Q1 Work Plan | Intrusion x Tiller Digital

How This Work Aligns With Our Agreement

Each workstream below maps directly to the services defined in our Master Services Agreement. Here's how they align:

Workstream	SOW Service Category	Alignment
Competitive Client Audit	Brand Strategy & Creative Direction	Competitive research is a foundational input to brand positioning and creative strategy. Understanding what drives client acquisition for competitors informs our own brand direction.
Blog SEO Overhaul	Content Creation	Blog rewrites, SEO optimization, and copywriting are core content creation services. Delivering in Google Docs ensures a clean review process before publication.
Keyword Map	Brand Strategy + Content Creation	Keyword strategy determines what topics the brand owns in search -- a critical input to both content planning and brand positioning.
Pattern Analysis Report	Marketing Campaign Creation	Synthesizing competitive intelligence into actionable recommendations is campaign strategy work that directly informs future marketing initiatives.
Technical Growth	Technical Growth (ongoing)	CMS updates, security scans, monitoring, and quarterly audits continue on their normal cadence per the Technical Growth scope.

Target Keywords & Phrases for Blog Rewrites

How to Use This

Every blog rewrite should target at least one primary keyword from the tables below. The keyword map deliverable (Week 7) should assign each keyword to a specific page or post, ensuring no two pages target the same primary keyword. These are organized by intent stage and priority.

Core Solution Keywords

Keyword / Phrase	Est. Monthly Volume	Difficulty	Priority
network security solutions	2,400-4,400	Medium	Critical
network detection and response	2,400-5,400	Medium	Critical
NDR security	1,000-2,400	Medium	Critical
network threat detection	1,000-2,400	Medium	Critical
DNS security	2,400-5,400	Medium	Critical
DNS filtering	3,600-6,600	Medium	Critical
intrusion detection system	2,400-5,400	Medium	Critical
intrusion prevention system	2,400-5,400	Medium	Critical
autonomous network enforcement	10-50 (category creation)	Low	Critical
real-time threat detection	800-1,600	Medium	High
network security monitoring	880-1,600	Medium	High
DNS threat intelligence	500-1,000	Low	Critical
IP reputation database	200-500	Low	High
automated threat blocking	100-300	Low	High

Buyer-Intent Keywords (bottom of funnel)

Keyword / Phrase	Est. Monthly Volume	Difficulty	Priority
best network security solutions	500-1,000	Medium	Critical
best NDR solutions	300-600	Medium	Critical
best DNS security solutions	300-600	Medium	Critical
best intrusion detection systems	500-1,000	Medium	Critical
network security for mid-market	50-200	Low	Critical
enterprise network security solutions	300-600	Medium	High
managed network security services	500-1,000	Medium	High
cloud network security solution	300-600	Medium	High
AWS network security solution	200-500	Medium	High

Educational "What Is" Keywords (top of funnel, high volume)

Keyword / Phrase	Est. Monthly Volume	Difficulty	Priority
what is network detection and response	1,000-2,400	Low	Critical
what is DNS security	1,000-2,400	Low	Critical
what is an intrusion detection system	2,400-5,400	Low	Critical
what is an intrusion prevention system	1,000-2,400	Low	Critical
what is threat intelligence	4,300-9,900	Low	Critical
what is the cyber kill chain	2,400-5,400	Low	Critical
what is zero trust security	2,400-5,700	Low	High
MITRE ATT&CK framework explained	3,600-6,600	Low	High
NDR vs EDR	300-600	Low	Critical
NDR vs SIEM	200-400	Low	High
IDS vs IPS	820-1,600	Low	High
how does DNS filtering work	500-1,000	Low	High

Problem-Aware Keywords (blog topics)

Keyword / Phrase	Est. Monthly Volume	Difficulty	Priority
how to prevent network intrusions	200-500	Low	Critical
how to detect network threats	200-500	Low	Critical
how to block malicious IP addresses	500-1,000	Low	High
how to stop ransomware on network	500-1,000	Low	High
lateral movement detection	500-1,000	Low	High
command and control detection	300-600	Low	High
alert fatigue cybersecurity	200-400	Low	High
insider threat detection	1,050	Low	High
DNS tunneling detection	300-600	Low	High

Vertical / Industry Keywords

Keyword / Phrase	Est. Monthly Volume	Difficulty	Priority
cybersecurity for healthcare	500-1,000	Medium	High
HIPAA network security requirements	300-600	Low	High
cybersecurity for government agencies	300-600	Low	High
CMMC compliance network security	200-400	Low	High
cybersecurity for financial services	300-600	Medium	High
PCI DSS network security	200-400	Low	High
cybersecurity for mid-market companies	100-200	Low	Critical
critical infrastructure cybersecurity	500-1,000	Low	High

Competitor Keyword Landscape (Reference for Audit)

Context for Competitive Audit

When reviewing competitor websites in Workstream 1, pay special attention to how they rank for these keywords. The goal is to understand which content strategies drive their organic visibility and which keyword categories they dominate.

