ProgrammableMarketing/parameter.ai (opens in a new tab)
PDF

Views

  • Plan
  • Roadmap
  • Research

On this page

  • The brief
  • Start here
  • Idea portfolio
  • Effort vs impact
  • This week · 7
  • This quarter · 11
  • Big bets · 3
  • Wildcards · 2
  • How we can help
Generated Nov 9, 2026 1 view
  1. Programmable
  2. Playbooks
  3. Parameter
Parameter logo

growth playbook · Nov 9, 2026

parameter.ai (opens in a new tab)

Parameter growth playbook

Diagnosis

Parameter (formerly Hex Security, a Y Combinator company) has two real assets that its website does not yet turn into pipeline. The first is research: its Labs writeups reach the security community (one hit 365 points and 177 comments on Hacker News), and its own job posts call disclosure "the front door to most of our customer relationships", yet the Labs posts end with no route to a test, a call or a subscription.

The second is product proof at scale (2,300 pentests in three weeks, 10,000+ pull requests reviewed a day), but there are no named customers, no prices and no self-serve path, while XBOW, Horizon3, Cobalt and Aikido all show named customers and Aikido lets buyers start free.

This playbook wires research to sales first, then adds a starting price, a clearer booking flow and honest proof, then builds named customer stories, a data report, GCC compliance pages and a self-serve first app.

Growth Score

6/10

Biggest Opportunity

Turn the research people already read and share into tests of their own apps, with a starting price and a 24-hour first finding as the offer.

Biggest Risk

Better-proven rivals (XBOW with named customers and a #1 HackerOne ranking, Horizon3 with 7,012 customers, Aikido's free tier) win the evaluation because Parameter shows logos of the team's past work rather than named customers, and unexplained headline numbers make careful security buyers doubt the rest.

01

Start here

The three moves to make first. Each one is written up in full below.

  1. 1

    Put "run this on your own app" and a subscribe option at the end of every Labs post, where the research audience currently hits a dead end

    Add the end-of-post block and a subscribe field to the Labs post template.

    High impact First result in With the next Labs post
  2. 2

    Publish a starting price for the fixed-scope Single App pentest

    Agree the lowest Single App price the team would sign today.

    High impact First result in 2-4 weeks
  3. 3

    Tell buyers what happens after "Book a call" and let them pick a time

    Write the three next steps under the form.

    Medium impact First result in 2 weeks

02

Your idea portfolio

23 ideas, grouped by when to run them. Open any idea for how to run it: the steps, who to approach, copy you can use, and how to measure it.

  • 8 ideas are marked Unexpected: plays you are unlikely to have tried.

Every idea placed by the effort it takes against the impact it could have. Quick wins sit top left; select a number to open that idea. The filters below narrow the list by status, timing, category and what Programmable can build.

Effort vs impactEach number is an idea. Select one to open it.
Impact →
Quick wins · 5Big bets · 7Fill-ins · 5Reconsider · 6
Effort →

Showing 23 of 23 ideas

This week 7

Quick wins with a clear first action.

  • 01

    Parameter's own job posts call vulnerability research and disclosure "a core part of how we go to market" and "the front door to most of our customer relationships", and the new SDR is hired to turn that research into first meetings. The research works: the October 28 Labs writeup reached 365 points and 177 comments on Hacker News. But every Labs post ends with only "next" and "back to all posts": no link to the product, no book-a-call, no sign-up and no way to subscribe. Labs posts are also missing from the RSS feed, so the most-read pages on the site send readers nowhere.

    High impactLow effort First result in With the next Labs post Sales Development Representat…

    First action

    Add the end-of-post block and a subscribe field to the Labs post template.

    How to measure it

    Labs-sourced bookings

    Now
    –
    Target
    10 qualified calls and 500 subscribers a quarter
    By
    90 days

    Steps

    1. 1

      Write the block

      One sentence tying the post's bug class to the reader's app, the 24-hour offer and a button to /book-a-call with a ?from=labs-<slug> tag.

      Founder (go-to-market) 2 hours

    2. 2

      Add it to the template

      End-of-post block plus a slim bar on scroll, on all four existing posts and every new one.

      Member of Technical Staff, Generalist 1 day

    3. 3

      Add subscribe

      One email field ("new Labs research, about twice a month") feeding the existing marketing tool.

      Member of Technical Staff, Generalist 1 day

    4. 4

      Fix the feed

      Include Labs posts in the RSS feed and link each post to its knowledge-center page and the sample report.

      Member of Technical Staff, Generalist half a day

    5. 5

      Route the leads

      Labs-tagged bookings and sign-ups go to the SDR the same day, with the post as the opening line.

      Sales Development Representative 1 day

    6. 6

      Add per-post offers

      For each new post, an Offensive Security Engineer writes one line on how the agents test for that bug class.

      Offensive Security Engineer 30 minutes a post

    7. 7

      Measure

      Views, clicks, subscribers and booked calls per post; compare posts shared on Hacker News or X with the rest.

      Sales Development Representative weekly

    First result
    With the next Labs post
    Cost
    Staff time only
    Owner
    Sales Development Representative

    Smallest test

    Add the block and subscribe field to the most-read Labs post today and count clicks for two weeks.

    Why it works

    Add a short block to the end (and a slim bar in the side or top) of every Labs post that connects the bug class in the post to the reader's own stack: "This bug class is what our agents test for on every release. Point them at your staging app and see first findings in 24 hours", with a button to the booking form pre-tagged with the post. Add a one-field email subscribe for new Labs research, put Labs into the RSS feed, and link each post to the matching knowledge-center page and sample report. Give the SDR a daily list of new Labs-sourced sign-ups and bookings to follow up with the post as the opening line.

    Readers of a technical writeup are at peak trust and curiosity, and the bug class gives a specific reason to test their own app. A subscribe option keeps the audience for the next post instead of renting it from Hacker News once. It costs a template change and turns research the team already does into measurable pipeline.

    Ready to use

    CopyEnd-of-post block for Labs

    Want to know if your app has this bug class?
Our agents test for it on every release, and prove each finding with a working exploit.
Point them at your staging app: first findings in 24 hours.
[Test my app]  (/book-a-call?from=labs-<slug>)

New Labs research, about twice a month:
[ work email ] [Subscribe]

Related: <knowledge-center page for the bug class> · Sample pentest report

    Risks and how to handle them

    • Research readers dislike a sales pitch on technical writing

      Keep the block below the article, factual and about the bug class; no pop-ups.

    • Readers book tests of systems they do not own

      Keep the written-authorization step used for the GISEC "bring your own target" offer.

    Evidence

    • Your websiteLabs (checked November 9, 2026): four research posts published between October 7 and October 28, 2026. The Labs index has a "Book a call" button, but the posts themselves end with only "next" and "back to all posts" links: no product link, no book-a-call, no sign-up and no subscribe option. The blog RSS feed (20 items) contains no Labs posts, and the site has no newsletter.Source
    • Hacker NewsThe October 28, 2026 Labs writeup of a now-fixed account-takeover bug in a major AI chat product reached 365 points and 177 comments on Hacker News, linking straight to the Labs post; the thread debated bug-bounty economics and whether AI tools make finding bugs cheap, and one commenter still called the firm "Hex (Parameter)".Source
    • HiringOffensive Security Engineer (San Francisco, onsite; $180K-$250K): runs manual pentests on customer web apps, APIs and cloud, turns that methodology into agent capabilities, validates agent findings before customers see them ("You are the quality bar"), leads scoping calls and findings walkthroughs, and contributes to vulnerability research and responsible disclosure, "a core part of how we go to market" and "the front door to most of our customer relationships".Source
    • HiringSales Development Representative (San Francisco, onsite; $80K-$90K base, $130K-$160K OTE): owns outbound to security and engineering leaders (account lists, sequences, follow-up), turns vulnerability research into first meetings, books and prepares qualified calls for the founders and then runs discovery, keeps CRM and pipeline reporting accurate, and reports on which messaging works and which segments convert.Source
  • 02

    Single App is already a fixed scope (one app and its APIs, an audit-ready report, free re-testing), yet all three tiers say only "Talk to Sales". Parameter's own cost guide tells buyers a web app pentest runs $5,000-$30,000 and its XBOW page quotes XBOW's $50,000 marketplace listing, so the only price a buyer cannot find on parameter.ai is Parameter's.

    High impactLow effort First result in 2-4 weeks Founder

    First action

    Agree the lowest Single App price the team would sign today.

    How to measure it

    Bookings from pricing

    Now
    –
    Target
    +25%
    By
    60 days

    Steps

    1. 1

      Set the price

      Starting price for one app and its primary APIs, from recent deals.

      Founder (go-to-market) 1 day

    2. 2

      Write the tier

      What is included, what changes the price, and the 24-hour first-findings promise.

      Founder (go-to-market) 2 hours

    3. 3

      Publish

      On /pentesting#pricing, with a "Start with one app" button.

      Member of Technical Staff, Generalist half a day

    4. 4

      Link it

      From the cost guide, the SOC 2 page and the comparison pages.

      Member of Technical Staff, Generalist half a day

    5. 5

      Brief sales

      Use the public price as the anchor on calls.

      Sales Development Representative 1 hour

    6. 6

      Compare

      Bookings and deal size for 60 days before and after.

      Founder (go-to-market) 60 days

    First result
    2-4 weeks
    Cost
    $0
    Owner
    Founder (go to market)

    Smallest test

    Add "from $X" to Single App for one month.

