Fortivex × Outbound Empire :
816K€ d'ARR auprès des RSSI en 9 mois.

Chaque RSSI d'Europe a reçu le même email.

DORA — the EU's Digital Operational Resilience Act — entered full application in January 2025. Overnight, every bank, insurance company and fintech with EU operations had a hard compliance deadline and a gap analysis that most could not fill internally. The demand signal was enormous.

So was the noise. Every cybersecurity vendor in Europe pivoted their pitch to DORA within 90 days. CISOs went from receiving 5 vendor emails per week to 50. The entire channel was flooded with "DORA compliance" subject lines, templated risk matrices, and identical decks. Response rates across the industry collapsed to near zero.

Fortivex had the product — a genuinely differentiated pentest-plus-vCISO offering built specifically for Article 26 ICT risk management requirements. But Marc and his team were engineers, not salespeople. Their pipeline was three warm introductions and a lot of waiting. The brief: break through the noise, get in front of the real decision-makers, and close 20 contracts in under 12 months.

Outbound Empire comme moteur d'échéance réglementaire

We started April 2025 — three months after DORA took effect, when the initial frenzy had peaked and CISOs were sorting through the aftermath. Our angle: not "DORA compliance" as a feature, but gap-specific targeting. Each email identified one specific DORA article the recipient's institution was likely failing on, with evidence.

Pourquoi ça a fonctionné

Specificity destroyed the noise. Every other vendor sent "DORA compliance" emails. We sent "Your Article 26 ICT third-party risk gap, based on your last two disclosed incidents" emails. CISOs replied because we had clearly done the work.

The scorecard was the sales call. Recipients who downloaded the 1-page ICT risk scorecard had already self-diagnosed their problem by the time they booked a call. Average time from first reply to signed contract: 19 days.

Reference clients wrote our copy. The anonymised audit summaries we published under the names of early clients generated inbound replies from prospects who had never been in our sequences — they found the articles via LinkedIn search. 2 contracts came from entirely inbound leads generated by outbound content.