Go-to-Market Playbook / Narrative Consulting + Access Narrative IGA

Prepared: April 3, 2026
0% complete
Key Concepts
Glossary
Overview
Strategy Summary The Numbers The Flywheel
Phase 1: Foundation
Overview (Weeks 1–2) Legal & Operations Platform Readiness Outbound Infrastructure Checklist
Phase 2: Content Engine
Overview (Weeks 1–4) LinkedIn Strategy Blog & SEO Content Bank Weekly Schedule
Phase 3: Outbound Blitz
Overview (Weeks 3–8) Target List Building Cold Email Campaigns LinkedIn Direct Outreach Sequence Playbook
Phase 4: Sales Conversion
Overview (Weeks 4+) Discovery Call Script Assessment as Wedge Proposal & Close SaaS Upsell Motion
Phase 5: SaaS Launch
Overview (Weeks 6–10) Pricing Strategy Pilot Program Onboarding Playbook
Phase 6: Referral Engine
Overview (Weeks 8+) Partner Channels Case Studies Community Presence
Budget & Tools
Monthly Budget Tool Stack
12-Week Sprint
Week-by-Week Plan Success Metrics
Revenue Model
Projections $100K Milestone Path
Master Checklist
All Action Items

Go-to-Market Playbook

The Hybrid Blitz: Content Authority + Surgical Outbound for Fastest Path to Revenue

Products: Consulting Services + Access Narrative IGA SaaS
Strategy: Content + Outbound Hybrid
Timeline: 12 weeks to first paying clients
Monthly Budget: $250–$350/mo
Time Investment: 5–10 hrs/week
Target: Fintechs & healthcare, 300–500 employees

Key Concepts & Glossary

This playbook uses business and marketing terms you may not have encountered before. This glossary defines them all upfront so nothing catches you off guard. Each term is also explained in context the first time it appears.

Business & Legal Terms

TermPlain English Explanation
LLC (Limited Liability Company)A legal business structure that separates your personal assets (house, car, savings) from your business. If the business gets sued, they can't come after your personal stuff. It also makes you look legitimate to enterprise clients who won't sign contracts with an individual person.
EIN (Employer Identification Number)A tax ID number for your business — like a Social Security Number, but for the LLC. You need this to open a business bank account, file taxes, and send invoices. Free from the IRS, takes 5 minutes online.
E&O Insurance (Errors & Omissions)Also called "professional liability insurance." If a client claims your consulting work caused them harm (e.g., "your recommendations broke our system"), this insurance pays for your legal defense and any settlement. Enterprise companies require consultants to carry this before signing a contract.
Cyber Liability InsuranceCovers you if there's a data breach or cyber incident related to your business. Since you'll be handling sensitive access management data, this is essential. Usually bundled with E&O for one monthly payment.
SOW (Statement of Work)A formal document describing exactly what work you'll do, what you'll deliver, the timeline, and the cost. Think of it as a detailed receipt you and the client both sign before work begins. It protects both sides.
MSA (Master Service Agreement)A legal contract that sets the overall terms of your business relationship with a client (payment terms, confidentiality, liability limits, IP ownership). You sign this once, then each new project gets a shorter SOW that references the MSA.
NDA (Non-Disclosure Agreement)A contract where both sides promise not to share confidential information. Clients often require this before showing you their internal systems.
Procurement ThresholdMost companies have spending limits where different levels of approval are needed. For example, a manager might approve purchases under $5,000 on their own, but anything above $5,000 needs VP approval and a formal procurement process (which takes weeks or months). Your $3,500 assessment is priced to stay BELOW this threshold, so deals close faster.

Sales & Marketing Terms

TermPlain English Explanation
Go-to-Market (GTM)Your plan for how you'll get your product in front of customers and convince them to buy. This entire document is your GTM plan.
ICP (Ideal Customer Profile)A detailed description of the exact type of company most likely to buy from you. Instead of "anyone who needs security help," your ICP is: "fintech companies with 300–500 employees who are approaching their first SOC 2 audit." Being specific lets you focus limited time on the people most likely to say yes.
PipelineYour list of potential deals in progress, organized by how close each one is to closing. A "healthy pipeline" means you have multiple conversations at different stages, so you always have deals coming in.
LeadA person or company who might become a customer. A "cold lead" is someone who doesn't know you yet. A "warm lead" is someone who has shown interest (visited your site, replied to an email). A "qualified lead" is someone with the budget, authority, and need to actually buy.
Inbound vs. OutboundInbound: People find YOU (through your blog, LinkedIn posts, or referrals) and reach out. Outbound: YOU find people and contact them first (cold emails, LinkedIn messages). This playbook uses both.
Discovery CallA 30-minute video or phone call with a potential client where you learn about their problems and decide if you can help. It's NOT a sales pitch — it's a conversation. You ask questions, they talk about their pain. If there's a fit, you propose next steps.
ProposalA document you send after a discovery call that says: "Here's what I understood about your situation, here's what I recommend, here's what it costs, and here's the timeline." The client reviews it and either says yes, negotiates, or says no.
UpsellSelling a more expensive or additional service to an existing customer. Example: A client pays $3,500 for your Assessment, and you show them they need the $8,500 Buildout to fix what the Assessment found. This is much easier than finding a brand new customer because they already trust you.
Wedge ProductA low-cost, low-risk offering that gets your foot in the door with a new client. Your $3,500 Assessment is your wedge — it's cheap enough that a manager can approve it quickly, and it naturally leads to bigger engagements. Think of it as the appetizer that sells the main course.
CTA (Call to Action)The thing you want someone to do after reading your content. "Book a free assessment call" is a CTA. "Try our online assessment tool" is a CTA. Every piece of content should have one.
Cold EmailSending an email to someone who doesn't know you. This is NOT spam. Effective cold email is personalized, relevant to the recipient's situation, provides value, and makes it easy to say "no thanks." Spam is bulk garbage sent to millions. Cold email is a carefully targeted message sent to a specific person about a specific problem they have.
Domain WarmingWhen you set up a new email domain, email providers (Gmail, Outlook) don't trust it yet. If you immediately send 100 emails from a brand-new domain, they'll all go to spam. "Warming" means gradually sending small volumes of real emails over 2 weeks so email providers learn your domain is legitimate. Instantly.ai automates this for you.
Reply RateThe percentage of people who respond to your cold emails. Industry average is 1–3%. A 4–6% reply rate is excellent. A 15–25% reply rate (for referral intros) is outstanding. If your reply rate is below 1%, something is wrong with your targeting or messaging.
Sequence / CadenceA pre-planned series of messages sent over time. Instead of sending one email and hoping, you send 3 emails over 7 days, each adding value. If they don't respond to email 1, email 2 shares a useful blog post, email 3 makes a final soft ask. Your CRM's sequence builder automates this.
Referral ArrangementAn informal (or formal) agreement with another professional: "You send clients to me, I send clients to you." No money changes hands (though some arrangements include a referral fee). SOC 2 auditors are a perfect referral partner because they find the problems you fix, but they don't fix them.
Case StudyA short story (500 words) about how you helped a specific client. It follows a simple structure: their problem, what you did, the results. Case studies are the #1 most persuasive marketing asset because prospects think, "They solved that company's problem, they can solve mine too."

