Studio C60 · SPP · Three Stages of the Qualifier Build BUILD 2026-05-14 · D

What ships now, what comes next, where it could go.

The qualifier system is designed to grow in three stages. Each stage is independently useful — the simple version ships first and answers the core question (who is this visitor and where should we send them). Later stages add depth without rebuilding the foundation. Click between the three stages below to see how each one works and what gets built.

Reviewing this doc? This is a working draft of the SPP qualifier strategy — read through it and let us know what's working, what's missing, and what needs sharpening. We'll be in touch when there's something interactive to test against.

STAGE 01 · THE MINIMUM USEFUL VERSION

A visitor lands, gets typed in three questions, lands on the right page, books a meeting.

Everything in this stage is select-based — no free-text inputs anywhere. The five typology pages render statically, with the same content for every visitor of that type. The system tags the visitor in HubSpot and hands off to sales. That's the whole flow.

Pages built
11 incl. 5 typology
Visitor inputs
Select only · no free-text
Endpoint
Booked meeting · HubSpot
Visitor lands on homepage DIRECT · SEARCH · REFERRAL · CAMPAIGN Three-question qualifier Q1. Where are you in this? Q2. What does your day actually look like? Q3. What does success look like in 90 days? ALL SELECT-BASED · NO FREE-TEXT INPUTS Confirmation card "Here's what we heard. Does this sound like you?" [ Yes, that's me ] [ Not quite — reselect ] YES ✓ RESELECT ↻ Visitor lands on one of five typology pages internally tagged Type 3–7 · never visible to visitor · same skeleton, different content Jump to Type 3 details below Type 3 "Considering a new market" CTA → ROI Workshop Jump to Type 4 details below Type 4 "Checking the path you're on" CTA → How We Work Jump to Type 5 details below Type 5 "Restarting a stalled program" CTA → ROI Workshop Jump to Type 6 details below Type 6 "Finding the right partner" CTA → Direct conv. Jump to Type 7 details below Type 7 "Handing it off to a partner" CTA → Direct conv. START A CONVERSATION Meeting request — booked TYPOLOGY TAGGED IN HUBSPOT · SALES HANDOFF

Builds in scope

  • Homepage — recoded with new hero, brand statement, qualifier block, paths, proof points, video, blog preview, events teaser
  • Three-question qualifier as a custom HTML/JS module embedded on the homepage
  • Confirmation card — conditional rendering based on which answers the visitor selected
  • Five typology pages — one template, five content variations, static rendering per visitor
  • Adjacent-type links on each typology page — static cross-navigation
  • Universal "Start a Conversation" CTA on every page
  • How We Work, Solutions, Who We Are, Insights, ROI Workshop — all refreshed or built to match
  • Events Calendar — dynamic event rendering in main nav
  • Partner Portal — minimal landing page, footer link only
  • HubSpot integration — form capture, typology tag, lead routing to sales

Deliberately not built yet

  • No free-text inputs anywhere — qualifier, confirmation card, or typology pages
  • No re-rendering of typology pages based on visitor words
  • No recalibration counter or state tracking
  • No terminal "this is a conversation, not a webpage" handoff
  • No 90-second inactivity prompt
  • No Type 7 fast-track logic
  • No campaign ID parsing — campaigns can still link to pages, but tagging happens via UTMs in HubSpot
  • No cold-landing backfill mini-qualifier
  • No separate submissions log — standard HubSpot capture only
  • No AI-generated content or dynamic page generation
  • No returning-visitor recognition
STAGE 02 · CARRY-THROUGH CONVERSATION

Visitors can refine in their own words. The system listens, sharpens the page, and knows when to stop trying and offer a person instead.

Stage 2 builds on the same foundation Stage 1 lays. Free-text appears at the points where it adds the most value — refining the read on the homepage, sharpening a typology page in the visitor's own words, or moving sideways to a different situation with context carried forward. After two rounds of refinement, the system hands off to a real conversation with the accumulated context as the meeting brief.

Visitor inputs
Select + free-text · at refinement points
State tracking
S0 → S1 → S2 · counter
Endpoint
Booked meeting · w/ accumulated context
FROM STAGE 1 NEW IN STAGE 2 Visitor lands on homepage + CAMPAIGN ID PARSING Three-question qualifier Q1 · Q2 · Q3 — same select questions Plus: cold-landing backfill on direct typology-page entry + MINI-QUALIFIER FOR COLD LANDINGS Confirmation card "Here's what we heard. Does this sound like you?" [ Yes ] [ Close, but not quite ] [ Not really ] + FREE-TEXT ON "CLOSE, BUT NOT QUITE" YES ✓ REFINE ⟳ RESET Typology page (1 of 5) opener now inflected with visitor's free-text → Reassurance opener (dynamic) → What we typically see → The risk we watch for → What we'd discuss with you → Maybe this isn't you + "Tell us what's different" free-text field surfaces here "Let's discuss [dynamic X]" CTA Event A — Stay & refine Page re-renders in place with the visitor's own words COUNTER +1 · SAME PAGE Event B — Move sideways Visitor picks adjacent type Context carries to new page COUNTER +1 · NEW PAGE RECALIBRATION CAP: 2 REFINEMENTS · THEN TERMINAL Terminal handoff "At this point, this is a conversation, not a webpage." Accumulated context becomes the meeting brief + 90-SEC INACTIVITY PROMPT · TYPE 7 FAST-TRACK CTA Meeting request — booked, with full context Pre-filled with everything the visitor told us SITUATION · FLAGS · GOAL · FREE-TEXT · RECALIBRATION HISTORY Captured · No data lost 1. HubSpot contact Known leads · qualifier tags 2. Submissions log + NEW Every interaction · incl. anonymous 3. Web analytics Funnel · drop-off · conversion THREE LAYERS · ONE SOURCE OF TRUTH WHAT'S NEW IN STAGE 2 Free-text refinement, the two-event recalibration model, the terminal handoff, campaign ID parsing, the cold-landing backfill, and the parallel submissions log.

Carried forward from Stage 1

  • Three-question qualifier on the homepage
  • Confirmation card with the four-part structure
  • Five typology pages with the shared skeleton
  • Universal "Start a Conversation" CTA
  • HubSpot contact tagging and lead routing
  • Standard meeting booking flow

New in this stage

  • Free-text on "Close, but not quite" — visitor tells us in their words what's different about their situation
  • "Tell us what's different" field on every typology page — refinement happens after they've read the page
  • Event A (Stay & refine) — page re-renders with the visitor's own language inflected into the opener and bullets
  • Event B (Move sideways) — visitor jumps to an adjacent typology, full context carries forward
  • Recalibration counter — S0 → S1 → S2, then terminal handoff
  • Terminal "this is a conversation, not a webpage" module with accumulated context as the meeting brief
  • 90-second inactivity prompt — soft exit ramp for visitors who stall mid-journey
  • Type 7 fast-track — Experts skip the recalibration loop entirely
  • Cold-landing mini-qualifier — backfill prompt when a visitor arrives directly on a typology page
  • Campaign ID parsing — campaign links pre-render pages with declared typology and flags
  • Airtable submissions log — every interaction captured, including anonymous visitors
STAGE 03 · INTELLIGENT & ADAPTIVE

The qualifier reads natural language. Pages generate dynamically. The site recognizes returning visitors and connects what it knows to what they're saying now.

Stage 3 is where the system stops being a static set of pages and starts being a thinking layer. The visitor can describe their situation in their own words from the start. The system generates a tailored page for them. Returning visitors get continuity. Insights content surfaces contextually. None of this replaces human connection — it earns it sooner.

