor case links to its evidence" as a line in demos.

Enterprise security buyers screen AI products for hallucinated or inconsistent output. A visible mismatch in the hero demo undercuts the "trustworthy cases" claim, and a demo that cites its evidence shows the opposite. Rivals publish precision claims (Nightfall "95% detection precision", Cyberhaven "~90% fewer false positives"), so Candor's demo itself has to carry the trust argument.

[ ] Contractor case: event count matches the AI summary
[ ] Every sample case: counts, dates, roles and sources match
[ ] Summaries and event rows come from one fixture
[ ] Each summary sentence links to its evidence rows
[ ] "Sample data" label on the Action Center
[ ] Gartner FAQ: typo fixed and categories named, or removed
[ ] Every page proofread before release

• Visitors take demo data as real customer data

  Keep a small "sample data" label on the Action Center.

• Evidence links slow the page

  Load the links after the first paint, as static data.

• Your websitePlatform page (fetched twice on November 9, 2026): in the sample Action Center case for a product contractor, the event row reads "Accessed personal email: mail.qq.com 21x" while the AI case summary says the contractor accessed personal email "25 times throughout March". The page also shows plain-English policies, plain-English investigation questions across Microsoft 365 and Okta, automated investigation reports with an evidence chain ("6 events, 4 sources, 3 attachments"), and high-intent sources (Copilot chats, SharePoint searches, Outlook outbound email, ServiceNow requests) beside CrowdStrike, Okta, Palo Alto Networks and Workday.Source
• Your websiteBlog ("Field Notes"): five posts between June 5 and September 1, 2026, all by a co-founder, each ending with the Calendly link; no newsletter signup or related posts. "Shadow AI Broke the Way We Run DLP" says shadow AI "occasionally accounted for 60-70% of the DLP events" a team handled; "Why Insider Risk Needs to Be Reinvented" sets out seven principles, including "Analysts need to trust alerts" and "Value needs to come fast".Source
• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source
• Competitor researchNightfall homepage: controls data across "AI agents, MCP servers, endpoints, and SaaS"; "95% detection precision", "live in one working hour", "20x average ROI"; an ROI calculator, plans, customer stories, a G2 badge and a "View Trust Center" link in the header.See the research Source

Add "Trust" to the nav and footer, and link the SOC 2 badge and the data-handling FAQ to it. Fill the trust center's empty sections: subprocessors, key policies (access, encryption, retention, incident response) and the data-handling answers already on the homepage (no training on customer data, inference on isolated infrastructure, data stays in the customer's tenancy). Mention the trust center in the demo confirmation email so security reviewers can start before the first call.

For a product that reads employees' activity, the security review is part of the sale. Making it self-serve shortens the cycle and shows confidence.

• Requests from non-buyers

  Keep the NDA-gated approval step.

• Trust centertrust.candor.security is a SafeBase trust center showing an independent SOC 2 Type 2 examination by Sensiba (Security criteria), with the report shared on request after review; it lists no policies or subprocessors. The main site says "SOC 2 Type II Certified" but its nav, footer and sitemap do not link the trust center.Source
• Competitor researchNightfall homepage: controls data across "AI agents, MCP servers, endpoints, and SaaS"; "95% detection precision", "live in one working hour", "20x average ROI"; an ROI calculator, plans, customer stories, a G2 badge and a "View Trust Center" link in the header.See the research Source
• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source

Move passed events to "Past" automatically by date, add a "Meet us at…" booking link with the booth or meeting spot for each upcoming event, and give each past event a short recap (talk slides or a takeaway post) for people who missed it. List the next quarter's events as soon as they're booked.

Conference meetings are Candor's main channel. A dated page looks abandoned, while pre-booked meetings turn a booth into pipeline.

• Few bookings ahead of time

  Also offer a side dinner or coffee slot (idea 17).

• Your websiteEvents page (checked November 9, 2026): the "Upcoming" list still includes SecureWorld St. Louis (September 2), the National Insider Risk Symposium (September 15-16, Washington, DC) and InfoSec World (October 11-15), alongside the API Cyber Conference (November 10-11, Houston); past events include Black Hat USA, FutureCon Omaha and FutureCon Chicago. The team says it prefers in-person conversations; no event has a meeting link.Source
• Your websiteSite-wide (checked November 9, 2026): every call to action is "Book a demo", linking to a co-founder's personal 30-minute Calendly; there is no contact form, email address, pricing page or newsletter. The nav shows "Case Studies (Coming soon)". The same three testimonials (a Deputy CISO at a Fortune 500 enterprise, an Insider Threat Program Lead at a global semiconductor company, and a named enterprise CISO) repeat on the homepage, platform and solution pages.Source

Post the five missing roles on the YC job board (or another applicant tracker) with their own text, salary and equity ranges, and link each button to its own post. Add a general "Don't see your role?" application. Mention the founder's investigator background and the hard problems (inline inspection, low-overhead agents, explainable AI) in each post.