Content & SEO Terms

TermPlain English Explanation
SEO (Search Engine Optimization)Making your website content show up when people search Google for things related to your business. If someone Googles "SOC 2 access control requirements" and your blog post appears on page 1, that's SEO working. It's free traffic from people actively looking for solutions you offer.
Long-Tail SearchSpecific, detailed search phrases (e.g., "how to run access review for SOC 2 audit fintech") rather than broad ones ("access management"). Long-tail searches have less competition and higher buyer intent — someone searching for that specific phrase is likely ready to take action.
Content Pillars3–5 core themes you always write about. Instead of posting randomly, you rotate through your pillars (compliance pain, scale problems, horror stories, how-to value, behind the build). This keeps your messaging consistent and ensures you cover all the angles that attract buyers.
Anchor ContentA single, comprehensive piece of content (usually 2,000+ words) that covers a topic thoroughly. It's the piece you'll link to from everywhere else. Your "SOC 2 Access Control Requirements" blog post is anchor content. Think of it as the centerpiece that everything else points to.
Engagement (LinkedIn)Commenting on other people's posts. LinkedIn's algorithm rewards people who interact with others — your posts reach more people when you're actively commenting on other posts. 15 minutes a day of genuine, thoughtful comments is more valuable than an extra post per week.

SaaS & Revenue Terms

TermPlain English Explanation
SaaS (Software as a Service)Software that customers pay for monthly (like Netflix or Spotify) instead of buying once. Your Access Narrative IGA platform is SaaS — clients pay $12–25/user/month for as long as they use it. SaaS is valuable because revenue is recurring: once a customer signs up, they keep paying every month without you having to re-sell them.
MRR (Monthly Recurring Revenue)The total amount of subscription money coming in each month. If you have 3 customers paying $3,000/mo each, your MRR is $9,000. MRR is the most important metric for a SaaS business because it tells you how much money you can predictably count on.
ARR (Annual Recurring Revenue)MRR × 12. If your MRR is $9,000, your ARR is $108,000. Investors and acquirers value SaaS companies as a multiple of ARR (typically 5–15x), so a $108K ARR business could be worth $540K–$1.6M. This is why SaaS is the goal.
ChurnWhen a customer stops paying. If 1 out of 10 customers cancels each month, you have 10% monthly churn. Low churn is critical — it means customers stay and your revenue compounds. High churn means you're constantly replacing lost customers just to stay flat.
Founding Customer / Early AdopterYour first customers who sign up knowing the product is new. They get a big discount (40% off) in exchange for providing feedback, testimonials, and being willing to tell others about their experience. These are incredibly valuable because they give you the social proof needed to sell at full price later.
Sales-Led vs. Self-ServeSales-led: Every customer talks to you before buying. You control the experience and can help them. Self-serve: Customers sign up on their own (like Dropbox or Slack). You're starting sales-led because the product needs hands-on onboarding, and you'll learn what to automate. Self-serve comes later.
Series A, B, C (Funding)When a startup raises money from investors, each round is named A, B, C. Series A companies ($5–15M raised) are establishing product-market fit. Series B ($15–50M) are scaling. Series C ($50M+) are expanding. For your targets: Series A–C companies have money to spend on security/compliance and are growing fast enough to need identity governance.
Productized ConsultingInstead of selling your time by the hour ("I'll bill you for however long it takes"), you sell fixed-scope packages with clear deliverables and prices. Your $3,500 Assessment is productized: the client knows exactly what they get, how long it takes, and what it costs. This is easier to sell than hourly consulting because the buyer knows the total cost upfront.
FlywheelA business model where each part of the cycle makes the next part easier. Your flywheel: content builds your reputation → reputation makes cold outreach work better → clients produce case studies → case studies become content → cycle repeats. Once it's spinning, growth accelerates on its own.

Industry-Specific Terms

TermPlain English Explanation
MSP (Managed Service Provider)A company that manages other companies' IT infrastructure (servers, networks, email, security) for a monthly fee. Think of them as outsourced IT departments. They're a potential referral partner because they handle IT but rarely specialize in identity governance.
MSSP (Managed Security Service Provider)Same as MSP but focused specifically on security (monitoring, incident response, firewalls). They often lack identity governance expertise, which is your opening.
White-LabelOffering your service under someone else's brand name. If an MSP "white-labels" your assessment, their client thinks the MSP did the work. You do the work, the MSP takes the credit and marks up the price. It's a way to get clients without doing your own sales.
ISACAA global professional association for IT governance, risk, and compliance professionals. Membership ($135/year) gives you access to a network of 185,000+ auditors, security professionals, and compliance experts. Local chapter meetings are where you meet potential clients and referral partners in person.
BSidesCommunity-organized, locally-run security conferences. They're informal, affordable (free–$50), and attended by the exact people who buy identity governance services. Presenting a 20-minute talk at a local BSides event is one of the highest-ROI marketing activities you can do.
CAN-SPAMA US law that sets rules for commercial email. You must include: your physical address, an unsubscribe link, and you must honor unsubscribe requests within 10 days. Violating this can result in fines up to $50,000 per email. Your platform already handles compliance — you just need to make sure unsubscribe links actually work.
GDPRA European Union privacy law. Even if you only target US companies, some may have European employees or customers, so having GDPR-compliant data handling shows enterprise readiness. It mainly means: let people request their data, let them delete their data, and don't collect data you don't need.

Strategy Summary

You are launching two products simultaneously: productized IGA consulting ($3,500–$8,500 engagements) and Access Narrative IGA SaaS (recurring monthly subscriptions). The consulting practice generates immediate cash flow, builds credibility, and creates a natural pipeline into SaaS sales. Every consulting engagement is a future SaaS customer.

"Productized consulting" means you sell fixed-price packages with clear deliverables, not open-ended hourly billing. Instead of saying "I charge $200/hour and it'll take however long it takes," you say "This assessment costs $3,500, takes 1–2 weeks, and you get a findings report and roadmap." Clients prefer this because they know the total cost upfront.

"SaaS" means customers pay a monthly fee to use your software (like a Netflix subscription). Revenue is recurring — once someone subscribes, they keep paying every month without you re-selling them. This is why SaaS businesses are so valuable. See the Glossary for all terms.

Why the Hybrid Blitz Works

  • Content makes cold outreach convert 2–3x better. When a prospect receives your cold email and checks your LinkedIn, they see a credible expert with a track record of insightful posts — not a random cold emailer.
  • Outbound generates immediate pipeline while content compounds over months.
  • Consulting wins become case study content that sells the SaaS product.
  • Your assessment tool qualifies leads automatically for both services.
  • You already built the entire infrastructure — CRM, content studio, sequences, outreach templates, assessment engine. Not using them would be waste.

Key constraint: You have 5–10 hours/week for sales and marketing. Every activity in this playbook is designed for maximum ROI within that constraint. Nothing is "nice to have" — everything earns its time slot.

The Numbers at a Glance

$100K
Annual Revenue Target
$350
Monthly Budget
5–10
Hours / Week
12
Weeks to First Client
2
Products to Market
$27K
Year 1 Value / Client

The Consulting → SaaS Flywheel

"Flywheel" is a business concept where each success makes the next success easier. Imagine a heavy wheel: it takes effort to start spinning, but once it's moving, each push makes it go faster. Your flywheel works like this: writing content makes people trust you → trust makes cold emails work better → cold emails lead to consulting clients → consulting clients become case studies → case studies become more content → the wheel spins faster with every cycle.