    Why it works

    Show "from $X" on Single App with what it includes, keep Rightsized and Continuous as quoted, and add one line comparing it with the manual SOC 2 pentest range the site already cites. Link the price from the cost guide and the compliance pages.

    Buyers with a SOC 2 deadline shortlist vendors they can budget for without a call, and a fixed scope is the easiest tier to price publicly. It also filters out calls that would never close.

    Risks and how to handle them

    • Larger buyers anchor on the small price

      Show what moves the price and keep the larger tiers quoted.

    • Competitors undercut

      Compete on proven findings and free re-testing, not price alone.

    Evidence

    • Your websitePentesting page and pricing: three tiers, Single App ("Fixed scope": one app and its primary APIs, an audit-ready SOC 2 / ISO 27001 report, same-day results, free re-testing), Rightsized ("Scoped for you") and Continuous ("Custom": pentests on every deploy, enterprise SLA, a dedicated success manager); no dollar amounts, "No seats, no surprises", and every tier's button is "Talk to Sales"; the page claims "Top 3 in the US on HackerOne" with no supporting link; a sample report PDF; no testimonials or case studies.Source
    • Your website"Penetration Testing Cost: 2026 Buyer's Pricing Guide" (September 11, 2026) lists market ranges ($5,000-$50,000+ per engagement; web app and API $5,000-$30,000; SOC 2 $5,000-$20,000; retests $1,500-$8,000) but no Parameter price; the SOC 2 page says manual SOC 2 pentests "run from about $5,000 for a shallow test" and that "Parameter is one annual contract scoped to the environment covered".Source
    • Your websiteComparison pages: eight vendor pages under /alternative. The XBOW page lists Parameter's pricing as "Annual, per environment" and XBOW's as quoted and usage-based, with a $50,000/year AWS Marketplace listing and a retired self-serve tier; XBOW is described as "Validated and reviewed; no published FP rate", and the page says it was "checked against its own site on 6 September 2026".Source
  • 03

    "Book a call" is the main button on every page, but the form asks for seven fields, shows no calendar and says nothing about what happens next. The homepage promises "A URL and credentials is all it takes" and first findings in 24 hours, so the booking step is the slowest part of the promise.

    Medium impactLow effort First result in 2 weeks Sales Development Representat…

    First action

    Write the three next steps under the form.

    How to measure it

    Held calls per form

    Now
    –
    Target
    +30%
    By
    45 days

    Steps

    1. 1

      Write the steps

      Scoping call, authorization, first findings in 24 hours.

      Founder (go-to-market) 1 hour

    2. 2

      Add a calendar

      Inline scheduler after submit, routed to founder or SDR slots.

      Sales Development Representative 1 day

    3. 3

      Trim the form

      Make team size and phone optional or move them to the call.

      Member of Technical Staff, Generalist 2 hours

    4. 4

      Confirm by email

      Calendar invite plus the sample report.

      Sales Development Representative 2 hours

    5. 5

      Track

      Submissions, booked slots and no-shows.

      Sales Development Representative weekly

    6. 6

      Review

      Compare the first 30 days with the previous 30.

      Founder (go-to-market) 30 days

    First result
    2 weeks
    Cost
    A scheduler licence
    Owner
    Sales Development Representative

    Smallest test

    Add the next-steps text and a calendar link to the thank-you state today.

    Why it works

    After the form, show a calendar with founder or SDR slots, and state the three next steps: a 20-minute scoping call, written authorization, first findings within 24 hours. Cut the form to work email, website and what to cover.

    Buyers who pick a time on the spot show up more often than those waiting for an email, and naming the steps removes the fear of a long sales cycle.

    Risks and how to handle them

    • Unqualified bookings fill founder calendars

      Route small teams to the SDR first.

    Evidence

    • Your websiteBook-a-call page: "Get a demo of Parameter." with fields Website, Name, Work email, Company, Team size, Phone (optional) and "What do you want to cover?" (optional); no calendar or scheduler, nothing on what happens after submitting, and no self-serve alternative.Source
    • Your websiteHomepage (checked November 9, 2026): H1 "Security at the speed of development."; "AI agents that find vulnerabilities in your web apps, APIs, and infrastructure. Continuously, not once a year."; stats "$30B+" in breaches prevented, "<1%" false positives and "24/7" coverage; "Backed by Y Combinator"; a logo row "Built by the team that secured:" Apple, Google, Microsoft, U.S. Department of Defense, T-Mobile, Henkel, Epic Games, AT&T and Yahoo; CTAs "Book a call" and "Sign up"; closing "A URL and credentials is all it takes." and "First findings land within 24 hours."; no testimonials.Source
    • HiringSales Development Representative (San Francisco, onsite; $80K-$90K base, $130K-$160K OTE): owns outbound to security and engineering leaders (account lists, sequences, follow-up), turns vulnerability research into first meetings, books and prepares qualified calls for the founders and then runs discovery, keeps CRM and pipeline reporting accurate, and reports on which messaging works and which segments convert.Source
  • 04

    The logo row (Apple, Google, Microsoft, the U.S. Department of Defense and others) is labelled "Built by the team that secured:", and the About page does not say whether these were employers, clients or bug-bounty targets. The homepage also claims "$30B+" in breaches prevented with no method. Security buyers check claims for a living, and an unexplained number or logo invites the question of what else is unexplained.

    High impactLow effort First result in Immediately Founder

    First action

    Write one accurate sentence for what the logos represent.

    How to measure it

    Claim-related objections

    Now
    –
    Target
    Near zero
    By
    60 days

    Steps

    1. 1

      List the claims

      Logos, "$30B+", "<1%", "Top 3 on HackerOne".

      Founder (go-to-market) 1 hour

    2. 2

      Write the basis

      One sentence each on where the number or logo comes from.

      Founder (go-to-market) half a day

    3. 3

      Check with legal

      Use of third-party logos and wording.

      Founder (go-to-market) 2 days

    4. 4

      Publish

      Caption under the logo row and a methods note linked from the stat.

      Member of Technical Staff, Generalist half a day

    5. 5

      Swap weak claims

      Replace anything without a basis with run or finding counts.

      Founder (go-to-market) 1 day

    6. 6

      Brief sales

      One answer for "are these your customers?"

      Sales Development Representative 1 hour

    First result
    Immediately
    Cost
    $0
    Owner
    Founder (go to market)

    Smallest test

    Add the caption under the logo row this week.

    Why it works

    Add one line under the logo row (for example, "Our researchers have reported vulnerabilities to these organisations through their bug-bounty and disclosure programmes" or whatever is accurate) and a short note or link explaining how "$30B+" was estimated. If a claim cannot be explained in one sentence, replace it with a number that can, such as runs completed or findings validated.

    Precise claims build trust with sceptical technical buyers, and they protect the brand when a prospect's security team does due diligence.

    Risks and how to handle them

    • A more modest label looks less impressive

      Pair it with real usage numbers from Sentinel and the pentest runs.

    Evidence

    • Your websiteHomepage (checked November 9, 2026): H1 "Security at the speed of development."; "AI agents that find vulnerabilities in your web apps, APIs, and infrastructure. Continuously, not once a year."; stats "$30B+" in breaches prevented, "<1%" false positives and "24/7" coverage; "Backed by Y Combinator"; a logo row "Built by the team that secured:" Apple, Google, Microsoft, U.S. Department of Defense, T-Mobile, Henkel, Epic Games, AT&T and Yahoo; CTAs "Book a call" and "Sign up"; closing "A URL and credentials is all it takes." and "First findings land within 24 hours."; no testimonials.Source
    • Your websiteAbout and product pages: the logo row is labelled "Built by the team that secured:" and the About page does not say whether those organisations were employers or clients; no named customer, testimonial or case study appears on the homepage, pentesting, fintech or SOC 2 pages; the About page lists 12 people including three co-founders.Source
  • 05

    The pentesting page claims "Top 3 in the US on HackerOne" with no link or detail, while XBOW's homepage leads with its #1 HackerOne ranking. A ranking buyers can click is proof; one they cannot check is a claim.

    Medium impactLow effort First result in 1 week Offensive Security Engineer

    First action

    Find the leaderboard URL and the exact period of the ranking.

    How to measure it

    Ranking link clicks

    Now
    –
    Target
    Tracked on every visit
    By
    30 days

    Steps

    1. 1

      Find the source

      Profile URL, period and category.

      Offensive Security Engineer 1 hour

    2. 2

      Rewrite the line

      Rank, period, link.

      Founder (go-to-market) 30 minutes

    3. 3

      Add disclosures

      Two or three fixed, public findings from Labs.

      Offensive Security Engineer 2 hours

    4. 4

      Publish

      Pentesting page and XBOW comparison.

      Member of Technical Staff, Generalist 1 hour

    5. 5

      Track

      Clicks and bookings from those pages.

      Sales Development Representative monthly

    6. 6

      Keep current

      Update or remove when the rank changes.

      Offensive Security Engineer quarterly

    First result
    1 week
    Cost
    $0
    Owner
    Offensive Security Engineer

    Smallest test

    Add the link today.

    Why it works

    Link the line to the public profile or leaderboard page, add the period and category, and pair it with two or three disclosed findings from Labs. Repeat it on the XBOW comparison page.

    Researchers' public track records are the proof this category buys on, and a checkable ranking answers the leaderboard comparison directly.