Specialist engineers decide whether to apply from the role text. Matching links stop silent drop-off and make the careers page credible to buyers too.

• Too many roles for a tiny team

  Mark the top two priorities and pause the rest.

• Your websiteCareers page: six open San Francisco engineering roles (Senior Full-Stack Engineer; Full-Stack Engineer, Investigations; Full-Stack Engineer, Integrations; AI/ML Engineer; Endpoint Engineer, macOS; Systems Engineer, DLP Engine), and every "Apply" button links to the same Senior Full-Stack Engineer posting on Y Combinator.Source
• HiringSenior Full-Stack Engineer (Y Combinator job board): "Candor is building the insider threat layer for the modern enterprise"; builds "investigation workflows, AI-assisted triage, detection modules, reporting, and containment actions" and integrations with "Microsoft 365, Slack, Okta, CrowdStrike, SIEMs, and ServiceNow"; "the hard problems are real: noisy data, privacy-preserving investigations, explainable AI"; $150K-$250K and 0.20%-0.50% equity. The YC profile lists Winter 2025, founded 2024, a team of 3 and "agentic data loss prevention (DLP) and insider risk management".Source

Restyle the row as "Our team previously built at", with smaller, greyed logos, and move it under the founder story. Put the strongest real proof in the customer-logo spot: the Fortune 500 and semiconductor testimonials, the SOC 2 Type II badge linked to the trust center, and "Backed by Y Combinator".

Clear proof avoids an awkward moment in diligence and lets the real customer evidence lead.

• Less visual weight above the fold

  Use the semiconductor and Fortune 500 quotes as a strip instead.

• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source
• Site researchSite research (programmable.info): domain registered March 21, 2026 and first archived April 21, 2026; the headline changed from "The Future of Human Risk Intelligence" to the current one and the site moved from Framer to Astro; authority score 16; no social share image; an automated scan of the homepage listed the AMD, JPMorgan, NASA and Uber logos as notable customers.Source

Keep Calendly for people ready to book. Add a four-field request (work email, workspace: Microsoft 365 or Google, identity provider, team size) that routes to a shared security@ or sales@ inbox and to the right founder. Add a two-minute recorded walkthrough for people not ready to talk. Use the answers to tailor the first demo to their stack.

More entry points capture buyers at different stages, and knowing the stack before the call makes the demo specific.

• Spam or vendor pitches

  Require a work email and filter by domain.

• Your websiteSite-wide (checked November 9, 2026): every call to action is "Book a demo", linking to a co-founder's personal 30-minute Calendly; there is no contact form, email address, pricing page or newsletter. The nav shows "Case Studies (Coming soon)". The same three testimonials (a Deputy CISO at a Fortune 500 enterprise, an Insider Threat Program Lead at a global semiconductor company, and a named enterprise CISO) repeat on the homepage, platform and solution pages.Source
• Competitor researchCyberhaven homepage: "the AI-native data security solution that modernizes DLP, DSPM, & IRM for Humans and Agents"; "~90% fewer false positives"; "4 min" from alert to answer; ISO 27001 and 42001 among its certifications; a /comparisons hub, a /customers page with named testimonials, an on-demand demo and a hands-on lab.See the research Source
• HiringSenior Full-Stack Engineer (Y Combinator job board): "Candor is building the insider threat layer for the modern enterprise"; builds "investigation workflows, AI-assisted triage, detection modules, reporting, and containment actions" and integrations with "Microsoft 365, Slack, Okta, CrowdStrike, SIEMs, and ServiceNow"; "the hard problems are real: noisy data, privacy-preserving investigations, explainable AI"; $150K-$250K and 0.20%-0.50% equity. The YC profile lists Winter 2025, founded 2024, a team of 3 and "agentic data loss prevention (DLP) and insider risk management".Source

Add an email subscribe box to every post and the blog index, plus "related posts" links to the matching solution page. Send a short monthly note: one new post, one anonymised pattern from the field and one upcoming event. Promote the existing RSS feed too.