Each step feeds the next. One client in motion powers the entire cycle.

LinkedIn Content
→
Cold Outreach
→
Free Assessment
→
Consulting Win
→
Case Study + SaaS Upsell
→
More Content

Assessment → Consulting ($3.5K–$8.5K) → Retainer ($1.5K/mo) → SaaS ($12–25/user/mo)

Phase 1: Foundation (Weeks 1–2)

Everything else depends on these being done. No outreach until the business can legally operate and close deals.

This phase is about building the legal and operational foundation your business needs before you can accept money from clients. Think of it like building a house: you can't decorate until the foundation, walls, and roof are in place. These items are "blockers" — meaning nothing else in this plan works until they're done.

Legal & Operations

Why do you need an LLC? An LLC (Limited Liability Company) creates a legal wall between you and your business. If a client sues Narrative Consulting LLC, they can't touch your personal bank account, house, or car. Without an LLC, you're personally liable for everything. It also signals professionalism — enterprise companies expect to sign contracts with a legal entity, not an individual.

What's an EIN? An Employer Identification Number is basically a Social Security Number for your business. The IRS assigns one for free. You need it to open a business bank account, pay taxes as a business, and appear on invoices.

Why a separate bank account? Mixing personal and business money is a legal and tax nightmare. A business bank account keeps everything clean: client payments go in, business expenses come out. Mercury and Relay are online banks designed for startups — no minimum balance, no fees, good integrations.

TaskCostTimelinePriority
Form PA LLC — File online with PA DOS. Your guide is already at easydatatransfer. Use self-registered agent (your home address) to save costs. $125 1–2 days to file, 2–4 weeks to process Blocker
Get EIN from IRS — Free, same-day online at irs.gov. Required for business bank account and invoicing. Free Same day Blocker
Open business bank account — Mercury (free, startup-friendly) or Relay. Need EIN + LLC docs. Free 1–3 days Blocker
E&O + Cyber Liability Insurance — Hiscox or Hartford bundle. $1M coverage. Procurement will disqualify without this. $80–150/mo Same day Blocker
Verify Stripe end-to-end — Send a test invoice through the client portal. Confirm payment arrives in your account. Free 1 hour High

What is E&O insurance? Errors & Omissions insurance (also called "professional liability") protects you if a client claims your work caused them harm. For example, if you recommend a specific access control setup and it fails, the client could sue you for damages. E&O pays for your lawyer and any settlement. Without it, you'd pay out of pocket.

What is Cyber Liability insurance? Covers data breaches and cyber incidents related to your business. Since you'll be handling sensitive identity and access data, this is especially important. Most carriers bundle E&O + Cyber for one payment.

What is "procurement"? This is the process companies use to evaluate and approve vendors. At medium and large companies, you can't just sell to someone — their procurement team reviews your business credentials (insurance, legal entity, security posture) before approving any purchase. Having insurance and an LLC means you pass this review.

Do not skip insurance. Enterprise procurement teams ask for proof of insurance in the first email. No insurance = no deal, regardless of how good your pitch is. Budget $80–$150/month for this. It pays for itself with a single engagement.

Platform Launch Readiness

Your consulting site at accessnarrative.com has a P1–P3 launch readiness plan with 10 tasks. Execute all of them:

#TaskWhy It Matters
1CAN-SPAM compliant unsubscribe linksLegal requirement for email campaigns
2Privacy policy pageRequired for enterprise trust
3Terms of Service pageLiability protection
4Cookie consent implementationGDPR/compliance signal
5Footer links (privacy, terms, contact)Professional credibility
6GDPR data endpointsEnterprise procurement requirement
7Rate limiting (Upstash Redis)Prevents abuse of assessment/forms
8HTML sanitizationSecurity hardening
9Code cleanupPerformance and reliability
10Deploy to productionGo live

Outbound Infrastructure Setup

"Outbound" means YOU reach out to potential customers first (as opposed to "inbound," where they find you). The tools below help you find the right people to contact and send them professional, personalized emails at scale. Think of it as having a research assistant (Apollo) who finds the right people, a mailroom (Instantly) that sends your letters, and a networking tool (Sales Navigator) that helps you connect on LinkedIn.

"Domain warming" is critical to understand: When you set up a new email address, Gmail and Outlook don't trust it yet. If you send 50 emails from a brand-new domain, they'll all go to spam. "Warming" means Instantly.ai gradually sends small batches of emails over 14 days, building your domain's reputation. After 14 days, your emails reliably land in inboxes. This is why you start this on Day 1 — it's a 2-week wait no matter what.

Start these on Day 1 — domain warming takes 14 days, so the sooner you start, the sooner you can send campaigns.

ToolCost/moPurposeSetup Time
LinkedIn Sales Navigator $100 Advanced search filters to find CTOs, VPs Engineering, CISOs at target companies. InMail credits let you message people you aren't connected with (normally LinkedIn blocks this). 30 min
Instantly.ai $30 Cold email sending with auto-warmup, deliverability monitoring, and sequence automation. Connect a dedicated outreach domain. 1 hour + 14 days warming
Apollo.io $100 Prospect database with verified emails. Build targeted lists by company size, industry, tech stack, funding stage. Export to Instantly. 30 min

Outreach domain: Do NOT send cold emails from your primary accessnarrative.com domain. Buy a separate domain (e.g., narrativeconsulting.co or getaccessnarrative.com) for ~$12/year and use it exclusively for cold outreach. This protects your primary domain's reputation.

Phase 1 Checklist

  • File PA LLC with DOS
    $125
  • Get EIN from IRS (online, same day)
    Free
  • Open business bank account (Mercury or Relay)
    Free
  • Purchase E&O + Cyber Liability insurance
    ~$100/mo
  • Test Stripe invoice flow end-to-end
    Free
  • Execute P1–P3 launch readiness (10 tasks)
    Dev time
  • Set missing Vercel env vars (Instantly, Upstash, LinkedIn, Cron)
    Free
  • Buy dedicated outreach email domain
    $12/yr
  • Activate LinkedIn Sales Navigator
    $100/mo
  • Set up Instantly.ai + begin domain warming
    $30/mo
  • Set up Apollo.io account
    $100/mo
  • Test CRM pipeline (add lead → sequence → email sends)
    Free

Phase 2: Content Engine (Weeks 1–4)

Content starts on Day 1, in parallel with foundation work. This is your authority-building machine. Every post makes your cold outreach warmer.

Why does content matter for sales? When you send a cold email to a CTO, the first thing they do is Google you and check your LinkedIn. If your LinkedIn has 50 insightful posts about identity governance, they think: "This person clearly knows their stuff." If your LinkedIn is empty, they think: "Who is this random person emailing me?" Content doesn't directly generate sales — it makes everything else you do work better.

"Content engine" means a system for consistently creating and publishing content. Instead of writing one post when you feel inspired, you batch-create 10–15 posts at once (maybe on a Sunday afternoon), schedule them to publish throughout the week, and then spend 15 minutes each day engaging with other people's posts. This is sustainable even with 5–10 hours/week.

