Casco growth playbook

Keep the six fields, then branch. "CISO or security team leader" and "Executive responsible for security purchasing" see a calendar right away for a 20-minute scope call with the Technical AE. "Security practitioner evaluating tools" sees the calendar plus the sample report and a short "what to bring" note (a target and test accounts). Visitors arriving from partner or reseller buttons go to a partner call. "Personal interest" goes to the newsletter and the free CVE MCP instead of the sales queue. Beside the form, add three steps (scope call, approve targets and test accounts, a human-approved report within five business days), three customer logos and the customer quote that Casco is "mission-critical for enterprise deals". Pass the clicked button into the CRM so every meeting has a source.

Security leaders who can book a slot while the problem is on their mind do not go cold waiting for an email, and routing keeps AE time for buyers. Showing the five-business-day promise next to the form answers the first question a buyer with an audit deadline has.

[ ] Hidden source field on every Book a demo / Schedule a pentest / partner / reseller button
[ ] Calendar for CISO / security leader and purchasing executive roles
[ ] Calendar + sample report for practitioners
[ ] Partner call link for partner and reseller sources
[ ] Newsletter + CVE MCP for Personal interest
[ ] Three-step 'what happens next' block
[ ] Three logos and one customer quote
[ ] Confirmation email asking for targets and test accounts
[ ] Weekly report: meetings held by role and source

• Unqualified visitors book AE time

  Show the calendar only for buyer roles with a work-email domain.

• Founder calendars overflow

  Use 20-minute scope slots and round-robin.

• Your websiteDemo page: "Tell us about your role and organization to get started." Six fields (first name, last name, email, role, organization, company website) and a "Continue" button; roles offered are "CISO or security team leader", "Security practitioner evaluating tools for my team", "Executive responsible for security purchasing", "Another role" and "Personal interest". No calendar, no customer proof and no description of what happens next. The header's "Book a demo", Supervised's "Schedule a pentest", "See an AI pentest", the partner perks and the reseller page's "Bring us a customer" all lead here.Source
• Site historyChanges to casco.com since November 16, 2025: Google Analytics and Google Tag Manager added; the Google appointment schedule removed; headline changed from "Autonomous Security Testing" to "Security that understands the software you ship."Source
• HiringTechnical Account Executive ($350,000 OTE): "Run the full sales cycle from first touch to close" in a "messy early sales motion building" phase, selling to AppSec leaders and CISOs. Sales Development Representative ($120,000 OTE, San Francisco): account-specific outreach "across email, phone, LinkedIn, and other channels", security events with fast follow-up; "You would rather create the right meeting than hit a vanity activity number."Source
• Your websiteHomepage (checked November 9, 2026): "Security that understands the software you ship."; stats "400+ trusted companies", "99%+ true positive rate", "5.8× better price-performance vs. frontier models", "68% of high/critical findings required signed-in access" and "90% more findings with source code connected"; pricing "depends on scope and the frequency of product changes. Book a demo to learn more."; human-approved pentests within five business days; logos include Microsoft, Gusto, Substack, CrewAI and Baseten; a customer CEO's quote: "Casco is mission-critical for enterprise deals."Source

Publish /sample-report: one redacted finding walked through end to end (impact, reproduction evidence, fix guidance, the retest and the remediation report that keeps the original finding), with the full PDF ungated and an optional work-email field for "a sample scoped to your stack". Link it from the demo confirmation, SDR sequences, the five-things buyer guide and every solution page.

The report is the product a pentest buyer actually receives; showing it early answers the quality question before the call and gives the SDR a useful reason to reach out.

• Competitors copy the format

  The format is not the moat; the proof and retest are.

• Your websiteBlog, "5 things to compare before choosing a pentest quote": compare scope, testing approach, a redacted sample finding, schedule, and remediation and retesting ("The work between those two points is part of what you are paying for"); no price ranges; ends with "Book a Casco walkthrough".Source
• Your websiteEnterprise page: tests production through existing controls with dedicated identities; SSO via Okta, Microsoft Entra ID, Google Workspace and Auth0; source IPs and request IDs for SOC verification; links to the Trust Center and sample pentest report; no customer names or case studies on the page.Source
• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source

Add a one-line footnote to each stat (definition, sample, period), link a short /methods page, and choose one wording for the 400+ figure (customers, or companies tested). Use the same wording in the deck, job posts and outreach.

A sourced number survives a skeptical reader and an AI summary; an unsourced one invites the first objection on the call.