Enterprise cycles are long. A monthly note keeps Candor in mind until the budget opens, and it builds an owned audience for a new domain.

• The cadence slips

  Monthly, short, and written ahead.

• Your websiteBlog ("Field Notes"): five posts between June 5 and September 1, 2026, all by a co-founder, each ending with the Calendly link; no newsletter signup or related posts. "Shadow AI Broke the Way We Run DLP" says shadow AI "occasionally accounted for 60-70% of the DLP events" a team handled; "Why Insider Risk Needs to Be Reinvented" sets out seven principles, including "Analysts need to trust alerts" and "Value needs to come fast".Source
• Your websiteSite-wide (checked November 9, 2026): every call to action is "Book a demo", linking to a co-founder's personal 30-minute Calendly; there is no contact form, email address, pricing page or newsletter. The nav shows "Case Studies (Coming soon)". The same three testimonials (a Deputy CISO at a Fortune 500 enterprise, an Insider Threat Program Lead at a global semiconductor company, and a named enterprise CISO) repeat on the homepage, platform and solution pages.Source
• Competitor researchDTEX homepage: "The Unified Platform for Human + Data + AI Risk"; headline numbers from the Ponemon 2026 Cost of Insider Risks report it sponsors ($19.5M average annual cost of insider incidents); a value calculator, analyst proof (Gartner, Forrester TEI, GigaOm) and a newsletter.See the research Source

Serve the hero image in AVIF or WebP at mobile sizes with priority loading, trim the render-blocking font and CSS requests, and add an Open Graph image (the headline plus a sample case card) to the homepage, platform and every blog post. Add a main landmark for the one accessibility issue.

Founders share Field Notes posts and the platform page, and a preview card lifts clicks from those shares. The speed work keeps mobile visitors fast as the site grows.

• Blurry hero image

  Check quality on retina screens.

• PageSpeedGoogle PageSpeed (mobile, tested November 2026): performance 72 (desktop 99); lab Largest Contentful Paint 6.1s on mobile, where the LCP element is an image; images are 1,188 KB of a 1,738 KB page, with 448 KB of image savings available and 1.05s of render-blocking requests. Real-visitor (Chrome UX) data shows LCP 788 ms at p75 and CLS 0, so actual visitors already see the page quickly. One accessibility issue: no main landmark.Source
• Site researchSite research (programmable.info): domain registered March 21, 2026 and first archived April 21, 2026; the headline changed from "The Future of Human Risk Intelligence" to the current one and the site moved from Framer to Astro; authority score 16; no social share image; an automated scan of the homepage listed the AMD, JPMorgan, NASA and Uber logos as notable customers.Source

Write three anonymised case studies, one per quoted customer, using a fixed shape: environment, the problem with prior tooling, deployment time, the first real case Candor surfaced (generalised), and numbers such as cases per week, time to decide and alerts avoided. Get written approval for each. Publish them at /customers and point the "Case Studies" nav item there.

Buyers comparing a three-person startup with funded incumbents need to see that it already works somewhere like their company. Anonymised but specific beats a repeated quote.

• A customer declines

  Offer a fully anonymised industry-only version.

• Your websiteSite-wide (checked November 9, 2026): every call to action is "Book a demo", linking to a co-founder's personal 30-minute Calendly; there is no contact form, email address, pricing page or newsletter. The nav shows "Case Studies (Coming soon)". The same three testimonials (a Deputy CISO at a Fortune 500 enterprise, an Insider Threat Program Lead at a global semiconductor company, and a named enterprise CISO) repeat on the homepage, platform and solution pages.Source
• Your websiteSitemap (17 URLs, checked November 9, 2026): homepage, about, platform, careers, events, privacy policy, responsible business, four solution pages (prevent critical data leaks, mitigate shadow AI, catch novel insider risk, reduce security negligence), the blog index and five posts. No case study, comparison, integration, documentation, pricing or trust pages.Source
• Competitor researchCyberhaven homepage: "the AI-native data security solution that modernizes DLP, DSPM, & IRM for Humans and Agents"; "~90% fewer false positives"; "4 min" from alert to answer; ISO 27001 and 42001 among its certifications; a /comparisons hub, a /customers page with named testimonials, an on-demand demo and a hands-on lab.See the research Source

Write four pages, each with the same table: time to first value, need for baselines or rules, investigation output, shadow AI handling, data handling and deployment. Be fair about where each rival is stronger (for example, Purview is already licensed in many Microsoft 365 tenants). End each page with "run both side by side for two weeks".