    Risks and how to handle them

    • The rank was individual, not company

      Say whose rank it is and when.

    Evidence

    • Your websitePentesting page and pricing: three tiers, Single App ("Fixed scope": one app and its primary APIs, an audit-ready SOC 2 / ISO 27001 report, same-day results, free re-testing), Rightsized ("Scoped for you") and Continuous ("Custom": pentests on every deploy, enterprise SLA, a dedicated success manager); no dollar amounts, "No seats, no surprises", and every tier's button is "Talk to Sales"; the page claims "Top 3 in the US on HackerOne" with no supporting link; a sample report PDF; no testimonials or case studies.Source
    • Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", with named quotes from security leaders (including a deputy CISO at Moderna), "200+ top security teams" and a #1 HackerOne ranking; Horizon3.ai, "7,012 customers", a Gartner Peer Insights 4.7/5 and awards; Cobalt, a "network of 500+ vetted security experts" with named CISO quotes and a "flexible Cobalt credit model".Source
  • 06

    The blog has "12 Types of Penetration Testing Explained for 2026" (September 9) and "12 Types of Penetration Testing and How to Choose the Right One" (September 15), and the first does not link to the second. Two near-identical pages compete for the same search and split links between them.

    Medium impactLow effort First result in 1-2 months Member of Technical Staff

    First action

    Check which of the two URLs gets more search clicks.

    How to measure it

    Clicks to merged page

    Now
    –
    Target
    Above the two pages combined
    By
    90 days

    Steps

    1. 1

      Compare

      Clicks and links for both URLs in Search Console.

      Member of Technical Staff, Generalist 1 hour

    2. 2

      Merge

      Best sections into the stronger URL.

      Offensive Security Engineer half a day

    3. 3

      Redirect

      301 the weaker URL and update internal links.

      Member of Technical Staff, Generalist 1 hour

    4. 4

      Add the chooser

      Each test type links to its /pentesting page.

      Member of Technical Staff, Generalist 2 hours

    5. 5

      Check others

      Look for other overlapping posts and glossary pages.

      Member of Technical Staff, Generalist half a day

    6. 6

      Measure

      Clicks and bookings from the page.

      Member of Technical Staff, Generalist monthly

    First result
    1-2 months
    Cost
    $0
    Owner
    Member of Technical Staff, Generalist

    Smallest test

    Redirect the weaker post this week and watch Search Console.

    Why it works

    Keep the stronger URL, fold the best sections of the other into it, 301 the weaker one, and add a "which test do you need?" box that points to the matching /pentesting page and the booking form.

    One stronger page ranks better than two that split the signal, and the box turns an educational read into a product path.

    Risks and how to handle them

    • Short-term ranking dip

      Redirect cleanly and keep the stronger URL.

    Evidence

    • Your websiteSitemap (169 URLs plus a separate /learn sitemap, checked November 9, 2026): 87 knowledge-center pages, including UAE IA Standard, Saudi NCA ECC, SAMA CSF, DORA, NIS2 and CMMC; compliance landing pages only for SOC 2, ISO 27001, PCI DSS and FedRAMP; industry pages only for fintech and healthcare; one free tool (a CVSS calculator); two separate posts, "12 Types of Penetration Testing Explained for 2026" (September 9) and "12 Types of Penetration Testing and How to Choose the Right One" (September 15), and the first does not link to the second.Source
  • 07

    Hex Security became Parameter on July 30, 2026, and hex.co now redirects. But three months later Hacker News readers still call the firm "Hex (Parameter)", and old profiles, directories and job listings keep the old name in circulation.

    Medium impactLow effort First result in 2 weeks Founder

    First action

    Search for "Hex Security" and list every result the company controls.

    How to measure it

    Listings updated

    Now
    –
    Target
    100% of controllable listings
    By
    30 days

    Steps

    1. 1

      Inventory

      Every listing and profile with the old name.

      Founder (go-to-market) half a day

    2. 2

      Update owned

      Social, accelerator and job listings.

      Founder (go-to-market) 1 day

    3. 3

      Request edits

      Directories and comparison sites.

      Sales Development Representative 1 week

    4. 4

      Add "formerly"

      On About and in the site description.

      Member of Technical Staff, Generalist 1 hour

    5. 5

      Move assets

      Serve site files from parameter.ai rather than the old domain.

      Member of Technical Staff, Infrastructure 1 day

    6. 6

      Recheck

      Search the old name monthly.

      Founder (go-to-market) monthly

    First result
    2 weeks
    Cost
    $0
    Owner
    Founder (go to market)

    Smallest test

    Update the three highest-ranking old-name profiles this week.

    Why it works

    List every profile and directory that names Hex Security (accelerator page, LinkedIn, X, review and tool directories, job boards, conference listings), update each to Parameter with "formerly Hex Security", and add the same line to the About page so searches for the old name land on the new one.

    Buyers who heard of Hex need to find Parameter in one search, and consistent names keep the research credit attached to the current brand.

    Risks and how to handle them

    • Old links break

      Keep the hex.co redirect permanently.

    Evidence

    • Your website"Hex Security is now Parameter" (July 30, 2026): the old name described only the first product, autonomous pentesting; agreements, DPAs and invoices are unchanged because the contracting entity, Anytool, Inc., is the same. hex.co now returns a 301 redirect to parameter.ai/?from=hex.Source
    • Hacker NewsThe October 28, 2026 Labs writeup of a now-fixed account-takeover bug in a major AI chat product reached 365 points and 177 comments on Hacker News, linking straight to the Labs post; the thread debated bug-bounty economics and whether AI tools make finding bugs cheap, and one commenter still called the firm "Hex (Parameter)".Source
    • PageSpeedHomepage on Google PageSpeed (November 9, 2026): mobile performance 50, desktop 80; lab mobile LCP 10.9 s with the hero video as the LCP element; 6.9 MB and 84 requests; real visitors pass Core Web Vitals (LCP 1.18 s, INP 124 ms, CLS 0); third parties include Google Tag Manager (314 KB), assets from the old hex.co domain (140 KB), HubSpot (71 KB), Apollo and X conversion tracking.Source

This quarter 11

The core plays for the next three months.

  • 08

    No named customer, quote or case study appears on the homepage, pentesting, fintech or SOC 2 pages. XBOW shows named security leaders, Horizon3 shows 7,012 customers and Cobalt and Aikido show named CISOs and metrics. Buyers comparing vendors see proof on every tab but Parameter's.

    High impactMedium effort First result in 6-10 weeks Founder

    First action

    List five customers with a strong result and ask each for 20 minutes.

    How to measure it

    Customer stories live

    Now
    –
    Target
    3
    By
    90 days

    Steps

    1. 1

      Pick customers

      Five with clear results.

      Founder (go-to-market) 1 day

    2. 2

      Offer options

      Named, title-only or industry-only.

      Founder (go-to-market) 1 week

    3. 3

      Interview

      Before, first finding, fixes, audit.

      Offensive Security Engineer 2 weeks

    4. 4

      Write

      One page each with three numbers.

      Founder (go-to-market) 2 weeks

    5. 5

      Approve

      Customer sign-off on every detail.

      Founder (go-to-market) 2 weeks

    6. 6

      Place

      Homepage, industry pages, comparison pages and sales emails.

      Member of Technical Staff, Generalist 2 days

    First result
    6-10 weeks
    Cost
    Staff time; an optional thank-you credit
    Owner
    Founder (go to market)

    Smallest test

    Publish one anonymised fintech story first.

    Why it works

    Ask the happiest customers for a named or anonymised-by-industry story: what they used before, time to first finding, critical findings caught, fix time and audit outcome. Start with one fintech and one healthcare story to back the two industry pages, plus one Sentinel story.

    Peer proof is the deciding factor in security purchases, and stories mapped to the industry pages make those pages credible.

    Risks and how to handle them

    • Customers will not be named in security

      Offer title-and-industry stories with real numbers.

    Evidence

    • Your websiteAbout and product pages: the logo row is labelled "Built by the team that secured:" and the About page does not say whether those organisations were employers or clients; no named customer, testimonial or case study appears on the homepage, pentesting, fintech or SOC 2 pages; the About page lists 12 people including three co-founders.Source
    • Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", with named quotes from security leaders (including a deputy CISO at Moderna), "200+ top security teams" and a #1 HackerOne ranking; Horizon3.ai, "7,012 customers", a Gartner Peer Insights 4.7/5 and awards; Cobalt, a "network of 500+ vetted security experts" with named CISO quotes and a "flexible Cobalt credit model".Source
    • Competitor researchAikido's homepage: "Secure everything devs build, ship & run."; "Start for Free" with "No credit card required"; "Trusted by 150k+ orgs"; customer stories with metrics from Revolut, Deel, Raisin and Visma; "Security that opens a PR instead of a ticket".Source
  • 09

    Sentinel already reviews "10,000+ PRs" a day on GitHub, GitLab and Bitbucket Cloud and caught 9,417 vulnerabilities in 30 days, but it has no free tier or public price, and Aikido wins developers with "Start for Free". Every inline comment on a public repository is visible to the maintainers and contributors who later buy security tools at work.

    High impactMedium effort First result in 1 month Member of Technical Staff

    First action

    Set a free monthly PR cap for public repositories and cost it.