Visitor inputs
Full natural language · qualifier becomes a conversation
Page rendering
Dynamically generated · per visitor
Memory
Returning-visitor recognition · cross-session continuity
FROM STAGES 1 & 2 NEW IN STAGE 3 — INTELLIGENCE LAYER Visitor lands on homepage RECOGNIZED IF RETURNING Returning-visitor lookup "Welcome back — pick up where you left off?" Natural-language qualifier "Tell us what you're dealing with." _____________________________________________ AI READS · IDENTIFIES TYPOLOGY · INFERS FLAGS Dynamically generated page written for this visitor, in their context → Opener written to mirror their language exactly → Pattern-matched to closest typology — but shaped to their wording → Risk framing pulled from SPP's knowledge base, applied to their situation → Insights/blog content surfaced contextually — relevant first → Questions for the conversation tailored to what they said "Let's discuss [bespoke language matched to their situation]" SPP knowledge base Typology framework 5 patterns · refined over time Risk patterns By framework, by industry Real client situations Anonymized · informs pattern recognition Voice & tone guide SPP brand voice · enforced on output CURATED · HUMAN-AUTHORED · NOT TRAINED ON RANDOMNESS Refinement continues as before Same Event A / Event B model from Stage 2 Same recalibration cap, same terminal handoff BUT NOW WORKING ON DYNAMIC PAGES, NOT STATIC ONES Meeting request — with rich, multi-layered context SPP arrives at the call already knowing the visitor's history, language, and likely needs CURRENT SITUATION · PRIOR SESSIONS · CAMPAIGN HISTORY · PREDICTED FRAMEWORK Contextual content matching → Insights filtered by typology Type 4 sees redirect content first → Solutions cross-linked CMMC visitor → CMMC deep page → Event invitations tailored Right event for their situation → Newsletter and follow-up Sequenced to where they actually are THE WHOLE SITE BECOMES PERSONALIZED THE PRINCIPLE AI is the engine, not the personality. The brand voice stays human. The system uses intelligence to read the visitor faster — so the conversation with SPP starts at a higher altitude.

Carried forward from Stages 1 & 2

  • Three-question qualifier as a fallback or alternative input mode
  • Five typology framework — still the underlying structure
  • Confirmation, refinement, recalibration, terminal handoff mechanics
  • Universal CTA and meeting booking flow
  • HubSpot integration, Airtable log, web analytics

New in this stage

  • Natural-language qualifier — visitor types what they're dealing with, AI identifies the closest typology
  • Dynamically generated typology pages — opener, bullets, risk framing, and CTA all written for this specific visitor
  • Curated knowledge base — SPP voice, typology patterns, risk content, anonymized real-world situations feed the generation
  • Returning-visitor recognition — HubSpot lookup at landing surfaces a "pick up where you left off?" prompt
  • Insights filtered by typology — a Type 4 visitor sees redirect-relevant content surfaced first on the blog
  • Solutions cross-linked contextually — visitor with CMMC signals gets CMMC content surfaced from the right typology page
  • Event invitations tailored — the right SPP event surfaced for the visitor's situation
  • Newsletter and follow-up sequenced to typology — automation matches the message to where they are
  • Cross-session continuity — the system remembers prior visits and builds on them
  • Predictive lead scoring — typology drift, intent signals, and engagement patterns inform sales
§ The Question Architecture · What We Ask And Why

The same questions do three jobs — route, confirm, and set the agenda.

The qualifier on the homepage isn't a survey — it's a conversation starter that earns its keep three times over. The same questions that route a visitor to the right page (1) also let them confirm or correct that read on the page itself (2) and then become the agenda for the call they book (3). This section breaks down the working question bank we'll build from, with each option mapped to the typology it points to. Overlap is expected and welcome — visitors don't fit cleanly into one bucket, and the qualifier should respect that.

Terminology, locked.

Three terms have been used loosely until now. Locking them in so this document and the build that follows are consistent.

TypeINTERNAL ONLY
The internal classification — Type 3, 4, 5, 6, 7. Lives in HubSpot tags and SPP's working vocabulary. Never appears anywhere a visitor can see it: not in URLs, page titles, adjacent links, breadcrumbs, or analytics labels. Sales and Marketing use Type to talk about visitors with each other.
"This lead is a strong Type 5 with the triage flag — pull Jason in."
SituationVISITOR-FACING
The visitor-facing framing of a Type. The URL slug, the page title, the way it's described in copy. Always written as something visitors recognize themselves in — never as a label, never as a category. There's one situation per type.
"You started this. Let's get it moving again." → /situation/restarting-a-program/
ScenarioCONTEXTUAL
A specific instance within a Situation. Type 5's situation is "restarting a program." Scenarios within it include "3PAO collapsed mid-engagement," "team lead departed," "vendor over-engineered the original scope." Scenarios are what Stage 2 inflects with and what Stage 3 generates against.
"Our 3PAO went out of business halfway through CMMC L2." → Type 5, Vendor-collapse scenario

The same question earns its keep three times.

Every question in the bank does three jobs in three different contexts. Designing them with all three in mind keeps the architecture tight and the language consistent from homepage to typology page to meeting invite.

CONTEXT 01 · ROUTING

On the homepage qualifier

The visitor sees the question with options. Their selections determine which situation page they land on. Answers also become the first row of context attached to their HubSpot contact and (Stage 2+) the seed for the inflected page they'll see.

Example: "Where are you in this?" with five state options. Visitor picks one, sees a confirmation, lands on the matching situation page.
CONTEXT 02 · CONFIRMATION

On the situation page (as a clarifier)

Same question, rephrased as a self-check. The visitor reads the page and asks themselves: does this fit? The clarifier statements are the same answer options written in visitor voice ("Actually, we already have a contract..."). Selecting one routes them to a different situation with their context carried over.

Example: Type 3 page shows "Actually we already have a contract on the line" — clicking carries their original input forward to the Type 4 page.
CONTEXT 03 · AGENDA

In the meeting invite + opening minutes

The same questions become the agenda for the booked call. The meeting invite reads "We'll review where you are, what's on your plate right now, and what success looks like in 90 days" — a direct echo of Q1/Q2/Q3. SPP arrives knowing what the visitor said, so the conversation starts at minute one, not minute fifteen.

Example: "Per your inputs, we'll cover restarting your CMMC program after the 3PAO collapse, addressing the partial-evidence portability question, and aligning on what back on track in 90 days means for your team."

How the questions are designed.

Three question styles, each used where it earns the most signal

Q1 — State (single-select). Where the visitor is in the journey. One answer is most-true; force a choice. This is the primary routing signal.

Q2 — Signals (multi-select). What's actively happening for them. Many can be true at once; let visitors pick all that apply. Each selection is a flag, not a route. Flags refine the page they land on and inform conversation framing.

Q3 — Outcome (single-select, goal-oriented). What "good" looks like in 90 days. Aspirational framing. Forces the visitor to articulate what they actually want — which makes the meeting invite write itself.

Overlap is a feature, not a bug

Real visitors don't fit one Type cleanly. A CISO restarting a stalled program who also has board pressure to optimize cost is partly Type 5 and partly Type 6. The qualifier should produce a strongest match, not a forced classification — and the situation page should make the secondary path easy to take if it fits better.

The matrices below show ● for primary route (this answer strongly suggests this Type) and ○ for secondary route (this answer is consistent with this Type, especially in combination with other answers). Flags refine without routing.

What we're avoiding

  • Yes/no questions. Force binary choices on things that aren't binary. Weak signal, easy to misread.
  • Compliance-jargon questions. Anything that asks "what level of CMMC are you targeting?" assumes the visitor knows — which Type 3 visitors don't, and Type 6 visitors find condescending.
  • "How urgent is this on a scale of 1–10?" Subjective scales without anchors mean nothing. Better: "what's the deadline that's actually driving this?"
  • Trick questions. Anything where the visitor feels graded. They're not.
Q 01 SINGLE-SELECT · STATE · PRIMARY ROUTING

"Where are you in this?"

