Home / Articles / Selling at the right altitude: why a small security firm's grand website is read by the people who will never buy from it, is unreadable to the ones who need it, and what to put on the page instead

Selling at the right altitude: why a small security firm's grand website is read by the people who will never buy from it, is unreadable to the ones who need it, and what to put on the page instead

By Dinis Cruz · 2026-11-04 · article v1.0.0 · newsroom v0.14.63 · salespositioningsmall-businesscybersecuritywebsitessmessynthetic-usersbehaviour-policiesvaultsarticle

Abstract: Picture a cybersecurity firm of one to five people with a website that sells everything: a 24/7 security operations centre, managed detection and response, red teaming, PCI and ISO audits, zero trust, a virtual CISO. These days it is often the kind of site an AI helps you build in an afternoon, and it looks impressive. It also has a tragic symmetry. The readers who understand every word are security teams at larger companies, and they will buy that work from an established provider with a bigger team, not from three people. The readers who need a firm this size, small businesses, cannot read the page: in the UK in 2025, only 9% of micro businesses had heard of Cyber Essentials. So the firm is selling at the wrong altitude. I built a vault with three versions of the same invented firm's website, bad, medium and good, and infographics for the argument. The good one names the people, says where they are and how they work, and sells outcomes a small business understands: still open after ransomware, nobody logging in as you, laptops looked after, client data handled properly, AI tools doing what you meant. And every service on the page has to pass three questions: have we sold it, can we deliver it at this size, and would the buyer who needs it understand the words?

In short

• The grand website of a small security firm sells everything, in the language of security experts.
• The tragic symmetry: the readers who understand it will not buy from a firm this size; the readers who need it cannot read it.
• The numbers: 9% of UK micro businesses had heard of Cyber Essentials in 2025.
• The right altitude: sell the outcome the owner understands, not the service a specialist would name.
• Name the people, say where you are and how you work, and show a price.
• Three questions for every service: have we sold it, can we deliver it at this size, would the buyer who needs it understand the words?
• A vault with three versions of the same invented firm's site shows the difference, bad, medium and good.

The grand website

You have seen this website. A cybersecurity company, often one to five people, with a home page that sells everything: security assessments, a security operations centre, managed detection and response, penetration testing and red teaming, PCI and ISO 27001, zero trust architecture, a virtual CISO, cyber risk quantification, cloud security posture. Big numbers, a dark theme, a gradient headline, "your trusted end-to-end partner", and a row of client logos.

These days a site like this is cheap to make. An AI will write the copy and build the page in an afternoon, and it looks like a company that spent serious money on marketing. And here is the thing: the more grandiose it is, the more it tells you it is a small company. Larger firms feel different. They show their people, their history, their scale. A page that claims to do everything usually means a small team that has not yet decided what it actually sells.

The tragic symmetry

The problem is not that the claims are big. It is who reads them.

The readers who understand the page will not buy from it. A security lead at a large company reads every term and knows exactly what each one takes. A 24/7 operations centre needs analysts on shift every night of the year. Red teaming at that level needs a team with a track record. So they buy it from an established provider, with a bigger team and a pedigree, and a three-person firm is not on the list, however good the website.

The readers who need the firm cannot read the page. The owner of a 14-person accountancy practice needs exactly what a small local firm can give: someone who comes in, fixes the basics, and keeps checking them. But they do not know what a SOC is, or XDR, or PCI. At best they have heard of ransomware. They do not leave thinking "I should call these people". They leave slightly intimidated, without calling anyone.

This is not a guess about small businesses. In the UK government's Cyber Security Breaches Survey 2025, 9% of micro businesses were aware of Cyber Essentials and 9% of the 10 Steps guidance, and 39% outsourced their cyber security at all. These are the people the small firm should be selling to, and the grand website is written in a language they do not speak.

So the website is aimed at the one reader who will not buy, and misses the two who would. That is what I mean by selling at the wrong altitude.

The right altitude

The work underneath does not change. What changes is the altitude you describe it from. A small business owner does not buy "managed detection and response". They buy "someone notices when something is wrong". They do not buy "backup and recovery"; they buy "ransomware on Monday, open on Tuesday".