LinkedIn Strategy

Posting Cadence: 3x/week

  • Monday: Educational post (IGA concepts, compliance breakdowns, "did you know" insights)
  • Wednesday: Opinion/hot take (what most companies get wrong, contrarian views on identity management)
  • Friday: Practical tip or mini-case study (anonymized war stories, step-by-step fixes, tool comparisons)

"Posting cadence" means how often you publish. 3x/week is the sweet spot: frequent enough that LinkedIn's algorithm keeps showing your posts to people, but not so frequent that you burn out. Each day of the week has a different content type to keep things varied and interesting.

"Batch-create" means sitting down once (for example, Sunday for 90 minutes) and writing all 3 posts for the upcoming week at once, then scheduling them in advance using your content studio. This is vastly more efficient than trying to write one post each day.

Content Pillars (Rotate Through These)

"Content pillars" are 3–5 recurring themes that all your content falls under. Instead of randomly writing about whatever comes to mind, you cycle through your pillars to make sure you're consistently attracting different types of buyers. Think of them as different "angles" on the same core expertise.

PillarPurposeExample Topics
Compliance Pain Attract SOC 2/HIPAA buyers "Your auditor will ask for access review evidence. Here's what they actually want." / "The 5 SOC 2 controls that trip up every fintech"
Scale Problems Attract growing companies "At 300 employees, your spreadsheet access tracker breaks. Here's what replaces it." / "The hidden cost of manual provisioning"
Horror Stories Create urgency "A terminated employee still had admin access 6 months later. Here's how." / "Service accounts are your biggest blind spot"
How-To Value Demonstrate expertise "How to run your first access review in 48 hours" / "ABAC vs RBAC: when to use which"
Behind the Build Humanize + sell SaaS "I'm building an IGA platform because [X]. Here's what I learned this week." / Product sneak peeks

Engagement rule: Spend 15 minutes per day commenting on posts from CISOs, CTOs, and compliance professionals in your target market. Genuine, insightful comments build relationships faster than posting alone. Your content studio already supports scheduling — batch-create posts on weekends, drip them out during the week.

Blog & SEO

What is SEO? SEO (Search Engine Optimization) means making your website show up when people search Google. If someone types "SOC 2 access control requirements" into Google and your blog post appears on page 1, that's free advertising from someone who is already looking for help — they came to YOU.

"Long-tail search traffic" means targeting specific, detailed search phrases like "how to prepare for SOC 2 access review fintech" instead of broad phrases like "access management." These specific searches have less competition (easier to rank for) and the people searching them are more likely to buy (they have a specific problem right now).

"CTA" (Call to Action) is the thing you want the reader to do after reading your content. At the end of every blog post, you include something like "Take our free assessment" or "Book a 30-minute call." Without a CTA, readers enjoy your content and leave. With a CTA, some of them become leads.

Your blog at accessnarrative.com/blog targets long-tail search traffic. These are prospects actively searching for solutions.

Priority Blog Posts (Publish 1 Every 2 Weeks)

  1. "The Complete Guide to SOC 2 Access Control Requirements" — Anchor content. 2,500+ words. Targets: "SOC 2 access controls", "SOC 2 user access review". Link to your assessment tool as CTA.
  2. "Identity Governance for Fintechs: What Your Auditor Actually Expects" — Industry-specific. Targets fintech compliance officers. CTA: free assessment.
  3. "How to Run an Access Review in 48 Hours (Not 48 Days)" — Practical how-to. Shows expertise. CTA: "Or let us handle it — $3,500 assessment."
  4. "RBAC vs ABAC: A Practical Guide for Growing Companies" — Educational. Targets mid-market teams choosing an access model. Subtly introduces Access Narrative as the ABAC solution.
  5. "Service Account Governance: The Compliance Gap Nobody Talks About" — Differentiator topic. Most IGA vendors ignore non-human accounts. You don't.
  6. "Why Your HRIS Isn't Your Identity Source of Truth" — Provocative. Gets shared. Naturally leads to your consulting assessment as the diagnostic.

Content Bank: 15 LinkedIn Posts to Write in Week 1

View all 15 pre-written post concepts ›
  1. "Your SOC 2 auditor is going to ask about access reviews. Here's what they actually want to see." — Break down the 3 specific artifacts auditors request. End with: "Need help getting audit-ready? Link in bio."
  2. "The 3 access control gaps I find in every 300-person company." — Stale accounts, no offboarding process, no service account governance. Each with a one-line fix.
  3. "Why your HRIS isn't your identity source of truth (and what to do about it)." — HRIS misses contractors, service accounts, app-specific roles. Explain the identity fabric concept.
  4. "Service accounts are your biggest compliance blind spot." — Most companies can't even list their service accounts. Explain the risk and the fix.
  5. "The real cost of manual provisioning at scale." — Do the math: 10 min per request × 50 requests/month = 500 min/month = 1 FTE day. And that's before errors.
  6. "I've seen access review spreadsheets with 10,000 rows. Nobody reads them." — The theatre of compliance vs. actual governance. What effective reviews look like.
  7. "Hot take: most companies don't need SailPoint. They need 3 good policies and someone to enforce them." — Contrarian. Gets engagement. Positions you as the practical alternative.
  8. "Your terminated employee still has access to 12 apps. I know because I checked." — The offboarding gap. How to audit it in 30 minutes.
  9. "ABAC isn't just for enterprises anymore. Here's how 300-person companies use it." — Practical ABAC explainer. Ties to Access Narrative's ABAC engine.
  10. "The first question I ask every new client: 'Show me your last access review.'" — 80% can't produce one. What that means for their compliance posture.
  11. "Building an IGA platform from scratch. Here's what I learned about audit trails this week." — Behind-the-build content. Shows the Narrative feature without being salesy.
  12. "The difference between identity management and identity governance (and why it matters for your SOC 2)." — Educational. Most buyers confuse these. Position yourself as the expert who clarifies.
  13. "3 things your Okta admin isn't telling you about your access posture." — Default configs, group sprawl, unused app assignments. Practical and slightly provocative.
  14. "I built 11 open-source Terraform modules for Okta. Here's why." — Credibility post. Links to your GitHub. Shows you ship real infrastructure.
  15. "If your access governance strategy is 'trust the manager to review,' you don't have a strategy." — Rubber-stamp problem. How to fix it with automated policies and exception-based reviews.

Weekly Time Allocation (Content Activities)

ActivityTimeFrequency
Batch-write 3 LinkedIn posts1.5 hrsWeekly (weekend)
Daily LinkedIn engagement (comments)15 min/day5x/week
Write 1 blog post (bi-weekly)2 hrsEvery 2 weeks
Total content time:~3 hrs/week average

Phase 3: Outbound Blitz (Weeks 3–8)

Domain warming completes around Week 3. This is when outbound begins in earnest. You already have 4 cold outreach templates built — now you need prospect lists and campaign execution.

"Outbound blitz" means a focused period of sending cold emails and LinkedIn messages to potential clients. "Cold" means they don't know you yet — you're reaching out first. This is NOT spam. Effective cold outreach is personalized (you mention their specific company and situation), relevant (you're solving a problem they actually have), and respectful (easy to unsubscribe, no tricks). Think of it as a polite tap on the shoulder at a networking event, not a bullhorn in a crowd.