Intent: Establish the visitor's current state. One option will be most-true. The answer drives the situation page they land on. Alternate phrasings: "Where would you say you are?" · "What's the state of things right now?" · "What best describes where you sit today?"

Option (as visitor reads it) T3 T4 T5 T6 T7
"We're considering a new market or regulated space. Nothing's signed yet — we're trying to figure out if it's worth pursuing."
"We have a real opportunity (or mandate) in front of us. Someone has told us we need to do X — and we're not sure they're right."
"We started this and got stuck. Real work is sitting half-done — we're not at zero, but we're not moving."
"We have a program running — and we want to make sure it's the right one, the right partner, the right spend."
"I know what we need. I just need someone to do it — to my standard, without making me supervise them."
● Primary route ○ Secondary route (consistent, especially in combination) — Not a fit
Q 02 MULTI-SELECT · SIGNALS · FLAGS & CONTEXT

"What's actually on your plate right now? (Pick all that apply.)"

Intent: Surface the specific signals shaping the visitor's situation. Multiple can be true. Each selection sets a flag; flags don't change which situation page they land on, but they change the inflection of the page content and the CTA fragment, and they show up as agenda items on the meeting invite.

Signal (as visitor reads it) T3 T4 T5 T6 T7
"A board, customer, or prime is pressing us for an answer."
"We have a deadline that's real and a framework that doesn't feel optional."
"Something we were counting on (vendor, tool, auditor, person) collapsed."
"Our internal lead, CISO, or expert just departed — and they took the program knowledge with them."
"We have more open risk on our plate than headcount to address it."
"We've gotten three or more quotes and they all sound the same."
"Someone we trust said we should call you."
"Our budget is in review — security spend is being scrutinized."
"We've shelved a gap assessment for more than six months."
"We genuinely don't know if we should be in this market at all."
"We need someone who can talk to executives without losing the engineers."
"We've already chosen a path — we just want a second opinion before committing."
● Strong signal for this Type ○ Consistent with this Type — Not a signal
Q 03 SINGLE-SELECT · OUTCOME · 90-DAY HORIZON

"What does success look like for you in 90 days?"

Intent: Force the visitor to articulate what they actually want. The answer becomes the closing line of the meeting invite — and the opening question of the call. Alternate phrasings: "If we talked again in 90 days, what would you want to be true?" · "What does 'good' look like for your team a quarter from now?"

Outcome (as visitor reads it) T3 T4 T5 T6 T7
"We've decided whether this market is worth the investment — and we have an honest answer either way."
"We're moving on the right path — the framework, the scope, and the timeline all hold up under scrutiny."
"Our program is back on track — what stalled is moving, with a credible plan to finish."
"We have a partner whose judgment we trust — the right shape of engagement, the right people, the right spend."
"Someone is running this for me to my standard — without making me supervise them."
"The board has clarity on what we're spending, what we're getting, and what good looks like."
"We have a defensible answer on what framework, what scope, what level — for our specific contract."
● Primary outcome for this Type ○ Plausible adjacent outcome — Not aligned

Why each Type — the reasoning behind the routing.

The matrices show the what; this section explains the why. For each Type, what does the combination of Q1 + Q2 signals + Q3 outcome actually mean? Which flags get set? Where does this Type sit relative to its adjacent Types — and what's the smallest signal that would push the visitor into a different bucket? This is the interpretive layer that makes the routing logic explainable, debuggable, and revisable.

TYPE 03 Considering a new market

What the answers mean together

Q1 indicates pre-decision exploration — they're not committed yet. Q2 signals are directional, not operational: board pressure, market acronyms blurring, "don't know if we should be in this market at all." Q3 is decisional: they want a yes/no answer on whether the market is worth pursuing.

Flags this set typically triggers

board-pressure budget-pending framework-uncertain

vs. adjacent Types

vs. Type 4: a Type 4 visitor has already been told what framework to chase. A Type 3 visitor is questioning whether to chase one at all. The line is "we've been told" vs. "we're considering."
vs. Type 6: a Type 6 visitor has a program running. A Type 3 visitor doesn't even know if there should be one.
TYPE 04 Checking the path you're on

What the answers mean together

Q1 indicates committed but uncertain — someone (prime, customer, regulator) has named the framework and they're acting on it, but doubt is real. Q2 typically combines deadline pressure with vendor-told doubt: "we've gotten three quotes that all sound the same" or "our prime says CMMC but our customer says SOC 2." Q3 is defensibility: they want to know the framework, scope, and level hold up under scrutiny.

Flags this set typically triggers

urgency contract-pressure vendor-told framework-conflict

vs. adjacent Types

vs. Type 3: Type 4 is past the "is this market worth it" question. They're already in.
vs. Type 5: Type 4 hasn't started executing yet; Type 5 has. If Q2 includes "we have a gap assessment from a year ago," they're more likely T5.
TYPE 05 Restarting a stalled program

What the answers mean together

Q1 indicates partial-execution-then-stall — they're not at zero. Real work exists. Q2 surfaces what stalled: vendor collapse (triggers triage flag), team departure, shelved assessment, internal alignment breakdown. Q3 is recovery-oriented: back on track with a credible plan to finish, not "start over."

Flags this set typically triggers

triage vendor-collapse team-loss partial-evidence

vs. adjacent Types

vs. Type 4: Type 5 has tried and stopped. If they're just questioning the path but haven't started, T4.
vs. Type 6: Type 5 wants to finish what stalled. Type 6 has a running program and wants to optimize it. The line is "stalled" vs. "running but questionable."
TYPE 06 Finding the right partner

What the answers mean together

Q1 indicates program is operational — there's running infrastructure, an existing partner, current spend, current people. Q2 surfaces executive triggers: board ROI pressure, budget cut without losing posture, quotes that all sound the same, need for a bullshit-meter. Q3 is judgment-oriented: a partner whose judgment they trust, not a vendor with the longest capability deck.

Flags this set typically triggers

budget-cut board-cycle existing-partner cfo-driven

vs. adjacent Types

vs. Type 7: Type 6 wants to think about partnership; Type 7 wants someone to execute. T6 buys judgment, T7 buys execution.
vs. Type 5: if the program is "stalled," T5. If it's "running but you're questioning whether it's the right shape," T6.
TYPE 07 Handing it off to a partner

What the answers mean together

Q1 indicates full clarity, depleted bandwidth — they know exactly what needs to happen, they just don't have time to do it themselves. Q2 surfaces expert overload: more open risk than headcount, referral entry, consultant fatigue, technical role. Q3 is delegation: someone running this to their standard, not requiring supervision. The hallmark of T7 is they don't need orientation — and they resent being given any.

Flags this set typically triggers

fast-track referrer-detected expert-handoff no-orientation

vs. adjacent Types

vs. Type 6: Type 6 wants judgment; Type 7 wants execution. If the buyer is technical (CISO, senior security lead, technical founder) and the trigger is "I'm out of bandwidth, not direction," T7. If the buyer is non-technical (CFO, COO, owner) and the trigger is "I need to understand what we're getting," T6.
vs. Type 5: T7 isn't recovering from anything — they just don't have time. If the Q2 surfaces "something collapsed," it's T5 even if the visitor is technical.

What doesn't go together — compatibility rules.

Not every Q1 + Q2 combination makes sense. Some Q2 signals are incompatible with certain Q1 states (a "considering" visitor can't have a 3PAO collapse — they don't have a 3PAO). Others are unusual and worth a soft warning before letting the visitor proceed. A third category sets flags rather than routing. These rules live in the qualifier code and shape what options the visitor sees as they progress.

