A client who went elsewhere without meaning to
Last spring you tested a client's customer portal and their external infrastructure. The work went well. The report was good. The client's IT manager said they would be back next year, because their biggest customer requires an annual test.
This spring, the IT manager is busy. Their customer's supplier questionnaire arrives with a question about the date of the last penetration test. They search for 'penetration test' online, fill in a form on another firm's website, and book with them. They were not unhappy with you. They simply did not think of you, because nobody from your firm got in touch.
Across your client list, this is happening quietly every month.
The cost of winning a new client, with scoping calls and proposals from scratch, is far higher than the cost of rebooking one who already knows and trusts you. Yet the new client gets all the attention.
Why repeat tests slip
- Nobody records why a client tests or how often: policy, customer requirement, insurer or certification.
- Engagement dates are in the scheduling spreadsheet, which does not prompt anyone a year later.
- Account ownership is loose; the tester and the salesperson both assume the other will follow up.
- Clients' scope changes over a year, so a follow-up needs a scoping conversation, which feels like a sales call.
- Busy periods mean follow-ups are the first thing dropped.
What slipping renewals cost
| Missed step | Result |
|---|---|
| No record of test cycle | Due tests invisible |
| No early contact | Client books elsewhere under deadline pressure |
| Scope started from scratch | Slow proposal, less competitive |
| Renewals not forecast | Busy and quiet months unpredictable |
| No trend shown to client | Your history with them is not used |
The pattern is easy to miss because it never shows up as a lost deal. There is no proposal that was rejected, no competitor you were beaten by. The client simply does not appear in next year's schedule, and nobody notices the absence.
The renewal tracking we build
- Each client engagement records the test types, the date and, where the client tells you, the reason they test and how often: annual policy, a customer requirement, an insurer, a certification.
- The next due date is calculated for each client and appears in a renewal pipeline in your CRM, at a point you set well before the due date.
- The account owner is prompted to get in touch, with last year's scope, findings summary and remediation status ready to hand.
- The client receives a short 'what has changed?' form built from last year's scope: new applications, new infrastructure, changes to hosting. Their answers feed straight into scoping.
- Clients who tell you their external deadline (a customer audit, an insurer renewal) get the timing planned backwards from it.
- The pipeline gives operations a forward view of likely engagements, which helps with scheduling and hiring.
What your pipeline looks like afterwards
Every client with an annual cycle is in the pipeline with a due date. Account owners reach out early with something useful: last year's scope and what the client fixed since. The scoping for a repeat test starts from what you already know, so the proposal goes out quickly and fits.
Clients notice that you remembered. And the year-on-year view of their findings, which only a returning tester can offer, becomes a reason to stay with you rather than start again with someone new.
Take the client from the start of this article. With renewal tracking, their record shows an annual cycle driven by a customer requirement. Well before their anniversary, the account owner gets a prompt with last year's scope and remediation status. The client receives the 'what has changed?' form, mentions a new mobile app, and the proposal goes out the following week, ahead of their customer's questionnaire rather than after it.
Operations get something too: a forecast. If the pipeline shows a cluster of annual tests due in the same months, you can plan leave, training and hiring around it rather than being caught out every spring.
Recognise this?
- You do not know which clients are due a repeat test.
- Past clients have tested with another firm without telling you.
- Repeat tests are scoped from scratch.
- Nobody owns follow-up after an engagement.
- You cannot forecast repeat work for the year ahead.