    How to measure it

    Active open-source installs

    Now
    –
    Target
    300
    By
    2 quarters

    Steps

    1. 1

      Cost it

      Compute cost per PR review and a monthly cap.

      Member of Technical Staff, AI Engineer 2 days

    2. 2

      Build the gate

      Free plan only for public repositories.

      Member of Technical Staff, Generalist 1 week

    3. 3

      List it

      Marketplace listings for GitHub and GitLab.

      Member of Technical Staff, Generalist 1 week

    4. 4

      Seed it

      Invite maintainers of 50 widely used projects.

      Sales Development Representative 2 weeks

    5. 5

      Attribute

      Link in each comment; tag sign-ups by repository.

      Member of Technical Staff, Generalist 2 days

    6. 6

      Convert

      Offer the paid plan when a contributor's company signs up.

      Sales Development Representative ongoing

    First result
    1 month
    Cost
    Model and compute cost under the cap
    Owner
    Member of Technical Staff, AI Engineer

    Smallest test

    Run Sentinel on ten consenting open-source projects for a month.

    Why it works

    Let maintainers of public repositories install Sentinel free from a marketplace listing, with a monthly cap. Each comment carries a small "reviewed by Parameter Sentinel" link. Track which contributors' companies later book a call.

    Developers adopt tools they have seen catch a real bug in their own project, and open-source use creates visible, earned proof at almost no sales cost.

    Risks and how to handle them

    • Compute cost grows fast

      Cap reviews per repository and month.

    • Noisy comments annoy maintainers

      Comment only on proven, high-confidence findings.

    Evidence

    • Your websiteSentinel page: AI review of every pull request, working with GitHub, GitLab and Bitbucket Cloud; "10,000+ PRs reviewed every day"; in the last 30 days 312,940 PRs reviewed and 9,417 vulnerabilities caught; no Sentinel price and no free tier; CTA "Get started". An August 7, 2026 blog post was titled "reviewing 5,000 PRs per day".Source
    • Competitor researchAikido's homepage: "Secure everything devs build, ship & run."; "Start for Free" with "No credit card required"; "Trusted by 150k+ orgs"; customer stories with metrics from Revolut, Deel, Raisin and Visma; "Security that opens a PR instead of a ticket".Source
  • 10

    The August post on 2,300 pentests (42% broken authentication and access control, 37% high or critical) is the most quotable data on the site, and Sentinel adds 312,940 PRs reviewed in 30 days. Published once, it ages; published every quarter with trends, it becomes the number journalists and buyers cite.

    High impactMedium effort First result in 1 quarter Offensive Security Engineer

    First action

    Re-run the August analysis on the last quarter's runs.

    How to measure it

    Report downloads

    Now
    –
    Target
    1,000 per edition
    By
    2 quarters

    Steps

    1. 1

      Fix the method

      Same classes and severity rules each quarter.

      Offensive Security Engineer 1 week

    2. 2

      Pull the data

      Runs and Sentinel catches, anonymised.

      Member of Technical Staff, AI Engineer 1 week

    3. 3

      Write

      Five findings with charts.

      Offensive Security Engineer 1 week

    4. 4

      Publish

      Page plus email-gated PDF.

      Member of Technical Staff, Generalist 2 days

    5. 5

      Pitch

      Security press and newsletters.

      Founder (go-to-market) 1 week

    6. 6

      Use in sales

      Industry slices in outbound.

      Sales Development Representative ongoing

    First result
    1 quarter
    Cost
    Staff time
    Owner
    Offensive Security Engineer

    Smallest test

    Publish one chart from last quarter's data this month.

    Why it works

    Publish a dated quarterly report: findings by class and severity, by industry and stack, time from introduction to detection, and Sentinel's catches before merge. Gate the full PDF lightly (email only) and give the headline charts away.

    Original data earns links and press in security, and the gated version builds the subscriber list idea 1 starts.

    Risks and how to handle them

    • Customer data exposure

      Aggregate only, with minimum group sizes.

    Builds on

    Evidence

    • Your website"We ran 2,300 pentests in 3 weeks. Here's what our AI finds" (August 6, 2026): in a 1,200-finding sample, 11% critical and 26% high; broken authentication and access control 42%, exposed secrets and configuration 17%, IDOR 15%, injection 11%; it cites a survey in which false-positive rate was the top selection criterion for 63% of respondents.Source
    • Your websiteSentinel page: AI review of every pull request, working with GitHub, GitLab and Bitbucket Cloud; "10,000+ PRs reviewed every day"; in the last 30 days 312,940 PRs reviewed and 9,417 vulnerabilities caught; no Sentinel price and no free tier; CTA "Get started". An August 7, 2026 blog post was titled "reviewing 5,000 PRs per day".Source
  • 11

    The SDR's job is outbound to security and engineering leaders, built on research and reporting on which segments convert. Parameter already knows that access-control flaws are 42% of findings and has fintech and healthcare pages; a sequence that opens with the likely bug in the prospect's kind of product beats a generic pentest pitch.

    High impactLow effort First result in 1 month Sales Development Representat…

    First action

    Draft the fintech sequence from the August data.

    How to measure it

    Outbound meeting rate

    Now
    –
    Target
    3 per 100
    By
    60 days

    Steps

    1. 1

      Pick segments

      Four, based on the industry pages and deals.

      Sales Development Representative 1 day

    2. 2

      Pull proof

      One finding share and one Labs post per segment.

      Offensive Security Engineer 1 day

    3. 3

      Write sequences

      Three emails each, short and technical.

      Sales Development Representative 3 days

    4. 4

      Build lists

      Security and engineering leaders per segment.

      Sales Development Representative 1 week

    5. 5

      Send

      Small batches per segment.

      Sales Development Representative ongoing

    6. 6

      Report

      Replies and meetings by segment and message.

      Sales Development Representative weekly

    First result
    1 month
    Cost
    Existing sales tools
    Owner
    Sales Development Representative

    Smallest test

    Send the fintech sequence to 100 prospects.

    Why it works

    Write one sequence per segment (fintech, healthcare, B2B SaaS, companies with an audit due): email one cites the relevant finding share and a Labs post, email two offers the sample report, email three offers a single-app test with first findings in 24 hours. Measure reply and meeting rates by segment.

    Specific, evidence-led openers earn replies from technical buyers who ignore templates, and the segment data shows where to focus.

    Risks and how to handle them

    • Unsolicited testing claims upset prospects

      Never imply a prospect's systems were tested; cite aggregate data only.

    Evidence

    • HiringSales Development Representative (San Francisco, onsite; $80K-$90K base, $130K-$160K OTE): owns outbound to security and engineering leaders (account lists, sequences, follow-up), turns vulnerability research into first meetings, books and prepares qualified calls for the founders and then runs discovery, keeps CRM and pipeline reporting accurate, and reports on which messaging works and which segments convert.Source
    • Your website"We ran 2,300 pentests in 3 weeks. Here's what our AI finds" (August 6, 2026): in a 1,200-finding sample, 11% critical and 26% high; broken authentication and access control 42%, exposed secrets and configuration 17%, IDOR 15%, injection 11%; it cites a survey in which false-positive rate was the top selection criterion for 63% of respondents.Source
    • Your websiteSitemap (169 URLs plus a separate /learn sitemap, checked November 9, 2026): 87 knowledge-center pages, including UAE IA Standard, Saudi NCA ECC, SAMA CSF, DORA, NIS2 and CMMC; compliance landing pages only for SOC 2, ISO 27001, PCI DSS and FedRAMP; industry pages only for fintech and healthcare; one free tool (a CVSS calculator); two separate posts, "12 Types of Penetration Testing Explained for 2026" (September 9) and "12 Types of Penetration Testing and How to Choose the Right One" (September 15), and the first does not link to the second.Source
  • 12

    Parameter exhibited at GISEC Global in Dubai and its knowledge center already explains the UAE IA Standard, Saudi NCA ECC and SAMA CSF. But its compliance landing pages cover only SOC 2, ISO 27001, PCI DSS and FedRAMP, and the GISEC page names no regional framework, so Gulf buyers met at the show have no page that speaks to their audit.

    Medium impactMedium effort First result in 1-2 months Founder

    First action

    List GISEC contacts by country and framework.

    How to measure it

    Gulf-sourced calls

    Now
    –
    Target
    10
    By
    2 quarters

    Steps

    1. 1

      Size demand

      GISEC contacts and current Gulf pipeline.

      Founder (go-to-market) 1 day

    2. 2

      Map testing needs

      What each framework requires in testing; verify against the official text.

      Offensive Security Engineer 1 week

    3. 3

      Write pages

      Three pages modelled on the SOC 2 page.

      Founder (go-to-market) 1 week

    4. 4

      Link

      From the knowledge-center entries and /compliance.

      Member of Technical Staff, Generalist 1 day

    5. 5

      Follow up

      Send to GISEC contacts.

      Sales Development Representative 1 week

    6. 6

      Measure

      Traffic and calls by country.

      Sales Development Representative monthly

    First result
    1-2 months
    Cost
    Staff time; optional local review
    Owner
    Founder (go to market)

    Smallest test

    Publish the UAE IA page and send it to GISEC contacts.

    Why it works

    Build compliance pages for UAE IA, NCA ECC and SAMA CSF in the format of the SOC 2 page: what the framework asks for in testing, what the report contains, how often to test. Send them to everyone met at GISEC and use them for regional outreach.

