Problem Definition
CyberVault is a managed detection and response (MDR) cybersecurity company based in Austin, Texas. The company provides 24/7 threat monitoring, incident response, and vulnerability management to mid-market businesses with 500 to 5,000 employees. Founded six years ago, CyberVault has grown rapidly and now generates $45 million in annual recurring revenue, up 60% year-over-year, serving approximately 380 clients.
The company recently closed an $80 million Series C round. Its investors have set an ambitious target: reach $200 million in ARR within three years while demonstrating a credible path to profitability by Year 3. CyberVault's current quarterly burn rate is $8 million, and the leadership team knows that simply maintaining the status quo will not be enough --- growth will naturally decelerate as the company saturates its current segment.
The CEO faces a strategic fork with three distinct paths. First, she can pursue enterprise clients with 5,000+ employees, where average contract values are three times higher but sales cycles stretch to 8+ months and competition from incumbents like CrowdStrike and SentinelOne is fierce. Second, she can expand downmarket to SMBs with fewer than 500 employees, where the addressable market is enormous but per-customer revenue is much lower and the go-to-market motion requires building an MSP partner channel from scratch. Third, she can pursue geographic expansion into Europe, where MDR adoption is accelerating and regulatory tailwinds (NIS2, DORA) are driving mandatory cybersecurity investment.
Each path demands different capabilities, capital allocation, and organizational changes. The board has made clear that a "do everything" answer is not acceptable --- they want a prioritized, sequenced plan with clear resource commitments. Your task is to evaluate these growth paths and recommend a strategy to reach $200M ARR in three years.
Additional InformationAsk for more dataHide data
Share if the candidate asks relevant questions:
- CyberVault employs 280 people, including 35 mid-market sales reps with a proven playbook: 12-week average sales cycle, 28% win rate
- Net revenue retention (NRR) for mid-market clients is 118%, driven by upselling threat intelligence and compliance modules
- Enterprise NRR is 94% --- clients that stay tend to negotiate fixed-price contracts with limited expansion
- Enterprise accounts require dedicated SOC analysts (1 per 3 accounts), driving higher delivery costs
- Mid-market accounts share pooled SOC resources (1 analyst per 15 accounts)
- The company has no European legal entity, no GDPR-specific product certifications, and no local language support
- CyberVault's platform currently integrates with 40+ security tools; enterprise clients often require custom integrations with legacy SIEM systems
- The SMB channel opportunity is primarily through managed service providers (MSPs), which would require a partner program CyberVault has not yet built
Question 1Structuring
Prompt: "How would you structure your approach to evaluating CyberVault's growth options and recommending a path to $200M ARR?"
Hint · Structuring
Build 3–4 branches that are specific to this client and question, not a generic framework. Check they don't overlap and together cover the problem.
Try it first, then checkShow model answerHide model answer
A strong framework would include three workstreams:
- Unit Economics Assessment --- Compare LTV-to-CAC ratios across segments, factoring in gross margins and churn. Identify which segment generates the most gross profit per dollar of sales investment.
- Growth Math --- Model the path to $200M under each scenario. How many net new customers per quarter? What retention rate is required? Does NRR from the existing base contribute meaningfully?
- Execution Feasibility --- Evaluate the organizational investment required (new hires, certifications, legal entities, partner programs) and the timeline to first revenue in each option.
The candidate should signal early that they want to look at churn alongside ACV, setting up the insight they will uncover in the exhibits.
What the interviewer is looking forShow guidanceHide guidance
Good: Candidate lists standard growth levers --- new customer acquisition, geographic expansion, product expansion, pricing --- and applies them to each of the three options. Framework is logical but generic. Candidate may default to a standard market entry framework without tailoring it to a recurring-revenue SaaS business.
Strong: Candidate builds a structured evaluation matrix with explicit criteria: (1) unit economics by segment (ACV, churn, CAC, LTV), (2) total addressable market and realistic penetration rates, (3) competitive intensity, (4) execution complexity and time-to-revenue. Recognizes that the 3-year timeline creates urgency --- some options may not generate meaningful revenue within the window. Explicitly calls out that churn matters as much as acquisition in a recurring-revenue model.
Excellent: Candidate frames the problem as a capital allocation decision, not just a market selection exercise. Asks: "Given $80M in fresh capital and a $32M annual burn, how should each dollar be deployed to maximize the probability of hitting $200M?" Identifies that the interaction between ACV and churn is the critical variable --- a high-ACV segment with high churn could be worse than a lower-ACV segment with strong retention. Notes that NRR above 100% means existing mid-market clients are a growth engine in themselves and should be quantified before evaluating new segments.
