The glue between
the silos.

I'm Nicholas Sorenson. The résumé says marketing and growth operator inside cybersecurity companies, the person accountable for pipeline, positioning, and the line that connects what marketing does to what the business actually books. That part is true. But the title undersells the actual work, which has always been creative: take a complex, technical category nobody can explain cleanly, find the real story inside it, and build the connective tissue that gets capital, product, sales, and brand telling the same one.

I didn't start in security. Twenty years ago the work was marketing communications for wildlife conservation — running comms for Wildlife Alliance out of Phnom Penh, on the ground for documentary shoots with the networks. Storytelling about things that mattered, with no budget and high stakes. Cybersecurity came later, in 2010, and I've spent sixteen years in it since. The throughline from the jungle to the SOC is the same instinct: find the story the facts are actually telling, and make people who don't speak each other's language care about the same one.

That work has run the full arc: naming a category before the analysts had a slot for it, rebuilding a brand on the way to an IPO track, standing up demand engines that fed real pipeline, and most recently positioning an AI-SecOps platform in the one fight the category can't avoid: whether the machines replace the analysts or amplify them. The categories were rarely single things. "Security operations" names a whole stack: a SIEM and SOAR core (Splunk, Sentinel, Cortex XSOAR, Google SecOps), the XDR and EDR telemetry feeding it, the detection engineering that makes any of it fire correctly, and the managed service wrapped around the whole thing, with external feeds like digital risk protection and attack-surface monitoring bolted on at the edge. "Access governance" at Pathlock was its own constellation: IAM, IGA, PAM, and application-layer controls, all of it answering to SOX, SoD, and ICFR before it answered to a security need. The work was never picking the acronym. It was finding the one story that made a dozen of them cohere for a buyer who owned all of them and understood none of them cleanly.

The job underneath every title was the same: make the go-to-market engine produce predictable revenue, and prove it.

Heretics is where that work operates on its own terms. The firm owns a single methodology, Revenue Governance, and applies it to the problem most cybersecurity companies share: a go-to-market motion that looks busy from the inside and incoherent from the outside.

The tooling got cheap. AI will draft the campaign, build the model, render the page, and write a passable first version of nearly anything you ask it to. Speed has stopped being a differentiator and become the price of entry. What stays scarce is the judgment about what is worth building at all: the read on where a category is heading, which motion a given market will actually reward, and which confident vendor story is a genuine position rather than an expensive tautology dressed as one.

That read is the thing I sell. It runs on the same wiring that does the synthesis: holding the technical detail, the market narrative, and the org politics in one frame, and finding the single connection that makes them resolve. Everything downstream — the operators who run it, the engine that encodes it, the public desk that grades vendors on it — is execution. The methodology is how the wiring becomes repeatable for someone who isn't me.

Start with the thing most people put in a footnote: I'm neurodivergent. ADHD. I've stopped treating it as a caveat, because it's the engine. The same wiring that makes a linear quarter-plan a slog is the wiring that sees a whole tangled category at once and finds the line through it. Pattern over process, synthesis over sequence. The creative side was always the real instrument; the operations career is where I learned to aim it.

I don't use the word failure. I've never met anyone operating in good faith, misguided or not, who earned it. What I've had instead is a long dialectic: a thesis I believed, an experience that contradicted it, and a synthesis I only reached by working through the contradiction. Most of that happened in rooms where I was defending marketing to the people who held the capital. Leadership, the board, PE masters, explaining ROI, measurement, the stack, the methodology, again and again. Some of those rooms I won. Some I lost, and the loss sent me back to dig deeper into cause and effect, to get better at articulating the engine to the powers who fund it, and to tell the truth about the numbers even when the truth was unwelcome.

I've run the whole gamut to get here: cutting my teeth in marketing ops and RevOps, then field and channel, then owning demand gen, brand, and product marketing, and eventually all of it at once. From that vantage you see the things people would rather not name. The silos. The technical debt. The ARR targets that were never remotely reachable, stood behind anyway by sales and marketing leaders afraid of shortening their own tenure — myself included, at one point. The disconnect between capital, the CEO, the CFO, product, engineering, sales, customer success, product marketing, demand gen, and brand is more prevalent than anyone admits.

The hinge is the oldest line in strategy, von Moltke's: no plan survives contact with the enemy. The enemy here wears no logo. It is the absence of revenue governance, and the failure of nerve that lets a board hear a number everyone in the room privately knows is fiction. A teardown that flatters you isn't a teardown. Heretics exists to make that contact on purpose, early, while the plan can still be changed. Naming the enemy is the first act. Governing it is the rest.

The toolkit, stated plainly. What twenty years in marketing actually leaves you holding.

Educated in political theory and constitutional democracy, which, it turns out, is decent training for reading how power, incentives, and narrative actually move inside a market.

If a go-to-market motion you're responsible for looks busier than it is effective, that's the conversation Heretics is built for. Work with Heretics →