Hard exclude
If Q1 = "considering a new market" (T3), hide Q2 options: "3PAO collapsed", "team lead departed", "shelved gap assessment", "more risk than headcount". A visitor in pre-decision exploration doesn't have a 3PAO, a security lead, a gap assessment, or open risk in their queue yet.
Hard exclude
If Q1 = "I know what we need" (T7), hide Q2 options: "don't know if we should be in this market", "quotes all sound the same". A T7 visitor has full clarity. Market uncertainty or shopping-multiple-quotes contradicts their stated state.
Hard exclude
If Q3 = "we've decided whether this market is worth it" (T3 outcome), block Q1 = "program running", "started and got stuck", "I know what we need". That outcome is decisional. It only makes sense if you haven't decided yet.
Soft warn
If Q1 = "I know what we need" (T7) + Q2 includes "board pressing for an answer": show "This combination is unusual. T7 visitors typically own the answer themselves. Are you sure?" The board pressing a T7 visitor usually means they're answering FOR the board, not asking ON behalf of them.
Soft warn
If Q1 = "started and got stuck" (T5) + Q3 = "someone running this to my standard" (T7 outcome): show "You might actually be Type 7 — the path is clear, you just need execution. Want to see that page instead?" A T5 visitor whose 90-day outcome is delegation may have moved past T5 and into T7 by the time they're booking.
Flag set
If Q2 includes "something we were counting on collapsed" OR "our internal lead departed": set triage flag. This sharpens the Type 5 page opener and adds a recovery-pattern bullet to the CTA fragment. The triage flag does not change which page they land on — it changes how that page reads.
Flag set
If Q2 includes "deadline that's real" OR "board pressing for an answer": set urgency flag. CTA fragments add "...before the deadline forces the wrong choice." Urgency is mostly a CTA shaper; it doesn't override the primary route.
Flag set
If Q2 includes "someone we trust said we should call": set referrer-detected flag. On Type 7 pages this activates the fast-track (skip the discovery call, go straight to a working session). Referrer flag is the single most powerful T7 signal.
Flag set
If Q2 includes "budget under scrutiny" AND Q1 = "program running" (T6): set budget-cut flag. CTA shifts toward "where can we cut without losing posture." Budget-cut + T6 is the canonical CFO outside-read scenario.

A worked example: how Q1 + Q2 + Q3 become the meeting invite.

A real visitor finishes the qualifier with the following selections:

Q1 (state): "We started this and got stuck. Real work is sitting half-done."
Q2 (signals): "Something we were counting on collapsed" · "We have a deadline that's real"
Q3 (outcome): "Our program is back on track — with a credible plan to finish."

→ Route: Type 5 (Restarting a Stalled Program), with triage flag

→ Meeting invite writes itself

"Looking forward to our conversation. Based on what you shared, we'll cover: where your program stalled and what kept it there, the impact of the dependency that collapsed and what recovery looks like from here, and what 'back on track with a credible plan to finish' in 90 days means for your specific timeline. We'll come in knowing this — so let's use the time to dig in, not to re-introduce."

The visitor walks into the meeting feeling understood before anyone has spoken. SPP walks in with the right context loaded. That's the architecture working as designed.

§ Try It · The Interactive Simulator

Pick answers, see where it routes, tell us what's right and wrong.

This is the working version of the qualifier. The same Q1/Q2/Q3 questions, the same scoring logic, the same routing rules described in the strategy tab — running live. Pick your selections below to see which Type a visitor with those answers would land on, why the system chose that Type, what flags get set, and what the meeting invite would say.

Your feedback shapes the build. After each run, give it a thumbs up or down and tell us why. Then optionally suggest specific changes to the questions, options, or reasoning. Your name is saved locally so you don't have to type it each time. Everyone reviewing this doc sees the same feedback pool in real time — build on each other's notes.

Q 01 "Where are you in this?" SINGLE-SELECT · STATE
"We're considering a new market or regulated space. Nothing's signed yet — we're trying to figure out if it's worth pursuing."
"We have a real opportunity (or mandate) in front of us. Someone has told us we need to do X — and we're not sure they're right."
"We started this and got stuck. Real work is sitting half-done — we're not at zero, but we're not moving."
"We have a program running — and we want to make sure it's the right one, the right partner, the right spend."
"I know what we need. I just need someone to do it — to my standard, without making me supervise them."
Q 02 "What's actually on your plate right now?" MULTI-SELECT · SIGNALS
"A board, customer, or prime is pressing us for an answer."
"We have a deadline that's real and a framework that doesn't feel optional."
"Something we were counting on (vendor, tool, auditor, person) collapsed."
"Our internal lead, CISO, or expert just departed — and they took the program knowledge with them."
"We have more open risk on our plate than headcount to address it."
"We've gotten three or more quotes and they all sound the same."
"Someone we trust said we should call you."
"Our budget is in review — security spend is being scrutinized."
"We've shelved a gap assessment for more than six months."
"We genuinely don't know if we should be in this market at all."
"We need someone who can talk to executives without losing the engineers."
"We've already chosen a path — we just want a second opinion before committing."
Q 03 "What does success look like for you in 90 days?" SINGLE-SELECT · OUTCOME
"We've decided whether this market is worth the investment — and we have an honest answer either way."
"We're moving on the right path — the framework, the scope, and the timeline all hold up under scrutiny."
"Our program is back on track — what stalled is moving, with a credible plan to finish."
"We have a partner whose judgment we trust — the right shape of engagement, the right people, the right spend."
"Someone is running this for me to my standard — without making me supervise them."
"The board has clarity on what we're spending, what we're getting, and what good looks like."
"We have a defensible answer on what framework, what scope, what level — for our specific contract."
→ Routing result

Why this Type

Flags set
→ Meeting invite preview

§ Typology Pages · The Five Destinations

Five typology pages, one skeleton, five different conversations.

When a visitor finishes the qualifier, they land on one of five pages. Every page uses the same structural skeleton — same section order, same kinds of content, same CTA shape — so the system is predictable and easy to maintain.

In Stage 1, the five pages are static. Every Type 4 visitor sees the same Type 4 page; every Type 5 visitor sees the same Type 5 page. Content is written once, holds for every visit, and is easy to maintain. Click any card below to see what its page actually says.

In Stage 2, the pages listen and adapt. The opener inflects with the visitor's free-text. A "Tell us what's different" field invites mid-page refinement. CTA fragments become truly dynamic. Adjacent links carry context to the next page. See the card content below — each preview now shows what changed.

In Stage 3, the system generates each page for the specific visitor — the skeleton stays, the words change. The opener mirrors their language. The risk framing pulls live from SPP's curated knowledge base. Insights and Solutions cross-link contextually. The cards below show each page as it would be generated for a real visitor.