High-Volume Keywords Competitors Currently Dominate

Keyword	Est. Monthly Volume	Top-Ranking Competitors
what is network detection and response	1,000-2,400	Cisco, Palo Alto, Darktrace, Vectra
what is threat intelligence	4,300-9,900	CrowdStrike, IBM
what is intrusion detection	2,400-5,400	CrowdStrike, Fortinet, Juniper
what is intrusion prevention	2,400-5,400	Fortinet, Palo Alto, CrowdStrike
what is DNS security	2,400-5,400	Cisco Umbrella, Cloudflare, Palo Alto
what is the cyber kill chain	2,400-5,400	Lockheed Martin, CrowdStrike, Vectra
what is network security	8,100-49,500	Palo Alto, Cisco, IBM
what is AI in cybersecurity	9,900	CrowdStrike, Palo Alto, Darktrace
endpoint detection and response	75,400	CrowdStrike, SentinelOne, Palo Alto
managed detection and response	5,400-11,000	CrowdStrike, SentinelOne, Arctic Wolf

"Vs" and "Alternative" Comparison Keywords

Keyword	Est. Monthly Volume	Top-Ranking Competitors
CrowdStrike vs SentinelOne	3,600-6,600	CrowdStrike, SentinelOne, Gartner
CrowdStrike vs Palo Alto	1,600-3,600	Cynet, CrowdStrike, Palo Alto
CrowdStrike alternatives	3,600-6,600	Cynet, Teramind, Wiz
Darktrace alternatives	1,000-2,400	G2, Heimdal, Sangfor
SentinelOne alternatives	1,000-2,400	Cynet, CrowdStrike
Palo Alto alternatives	1,000-2,400	Check Point, Fortinet
Cisco Umbrella alternatives	500-1,000	PeerSpot, dope.security
Darktrace vs Vectra	500-1,000	Vectra AI, PeerSpot

Competitor Category Dominance

Category	#1 Competitor	#2 Competitor	#3 Competitor
NDR / Network Detection	Darktrace	Vectra AI	ExtraHop
DNS Security / Filtering	Cisco Umbrella	Cloudflare	Palo Alto
IDS / IPS	Fortinet	Palo Alto	Cisco
Threat Intelligence	CrowdStrike	Recorded Future	IBM
Educational Content Hubs	CrowdStrike (1.1M visits/mo)	Palo Alto	SentinelOne
Endpoint (EDR)	CrowdStrike	SentinelOne	Palo Alto
Zero Trust	Palo Alto	CrowdStrike	Microsoft
AI in Cybersecurity	CrowdStrike	Darktrace	Palo Alto

Intrusion's Unique Keyword Opportunities

Keyword / Phrase	Est. Monthly Volume	Why This Is Unique to Intrusion
autonomous network enforcement	10-50	Intrusion-coined category -- opportunity to define the space
agentless network security	50-200	Shield is inline/agentless vs competitors' agent-based models
IP reputation database	200-500	TraceCop's 8.5B IP intelligence database
real-time malicious IP blocking	100-200	Shield's core differentiator vs alert-based competitors
autonomous cyber defense	200-500	Aligns with ANE positioning -- competitors only use "autonomous" for endpoint
network enforcement vs network detection	<10	Category-defining comparison only Intrusion can make
inline network threat blocking	50-100	Architectural differentiator

Weekly Schedule Overview

Week	Dates	Focus	Hours	Deliverable Due
1	Feb 24-28	Build competitor client list + Blog audit	10	Blog audit spreadsheet
2	Mar 3-7	Finish client list + Start blog rewrites	10	100-client spreadsheet
3	Mar 10-14	Website reviews (50 vendors) + Blog rewrites	10	Scored audit (first half)
4	Mar 17-21	Website reviews (50 vendors) + Blog rewrites	10	Scored audit complete
5	Mar 24-28	Pattern analysis report + Blog rewrites	10	Top 5 Patterns draft
6	Mar 31-Apr 4	Final blog rewrites + Patterns report finalized	10	All blog rewrites + final report
7	Apr 7-11	Keyword map + Final QA	8	Keyword map spreadsheet
8	Apr 14-16	Handoff + documentation	2	All deliverables packaged

Workstream 1: Competitive Client Website Audit

~35 hrs 0/0

Objective

Research 100 companies that buy network security from our competitors. Review each vendor's website to understand what on the site helped close that type of client. Synthesize findings into a pattern report with actionable recommendations.