Interviewer Tips
- If the candidate immediately jumps to "enterprise because higher ACV," push back: "What else would you want to know about enterprise customers before recommending that path?"
- If the candidate asks about churn by segment, share the churn figures and watch whether they connect it to ACV. This is the key diagnostic moment.
- If the candidate asks about existing customer expansion, share NRR data --- this separates strong candidates who understand SaaS economics from those applying generic frameworks.
Question 2Numeracy
Prompt: "The VP of Sales wants to compare two investment scenarios. CyberVault has $9 million in incremental sales budget to deploy over the next year. Using Exhibit 1, calculate how many new customers this budget can acquire in the mid-market versus enterprise segments, and then estimate the 3-year cumulative gross profit from those new customers for each option."
Hint · Numeracy
Write the formula before you plug in numbers, keep units and zeros explicit, and sanity-check the order of magnitude at the end.
Exhibit 1Customer Segment Economics
| Metric | SMB (<500 emp.) | Mid-Market (500-5K) | Enterprise (5K+) |
|---|---|---|---|
| Average ACV | $40K | $120K | $360K |
| Gross Margin | 60% | 70% | 55% |
| Annual Churn Rate | 20% | 8% | 24% |
| Customer Acquisition Cost | $20K | $60K | $180K |
| Avg. Sales Cycle | 30 days | 90 days | 240 days |
| Net Revenue Retention | 104% | 118% | 94% |
| US Addressable Companies | 180,000 | 28,000 | 4,500 |
Source: CyberVault case file
Try it first, then checkShow model answerHide model answer
Calculation
Part A: Customer Acquisition
| Segment | Budget | CAC | New Customers Acquired |
|---|---|---|---|
| Mid-Market | $9M | $60K | 150 |
| Enterprise | $9M | $180K | 50 |
Part B: Annual Gross Profit per Customer
| Segment | ACV | Gross Margin | Annual GP per Customer |
|---|---|---|---|
| Mid-Market | $120K | 70% | $84K |
| Enterprise | $360K | 55% | $198K |
Part C: 3-Year Cumulative Gross Profit (accounting for churn)
Mid-Market (8% annual churn, 92% retention):
| Year | Surviving Customers | Gross Profit |
|---|---|---|
| 1 | 150 | $12.6M |
| 2 | 150 x 0.92 = 138 | $11.6M |
| 3 | 138 x 0.92 = 127 | $10.7M |
| Total | $34.9M |
Enterprise (24% annual churn, 76% retention):
| Year | Surviving Customers | Gross Profit |
|---|---|---|
| 1 | 50 | $9.9M |
| 2 | 50 x 0.76 = 38 | $7.5M |
| 3 | 38 x 0.76 = 29 | $5.7M |
| Total | $23.1M |
Key Insight
Mid-market generates 51% more 3-year gross profit ($34.9M vs. $23.1M) from the same $9M investment.
The hidden trap: Revenue lifetime value is actually identical for both segments:
| Segment | ACV | Churn | Revenue LTV (ACV / Churn) |
|---|---|---|---|
| Mid-Market | $120K | 8% | $1,500K |
| Enterprise | $360K | 24% | $1,500K |
The enterprise segment's 3x ACV advantage is perfectly offset by its 3x higher churn rate. Once you layer in lower enterprise gross margins (55% vs. 70%) and 3x higher CAC, mid-market is the decisively superior investment.
LTV-to-CAC comparison:
| Segment | GM-Adjusted LTV | CAC | LTV / CAC |
|---|---|---|---|
| Mid-Market | $1,500K x 70% = $1,050K | $60K | 17.5x |
| Enterprise | $1,500K x 55% = $825K | $180K | 4.6x |
The mid-market LTV-to-CAC ratio is nearly 4x higher than enterprise. A candidate who anchors on ACV alone will miss this entirely.
Bonus for strong candidates: Factoring in mid-market NRR of 118%, the surviving mid-market customers actually grow their ACV over time, widening the gap further. Enterprise NRR of 94% means enterprise revenue erodes even faster than the churn math alone suggests.
What the interviewer is looking forShow guidanceHide guidance
Interviewer Tips
- Allow the candidate to set up the calculation themselves. If they ask which segments to compare, say "the VP is most interested in mid-market versus enterprise."
- A good candidate will compute Part A and Part B quickly, then pause to think about how churn compounds. If they forget churn, prompt: "Are these customers all still paying in Year 3?"