For a small firm whose market is small businesses, that means selling the fundamentals, as outcomes:

• You stay open after ransomware, because your backups are tested, not just running.
• Nobody can log in as you, because two-step sign-in is on your email and every important account.
• Your laptops are looked after: updates, protection, and a check every month.
• Your clients' data is where it should be: the GDPR basics, and no confidential files shared with half the planet.
• Your AI tools do what you meant: a written policy for each assistant or agent you use. This is the newest item, and it is where Agent Behaviour Policies come in: what each agent is for, what it can reach, and what holds each line.

None of it is glamorous. All of it is what the UK's National Cyber Security Centre's guidance for small organisations covers: backups, protecting devices and accounts, and spotting scams. And it is the work that, for most small businesses, should eventually be a requirement.

There is also a reason this is a better business now than it was. A small firm can now run agents that check a client's basics every day, backups, sign-in settings, shared files, updates, and only call a person when something changes. Three people can look after far more businesses than they could two years ago, as long as what they sell is something those businesses understand.

Three versions of the same firm

To make this concrete I asked for a vault with three versions of the website of one invented firm, Fenmoor Cyber, three people in an invented town. Same people, same skills, three websites. Each comes with notes on how three readers see it: the owner of a 14-person accountancy practice, the office manager who looks after IT at a 40-person builders' merchant, and the security lead of a 2,000-person insurer.

• Bad: the grand website. Understood only by the security lead, who would not buy. The owner leaves; the office manager bookmarks it and does nothing.
• Medium: cleaner words and a plain list of eight services, "for businesses of every size". Better, and still the same problem: it sells services, not outcomes, and hides the people.
• Good: "We are three people in Fenmoor who keep small businesses running when something goes wrong." Three named people with what each does, the area they cover, five outcomes, how the first month works, a fixed monthly price, and a short section on what they do not do, with an offer to say who does. The owner books the free visit. The security lead still would not buy, and the site tells them so politely, which is itself a reason to recommend the firm to the smaller businesses in their supply chain.

Open the vault to switch between the three and read the notes. Everything in it is invented: the firm, the town, the people, the prices and the claims.

Name the people

The first change from bad to good is the people. A small firm's strongest asset is that it is small: you know who will answer the phone and who will come to your office. So say it. This is Paula, this is Steve, this is Anna. This is what each of us does. This is the area we cover. This is how we work, and this is what it costs. Trust us because you can see us.

A large firm cannot do that, and a small firm that hides behind a corporate voice throws away the one thing a larger competitor cannot copy.

Three questions for every service

Before a service goes on the page, it should pass three questions:

1. Have we sold it? Not could we, and not have we done it once for a friend. Has someone paid us for it?
2. Can we deliver it, at this size? A 24/7 operations centre needs people on shift every night, not a better website.
3. Would the buyer who needs it understand the words? Read the page as that 14-person practice would.

If any answer is no, the service is a claim, not a product. Take it off, or say who you would send the customer to. Being able to explain something, or having an AI write a convincing page about it, is not the same as there being a market for it.

Ask the readers, before the market does

The third question is the hardest to answer about your own website, because you cannot un-know the words. This is where synthetic users earn their keep. Point a small business owner, an office manager and a security lead, invented and run by agents one screenshot at a time, at your home page, and ask each one: do you understand what this company does, why it would help you, and would you contact them? On a grand website, the owner says, quite quickly, "I have no idea what this is." That is the answer the market gives too, only more slowly and without telling you.

What this does not claim

• Fenmoor Cyber, its town and its people are invented, and so are the readers' reactions in the vault, which are my reading, not research.
• The curves in the first figure are illustrative; the 9% and 39% are measured, for UK micro businesses in 2025.
• Some small firms do sell specialist work well, usually as a named specialist in one thing, not as a firm that does everything.
• The outcomes listed are the fundamentals, not everything a small business needs; regulated businesses need more.

Where this comes from

My conversation of 4 November 2026, in this site's repository under admin/notes/2026-11-04__selling-at-the-right-altitude/. DSIT, Cyber Security Breaches Survey 2025. NCSC, Small organisations guide to cyber security. The vault, made for this article. Earlier on this site: synthetic users for your website, what can your agent reach, resilience when the workforce includes agents. All read 4 November 2026.

Peer review Not reviewed yet. Review it

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles