Mod 09 · Routes to Market

Ten ways cyber is actually sold.

Cyber GTM isn't just what you sell or who buys. It's also who carries the deal. Ten routes — each with a best-fit category type, a deal-economics reality, and the common mistake that kills the channel before it scales.

Route 01 Direct

Direct Enterprise Sales

Complex / high-ACV / strategic categories where the buyer needs to evaluate architecture and the seller needs to control the narrative.

Open →
Route 02 PLG

Product-Led / Self-Serve

Developer-facing, cloud-native, compliance-light tools where the buyer can evaluate before talking to a human and activate before paying.

Open →
Route 03 MSP

MSP

SMB and lower-mid-market where the buyer trusts their managed IT provider more than any specific vendor. The MSP carries the relationship; you carry the technology.

Open →
Route 04 MSSP

MSSP

Mid-market and lower enterprise where the buyer wants a security outcome but does not want to staff a 24/7 SOC. The MSSP delivers the function on top of your platform.

Open →
Route 05 VAR

VAR / Reseller

Mid-market and enterprise where the buyer already has procurement, paper, and a preferred reseller. The VAR carries fulfillment, not demand creation.

Open →
Route 06 SI

Systems Integrator

Enterprise transformation programs where the security category is one workstream of a larger architecture project (zero trust, cloud migration, identity modernization, M&A integration).

Open →
Route 07 Marketplace

Cloud Marketplace

Buyers with committed cloud spend (AWS EDP, Azure MACC, GCP committed-use) looking to draw down against the commitment. Procurement-friendly, fast contracts.

Open →
Route 08 Co-Sell

Technology Co-Sell

Categories that depend on integration with a platform ecosystem (Microsoft, AWS, Google, CrowdStrike, Palo Alto, Okta). The platform vendor opens doors and validates the architecture.

Open →
Route 09 OEM

OEM / Embedded

Infrastructure or platform adjacency where your product becomes a capability inside another vendor product. The end buyer never sees your brand.

Open →
Route 10 Insurance

Insurance / Advisory Referral

SMB and compliance-triggered buyers where the trigger is a cyber-insurance application, a post-incident IR engagement, or a regulatory audit. The referrer carries urgency and trust.

Open →

The Channel Fit Matrix

Eight common category types × the ten routes. Each cell rates the natural fit between category and route — not whether it can be done, but whether it should be the dominant motion. Cells marked "—" mean the route effectively doesn't fit.

Category DirectPLGMSPMSSPVARSIMktCoSellOEMIns/Adv
MDR
CNAPP
SIEM / SecOps
Identity (IAM/PAM)
AppSec / API
GRC / Compliance
OT Security
Email security
Fit Very high High Med Low —