- The best candidates will proactively compute LTV/CAC ratios and identify the identical revenue LTV without prompting.
Question 3Judgement & Insights
Prompt: "The CEO is excited about the enterprise segment because of the $360K ACV and has pointed to the 4,500 addressable enterprise companies in Exhibit 1. She also notes that CyberVault already has a handful of enterprise clients. Looking at all three exhibits, what would you tell her?"
Hint · Judgement & Insights
Read the exhibit title, axes and units first. Lead with the ‘so what’, then back it with one or two numbers.
Exhibit 2MDR Competitive Landscape (US Market)
| Company | Primary Segment | Est. Market Share | ACV Range | Key Differentiator |
|---|---|---|---|---|
| CrowdStrike Falcon Complete | Enterprise | 18% | $400-800K | Platform breadth, brand |
| SentinelOne Vigilance | Enterprise | 14% | $300-600K | AI-native XDR |
| Arctic Wolf | Mid-Market | 12% | $80-150K | SOC-as-a-service |
| Huntress | SMB | 8% | $20-60K | MSP channel |
| Expel | Mid-Market | 5% | $100-180K | Automation, transparency |
| Red Canary | Mid-Market | 4% | $90-140K | Detection engineering |
| CyberVault | Mid-Market | ~2% | $100-140K | Threat intelligence |
| Others / fragmented | Mixed | 37% | Varies | --- |
Source: CyberVault case file
Exhibit 3European MDR Market Opportunity
| Market | MDR Market Size (2025) | 3-Year CAGR | Mid-Market Avg. ACV | Regulatory Complexity | Local Competitor Density |
|---|---|---|---|---|---|
| United Kingdom | $1.8B | 14% | $110K | Medium | High |
| Germany | $1.5B | 16% | $130K | High (GDPR + BSI) | Medium |
| France | $0.9B | 13% | $105K | High | Medium |
| Nordics | $0.7B | 18% | $125K | Medium | Low |
| Benelux | $0.5B | 15% | $115K | Medium | Low |
Source: CyberVault case file
Try it first, then checkShow model answerHide model answer
Four observations the candidate should surface:
-
The ACV-churn trap: Enterprise revenue LTV equals mid-market LTV ($1.5M each), but enterprise costs more to acquire ($180K vs. $60K CAC) and delivers less gross profit (55% vs. 70% margin). Enterprise LTV-to-CAC ratio is roughly 4.6x versus 17.5x for mid-market. The CEO's excitement about $360K ACV is anchoring on the wrong metric.
-
Competitive positioning: CyberVault holds ~2% of the mid-market MDR share (Exhibit 2), meaning enormous headroom exists in a segment it already knows how to win. Moving to enterprise means competing against CrowdStrike (18% share) and SentinelOne (14% share) with multi-billion-dollar sales organizations. Even reaching 5% mid-market share would represent significant growth.
-
Operational scalability: Enterprise delivery costs are structurally higher. Dedicated SOC analysts at a 1:3 ratio versus 1:15 for mid-market means serving 50 enterprise clients requires ~17 dedicated analysts, whereas 150 mid-market clients require only ~10 shared analysts. This has direct implications for the gross margin difference and the company's ability to scale without proportional headcount growth.
-
European timing risk: No legal entity, no GDPR certifications, no local language support (Additional Information). Germany's BSI regulatory requirements alone could take 12-18 months to navigate. Europe is a real opportunity but not a 3-year ARR driver unless the company starts immediately --- and even then, it will not meaningfully contribute until Year 2. Note the Nordics trap in Exhibit 3: 18% CAGR and low competitor density look attractive, but the $0.7B total market is too small to materially impact a $200M ARR target.
What the interviewer is looking forShow guidanceHide guidance
Good (Level 1 --- Surface): Candidate identifies that enterprise churn is 3x higher than mid-market and that the higher ACV is offset by shorter customer lifetimes. Notes that enterprise competition is intense based on Exhibit 2 --- CrowdStrike and SentinelOne hold a combined 32% share.
Strong (Level 2 --- Implication): Candidate connects the unit economics trap to organizational implications. Enterprise deals require dedicated SOC analysts (1:3 ratio vs. 1:15 for mid-market), meaning the delivery model does not scale linearly. The 240-day enterprise sales cycle means reps close only 1-2 deals per year, compared to 4+ mid-market deals. This creates a hiring and capacity problem that compounds over three years. The candidate should also note that enterprise NRR of 94% means revenue from enterprise clients shrinks over time, while mid-market NRR of 118% means revenue grows.