TYPE 03 · internal
Considering a new market
TYPE 04 · internal
Checking the path you're on
TYPE 05 · internal
Restarting a stalled program
TYPE 06 · internal
Finding the right partner
TYPE 07 · internal
Handing it off to a partner

The shared anatomy

Every typology page has the same seven sections in the same order. Most are fixed in structure (the section exists, in this place, on every page). Some are variable per typology (the actual words differ between Type 3 and Type 4). A few become stage-dependent in Stages 2 and 3 (they take on additional behavior when the system gets smarter).

www.steelpatriotpartners.com/situation/... SECTION 01 · VISIBLE PAGE TITLE "You started this. Let's get it moving again." → Variable per typology · always written as situation, never as label SECTION 02 · REASSURANCE OPENER "You started a compliance program and ran into something. You're not at zero — you're carrying real work that stalled." → Variable per typology · Stage 2+ inflects with visitor's own free-text language SECTION 03 · WHAT WE TYPICALLY SEE 3–5 bullets describing patterns we see in this situation → Variable per typology SECTION 04 · THE RISK WE WATCH FOR The mistake or failure mode most common in this situation → Variable per typology · Stage 3 pulls live from knowledge base SECTION 05 · WHAT WE'D WANT TO DISCUSS 4–6 questions that would open the conversation → Variable · Stage 3 tailors to visitor's language SECTION 06 · WHAT HAPPENS NEXT The shape of the first conversation (workshop, call, etc.) → Mostly fixed · ROI Workshop language stays consistent SECTION 07 · MAYBE THIS ISN'T YOU → 2–3 adjacent situations with clarification statements → Stage 1: static links · Stage 2: context carries forward · Stage 3: AI-suggested SECTION 08 · CTA "Let's discuss [X]" → Fixed shape · variable fragment per type + flags
Fixed structure · same on every typology page
Variable per typology · different words on Type 4 vs Type 5
Stage-dependent · gains behavior in Stage 2 and Stage 3
TYPE 03 · internal only

"You're considering a new market — and what it'll take to be ready for it."

"You're considering a new market — and what it'll take to be ready for it."

+ TITLE STAYS · OPENER & BODY ADAPT TO VISITOR INPUT

[Page title generated for this visitor's specific market & framework]

+ TITLE NOW SHAPED BY VISITOR'S DESCRIBED SITUATION
URL: /situation/considering-a-new-market/
↳ ROUTES IN FROM THE QUALIFIERFROM THE QUALIFIER + REFINEMENTFROM ANY INPUT, INCLUDING NATURAL LANGUAGE
  • Q1: "We're looking at a new market or regulated space — federal, healthcare, cloud, or otherwise — and nothing's signed yet"
  • Q2 signals: board is pushing, vendor outreach feels off, framework acronyms blur, not sure who to talk to first
  • Q3 goal: "We've decided whether this new market or framework is worth pursuing"
  • Free-text on "Close, but not quite": visitor's own words about what they're considering
  • Campaign-ID parsing: utm_situation=exploring-fedramp pre-routes here
  • Cold-landing backfill: direct entry triggers a mini-qualifier in-page
  • Natural-language qualifier: "I'm trying to figure out if going federal makes sense for us" — AI maps to Type 3
  • Returning visitor: prior session showed early exploration intent — recognized on landing
○ WHAT THIS PAGE ACTUALLY SAYS
STAGE 01 · STATIC — SAME FOR EVERY TYPE 3 VISITOR
"You're looking at a new market — federal contracting, healthcare, cloud services, financial, or something else that asks more of your security program than what you're running today. You're trying to figure out whether this is a market you should be in, and if so, what it costs."
What we see: framework acronyms blurring · "compliance in a box" pitches feeling off · uncertainty about consultant vs. auditor vs. engineer · worry about spending on the wrong thing
The risk: companies in your position often get sold certainty before they have clarity
CTA → "Let's discuss whether this is the right move for your business."
STAGE 02 · INFLECTED BY VISITOR'S OWN WORDS
Visitor said on confirmation card: "Our board is pushing us into federal work. We don't know if we should be chasing CMMC or starting with something smaller."
"You're looking at federal work — and the board is pushing. Before you chase CMMC or anything else, the right question is whether this is the right market for you to be in at all, and if so, what the smallest credible first step looks like."
What we see in your situation: board pressure outpacing clarity · CMMC framed as the goal when it's actually a downstream consequence · vendor pitches optimized for closing, not for fit
The risk for you specifically: committing to CMMC budget before knowing whether the federal opportunity is real — twice the cost, half the confidence
Tell us what's different — refine in your own words
CTA (base) → "Let's discuss whether this is the right move for your business."
+board-pressure: "...and what to tell the board this quarter."
+budget: "...without committing to a full CMMC program before you know."
STAGE 03 · GENERATED FOR THIS SPECIFIC VISITOR
AI inferred from visitor's input + knowledge base: Market: Federal · DoD prime subcontracting · Likely framework: CMMC L2 · Stage: pre-bid exploration · Board involvement: active
"You're being asked to consider DoD prime subcontracting, and your board wants a CMMC plan on the table before the next bid cycle. The first decision isn't which CMMC level — it's whether the contract math makes the certification worth it for you. We talk to companies in this exact place every month."
What the pattern usually looks like: $2–4M opportunity, 18-month bid cycle, $300K–$800K compliance lift, single-prime dependency · we have anonymized comparables on file
What we'd want to discuss first: the deal math · the actual scope of CUI you'd be handling · whether GovRAMP or CMMC L2 is right for this specific opportunity
Surfaced contextually: Insights: "CMMC L2 vs. L1: the decision tree for first-time bidders" · Solutions: CMMC L2 deep page · Event: Aug 14 — Federal Compliance for SaaS Founders
CTA → "Let's walk through the math on this specific opportunity together."
↦ CLARIFICATIONS THAT ROUTE OUT
  • "Actually we already have a contract on the line and a real deadline" → Type 4
  • "Actually we started this work and got stuck" → Type 5
  • "Actually we're already working with another firm on this" → How We Work content
  • Context carries forward: if visitor jumps to Type 4 or 5, their free-text and flags travel with them
  • Recalibration counter: S0 → S1 → S2 — after 2 refinements, terminal handoff fires
AI-suggested for this visitor: "Based on what you described, you might actually be closer to Type 4 (checking the path) — your board has effectively made the CMMC decision for you. Want to see what that page would say instead?"
Stage behavior summary Static page — same opener for every Type 3 visitor. Adjacent-link clarifications navigate to other static pages. Opener inflects with the visitor's free-text about why they're exploring this market. CTA fragment may adjust if budget or board-pressure flags are set. Adjacent clarifications carry visitor context to the next page. Opener fully generated from visitor's situation description. Risk frame pulled from SPP knowledge base, matched to the specific market they named (HITRUST, FedRAMP, SOC 2, etc.). Adjacent suggestions inferred by AI.
TYPE 04 · internal only

"You've been told you need to comply. Let's check that."

"You've been told you need to comply. Let's check that."

+ TITLE STAYS · OPENER REFERENCES THE SPECIFIC PATH THEY'RE ON

[Page title generated against the specific framework conflict at play]

