The Funnel
How a visitor becomes a watched brand. The fold to one front door, the happy path from free scan to firm, the enrichment that earns the subscription, and the paid and non-paid lifecycle that carries it.
One engine. Too many doors. No memory.
Defender already runs a single scan engine. The problem is not the product. It is the shape of the journey around it: two public front doors competing for the same action, and a funnel that forgets you the moment you close the tab.
Two front doors
A polished public scan on the marketing domain and a second, plainer one at the app root. Both post to the same engine. Two skins, one job, competing entry points.
No lifecycle memory
The product sends two emails: a sign-in link and an internal alert to us. The person who just ran a scan and saw real threats receives nothing. No nudge, no proof, no return path.
The app under-earns
Signed in, the experience is activate-watch plus a findings list. There is no reason built in to come back, so the subscription has to justify itself on faith.
Fold the funnel to one front door, give the logged-in surface a reason to be opened weekly, and put a lifecycle behind every email captured. One scan, one path, one memory.
The fold: one job per surface
Principle: the marketing domain is the top of the funnel, the app is the product, and no two surfaces compete for the same action. The engine never changes. Only the doors do.
One scan
The public scan lives only on the marketing domain. One place to maintain copy and brand.
One redirect
The app root collapses to a redirect. The duplicate scan UI is removed. No competing entry point.
One engine
Every scan still posts to the same backend. The fold is UI-only and ships as a small, isolated change.
The happy path
Anonymous visitor to watched brand, in one continuous line. Two moments capture the lifecycle: the email gate on the report, and the checkout.
The email gate (step 5) and checkout (step 8) are where the person becomes known. Everything downstream is lifecycle: nurture before the first hinge, onboarding and retention after the second.
App enrichment: the subscription earns itself
The logged-in surface becomes a living watch console, not a static findings list. Six moves, sequenced so activation and retention come first.
Onboarding checklist
Three steps with a progress ring: activate the watch, confirm coverage, set alert routing (email, Slack, webhook). Drives activation rate.
Threat-surface score
One number over time, with a trend line. "Down two since last week." The reason to log back in.
Watch timeline
A change feed: new lookalike seen, certificate issued, cluster grew, takedown filed. Each item builds an evidence packet in one click.
Evidence packet builder
Status chips from drafting to ready to exported, ending in a counsel-ready PDF. Bulk export is gated to Firm: the moat.
Weekly digest
The retention spine, in email. "Your watch this week: two new, one resolved." Ties directly to E2 and E3.
Reassuring clean state
"Nothing impersonating you right now. Watch is live." When there is nothing to find, the reassurance is the product.
Drip · non-paid nurture
Trigger: an email captured at the scan gate, or a free signup. Goal: the first paid Watch. Stops on purchase or unsubscribe.
| Step | When | Subject | The move |
|---|---|---|---|
| A0 | t+0 | Your impersonation scan: N threats on {brand} | The report link and the headline count. Transactional, sets the hook. |
| A1 | +1 hr | The ones we did not show you | Tease the locked findings with one concrete example: lookalike domain, certificate date. |
| A2 | Day 1 | That domain is not a typo. It is infrastructure. | Teach the diff, the cert, the cluster. Positions Defender as the expert, not a toy. |
| A3 | Day 3 | Lookalikes do not age out. They convert. | The cost of inaction, with one anonymized takedown story. |
| A4 | Day 5 | A scan is a photo. Impersonation is a video. | Sell continuous watch and the evidence packet. Watch is $99/mo per brand. |
| A5 | Day 8 | We re-ran {brand}. Here is what changed. | A fresh scan delta: what is new since the first scan. Proof it moves. |
| A6 | Day 14 | Closing your scan report | The report link is expiring. Last call, with an optional first-month wedge. |
| A7 | Day 30 | The state of impersonation | Drop to a monthly newsletter. Stay warm without selling. |
Drip · paid lifecycle
Trigger: a completed checkout. Goal: activate, deliver the first win, retain, expand. B0 and B4 carry the most weight: activation gates value, and the real-time alert is the moment worth paying for.
| Step | When | Subject | The move |
|---|---|---|---|
| B0 | t+0 | Your watch is on. One step to arm it. | Welcome and receipt. The single CTA is verify your domain by DNS. The most important email in the system. |
| B1 | +1/3/6d | Your watch is paid but not armed | If not activated: a one-step DNS reminder and a two-minute walkthrough. Then a human ping. |
| B2 | on activate | Armed. Here is your baseline threat surface. | The first real value: score, top findings, what we will watch. Sets the recurring-value expectation. |
| B3 | +7d, then weekly | Your watch this week: {new} / {resolved} | The weekly digest. Perpetual. The retention spine. |
| B4 | on event | New impersonator detected: {domain} | Real-time alert with severity and a one-click evidence packet. The worth-paying-for moment. |
| B5 | Day 30 | 30 days of watch: {seen}, {packets} | Value recap and expansion. Add more brands, or move to Firm to unlock bulk export. |
| B6 | renewal | Keep your watch live. | Card-expiring and failed-payment recovery, driven by Stripe. |
| B7 | cancel intent | Turning the watch off leaves N live. | The save: offer a single-brand downgrade before full churn. |
The email spine
Modeled on the proven subscriber backbone: a subscribers table, a send ledger, a deterministic runner, and event triggers. Idempotent by construction, so nothing double-sends.
Three addresses
watch@ for lifecycle. login@ for auth. scan@ stays internal.
Five sources
scan_lead · free_signup · watch · firm · newsletter. The source decides the track.
Verify first
Send to a seed inbox, confirm render, unsubscribe, and ledger entry before the cron is flipped on.
Voice & guardrails
Every email reads as a calm, capable watch. It informs, it never alarms. The tone is the product.
- Lead with the finding and the proof: the diff, the certificate, the cluster.
- Stay institutional and declarative. Report, do not pitch.
- Make one ask per email. One CTA, clearly the next step.
- Use plain hyphens and clean sentences. Read it aloud first.
- Sell on fear or use alarm-red, countdown urgency, or threat theatre.
- Sound like a startup. No exclamation, no growth-hack voice.
- Claim a capability still in development as if it were live.
- Use em-dashes or any machine tell anywhere in the copy.
Live surfaces
The funnel as it stands today, captured live.
Build plan
Five lanes, sequenced. The fold ships first because it is small and isolated. The spine and the tracks follow. App enrichment lands E1 and E2 first because they drive activation and retention.
| Lane | Scope | Status |
|---|---|---|
| 1 | The fold. Collapse the app root to a redirect, remove the duplicate scan UI. Small, isolated, ship first. | Not started |
| 2 | The spine. Migration 0009, the cron runner, event triggers, and the watch@ sender. | Not started |
| 3 | The tracks. Write Track A (A0-A7) and Track B (B0-B7) as templates, copy locked to brand voice. | Not started |
| 4 | App enrichment. E1-E6, with the checklist and the score first. | Not started |
| 5 | Wire triggers. scan-done → A0, gate-capture → Track A, checkout → B0, activation → B2, detection → B4. | Not started |