Why does this start at Week 3? Because your outreach email domain needs 2 weeks of "warming" before emails land in inboxes (see Phase 1). Your content engine also needs to be running by now so that when prospects check your LinkedIn, they see credibility.

Target List Building (Apollo.io)

"ICP" (Ideal Customer Profile) is a detailed description of the exact type of company most likely to buy from you. Instead of emailing random people, you define the characteristics of your perfect customer and then search for companies that match. This is like fishing with a spear instead of a net — more effort per target, but dramatically higher success rate.

Apollo.io is a database of millions of companies and their employees, with verified email addresses. You enter your ICP filters (company size, industry, job titles), and it gives you a list of specific people to contact. You then export these lists to Instantly.ai, which sends your email sequences automatically.

"Trigger signals" are events that indicate a company needs what you sell RIGHT NOW. A company posting their first SOC 2 compliance job? They just realized they need help. A company that just raised Series B funding? They're about to scale fast and will outgrow their current identity management. Targeting trigger signals means you're reaching people when they're most receptive.

Ideal Customer Profile (ICP) Filters

FilterConsulting ICPSaaS ICP
Company Size300–500 employees200–1,000 employees
IndustryFintech, Healthcare, SaaSSame + any SOC 2 company
FundingSeries A–C (has budget, needs governance)Series B+ (growing fast, scaling pains)
Job TitlesCTO, VP Engineering, CISO, VP IT, Head of SecuritySame + IT Director, IAM Manager
Tech StackOkta, Azure AD, Google WorkspaceAny IDP + 10+ SaaS apps
Trigger SignalsSOC 2 audit approaching, recent funding, compliance hireScaling headcount, new compliance requirement

List size target: Build lists of 50–100 prospects per campaign. Quality over quantity. You want 3–5 discovery calls per week, which requires ~50 cold emails/week at a 3–5% reply rate.

Cold Email Campaigns

"Campaigns" are organized batches of outreach targeting a specific type of prospect. Instead of sending the same generic email to everyone, you create different campaigns for different situations. Campaign 1 targets companies facing SOC 2 audits (they have urgency). Campaign 2 targets fast-growing companies (they have scaling pain). Each campaign has its own email templates tailored to that specific situation.

"Sequence" means a series of pre-written emails sent automatically over several days. If someone doesn't reply to email 1, they automatically get email 2 three days later (which shares something useful), and then email 3 a few days after that (which makes a gentle final ask). This follow-up is crucial — most sales happen after the 2nd or 3rd contact, not the first.

"Reply rate" is the percentage of people who respond. A 3–5% reply rate on cold email is good. That means if you email 100 people, 3–5 will respond. Of those, maybe 1–2 will book a call. This is why volume matters — you need to email ~50 people per week to get 1–3 calls.

You already have 4 outreach templates built. Run them as separate campaigns in Instantly.ai, targeting different trigger events:

Campaign 1: "Just Got the SOC 2 Request"

Trigger: Company recently posted SOC 2 compliance job, or their job listings mention SOC 2 for the first time.

Sequence: 3 emails over 7 days. Email 1: empathize with the audit scramble. Email 2: share your SOC 2 access control blog post. Email 3: offer a free 30-min assessment call.

Expected reply rate: 4–6% (high intent trigger)

Campaign 2: "Scaling Past the Spreadsheet"

Trigger: Company recently crossed 300 employees (check LinkedIn company page) or just raised a round.

Sequence: 3 emails over 10 days. Email 1: "At 300 people, manual access management breaks." Email 2: share the "real cost of manual provisioning" post. Email 3: offer assessment.

Expected reply rate: 2–4%

Campaign 3: "Post-Incident Cleanup"

Trigger: Company recently disclosed a security incident, data breach, or compliance finding.

Sequence: 2 emails over 5 days. Sensitive tone. Focus on "getting the house in order" and preventing recurrence. Offer assessment as non-threatening first step.

Expected reply rate: 3–5%

Campaign 4: "Referral Warm Intro"

Trigger: Partner or contact provided an introduction.

Sequence: 1 email. Reference the mutual connection. Offer assessment. This is your highest-converting campaign.

Expected reply rate: 15–25%

LinkedIn Direct Outreach

Run in parallel with cold email. Different channel, same prospects. Do NOT copy-paste your cold email — LinkedIn messages should be conversational.

LinkedIn Outreach Cadence

  1. Day 1: Send connection request with short personalized note (reference their company, a post they wrote, or a shared interest). No pitch.
  2. Day 3 (after acceptance): Thank them for connecting. Ask a genuine question about their identity/compliance challenges. Still no pitch.
  3. Day 7: Share a relevant piece of your content (blog post or LinkedIn post). "Thought you might find this relevant given [their situation]."
  4. Day 14: Soft pitch. "I help companies like [theirs] get audit-ready. Would a 30-min assessment call be useful? No obligation."

Volume limit: LinkedIn flags accounts that send too many connection requests. Stay under 20–25 new connections per week. Quality targeting matters more than volume here.

Weekly Outbound Time Allocation

ActivityTimeFrequency
Build prospect lists in Apollo (50/week)30 minWeekly
Import to Instantly + launch campaigns15 minWeekly
Reply to cold email responses30 minDaily
LinkedIn connection requests (20/week)30 minWeekly
LinkedIn follow-up messages15 min3x/week
Total outbound time:~3–4 hrs/week

Phase 4: Sales Conversion (Weeks 4+)

By Week 4, you should have discovery calls happening. Here's how to convert them.

"Sales conversion" means turning interested people into paying customers. Up until now, you've been generating leads (people who are aware of you and interested). This phase is about what happens when they say "tell me more" — how do you run the conversation, what do you propose, and how do you get them to sign?

"Discovery call" is a 30-minute conversation (usually video call) with a potential client. Despite the name, this is NOT a sales pitch. You spend 80% of the time listening and asking questions about their problems. The goal is to understand their situation well enough to recommend the right service. If there's a fit, you offer next steps. If not, you part ways professionally. Think of it as a doctor's consultation — diagnose first, prescribe second.

Discovery Call Framework (30 Minutes)

The PAIN Framework

  1. Problem (5 min): "Tell me about your current identity management setup. What's working and what's not?" Listen for: manual processes, audit failures, scaling pains, recent incidents.
  2. Audit (10 min): "Walk me through your last access review. How long did it take? Who ran it?" Listen for: no formal process, spreadsheet-based, never done one, took weeks.
  3. Impact (5 min): "What happens if this doesn't get fixed? Is there a compliance deadline or audit coming up?" Listen for: SOC 2 audit date, board pressure, customer requirements.
  4. Next Steps (10 min): "Based on what you've described, I'd recommend starting with our Identity Infrastructure Assessment. It's $3,500, takes 1–2 weeks, and you'll have a complete picture of your gaps with a prioritized remediation plan. I can have a proposal to you by tomorrow."

Key insight: Never pitch the Buildout ($8,500) first. Always start with the Assessment ($3,500). It's below most procurement thresholds, it's low risk for the buyer, and it creates the evidence needed to sell the Buildout. The Assessment IS your sales tool.

