Cybersecurity paid search case study: How Understory Agency built Doppel a $3.65M pipeline engine

Cybersecurity is one of the harder categories in which to buy paid search. Security buyers share their search terms with students, researchers and job seekers, so much of the query volume was never going to convert. Deals involve several stakeholders, so a form submission that looks like progress in the ad platform can mean very little to sales. Spend goes up, the dashboard gets busier, and pipeline stays flat.

Doppel is a San Francisco company defending organizations against AI-driven social engineering. Rodolfo Yiu joined as Sr Director, Marketing to build the paid program from the ground up. For the first stretch he was the entire program. Spend ran about $45K a month across 2 channels, roughly $15K on Google and $30K on LinkedIn. Leads arrived in bursts, and most of the flow traced back to one OpenAI webinar in December.

Doppel wanted an engine instead. That meant campaign-driven lead flow on a schedule they controlled, and paid support behind the product lines that had none. It also meant scaling spend without cost per lead climbing at the same rate.

Between January and July 2026, Doppel's Google Ads program produced $3,652,185 in influenced pipeline on $504,169 of spend. That is a blended 7.2x, with cost per form down 20% from one quarter to the next. The campaign carrying most of that growth scaled 7.6x in a single quarter and held cost per acquisition at $941 the whole way.

Here is how we built it.

Performance Summary (January to July 2026)

• Google-influenced pipeline: $3,652,185
• Google Ads spend: $504,169
• Blended pipeline to spend: 7.2x
• Cost per form: down 20% quarter on quarter, from $1,673 to $1,334
• Form submissions and influenced opportunities: 378 and 56
• Core campaign scale: 7.6x in one quarter at a flat $941 cost per acquisition

About Doppel

Industry: Cybersecurity, AI social engineering defense

Doppel (LinkedIn) is the platform for social engineering defense, headquartered in San Francisco. The company protects organizations against AI-driven impersonation and social engineering attacks across the channels where those attacks now start, and sells across 4 product lines. Understory Agency has run Doppel's paid search and paid social as a single program since February 2026.

The Challenge

Doppel had 2 problems running at the same time. The first was capacity: Rodolfo Yiu was building and operating the entire paid program single-handed, which caps how much of an account can be tested and rebuilt in any given week. The second was signal. 3 things were structurally wrong. Lead flow traced back to one December webinar. Revenue sat 95% to 99% inside a single product line, and the other lines carried no paid support. The conversion data feeding Google Ads had no CRM lifecycle import behind it, so the platform optimized toward an event sales could not act on.

Rodolfo had worked with Understory Agency at a previous company and hired us again. He gave 3 reasons: B2B SaaS knowledge, cybersecurity fluency with the ICP and the language, and the data layer. By the data layer he meant how Google Ads conversions get configured down to pipeline and MQL definitions. Those nuances take more time to get right than most people expect, and the prior history let Doppel skip the ramp.

The numbers before we began

Understory Agency audits every paid account before touching it. The October 2025 audit of Doppel's account found:

👉 Roughly $45K a month of paid spend, about $15K on Google and $30K on LinkedIn

👉 95% to 99% of revenue from a single product line, with the other lines carrying no paid support

👉 2 channels live, Google and LinkedIn, with LinkedIn running on native targeting only

👉 Messy conversion tracking, with no CRM lifecycle import back into the ad platform

👉 A competitor bidding on Doppel's own trademark, unchallenged

👉 Conversation ads tested before we arrived and never made to work

The Strategy: Fix the conversion signal, then scale the winner

The account we inherited had 16 campaigns named for how it had grown over time. That makes every downstream decision harder, because you cannot read which product line is working, allocate budget by product, or report to a leadership team that thinks in product lines. In May 2026 we consolidated those 16 campaigns into 11 and renamed every one of them to Doppel's own product taxonomy across all 4 product lines. The account took the shape of the business, which is the precondition for everything below it.

Our test for any scale decision is whether efficiency survives the volume. Most accounts decay under it: budget goes up, the algorithm reaches further down the quality curve, and cost per acquisition drifts up alongside it. Doppel's core takedown-services campaign went from $15.8K to $120.5K in a single quarter, a 7.6x increase, and finished at the $941 cost per acquisition it started at. Funding that took discipline somewhere else. Competitor campaigns were consuming 20.7% of Q1 spend, and one of them had produced a single conversion at a cost of $10,485. We cut it, brought competitor allocation down to 4.8% of Q2 spend, and redeployed the difference into the campaigns producing at $941. Choosing what to stop funding is the part of paid media management clients rarely see, and it decides whether a scaled account stays efficient.