+ TITLE SPECIFIC TO CMMC vs SOC 2, FEDRAMP vs ISO, etc.
URL: /situation/checking-the-path/
↳ ROUTES IN FROM THE QUALIFIERFROM THE QUALIFIER + REFINEMENTFROM ANY INPUT, INCLUDING NATURAL LANGUAGE
  • Q1: "We've been told we need to do this and the clock is running"
  • Q2 signals: contract/flow-down pressure, vendor told us framework X, customer expectations vague, internal team committed already
  • Q3 goal: "We know what we actually have to do (and what we don't) and we're moving on the right path"
  • Active flags: urgency if Q2 = "deadline-driven"
  • Free-text on confirmation card: visitor names the specific framework they were told to chase
  • Campaign-ID parsing: utm_situation=cmmc-flowdown or utm_pressure=customer-mandate
  • Sideways arrival from Type 3: visitor who clarified "actually we have a contract" — flags + free-text carry forward
  • Natural-language qualifier: "Our biggest customer says we need SOC 2 but our prime says CMMC" — AI recognizes the conflict and routes here
  • Framework-conflict detection: AI flags incompatible framework pairs in visitor input
○ WHAT THIS PAGE ACTUALLY SAYS
STAGE 01 · STATIC — SAME FOR EVERY TYPE 4 VISITOR
"You have an opportunity in front of you, and you've been told you need to do something. You're confident enough to be moving on it. You're not so confident that you're sure the path is right."
What we see: contracts requiring "framework X" no one has read end-to-end · vendor-pitched Level 2 when Level 1 would have served · over-scoped plans · under-scoped customer expectations
The risk: the fastest way to waste a year and a six-figure budget is to comply with the wrong framework at the wrong scope
CTA → "Let's discuss whether the path you're on is actually the right one."
+urgency: "...before the deadline forces the wrong one."
STAGE 02 · INFLECTED BY VISITOR'S OWN WORDS
Visitor said on confirmation card: "Our prime told us we need CMMC Level 2 by end of year. Vendor quoted us $450K and 9 months. Something feels off."
"You've been told CMMC Level 2 is the path, and you're being asked to commit $450K and nine months to it. Before you sign that contract, the question worth asking is whether Level 2 is actually what your flow-down requires — or whether someone is selling above the line."
What we see in your situation: CMMC Level 2 quoted as default when many flow-downs accept Level 1 · 9-month timelines built around full-scope when partial-scope is often enough · price reflecting "what the market bears" not what your specific contract needs
The risk for you specifically: paying for Level 2 when your contract only requires Level 1 — a 3x cost overrun before you've even started
Tell us what's different — refine in your own words
CTA (base) → "Let's discuss whether the path you're on is actually the right one."
+urgency: "...before the deadline forces the wrong one."
+contract-pressure: "...what your actual flow-down requires vs. what was quoted."
+vendor-told: "...whether to keep that vendor or get a second read."
STAGE 03 · GENERATED FOR THIS SPECIFIC VISITOR
AI identified the conflict: Customer mandate: SOC 2 Type II · Prime mandate: CMMC L2 · Industry: Defense SaaS · Urgency: both deadlines < 6 months
"You're being pulled in two directions — SOC 2 from your biggest commercial customer, CMMC Level 2 from your prime contractor. Both deadlines are inside six months. The good news: these aren't incompatible. The path that actually works is doing them in the right order, with shared evidence, so you're not paying twice for the same control."
What the pattern usually looks like: SOC 2 first (faster · less invasive · acts as foundation), CMMC L2 second (reuses ~60% of the SOC 2 control evidence) · total timeline 9–11 months vs. 14+ if sequenced wrong
What we'd want to discuss first: the actual scope of each mandate · whether your prime accepts CMMC L1 (most flow-downs to subs do) · the shared-evidence map
Surfaced contextually: Insights: "SOC 2 + CMMC: when one foundation serves both" · Solutions: Dual-framework engagement · Event: Jun 28 — DIB SaaS Compliance Roundtable
CTA → "Let's map both mandates onto one program before you sign anything."
↦ CLARIFICATIONS THAT ROUTE OUT
  • "Honestly we haven't started yet — we're still deciding if we should" → Type 3
  • "Actually we tried and stalled" → Type 5
  • "We know the path, we just need someone to execute" → Type 7
  • Context carries forward: framework name, vendor name, urgency flags all travel to the next page
  • Recalibration counter: S0 → S1 → S2 — terminal handoff at 2 refinements
AI-suggested for this visitor: "Based on your two-mandate situation, you might also fit Type 6 (finding the right partner) — your CFO will care about the shared-evidence cost optimization. Want to see that framing?"
Stage behavior summary Static. The Type 4 opener and bullets are the same for every visitor routed here. Urgency flag changes the CTA fragment but the page body is fixed. Opener and risk framing inflect with the visitor's free-text on the homepage ("we were told we need CMMC Level 2 for a flow-down..."). Page can re-render after they refine. CTA dynamically responds to urgency, contract-pressure, and other flags. Page fully generated. AI identifies the specific framework conflict (CMMC vs GovRAMP, FedRAMP vs SOC 2, etc.) and writes a page that addresses their exact comparison. Real anonymized case patterns from the knowledge base inform the risk framing.
TYPE 05 · internal only

"You started this. Let's get it moving again."

"You started this. Let's get it moving again."

+ TRIAGE MODIFIER SHARPENS OPENER WHEN FLAG IS SET

[Page title generated for the specific stall pattern]

+ DISTINGUISHES STALL FROM RESOURCE-LOSS vs VENDOR-COLLAPSE vs COST-OVERRUN
URL: /situation/restarting-a-program/ · also handles the Triage modifier
↳ ROUTES IN FROM THE QUALIFIERFROM THE QUALIFIER + REFINEMENTFROM ANY INPUT, INCLUDING NATURAL LANGUAGE
  • Q1: "We started a compliance or security program and got stuck"
  • Q2 signals: gap assessment shelved · resource pulled · internal alignment broke · vendor or authorization collapse · partner audit firm collapsed
  • Q3 goal: "We're unstuck, the program is rebuilt or back on track, and we have a credible plan to finish"
  • Active flags: triage if Q2 = "something outside our control collapsed"
  • Free-text on confirmation card: visitor describes specifically what stalled and when
  • Campaign-ID parsing: utm_situation=3pao-collapse, utm_situation=cmmc-restart, etc.
  • Sideways arrival from Type 4: visitor who clarified "we tried and stalled" — context follows
  • Natural-language qualifier: "Our gap assessment from last year is collecting dust. The lead who ran it left." — AI recognizes a resource-loss stall
  • Stall-pattern classification: AI infers which kind of stall (resource, vendor, cost, alignment) from visitor's wording
○ WHAT THIS PAGE ACTUALLY SAYS
STAGE 01 · STATIC — SAME FOR EVERY TYPE 5 VISITOR
"You started a compliance program and ran into something. You're not at zero — you're carrying real work that's stalled. And in some cases, you're carrying it alone."
What we see: gap assessments shelved · partial control mapping · internal leads pulled or departed · external dependencies that broke · DIB veterans facing CMMC, healthcare IT directors with HITRUST pressure, SaaS firms with lapsed SOC 2
The risk: abandoning the right approach for a faster-looking one out of frustration — paying twice for the same work and ending up with something worse
CTA → "Let's discuss what it would take to get your program moving again."
+triage: "...what the recovery path looks like from where you are."
STAGE 02 · INFLECTED BY VISITOR'S OWN WORDS
Visitor said on confirmation card: "Our 3PAO collapsed halfway through our CMMC L2 assessment. We have six months of work and no path to certify."
"Your 3PAO went out from under your CMMC Level 2 assessment, and now six months of completed work is sitting without a path forward. You're not starting over — but you do need someone who can pick up partially-completed evidence and route it to a new 3PAO without re-doing what's already documented."
What we see in your situation: documented controls that need re-validation, not re-creation · evidence portability issues between 3PAOs · client-side staff exhausted from the first run · pressure to "just start over" coming from misinformed advisors
The risk for you specifically: a new 3PAO that won't accept the prior evidence — turning six months of paid work into sunk cost, plus another six months of full assessment
Tell us what's different — refine in your own words
CTA (base) → "Let's discuss what it would take to get your program moving again."
+triage: "...what the recovery path looks like from where you are."
+vendor-collapse: "...how to port the work you already did to a new 3PAO."
+team-loss: "...what to do when the person who knew the program is gone."
STAGE 03 · GENERATED FOR THIS SPECIFIC VISITOR
AI classified the stall: Stall type: Vendor collapse mid-engagement · Framework: CMMC L2 · Progress before stall: ~60% (assessment phase) · Urgency: active contract dependency
"You were 60% of the way through a CMMC Level 2 assessment when your 3PAO ceased operations. That's the second-most-common stall pattern we see (after team-loss). The recovery path is well-trodden: most of your evidence can be ported to a new 3PAO with the right intermediary, and the gap is usually 8–12 weeks, not 6 months."
What the pattern usually looks like: 70–80% of documented evidence is portable · 2–3 weeks to validate evidence completeness · 4–6 weeks to onboard a new 3PAO and run delta validation · 2–4 weeks for re-assessment of partial-evidence controls
What we'd want to discuss first: your evidence repository structure · which controls were fully documented vs. partial · whether your prime accepts an interim attestation while you complete
Surfaced contextually: Insights: "When your 3PAO disappears: a recovery playbook" · Solutions: CMMC mid-engagement recovery · Case study: Anonymized — defense SaaS, similar situation, 11-week recovery
CTA → "Let's review your evidence repository and map the shortest path forward."
↦ CLARIFICATIONS THAT ROUTE OUT
  • "Honestly we never really started — we're earlier than that" → Type 3 or Type 4
  • "Actually the program is running, we just want to optimize" → Type 6
  • "We know what to do, we need someone to build it" → Type 7
  • Context carries forward: stall pattern, framework, partial-progress flags all travel
  • Recalibration counter: S0 → S1 → S2 — visitors who keep refining here often need the terminal handoff faster
AI-suggested for this visitor: "Vendor-collapse cases often benefit from the Type 7 (handing it off) framing — you know what needs to happen, you need someone to execute the recovery without making you supervise. Want that page?"
Stage behavior summary Static, with the Triage modifier handled as a flag (same page skeleton, different opener line conditionally rendered). All Type 5 visitors see the same content otherwise. Opener pulls in visitor's free-text — what specifically stalled, when, why. Triage cases get a sharper, shorter version of the page. Recalibration counter tracks visitors who keep returning here from other types. AI distinguishes a stalled-from-resource-loss case from a stalled-from-vendor-collapse case from a stalled-from-cost-overrun case, and writes a page for the specific stall pattern. Real anonymized recovery patterns inform risk and next-step framing.
TYPE 06 · internal only