The Assessment as Your Wedge Product

"Wedge product" is a concept from sales strategy. It's a small, low-cost, low-risk offering designed to get your foot in the door with a new client. The logic is simple: it's very hard to convince a stranger to spend $8,500. But it's much easier to convince them to spend $3,500 on a clearly defined assessment. Once they've worked with you, trust is established, and selling the $8,500 buildout becomes natural — they've seen your quality firsthand.

Think of it like a restaurant offering a lunch special. The lunch special gets new customers in the door. Once they experience the food, they come back for dinner (the real money-maker).

The $3,500 Identity Infrastructure Assessment is your primary sales conversion mechanism. Here's why it's the perfect wedge:

AttributeWhy It Works
Price point ($3,500)Below most procurement thresholds. Manager can approve without VP sign-off. Low perceived risk.
Clear deliverableRisk-ranked findings report + remediation roadmap. Tangible, not theoretical.
Short timeline (1–2 weeks)Fast enough to fit before an audit deadline. Doesn't require a long sales cycle.
Creates urgency for upsellThe findings report naturally surfaces the need for the Buildout ($8,500) and/or Access Narrative SaaS.
Online assessment toolYour assessment engine at accessnarrative.com/assessment pre-qualifies leads automatically before the call.

Proposal & Close Process

A "proposal" is a document you send to a potential client after your discovery call. It's different from an invoice (which comes after work is done). A proposal says: "Based on our conversation, here's what I understood about your situation, here's what I recommend doing, here's what it will cost, and here's the timeline." The client reads it, maybe asks some questions, and either accepts (you're hired!), negotiates (adjusts scope or price), or declines.

Why 24 hours? Speed matters in sales. The client's pain is freshest right after your call. If you wait a week to send a proposal, they've moved on to other priorities. Sending it the next day shows professionalism and keeps momentum. Your platform already has a proposal template — you just customize it for each client.

"Closing" means getting the client to agree and pay. In your case, closing = they sign the SOW (Statement of Work) and pay the 50% upfront deposit. Don't overthink this — if your discovery call identified real problems and your proposal addresses them clearly, closing happens naturally.

  1. Send proposal within 24 hours of discovery call. Use your existing proposal template. Personalize the "Current Situation" and "Recommended Approach" sections based on what they told you.
  2. Follow up at Day 3 if no response. "Just checking if you had any questions about the proposal."
  3. Follow up at Day 7 with added value. Share a relevant blog post or insight related to their specific situation.
  4. If stalled at Day 14, offer the online assessment tool as a free starting point. "Try our online assessment — it'll give you a preliminary view of your gaps. If the results confirm what we discussed, we can revisit the engagement."

The Consulting → SaaS Upsell Motion

"Upsell" means selling an additional or more expensive service to someone who is already a customer. Upselling is much easier than finding new customers because the trust barrier is already gone — they've worked with you, they like your work, and they're receptive to your recommendations. Your consulting engagements are the perfect setup for an upsell into the SaaS product.

How this works in practice: You complete a $3,500 Assessment and present the findings to the client. The findings show they have identity governance gaps. You say: "I can fix these manually through our Buildout package ($8,500), and then Access Narrative can monitor and enforce these controls automatically going forward for $12–25/user/month." The client has just seen evidence of the problem, so the solution sells itself.

Every consulting engagement is a SaaS sales opportunity. Here's when and how to introduce Access Narrative:

Timing the SaaS Conversation

  • During Assessment delivery: "Your findings show you need continuous access monitoring, not just a one-time audit. I've built a platform that does exactly this — let me show you."
  • During Buildout delivery: "I've set up your policies and workflows. Access Narrative can enforce and monitor these automatically going forward."
  • During Retainer check-ins: "The manual quarterly reviews we're doing could be automated. Let me show you what that looks like in Access Narrative."

The pitch: "You're paying me $1,500/month to do access reviews manually. Access Narrative does it continuously for $12–25 per user. For a 400-person company, that's $5–10K/month with better coverage than quarterly manual reviews."

Key differentiator for the SaaS pitch: The "Narrative" audit trail. No other IGA platform gives you a clickable, interactive timeline of every access change for every user. Demo this feature first — it's visually impressive and immediately communicates value.

Phase 5: SaaS Launch (Weeks 6–10)

By this point, your IGA product should be production-ready. Launch sales-led only — every customer comes through a conversation with you.

"Sales-led" vs "self-serve" are two ways customers can buy your software. Sales-led means every customer talks to you first — you demo the product, answer questions, and personally set up their account. Self-serve means customers sign up on their own (like signing up for Dropbox). You're starting sales-led because:

(1) Your product is new and may need hands-on setup help. (2) You learn what customers need by talking to them. (3) Identity governance is a trust product — security buyers want to talk to a human before handing over sensitive data. (4) Each conversation teaches you what to automate later.

Self-serve is the goal for later (once the product is polished and you have documented onboarding flows), because it lets you grow without your time being the bottleneck.

Pricing Strategy

How does SaaS pricing work? SaaS products are priced "per user per month." If a company has 400 employees and your Starter tier costs $12/user/month, they pay 400 × $12 = $4,800 per month. This means a single mid-size customer generates significant recurring revenue.

Why have tiers? Different customers need different features. A 200-person company might only need basic access management (Starter), while a 1,000-person company needs SIEM integration and advanced certifications (Professional). Tiering lets you capture revenue from both without the smaller company paying for features they don't use. It also creates a natural "upgrade" path as companies grow.

"Per-user" pricing means your revenue grows automatically as the customer's company grows. If they have 400 employees today and hire 100 more next year, your monthly revenue from that one customer increases by 25% — without any additional selling.

TierPriceUsersIncludes
Starter $12/user/mo Up to 500 Core access management, Narrative audit trail, basic reports, email support
Professional $18/user/mo Up to 2,000 + ABAC rules, access certifications, SIEM integration, priority support
Enterprise $25/user/mo Unlimited + AI wizard, custom integrations, dedicated support, SLA

Early adopter discount: Offer your first 3–5 SaaS customers 40% off for the first year in exchange for: (1) a case study, (2) a testimonial quote, (3) willingness to be a reference call. A 400-user company at Starter pricing = $4,800/mo × 60% = $2,880/mo. Still excellent revenue, and you get the social proof you need to sell at full price.

Pilot Program Structure

What is a "founding customer" / pilot program? When you launch a new product, your first customers take a risk — the product is unproven, there are no reviews, and bugs may exist. To compensate for this risk, you offer them a significant discount (40% off) in exchange for something equally valuable: their feedback, a public testimonial, and willingness to tell others about their experience.

Why is this worth 40% off? Because testimonials and case studies are worth far more than the discount. Without social proof, every sale is hard. With one credible testimonial from a real company, every subsequent sale gets easier. You're essentially investing in marketing assets that pay dividends forever.

"Reference call" means when a future prospect asks "Can I talk to one of your current customers?" and your founding customer agrees to take a 15-minute call to vouch for you. This is the single most powerful sales tool in B2B (business-to-business) sales.

The "Founding Customer" Offer

Position early SaaS customers as "founding customers" who get permanent benefits in exchange for helping shape the product:

  • 40% discount for Year 1 (locked in, regardless of future pricing changes)
  • 15% permanent discount starting Year 2 (loyalty reward for early adopters)
  • Direct access to you for feature requests and priority support
  • In exchange: Monthly 30-min feedback call, case study participation, public testimonial, willingness to take 1–2 reference calls per quarter

Onboarding Playbook (Sales-Led)

For the first 5–10 customers, you personally onboard every one. This is critical for product quality.