    Regional regulators drive pentest budgets, few AI pentest vendors speak to these frameworks, and the explanatory content already exists.

    Risks and how to handle them

    • Requirements misstated

      Cite the official framework text and have a regional practitioner review.

    Evidence

    • Your websiteGISEC Global 2026 page (September 16-18, Dubai, booth SP60 in the Startup Zone): live agent runs every 30 minutes ("If the agents miss, you'll see them miss"), "Bring your own target" with written authorization for a staging environment and validated findings sent before the show closed, and thirty minutes with a founder; the page names no Middle East frameworks.Source
    • Your websiteSitemap (169 URLs plus a separate /learn sitemap, checked November 9, 2026): 87 knowledge-center pages, including UAE IA Standard, Saudi NCA ECC, SAMA CSF, DORA, NIS2 and CMMC; compliance landing pages only for SOC 2, ISO 27001, PCI DSS and FedRAMP; industry pages only for fintech and healthcare; one free tool (a CVSS calculator); two separate posts, "12 Types of Penetration Testing Explained for 2026" (September 9) and "12 Types of Penetration Testing and How to Choose the Right One" (September 15), and the first does not link to the second.Source
    • Your websiteSOC 2 page: "Pentest evidence for SOC 2. From every release."; "Auditors set their own evidence standard"; "Ask your auditor before the audit window opens"; "Parameter holds a SOC 2 Type I report, with the Type II observation period underway"; footer badges link to the trust center at trust.parameter.ai.Source
  • 13

    Parameter has 87 knowledge-center pages and a separate glossary with its own sitemap, covering topics from IDOR to DORA, but the free-tools and content pages end with the same generic "Sign up" and "Book a call". A reader of the broken-access-control page should see how the agents find that bug, not a generic demo button.

    Medium impactMedium effort First result in 1 month Member of Technical Staff

    First action

    Export the page list and assign each a next step in a sheet.

    How to measure it

    Content-to-product click rate

    Now
    –
    Target
    2x
    By
    60 days

    Steps

    1. 1

      Map pages

      Topic to next step for every knowledge-center and glossary page.

      Offensive Security Engineer 2 days

    2. 2

      Write boxes

      Four box types, short copy.

      Founder (go-to-market) 1 day

    3. 3

      Build

      Component reading the mapping.

      Member of Technical Staff, Generalist 3 days

    4. 4

      Launch

      Top 20 pages by traffic first.

      Member of Technical Staff, Generalist 1 day

    5. 5

      Roll out

      All remaining pages.

      Member of Technical Staff, Generalist 1 week

    6. 6

      Measure

      Click and booking rate per box type.

      Sales Development Representative monthly

    First result
    1 month
    Cost
    Engineering time
    Owner
    Member of Technical Staff, Generalist

    Smallest test

    Add a matched box to the ten most-visited pages.

    Why it works

    Map each page to one of four next steps: a sample finding for that bug class, the relevant product page, the relevant compliance page, or the Labs post on that topic. Add it as an in-line box halfway down and at the end.

    Topic-matched calls to action convert educational traffic far better than generic ones, and the mapping is a one-time table.

    Risks and how to handle them

    • Boxes feel salesy on reference pages

      Keep them factual and below the definition.

    Evidence

    • Your websiteSitemap (169 URLs plus a separate /learn sitemap, checked November 9, 2026): 87 knowledge-center pages, including UAE IA Standard, Saudi NCA ECC, SAMA CSF, DORA, NIS2 and CMMC; compliance landing pages only for SOC 2, ISO 27001, PCI DSS and FedRAMP; industry pages only for fintech and healthcare; one free tool (a CVSS calculator); two separate posts, "12 Types of Penetration Testing Explained for 2026" (September 9) and "12 Types of Penetration Testing and How to Choose the Right One" (September 15), and the first does not link to the second.Source
    • Your websiteFree tools page: one tool, a CVSS v3.1 calculator; no sign-up needed and "nothing you type leaves your browser"; the only CTAs are "Sign up" and "Book a call".Source
  • 14

    Parameter's SOC 2 page tells buyers that "Auditors set their own evidence standard" and to "Ask your auditor before the audit window opens". That makes the auditor, and the compliance platform the buyer uses to prepare, the gatekeeper for every compliance-driven pentest.

    High impactMedium effort First result in 1-2 months Founder

    First action

    Send the sample report to three audit firms for feedback.

    How to measure it

    Calls from auditors and platforms

    Now
    –
    Target
    15 a quarter
    By
    2 quarters

    Steps

    1. 1

      List partners

      Ten audit firms serving startups; compliance platforms with partner directories.

      Founder (go-to-market) 2 days

    2. 2

      Review the report

      Walkthroughs with three audit firms.

      Offensive Security Engineer 3 weeks

    3. 3

      Adjust

      Report changes they ask for.

      Member of Technical Staff, Generalist 2 weeks

    4. 4

      Apply

      Compliance platform partner programmes.

      Founder (go-to-market) 1 month

    5. 5

      Equip

      One-page brief and a referral link per partner.

      Sales Development Representative 1 week

    6. 6

      Track

      Calls and deals by partner.

      Sales Development Representative monthly

    First result
    1-2 months
    Cost
    Staff time; possible partner fees
    Owner
    Founder (go to market)

    Smallest test

    One auditor walkthrough this month.

    Why it works

    Walk three to five audit firms through the sample report and ask what they would change for it to be accepted as evidence; publish an "auditor-reviewed report format" note. In parallel, apply to the partner directories of the main compliance automation platforms so Parameter appears when their customers look for a pentest.

    Compliance buyers follow their auditor's and platform's lists, and one partner can send a steady stream of startups facing their first audit.

    Risks and how to handle them

    • Auditors avoid endorsing vendors

      Ask for format feedback, not endorsement.

    Evidence

    • Your websiteSOC 2 page: "Pentest evidence for SOC 2. From every release."; "Auditors set their own evidence standard"; "Ask your auditor before the audit window opens"; "Parameter holds a SOC 2 Type I report, with the Type II observation period underway"; footer badges link to the trust center at trust.parameter.ai.Source
    • Your website"Penetration Testing Cost: 2026 Buyer's Pricing Guide" (September 11, 2026) lists market ranges ($5,000-$50,000+ per engagement; web app and API $5,000-$30,000; SOC 2 $5,000-$20,000; retests $1,500-$8,000) but no Parameter price; the SOC 2 page says manual SOC 2 pentests "run from about $5,000 for a shallow test" and that "Parameter is one annual contract scoped to the environment covered".Source
  • 15

    The only free tool is a CVSS calculator that ends in a generic "Book a call". Pricing "follows the size of what is tested" (apps, APIs, repos, roles), which is exactly what a buyer could enter themselves to see which tier fits and what a manual test of the same scope would cost.

    Medium impactMedium effort First result in 1 month Member of Technical Staff

    First action

    Write the scope-to-tier rules sales uses today.

    How to measure it

    Scope-builder submissions

    Now
    –
    Target
    40 a month
    By
    90 days

    Steps

    1. 1

      Write the rules

      Scope inputs to tier and range.

      Founder (go-to-market) 2 days

    2. 2

      Design

      Six inputs, one answer.

      Member of Technical Staff, Generalist 2 days

    3. 3

      Build

      Client-side like the CVSS tool.

      Member of Technical Staff, Generalist 1 week

    4. 4

      Connect

      Pre-fill the booking form with the scope.

      Member of Technical Staff, Generalist 1 day

    5. 5

      Link

      From pricing, the cost guide and compliance pages.

      Member of Technical Staff, Generalist half a day

    6. 6

      Review

      Compare tool ranges with signed deals.

      Founder (go-to-market) monthly

    First result
    1 month
    Cost
    Engineering time
    Owner
    Member of Technical Staff, Generalist

    Smallest test

    A static table of three example scopes on the pricing section.

    Why it works

    Build a no-sign-up tool: number of apps, APIs, repositories, user roles, cloud accounts and the audit it is for. It returns the recommended tier, a price range, the manual-pentest range from the cost guide, and a "send this scope to sales" button that pre-fills the booking form.

    Buyers want a number before a call; the tool gives one and hands sales a qualified, pre-scoped lead.

    Risks and how to handle them

    • Ranges set wrong expectations

      Show ranges and what moves the price.

    Builds on

    Evidence

    • Your websiteFree tools page: one tool, a CVSS v3.1 calculator; no sign-up needed and "nothing you type leaves your browser"; the only CTAs are "Sign up" and "Book a call".Source
    • Your websitePentesting page and pricing: three tiers, Single App ("Fixed scope": one app and its primary APIs, an audit-ready SOC 2 / ISO 27001 report, same-day results, free re-testing), Rightsized ("Scoped for you") and Continuous ("Custom": pentests on every deploy, enterprise SLA, a dedicated success manager); no dollar amounts, "No seats, no surprises", and every tier's button is "Talk to Sales"; the page claims "Top 3 in the US on HackerOne" with no supporting link; a sample report PDF; no testimonials or case studies.Source
    • Your website"Penetration Testing Cost: 2026 Buyer's Pricing Guide" (September 11, 2026) lists market ranges ($5,000-$50,000+ per engagement; web app and API $5,000-$30,000; SOC 2 $5,000-$20,000; retests $1,500-$8,000) but no Parameter price; the SOC 2 page says manual SOC 2 pentests "run from about $5,000 for a shallow test" and that "Parameter is one annual contract scoped to the environment covered".Source
  • 16

    At GISEC, Parameter ran the agents live every 30 minutes with the promise "If the agents miss, you'll see them miss". That honest format reached only booth visitors; the YouTube channel has 18 subscribers, 4 videos and about 1,000 views in total.