• Some numbers shrink once defined

  A smaller, defined number is more persuasive to this buyer than a larger vague one.

• Your websiteHomepage (checked November 9, 2026): "Security that understands the software you ship."; stats "400+ trusted companies", "99%+ true positive rate", "5.8× better price-performance vs. frontier models", "68% of high/critical findings required signed-in access" and "90% more findings with source code connected"; pricing "depends on scope and the frequency of product changes. Book a demo to learn more."; human-approved pentests within five business days; logos include Microsoft, Gusto, Substack, CrewAI and Baseten; a customer CEO's quote: "Casco is mission-critical for enterprise deals."Source
• Your websiteSeries A post (July 13, 2026): a "$100M valuation Series A" led by Standard Capital with FundersClub, Y Combinator and Rebel Fund, bringing total funding to $17M; Casco "already found critical vulnerabilities in 400+ companies"; Standard Capital's general partner, formerly Stripe's head of security: "Casco is the tool I wish I'd had at Stripe."Source
• HiringTechnical Account Executive ($350,000 OTE): "Run the full sales cycle from first touch to close" in a "messy early sales motion building" phase, selling to AppSec leaders and CISOs. Sales Development Representative ($120,000 OTE, San Francisco): account-specific outreach "across email, phone, LinkedIn, and other channels", security events with fast follow-up; "You would rather create the right meeting than hit a vanity activity number."Source

List the nine third-party services with an owner and purpose for each; remove any nobody owns or that duplicate another tool; load the remaining marketing pixels after the first interaction; trim unused JavaScript (about 569 KB) and compress images (about 499 KB). Re-test with PageSpeed and watch the field INP.

A security buyer's first click should feel instant, and a smaller tag set is easier to own and audit.

• Attribution data drops

  Check conversions in analytics before and after each removal.

• PageSpeedHomepage, November 9, 2026: mobile performance 52, desktop 73; accessibility and SEO 100; lab LCP 3.8 s; 11.1 MB across 110 requests; Google Tag Manager loads 830 KB with 872 ms of main-thread blocking; nine third-party services including ad and social pixels; savings available from unused JavaScript (about 569 KB) and images (about 499 KB). Real visitors: LCP 2.2 s (good) but INP 240 ms, so the page fails Core Web Vitals on responsiveness.Source
• Site historyChanges to casco.com since November 16, 2025: Google Analytics and Google Tag Manager added; the Google appointment schedule removed; headline changed from "Autonomous Security Testing" to "Security that understands the software you ship."Source

Publish /pricing with the drivers (number of apps and APIs, roles and test accounts, cloud and network scope, how often you ship, supervised or autonomous) and three worked examples, for example a seed-stage SaaS before SOC 2, a Series B with an API and mobile app, and an enterprise with continuous testing, each with a price band and what is included (retest window, attestation letter). Add a short scope form that hands the inputs to the AE.

Ranges qualify buyers before the call and remove the fear of an open-ended quote; competitors that hide prices make Casco's openness a difference.

• Anchoring big deals low

  Show bands with clear drivers, and a separate enterprise row.

• Your websiteCasco Supervised: "Our pentest pricing is based on the scope of the test."; reports "Within 5 business days latest", or "within a few business hours for a rush fee"; free retesting for 90 days by default, longer at extra cost; remediation reports keep original findings (no "clean" reports); attestation letters and a trust-center summary available.Source
• Your websiteBlog, "5 things to compare before choosing a pentest quote": compare scope, testing approach, a redacted sample finding, schedule, and remediation and retesting ("The work between those two points is part of what you are paying for"); no price ranges; ends with "Book a Casco walkthrough".Source
• Your websiteContent hub titles include "What Do Companies Use to Map Penetration Test Evidence to CMMC Level 2 Controls", "NIS2 and Continuous Security Testing: What EU Essential Entities Are Doing", an FAQ on predictable-priced pentesting, "Paying Per Retest Round: What Fast Shipping Teams Use Instead" and "Paying for a Scanner, a Bug Bounty and an Annual Pentest: How Startups Consolidate".Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", free unlimited retesting, "#1 on HackerOne", demo only; Cobalt, "Go from scope to active pentest in hours", a credit model and a downloadable "State of Pentesting 2026" report; Horizon3.ai, "7,012 customers" and a 4.7 Gartner Peer Insights rating, demo only. Casco's own listicles also name Strix and FireCompass.See the research Source

For each listicle, add a named author from the security team, a date, the criteria and how each was checked, links to every vendor, and a line saying Casco wrote it. Then publish three fair comparison pages (Casco vs XBOW, Cobalt and Horizon3.ai) covering approach, authenticated testing, retest terms, reporting, compliance and pricing model, dated and refreshed each quarter.

Transparent comparisons earn the trust that self-ranking spends, and they still answer the questions buyers and AI assistants ask.

• Casco no longer ranks first everywhere

  Say where each tool fits; buyers trust a vendor that admits fit.

• Your websiteContent hub at /content with 50 article links (12 listicles, 8 FAQs, 4 decision guides, 1 explainer, 25 recommended posts). The listicle "Continuous Penetration Testing Platforms That Prove Security to Enterprise Buyers" ranks four options "with Casco at the top", ahead of XBOW, Strix and FireCompass; no author or date is shown, and only Casco's entry carries links.Source
• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", free unlimited retesting, "#1 on HackerOne", demo only; Cobalt, "Go from scope to active pentest in hours", a credit model and a downloadable "State of Pentesting 2026" report; Horizon3.ai, "7,012 customers" and a 4.7 Gartner Peer Insights rating, demo only. Casco's own listicles also name Strix and FireCompass.See the research Source
• HiringTechnical Account Executive ($350,000 OTE): "Run the full sales cycle from first touch to close" in a "messy early sales motion building" phase, selling to AppSec leaders and CISOs. Sales Development Representative ($120,000 OTE, San Francisco): account-specific outreach "across email, phone, LinkedIn, and other channels", security events with fast follow-up; "You would rather create the right meeting than hit a vanity activity number."Source

Interview five customers across segments (AI startup, fintech, enterprise, a compliance-driven buyer, an agent platform) and publish each with one number: critical findings missed by the previous pentest, days to a clean retest, enterprise deals unblocked, or hours saved on triage. Add a /customers index and link the right story from each solution page and the enterprise page.

Peer proof with a number is what a CISO forwards to their CFO; logos alone do not say what changed.

• Security customers decline to be named

  Offer anonymised stories by industry and size.

• Your websiteCrewAI customer story: quotes from CrewAI's CEO ("Casco is the obvious security solution for AI systems") and Head of Security ("the first cybersecurity product that makes security testing high-quality, fast, and easy"); no figures on results and no link to other customer stories.Source
• Your websiteHomepage (checked November 9, 2026): "Security that understands the software you ship."; stats "400+ trusted companies", "99%+ true positive rate", "5.8× better price-performance vs. frontier models", "68% of high/critical findings required signed-in access" and "90% more findings with source code connected"; pricing "depends on scope and the frequency of product changes. Book a demo to learn more."; human-approved pentests within five business days; logos include Microsoft, Gusto, Substack, CrewAI and Baseten; a customer CEO's quote: "Casco is mission-critical for enterprise deals."Source
• Your websiteEnterprise page: tests production through existing controls with dedicated identities; SSO via Okta, Microsoft Entra ID, Google Workspace and Auth0; source IPs and request IDs for SOC verification; links to the Trust Center and sample pentest report; no customer names or case studies on the page.Source

Publish five pages: "Pentest for SOC 2", "for ISO 27001", "for HIPAA", "for CMMC Level 2" and "for NIS2". Each covers what the auditor expects, what scope usually satisfies it, the report and attestation letter, how retesting works within the audit window, a timeline from scope call to report, and a sample control mapping. Link the existing FAQ and explainer articles to them.

Compliance deadlines create urgent, budgeted demand, and buyers search by framework, not by asset type.

• Overpromising audit outcomes

  Say what the report provides and advise confirming scope with the auditor, as the AI pentesting FAQ already does.

• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source
• Your websiteHomepage products: AI and supervised pentesting for web, API, cloud, mobile, AI apps and agents, and networks; connected workflows "Email Triage, MCP Workflows, Context Refinement, Slack Bot, and Network Observability"; testing "even behind Cloudflare challenges, CAPTCHAs, and firewall rules"; testing keeps scope and attack history and replays proven attacks to verify fixes; support for SOC 2, ISO 27001 and HIPAA reviews, and a Business Associate Agreement on request.Source
• Your websiteContent hub titles include "What Do Companies Use to Map Penetration Test Evidence to CMMC Level 2 Controls", "NIS2 and Continuous Security Testing: What EU Essential Entities Are Doing", an FAQ on predictable-priced pentesting, "Paying Per Retest Round: What Fast Shipping Teams Use Instead" and "Paying for a Scanner, a Bug Bounty and an Annual Pentest: How Startups Consolidate".Source
• Your websiteAI pentesting page: Casco is "a CREST-accredited penetration testing provider"; a table compares scanners, manual tests and AI pentesting; the FAQ says AI cannot fully replace a human tester in every case and advises confirming scope and report format with the auditor before a SOC 2 or ISO 27001 test; final CTA "Provide a target and test accounts"; no pricing or turnaround on the page.Source

