How to measure what happens between exposure and form fill without pretending attribution is perfect.

Article Summary

Most B2B cybersecurity buyers complete 70-80% of their evaluation before contacting a vendor, through channels attribution software can't track. Stop chasing perfect attribution. Instead, build a measurement system using branded search trends, self-reported attribution, dark funnel influence overlays, and content signal correlation to guide smarter budget decisions.

Your attribution dashboard says the webinar drove 40 leads last quarter. Your branded search is up 18%. Direct traffic conversions are climbing. Everything looks healthy.

But here's the problem: those numbers are telling you what happened at the finish line. They're not telling you what happened during the race.

A CISO watches your webinar panellist speak at RSA. She mentions your brand to a peer in a private Slack channel. That peer Googles your company name three weeks later, reads a G2 review, and forwards your case study to a colleague. The colleague fills out a demo request form. Your CRM credits "organic search."

Everyone involved would tell you the webinar started it. Your dashboard would disagree.

This gap between what actually influences a deal and what your analytics can track has a name. And most cybersecurity marketers aren't measuring it properly, if they're measuring it at all.

Key Takeaways:

• Branded search volume, direct traffic spikes, and self-reported attribution are your best proxy signals for measuring dark funnel activity that software attribution will never see.
• Stop optimizing for trackable channels alone. The channels that "perform best" in your attribution report are often just the ones easiest to measure, not the ones creating demand.
• Build a four-layer measurement system (leading indicators, self-reported attribution, dark funnel influence overlays, content signal correlation) that acknowledges what it can't track instead of pretending last-click tells the full story.

What the dark funnel actually is

The dark funnel refers to every part of the buyer journey that happens outside your trackable marketing channels. Peer recommendations in private Slack groups. Conversations at industry meetups. Reddit threads where someone asks which threat intelligence vendor is worth the budget. LinkedIn DMs where a security engineer sends your report to a procurement lead. AI search queries where a buyer asks ChatGPT to compare endpoint detection platforms.

None of these interactions trigger your CRM or fire a tracking pixel. Research consistently shows that 70 to 80 percent of the B2B evaluation process happens in exactly these spaces.

For cybersecurity marketing, the dark funnel is arguably even larger. Security professionals are sceptical of vendor messaging by nature. They trust peer validation over branded content. They research in private channels precisely because they don't want to be retargeted the moment they show interest.

According to 6sense's 2025 research, 94 percent of buying groups rank their shortlist before initiating contact with sales, and the vendor ranked first wins 77 percent of the time. The game is largely over before your form fill happens.

And now AI search has made it worse. Buyers ask ChatGPT or Perplexity to compare vendors, form shortlists based on AI-generated summaries, and then arrive at your site via branded search. Your analytics logs this as "direct" or "organic branded." The actual moment demand was created is invisible.

Branded search, direct traffic, and self-reported attribution

If you can't directly track the dark funnel (and you can't, by definition), you need proxy signals. Three of them are worth paying serious attention to.

Branded search volume is the most underrated signal in your analytics. When someone types your company name into Google, they already know who you are. Something made that happen, and it wasn't SEO. It was awareness generated through channels you can't attribute: a podcast appearance, a peer recommendation, a conference talk, an AI search result.

Correlate branded search volume against your marketing activities. If you sponsor a webinar series in Q2 and branded search ticks up in Q2 and Q3, that's directional evidence. Not proof. But far more honest than last-click attribution pretending the Google ad that captured the query "caused" the conversion.

Direct traffic patterns work similarly. Not all direct traffic is dark funnel activity, but unexplained spikes often are. Someone shared your link in a private Slack channel. UTM parameters got stripped. If direct traffic spikes after a podcast episode or conference talk, that's signal, not noise.

