Enterprise Cybersecurity
1:1 Partner ABM
Palo Alto Networks
Surrounding the buying committee on nine-figure cyber transformation deals
How Palo Alto Networks and its global systems integrator partners used 1:1 ABM to reach influencers from the bottom up and executives from the top down — including a $138M SASE and SD-WAN RFP win.
$138M
RFP won with GSI partner support
+125%
Meetings booked with target decision makers
+58%
Decision-maker relationships established
10 / 4
1:1 strategies scoped across 4 GSIs
$1M–$100M+
Deal sizes in scope
Palo Alto Networks sells its largest cyber transformation deals alongside Global Systems Integrators, whose account teams already sit inside the customer. The ABM Agency built a repeatable 1:1 partner ABM model for PANW’s GSI program: joint account selection with sales, buying-committee mapping across both PANW and GSI relationships, “better together” messaging that made the partnership the product, and 1:1 landing pages, direct mail and executive journeys that surrounded influencers from the bottom up and executives from the top down. The model was applied to in-flight RFPs and expansion accounts in financial services, automotive, healthcare, energy, telecom and hospitality, and is credited with a nine-figure SASE and SD-WAN win.
Industry context
Enterprise security is increasingly bought as part of a broader transformation program run by a systems integrator. When a global bank, automaker or health system moves to the cloud, the GSI often owns the roadmap, the relationships and the RFP process; the security vendor is one line in a much larger bill of materials. For a vendor like Palo Alto Networks, that creates a two-sided marketing problem: the end customer must want PANW, and the GSI must want to lead with PANW rather than a competitor it also partners with.
The deals are large and slow. SASE, SD-WAN and cloud security programs at Fortune 500 accounts run from a few million to well over $100 million, with buying groups of a dozen or more spanning the CISO’s organization, network and infrastructure, cloud platforms, procurement and the business. Influencers — architects, engineers, heads of SOC — shape the technical evaluation from the bottom up; executives sign from the top down. Each GSI account team has some of these relationships; the vendor has others; nobody has all of them.
Partner marketing usually defaults to co-branded brochures, joint webinars and MDF-funded events aimed at everyone. It rarely does the hard thing: pick one account, map every stakeholder across both partners, and run a coordinated sequence that makes the partnership itself the reason to buy. Add regional constraints — EU opt-in rules for email, GDPR, partner data-processing agreements — and most programs stall at the brochure.
The client’s situation
PANW’s partner marketing organization wanted to move from generic GSI co-marketing to account-level programs on deals that mattered: low-funnel accounts with an active RFP or a cross-sell and upsell opening, ranging from $1M to $100M+. The objective was to expand the buying group, deliver messaging that resonated with each stakeholder, accelerate the sales cycle and keep the PANW/GSI partnership top of mind through the decision.
Each campaign involved stakeholders at three companies — PANW, the GSI and the account — across regions, with weekly partner meetings and varying levels of readiness. Several were canceled or paused as partner priorities and MSAs shifted, which is normal in partner ABM and is why the model had to be repeatable rather than bespoke each time.
The challenge
Go-to-market
- Three-party programs (PANW, GSI, account): alignment on account selection, messaging and who sends what had to be negotiated for every campaign
- Account types: “goal line” (RFP in flight, weeks to decision) and “expand” (small footprint in a large enterprise), each needing a different cadence
- Influencer-led decisions in some accounts requiring bottom-up and top-down tracks simultaneously
- Cost-sensitive buyers and incumbent vendors already known to the account
- Executives neither PANW nor the GSI had been able to reach
- EU accounts with opt-in-only email rules, where direct mail and events carried more weight
- Partner turnover and program cancellations: of the first ten strategies, four completed, two went in-market, and four were canceled after intake or discovery
MarTech
- No shared system across three companies. PANW’s CRM, the GSI’s CRM and the account’s engagement data lived in separate instances; ABMA built the account intelligence layer — executive maps, buying-committee coverage, profiles for messaging tone — and the reporting model that combined account-based and person-based signals into a single view.
- Landing pages were hosted on a PANW-controlled partner domain so pages could be co-branded per partner and per account without waiting on either company’s corporate web team.
- Partner data processing: a supplier data-processing agreement was executed with PANW so contact data could be handled across the program; EU programs were designed around opt-in, with direct mail, events and sales email carrying touches that marketing email could not.
- Measurement had to be defined for 1:1 where classic funnel metrics do not apply: account coverage, response rate, time to engagement and engagement quality were set as KPIs, with a Custom Influence Score to quantify decision-maker relationships.
- Media (display, LinkedIn, native, video) ran as “digital surround” timed to sales outreach and events, with reporting on account-level exposure.
- Coexistence: ABMA produced strategy, copy and wireframes; PANW’s design and ad-operations teams executed; nothing was inserted into PANW or partner CRMs by ABMA.