  1. Day 0: Kickoff call (45 min) — Walk through their environment: user count, apps, IDP, compliance requirements. Configure their tenant.
  2. Day 1–3: Data import — Help them import users and applications via the wizard. Fill in gaps where the wizard isn't complete yet.
  3. Day 4–7: Configure access controls — Set up birthright rules, ABAC policies, and approval workflows based on their Assessment findings.
  4. Day 7–14: Certification dry run — Run a test access certification campaign. Train their team on the workflow.
  5. Day 14: Go-live — Switch to production use. You monitor for the first week and address issues in real-time.
  6. Day 30: Check-in call — Collect feedback, address issues, request testimonial if satisfied.

Why sales-led onboarding matters: Every onboarding conversation teaches you what the wizard needs to do automatically. By customer #5, you'll have a clear list of what to build for self-serve. By customer #10, self-serve becomes viable.

Phase 6: Referral Engine (Weeks 8+)

Once you have your first 1–2 paying clients, shift 30% of your marketing energy toward referrals. Referral leads close at 4–5x the rate of cold leads.

What is a "referral engine"? A systematic way to get other people to send customers to you. Instead of relying solely on your own outreach, you build relationships with professionals who regularly encounter people who need your services, and they recommend you.

Why do referral leads close 4–5x better? Trust. When a SOC 2 auditor tells their client "I know a guy who specializes in fixing exactly this — his name is Sean," that client already trusts you before the first call. Compare that to a cold email from a stranger. The auditor's recommendation did the selling for you.

"Referral arrangement" is simply an agreement (often informal) where you and another professional agree to recommend each other. No money needs to change hands — the value is mutual. They send you clients who need identity governance; you send them clients who need SOC 2 audits. Everyone wins.

Partner Channel Strategy

Partner TypeWhy They Refer to YouHow to Approach
SOC 2 Auditors They find access control gaps during audits but don't fix them. You're their remediation partner. Reach out to boutique audit firms (Johanson Group, Prescient Assurance, Drata partners). Offer a mutual referral arrangement. They send you clients who fail access control reviews; you send them companies needing SOC 2 audits.
Compliance Consultants They handle policy/process but don't implement identity infrastructure. You're their technical partner. Find solo/boutique compliance consultants on LinkedIn. Propose complementary positioning: they handle policy, you handle implementation.
MSPs/MSSPs They manage IT infrastructure but rarely specialize in identity governance. You fill their expertise gap. Target small MSPs serving 300–500 person companies. Offer white-label assessment capability or referral fee (10–15% of first engagement).
Okta/Azure AD Partners They deploy identity platforms but don't do governance. You're the governance layer on top. Join the Okta Partner Network (your 11 Terraform modules are your credential). ISACA chapter events are full of these people.

Case Study Machine

What is a case study and why does it matter? A case study is a short (500 words) story about how you helped a specific client. It's the most persuasive type of marketing content in B2B (business-to-business) because prospects read it and think: "They solved that company's problem, which is similar to my problem, so they can probably help me too."

Do you need the client's permission? Yes, always. Some clients are happy to be named publicly. Others prefer to remain anonymous ("a Series B fintech with 350 employees"). Both versions are valuable. You'll request permission as part of your Founding Customer agreement.

When do you write your first one? After your first completed Assessment engagement (around Weeks 9–10). Even an anonymized case study with real metrics ("reduced access review time from 3 weeks to 48 hours") is powerful.

Every client engagement becomes a case study. Here's the template:

Case Study Format (500 Words Max)

  1. The Situation: "[Company type] with [X] employees needed [compliance requirement] but had [specific gap]."
  2. The Challenge: "Manual access management was taking [X] hours/week. Their last audit revealed [specific findings]."
  3. The Solution: "We ran a 2-week Identity Infrastructure Assessment, followed by a 4-week Governance Buildout."
  4. The Results: Quantified outcomes. "Access review time reduced from 3 weeks to 48 hours. Zero findings in subsequent SOC 2 audit. Saved $X/year in manual effort."
  5. The Quote: A sentence from the client. This is the most powerful part.

If the client can't be named, anonymize: "A Series B fintech with 350 employees." Still valuable.

Community Presence

CommunityCostAction
ISACA Local Chapter $135/yr Attend monthly meetings. Offer to present on identity governance topics. Network with auditors and compliance professionals.
Identity Defined Security Alliance (IDSA) Free Contribute to working groups. Builds visibility among identity security practitioners.
r/cybersecurity, r/sysadmin Free Answer access management questions. Link to blog posts where relevant. Never hard-sell.
LinkedIn Groups Free Join "Identity Management Professionals", "SOC 2 Compliance", "CISO Network". Share content and engage.
Local BSides/Security Meetups Free–$50 Attend 1–2 per quarter. Present if possible. A 20-minute talk at a local BSides establishes more credibility than 50 LinkedIn posts.

Budget & Tools

Monthly Operating Budget

CategoryItemMonthly CostNotes
Sales ToolsLinkedIn Sales Navigator$100Advanced search + InMail
Instantly.ai$30Cold email + warmup
Apollo.io$100Prospect database
InfrastructureOutreach email domain$1~$12/year
Existing stack (Supabase, Vercel, etc.)$116Already paying this
InsuranceE&O + Cyber Liability$80–150Non-negotiable for enterprise sales
CommunityISACA Membership$11$135/year
Total New Monthly Spend$322–$392On top of existing $116/mo

ROI math: Total new monthly cost is ~$350. One Assessment engagement ($3,500) pays for 10 months of tooling. One SaaS customer at Starter pricing (400 users × $12 = $4,800/mo) pays for everything and then some. The budget is conservative and easily justified.

One-Time Setup Costs

ItemCost
PA LLC Filing$125
Outreach email domain$12
ISACA Membership (annual)$135
Total One-Time$272

12-Week Sprint Plan

Week-by-week execution plan. Each sprint card shows what to focus on that week.

Weeks 1–2: Foundation

  • File LLC + get EIN + open bank account
  • Purchase insurance (E&O + Cyber)
  • Execute P1–P3 launch readiness (10 platform tasks)
  • Set up Instantly.ai + begin domain warming
  • Activate LinkedIn Sales Navigator + Apollo.io
  • Batch-write 15 LinkedIn posts using content studio
  • Schedule first 2 weeks of posts (3x/week)
  • Begin daily LinkedIn engagement (15 min/day)
  • Finalize IGA product MVP scope (what ships vs. what's post-launch)

Weeks 3–4: Content + First Outbound

  • Publish first blog post: "SOC 2 Access Control Requirements"
  • Continue LinkedIn posting (3x/week)
  • Domain warming complete — launch first cold email campaign
  • Build first Apollo prospect list (50 prospects, SOC 2 trigger campaign)
  • Start LinkedIn direct outreach (20 connection requests/week)
  • Write second blog post: "Identity Governance for Fintechs"
  • Join ISACA + attend first local chapter event if available

