Win/Loss Analysis - Q1

Yeah I've been wanting to have this conversation for a few weeks. I pulled the closed-lost records going back to January and the pattern is not great.

Sure. So in Q1 we had — I'm looking at my sheet here — 34 closed-lost opportunities with a total combined ACV of around 2.1 million. Of those, 22 had a named competitor as the reason or it was noted in the loss notes. SentinelShield shows up the most, 9 times. VaultEdge was 6. CyberNova was 4. The rest were kind of scattered.

SentinelShield nine times. That's — that's a lot. Do we know what specifically they were winning on?

That's the frustrating part. The loss notes are inconsistent. Some AEs write paragraphs, some write 'went with competitor' and that's it. But from the ones that had detail, the recurring themes were pricing, and — this is the one that stings — reliability concerns post the March outage.

How many of the Q1 losses do we think are directly attributable to the outage versus just timing? Like Q1 was already in progress when the outage happened on March 10th.

It's hard to isolate cleanly, but deals that were in late-stage negotiation in mid-March — I counted at least five that slipped or went cold right around that window. And two of them explicitly cited it in the loss notes. One prospect said, and I'm quoting from the notes here, 'we can't afford six hours of no threat visibility in our environment.'

That's fair feedback though, right? Like I'm not going to sit here and say that's unfair. Six hours was bad. The cascading failure in the event ingestion pipeline — that should never have gotten to that point.

And to be clear, the fix is in place. The redundant processing nodes are live, we've got the circuit breaker pattern deployed. But the optics problem is that prospects don't know that unless we tell them and apparently we're not always telling them effectively.

That's actually something I want to flag — do we have a leave-behind or a one-pager that specifically addresses the March incident and what we did to fix it? Because I don't have one and I've been kind of winging it in conversations.

We don't. And that's a gap. Like we put out a postmortem internally and we sent customer comms but there's nothing packaged for sales conversations.

Okay, that's an action item, let's flag that. Someone needs to own a one-pager on the Detect outage resolution. Kevin, can you work with product on that?

Yeah I can do that. I'll pull in the postmortem details and frame it as a 'here's what happened, here's what we did, here's why it won't happen again' kind of thing. Should be pretty straightforward.

VaultEdge is mostly showing up in deals where Protect is the primary use case. They're undercutting us on backup pricing pretty aggressively and a couple of the notes mention their recovery time benchmarks. Apparently they're claiming sub-15-minute RTO in their pitch and we're not matching that claim in conversations.

Are their RTO numbers even real? Like has anyone done a head-to-head on that?

That's exactly what I want to know. And I don't have a good answer. We need competitive testing data or at least a way to challenge those claims in the room. Right now when a prospect brings up VaultEdge's RTO numbers we're kind of just... nodding.

That's a problem. We should not be nodding. We need either our own benchmarks or a way to reframe the conversation around total recovery workflow, not just raw RTO. Because point-in-time recovery, data integrity validation — those are things we do well and VaultEdge's pitch glosses over.

Agreed, but it's hard to reframe in the moment when the prospect already has a datasheet in front of them. We need that collateral to exist before the call happens.

Yeah, I hear that. Okay let's talk about Comply for a second because that's actually — I think that's a potential bright spot even if Q1 was rough. Comply v2 just launched on April 7th and I'm curious if anyone's already seeing it move the needle in conversations.

It's too early to show up in win data obviously, but I've had three demos in the last two weeks where on-demand SOC 2 and HIPAA reporting was like, the thing that got the prospect excited. One of them literally said 'okay this is the first time I've actually wanted to stay on a compliance demo.'

There's also something I want to bring up that's a little uncomfortable — I think some of the Q1 losses are partially on us, meaning Customer Success. There are a couple accounts where I think we didn't stay close enough during the evaluation and competitors got more face time. That's on me to fix but I wanted to name it.

Okay so we have a few themes here. Reliability perception from the March Detect outage, lack of competitive collateral especially against VaultEdge on Protect, and some execution gaps on our side. Does that feel like a fair summary?

I'd add one more — loss note quality. If we can't consistently capture why we're losing, we can't fix it. The data I pulled was useful but it's incomplete and that means we're probably missing patterns.

Yeah that's been a chronic problem. I've brought it up in sales meetings before and it just doesn't stick. Maybe it needs to come from leadership more forcefully.

I'll take that one. I'll talk to the VP of Sales about making loss notes a required field with a minimum character count or something. It's not a technical problem, it's a process problem.

Good. Okay so action items — Kevin owns the Detect outage one-pager, we need someone to own a competitive brief on VaultEdge and Protect specifically, Raj you're talking to VP Sales about loss note quality, and I guess I need to tighten up the engagement model for late-stage evaluations.

I can take the VaultEdge competitive brief. I've been doing some informal research anyway and I'd rather have something formal to point to.

Perfect. Can we aim to have drafts of both the one-pager and the competitive brief by end of next week? That gives us something to work with before we're too deep into Q2.

End of next week is tight but yeah, I think doable. I'll block time for it.