"You know what's at stake. You want the right partner."

"You know what's at stake. You want the right partner."

+ OPENER ACKNOWLEDGES THE SPECIFIC BUSINESS CONTEXT

[Page title written for this executive's specific business situation]

+ TUNED TO BOARD-CYCLE vs BUDGET-CUT vs SECOND-OPINION
URL: /situation/finding-a-partner/
↳ ROUTES IN FROM THE QUALIFIERFROM THE QUALIFIER + REFINEMENTFROM ANY INPUT, INCLUDING NATURAL LANGUAGE
  • Q1: "We have a program running and want to optimize it"
  • Q2 signals: CFO/COO/owner profile · quotes from 20 firms look identical · need a bullshit-meter · budget cut without losing posture · board ROI questions
  • Q3 goal: "The right partner is in place — engineering depth, business judgment, low BS — and we're executing"
  • Active flags: budget-cut · urgency (board cycle) · existing-partner (already working with someone, want a second perspective)
  • Free-text on confirmation card: visitor describes their executive context (board pressure, cost overrun, vendor consolidation, etc.)
  • Campaign-ID parsing: utm_audience=cfo, utm_topic=board-roi
  • Sideways arrival from Type 5: visitor whose stall is really an optimization request in disguise
  • Natural-language qualifier: "My CISO wants three more headcount. I want one outside opinion before I sign off." — AI recognizes the executive second-opinion pattern
  • Executive-pattern recognition: AI infers buyer role (CFO, COO, owner, CISO) and tunes content accordingly
○ WHAT THIS PAGE ACTUALLY SAYS
STAGE 01 · STATIC — SAME FOR EVERY TYPE 6 VISITOR
"You're not a compliance person, and you don't need to be. You understand what's at stake. You're not shopping capability lists — you're trying to find judgment you can trust."
What we see: 20 identical-looking quote decks · CISOs needing a single outside voice as a check · pressure to cut security spend without cutting posture · board ROI questions hitting · the polished firm that can sell to executives but can't execute
The risk: the firm that wins on polish usually loses on substance
CTA → "Let's discuss what the right partnership would look like for your program."
+budget-cut: "...where you can cut without losing posture."
+existing-partner: "...what a second perspective on your current direction would tell you."
STAGE 02 · INFLECTED BY VISITOR'S OWN WORDS
Visitor said on confirmation card: "Board wants a 15% security cost reduction. CISO says it's not possible. I need an outside read."
"Your board wants 15% out of security spend. Your CISO says the program won't hold at that number. Both can be true. The third option — the one neither party usually proposes — is a structural rework that lowers cost without lowering posture. That's usually what an outside read finds."
What we see in your situation: "15% off" mandates that hide a 30% restructure opportunity · vendor consolidation that frees real budget · controls that were over-engineered for the actual risk · tools paying twice for the same outcome
The risk for you specifically: cutting the CISO's program at the board's number — your security posture drops, you save $X, you spend 3X recovering it next year
Tell us what's different — refine in your own words
CTA (base) → "Let's discuss what the right partnership would look like for your program."
+budget-cut: "...where the 15% can come from without breaking the program."
+board-pressure: "...how to give the board a credible answer this quarter."
+existing-partner: "...what a second perspective on your CISO's plan would say."
STAGE 03 · GENERATED FOR THIS SPECIFIC VISITOR
AI inferred executive context: Buyer role: CFO at series-B SaaS · Trigger: board mandate · cost reduction · Current spend: ~$2.4M/yr security program · Sensitivity: can't be seen as anti-security
"You're the CFO. Your board wants 15% out of a $2.4M security program, and your CISO has — correctly — said the program won't hold at that number. You need an answer that lets you take the cost reduction to the board without being the executive who cut security and got breached six months later. There's usually one: it lives in vendor consolidation and control rationalization, not in cutting headcount."
What the pattern usually looks like: $200K–$400K of vendor overlap (overlapping SIEM/EDR/identity tools) · 30–40% of compliance controls over-engineered for actual risk · contractor spend masquerading as project work · 2–3 board-friendly cost moves that don't touch headcount
What we'd want to discuss first: your current vendor map · what the CISO sees as untouchable vs. negotiable · the board's actual question (sometimes it's not 15% — it's "tell me security is being managed responsibly")
Surfaced contextually: Insights: "The CFO's outside read: when to challenge your security budget" · Solutions: Program optimization engagement · Event: Sept 5 — Security ROI for SaaS CFOs (private dinner)
CTA → "Let's walk through your security spend together — one hour, no pitch."
↦ CLARIFICATIONS THAT ROUTE OUT
  • "Actually we're stalled and need to get unstuck" → Type 5
  • "We just need execution, not strategy" → Type 7
  • "We're earlier than this — still figuring out if it's worth doing" → Type 3
  • Context carries forward: executive role, budget pressure, board-cycle timing all travel
  • Existing-partner flag: when set, How We Work content surfaces inline rather than a typology jump
AI-suggested for this visitor: "Cost-reduction CFOs often actually want Type 7 (handing it off) framing — you don't need a strategic partner, you need someone to execute the rationalization. Want to see that page?"
Stage behavior summary Static page with conditional CTA fragment per flag. All Type 6 visitors get the same opener and bullets. Opener acknowledges visitor's specific business context ("you're optimizing a program that's running" vs "you're being asked to defend the program to the board"). Flags drive CTA framing dynamically. Existing-partner flag surfaces the "we work alongside" message inline. AI reads the visitor's executive context and matches them to a real anonymized comparable. Page leads with business-outcome framing tailored to their stage (board prep, cost optimization, vendor consolidation, etc.). Insights content surfaces ROI-related thought leadership first.
TYPE 07 · internal only

"You know what needs to happen. You need it done right."

"You know what needs to happen. You need it done right."

