Every referral-only security company owner I've worked with eventually says a version of the same sentence: "We've never had to market. It's all word of mouth."
They say it with pride. About ten minutes later, they say the second half: "But it's been flat for a while, and I don't really know why."
Both things are true at once, and they're the same problem. Referral businesses aren't broken. They're just capped. The pipeline is entirely dependent on other people remembering you at the exact moment someone else has a problem. That's not a strategy.
This is what happened when a local security guard company decided to grow with a real marketing strategy.
The situation
The client was doing roughly $20 million in revenue. Revenue had been essentially flat for the last couple of years. Not declining, just flat.
They had no marketing function. No website updates in years. No one who knew how to use their CRM or marketing automation platform beyond a shared inbox and a leads spreadsheet. What they did have was an excellent reputation, low attrition, and a founder who knew every property manager within a 50-mile drive.
Why buying leads was the wrong first move
Buying more leads would have poured new inquiries into a system that was already missing revenue from existing accounts, informal referrals, slow follow-up, and dormant quotes. The better first move was to repair those four leaks, using the trust and opportunities the firm had already earned before paying for more demand.
What we did
1. We sold to the accounts they already had
The cheapest revenue in a security business is sitting inside the existing base, and in referral-led firms it's almost always underworked — because upselling feels pushy to people whose whole identity is "we don't sell, we serve."
We pulled every active account into one view and mapped what each one had versus what they could have. Monitoring accounts with no video verification. Guarding contracts with no access control. Single-site clients with four other locations under the same ownership. Systems installed six or seven years ago running on hardware the manufacturer had already sunset.
Then we stopped calling it selling. Every conversation was framed as a coverage review: here's what's protected, here's what isn't, here's what's changed since we installed this. That reframe mattered more than any script. It gave the ops people, who knew these sites better than anyone, permission to have a revenue conversation without feeling like they'd been turned into salespeople.
2. We turned referrals from an accident into a system
They were getting referrals. They just weren't asking for them, tracking them, or thanking anyone for them.
Three changes. First, we identified the specific accounts and partners who had actually sent business in the past two years — it's always a much shorter list than owners expect, usually a handful of people doing most of the work. Second, we built a defined moment to ask: a set point in the account lifecycle, after a successful install or a clean quarterly review, when the request is natural rather than random. Third, every referral got acknowledged, in writing, to the person who made it.
That last one sounds soft. It isn't. People repeat behavior that gets noticed. The referral sources who heard back sent more.
3. We fixed speed-to-lead
This is the least interesting fix and it moved the most revenue. The original lead-response study is older, but its central lesson still matches what we saw: waiting to respond wastes buyer intent.
Inbound inquiries were being answered on a timeline measured in days. We got it to hours, then to a same-business-day standard with a named owner for every inquiry. Nothing sophisticated — a shared responsibility, a simple queue, and an expectation that the queue gets cleared before anyone goes home.
We also resurrected the dead quote pile. Every proposal from the previous 18 months that had gone quiet got one honest follow-up. Not a "just checking in." A specific message referencing what they'd asked for and what had changed since. A real percentage of those were still live. Some had gone with a competitor and were already unhappy.
4. We gave referral sources something to hand over
When a property manager recommends you to a peer, they're putting their own credibility on the line. If the only thing they can send is a phone number, they'll do it less often, because it's a bigger ask of them.
So we built the artifacts that make a referral easy: two short written case examples with real outcomes, a clear one-page overview of what the firm does and who it's for, and a website that answered the questions a referred prospect would actually have before calling. Nothing elaborate. The bar was simply "a busy person can forward this without explaining it."
5. We cleaned up what people saw when they did a Google Search in their service area
Their Google Business Profile had not been touched since the day it was claimed. Wrong hours. One category. A few reviews, the most recent from three years earlier. A stock photo of a guard who didn't work there.
We optimized it. We corrected the primary and secondary categories, so the firm surfaced for what it actually sells instead of one generic label. Service areas defined properly. State license number in the description, because that's the first thing a commercial buyer looks for. Real photos: their own vehicles, their own uniformed team, actual installs with client permission.
Then reviews. They had over 150 accounts who genuinely liked them and almost nothing public to show for it. So we asked and we received new reviews.
Does this transfer to your firm?
Honestly, not always. This worked because of conditions that aren't universal.
It works when you have a meaningful existing account base with genuine room to expand, when your service quality is actually strong enough that customers would recommend you if asked, and when someone internally has the authority to change how follow-up happens and will use it.
It doesn't work if you're a new firm with thirty accounts and no reputation to leverage yet. It doesn't work if attrition is high, because you'll be pouring effort into a base that's leaving. And it doesn't work if the real problem is that your service is mediocre, in which case more visibility just helps more people find out.
If you're in that second group, you probably do need demand generation from cold channels, and someone telling you otherwise isn't paying attention to your situation.
One Note:
I run a fractional CMO practice serving physical security companies, so I have an obvious interest in you concluding that marketing strategy is worth paying for.
Here's the version that's true anyway: most of what's described above is not consulting work. Following up on quotes, calling your existing accounts, and asking happy customers for introductions are things your team can do starting Monday without hiring anyone. If you do only that and never speak to me, you'll be better off than you were.
What outside help actually bought this firm was sequencing and accountability, knowing which lever to pull first, and having someone whose job it was to make sure it got pulled.
Where to start
If revenue is flat and your instinct is to go buy leads, do one thing first: count how many opportunities reached your inbox in the last 90 days and how many got a real response within 24 hours.
If that percentage is bad, you don't have a lead problem.
Want a structured read on where your growth is actually leaking? The Marketing Scorecard walks through 40 questions across 8 categories and gives you a diagnosis before anyone tries to sell you anything.