Phase 1 | Feb 24 - Mar 7 | Build the Client List (12 hrs)

Identify 100 end-client companies currently using competitor network security products

Competitors to research: CrowdStrike, Darktrace, Palo Alto Networks, Cisco Umbrella, SentinelOne, Vectra, ExtraHop, Arctic Wolf

Document for each: Company name, industry, employee count, which vendor they use

Include source for each entry (case study, press release, G2 review, LinkedIn mention)

Deliver completed spreadsheet with all 100 entries Deliverable

Phase 2 | Mar 10 - Mar 21 | Website Review + Scoring (15 hrs)

For each of the 100 clients, review the vendor's website from the perspective: "What on this site would have helped close this type of client?"

Score each vendor site on 7 dimensions:

Deliver completed scored audit spreadsheet for all 100 entries Deliverable

Phase 3 | Mar 24 - Mar 28 | Pattern Analysis Report (8 hrs)

Analyze the 100 reviews and identify the Top 5 Website Patterns That Win Cybersecurity Clients

For each pattern: What it is, which vendors execute it best, specific screenshots

Map each pattern to the buyer journey stage it influences

Include recommendation for how Intrusion should implement each pattern

Deliver final PDF report with screenshots and recommendations Deliverable

Workstream 2: Blog SEO Overhaul

~30 hrs 0/0

Objective

Audit every blog post on intrusion.com for SEO readiness, then rewrite each one per the guidelines we provide. All rewrites delivered in Google Docs for review -- nothing published to the live site. Finish with a complete keyword map for the entire site.

Phase 1 | Feb 24 - Feb 28 | Blog Audit (5 hrs)

Crawl all existing blog posts on intrusion.com

Document for each: URL, title, publish date, word count, target keyword (if any), meta title, meta description

Audit heading structure (H1/H2/H3), internal links, image alt text

Flag thin content (<800 words), duplicate/cannibalizing posts, non-indexable pages

Deliver blog audit spreadsheet with SEO health score per post Deliverable

Phase 2 | Mar 3 - Apr 4 | SEO Rewrites (20 hrs)

Rewrite all blog posts per the SEO guidelines document (provided separately)

Requirements: H1 with target keyword, H2/H3 hierarchy, meta title <60 chars, meta desc <155 chars, keyword in first 100 words, internal links to product pages, image alt text, minimum 800 words, CTA at bottom

Each rewrite includes: target keyword, optimized meta title, optimized meta description

Internal links point to product pages: Shield Network, Shield Cloud, Shield Endpoint, Intelligence Services

Expand thin posts to minimum 800 words with relevant, substantive content

Deliver all rewritten posts as Google Docs with tracked changes Deliverable

Phase 3 | Apr 7 - Apr 11 | Keyword Map (5 hrs)

Produce keyword-to-page mapping for the entire Intrusion website

Each page gets a primary keyword + 2-3 secondary keywords. No two pages should target the same primary keyword.

Identify keyword cannibalization issues and recommend fixes

Gap analysis: keywords with meaningful search volume that have no targeting page

Deliver keyword map spreadsheet Deliverable

Workstream 3: Technical Growth (Ongoing)

Per SOW 0/0

Ongoing Obligations

These continue on their normal cadence per the Technical Growth section of the SOW. Q1 quarterly deliverables are due.

Monthly Tasks

March CMS + Plugin Updates

March Security Scan + Report

April CMS + Plugin Updates

April Security Scan + Report

Daily Website Monitoring (ongoing)

Q1 Quarterly Deliverables

Q1 Technical SEO Audit Deliverable

Q1 Accessibility Audit Deliverable

Q1 Core Web Vitals Audit Deliverable

Q1 Quarterly Report Deliverable

Deliverables Summary

#	Deliverable	Format	Due
1	Blog Audit Spreadsheet	Google Sheet	Feb 28
2	100-Client Competitor Spreadsheet	Google Sheet	Mar 7
3	Scored Vendor Website Audit	Google Sheet	Mar 21
4	Top 5 Website Patterns Report	PDF + Screenshots	Mar 28
5	All Blog Rewrites	Google Docs (tracked changes)	Apr 4
6	Site-Wide Keyword Map	Google Sheet	Apr 11
7	Q1 Technical SEO Audit	Report	ASAP
8	Q1 Accessibility Audit	Report	ASAP
9	Q1 Core Web Vitals Audit	Report	ASAP
10	Q1 Quarterly Report	Report	ASAP