Keep the anonymous endpoint and keep tool output strictly factual. Add an optional free key (email only) that unlocks a weekly digest of new CVEs for the packages the key has checked. On the CVE web pages and in the digest (not in tool responses), offer "Is this reachable in your app? Casco can test it" with a link to the routed demo page. Count requests, keys and companies per week.

A developer whose agent flags a vulnerable dependency has a live question that only an exploit test answers; the digest keeps Casco in front of them until the next one.

• Developers see it as bait

  Keep the free endpoint unchanged and the tool output free of marketing.

• Privacy of package lists

  Store checked packages only for key holders who opt in to the digest.

• #1 Turn the one-step "Continue" demo form into a routed booking page: security leaders pick a time, everyone else gets the right next step

• Your websiteCVE Intelligence for Agents: a free CVE MCP with "No signup, OAuth, API key, or local server to install"; four read-only tools, including a dependency check of up to 100 package versions per call; it warns that unknown results are not clean and "no_known_vulnerabilities" is "not proof of safety"; links to "Book a demo"; a separate authenticated MCP serves customers' own findings; no usage figures published.Source
• HiringGrowth Engineer (San Francisco, $180,000 base): wire "the automation layer (APIs, webhooks, LLM agents)" that turns product triggers into upsells; test channels by hand before automating them; channels are HackerNews, Reddit and LinkedIn; "We care about pipeline, product usage, and revenue."Source

Fix a publishing day and a two-issue buffer. Add a signup option to receive remediation guides for chosen ecosystems (Rails, Go, Node, Python, Java) as they publish. Each alert carries the fix, how to verify it, and a link to the routed demo page for teams that want the fix retested.

Ecosystem alerts are useful enough to subscribe to at work, and each one is a reason to talk about verifying fixes, which is what Casco sells.

• Alert fatigue

  Only critical and high CVEs, and a weekly roll-up option.

• Your websiteNewsletter: "A bi-weekly cybersecurity briefing from Casco" with a work-email signup; five issues from July 22 to October 21, 2026, including "9,308 leaked AWS keys still work" and "Attack probes arrived 10 minutes after an OCaml security fix went public".Source
• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source
• Your websiteCVE Intelligence for Agents: a free CVE MCP with "No signup, OAuth, API key, or local server to install"; four read-only tools, including a dependency check of up to 100 package versions per call; it warns that unknown results are not clean and "no_known_vulnerabilities" is "not proof of safety"; links to "Book a demo"; a separate authenticated MCP serves customers' own findings; no usage figures published.Source

Define "first verified finding" as the activation event and track days from signature to it for every customer. Build a guided setup in the console: approve targets, create test users per role with a checklist for MFA and SSO, a connection test, then a first run. Send nudges by email and Slack when a step stalls, and alert the Customer Success Engineer after 48 hours of no progress.

Early proof of value drives renewal and expansion, and a guided checklist removes the manual back-and-forth both new roles are hired to reduce.

• Customers cannot create test accounts quickly

  Offer a short call with the CSE to set them up together.

• HiringProduct Engineer ($200,000 base): "Map and improve the experience from contract signature through onboarding, activation" and on to renewal, across email, Slack or Teams, notifications and the console, so new customers reach "meaningful product value with less friction and less manual guidance". Customer Success Engineer: guide customers from "signed contract" to "fully operational".Source
• Your websiteHomepage (checked November 9, 2026): "Security that understands the software you ship."; stats "400+ trusted companies", "99%+ true positive rate", "5.8× better price-performance vs. frontier models", "68% of high/critical findings required signed-in access" and "90% more findings with source code connected"; pricing "depends on scope and the frequency of product changes. Book a demo to learn more."; human-approved pentests within five business days; logos include Microsoft, Gusto, Substack, CrewAI and Baseten; a customer CEO's quote: "Casco is mission-critical for enterprise deals."Source
• Your websiteAI pentesting page: Casco is "a CREST-accredited penetration testing provider"; a table compares scanners, manual tests and AI pentesting; the FAQ says AI cannot fully replace a human tester in every case and advises confirming scope and report format with the auditor before a SOC 2 or ISO 27001 test; final CTA "Provide a target and test accounts"; no pricing or turnaround on the page.Source

Thirty days before each customer's retest window closes, send the security lead a short summary: findings fixed and verified, findings still open, and releases shipped since the test. Offer continuous testing that keeps retesting every fix, with a price that credits part of the pentest fee. The Technical AE follows up with accounts that have open findings or frequent releases.

