On 22 September 2022, Optus told Australia it had been breached, and records belonging to up to 9.8 million people were in someone else's hands. Within nine weeks, parliament had lifted the maximum penalty for serious privacy breaches from $2.22 million to $50 million. A reform that had idled for years moved at the speed of a news cycle.
That is what a trigger does, and it is the honest model of how security gets bought. Nobody at the company you want woke up last Tuesday wanting a new vendor. Then something happened: a breach in their industry, a board paper due, a renewal notice with new questions in it. A budget that did not exist at nine existed by lunch.
Most of your market is asleep
John Dawes at the Ehrenberg-Bass Institute put a number on this in 2021: at any given time, about 95 per cent of business buyers are not in the market for what you sell. They are not weighing you against a competitor. They are not reading comparison pages. They are doing their jobs, and they will keep doing their jobs until a trigger interrupts.
Marketing that ignores the 95 per cent spends its budget telling them to hurry up. It reads as noise because it is noise. The ASD counts a cybercrime report roughly every six minutes, and your buyer has been told the sky is falling, by every vendor, for a decade. Fear is not a trigger. Fear is wallpaper.
The triggers that open Australian budgets
The loudest one is a breach close to home. Optus and then Medibank put a question into every boardroom in the country: could that be us? A threat that had lived in the risk register as an abstraction became a colleague's company on the evening news. Whoever is already in the room, or already in the CISO's head, when that question gets asked wins the quarter.
The rest run on calendars, which is better news than it sounds, because calendars can be learned. A board risk review with a date on it. A cyber insurance renewal arriving with attestation questions the last renewal never asked. A regulator's deadline: APRA's CPS 230 took effect on 1 July 2025, and the obligations under the SOCI Act keep widening. And the financial year itself, when unspent money looks for a home before 30 June and next year's line items are argued over in May.
None of these moments is about your product. Every one of them is about your buyer's week. That inversion is the whole discipline.
Being there before the moment
You cannot schedule someone else's trigger. You can only be the name that surfaces when it fires, and names surface because of work done in the long months when nobody was buying anything. The articles a buyer half-remembers. The roundtable where they met you. The feed where your founder keeps turning up with something worth reading. Ehrenberg-Bass calls the asset mental availability. A CISO calls it 'the first firm I thought of'.
Then map the plays, account by account. Who renews when? Which regulator owns them? When does their board cycle run? Write a planned follow-up for each trigger: the call in the week the news breaks, the briefing offered before the board paper is due, the note in May when budgets are being argued. It is less a funnel than a calendar with names on it.
The next Optus-sized moment is already in the post. Nobody knows the date, only that a board will turn to its security team and ask what to do, and that the answer will include a company's name. The whole game is being that name.