Asset creation
Each 1:1 strategy generated its own asset set, in the account’s context and the partner’s brand, through multiple rounds of PANW and partner review:
- Co-branded 1:1 landing pages per account, with a partnership hero, three monthly-refreshed assets carrying account-specific thumbnails and copy, and an account-priority section
- Account-specific two-page use cases showing what the partnership delivers for that account; personalized bumpers and call-out boxes added to existing PANW white papers and analyst reports, ungated
- Executive letters and direct mail: a seed-paper ESG letter, an Earth Day seedling mailer, a team video card with partner-branded treats, handwritten notes, an adventure-themed gift
- Plain-text sales email sequences from the PANW account executive with the GSI account executive copied — 12 touchpoints for influencers, 11 for executives in the automotive program
- Executive event invitations tied to the account’s own moments; “Ultimate Test Drive” hands-on cloud security assessment invitations for practitioners
- Digital surround creative: long-form landing-page video, 30-second video ads, display banner sets, native ads per resource, LinkedIn image and document ads for two inbound campaigns plus an ESG track
What we built
- 01GSI account selection criteria and process, jointly with PANW partner sales: white space, perception, expand and goal-line classification
- 02Discovery per GSI and per account: intake form, systems and constraints, sales interviews, executive mapping workshops
- 03Persona architecture: decision makers (CEO, CIO, CISO, CTO, CDO, CFO, sourcing) and influencers (director and head of security, SOC, cloud, network, infrastructure, procurement) with pain points and business impact by account
- 04Messaging pillars per account: partnership value (“better together”), solution (SASE, Prisma Cloud, Zero Trust), and an account imperative such as net-zero or cloud-first transformation
- 05Dual-track journeys: bottom-up influencer sequences and top-down executive journeys with event and gifting moments, all sent from the PANW account executive with the GSI account executive copied and executive-sponsor follow-up
- 06Co-branded landing pages on the partner domain with monthly asset refresh
- 07Digital surround media plan (video, display, native, LinkedIn) launched ahead of outreach and refreshed quarterly or monthly by track
- 08Sales playbook: buying-committee view, decision-maker relationship intel, a shared sales-and-campaign calendar, weekly sales/ABM meetings and a feedback loop
- 09Measurement framework: account coverage, response rate, time to engagement, engagement quality, engagement score and pipeline velocity
- 10A program roadmap to extend to all seven GSIs, targeting up to five 1:1 strategies per partner after the first ten
Figure 1
Two tracks against one account — influencers surrounded from the bottom up, executives approached from the top down
Bottom-up
Influencer track
Architects, engineers, heads of SOC, cloud, network and infrastructure who shape the technical evaluation
Partnership video and brochure
Direct mail: team video card
Account-specific two-page use case
Handwritten Ultimate Test Drive invitation
LinkedIn connection and scheduling
Top-down
Executive track
Senior technology executives neither partner had reached
Sector cybersecurity article
Industry 4.0 e-book
Executive-sponsor dinner invitation at the account’s own event
Handwritten note with a gift
Peer-customer introductions and meeting request
Always on
Digital surround
Launched ahead of outreach, timed to sales touches and events
LinkedIn image and document ads
Video ads and long-form video
Co-branded 1:1 landing page
Every email was sent from the PANW account executive with the GSI account executive copied.
Spotlight: Palo Alto Networks and Infosys at BMW
The spotlight program shows the model in full: a bottom-up influencer journey and a top-down executive journey, built from a joint discovery workshop, executed to opt-in EU contacts only, and leaning on events, direct mail and hands-on workshops where email could not reach.
The opportunity
Additional Prisma Cloud and XSOAR licenses at BMW, with a large Infosys-led cloud infrastructure RFP approaching. BMW’s CIO organization had set a target of moving 80–90% of workloads and applications to the cloud, but the journey was slow, costly and resource-constrained. Neither partner had established contact with two of the account’s most senior technology executives.
What discovery told us
BMW is highly cost-sensitive. Influencers — directors, heads of function, engineers and architects across cybersecurity, cloud, network and infrastructure — carry unusual weight in decisions, so the program needed a bottom-up track as well as a top-down one. Palo Alto Networks was already well known inside BMW; Infosys was an incumbent partner with deep knowledge of BMW’s processes and IT landscape. Executive mapping sessions with both partners identified the influencer set and the executive set, and events on BMW’s own calendar were chosen as the moments to meet in person. EU rules meant the program could contact opt-in individuals only.
Messaging architecture
One imperative — BMW’s cloud-first strategy and cyber transformation journey — expressed through a core proposition (accelerate cloud adoption and reduce spend while securing an evolving hybrid and multi-cloud environment) and a partnership story (a single-vendor solution combining Palo Alto Networks technology with Infosys’s account knowledge and managed services).
Solution proof points: Cobalt powered by Prisma Cloud for visibility and compliance across hybrid and multi-cloud, Prisma SASE and ZTNA 2.0 for secure access, next-generation firewall for inline zero-day protection, and managed security that lets BMW reallocate scarce resources to innovation. Every asset was framed as what this partnership means for BMW, never as a product pitch.