It turns a one-off pentest into a subscription at the moment the customer can see what continuous testing would have caught, and it answers the competitor's unlimited-retest offer.

• Feels like a hard sell

  Lead with the useful summary; the offer is one line.

• Your websiteCasco Supervised: "Our pentest pricing is based on the scope of the test."; reports "Within 5 business days latest", or "within a few business hours for a rush fee"; free retesting for 90 days by default, longer at extra cost; remediation reports keep original findings (no "clean" reports); attestation letters and a trust-center summary available.Source
• HiringGrowth Engineer (San Francisco, $180,000 base): wire "the automation layer (APIs, webhooks, LLM agents)" that turns product triggers into upsells; test channels by hand before automating them; channels are HackerNews, Reddit and LinkedIn; "We care about pipeline, product usage, and revenue."Source
• Your websiteContent hub titles include "What Do Companies Use to Map Penetration Test Evidence to CMMC Level 2 Controls", "NIS2 and Continuous Security Testing: What EU Essential Entities Are Doing", an FAQ on predictable-priced pentesting, "Paying Per Retest Round: What Fast Shipping Teams Use Instead" and "Paying for a Scanner, a Bug Bounty and an Annual Pentest: How Startups Consolidate".Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", free unlimited retesting, "#1 on HackerOne", demo only; Cobalt, "Go from scope to active pentest in hours", a credit model and a downloadable "State of Pentesting 2026" report; Horizon3.ai, "7,012 customers" and a 4.7 Gartner Peer Insights rating, demo only. Casco's own listicles also name Strix and FireCompass.See the research Source

Send each customer a one-page monthly report by email and Slack: new endpoints and releases covered, tests run, findings opened and closed, fixes verified by replayed attacks, and time to fix compared with last month. Give the security lead a version they can forward to their CTO or board.

It makes invisible work visible to the person who renews the contract and gives the security lead something to show upward.

• Quiet months look empty

  Show coverage and tests run, not only findings.

• #11 Measure and shorten the time from signed contract to the first verified finding, starting with test accounts

• HiringProduct Engineer ($200,000 base): "Map and improve the experience from contract signature through onboarding, activation" and on to renewal, across email, Slack or Teams, notifications and the console, so new customers reach "meaningful product value with less friction and less manual guidance". Customer Success Engineer: guide customers from "signed contract" to "fully operational".Source
• Your websiteHomepage products: AI and supervised pentesting for web, API, cloud, mobile, AI apps and agents, and networks; connected workflows "Email Triage, MCP Workflows, Context Refinement, Slack Bot, and Network Observability"; testing "even behind Cloudflare challenges, CAPTCHAs, and firewall rules"; testing keeps scope and attack history and replays proven attacks to verify fixes; support for SOC 2, ISO 27001 and HIPAA reviews, and a Business Associate Agreement on request.Source

Commit to one substantial piece of original research a month (a new attack class, a dataset or a tool), released with a technical write-up, a reproducible demo and responsible-disclosure notes. Post it to Hacker News and the relevant subreddit from an engineer's account, answer comments for the first hours, and end each post with one next step: the newsletter, the CVE MCP or a scoped test.

Security engineers trust research over ads, and one strong post can reach more of the target audience than a month of outbound.

• Research names other companies

  Publish only after fixes or with consent, and anonymise where needed.

• ChannelsBlog research includes "We hacked YC agents", "How to hack Ford for $130k", an ElectricSQL SQL injection and "The Blueprint of a North Korean Attack on Open-Source". Hacker News: 8 mentions, top story 32 points, last mention October 30, 2026. YouTube @getcasco: 21 videos, 69 subscribers, 17,610 views.Source
• HiringGrowth Engineer (San Francisco, $180,000 base): wire "the automation layer (APIs, webhooks, LLM agents)" that turns product triggers into upsells; test channels by hand before automating them; channels are HackerNews, Reddit and LinkedIn; "We care about pipeline, product usage, and revenue."Source
• HiringSeven open roles on casco.com/careers: Software Engineer (remote US), Product Engineer, Offensive Security Engineer (remote US; "Research emerging attack vectors, particularly those involving AI/LLM systems and applications"), Customer Success Engineer, Sales Development Representative, Technical Account Executive and Growth Engineer, the rest in San Francisco.Source

Publish the referral share and a reseller discount range, a partner pilot kit (a client-ready one-pager, the sample report, a scoping checklist and a white-label report example), and a partner registration form that protects the partner's deal. Recruit ten vCISOs and compliance advisors for a first cohort.

