How to market a complex SaaS product to people who don't know they need it

Why is a complex SaaS product so hard to sell?

Businesses rarely act on cyber risk until something goes wrong. Cybersecurity works like a seat belt: it feels unnecessary right up to the moment you need it. Most awareness material makes this worse. It explains threats in general terms, and people sit through it without ever feeling that it could happen to them.

If your product is as complex as cybersecurity, marketing it is an uphill climb. First you have to get the customer to understand that they need it, and why it is urgent. Only once that has landed can you start to sell your specific solution.

That was my job at StrongKeep. Before I could talk about the product, I had to answer a different question: how do you make a risk feel real before it becomes real?

Why didn't the usual SaaS marketing playbook work?

I started with research. Almost every playbook for marketing a complex product says the same things: educate your audience, find interesting ways to tell the story, go to events, use founder-led content, thought leadership etc. These playbooks give you a general overview of what to consider. But most problems are specific, and you can apply as much of that general advice as you like without solving yours, because it was never tailored to the issue you are actually facing.

None of them dealt with my actual problem. My audience did not understand why they needed the product, or how exposed they were. Most of those tactics assume the reader already sees the problem and is choosing between solutions. Mine weren't there yet. In Eugene Schwartz's stages of awareness, they were unaware. So the task was not to convert them. It was to move them one step, from unaware to problem-aware.

How do you sell a product that people only need when things go wrong?

To find a way in, I zoomed out to see what I was actually being asked to sell: insurance. It isn't exciting and you don't see it working every day. It is a safety net that is there when things go wrong.

For instance, an insurance salesperson never opens with the returns. They open with "How many children do you have?" and "Who looks after them if something happens to you?" They make you picture the problem in your own life first. I could not see why a conversation about cyber should be any different.

So I proposed a different approach. Instead of telling people about an attack, let them make the decisions inside one and feel what it is like to be hacked. You play the person in charge. You choose what to do, and only then do you see what that choice cost.

Why were the games effective?

1. Every game is a real case

Each one is built on a public record: a police release, a court case or news reporting of a regulator's findings. I did not want the games to look like an experience invented to win you as a client. Real stories make them authentic and give them a reason to exist beyond being a conversion tool.

2. Only real numbers

If a figure was never made public, the game does not claim one. In The Morning, the ransom amount was never disclosed, so the game never states it. The numbers carry the message because they are not estimates. This happened, the way you are playing it.

3. The reader decides before seeing the outcome

This is the whole mechanism, and no storytelling idea was allowed to override it. If a player makes the wrong call, they made it themselves. That is the point: when it happens to you, you won't know what to do either.

4. No jargon on the first two screens

If someone has to ask what a term means, they have already stopped playing.

5. No real person or company is named, even where the source names them

The people in these cases were victims, and the games protect their identity.

Decision 1 of 4

The three games

Each takes a few minutes, needs no technical knowledge and works on a phone or a laptop.

• 
  The MorningYou own a Singapore eye clinic, and your patient records have been locked by ransomware. Based on a 2021 case reported in the press, in which 73,466 patient records were affected.Play on StrongKeep ↗
• 
  Everything Checked OutA family business discovers a customer has been paying a fraudster for months. Based on a US Department of Justice case.Play on StrongKeep ↗
• 
  The RestructuringA finance director receives a payment instruction on a video call with his CEO. Based on a 2025 Singapore Police Force release involving USD 499,000.Play on StrongKeep ↗

What happened next?

In October 2026, StrongKeep published the three games on its free tools page for Cybersecurity Awareness Month.

In summary: what made the games work?

Four things, and each one does a job that a sales pitch cannot.

• AuthenticityReal cases and real numbers mean the reader cannot dismiss it as marketing.
• Time pressureEach game runs on a clock: The Morning across one working day, from 07:34 to 16:30; The Restructuring across four days; Everything Checked Out across the 96 days no money arrived. Decisions feel urgent, as they would in a real attack.
• The reader decides and lives with itThe lesson comes from their own choice, not from being told.
• Protecting the people involvedNobody is named, so the focus stays on the decision, not on blaming a victim.