    Medium impactMedium effort First result in 1 month Offensive Security Engineer

    First action

    Pick a well-known practice target and schedule the first stream.

    How to measure it

    Views per stream

    Now
    –
    Target
    2,000
    By
    2 quarters

    Steps

    1. 1

      Pick targets

      Deliberately vulnerable practice apps only.

      Offensive Security Engineer 1 day

    2. 2

      Set up

      Stream layout showing agent steps and proof.

      Member of Technical Staff, Infrastructure 3 days

    3. 3

      Rehearse

      One private run.

      Offensive Security Engineer 1 day

    4. 4

      Go live

      Monthly, 45 minutes with Q&A.

      Offensive Security Engineer monthly

    5. 5

      Clip

      Three short clips per stream.

      Founder (go-to-market) monthly

    6. 6

      Embed

      On matching knowledge-center and product pages.

      Member of Technical Staff, Generalist monthly

    First result
    1 month
    Cost
    Staff time
    Owner
    Offensive Security Engineer

    Smallest test

    Record one run and post it as a video.

    Why it works

    Once a month, stream an agent run against a deliberately vulnerable practice app, with an engineer narrating what the agent tries, what it proves and what it misses. Clip the best moments for X and LinkedIn and embed the recordings on the relevant knowledge-center pages.

    Showing misses earns trust with sceptical practitioners, and live runs are proof competitors' polished demos cannot match.

    Risks and how to handle them

    • A bad run on camera

      That is the point; explain the miss and what changes.

    Evidence

    • Your websiteGISEC Global 2026 page (September 16-18, Dubai, booth SP60 in the Startup Zone): live agent runs every 30 minutes ("If the agents miss, you'll see them miss"), "Bring your own target" with written authorization for a staging environment and validated findings sent before the show closed, and thirty minutes with a founder; the page names no Middle East frameworks.Source
    • YouTube@parameter_ai: 18 subscribers, 4 videos and 1,073 total views; the site's /videos section has two explainers (row-level security and IDOR) from September 8, 2026.Source
  • 17

    Real visitors pass Core Web Vitals (LCP 1.18 s), so this is not urgent. But Google's mobile lab test scores 50 with a 10.9-second LCP caused by the hero video, the page weighs 6.9 MB, and it loads tag manager, HubSpot, two Apollo scripts, X tracking and 140 KB of files still served from the old hex.co domain.

    Low impactLow effort First result in 2 weeks Member of Technical Staff

    First action

    List every tag with its owner and last use.

    How to measure it

    Mobile LCP (lab)

    Now
    –
    Target
    Under 4 s
    By
    30 days

    Steps

    1. 1

      Inventory tags

      Owner, purpose, last used.

      Member of Technical Staff, Infrastructure half a day

    2. 2

      Remove duplicates

      One script per vendor.

      Member of Technical Staff, Infrastructure half a day

    3. 3

      Move assets

      Serve from parameter.ai.

      Member of Technical Staff, Infrastructure 1 day

    4. 4

      Poster on mobile

      Still image, video on demand.

      Member of Technical Staff, Generalist 1 day

    5. 5

      Cache

      Long cache lifetimes for static files.

      Member of Technical Staff, Infrastructure 2 hours

    6. 6

      Retest

      PageSpeed and field data.

      Member of Technical Staff, Infrastructure monthly

    First result
    2 weeks
    Cost
    $0
    Owner
    Member of Technical Staff, Infrastructure

    Smallest test

    Swap the mobile hero for a poster and retest.

    Why it works

    Serve a poster image on mobile and load the video after interaction; move all assets onto parameter.ai; review which tags are still used and who owns each; set long cache lifetimes for static files.

    Slower phones and first visits from shared links get a faster page, and one owner per tag keeps tracking clean after the rebrand.

    Risks and how to handle them

    • Breaking attribution

      Check conversions before and after.

    Evidence

    • PageSpeedHomepage on Google PageSpeed (November 9, 2026): mobile performance 50, desktop 80; lab mobile LCP 10.9 s with the hero video as the LCP element; 6.9 MB and 84 requests; real visitors pass Core Web Vitals (LCP 1.18 s, INP 124 ms, CLS 0); third parties include Google Tag Manager (314 KB), assets from the old hex.co domain (140 KB), HubSpot (71 KB), Apollo and X conversion tracking.Source
    • Your website"Hex Security is now Parameter" (July 30, 2026): the old name described only the first product, autonomous pentesting; agreements, DPAs and invoices are unchanged because the contracting entity, Anytool, Inc., is the same. hex.co now returns a 301 redirect to parameter.ai/?from=hex.Source
  • 18

    Single App includes free re-testing; Continuous adds a pentest on every deploy. The re-test is the moment a customer sees how much changed since the first run, which is the argument for testing every release.

    High impactLow effort First result in 1-2 months Founder

    First action

    Add the "since your last test" section to the re-test report.

    How to measure it

    Upgrade rate

    Now
    –
    Target
    25% within 90 days
    By
    2 quarters

    Steps

    1. 1

      Define the section

      Releases, new surface, new findings.

      Offensive Security Engineer 2 days

    2. 2

      Build it

      Into the re-test report.

      Member of Technical Staff, Generalist 1 week

    3. 3

      Set the credit

      Single App fee credited within 30 days.

      Founder (go-to-market) 1 day

    4. 4

      Walk through

      Findings walkthrough includes the section.

      Offensive Security Engineer per customer

    5. 5

      Follow up

      Day 7 and day 25 reminders.

      Sales Development Representative per customer

    6. 6

      Measure

      Upgrade rate and time to upgrade.

      Founder (go-to-market) monthly

    First result
    1-2 months
    Cost
    Discount cost of the credit
    Owner
    Founder (go to market)

    Smallest test

    Add the section to the next five re-tests.

    Why it works

    At each re-test, add a short "since your last test" section: releases shipped, new endpoints, new findings, and what Continuous would have caught and when. Offer to credit the Single App fee against a Continuous contract signed within 30 days.

    Customers upgrade on their own evidence, and a fee credit removes the feeling of paying twice.

    Risks and how to handle them

    • Little change between tests

      Offer the upgrade only when new surface appears.

    Builds on

    Evidence

    • Your websitePentesting page and pricing: three tiers, Single App ("Fixed scope": one app and its primary APIs, an audit-ready SOC 2 / ISO 27001 report, same-day results, free re-testing), Rightsized ("Scoped for you") and Continuous ("Custom": pentests on every deploy, enterprise SLA, a dedicated success manager); no dollar amounts, "No seats, no surprises", and every tier's button is "Talk to Sales"; the page claims "Top 3 in the US on HackerOne" with no supporting link; a sample report PDF; no testimonials or case studies.Source
    • HiringOffensive Security Engineer (San Francisco, onsite; $180K-$250K): runs manual pentests on customer web apps, APIs and cloud, turns that methodology into agent capabilities, validates agent findings before customers see them ("You are the quality bar"), leads scoping calls and findings walkthroughs, and contributes to vulnerability research and responsible disclosure, "a core part of how we go to market" and "the front door to most of our customer relationships".Source

Big bets 3

Larger plays that can change the trajectory.

  • 19

    The homepage already says "A URL and credentials is all it takes" and has a "Sign up" button, but every pricing tier says "Talk to Sales" and the booking page offers no self-serve route. Aikido lets teams "Start for Free" and XBOW has retired its self-serve tier, so a self-serve AI pentest is an open lane.

    High impactHigh effort First result in 1 quarter Member of Technical Staff

    First action

    Design the domain-ownership and scope step.

    How to measure it

    Self-serve runs per month

    Now
    –
    Target
    50
    By
    2 quarters

    Steps

    1. 1

      Ownership check

      DNS or file verification before any test.

      Member of Technical Staff, Infrastructure 2 weeks

    2. 2

      Scope and limits

      Safe defaults, staging first.

      Offensive Security Engineer 2 weeks

    3. 3

      Checkout

      Card payment for Single App.

      Member of Technical Staff, Generalist 2 weeks

    4. 4

      Onboarding

      Credentials, test accounts, notifications.

      Member of Technical Staff, Generalist 3 weeks

    5. 5

      Quality gate

      Engineer review of first findings.

      Offensive Security Engineer ongoing

    6. 6

      Beta

      20 invited teams.

      Founder (go-to-market) 1 month

    7. 7

      Launch

      Pricing page and Labs posts link to it.

      Founder (go-to-market) 1 week

    First result
    1 quarter
    Cost
    One engineer for a quarter plus compute
    Owner
    Member of Technical Staff, Generalist

    Smallest test

    Invite ten teams to a manual self-serve flow run by an engineer.

    Why it works

    Build a self-serve path for one app: verify domain ownership, set scope and safe-testing limits, pay by card for a Single App run (or get a capped free first run on staging), and receive the first validated findings within 24 hours. Larger scopes still go to sales.

    Developers and small teams who will never book a sales call can buy, and each self-serve run becomes a qualified lead for Continuous.

    Risks and how to handle them

    • Testing systems the buyer does not own

      Mandatory ownership verification and written authorization.

    • Support load

      Start invite-only with a cap.