Excellent (Level 3 --- Actionable): Candidate synthesizes across all three exhibits to build a nuanced recommendation. Notes from Exhibit 3 that the Nordics have the highest growth rate (18% CAGR) and lowest competitor density, but the $0.7B total market is too small to move the needle for a $200M ARR target. The UK is the largest European market ($1.8B) but has high competitor density --- CyberVault would face the same incumbents it is trying to avoid domestically. Proposes that instead of a binary choice, CyberVault should double down on mid-market domestically (primary growth engine) while selectively piloting enterprise clients that fit a specific profile (e.g., companies with 5,000-8,000 employees in underserved verticals where CrowdStrike is less dominant). Frames Europe as a Year 2-3 initiative requiring 12+ months of regulatory and operational preparation.
Interviewer Tips
- If the candidate only cites ACV differences, push: "Is there anything in the data that makes you question whether higher ACV translates to higher value?"
- If the candidate proposes a hybrid strategy (some enterprise, some mid-market), ask them to quantify the trade-off: "If you divert $3M from mid-market to enterprise, what do you gain and what do you give up?"
- Watch for whether the candidate engages with Exhibit 3 at all. Weak candidates ignore it; strong candidates use it to address the Europe option even if the question did not explicitly mention it.
Question 4Synthesis
Prompt: "You have 60 seconds with the CEO and the board. What is your recommendation?"
Hint · Synthesis
Answer first: the recommendation, two or three reasons with numbers, then risks and next steps.
Try it first, then checkShow model answerHide model answer
"CyberVault should pursue a mid-market acceleration strategy as its primary growth engine, with selective investment in two supporting initiatives.
Primary (70% of investment): Double down on mid-market. The unit economics are compelling --- 17.5x LTV-to-CAC ratio, 118% NRR, and only 1.2% penetration of 28,000 addressable US companies. With $9M in incremental sales spend, we can add 150 customers and $18M in new ARR annually. Combined with 118% NRR on the existing base, mid-market alone can drive CyberVault past $150M ARR by Year 3.
Secondary (20% of investment): Build an SMB channel through MSP partnerships. The 180,000-company TAM is too large to ignore, and MSP-delivered MDR requires minimal direct sales investment. This adds a high-volume, low-CAC acquisition channel that can contribute $20-30M ARR by Year 3.
Exploratory (10% of investment): Begin European regulatory preparation and hire a small team in the UK or Nordics. This positions CyberVault for international expansion in the Series D timeframe without diverting resources from the core growth plan.
I would not recommend an enterprise push. Despite the attractive $360K ACV, enterprise churn of 24% erases the revenue advantage, and competing against CrowdStrike and SentinelOne in their core segment is a low-probability bet when CyberVault has a proven mid-market playbook with massive remaining headroom."
Key Risks and Mitigants
| Risk | Likelihood | Mitigant |
|---|---|---|
| Mid-market growth decelerates as CyberVault saturates top-of-funnel | Medium | Expand into adjacent verticals (healthcare, financial services) within mid-market |
| SMB channel through MSPs dilutes brand and margins | Medium | Curate MSP partners carefully; maintain minimum margin thresholds |
| A competitor acquires CyberVault's mid-market positioning | Low | Accelerate now while the window is open; NRR of 118% creates switching cost moat |
| European regulatory setup takes longer than 12 months | High | Start immediately with a small team; treat as optionality, not a committed revenue target |
What the interviewer is looking forShow guidanceHide guidance
Interviewer Tips
- A strong synthesis will follow the "action-insight-evidence" pattern: state what to do, explain why with a specific number, and cite the exhibit.
- If the candidate recommends enterprise, do not immediately correct. Ask: "Walk me through the LTV-to-CAC ratio for enterprise versus mid-market." Let the math do the correcting.
- The best candidates will acknowledge what they are giving up by not pursuing enterprise (brand credibility, large logos for future fundraising) and explain why the trade-off is still worth making.
Scoring Notes
| Dimension | Weight | What Distinguishes Top Performance |
|---|---|---|
| Structuring | 25% | Frames as capital allocation, not market selection; identifies churn-ACV interaction early |
| Numeracy | 30% | Computes LTV/CAC correctly; identifies the identical revenue LTV trap without prompting |
| Judgment | 25% | Synthesizes across all three exhibits; addresses competitive dynamics and European timing |
| Synthesis | 20% | Delivers a crisp, prioritized recommendation with specific numbers and clear trade-off logic |
Contributed by CaseDrill practice community