Stacy Shelley has spent most of his professional life selling an awkward commodity: confidence. Cybersecurity vendors deal in alarms, intrusions, disappearing data, and expensive possibilities. Their buyers are trained to suspect easy answers. Shelley likes them for precisely this reason. Security people, he once explained, are smart, skeptical, and burdened with trust issues. A lesser marketer might hear a complaint. He heard the job description.
That job has carried him from the post-antivirus years of the early 2000s through Secureworks, PhishLabs, and Fortra. The logos changed. The market went from a relatively compact trade to a thicket of platforms, acronyms, and overlapping promises. Shelley's recurring assignment stayed remarkably plain: decide who the product is for, give the category a usable shape, and build enough credibility that a suspicious buyer will lean closer.
The numbers are tidy in hindsight. At Secureworks, Shelley was part of the run from roughly $15 million to more than $100 million in annual recurring revenue before Dell acquired the company. At PhishLabs, where he led marketing from 2013 to 2021, revenue grew from under $2 million to $26 million before Fortra bought it. At Fortra he led marketing for a digital risk and email protection portfolio above $200 million in ARR. Careers never feel tidy while they are happening, of course. Their neatness is an editorial privilege.
Learning the suspicious room
Shelley entered information security through LURHQ and then Secureworks, before cybersecurity became what he calls a cottage industry unto itself. He was not merely arranging copy around products. By 2015, his remit included understanding emerging security trends and their impact on information-security leaders. He spoke about network security, web application security, compliance, and threat intelligence. Marketing, in this corner of technology, required enough technical fluency to know when a sentence was cheating.
Former Secureworks colleagues remembered both the language and the labor. Yoshee Sodiq credited Shelley with positioning, strategy, and shaping the company's voice. Steele Hays called him a key leader and a “workhorse” during the company's rapid growth. The compliment is worth pausing over. Brand building is often photographed at launches and conferences. Most of it occurs in the far less glamorous interval when a team argues over the right noun.
“Be more than a reference, like be an actual resource.”Stacy Shelley, Content Amplified
At PhishLabs, the work acquired startup dimensions. Shelley says he built the go-to-market function across category creation, analyst relations, account-based marketing, demand generation, and team development. Those disciplines sound separate on an organization chart. In a growing company they are one argument made in several rooms. The analyst must recognize the category, the salesperson must trust the message, and the buyer must see a problem described with uncomfortable accuracy.
PhishLabs also made the abstraction of “market education” unusually concrete. Its services dealt with phishing, account takeover, malicious infrastructure, and the patient business of disrupting attacks. Buyers were not shopping for a cheerful novelty. They were deciding whether an outside company understood adversaries well enough to protect a bank, a brand, or a workforce. Shelley helped translate the threat researchers' view of the world into an executive reason to act. The task required restraint. Fear is plentiful in security; durable differentiation is not.
Two growth journeys · ARR
Bar lengths share a $100M scale.There were less comfortable tests of that voice. In 2017, after an online post claimed to offer a PhishLabs customer list, Shelley became the public speaker for an investigation still in progress. He did not manufacture certainty. He said no evidence had been found that client systems or data were compromised, explained that log analysis and forensics would take time, and insisted the company wanted complete confidence in the answer. It was crisis communication by subtraction: state what is known, name the work underway, and stop.
A universe of 5,000
One of Shelley's revealing marketing metrics is not large. At one company, his team kept a list of about 5,000 target accounts. “That was our universe,” he recalled in a 2026 interview. Broad search traffic could be counted by the thousands, but the enterprise buyers that mattered were not discovering security vendors through generic Google searches. They read research reports, listened to peers, and arrived at a vendor's website well after the first impression.
This led to a useful act of renunciation. The website did not have to be the whole journey. It had a narrower assignment: make a memorable second or third impression on somebody already qualified to care. Awareness was happening elsewhere, in professional communities, social channels, Slack groups, Discord servers, reports, events, and conversations the vendor could not commandeer with a keyword spreadsheet.
“We had a list of about 5,000 accounts that were our universe. That was the traffic we cared about.”Stacy Shelley on measuring the audience that could buy
There is a sly severity to this view. It removes the consolation prize. A million irrelevant visitors cannot hide the absence of a hundred relevant ones. The old content mill offered marketers a seductive industrial bargain: reassemble familiar information, aim at a popular query, and let the dashboard throw a small parade. Shelley describes it more tartly as trying to “out-algorithm your opponent.” AI has made the weakness obvious. When ten articles contain the same rearranged answer, a machine needs to show the reader only one summary.
His alternative sounds almost quaint: create something new. Challenge the buyer's thinking. Be present where the audience already learns. Measure engagement from the accounts that belong in the market. This is not a rejection of content or search. It is a demand that each earn its keep.
The title disappears; the tools appear
In February 2026, Shelley's position at Fortra was eliminated. His public note did not pretend the transition was pleasant. The years had been challenging and frustrating, he wrote, and also exciting and rewarding. He thanked the people he led, encouraged colleagues still at the company to keep fighting, and said he hoped to handle membership in the layoff club with the dignity and perseverance he had seen others display.
Fortra had been a different exercise in scale. Shelley arrived through the PhishLabs acquisition and moved from marketing one growth company to coordinating a portfolio of digital-risk and email-protection products. The work after a deal is less cinematic than the announcement. Brands overlap. Teams inherit new reporting lines. Customers need continuity while the company seeks coherence. Shelley counts M&A integration among his core disciplines, alongside category creation and analyst relations, because the story must survive the transaction as surely as the software does.
Then came a revealing change in medium. Shelley began publishing free, open-source tools. One lets a cybersecurity marketing team build a branded ROI calculator through a five-step interface, define inputs and formulas, and place the finished calculator on a landing page with a script tag. A sales version lets a representative develop the numbers with a prospect and leave behind a PDF or PowerPoint. A competitive-intelligence tracker watches changes to competitor sites, pricing, hiring, reviews, executive announcements, and community chatter, then uses AI to classify the signals.
Cybersecurity ROI Calculator Builder
The calculator is a small proof of Shelley's larger thesis. Many vendors have promised operational efficiency in hundreds of decks. He removed a developer queue. The configuration lives in the embed itself rather than a remote database. Marketers can inspect the formulas, alter the assumptions, and host the widget on their own infrastructure. The result is usefulness one can download.
The next build
Shelley now describes himself as a GTM partner, available for fractional and advisory work while open to CMO and vice-president roles at cybersecurity companies ready to scale. The phrase “ready to scale” carries more conditions than its cheerful cadence suggests. His preferred range is the build-out phase, when a company has enough proof to deserve a market and enough ambiguity to need one. He likes teams between roughly $5 million and $100 million in revenue, where category, culture, pipeline, and positioning are still being poured into the same foundation.
He brings two acquisitions to that search, but the exits are not the entire tale. Plenty of people can arrive after a category has hardened and buy attention inside it. Shelley's specialty is earlier and messier: giving the category edges, aligning the company around a credible claim, and finding the small population for whom that claim has immediate consequence.
The setting suits the moment. His personal photograph was taken at Moore Cove Falls in Pisgah National Forest, near Asheville, with water dropping brightly behind him and no lanyard in sight. After years of portfolios and integrations, the next chapter looks deliberately hands-on. Build the tool. Publish the conviction. Watch the actual accounts. If a security buyer remains skeptical, good. At least the right person is in the room.