Prepared for BeyondTrust
Nov 4, 2026 · KlientBoost
Growth Plan ● Paid Search ● Core Security and AI Security

Better pipeline from your 2027 search budget

Your brand campaigns already bid on your Salesforce pipeline. Non-brand, where new buyers search, still learns from lighter actions, and most of your AI campaign's spend reaches people looking up AI tools. This plan brings your pipeline signal to every campaign and runs Core Security and AI Security as two programs from kickoff. Today's ~155 opportunities a month are the baseline every change is tested against.

Where you stand
~155
opportunities a month from paid search, about 1 in 5 closed ones won. Your Salesforce export: the last 14 months and the last quarter alike.
Where you're trying to go
~$1,600
per opportunity on Google and ~$1,000 on Microsoft, on ~$2.7M of paid search in 2027: your team's directional numbers. Microsoft ran about there last quarter (~$990). Google ran ~$1,770, so the job is roughly 10% cheaper Google opportunities.
Our first goal to get you there
Set together
after 30 days live: the first quarterly goal on cost per opportunity and pipeline quality, benchmarked on your last 90 days.

Where You Stand

Your pipeline signal already works where your brand campaigns bid. The opportunity is bringing it to the searches where new buyers start, and to AI Security.

The short version: three problems, three fixes.

The problem
The fix
What's at stake
Non-brand learns from lighter actions.Your brand campaigns record $3,074 of value per conversion, a value only your Salesforce stages carry. Non-brand, where new buyers search, records $69.
Count each lead once, on one pipeline action per goal, and bring non-brand onto it through tests, with click IDs checked form by form.
About $165K a quarter of non-brand Search on the 15-month average, and about 1 in 6 of last quarter's Google opportunities with no click ID.
Brand campaigns buy searches that don't name you.13% of brand-campaign spend went to searches like "ninja one" and "buy rdp", and 13 of your 16 budget-limited campaigns are brand.
Route those searches to campaigns built for them, agreed with you campaign by campaign, with brand budget flat for 90 days.
About $45K a quarter, most of it inside brand campaigns that are limited by budget.
AI Security reaches people buying AI tools.Your AI-Coworker campaign is about 1% of Search, and 63% of it went to searches for the AI tools themselves, with no conversions.
Its own budget line and goals, tool searches paired with governing and securing them, and keywords from your buyers' questions.
About $3.4K in the last 90 days, and every AI Security dollar after launch.

Last 90 days unless labeled. A conversion is whatever Google or Microsoft records: a form, a trial or an imported Salesforce stage. An opportunity is a Salesforce opportunity.

Your readWhat changed on your side this year? Click ID capture dipped with the site move, and Google opportunities dipped to 94 and 106 in June and July before reaching 136 in September.

The full read, when you want it.

What's already working, eight findings across Google and Microsoft, and where quality shows up today. Open any of them.

What's working: the pieces we build on 6

Your pipeline already reaches Google Ads, the account is organized by theater and product, the setup for AI-driven matching is in place, and Microsoft brings more than its share of opportunities. We build on all of it instead of starting over.

GoogleYour Salesforce stages already flow into Google Ads as conversions, and your brand campaigns bid on them.Sets up: the same signal, brought to non-brand. The Foundation Plan, built on the imports you already have.
GoogleThe account is built for a global program: theater, product line and brand or non-brand in the campaign names.Sets up: goals and reporting by theater and product from day one.
GoogleBroad match and AI Max already run in non-brand, the match types Google pairs with the widest range of searches in AI Overviews and AI Mode.Sets up: wider reach, once bidding learns from the right signal.
GoogleYour Remote Support pages convert: 2.7% of clicks on the Remote Support trial page, 3.5% on the product page.Sets up: dedicated page(s) modeled on what already works.
MicrosoftMicrosoft brings about 1 in 5 paid search opportunities on about 1 in 7 search dollars.Sets up: a Microsoft budget that grows with the proven Google winners.
MicrosoftWhen your main NAM brand campaign shows, it's at the top of the page 87% of the time.Sets up: brand defense that already holds, so new effort goes to non-brand.