Advisors already own the moment a company is told it needs a pentest; clear economics let them recommend Casco without a negotiation.

• Channel conflict with direct sales

  Deal registration decides ownership.

• Your websitePartners page: perks with Vouch Insurance (5% off premiums and 20% off annual pentesting), Scout (20% off) and Network Right (up to 20% off), plus "Priority scheduling for security reviews". Reseller page: referral and managed-service models for MSPs, MSSPs, consultancies, vCISOs and compliance advisors, paid by revenue share or reseller discount with no published rates; "Bring us a customer" and "Design your partner motion" both go to the demo page.Source
• HiringTechnical Account Executive ($350,000 OTE): "Run the full sales cycle from first touch to close" in a "messy early sales motion building" phase, selling to AppSec leaders and CISOs. Sales Development Representative ($120,000 OTE, San Francisco): account-specific outreach "across email, phone, LinkedIn, and other channels", security events with fast follow-up; "You would rather create the right meeting than hit a vanity activity number."Source

Recruit three to five perk partners at those moments (compliance automation platforms, startup accelerators and banking or credit programs for startups, more insurers), each with a dedicated page that states the perk and pre-fills the partner on the routed demo form. Report partner-sourced meetings monthly and share them with each partner.

Perks placed where the need first appears catch buyers before they collect three quotes, and tracking makes each partnership worth renewing.

• Discounts erode price

  Cap perks at the current 20% and tie them to annual terms.

• #1 Turn the one-step "Continue" demo form into a routed booking page: security leaders pick a time, everyone else gets the right next step

• Your websitePartners page: perks with Vouch Insurance (5% off premiums and 20% off annual pentesting), Scout (20% off) and Network Right (up to 20% off), plus "Priority scheduling for security reviews". Reseller page: referral and managed-service models for MSPs, MSSPs, consultancies, vCISOs and compliance advisors, paid by revenue share or reseller discount with no published rates; "Bring us a customer" and "Design your partner motion" both go to the demo page.Source
• Your websiteDemo page: "Tell us about your role and organization to get started." Six fields (first name, last name, email, role, organization, company website) and a "Continue" button; roles offered are "CISO or security team leader", "Security practitioner evaluating tools for my team", "Executive responsible for security purchasing", "Another role" and "Personal interest". No calendar, no customer proof and no description of what happens next. The header's "Book a demo", Supervised's "Schedule a pentest", "See an AI pentest", the partner perks and the reseller page's "Bring us a customer" all lead here.Source

After the estimate, show the same budget side by side with continuous testing (coverage, time to finding, retesting, triage effort), offer Email Triage for the reports a bounty will bring, and add one button to the routed demo page with the estimate passed along. Refresh the market data to 2026 and say so.

It meets a budget holder at the moment they are comparing spend, with their own numbers on the screen.

• Comparison looks rigged

  Show where a bounty is the better fit.

• #1 Turn the one-step "Continue" demo form into a routed booking page: security leaders pick a time, everyone else gets the right next step

• Your websiteBug Bounty Budget Calculator: "Estimate your bug bounty program costs based on company size and expected vulnerability findings" from "real market data from 2024-2025".Source
• Your websiteContent hub titles include "What Do Companies Use to Map Penetration Test Evidence to CMMC Level 2 Controls", "NIS2 and Continuous Security Testing: What EU Essential Entities Are Doing", an FAQ on predictable-priced pentesting, "Paying Per Retest Round: What Fast Shipping Teams Use Instead" and "Paying for a Scanner, a Bug Bounty and an Annual Pentest: How Startups Consolidate".Source
• Your websiteHomepage products: AI and supervised pentesting for web, API, cloud, mobile, AI apps and agents, and networks; connected workflows "Email Triage, MCP Workflows, Context Refinement, Slack Bot, and Network Observability"; testing "even behind Cloudflare challenges, CAPTCHAs, and firewall rules"; testing keeps scope and attack history and replays proven attacks to verify fixes; support for SOC 2, ISO 27001 and HIPAA reviews, and a Business Associate Agreement on request.Source

Capture three things per conversation on the floor (stack, compliance deadline, current pentest provider). Within 48 hours, send a note with the most relevant remediation guide or research post for their stack, the sample report and a calendar link for a scoped walkthrough. Tag every event lead in the CRM and compare meeting rates by event.