Buyers searching "Purview insider risk alternative" or "Cyberhaven vs" are already in market. Honest pages also earn trust with skeptical CISOs.

• Claims go out of date

  Date pages and cite the rival's own page.

• Your websiteSitemap (17 URLs, checked November 9, 2026): homepage, about, platform, careers, events, privacy policy, responsible business, four solution pages (prevent critical data leaks, mitigate shadow AI, catch novel insider risk, reduce security negligence), the blog index and five posts. No case study, comparison, integration, documentation, pricing or trust pages.Source
• Competitor researchCyberhaven homepage: "the AI-native data security solution that modernizes DLP, DSPM, & IRM for Humans and Agents"; "~90% fewer false positives"; "4 min" from alert to answer; ISO 27001 and 42001 among its certifications; a /comparisons hub, a /customers page with named testimonials, an on-demand demo and a hands-on lab.See the research Source
• Competitor researchDTEX homepage: "The Unified Platform for Human + Data + AI Risk"; headline numbers from the Ponemon 2026 Cost of Insider Risks report it sponsors ($19.5M average annual cost of insider incidents); a value calculator, analyst proof (Gartner, Forrester TEI, GigaOm) and a newsletter.See the research Source
• Your websiteCatch Novel Insider Risk page: no long history or baseline needed; a contractor's first-day example (an AI assistant query about acquisition targets, an internal project search and deal-room files); cases open "for investigation, not verdicts", with plausible benign explanations in the brief.Source

Publish a page per source: what Candor ingests, the permissions it needs (read-only scopes), setup time, an example signal (for example, a Copilot query about credentials), and how it joins other sources in a case. Add an /integrations index. These pages also answer security reviewers' first questions.

Integration-plus-use-case searches (for example "Copilot insider risk" or "ServiceNow DLP") are specific and high intent, and permission transparency speeds security review.

• Revealing detection logic

  Describe inputs and outcomes, not detection rules.

• Your websitePlatform page (fetched twice on November 9, 2026): in the sample Action Center case for a product contractor, the event row reads "Accessed personal email: mail.qq.com 21x" while the AI case summary says the contractor accessed personal email "25 times throughout March". The page also shows plain-English policies, plain-English investigation questions across Microsoft 365 and Okta, automated investigation reports with an evidence chain ("6 events, 4 sources, 3 attachments"), and high-intent sources (Copilot chats, SharePoint searches, Outlook outbound email, ServiceNow requests) beside CrowdStrike, Okta, Palo Alto Networks and Workday.Source
• Your websiteSitemap (17 URLs, checked November 9, 2026): homepage, about, platform, careers, events, privacy policy, responsible business, four solution pages (prevent critical data leaks, mitigate shadow AI, catch novel insider risk, reduce security negligence), the blog index and five posts. No case study, comparison, integration, documentation, pricing or trust pages.Source
• HiringSenior Full-Stack Engineer (Y Combinator job board): "Candor is building the insider threat layer for the modern enterprise"; builds "investigation workflows, AI-assisted triage, detection modules, reporting, and containment actions" and integrations with "Microsoft 365, Slack, Okta, CrowdStrike, SIEMs, and ServiceNow"; "the hard problems are real: noisy data, privacy-preserving investigations, explainable AI"; $150K-$250K and 0.20%-0.50% equity. The YC profile lists Winter 2025, founded 2024, a team of 3 and "agentic data loss prevention (DLP) and insider risk management".Source

Package a two-week, monitor-only assessment on a pilot group, ending with a report: share of AI use on governed versus personal accounts, the types of data pasted (code, pricing, credentials), the top five risky patterns and a recommended policy set in plain English. Give it its own landing page from the shadow AI solution page, with the scope and data-handling terms written out.

A concrete, low-risk first step with a deliverable is easier to approve than a platform purchase, and the report becomes the business case for expanding.

• Free work without conversion

  Agree success criteria and a decision date up front.