Google: campaign report (Jul 2025 to Sep 2026), search terms and landing page reports (Jul 27 to Oct 27, 2026). Opportunities: your Salesforce export, Aug 2025 to Sep 2026. Microsoft: campaign report (Aug 2025 to Sep 2026) and search terms (last 90 days). Conversions are as each platform records them.

What's not working, platform by platform 8

Two things hold the program back: what the non-brand and Microsoft campaigns learn from, and which searches the budget buys. Each finding runs in order of impact, and each comes with a question for you, because this is a first read from your exports.

About a third of Google Search spend (34%) runs on searches Google doesn't list, so shares of search terms here are shares of the two thirds it shows.

Google

1Non-brand, where new buyers search, learns from lighter actions than brand does.

The Foundation PlanBlood Work
$3,074
value per recorded conversion on your brand Target CPA campaigns
$69
on your non-brand Maximize Conversions campaigns
97%
of the non-brand spend Google shows runs on Maximize Conversions, last 90 days (Jul 27 to Oct 27, 2026)

Google Ads campaign report, Jul 2025 to Sep 2026 (15 months, the window the export covers): conversion value divided by conversions. In the conversion settings you shared, only your Salesforce stage imports carry values that size. 98% of brand Search spend sits in campaigns above $500 per conversion, against 2% of non-brand.

What it means
  • Brand's bids follow your pipeline. Non-brand's follow whichever of its goals converts cheapest.
  • One lead can count once for every stage it reaches: 23 brand search terms record more conversions than clicks, and one shows 10 conversions on a single click.
  • Which goals each campaign uses is the first thing we confirm with you.
  • The fix keeps your imports: count each lead once, on one pipeline action per goal, then move non-brand onto it through tests.
  • Which goals do your non-brand campaigns bid on today?

2When your site moved, click ID capture fell from about 98% to 79%.

Blood Work
Google paid search opportunities with a click ID
Jan to Apr 2026
98%496 of 508
Jul to Aug 2026
79%175 of 222
Sep 2026
89%121 of 136

Your Salesforce opportunity export, Google media sources, by month created. Microsoft fell too: 98% from January to April, 86% in July and August, 83% in September.

What it means
  • An opportunity without a click ID can't tell Google which search found it, so bidding learns from less of your pipeline.
  • It lines up with the dip in Google opportunities in June and July: 94 and 106, against about 127 a month over the ten months before. Part of that dip may be lost attribution rather than fewer opportunities.
  • Cost per opportunity moved with it: Google ran about $1,560 per opportunity over the last 14 months and about $1,770 last quarter (rough: Search spend over opportunities created).
  • The fix: capture checked form by form after the move, with enhanced conversions as a backup when a click ID is lost.
  • Which forms changed in the June and July site move?

3Your brand campaigns also buy searches that don't name you: 13% of their spend, and 73% in NAM Brand Reach.

N-Gram RefinementThe 4 Conversion Intent Buckets
Share of each campaign's spend on searches that don't name BeyondTrust or a product
NAM Brand Reach
73%$17,075 of $23,248
NAM Brand Core
28%$17,259 of $62,321
All brand campaigns
13%$44,730 of $343,362

Google Ads search terms report, last 90 days (Jul 27 to Oct 27, 2026), searches Google lists. A brand search names BeyondTrust, Bomgar or a product like Password Safe, Entitle or Pathfinder.

What it means
  • Examples from inside the brand campaigns: "fleetdeck", "domotz", "ninja one", "buy rdp", "rmm agent", "jumpcloud alternatives".
  • 13 of the 16 Google campaigns limited by budget at the time of the export are brand campaigns, NAM Brand Top, Core and Reach among them.
  • It runs both ways: about 3 in 10 non-brand dollars matched brand searches.
  • The fix routes those searches to campaigns built for them first, then keeps them out of brand, agreed with you campaign by campaign, with brand budget flat for the first 90 days.
  • What are the Reach campaigns built to do?

4Your biggest PAM campaign shows on about 1 in 5 searches it could, and Google flags it for missing keywords.