    Builds on

    Evidence

    • Your websiteHomepage (checked November 9, 2026): H1 "Security at the speed of development."; "AI agents that find vulnerabilities in your web apps, APIs, and infrastructure. Continuously, not once a year."; stats "$30B+" in breaches prevented, "<1%" false positives and "24/7" coverage; "Backed by Y Combinator"; a logo row "Built by the team that secured:" Apple, Google, Microsoft, U.S. Department of Defense, T-Mobile, Henkel, Epic Games, AT&T and Yahoo; CTAs "Book a call" and "Sign up"; closing "A URL and credentials is all it takes." and "First findings land within 24 hours."; no testimonials.Source
    • Your websiteBook-a-call page: "Get a demo of Parameter." with fields Website, Name, Work email, Company, Team size, Phone (optional) and "What do you want to cover?" (optional); no calendar or scheduler, nothing on what happens after submitting, and no self-serve alternative.Source
    • Competitor researchAikido's homepage: "Secure everything devs build, ship & run."; "Start for Free" with "No credit card required"; "Trusted by 150k+ orgs"; customer stories with metrics from Revolut, Deel, Raisin and Visma; "Security that opens a PR instead of a ticket".Source
    • Your websiteComparison pages: eight vendor pages under /alternative. The XBOW page lists Parameter's pricing as "Annual, per environment" and XBOW's as quoted and usage-based, with a $50,000/year AWS Marketplace listing and a retired self-serve tier; XBOW is described as "Validated and reviewed; no published FP rate", and the page says it was "checked against its own site on 6 September 2026".Source
  • 20

    Research and disclosure are "the front door to most of our customer relationships", but one-off research depends on finding a headline bug. A standing, opt-in programme for widely used open-source projects would produce a steady flow of fixed, disclosed findings, all with the maintainers' consent.

    High impactHigh effort First result in 1 quarter Offensive Security Engineer

    First action

    Ask five maintainers whether they would enrol.

    How to measure it

    Disclosed, fixed findings

    Now
    –
    Target
    24 a year
    By
    4 quarters

    Steps

    1. 1

      Write the terms

      Scope, consent, disclosure timeline, credit.

      Founder (go-to-market) 1 week

    2. 2

      Recruit

      Ten projects to start.

      Offensive Security Engineer 1 month

    3. 3

      Run

      Agents on each release.

      Member of Technical Staff, AI Engineer ongoing

    4. 4

      Validate

      Engineer review before reporting.

      Offensive Security Engineer ongoing

    5. 5

      Disclose

      Private report, fix, then a Labs note.

      Offensive Security Engineer per finding

    6. 6

      Report

      Yearly summary of findings and fix times.

      Founder (go-to-market) yearly

    First result
    1 quarter
    Cost
    Compute plus engineer time
    Owner
    Offensive Security Engineer

    Smallest test

    Enrol two projects for one quarter.

    Why it works

    Invite maintainers of popular open-source web frameworks and apps to enrol. The agents test each release, an engineer validates, maintainers get private reports, and after the fix Parameter publishes a short Labs note with credit to the maintainers. Combine with free Sentinel on those repositories.

    Consent-based, recurring research builds a public record that rivals' leaderboard claims cannot, and every note is a Labs post with a built-in test offer (idea 1).

    Risks and how to handle them

    • Maintainer burden

      Only proven findings, with suggested fixes.

    Builds on

    Evidence

    • HiringOffensive Security Engineer (San Francisco, onsite; $180K-$250K): runs manual pentests on customer web apps, APIs and cloud, turns that methodology into agent capabilities, validates agent findings before customers see them ("You are the quality bar"), leads scoping calls and findings walkthroughs, and contributes to vulnerability research and responsible disclosure, "a core part of how we go to market" and "the front door to most of our customer relationships".Source
    • Your websiteLabs (checked November 9, 2026): four research posts published between October 7 and October 28, 2026. The Labs index has a "Book a call" button, but the posts themselves end with only "next" and "back to all posts" links: no product link, no book-a-call, no sign-up and no subscribe option. The blog RSS feed (20 items) contains no Labs posts, and the site has no newsletter.Source
    • Your websiteSentinel page: AI review of every pull request, working with GitHub, GitLab and Bitbucket Cloud; "10,000+ PRs reviewed every day"; in the last 30 days 312,940 PRs reviewed and 9,417 vulnerabilities caught; no Sentinel price and no free tier; CTA "Get started". An August 7, 2026 blog post was titled "reviewing 5,000 PRs per day".Source
  • 21

    Parameter itself pairs agents with human testers: its Offensive Security Engineer runs manual pentests and validates agent findings before customers see them. Cobalt sells a network of 500+ human testers. Small consultancies have clients, trust and audit relationships but limited hours; Parameter has agents but a small team.

    High impactHigh effort First result in 1-2 quarters Founder

    First action

    Interview five boutique pentest firms about their capacity limits.

    How to measure it

    Partner contracts

    Now
    –
    Target
    10
    By
    3 quarters

    Steps

    1. 1

      Interview

      Five firms on capacity and pricing.

      Founder (go-to-market) 2 weeks

    2. 2

      Design terms

      Margin, branding, support split.

      Founder (go-to-market) 2 weeks

    3. 3

      Build tenancy

      Partner workspaces with client separation.

      Member of Technical Staff, Infrastructure 1 month

    4. 4

      Enable

      Training on scoping and safe testing.

      Offensive Security Engineer 2 weeks

    5. 5

      Pilot

      Three firms, three clients each.

      Founder (go-to-market) 1 quarter

    6. 6

      Review

      Margin, churn and finding quality.

      Founder (go-to-market) quarterly

    First result
    1-2 quarters
    Cost
    Engineering for tenancy plus partner margin
    Owner
    Founder (go to market)

    Smallest test

    One firm runs the agents for one client under a referral fee.

    Why it works

    Offer a partner edition: consultancies run the agents for continuous coverage between their manual engagements, white-label or co-brand the report, and resell Continuous with a margin. Start with five boutique firms serving SOC 2 and PCI clients.

    Each partner brings many clients at once, and Parameter competes with the human-network model by enabling it rather than replacing it.

    Risks and how to handle them

    • Channel conflict with direct sales

      Register deals; partners keep clients they bring.

    Evidence

    • Your websitePentesting page and pricing: three tiers, Single App ("Fixed scope": one app and its primary APIs, an audit-ready SOC 2 / ISO 27001 report, same-day results, free re-testing), Rightsized ("Scoped for you") and Continuous ("Custom": pentests on every deploy, enterprise SLA, a dedicated success manager); no dollar amounts, "No seats, no surprises", and every tier's button is "Talk to Sales"; the page claims "Top 3 in the US on HackerOne" with no supporting link; a sample report PDF; no testimonials or case studies.Source
    • Competitor researchRivals' own homepages: XBOW, "Every finding is a working exploit", with named quotes from security leaders (including a deputy CISO at Moderna), "200+ top security teams" and a #1 HackerOne ranking; Horizon3.ai, "7,012 customers", a Gartner Peer Insights 4.7/5 and awards; Cobalt, a "network of 500+ vetted security experts" with named CISO quotes and a "flexible Cobalt credit model".Source
    • HiringCareers page: five open roles, all full time in San Francisco: Member of Technical Staff (Generalist, AI Engineer and Infrastructure), Offensive Security Engineer and Sales Development Representative; the page describes a "Small team".Source
    • HiringOffensive Security Engineer (San Francisco, onsite; $180K-$250K): runs manual pentests on customer web apps, APIs and cloud, turns that methodology into agent capabilities, validates agent findings before customers see them ("You are the quality bar"), leads scoping calls and findings walkthroughs, and contributes to vulnerability research and responsible disclosure, "a core part of how we go to market" and "the front door to most of our customer relationships".Source

Wildcards 2

Unexpected experiments, each with a cheap way to test it.

  • 22

    Parameter's own data post cites a survey in which false-positive rate was the top selection criterion for 63% of buyers, and its XBOW comparison points out that XBOW has "no published FP rate". Parameter claims "<1%" on every page, but no page explains how it is counted.

    Medium impactMedium effort First result in 1 month Member of Technical Staff

    First action

    Write down today's definition of a false positive.

    How to measure it

    Methods page visits

    Now
    –
    Target
    Linked from every comparison
    By
    60 days

    Steps

    1. 1

      Define

      Finding, validation, false positive.

      Offensive Security Engineer 2 days

    2. 2

      Instrument

      Track customer-disputed findings.

      Member of Technical Staff, AI Engineer 1 week

    3. 3

      Compute

      Rolling 90-day rate.

      Member of Technical Staff, AI Engineer 2 days

    4. 4

      Publish

      Methods page with the live number.

      Member of Technical Staff, Generalist 2 days

    5. 5

      Link

      From every "<1%" mention and the comparisons.

      Member of Technical Staff, Generalist 1 day

    6. 6

      Update

      Monthly.

      Member of Technical Staff, AI Engineer monthly

    First result
    1 month
    Cost
    Staff time
    Owner
    Member of Technical Staff, AI Engineer

    Smallest test

    Add a one-paragraph definition under the "<1%" stat.

    Why it works

    Publish a methods page: what counts as a finding, how it is validated, how false positives are reported by customers, and the rolling 90-day rate. Update it monthly and link it wherever "<1%" appears.

    Being the vendor whose headline number is auditable turns the category's top buying criterion into Parameter's advantage.