Weeks 5–6: Pipeline Building

  • Launch second cold email campaign (scaling past spreadsheet trigger)
  • First discovery calls should be happening by now
  • Continue LinkedIn content + outreach cadence
  • Publish third blog post
  • Refine outreach based on reply data (which subject lines work, which don't)
  • Begin reaching out to SOC 2 auditor firms for partnership conversations
  • Continue IGA product development toward production-ready

Weeks 7–8: First Conversions

  • Send first proposals (Assessment package, $3,500)
  • Launch third cold email campaign (post-incident trigger)
  • Follow up on all open proposals
  • Target: close first Assessment engagement this period
  • IGA product should be nearing production-ready
  • Prepare "Founding Customer" SaaS offer materials
  • Continue content cadence (this is non-negotiable, never skip)

Weeks 9–10: Deliver + SaaS Launch

  • Deliver first Assessment engagement
  • Present findings — upsell to Buildout ($8,500) and/or SaaS pilot
  • Launch IGA SaaS product (sales-led, no public self-serve yet)
  • Pitch Founding Customer offer to assessment clients
  • Begin first SaaS onboarding if customer signs
  • Write first case study (even if anonymized)
  • Continue outbound + content

Weeks 11–12: Scale + Systemize

  • Review what's working: which campaigns, which content, which channels
  • Double down on top-performing channel (kill what isn't working)
  • Publish case study from first client
  • Formalize 1–2 partner referral arrangements
  • Second SaaS customer pitch (aim for 2–3 SaaS customers by end of Q1)
  • Evaluate: are you on track for $100K annualized? If yes, plan full-time transition timeline.
  • Continue content cadence — you should have 36+ LinkedIn posts and 6 blog posts by now

Success Metrics by Week 12

1–2
Consulting Clients
1–2
SaaS Pilot Customers
5–10
Discovery Calls / Month
36+
LinkedIn Posts Published
6
Blog Posts Published
500+
LinkedIn Connections (Net New)

Revenue Projections

How to read revenue projections: These numbers are estimates based on reasonable assumptions about how many clients you can acquire. They are NOT guaranteed — they represent what's achievable if you execute this playbook consistently. The "conservative" scenario assumes things go reasonably well. The "pessimistic" scenario assumes slower-than-expected traction. Both are useful for planning.

"Revenue" vs "Profit": Revenue is the total money that comes in. Profit is what's left after expenses. With your low overhead (~$450–$500/month total), most of your revenue IS profit. For example, if you bring in $100K in revenue and spend $6K on tools/insurance, your profit is ~$94K.

Year 1 Revenue Model (Conservative)

Revenue StreamAssumptionsAnnual Revenue
Assessments 4–6 assessments at $3,500 $14,000–$21,000
Buildouts 2–3 buildout upsells at $8,500 $17,000–$25,500
Retainers 2 clients at $1,500/mo, average 8 months each $24,000
SaaS (Year 1) 3 customers, avg 350 users, Starter at $7.20/user (40% off), avg 6 months $45,360
Total Year 1 $100,360–$115,860

Reality check: This is the optimistic-but-achievable scenario. The pessimistic scenario (2 assessments, 1 buildout, 1 retainer, 1 SaaS customer) produces ~$45K–$55K. Still meaningful side income, and enough to validate the business before going full-time.

Path to $100K — When to Go Full-Time

The Full-Time Decision Framework

You said you'll go full-time when you can reasonably expect $100K/year in profit. Here's what that looks like in concrete terms:

  • Signal 1: You have 2+ active retainer clients ($3,000/mo recurring consulting revenue)
  • Signal 2: You have 2+ SaaS customers generating $5,000+/mo in MRR (Monthly Recurring Revenue — the total subscription money coming in each month)
  • Signal 3: Your pipeline has 3+ qualified leads at any given time
  • Signal 4: Your content is generating inbound leads (people contacting YOU)

When any 3 of these 4 signals are true, you have reasonable confidence in $100K+ annual revenue. At that point, going full-time unlocks 30+ additional hours/week for sales and delivery, which accelerates growth further.

Year 2 Revenue (Full-Time Scenario)

Revenue StreamAssumptionsAnnual Revenue
Consulting8–12 assessments, 4–6 buildouts, 4 retainers$95,000–$145,000
SaaS8–12 customers, growing user base, mix of pricing tiers$120,000–$200,000
Total Year 2$215,000–$345,000

The compounding effect: SaaS revenue compounds. Every customer you retain generates revenue every month forever. By Year 2, SaaS should be your primary revenue source, with consulting as the acquisition channel that feeds it.

Why SaaS revenue "compounds": Unlike consulting (where you finish a project and the revenue stops), SaaS revenue stacks. Customer 1 keeps paying every month. Then Customer 2 signs up and starts paying. Now you have 2x the monthly revenue. Customer 3 signs up. 3x. This is called "compounding" — as long as existing customers don't cancel (low "churn"), every new customer makes your total revenue permanently higher.

Example: In Month 6, you have 2 SaaS customers paying $3,000/mo each = $6,000/mo. In Month 9, you add a third customer = $9,000/mo. By Month 12, you have 4 customers = $12,000/mo. That's $144,000/year in recurring revenue — money that keeps coming even while you sleep. This is why SaaS is the endgame, and consulting is the path to get there.

Master Checklist

Every action item from this playbook in execution order. Check them off as you go.

Week 1–2: Foundation

  • File PA LLC with DOS ($125)
  • Get EIN from IRS (free, same day)
  • Open business bank account
  • Purchase E&O + Cyber Liability insurance
  • Test Stripe invoice flow end-to-end
  • Execute P1–P3 launch readiness (all 10 tasks)
  • Set missing Vercel env vars
  • Buy outreach email domain
  • Set up Instantly.ai + begin domain warming
  • Activate LinkedIn Sales Navigator
  • Set up Apollo.io
  • Batch-write 15 LinkedIn posts
  • Schedule first 2 weeks of LinkedIn posts
  • Begin daily LinkedIn engagement (15 min/day)

Week 3–4: Content + First Outbound

  • Publish blog: "SOC 2 Access Control Requirements"
  • Launch first cold email campaign (SOC 2 trigger)
  • Build first Apollo prospect list (50 prospects)
  • Start LinkedIn direct outreach (20/week)
  • Publish blog: "Identity Governance for Fintechs"
  • Join ISACA + find local chapter

Week 5–6: Pipeline Building

  • Launch second cold email campaign (scaling trigger)
  • Publish third blog post
  • Refine outreach based on reply data
  • Reach out to 3–5 SOC 2 auditor firms
  • Conduct first discovery calls

Week 7–8: First Conversions

  • Send first Assessment proposal(s)
  • Launch third cold email campaign (post-incident)
  • Close first Assessment engagement
  • Prepare Founding Customer SaaS offer materials
  • IGA product production-ready

Week 9–10: Deliver + SaaS Launch

  • Deliver first Assessment
  • Present findings + upsell Buildout and/or SaaS
  • Launch Access Narrative SaaS (sales-led)
  • Pitch Founding Customer offer to first clients
  • Write first case study

Week 11–12: Scale + Systemize

  • Review channel performance — double down on winners
  • Publish case study on website + LinkedIn
  • Formalize 1–2 partner referral arrangements
  • Pitch second SaaS customer
  • Evaluate full-time transition readiness