Gold Pan TechniqueAll-Star Campaigns
21%
search impression share
16%
top-of-page impression share
Not budget
Google's status at export: missing enough relevant keywords, not limited by budget

Google Ads campaign report, Jul 2025 to Sep 2026: search impression share, search top impression share and status at export for NAM non-brand PAM Top, the PAM campaign with the most spend ($78,819 over 15 months).

What it means
  • The gap looks like coverage of the searches PAM buyers make, more than budget.
  • Top-of-page share on high-intent PAM searches is the first Core Security measure we'd move.
  • The fix builds out the PAM search set by intent, and gives proven searches their own budget.
  • We'll agree with you how products group (Privileged Remote Access, Endpoint Privilege Management, Password Safe) before we report on them.
  • Which PAM searches matter most to your sales team?

5In your AI campaign, about 6 in 10 dollars went to searches for the AI tools themselves.

PPC Temperature CTA Matching
NAM AI-Coworker campaign, share of search spend, last 90 days (Jul 27 to Oct 27, 2026)
Claude AI ad group
63%$3,3840 conversions
Coworkers ad group
30%$1,6074 conversions
Everything else
7%$3631 conversion

Google Ads search terms report, last 90 days (Jul 27 to Oct 27, 2026), mostly before your October 21 launch. Searches that name Claude, ChatGPT, Copilot or Gemini come to the same 63%.

What it means
  • The top searches are "ai claude", "claude for business" and "claude business pricing": people buying the tool, more than people securing it.
  • Under 2% of that spend paired the tool with a security word.
  • Your AI Agent Security product governs tools like Claude Code and Copilot, so tool names belong in the program, paired with the job of governing and securing them.
  • The AI-Coworker campaign is about 1.3% of the Search spend Google lists, so the program has room to grow on its own budget line.
  • What are buyers asking your sales team about AI Security?

Microsoft

1Microsoft records about 34 conversions for every opportunity, and its bidding learns from them.

The Foundation Plan
~34
recorded conversions per paid search opportunity
6,836
conversions on NAM Brand Core alone, about 15 times all Microsoft opportunities
25 of 25
enabled campaigns bid on Maximize Conversions

Microsoft Ads campaign report and your Salesforce opportunity export, Aug 2025 to Sep 2026, the 14 months both cover.

Possible explanations, and how we check
  • A page load or chat counted as a conversion: we check each conversion goal.
  • One visitor counted several times: we check the counting setting on each goal.
  • A tag firing on more pages than intended: we check where each tag fires.
  • Whichever it is, your Salesforce stages go into Microsoft as well, so bidding learns from the same pipeline as Google.
  • Which actions does Microsoft count as conversions today?

2About 88% of Microsoft search spend is brand, and 22% of that went to searches that don't name you.

N-Gram Refinement
Microsoft search spend, last 90 days (Jul 25 to Oct 26, 2026)
Brand campaigns
88%$90,975
Non-brand campaigns
12%$12,969

Microsoft Ads search terms report, Jul 25 to Oct 26, 2026: $19,846 of the $90,975 in brand campaigns. The 14-month campaign report shows about the same split: 86.5% brand.

What it means
  • The same brand question as Google, with the same first move: route those searches first, budget flat for 90 days.
  • The non-brand searches proven on Google move to Microsoft next.

3Non-brand gets about 1 in 8 Microsoft dollars, and only 11 non-brand campaigns spent anything in 14 months.

Gold Pan Technique
$13K
non-brand Microsoft spend in the last 90 days, of $104K
11
non-brand campaigns spent anything over 14 months, $53K between them
1,500
conversions one of them recorded at about $9 each, over 14 months

Microsoft Ads search terms report (Jul 25 to Oct 26, 2026) and campaign report (Aug 2025 to Sep 2026).

What it means
  • Non-brand is where new demand lives, and on Microsoft it barely gets a look.
  • A count that high on that spend says more about what Microsoft counts than about demand, so the signal comes first.
  • Then the non-brand searches proven on Google get their own budget on Microsoft.
Where quality already shows up: PAM content closes at 28%
Win rate of closed opportunities, by the form that created them
PAM content
28%96 opportunities
Contact, demo, chat
22%1,282 opportunities
Privileged Remote Access
20%166 opportunities
Remote Support
18%475 opportunities
Endpoint Privilege Mgmt
18%75 opportunities

Your Salesforce opportunity export, Google and Microsoft, Aug 2025 to Sep 2026: closed won as a share of closed opportunities, grouped by the form each one came from. The groups are our read of your form names, and recent opportunities are still open.