Figure 2
The BMW program at a glance
50
Opt-in EU contacts targeted
~100
Influencer contacts mapped
12
Influencer touchpoints, Aug–Nov
11
Executive touchpoints, Aug–Dec
9
Executives in the top-down track
Landing page and content
A partnership page carrying Prisma Cloud, partnership and cyber-transformation messaging with a “reach out today” call to action; existing assets (the Infosys partnership video and press release, the Gartner Magic Quadrant report, a cloud security video, a Forrester study of Prisma Cloud) plus net-new pieces (the BMW use case and a partnership placemat), with dynamic account and rep personalization as in the other GSI programs.
Working model
ABMA led the discovery workshop, executive mapping, messaging pillars, both journeys, the asset list and the landing-page wireframe; PANW and Infosys owned design, send and event execution.
Outcome
The bottom-up focus on technical stakeholders and influencers earned effective engagement inside BMW, uncovered new inroads, accelerated deal momentum, and positioned Palo Alto Networks and Infosys as trusted advisors in BMW’s transformation.
Results
| Metric | Value | Timeframe |
|---|---|---|
| RFP won (SASE and SD-WAN, GSI-supported) | $138M | — |
| Meetings booked with target decision makers | +125% | — |
| Decision-maker relationships established (Custom Influence Score) | +58% | — |
| Sales-cycle acceleration | 20% faster | — |
| 1:1 strategies scoped / completed / in market / canceled | 10 / 4 / 2 / 4 | 2023 |
| Programs in market | IBM–healthcare (Aug–Nov 2023); Deloitte–financial services (Oct 2023–Jan 2024) | 2023–24 |
| GSIs engaged | 4 of 7 (Deloitte, IBM, Infosys, Accenture) | 2023 |
| BMW: opt-in contacts targeted | 50 | 2023–24 |
| BMW: influencer track | ~100 contacts mapped · 12 touchpoints · Aug–Nov | 2023 |
| BMW: executive track | 9 executives · 11 touchpoints · Aug–Dec | 2023 |
| BMW: outcomes | Effective engagement, new inroads, accelerated deal momentum, trusted-advisor positioning | — |
GSI partners are named with consent. End-target accounts other than BMW are described by industry.
Why it worked
The partnership was the product. Every asset led with what PANW and the GSI do together for this account, which gave the GSI a reason to lead with PANW and gave the account a single-vendor story.
Two tracks, one plan. Influencers who shape technical evaluations were surrounded from the bottom up while executives neither partner had reached were approached from the top down through events and sponsors.
Account imperatives, not product features. Tying the message to what the account had publicly committed to — net-zero targets, cloud-first strategy, a new vehicle platform — earned attention that security messaging alone would not.
Built to be repeated. Account selection criteria, discovery templates, persona architecture and journey templates meant a new GSI and account pairing could start in weeks, and cancellations did not sink the program.
Measured like 1:1. Coverage, response, time-to-engagement and relationship scores gave partner sales something to act on between RFP milestones.
Services and tools
Services
GSI Account Selection
Account Intelligence & Executive Mapping
Buying-Committee Messaging
Journey & Cadence Design
Landing Page Copy & Wireframes
Direct Mail & Gifting Programs
Executive Event Strategy
Sales Playbooks
ABM Measurement Frameworks
Channels worked in
Programmatic display and native
Video
Plain-text sales email
Direct mail and gifting
Executive events
Hands-on workshops
Frequently asked
How does ABM work when a systems integrator owns the customer relationship?
You market the partnership, not the product. For Palo Alto Networks and its GSIs we mapped the buying committee across both companies’ relationships, built co-branded 1:1 pages and journeys that led with what PANW and the GSI deliver together, and sent every touch from the PANW account executive with the GSI account executive copied.
Can 1:1 ABM influence an RFP that is already in flight?
That is where it earns its keep. “Goal line” accounts got a compressed sequence — digital surround, personalized use cases, executive outreach and events timed to the RFP calendar — to keep the partnership top of mind through the decision. One such program is credited with a nine-figure SASE and SD-WAN win.
How do you run ABM in the EU where marketing email requires opt-in?
Shift the weight to channels that do not. At BMW the program reached 50 opt-in contacts only; sales email from the account executives, a team video card with partner-branded treats, a BMW-specific use case, a handwritten Ultimate Test Drive invitation, an executive dinner in Munich around BMW’s motor-show exhibition and hands-on workshops carried the sequence, with display and LinkedIn as surround.
What happens when partner programs get canceled midway?
Plan for it. Four of the first ten strategies were canceled after intake or discovery as partner priorities changed. Because account selection, discovery and journey design were templated, the remaining programs and new pairings kept moving.
Related proof
Dassault Systèmes
Enterprise software, locked stack
PTC Windchill+
1:Few objection-led journeys
SentiLink
Financial services 1:1