    Risks and how to handle them

    • The measured rate is above 1%

      Publish the true number and the trend; adjust the claim.

    Builds on

    Evidence

    • Your website"We ran 2,300 pentests in 3 weeks. Here's what our AI finds" (August 6, 2026): in a 1,200-finding sample, 11% critical and 26% high; broken authentication and access control 42%, exposed secrets and configuration 17%, IDOR 15%, injection 11%; it cites a survey in which false-positive rate was the top selection criterion for 63% of respondents.Source
    • Your websiteComparison pages: eight vendor pages under /alternative. The XBOW page lists Parameter's pricing as "Annual, per environment" and XBOW's as quoted and usage-based, with a $50,000/year AWS Marketplace listing and a retired self-serve tier; XBOW is described as "Validated and reviewed; no published FP rate", and the page says it was "checked against its own site on 6 September 2026".Source
    • Your websiteHomepage (checked November 9, 2026): H1 "Security at the speed of development."; "AI agents that find vulnerabilities in your web apps, APIs, and infrastructure. Continuously, not once a year."; stats "$30B+" in breaches prevented, "<1%" false positives and "24/7" coverage; "Backed by Y Combinator"; a logo row "Built by the team that secured:" Apple, Google, Microsoft, U.S. Department of Defense, T-Mobile, Henkel, Epic Games, AT&T and Yahoo; CTAs "Book a call" and "Sign up"; closing "A URL and credentials is all it takes." and "First findings land within 24 hours."; no testimonials.Source
  • 23

    Continuous customers get pentests on every deploy, findings in pull requests and a success manager, but the people who renew the contract (the CISO, the board, the auditor) rarely read pull requests. The SOC 2 page already frames reports as audit evidence, and Parameter is itself in its SOC 2 Type II observation period, so it knows what auditors look for.

    Medium impactMedium effort First result in 1 quarter Founder

    First action

    Draft the one-page layout from one customer's last month.

    How to measure it

    Annual renewal rate

    Now
    –
    Target
    Above 90%
    By
    4 quarters

    Steps

    1. 1

      Design

      One page, five numbers, one trend.

      Founder (go-to-market) 1 week

    2. 2

      Map controls

      SOC 2 and ISO 27001 references per finding type.

      Offensive Security Engineer 1 week

    3. 3

      Build

      Automated monthly PDF and email.

      Member of Technical Staff, Generalist 2 weeks

    4. 4

      Pilot

      Five customers; ask who they forwarded it to.

      Founder (go-to-market) 1 month

    5. 5

      Roll out

      All Continuous customers.

      Member of Technical Staff, Generalist 1 week

    6. 6

      Track

      Opens, forwards and renewals.

      Founder (go-to-market) monthly

    First result
    1 quarter
    Cost
    Engineering time
    Owner
    Founder (go to market)

    Smallest test

    Hand-make the summary for three customers.

    Why it works

    Each month, send a one-page summary: releases tested, findings by severity, median time to fix, re-test results and audit-relevant controls covered, with a downloadable evidence pack. Make it forwardable and show the trend since the contract began.

    Renewals are decided by people who never see the day-to-day value; a forwardable summary shows it to them every month.

    Risks and how to handle them

    • Bad months look bad

      Show findings fixed, not just found.

    Evidence

    • Your websitePentesting page and pricing: three tiers, Single App ("Fixed scope": one app and its primary APIs, an audit-ready SOC 2 / ISO 27001 report, same-day results, free re-testing), Rightsized ("Scoped for you") and Continuous ("Custom": pentests on every deploy, enterprise SLA, a dedicated success manager); no dollar amounts, "No seats, no surprises", and every tier's button is "Talk to Sales"; the page claims "Top 3 in the US on HackerOne" with no supporting link; a sample report PDF; no testimonials or case studies.Source
    • Your websiteSOC 2 page: "Pentest evidence for SOC 2. From every release."; "Auditors set their own evidence standard"; "Ask your auditor before the audit window opens"; "Parameter holds a SOC 2 Type I report, with the Type II observation period underway"; footer badges link to the trust center at trust.parameter.ai.Source

03

How Programmable can help

Where an idea in this playbook is something Programmable builds or runs, it's listed here with what we'd do. Everything else is yours to run.

ProgrammableInfo

Turn the research into a list you can act on

These ideas start with finding the right companies. Info finds them and the right person at each, researches every one and drafts the outreach, then asks before it sends.

  • Build this list in Info for idea #11 (opens programmable.info in a new tab)

New accounts: 100,000 free credits with code BETA100K

Find the companies (opens programmable.info in a new tab)
ProgrammableDigital

Show it, don't just describe it

These ideas need something to show: a demo, a video, an animation, graphics or a deck. Digital turns screenshots or the site into all of them, in the company's own brand.

Make a demo (opens programmable.digital in a new tab)
More example playbooks and reviews

More growth playbooks

Other companies we have researched, each read from what they are hiring for.

  • Amwell growth strategyA technology-enabled care platform for health plans, health systems and government: virtual primary and urgent care, digital behavioral…22 growth ideas
  • SFH growth strategyA PhD-founded, family-owned supplement brand from Maine (since 2009/2010): protein, PUSH pre-workout, NSF Certified for Sport omega-3…22 growth ideas
  • Mintel growth strategyA global market intelligence company: consumer research, the GNPD product launch database, market data, expert analysis, AI tools (Leap…21 growth ideas
  • Earnest growth strategyStudent loan refinancing, private student loans for undergraduate, graduate and parent borrowers, and personal loans, with no fees…21 growth ideas
  • Potential growth strategyAn AI-powered learning and engagement platform that governments and enterprises use to run branded workforce, certification…20 growth ideas
  • The Agency growth strategyA global boutique luxury real estate brokerage for homes for sale and rent, new development, leasing, commercial and resort properties…20 growth ideas
  • Workato growth strategyA control and execution platform for enterprise AI, built on its iPaaS: integrations and automation, agents (AIRO, Agent Studio)…21 growth ideas
  • AgentShelf growth strategyA no-code platform to build, deploy and govern AI agents, with an AI Front Desk for business websites, dedicated agent workspaces, an…22 growth ideas

See every playbook and website review

Independent research. Programmable wrote this playbook from public sources, as they stood on November 9, 2026, and cites them throughout. Parameter did not commission, review or endorse it, and Programmable is not affiliated with Parameter. Company and product names are trademarks of their owners, used only to identify them. The ideas are suggestions and opinion, not professional, legal or financial advice, and not statements about how Parameter runs its business.

Something wrong, or do you represent Parameter? Email [email protected] and we will correct it or take it down.

30/60/90 roadmap

What to focus on in each month, and the ideas that carry it.

  1. Days 1 to 307 ideas

    Put a test offer and subscription on every Labs post, add a Single App starting price, fix the booking flow, explain the logos and headline numbers, link the HackerOne rank, merge the duplicate post and finish the rebrand in listings.

  2. Days 31 to 6011 ideas

    Named customer stories, Sentinel for open source, the findings report, research-led SDR sequences, GCC compliance pages, knowledge-center CTAs, audit partners, the scope builder, the live agent run, tag clean-up and the Single App upgrade path.

  3. Days 61 to 905 ideas

    Commit to the big bets: a self-serve first app, an opt-in open-source testing programme and a consultancy channel; test the false-positive method page and the board report.

The research behind the plan

3 research areas, each summarised in a few lines. Open any of them for the full detail.

Customers

What customers say

Customers value findings proven with a working exploit, not scanner noise. The most cited problem: annual pentests that cost five figures and are stale on arrival.

  • First findings within 24 hours instead of waiting for an annual engagement
  • False positives from automated tools
  • In their words: “pentest”

Market

Competitive landscape

5 competitors compared: XBOW, Horizon3.ai (NodeZero), Cobalt, Aikido and 1 more.

  • Gap to exploit: A published, checkable false-positive method
  • XBOW: Black-box first; no code or cloud coverage per Parameter's comparison
  • Horizon3.ai (NodeZero): Network-first rather than application-layer

Hiring signals

Parameter is a small San Francisco team hiring five roles, and the mix says engineering-led growth with a first sales hire.

  • Sales Development Representative: First outbound hire, turning research into meetings. Ideas 1, 3, 11.
  • Offensive Security Engineer: Disclosure is "the front door" to customers. Ideas 1, 5, 20.
  • Member of Technical Staff, Generalist: Product and site work for self-serve and conversion. Ideas 13, 15, 19.

From the team that wrote this playbook

All products
  • ProgrammableAgencyWorking AI systems in days, not quarters (opens programmable.agency in a new tab)
  • ProgrammableInfoAn agent that finds, researches and asks first (opens programmable.info in a new tab)
  • ProgrammableDigitalScreenshots in, an animated product demo out (opens programmable.digital in a new tab)
  • ProgrammableWatchKnow the day a supplier falls out of compliance (opens programmable.watch in a new tab)
  • ProgrammableTalkGet registrants for your events, and know who’s coming (opens programmable.talk in a new tab)
  • ProgrammablePageText what you need, your customer gets a page that works (opens programmable.page in a new tab)
  • ProgrammableCommunityForums with labelled AI members, never empty (opens programmable.community in a new tab)
ProgrammableMarketing
ExamplesLeaderboardsProductsTermsPrivacyCookiesDPALegalContact

© 2026 AI-Powered Growth Intelligence