Self-reported attribution is the simplest and most powerful tool you're probably not using well enough. Add a required free-text field to your high-intent forms: "How did you first hear about us?" Not a dropdown. A free-text field. Dropdowns push people toward the first option. Free text forces them to think, and it surfaces answers your dropdown would never include: "my colleague forwarded your email," "someone mentioned you in a CISO forum," "I saw your analyst on a panel at Black Hat."

Self-reported attribution has real limitations. People are subject to recency bias: they remember the last touchpoint, not the first. The person filling out the form isn't always the person who drove the buying decision. And the phrasing tends to be vague: "Google" could mean branded search, a paid ad, or organic results.

But directionally, it's far more revealing than software attribution alone. Blend what your software tells you with what your buyers tell you. Neither source is complete, but together they give you a much more honest picture.

What to stop obsessing over

This is the harder conversation. If you accept that most of the buying journey is invisible, some of your current metrics become less useful than you think. Not useless. Less useful.

Stop treating last-click attribution as truth. In a typical enterprise cybersecurity deal, there might be 30 to 50 marketing touchpoints before that final form fill. Last-click credits exactly one of them. You already know this is wrong. Act on it.

Stop optimizing solely for trackable channels. When your attribution model can only see 20 to 30 percent of the buyer journey, the channels that "perform best" are often just the channels that are easiest to measure. Paid search captures demand. It rarely creates it.

Stop conflating lead volume with pipeline quality. Someone who downloads a threat report for a board presentation is not the same as someone who watches your webinar, reads two case studies, and asks a peer about your platform in a private channel. The second person is far further down their buying journey. Your attribution model might not even know they exist.

Stop chasing perfect attribution. The compulsion to attribute every conversion to a specific touchpoint is incompatible with a world where the most influential touchpoints are invisible. The shift is from "what drove this conversion?" to "are we present and accurately represented in the places where decisions are being made?"

This doesn't mean you throw your dashboard away. It means you hold it with appropriate scepticism. Use it as one input among several. And build a measurement approach that acknowledges what it can't see.

A practical dark funnel dashboard

So what should you actually track? A four-layer framework.

Layer 1: Leading indicators (monthly). Track branded search volume and direct traffic trends month over month. Monitor mentions in observable community channels. If you have access to intent data platforms like Bombora or G2, track which target accounts are researching your category before they've engaged with you directly.

Layer 2: Self-reported attribution (ongoing). Add a free-text "how did you hear about us?" field to every high-intent form. Review and categorize responses monthly. If "podcast" or "peer recommendation" or "conference" keeps appearing, that's where demand is being created. Supplement with closed-won deal interviews: have sales ask "where did you first hear about us?" and log answers in your CRM.

Layer 3: Dark funnel influence overlay (quarterly). For every closed-won deal, check which dark funnel signals were active 30 to 90 days before conversion. G2 intent activity? Branded search spikes? Community or event mentions? Over time, this builds a model of dark funnel pipeline influence you can present alongside standard attribution.

Layer 4: Content signal correlation (quarterly). Track which content assets accounts consume before converting. If accounts that close tend to have visited your pricing page, read a case study, and attended a webinar in the 90 days prior, those assets are contributing, whether or not the attribution model gives them credit.

The goal isn't a dashboard that tells you exactly which dollar drove which deal. That dashboard doesn't exist. The goal is a measurement system honest about what it can see and useful enough to drive better decisions than last-click alone.

Most cybersecurity marketers know attribution is broken. They say it in meetings. They complain about it on LinkedIn. And then they go back to optimizing for the metrics their tools can track, because those are the numbers leadership asks for.

The dark funnel isn't going away. Buyers will continue researching in private. AI search will continue stripping attribution from the discovery process. Peer recommendations will keep happening in channels your pixels can't reach.

The marketers who adapt won't be the ones who figure out how to track everything. They'll be the ones who build measurement systems that account for what they can't track, and who have the confidence to defend budget for activities that influence pipeline even when the dashboard can't prove it.

That takes a different kind of conversation with your leadership team. But it's a conversation worth having, because the alternative is optimizing for a reality that no longer exists.