• Your websiteBlog ("Field Notes"): five posts between June 5 and September 1, 2026, all by a co-founder, each ending with the Calendly link; no newsletter signup or related posts. "Shadow AI Broke the Way We Run DLP" says shadow AI "occasionally accounted for 60-70% of the DLP events" a team handled; "Why Insider Risk Needs to Be Reinvented" sets out seven principles, including "Analysts need to trust alerts" and "Value needs to come fast".Source
• Your websiteMitigate Shadow AI page: Candor records destination and account ownership for browser uploads and pastes, labels company-account use "governed" and personal-account use "shadow AI", and shows policy outcomes such as public product docs on a governed account (Continue), internal source code on a personal account (Alert), customer pricing on a personal account (Ask why) and credentials on an unknown account (Block). The page has no FAQ and no proof beyond the shared testimonials.Source
• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source

Publish a short methodology note: what MTTI means here, the comparison (prior tooling vs Candor), how many cases and teams it covers, and the range rather than only the best result. Link it from the claim. Add the same footnote pattern to "Detection on Day 1" and the one-week deployment claim.

A sourced number earns trust and gets repeated, while an unsourced one invites doubt on the first call.

• The real figure is lower

  Publish the honest range; credibility is worth more than the headline.

• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source
• Competitor researchCyberhaven homepage: "the AI-native data security solution that modernizes DLP, DSPM, & IRM for Humans and Agents"; "~90% fewer false positives"; "4 min" from alert to answer; ISO 27001 and 42001 among its certifications; a /comparisons hub, a /customers page with named testimonials, an on-demand demo and a hands-on lab.See the research Source
• Competitor researchNightfall homepage: controls data across "AI agents, MCP servers, endpoints, and SaaS"; "95% detection precision", "live in one working hour", "20x average ROI"; an ROI calculator, plans, customer stories, a G2 badge and a "View Trust Center" link in the header.See the research Source

Publish 30 example policies grouped by risk (shadow AI, departing employees, source code, customer data, credentials, M&A material), each with the plain-English text, the response, why it matters and the false positives it avoids. Each has a "Try this policy in Candor" link to a demo. Make it a public page, not gated.

It's useful on its own, it ranks for practical searches, and it demonstrates the product's core idea without a demo.

• Rivals copy it

  The policies only work this simply in Candor; that is the point.

• Your websiteMitigate Shadow AI page: Candor records destination and account ownership for browser uploads and pastes, labels company-account use "governed" and personal-account use "shadow AI", and shows policy outcomes such as public product docs on a governed account (Continue), internal source code on a personal account (Alert), customer pricing on a personal account (Ask why) and credentials on an unknown account (Block). The page has no FAQ and no proof beyond the shared testimonials.Source
• Your websitePlatform page (fetched twice on November 9, 2026): in the sample Action Center case for a product contractor, the event row reads "Accessed personal email: mail.qq.com 21x" while the AI case summary says the contractor accessed personal email "25 times throughout March". The page also shows plain-English policies, plain-English investigation questions across Microsoft 365 and Okta, automated investigation reports with an evidence chain ("6 events, 4 sources, 3 attachments"), and high-intent sources (Copilot chats, SharePoint searches, Outlook outbound email, ServiceNow requests) beside CrowdStrike, Okta, Palo Alto Networks and Workday.Source
• Your websiteSitemap (17 URLs, checked November 9, 2026): homepage, about, platform, careers, events, privacy policy, responsible business, four solution pages (prevent critical data leaks, mitigate shadow AI, catch novel insider risk, reduce security negligence), the blog index and five posts. No case study, comparison, integration, documentation, pricing or trust pages.Source

Publish a free investigation report template (Word and Google Docs) with sections for timeline, evidence chain, benign explanations considered, decision and follow-up, plus a filled-in sample from demo data. Ask for a work email to download, and follow up with "see it filled in automatically".

It's a practical tool with a clear next step: anyone who downloads it has felt the manual pain that Candor removes.

• Downloads from students or vendors

  Score leads by company domain.

• Your websitePlatform page (fetched twice on November 9, 2026): in the sample Action Center case for a product contractor, the event row reads "Accessed personal email: mail.qq.com 21x" while the AI case summary says the contractor accessed personal email "25 times throughout March". The page also shows plain-English policies, plain-English investigation questions across Microsoft 365 and Okta, automated investigation reports with an evidence chain ("6 events, 4 sources, 3 attachments"), and high-intent sources (Copilot chats, SharePoint searches, Outlook outbound email, ServiceNow requests) beside CrowdStrike, Okta, Palo Alto Networks and Workday.Source
• Your websiteCatch Novel Insider Risk page: no long history or baseline needed; a contractor's first-day example (an AI assistant query about acquisition targets, an internal project search and deal-room files); cases open "for investigation, not verdicts", with plausible benign explanations in the brief.Source

Publish one heavily anonymised, composite case a month: the signals, what a rule-based tool would have flagged (or missed), how the story came together, the benign explanations ruled out, and the lesson for program design. Turn each one into a conference talk segment and a newsletter issue. Have legal review every case for confidentiality.