+ REFERRAL CONTEXT ACKNOWLEDGED IF PRESENT · FAST-TRACK ACTIVE

[Page title written for this expert's specific handoff need]

+ RETURNING-VISITOR RECOGNITION + REFERRER CONTEXT
URL: /situation/handing-it-off/
↳ ROUTES IN FROM THE QUALIFIERFROM THE QUALIFIER + FAST-TRACKFROM ANY INPUT, INCLUDING NATURAL LANGUAGE
  • Q1: "I've done this before — I know what I need, I need someone to do it"
  • Q2 signals: CISO or senior security lead · technical founder · more open vulnerabilities than bandwidth · came via referral · burned out on hand-holding consultants
  • Q3 goal: "Someone is running this for me to the standard I would run it myself"
  • Type 7 fast-track: Experts skip the recalibration loop entirely — straight to a direct conversation
  • Referrer detection: URL contains ?ref= or session shows known-referrer source
  • Sideways arrival from Type 4 or 6: visitor who clarified "we know the path, just need execution"
  • Natural-language qualifier: "I'm a CISO. I know we need to MFA every privileged account, deploy CSPM, and finalize CMMC. I don't have the bandwidth." — AI recognizes expert handoff pattern
  • Returning-visitor recognition: repeat callers don't re-qualify — they go straight to a conversation with prior context loaded
○ WHAT THIS PAGE ACTUALLY SAYS
STAGE 01 · STATIC — SAME FOR EVERY TYPE 7 VISITOR
"You came here through a referral or because someone you trust said our name. You don't need orientation. What you need is depth and execution — somebody who will run this the way you would, without making you supervise them."
What we see: more open vulnerabilities than bandwidth · clarity about the right answer with no time to deliver it · consultant fatigue from too much hand-holding · the desire to hand over a problem and stop thinking about it
The risk: a partner that consumes more of your attention than the problem would have — you've gone backward
CTA → "Let's discuss what we'd take off your plate first."
STAGE 02 · INFLECTED + REFERRER ACKNOWLEDGED
Referral context detected (session): Referred by Jane Marcus at ACME Defense · Came in via direct meeting link, not the homepage qualifier
"Jane Marcus sent you our way. That tells us most of what we need to know about what you'll value and what you won't tolerate. You don't need an orientation, and you don't need us to convince you we're worth talking to. Let's just talk about what's on fire."
What we see in your situation: direct-from-referral entry · low patience for sales process · expectation of immediate substance · likely an active fire or strategic gap you've been carrying alone
The risk for you specifically: wasting your time on a discovery call that should have been a working session — we won't do that
CTA (base) → "Let's discuss what we'd take off your plate first."
+referrer-detected: "Skip the discovery — book a working session."
+fast-track-active: "30-min direct call, no presentation deck."
STAGE 03 · GENERATED WITH FULL CONTEXT
AI loaded prior context: Returning visitor: 3rd session in 6 weeks · Last session: CSPM tool selection discussion · Stated role: CISO · series-C SaaS · Active concerns: CMMC L2 prep, identity sprawl, contractor offboarding
"Welcome back. Last time you mentioned the CSPM rollout was waiting on identity cleanup, and CMMC L2 prep was on the backburner. Two of those have probably shifted — happy to pick up wherever's most useful. Or if you've got something new on fire, let's start there."
What we'd want to discuss first: the highest-priority handoff right now · whether the CSPM identity dependency resolved · CMMC L2 timeline status · any new arrivals on the fire list
Surfaced contextually: Solutions: Identity cleanup engagement (last session's topic) · Insights: "Contractor offboarding: the audit-ready playbook" (matches active concern) · Next available conversation: Tomorrow 2pm with Jason
CTA → "Pick up where we left off — or tell us what changed."
↦ CLARIFICATIONS THAT ROUTE OUT
  • "Actually the strategic conversation matters too" → Type 6
  • "Honestly we're not as far along as I thought" → Type 5
  • "I just assumed I know — we haven't really started" → Type 4
  • Fast-track in effect: Type 7 visitors don't go through the recalibration loop — clarifications surface as conversation options instead
AI-suggested for this visitor: "Returning experts rarely need to re-classify. If something has materially changed in your situation since last session, just say so and we'll pick it up live."
Stage behavior summary Static page, with the simplest call to action of all five — these visitors don't want a process, they want to talk. Fast-track applies — Experts get one click to a direct conversation rather than going through the refinement loop. Page acknowledges their referral context if a referrer name is in the URL or session. AI recognizes the technical depth and skill ceiling implied by their free-text and shapes the conversation invitation accordingly. Returning-visitor recognition is especially valuable here — these are repeat callers who don't want to re-explain.

How the typology pages evolve across the three stages

The same five pages, the same skeleton, the same visitor-facing situation framing — but the experience gets sharper as the system gets smarter. Click between the three stages at the top of this document to see the corresponding flow diagram. Below: a side-by-side of what the typology pages do at each stage.

STAGE 01 · SIMPLE

Static pages, predictable content

  • Same opener for every visitor of this type — written once, holds for every visit
  • Fixed adjacent links at the bottom of each page — clicks go to the next static page with no carry-through
  • Single CTA fragment per typology, optionally varied by one or two flags (urgency, triage)
  • No free-text anywhere on the page
  • Standard HubSpot tagging writes the typology to the contact record on form submission
  • Easy to maintain — Marco or Sean can update copy in one place and ship
STAGE 02 · ADVANCED

Pages that listen and adapt

  • Opener inflects with the visitor's free-text from the homepage confirmation card
  • "Tell us what's different" field appears mid-page — visitor can refine in their own words
  • Adjacent links carry context — clicking through to Type 5 carries the original free-text and any flags
  • CTA fragment becomes truly dynamic — multiple flag combinations produce distinct fragments
  • Type 7 fast-track active — Experts bypass the refinement loop
  • Airtable log captures every refinement, including anonymous visitors who never identify themselves
  • Recalibration counter tracks how many times the visitor has refined — at 2, the terminal handoff kicks in
STAGE 03 · INTELLIGENT

Pages generated for the specific visitor

  • Opener fully generated from visitor's situation description — mirrors their language, uses their framing
  • What we see / risk / discuss all generated against SPP's curated knowledge base — real patterns, real risks, real recovery paths
  • Insights content surfaces contextually — Type 4 visitors see redirect content first, Type 5 sees recovery patterns
  • Solutions deep-pages cross-linked — a CMMC-mentioning Type 4 visitor sees a CMMC deep page contextually
  • Returning visitor recognition picks up where they left off, including their prior typology drift
  • Event invitations tailored — the right SPP event surfaces for this specific situation
  • The brand voice stays human — AI is the engine, not the personality
A note on the path from Stage 02 to Stage 03

Stage 03 isn't a single leap — there are meaningful stops along the way.

The jump from Stage 2 to a fully intelligent Stage 3 is large, expensive, and risky to attempt in one move. The more useful path is progressive: once Stage 2 is shipped and we have real visitor data, we can add intelligence one capability at a time. Each intermediate step is independently valuable and informs whether the next one is worth building.

2.1
Smarter opener inflection
The free-text on the homepage starts driving page openers more substantively — LLM rewrites the opener line in real time, but the rest of the page stays static. Low risk, high signal.
2.2
Free-text qualifier (alongside select)
An optional "describe your situation" field appears on the homepage as an alternative to the three select questions. AI maps free-text → typology in real time. Select-based qualifier stays as fallback.
2.3
Returning-visitor recognition
HubSpot lookup at landing surfaces a "pick up where you left off?" prompt for known visitors. No content generation needed yet — just memory.
2.4
Contextual Insights matching
Blog and resource content gets tagged by typology and surfaces to matching visitors first. Editorial work, not AI work, but it makes the site feel more intelligent.
2.5
Full dynamic page generation
The full Stage 3 vision — openers, what-we-see, risk framing all generated against the SPP knowledge base for the specific visitor. Built on everything that came before.

These intermediate stops can be priced and scoped individually as separate engagements after Stage 2 is live. Each is built on the same foundation. None requires throwing away earlier work.