Cybersecurity paid media case study: What Understory Agency learned about reaching security buyers for Vicarius

Security software is one of the hardest things to advertise. The buyers are skeptical by profession, and a vendor gets disqualified on the wrong word in an ad. Nobody signs up from a click, because these products do not self-serve. The deal that follows runs about 120 days and involves a committee.

Vicarius sells vulnerability remediation, from offices in New York and Tel Aviv. Agnayee Datta was then Director of Marketing, and she was the only demand generation person at the company while also running the marketing team. Paid media was live and it was nobody's full-time job.

What she wanted was continuous attention on the account. She is precise about what that means. Setup is the easy part. The work that decides the outcome is the continuous monitoring, the experimentation, and the shutting down of what is not working.

Understory Agency audited the account in January 2025 and went live that March. The first finding was traffic arriving from LinkedIn's Audience Network, which had been running by default. Understory Agency's own testing measured it at over 99% bounce with zero time on page, and the auditor's note reads "convinced it's all bot traffic". Switching the expansion off produced an immediate end to the spam leads and the wasted spend. From there, Vicarius invested $134,564 across LinkedIn and Google, tested 151 ads against 65 audiences, and ran campaigns in the United States, ANZ, India, Spain, France, Germany, the United Kingdom and Singapore.

Here is how we built it.

Performance Summary (March to September 2025)

• LinkedIn investment: $100,289
• LinkedIn impressions and clicks: 1,672,985 and 21,095, a 1.26% CTR
• LinkedIn CPM and CPC: $59.95 and $4.76
• LinkedIn direct leads and website demo requests: 65 and 17
• Testing volume: 54 campaigns, 65 audiences and 151 ads
• Google Ads: $34,275 across 4 regions, 40 leads and 10 opportunities at an $857 blended cost per acquisition

About Vicarius

Industry: Cybersecurity, vulnerability remediation

Vicarius is a vulnerability remediation company with offices in New York and Tel Aviv, led by CEO Roi Cohen. The product sits with the security teams responsible for finding, prioritizing and patching software vulnerabilities across their environment. Understory Agency has run Vicarius's paid media on LinkedIn and Google since March 2025, across the United States, ANZ, India, Spain, France, Germany, the United Kingdom and Singapore.

The Challenge

Understory Agency inherited the problem that comes with a lean team at a high-growth startup. Agnayee Datta was the only demand generation person and she ran the marketing team at the same time, so the ad accounts got attention in the gaps between everything else. Campaigns can be set up in a week by anyone. Keeping them honest takes somebody looking at them every day, and that was the hour nobody had.

The category made the second problem. Security buyers are skeptical of vendors before a vendor has said anything, so the messaging and the creative carry more weight than they do in most B2B categories. The audience is also hard to reach on any platform. And because these buyers do not self-serve, a lead form only works once the company is already recognized, which puts brand ahead of lead generation in the sequence.

Vicarius had been burned by ad agencies before, as Agnayee describes it, which is the ordinary starting position for a marketing leader at this stage. 2 things decided the hire. The first was social proof, and Agnayee found Understory Agency through founders at her own stage talking about it on LinkedIn. The second was the pricing model. Understory Agency charges custom flat retainers for each service and never a percentage of spend. The agency fee does not climb as the ad budget does, so the annual plan she had already built survived the scale-up.

The numbers before we began

Understory Agency audits every paid account before touching it. The January 2025 audit of Vicarius's accounts found:

👉 LinkedIn's Audience Network running by default, sending traffic that Understory Agency's own testing measured at over 99% bounce with zero time on page. The auditor's note reads "convinced it's all bot traffic"

👉 Spam leads and wasted spend flowing from that same audience expansion

👉 Brand keywords mixed into non-brand campaigns on broad match in Google Ads, so brand demand was being counted as prospecting performance

👉 Search Partners consuming a large share of Google spend

👉 Too many simultaneous conversion actions, which gave the bidding algorithm competing definitions of success

👉 Auto-apply recommendations left switched on, so Google was changing the account without anyone reviewing the changes

👉 1 person covering demand generation and the marketing team, so nothing in the accounts got continuous monitoring

The Strategy: Stop the bleed, then map where security buyers actually convert

Understory Agency stopped the bleed before building anything. Audience Network expansion went off, and the spam leads stopped with it. Conversion tracking and the forms behind it were rebuilt next, because every decision after that point reads from them. A regional map built on a broken conversion signal is worse than no map, since it sends real budget after a number that means nothing.

Then we built the audiences. Native platform targeting is the default answer on LinkedIn and it is the same answer every competitor gets. We asked Vicarius for their closed-won accounts by region and built lookalike audiences from them, so each market was targeted from customers that market had already produced. Every campaign was segmented tightly. When an audience is this hard to reach, a narrow audience with the right message beats a wide one, and the hit rate is the only thing worth optimizing for. Each market got campaigns built for it in its own language and context, which is a different exercise from translating the US campaigns and shipping them.