A starting definition of quality, for your team to change
  • A quality search opportunity reaches a later stage or closes, read by product line and theater.
  • PAM content closes best. Remote Support brings the most volume of any product form and closes a little under the average of about 1 in 5.
  • Password Safe, Entitle and AI Security are too few to read yet.
  • Counts only: a few large deals swing the amounts.
  • How does your team define a quality opportunity from search?

The Plan

Two programs on one pipeline signal, running together from kickoff. Live campaigns keep improving while the signal gets fixed underneath.

The plan in one minute.

Bring your pipeline signal to every campaign, and run Core Security and AI Security as separate programs with their own budgets, goals and reporting. Three parts, running together from kickoff:

1

Bring your pipeline signal to non-brand.

Each lead counted once, on one pipeline action per goal. Non-brand moves onto it through tests, with click IDs checked form by form.

The Foundation PlanBlood Work
2

Protect and grow PAM search.

Brand campaigns hold brand searches, PAM coverage gets built out by intent, and proven searches get protected budget.

The 4 Conversion Intent BucketsN-Gram RefinementGold Pan TechniqueAll-Star Campaigns
3

Build AI Security search from what buyers ask.

Its own budget line from day one, keywords and ads from your buyers' questions, and tool searches paired with security intent.

PPC Temperature CTA MatchingThe Lift Lab

How each part works.

1

Bring your pipeline signal to non-brand.

What we do
The Foundation Plan starts from the imports you already have: one pipeline action per goal, so each lead counts once, then non-brand moves onto it through tests. Blood Work checks click ID capture form by form after the site move, with enhanced conversions as a backup.
What changes in the account
Non-brand bids toward pipeline instead of lighter actions. Microsoft gets your Salesforce stages too, consent is checked in each EU market, and one UTM structure runs across campaigns.
How you'll see it
Click ID capture back toward its level before the move, and pipeline by campaign and theater on every reporting call.
More on this part
  • Brand's current bidding stays as it is through the handover.
  • Closed won feeds reporting and budget decisions. Bidding learns from earlier stages that land inside Google's 90-day window.
  • Stage values come once the counting is clean, and enhanced conversions go in with your privacy team's sign-off.
2

Protect and grow PAM search.

What we do
Brand campaigns hold brand searches, with brand budget flat for the first 90 days. The 4 Conversion Intent Buckets sorts non-brand by intent, N-Gram Refinement finds the words that pay off and the ones that don't, and Gold Pan Technique and All-Star Campaigns give proven searches their own budget.
What changes in the account
Searches that don't name BeyondTrust move out of brand into campaigns built for them, agreed with you campaign by campaign. The PAM search set gets built out by intent. Bidding changes run as tests on non-brand first.
How you'll see it
Top-of-page share on high-intent PAM searches, and non-brand opportunities by product line and theater.
More on this part
  • Goals and reporting by theater: NAM, EMEA, APAC and LATAM.
  • We'll agree with you how your products group before we report on them.
  • Budget steers toward the product lines that close, once we agree what quality looks like.
3

Build AI Security search from what buyers ask.

What we do
Its own budget line, goals and reporting from kickoff. The questions buyers ask your sales team become the keywords and ads, and PPC Temperature CTA Matching gives each search the right next step.
What changes in the account
Searches naming Claude, Copilot and other AI tools get paired with governing and securing them. YouTube stays on, measured with The Lift Lab so views tie back to search and pipeline. Dedicated page(s) come with CRO or your web team.
How you'll see it
AI Security opportunities as their own line, read on early signals first while volume builds.
More on this part
  • As your talk tracks evolve, the keywords and ads follow them.
  • Its scorecard starts with searches, clicks and form starts, then opportunities as they build.

Bidding and budget changes roll out only after they beat your baseline.