Speed and relevance decide event ROI, and Casco's CVE guides and research give a ready, specific reason to write.

• Scanned badges without a conversation

  Send those the newsletter, not a sales note.

• #2 Give the sample pentest report its own page and put it in every follow-up

• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source
• HiringTechnical Account Executive ($350,000 OTE): "Run the full sales cycle from first touch to close" in a "messy early sales motion building" phase, selling to AppSec leaders and CISOs. Sales Development Representative ($120,000 OTE, San Francisco): account-specific outreach "across email, phone, LinkedIn, and other channels", security events with fast follow-up; "You would rather create the right meeting than hit a vanity activity number."Source
• Your websiteNewsletter: "A bi-weekly cybersecurity briefing from Casco" with a work-email signup; five issues from July 22 to October 21, 2026, including "9,308 leaked AWS keys still work" and "Attack probes arrived 10 minutes after an OCaml security fix went public".Source

Publish an annual report from anonymised findings across 400+ companies: share of critical issues behind login, the most common authorization flaws, issues in AI agents and MCP integrations, time to fix and how often fixes fail retest. Release the headline numbers free with a method section, the full report with a work-email download, a launch on Hacker News and LinkedIn, and a briefing for security press.

Original data earns links, press and AI citations for a year, and it sells the thesis that testing must happen signed-in and continuously.

• Any customer becomes identifiable

  Publish only aggregates above a minimum sample.

• #3 Put a source and date under every homepage number, starting with "400+ trusted companies"

• Your websiteHomepage (checked November 9, 2026): "Security that understands the software you ship."; stats "400+ trusted companies", "99%+ true positive rate", "5.8× better price-performance vs. frontier models", "68% of high/critical findings required signed-in access" and "90% more findings with source code connected"; pricing "depends on scope and the frequency of product changes. Book a demo to learn more."; human-approved pentests within five business days; logos include Microsoft, Gusto, Substack, CrewAI and Baseten; a customer CEO's quote: "Casco is mission-critical for enterprise deals."Source
• Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", free unlimited retesting, "#1 on HackerOne", demo only; Cobalt, "Go from scope to active pentest in hours", a credit model and a downloadable "State of Pentesting 2026" report; Horizon3.ai, "7,012 customers" and a 4.7 Gartner Peer Insights rating, demo only. Casco's own listicles also name Strix and FireCompass.See the research Source
• ChannelsBlog research includes "We hacked YC agents", "How to hack Ford for $130k", an ElectricSQL SQL injection and "The Blueprint of a North Korean Attack on Open-Source". Hacker News: 8 mentions, top story 32 points, last mention October 30, 2026. YouTube @getcasco: 21 videos, 69 subscribers, 17,610 views.Source

Give each customer an optional, permissioned verification page: tested scope, testing cadence, date of last test, the share of findings fixed and verified by retest, and an attestation download, with no technical detail. Customers link it from their trust center and questionnaires. The page footer says how the testing works and links to Casco, and each referral visit is tracked.

It saves customers time in every security review and puts Casco in front of the reviewers who buy pentests themselves; continuous status rewards staying on continuous testing.

• Page read as a guarantee of security

  State what was tested and when, never "secure".

• Customers fear exposure

  Opt-in, no technical details, revocable at any time.

• #13 A monthly "what you shipped, what we tested, what we proved fixed" report for each customer's security lead

• Your websiteHomepage (checked November 9, 2026): "Security that understands the software you ship."; stats "400+ trusted companies", "99%+ true positive rate", "5.8× better price-performance vs. frontier models", "68% of high/critical findings required signed-in access" and "90% more findings with source code connected"; pricing "depends on scope and the frequency of product changes. Book a demo to learn more."; human-approved pentests within five business days; logos include Microsoft, Gusto, Substack, CrewAI and Baseten; a customer CEO's quote: "Casco is mission-critical for enterprise deals."Source
• Your websiteCasco Supervised: "Our pentest pricing is based on the scope of the test."; reports "Within 5 business days latest", or "within a few business hours for a rush fee"; free retesting for 90 days by default, longer at extra cost; remediation reports keep original findings (no "clean" reports); attestation letters and a trust-center summary available.Source
• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source

Recruit two or three government-focused resellers or integrators that hold contract vehicles agencies already use, give them the managed-service terms and a government pilot kit (scope template, capability statement, FedRAMP package link, sample report), and target small and mid-size agency programs that need continuous testing of web apps and AI systems. Add a "How to buy" section to /gov listing each route as it goes live.