Stories are what insider threat professionals share and remember, and they prove the "stitch the story" claim better than any feature list.

• Confidentiality with a past employer

  Use composites only, with counsel review.

• PressSecureWorld speaker bio: a Candor co-founder was previously an insider risk investigator in the semiconductor industry, leading cases on data exfiltration, nation-state sabotage and competitor recruitment.Source
• Your websiteBlog ("Field Notes"): five posts between June 5 and September 1, 2026, all by a co-founder, each ending with the Calendly link; no newsletter signup or related posts. "Shadow AI Broke the Way We Run DLP" says shadow AI "occasionally accounted for 60-70% of the DLP events" a team handled; "Why Insider Risk Needs to Be Reinvented" sets out seven principles, including "Analysts need to trust alerts" and "Value needs to come fast".Source
• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source

For each conference, host one invite-only roundtable near the venue: a 20-minute case-file talk (idea 16) and an open discussion of program challenges, with no product pitch. Invite through the newsletter, LinkedIn and the event's attendee tools. Follow up within 48 hours with the case slides and an offer of a shadow AI assessment (idea 10).

Insider risk is a small, tight community whose leads value peers. A useful room builds trust and referrals at a lower cost per meeting than a booth.

• No-shows

  Invite 20 to seat 12 and confirm the day before.

• #16 A "case files" series: anonymised insider cases told by a founder who used to investigate them

• Your websiteEvents page (checked November 9, 2026): the "Upcoming" list still includes SecureWorld St. Louis (September 2), the National Insider Risk Symposium (September 15-16, Washington, DC) and InfoSec World (October 11-15), alongside the API Cyber Conference (November 10-11, Houston); past events include Black Hat USA, FutureCon Omaha and FutureCon Chicago. The team says it prefers in-person conversations; no event has a meeting link.Source
• PressSecureWorld speaker bio: a Candor co-founder was previously an insider risk investigator in the semiconductor industry, leading cases on data exfiltration, nation-state sabotage and competitor recruitment.Source

Publish a page explaining what Candor is priced on (for example, monitored users), what's included, typical starting ranges or "starts at" anchors, the pilot structure (idea 20), and purchasing options (direct or marketplace). Add a simple cost-of-triage calculator: analyst hours spent on false positives today versus with Candor.

Transparent pricing screens out mismatched buyers and speeds up the ones who fit, and the calculator turns the alert-fatigue story into a budget line.

• Anchoring too low for large deals

  Publish what pricing is based on and a starting point, not a ceiling.

• Your websiteSite-wide (checked November 9, 2026): every call to action is "Book a demo", linking to a co-founder's personal 30-minute Calendly; there is no contact form, email address, pricing page or newsletter. The nav shows "Case Studies (Coming soon)". The same three testimonials (a Deputy CISO at a Fortune 500 enterprise, an Insider Threat Program Lead at a global semiconductor company, and a named enterprise CISO) repeat on the homepage, platform and solution pages.Source
• Competitor researchNightfall homepage: controls data across "AI agents, MCP servers, endpoints, and SaaS"; "95% detection precision", "live in one working hour", "20x average ROI"; an ROI calculator, plans, customer stories, a G2 badge and a "View Trust Center" link in the header.See the research Source
• Competitor researchDTEX homepage: "The Unified Platform for Human + Data + AI Risk"; headline numbers from the Ponemon 2026 Cost of Insider Risks report it sponsors ($19.5M average annual cost of insider incidents); a value calculator, analyst proof (Gartner, Forrester TEI, GigaOm) and a newsletter.See the research Source

Standardise one pilot: scope (users and sources), success criteria agreed up front (cases surfaced, analyst time per case, false positives), a mid-point review, and a price that converts at the end. Publish the outline on the pricing page and use it in every proposal. Track every pilot against the same scorecard.

Committing to a date makes the speed claim believable and turns pilots into decisions instead of open-ended trials.

• A slow customer IT team misses day 7

  Start the clock when access is granted.

• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source
• Your websiteBlog ("Field Notes"): five posts between June 5 and September 1, 2026, all by a co-founder, each ending with the Calendly link; no newsletter signup or related posts. "Shadow AI Broke the Way We Run DLP" says shadow AI "occasionally accounted for 60-70% of the DLP events" a team handled; "Why Insider Risk Needs to Be Reinvented" sets out seven principles, including "Analysts need to trust alerts" and "Value needs to come fast".Source
• Competitor researchNightfall homepage: controls data across "AI agents, MCP servers, endpoints, and SaaS"; "95% detection precision", "live in one working hour", "20x average ROI"; an ROI calculator, plans, customer stories, a G2 badge and a "View Trust Center" link in the header.See the research Source

Write two industry pages showing the top insider patterns for the sector, sample cases from demo data (for example, a departing engineer collecting design files), the relevant testimonial, and the sources that matter most. Use them in event follow-ups and targeted LinkedIn outreach to insider threat leads in those sectors.

Sector-specific proof shortens the "do you understand us?" phase of a sale, and both sectors have budgets for protecting IP.

• Looks narrow to other sectors

  Keep use-case pages as the main navigation.

• Your websiteSite-wide (checked November 9, 2026): every call to action is "Book a demo", linking to a co-founder's personal 30-minute Calendly; there is no contact form, email address, pricing page or newsletter. The nav shows "Case Studies (Coming soon)". The same three testimonials (a Deputy CISO at a Fortune 500 enterprise, an Insider Threat Program Lead at a global semiconductor company, and a named enterprise CISO) repeat on the homepage, platform and solution pages.Source
• Your websiteEvents page (checked November 9, 2026): the "Upcoming" list still includes SecureWorld St. Louis (September 2), the National Insider Risk Symposium (September 15-16, Washington, DC) and InfoSec World (October 11-15), alongside the API Cyber Conference (November 10-11, Houston); past events include Black Hat USA, FutureCon Omaha and FutureCon Chicago. The team says it prefers in-person conversations; no event has a meeting link.Source
• PressSecureWorld speaker bio: a Candor co-founder was previously an insider risk investigator in the semiconductor industry, leading cases on data exfiltration, nation-state sabotage and competitor recruitment.Source

Pick the two marketplaces closest to where buyers already have budget: likely the Microsoft commercial marketplace (because Copilot and Purview buyers are the core audience) and one of the CrowdStrike, Okta or ServiceNow app stores. Complete the listing and technical validation, publish a listing page with a short video, and add "Buy through your marketplace" to the pricing page (idea 19).

Buying through committed spend removes a budget objection, and marketplace listings add credibility for a new vendor.

• Listing doesn't create demand alone

  Pair it with co-sell and the integration pages (idea 9).

• #9 One page per integration: what Candor reads from Copilot, SharePoint, Okta, CrowdStrike, ServiceNow and Workday

• Your websitePlatform page (fetched twice on November 9, 2026): in the sample Action Center case for a product contractor, the event row reads "Accessed personal email: mail.qq.com 21x" while the AI case summary says the contractor accessed personal email "25 times throughout March". The page also shows plain-English policies, plain-English investigation questions across Microsoft 365 and Okta, automated investigation reports with an evidence chain ("6 events, 4 sources, 3 attachments"), and high-intent sources (Copilot chats, SharePoint searches, Outlook outbound email, ServiceNow requests) beside CrowdStrike, Okta, Palo Alto Networks and Workday.Source
• HiringSenior Full-Stack Engineer (Y Combinator job board): "Candor is building the insider threat layer for the modern enterprise"; builds "investigation workflows, AI-assisted triage, detection modules, reporting, and containment actions" and integrations with "Microsoft 365, Slack, Okta, CrowdStrike, SIEMs, and ServiceNow"; "the hard problems are real: noisy data, privacy-preserving investigations, explainable AI"; $150K-$250K and 0.20%-0.50% equity. The YC profile lists Winter 2025, founded 2024, a team of 3 and "agentic data loss prevention (DLP) and insider risk management".Source

Invite customers and pilot users to contribute anonymised, aggregated counts only (share of AI use on governed vs personal accounts, data types pasted, policy outcomes such as Ask why vs Block), plus a practitioner survey of insider threat leads. Publish "The State of Shadow AI Data Movement" with the method, sample size and privacy approach up front. Launch it at a major conference with a talk.

Original data earns press, analyst attention and backlinks for a new domain, and frames Candor as the authority on the problem it solves.

• Sample too small

  Lead with the survey and present telemetry as directional.

