As we approach the end of the fiscal year, it’s the perfect time to discuss the critical topic of forecasting—especially before the holiday season sets in and we find ourselves in a mental fog.
Forecasting for FY 25 involves multiple factors that will shape your overall growth trajectory and inform your strategic plan. With over twenty years of experience in the cybersecurity sector, I’ve encountered various forecasting models, and I’m excited to share insights that can help you navigate this complex landscape.
Market Growth and New Entrants
In my previous article Selling your cybersecurity business, I noted that the cybersecurity market is growing at approximately 10.5%, which indicates that the overall “cyber pie” is expanding. However, a crucial question arises: How quickly are new entrants entering this market? If their growth rate surpasses 10.5%, we could face challenges. While this growth percentage serves as an average—indicating that some services are experiencing faster growth—achieving more than 10% typically means taking a piece of the pie from your competitors.
We often overlook this gradual market shift until it’s too late. For instance, if you observe that “my privacy business has dropped by 20% YOY” while “our GRC services grew by 30% last year,” you might find yourself with only a net growth of around 10%. Unless the entire privacy market has contracted, it’s likely that a competitor has encroached on your share.
It’s easy to dismiss these market movements as a result of commoditized services or lengthy buying cycles. Some companies may even consider leaving an underperforming market to focus on areas with higher growth potential and margins. However, this strategy can invite even more competition or lead to upmarket migration, where rivals start offering higher-margin services that directly compete with yours.
Sales Forecasting
The leading indicator of revenue is sales—it’s simple: you cannot deliver work that you haven’t sold! Let’s delve into the different types of sales:
- Reoccurring: Clients renew services year over year for similar work and revenue.
- Transactional: These are typically one-time transactions, with minimal assurance of repeat business.
- Multiyear: Contractual services that obligate clients to continue for a specific duration, unless triggered by certain events.
- Adjacent Sales: Additional services/products sold alongside the primary offerings, often referred to as upselling or add-on work.
- Reduction/Lost: Clients who are reducing their spending or switching vendors.
Categorizing these sales types is essential because growth projections must account for both your existing client base and your sales pipeline.
For instance, let’s assume your FY 24 sales for Governance, Risk, and Compliance (GRC) are $15 million, and you expect these services to grow by 20% in FY 25, bringing your target to $18 million.
For GRC, base sales are projected at $7 million, with variable sales exceeding $12 million to achieve the 20% growth target. This means, in reality, you’ll need to replenish your sales by nearly 85%. This starkly contrasts the anticipated 20% growth—an important reality check.
When crafting your FY 25 GRC strategy, carefully consider how you’ll achieve the growth percentage and the resources necessary to meet forecasted variable sales. My article on Chief Revenue Officer offers several structuring examples.
Sales Pipeline
Ideally, your sales pipeline should be three times your forecast. In our FY 25 example, that equates to a projected pipeline of $54 million. Most cybersecurity firms (excluding those focused solely on federal contracts) generally maintain a 50% win/loss ratio, though this often applies only to proposed work. Analyzing the entire pipeline across various stages—lead qualification, discussions, and proposals—usually reveals a closure rate closer to 33%.
Using the categories defined above, you should see a similar distribution in your sales pipeline. Mapping this to the sales stages can provide a clear picture of the gap needed to close the $18 million target.
Sales to Revenue
Conversion from sales to revenue typically hovers around 80% unless you’re exceptionally efficient. The calculation is straightforward: sales divided by revenue equals a percentage. If you’re operating below 80%, it indicates a lag in sales, delivery, and billing. Conversely, if your conversion exceeds 100%, you may not be selling enough to meet capacity demands. It is worth noting that carry-over sales from one fiscal year to the next can also impact these numbers. If you find yourself at or around 100%, it’s a signal to ramp up sales efforts since you’re consuming more resources than you have available!
Alternative Forecasting Methods
Many accounting firms utilize a forecasting method based on personnel—projecting how many new hires are needed and associating a revenue number with each. This approach has its merits; since labor represents one of the highest costs in any organization, aligning revenue expectations with staffing can shift the focus to a revenue-centric model. This method works particularly well in professional services, which is why this article centers on cybersecurity. A well-documented hiring plan can facilitate coordination with other departments, such as HR, enabling timely adjustments to hiring based on performance against forecasts.
However, I advise caution with this approach. Viewing resources as revenue can lead to “over-hiring,” a common pitfall that often results in layoffs every few years among larger accounting firms. This model can stifle innovation and, as discussed in my previous article on pricing, may limit value creation beyond billable hours, as the focus shifts to meeting utilization targets.
Conclusion
In summary, forecasting for FY 25 in the cybersecurity sector requires a nuanced understanding of market dynamics, sales strategies, and pipeline management. As competition intensifies and the risk of upmarket migration increases, businesses must take a proactive stance in their forecasting efforts. By categorizing sales types, accurately assessing the necessary sales pipeline, and effectively converting sales to revenue, organizations can set realistic growth targets. Ultimately, effective forecasting not only prepares businesses for future challenges but also positions them for sustainable growth in an ever-evolving marketplace. Moving forward, leveraging these insights will be vital for seizing opportunities in the cybersecurity domain.