Tests before rolloutsBidding changes run on part of the traffic first, read against your pipeline, with a rollback trigger agreed before launch.
Brand budget flat for 90 daysThe first brand move is routing searches to the right campaigns, agreed with you campaign by campaign.
Two programs, two scorecardsCore Security and AI Security each get their own budget line, goals and reporting.
A brand holdout, when you want oneShows what brand search adds, once results are in.The Black Mirror Test

Expect some relearning when a signal changes. That's why changes reach part of the traffic first, and why the baseline is today's ~155 opportunities a month.

Your readWhat should trigger a rollback: a drop in SQLs, in opportunities, or both?

What we keep from today.

  • Your Salesforce imports, and brand's current bidding through the handover
  • The theater and product structure in your campaign names
  • Your converting Remote Support and Privileged Remote Access pages
  • Your YouTube program, now measured against search and pipeline

Where search is going, and how this plan connects to it.

Now

Paid search

Google and Microsoft, on one pipeline signal. This plan.

After the signal is fixed

Ads inside AI answers

Google already places search ads in AI Overviews and AI Mode, in English in the US and a few other markets, and Microsoft is piloting them in Copilot. They learn from the same signal, so they follow it. ChatGPT ads come later, as a true test.

With your web team

Showing up in the answer

AI search visibility for PAM and AI security, worked with your brand and web team and led by our Director of SEO. Whoever runs organic, we share our search term and conversion data so both channels learn from the same signal.

Organic search and the site sit with your brand and web team, so that piece gets scoped with them, on its own.

Roadmap

Built around your January switch: a read-only review before kickoff, then both programs from day one.

The path to your January switch.

From your team
From ours
Your read on these findings, and how you define a quality opportunity
This plan, corrected with your read
Budget and goals by program, as 2027 planning settles
Options priced to your budget
Coupa and your security review
The answers your security review needs
Read-only access, and who owns the manager account and the Salesforce import
A read-only review while your current partner still runs the accounts

The handover is planned so your live campaigns keep running. From your current partner, we'd ask for the ad and test history, change logs, negative keyword lists, audiences, conversion definitions and scripts.

Your readWho owns the manager account and the Salesforce import today?

The roadmap, phase by phase.

Phases count from kickoff. Our team schedules the kickoff once the agreement is signed. Between signing and kickoff, we get access to every account and re-run the math against your real data before we spend a dollar. Nothing changes in your accounts before kickoff.

Before kickoffAccess and read-only review
MeasurementRead-only access, every conversion action and campaign goal inventoried, and click ID capture checked form by form.
Core SecurityA read of brand, non-brand and each theater.
AI SecurityYour sales-call questions and current talk tracks.
YouTubeAccess to YouTube and your current video ads.
Pages + CROA read of your /sem/ pages, with your web team.
Done by the endThe math re-run against your real data, with each finding here confirmed or overturned.
First 30 daysPhase 1 · One signal, and the cleanup
MeasurementOne pipeline action per goal, the first non-brand tests, enhanced conversions with your privacy team's sign-off, and your stages into Microsoft.
Core SecuritySearches that don't name BeyondTrust routed out of brand, agreed campaign by campaign, with brand budget flat.
AI SecurityIts own budget line and goals, keywords and ads from buyer questions, and tool searches paired with security intent.
YouTubeCampaigns carried over as they run today.
Pages + CROEvery ad pointed at the best page you have today.
Done by the endEach lead counted once, and the first non-brand tests running.
Days 31 to 90Phase 2 · Tests and reinvestmentThe first quarterly goal, set together.
MeasurementTests read against your baseline, one UTM structure, and stage values once the counting is clean.
Core SecurityPAM coverage built out by intent, and budget moved to the non-brand searches that convert.
AI SecurityWith CRO or your web team, the first dedicated page(s).
YouTubeThe lift study designed and live.
Pages + CROWith CRO: dedicated page(s) live, and testing starts.
Done by the endThe first quarterly goal set together, and the first tests read.
Each quarter afterPhase 3 · Scale what wins
MeasurementPipeline by campaign and theater on every reporting call.
Core SecurityProven searches in All-Star Campaigns, and Microsoft mirroring the Google winners.
AI SecurityAds inside AI answers tested, once the signal is clean.
YouTubeBudget follows what the lift shows.
Pages + CROWith CRO: testing continues, and every winner stays.
Done by the endEach goal hit sets the next one, through the Growth Grid.