• #10 Offer a two-week shadow AI assessment that ends with a governed-vs-shadow report
• #12 Turn Field Notes into a newsletter, so CISOs who read one post hear about the next

• Your websiteBlog ("Field Notes"): five posts between June 5 and September 1, 2026, all by a co-founder, each ending with the Calendly link; no newsletter signup or related posts. "Shadow AI Broke the Way We Run DLP" says shadow AI "occasionally accounted for 60-70% of the DLP events" a team handled; "Why Insider Risk Needs to Be Reinvented" sets out seven principles, including "Analysts need to trust alerts" and "Value needs to come fast".Source
• Competitor researchDTEX homepage: "The Unified Platform for Human + Data + AI Risk"; headline numbers from the Ponemon 2026 Cost of Insider Risks report it sponsors ($19.5M average annual cost of insider incidents); a value calculator, analyst proof (Gartner, Forrester TEI, GigaOm) and a newsletter.See the research Source
• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source

Extend the case model to non-human identities: an agent's assigned task, the data it touches, where it sends data and whose permissions it uses. Start with agents inside Microsoft 365 (where Candor already has sources). Open a case when an agent's actions drift from its task, using the same evidence chain as human cases. Run it with two design partners before announcing.

Buyers are adding agents faster than they can govern them, and the "story behind the action" approach transfers naturally. It keeps Candor in the conversation as rivals move there.

• Distracts from the core human insider product

  Gate it on two committed design partners.

• Competitor researchCyberhaven homepage: "the AI-native data security solution that modernizes DLP, DSPM, & IRM for Humans and Agents"; "~90% fewer false positives"; "4 min" from alert to answer; ISO 27001 and 42001 among its certifications; a /comparisons hub, a /customers page with named testimonials, an on-demand demo and a hands-on lab.See the research Source
• Competitor researchNightfall homepage: controls data across "AI agents, MCP servers, endpoints, and SaaS"; "95% detection precision", "live in one working hour", "20x average ROI"; an ROI calculator, plans, customer stories, a G2 badge and a "View Trust Center" link in the header.See the research Source
• Your websitePlatform page (fetched twice on November 9, 2026): in the sample Action Center case for a product contractor, the event row reads "Accessed personal email: mail.qq.com 21x" while the AI case summary says the contractor accessed personal email "25 times throughout March". The page also shows plain-English policies, plain-English investigation questions across Microsoft 365 and Okta, automated investigation reports with an evidence chain ("6 events, 4 sources, 3 attachments"), and high-intent sources (Copilot chats, SharePoint searches, Outlook outbound email, ServiceNow requests) beside CrowdStrike, Okta, Palo Alto Networks and Workday.Source

Assemble a "Procurement pack" in the trust center: the SOC 2 report (on request), the Responsible Business summary, a data flow diagram, the subprocessor list, a pre-filled standard security questionnaire and the insurance certificate. Offer it at the end of every second demo as "send this to procurement now".

Vendor onboarding at large enterprises often adds weeks to a deal. Handing procurement a complete pack early removes that delay, and it signals maturity beyond the team's size.

• Answers go out of date

  Review them with the Responsible Business annual review.

• #2 Link the SafeBase trust center from the site, so the SOC 2 claim is one click from proof

• Your websiteResponsible Business page (published August 9, 2026): Code of Conduct and Supplier Code of Conduct, an anti-corruption program designed around the U.S. FCPA, supplier risk tiering, a speak-up process, 2026 metrics (100% ethics training completion) and disclosures drawing on GRI 2, GRI 205 and the UN Global Compact.Source
• Trust centertrust.candor.security is a SafeBase trust center showing an independent SOC 2 Type 2 examination by Sensiba (Security criteria), with the report shared on request after review; it lists no policies or subprocessors. The main site says "SOC 2 Type II Certified" but its nav, footer and sitemap do not link the trust center.Source
• Your websiteHomepage (checked November 9, 2026): headline "Stitch the story, stop insider risk. Data loss. Alert fatigue."; claims an "80% reduction in MTTI", "Detection on Day 1" and most organizations live within one week; a logo row (AMD, JPMorgan, NASA, Uber) introduced only by the words "Built by AI experts from"; an FAQ headed "What Gartner catagories that Candor fall into?" answered "Candor is best positioned for your DLP and IRM needs."; SOC 2 Type II; customer data is not used for model training and stays in the customer's tenancy.Source