Partners with vehicles remove the slowest step in public-sector buying, and a certified, continuous product is easier to place than a new contract.

• Long public-sector cycles

  Keep the commercial motion as the core and treat government as a parallel bet.

• #15 Publish the reseller economics and a one-customer pilot kit for vCISOs and MSSPs

• Your websiteCasco for Government: "FedRAMP Certified under the 20x Program path at Class A" (Marketplace package FR2632731472, status as of November 5, 2026); UEI and CAGE code published; a one-page capability statement dated November 2026; enterprise customers listed include Microsoft, Gusto, Sprout Social and CrewAI; no contract vehicles named; contact is a government team email address.Source
• Your websitePartners page: perks with Vouch Insurance (5% off premiums and 20% off annual pentesting), Scout (20% off) and Network Right (up to 20% off), plus "Priority scheduling for security reviews". Reseller page: referral and managed-service models for MSPs, MSSPs, consultancies, vCISOs and compliance advisors, paid by revenue share or reseller discount with no published rates; "Bring us a customer" and "Design your partner motion" both go to the demo page.Source

Offer a limited number of free, scoped checks per month: one agent, with written authorization from the startup, focused on tool permissions, data exposure and prompt-injection paths, delivered as a short report with fixes. Recruit through accelerators, founder communities and the research posts. Convert with a startup plan for continuous testing once they raise or sign their first enterprise customer.

It turns Casco's most memorable research into a service founders ask for, and it captures AI companies before their first enterprise security review.

• Demand exceeds capacity

  Fixed monthly quota and a waitlist.

• Testing without proper consent

  Only after signed authorization from the agent's owner.

• #14 One original research drop a month, written for Hacker News and Reddit, with a clear next step

• ChannelsBlog research includes "We hacked YC agents", "How to hack Ford for $130k", an ElectricSQL SQL injection and "The Blueprint of a North Korean Attack on Open-Source". Hacker News: 8 mentions, top story 32 points, last mention October 30, 2026. YouTube @getcasco: 21 videos, 69 subscribers, 17,610 views.Source
• Your websiteCrewAI customer story: quotes from CrewAI's CEO ("Casco is the obvious security solution for AI systems") and Head of Security ("the first cybersecurity product that makes security testing high-quality, fast, and easy"); no figures on results and no link to other customer stories.Source
• Your websiteSitemap (127 URLs, checked November 9, 2026): eight solution pages organised by what is tested (AI, web app, API, cloud, mobile, AI agent and network pentesting, plus vulnerability prioritization); 39 blog posts, of which one is a customer story (CrewAI) and seven are CVE remediation guides; no pricing page, no customers index, no sample report page and no "Casco vs" pages; two free tools (CVSS and bug bounty calculators); RSAC and Black Hat event pages; partner and reseller pages.Source

Offer Email Triage free for one security@ inbox and a capped number of reports a month: each report is classified, de-duplicated and, where safe and in scope, reproduced. When a report is confirmed as real, offer a scoped Casco test of the affected area. Upgrade to paid on volume or when the team wants continuous testing.

A free tool that handles a real weekly annoyance gets Casco inside small companies early, and a confirmed report is the strongest buying trigger there is.

• Cost of free usage

  A low monthly cap and reproduction only for in-scope, authorized targets.

• Your websiteHomepage products: AI and supervised pentesting for web, API, cloud, mobile, AI apps and agents, and networks; connected workflows "Email Triage, MCP Workflows, Context Refinement, Slack Bot, and Network Observability"; testing "even behind Cloudflare challenges, CAPTCHAs, and firewall rules"; testing keeps scope and attack history and replays proven attacks to verify fixes; support for SOC 2, ISO 27001 and HIPAA reviews, and a Business Associate Agreement on request.Source
• Your websiteContent hub titles include "What Do Companies Use to Map Penetration Test Evidence to CMMC Level 2 Controls", "NIS2 and Continuous Security Testing: What EU Essential Entities Are Doing", an FAQ on predictable-priced pentesting, "Paying Per Retest Round: What Fast Shipping Teams Use Instead" and "Paying for a Scanner, a Bug Bounty and an Annual Pentest: How Startups Consolidate".Source