Finding your attack vector

The sharpest version of your case study

While on paternity “leave”, I’ve been having a fun time testing different attack vectors for Waffle, in ~200 different LinkedIn conversations with potential customers.

Waffle is, if you’re not following along, my bootstrapped startup with happy customers. Problem is, my happy customers don’t seem to be buying what I think I’m selling.

It started out as a tool to “build & manage SOC 2 compliant AWS infrastructure, fast.” But our happiest customers don’t care about SOC 2 compliance - or at most, they think it’s something that will be important to them someday in the future.

I noticed this too as I tried to grow the product. As I did outreach to early-stage B2B founders, they’d all have the same objection: “Yeah we’re trying to avoid getting SOC 2 compliant.” And sure, I could probably convince them - but that’s pushing, and my goal is to find pull.

All of this told me I needed to think about a different attack vector - a different shape of Waffle’s case study.

The “Attack Vector” Concept

For any product and customer, there are many different ways to “frame” a case study. Each different approach is an attack vector - a thesis about what people really want, what we’re going to build, and how we’re going to win.

Let’s take Waffle again. Looking across our customers, our attack vectors could include:

• Build SOC 2 compliant infra

• Get your existing product SOC 2 compliant

• Deploy a SOC 2 compliant VERSION of your product

• Same as above but with HIPAA / GDPR / ISO

• Build on AWS more easily

• Build with ECS Fargate more easily

• Replicate the Vercel/Heroku developer experience in your AWS account

• Build a scalable back-end in one click

• And… more!

This isn’t just a messaging thing, nor is it properly defined as “message-market fit.” It’s the starting point of the case study - the project they’re trying to accomplish and when it is urgent in their lives - around which we design everything else. The project vector we choose dictates our market size, our growth rate, and the intensity of demand we serve.

It represents a choice about what product we’re building, what market we’re targeting. Each is plausible. Each has trade-offs. Each has a different set of competitors. Each has a different go-to-market motion.

Like, think of Rippling vs. Gusto in the payroll space: Gusto’s vector is, “Make payroll delightful.” Rippling’s vector is, “Automate payroll and back-office tasks away.” In my opinion, Rippling’s vector beats Gusto’s 9 times out of 10 - and leads to a totally different product.

How, then, should I choose Waffle’s attack vector? I’m thinking about choosing exclusively based on pull: In a bunch of different conversations with B2B founders, see which project vector gets people to try to buy.

(Or you could just respond to this email and tell me which to pursue. Maybe I’ll just YOLO it.)