YouTube runs on the options that include it. Pages + CRO cells marked With CRO run on the option that includes CRO.

How We Work

Who runs your program, how we report on it, and how we measure progress together.

Who's behind your program.

Your dedicated growth team

Growth ManagerPaid search leadRuns your account and works with your team directly
Growth DirectorOversightOversees your account and the team behind it
Business IntelligenceOur BI teamYour tracking, imports and the Salesforce connection
CRO StrategistWith CROYour dedicated page(s) and tests

Your strategist team

Austin SpikesEnterprise Growth StrategistThis plan and the partnership
JD GarciaVP of GrowthThis plan and the partnership

You talk to the people doing the work, with no game of telephone.

Your Growth Grid

A chart of your goals against time, reviewed on every performance call.

The first goal is set together after 30 days live, then each quarter. Each goal hit sets the next one.

Illustrative Growth Grid: goal progress (KPI %) tracked against time elapsed (Time %) across a quarter, with notes on KPI % vs Time %, True Performance, and Goals Hit = Time To Scale
Swipe sideways to read the full chart.Illustrative example of a Growth Grid. Yours tracks the goals we set together.

What we measure, program by program.

MeasurementEach lead counted once, click ID capture back toward its level before the move, and pipeline by campaign.
Core SecurityTop-of-page share on high-intent PAM searches, and non-brand opportunities by product line and theater.
AI SecurityEarly signals first, then AI Security opportunities as their own line, and lift from YouTube.
Pipeline qualityThe share of opportunities that reach later stages and close, quarter over quarter.

How we work together.

  • A dedicated reporting dashboard
  • A dedicated Slack channel, and email
  • A dedicated project our team manages your work in
  • More frequent communication while we take over your accounts, validate these findings, recommend immediate changes, improve your live campaigns and build new ones where they fit, then regular reporting calls after

Your readWho on your team should be on the reporting calls?

Investment

Three ways to start, each a step up. Every option runs both programs on one pipeline signal.

Three options. We recommend the middle one.

Search first

Paid Search

Google and Microsoft, with Core Security and AI Security as separate programs on one pipeline signal.

  • Google and Microsoft management
  • Your Salesforce stages kept clean as the bidding signal
  • Goals and reporting by program and theater
  • Reporting dashboard and Growth Grid reviews
Our recommendation

Paid Search + YouTube

Everything in Paid Search, plus YouTube measured with a lift study: the video program you already run, tied to search and pipeline, under one team at the switch.

  • Everything in Paid Search, plus:
  • YouTube management
  • A lift study that ties views to search and pipeline
Pages and testing

Paid Search + YouTube + CRO

Everything in Paid Search + YouTube, plus dedicated page(s) built around your primary conversion.

Your /sem/ landing pages took $115K and 10,643 clicks in the last 90 days, enough traffic to carry a real testing program.

  • Everything in Paid Search + YouTube, plus:
  • Dedicated page(s) for Core Security and AI Security
  • Variant testing, with page insights inside it
  • New pages as results direct, decided with you
  • Built with your web team
One time, at the startMeasurement buildYour Salesforce stages into Microsoft Ads, enhanced conversions on Google, click ID capture checked form by form, and one UTM structure across campaigns. Scoped with your team before launch.

Each option gets priced to your 2027 budget after this call. No setup fee.

Growth levers, down the road.

Ready to add once performance thresholds are met and there's Room to Grow.

ChatGPT adsA true test once the signal is in place, with its own budget and goal.
A brand holdoutWhen you want to know what brand search adds.The Black Mirror Test
AI search visibilityShowing up in AI answers for PAM and AI security, scoped with your brand and web team.
Creative from the same teamNew video and static ads for YouTube and beyond, custom scoped.
Next step

Your read on this plan, then each option priced to your 2027 budget. Our team schedules the kickoff once the agreement is signed.