Once a US campaign is at scale, the next dollar in that market is the most expensive one available, so we widened the map. The UK launched in May 2026 and became the account's best cost-per-lead geography almost immediately, at $581 against $941 for the US equivalent, producing 3 opportunities worth roughly $226K. Canada followed in July 2026 and recorded its first conversion inside week one.

The most valuable finding of the engagement came out of the reporting layer. Tracing paid form submissions through to Doppel's CRM showed that only 36% of them ever became qualified leads. On one campaign, the submit-to-lead rate fell from roughly 69% to roughly 21% after a bidding change, so about 49 extra form submissions produced about 2 extra qualified leads. An account optimized on form volume takes that trade every time, because more forms look like more progress. We moved Doppel's conversion goal to CRM-qualified leads, so bidding and campaign decisions now optimize toward the outcome sales can actually work. Underneath that, the program widened and the reporting got rebuilt:

• Bing and Reddit went live and Meta went into testing, taking the account from 2 channels to 5.
• Paid social ran at roughly $600,000 of spend, roughly 6 million impressions and 211 leads captured in Q2 FY27, with Reddit at roughly $40,000 delivering the account's lowest cost per click.
• On LinkedIn, message ads beat conversation ads on open rate by 20%, so the budget moved to message ads.
• A purpose-made reporting dashboard now reads from Doppel's data warehouse with per-product and per-experiment views, and sits under every budget decision.

The Results (January to July 2026)

👉 $3,652,185 in Google-influenced pipeline on $504,169 of Google Ads spend, a blended 7.2x pipeline-to-spend ratio

👉 378 form submissions and 56 influenced opportunities from Google Ads, at $1,334 blended cost per form

👉 Cost per form down 20%, from $1,673 in Q1 FY27 to $1,334 in Q2 FY27 (Doppel's own fiscal quarter labels)

👉 Monthly form volume from 31 in April to 68 in June and 101 across July 1 to 21, with July's cost per form at $757

👉 The core takedown-services campaign scaled 7.6x in one quarter, from $15.8K to $120.5K, holding cost per acquisition at $941

👉 The UK entered the account at $581 cost per lead against $941 for the US equivalent, producing 3 opportunities worth roughly $226K

👉 Canada launched July 2026 and converted inside week one

👉 Competitor campaign spend concentrated from 20.7% of Q1 spend to 4.8% in Q2, with the budget redeployed into campaigns that were producing

Key Takeaways

• Get the conversion signal right before the budget goes up. If only 1 in 3 of your form submissions becomes a qualified lead, every extra dollar teaches the algorithm to find more of the wrong buyer. Trace submissions into the CRM and make the real submit-to-qualified rate your conversion goal.
• Efficiency lives in a small number of campaigns. Find the one that holds its cost per acquisition as volume climbs, send the incremental budget there, and hold the line everywhere else.
• Once a domestic campaign is at scale, the next dollar in that market is the most expensive one available. A new geography can usually be tested for a fraction of it.
• Prune on a schedule. Competitor campaigns, brand defense and experimental audiences all earn a place at launch, and some stop earning it by month 3. An account nobody prunes gets more expensive every quarter, and only a reporting layer that reads past the ad platform into the CRM will show it.

What Doppel says

Conclusion

Doppel started with a paid program run by one person across 2 channels. It finished the period on 5 channels, with an account built in the shape of the business and a conversion goal wired to the CRM. 2 new geographies now carry the incremental budget, and a warehouse-fed dashboard sits under every decision. The output was $3,652,185 in Google-influenced pipeline on $504,169 of spend between January and July 2026, with cost per form falling 20% across the scale.

The same problem shows up across post-product-market-fit B2B SaaS. The paid account optimizes toward form fills while sales disputes the lead quality. Cost per acquisition drifts up every time budgets go up. Or the whole program sits with one marketing leader who has run out of hours. Understory Agency runs that program as the team.

Related reading

• Understory Agency paid media, the service line behind this engagement.
• Best B2B SaaS paid media agencies, the buyer's guide to this category.
• Doppel, the platform for social engineering defense.
• Forthcoming in the paid search cluster: RemoFirst, Hiver and Knit.