.png)
"In cybersecurity, everyone talks about building partner channels. Almost no one actually activates them. Spear gave us a way to get into the field, fast — without waiting for introductions that never come."
CEO & Co-Founder, ARMO
About Armo
ARMO is a cloud-native security company that helps organizations secure applications running in cloud and Kubernetes environments. Its platform combines cloud security, Kubernetes security, vulnerability management, and runtime threat detection into a single solution. ARMO uses eBPF-based behavioral analysis to learn how applications normally operate and then detects suspicious activity, misconfigurations, vulnerabilities, and potential attacks in real time. The company is also the creator and maintainer of Kubescape, a widely adopted open-source Kubernetes security project. ARMO’s flagship Cloud Application Detection and Response (CADR) technology provides code-to-cloud visibility, helping security and DevOps teams prioritize the most critical risks, reduce alert fatigue, investigate incidents faster, and protect cloud workloads from both known and emerging threats
The challenge
When ARMO signed an OEM agreement with Rapid7 in early 2026, the deal looked like a growth unlock on paper. Rapid7 had embedded ARMO's runtime security technology into their new platform, which meant every new Rapid7 deployment would generate revenue for ARMO. The math was compelling, but the math only worked if Rapid7's sales organization actually knew what they were selling.
That was the problem. Rapid7 had hundreds of account executives, sales engineers, sales directors, and regional managers spread across the US and Europe. Most of them had spent their careers selling legacy network security and vulnerabilities management products. Cloud Runtime security was a new domain, one of many products and features Rapid7 has. As Jonathan Kaftzan, ARMO's Head of Partnerships, described it: the legal work was done, the partnership was signed – now the real work begins"
“Usually what happens in these kinds of deals is that you sign a paper with a channel partner, but then nothing happens. The only way for things to happen is if you're starting to engage in the field – the salespeople of that reseller, of that channel, or that technology partner – and working with them in order to sell you as the cybersecurity vendor."
The conventional path – going top-down through Rapid7's product and sales leadership and waiting for introductions to trickle down – would have taken months. And critically, ARMO couldn't reach Rapid7's customers list directly. Bypassing a partner's reps to cold-contact their accounts is the kind of move that kills relationships before they start. ARMO needed a way to reach hundreds of salespeople quickly, build genuine familiarity, and turn passive reps into active internal champions, without stepping on anyone's territory.
ARMO had been using Spear since July 2025 for direct outbound: conference and webinars leads, website visitors, Kubescape open source community members. The results were solid. But this was a different problem entirely.
“Spear created a shortcut for every salesperson in Rapid7.”
The solution
In January 2026, Jonathan launched a coordinated, multi-layer campaign through Spear targeting every segment of the Rapid7 ecosystem – not as cold outreach, but as partner enablement at scale.
The strategy ran two tracks simultaneously:
Rapid7 salespeople. ARMO's own reps reached Rapid7's account executives and sales engineers directly, with a message built on shared context: you're already in the accounts where Cloud and Kubernetes security is a gap. ARMO gives you the layer that completes the story. The goal wasn't to book demos, it was to create internal champions who would introduce ARMO to the accounts they already owned.
MSSPs and channel resellers. Managed security service providers who distribute Rapid7 were approached with a partner value proposition: add Rapid7 & ARMO to your offering, differentiate your stack, open a new revenue line.
What made the approach work wasn't volume, it was relevance. Because every message started from a shared reference point (the Rapid7 relationship, the new platform, the runtime gap), recipients had a reason to respond that didn't exist with a generic cold outreach. Spear handled the sourcing, targeting, and sequencing; Jonathan handled the conversations.
"Spear offered me an option to reach as many Rapid7 salespeople using LinkedIn, to make those introductions, to schedule those training sessions directly. I kind of created a shortcut to every salesperson in Rapid7 using Spear."
The timing mattered too. Spear's trigger-based approach meant outreach went out when prospects were visibly active – posting on LinkedIn, announcing new roles, engaging with relevant content. A message that arrives when someone is already thinking about a topic lands differently than one that interrupts.
"Spear gave us a way to run a proper partner motion without a full partner team. We know exactly who we're reaching inside Rapid7 and why."
The impact
The standout result was the Rapid7 salesperson campaign: 297 people contacted, 232 (78.1%) connections made, 142 (47.9%) replies, and 23 meetings booked – all from a single campaign targeting a partner's internal team. It was the highest-engagement campaign ARMO ran across any segment or time period.
Across all partner campaigns combined, the numbers tell the story:
- 967 people reached across all partner campaign tracks
- 403 LinkedIn connections made – a 41.7% connection rate
- 166 replies across all Rapid7 outreach
- 8 meetings booked directly from Rapid7 campaigns
- 4 active partner campaign tracks running in parallel by April 2026
For context: average LinkedIn outbound reply rates typically sit in the 3–5% range. The salesperson campaign ran at nearly 10x that.
The broader significance is what ARMO built in under six months: a functioning partner-led pipeline motion running alongside their direct outbound, reaching enterprise accounts that would have been inaccessible through cold approaches alone. A Fortune 1000 CISO is hard to reach cold. The Rapid7 account executive who already has the relationship is not.
These successful partner campaigns were within the context of 48 meetings booked across all outbound campaigns.
The ARMO case points to something applicable well beyond their specific situation. In cybersecurity, most go-to-market strategies eventually depend on channels like resellers, VARs, integrators, technology partners. The standard failure mode is that partnerships get signed and then stall, because there's no mechanism to actually engage the field. What ARMO proved is that LinkedIn-native outbound, run with the right targeting and context-first messaging, can serve as that mechanism: a way to get to the people who hold the relationships, at scale, without stepping over the partnership itself.
Spear is a trigger-based, human-led outbound platform designed to create real pipeline. getspear.ai