The geography is the part of this engagement worth reading twice, because almost nobody publishes it. India produced the most leads, then ANZ, then the US, then Spain. France produced 2 direct leads across the whole period and one of them converted to a customer. That is the finding that changes how a budget gets built. Lead volume and deal value do not land in the same countries. A market that looks quiet on a lead report can be the one carrying revenue.

The brand and non-brand split told the same story from another angle. 65% of all Google leads came from branded campaigns. In North America the concentration was sharper still, with 88% of leads coming from brand while non-brand consumed 85% of the budget. In a category where buyers do not self-serve, that is what the demand curve looks like before recognition has been built. The non-brand budget is doing demand creation and the brand budget is collecting it, so the sequence has to be brand first with lead generation layered on top. Reading non-brand as though it were a direct-response line item in that situation is how companies talk themselves out of the only spend that grows the brand campaigns.

The creative testing produced the most transferable finding of the engagement. 151 ads were tested and 1 clear winner emerged, a meme format. The pattern underneath it held across the account. Demo videos featuring Vicarius's own founder cleared 4% CTR, and his personal posts plus document ads cleared 5%. A generic stock GIF managed 0.33%. Security buyers have seen every polished vendor asset ever made and they discount them on sight. A recognizable human being explaining the product is the thing they stop for.

The build, in the order it happened:

• Switched off Audience Network expansion, which ended the spam leads and the wasted spend immediately.
• Rebuilt conversion tracking and the forms, as the foundation everything else reads from.
• Built closed-won lookalike audiences per region, seeded from the customers each market had already produced.
• Segmented every campaign tightly, to maximize hit rate against a hard-to-reach audience.
• Localized by market, with campaigns written for the country they ran in.
• Sequenced brand first, then layered lead generation on top of it.

The Results (March to September 2025)

👉 Audience Network expansion switched off, producing an immediate end to spam leads and wasted spend

👉 $100,289 invested on LinkedIn, returning 1,672,985 impressions and 21,095 clicks at a 1.26% CTR, at a $59.95 CPM and a $4.76 CPC

👉 65 direct leads and 17 website demo requests from LinkedIn

👉 54 campaigns, 65 audiences and 151 ads tested across the period

👉 $34,275 on Google Ads across 4 regions, producing 40 leads and 10 opportunities at an $857 blended cost per acquisition

👉 EMEA and India was the most efficient Google region at $166 per acquisition, with 20 leads and 7 opportunities on $3,319 of spend

👉 65% of all Google leads came from branded campaigns, and in North America 88% of leads came from brand while non-brand consumed 85% of the budget

👉 1 clear creative winner out of 151 ads, with Vicarius's founder in demo videos at 4% CTR and his personal posts plus document ads at 5%, against 0.33% for a generic stock GIF

👉 France produced 2 direct leads and one of them converted to a customer

👉 A deal won from LinkedIn ads in one of Vicarius's strongest markets, reported by Agnayee Datta, who also describes LinkedIn as one of the company's top channels for creating qualified leads

Key Takeaways

• Check placement expansion before you judge anything else in a LinkedIn account. It is switched on by default, it buys cheap clicks from apps and sites outside the feed, and it makes a campaign look busy while the traffic bounces. The placement report answers the question in a minute.
• Read paid media by region and never as one blended number. Volume and value separate by market. The country producing the most leads is often not the country producing the best deals, and a market that produces 2 leads can still produce a customer.
• When most of your leads arrive through branded campaigns, your non-brand budget is doing demand creation. Measure it as demand creation. In categories where buyers do not self-serve, recognition has to exist before a lead form does anything, so brand runs first and lead generation layers on top.
• In a skeptical category, the recognizable human outperforms the polished asset. A founder on camera and a founder's own posts can clear several times the click-through rate of a stock creative. Test the person before you test the production value.

Conclusion

Vicarius started with paid accounts that were quietly buying bot traffic and a marketing leader who had no hours to catch it. Understory Agency switched off the expansion, rebuilt the tracking underneath, and then spent the rest of the engagement finding out where a security buyer can actually be reached. The map that came out of it names the regions that convert, the split between brand and non-brand demand in North America, and the creative format that a skeptical audience stops for.

The hard categories are where paid media expertise is worth paying for. A generalist can run a campaign in a market that self-serves. Enterprise security asks for more than that. The buying group is a committee, the cycle runs months, and the audience discounts advertising on sight. What gets through is a continuously managed account, built market by market, with somebody on it every day. Understory Agency runs that program as the team.

Related reading

• Understory Agency paid media, the service line behind this engagement.
• Best LinkedIn ads agencies for B2B SaaS, the buyer's guide to this category.
• Vicarius, the vulnerability remediation platform.
• Forthcoming in the paid social cluster: Doppel, Northbeam, Hyperbound and RB2B.