The ICP Dual-Constraint Diagnostic

What it is

A twelve-question diagnostic that pressure-tests an ICP definition against both the customer side (who has the problem and the buying permission to act) and the company side (who your organization can actually win and keep). The diagnostic does not produce an ICP — it tests whether the ICP you have, or are about to ratify, is grounded in evidence or in assumption.

Definitions you will need

Ideal Customer Profile (ICP). An account-level definition of the kind of company you should be selling to — expressed in firmographics, technographics, security maturity, regulatory obligation, and behavioral signals. Not a list of target logos. A set of criteria.

Dual constraint. The discipline of resolving two questions at once: what the customer will buy, and what your organization can actually package, price, sell, and sustain. Either side answered alone produces a strategy that fails.

How to use it

For a single ICP segment, answer each question with one of three responses: Evidence-backed (you have specific data, win/loss verbatim, customer interviews, or pipeline analytics that ground the answer), Reasonable assumption (you have indirect signal but no direct evidence), or Guessing (you do not actually know). The point is not to score well. It is to score honestly. Every Reasonable assumption and Guessing answer is a research backlog item.

Customer-side questions (the buyer reality)

1. The forcing function. What specific event, regulation, business pressure, or operational pain forces an account in this segment to consider a purchase like ours this fiscal year, rather than next?
2. The budget reality. Where does the budget for this purchase come from in the account — security, IT, compliance, business unit, board-mandated cyber line — and is it allocated, contested, or hypothetical?
3. The buying permission. Who in the account can move this purchase forward, who can stop it, and which of those roles do we currently have a relationship with?
4. The competitive set. When an account in this segment evaluates us, who are they actually comparing us to — including incumbents, build-it-internal options, and "do nothing"?
5. The reason to switch. What specific failure of the incumbent, or specific change in the buyer's situation, makes them willing to take the risk of changing vendors?
6. The trust path. Where do buyers in this segment form opinions before they ever talk to us — peer communities, analyst inquiry, specific publications, advisory relationships — and are we present in those places?

Company-side questions (the org reality)

7. Seller coverage. Can our current sales team reach accounts in this segment with their current territory model, account assignments, and quota structure? Or are we describing accounts no one is actually paid to work?
8. Channel economics. If the segment requires partner, MSSP, or hyperscaler co-sell motion, do we have the deal-registration mechanics, partner enablement, and economics to make those motions profitable for the partner?
9. Pricing fit. Does our pricing metric (per-user, per-asset, per-workload, per-GB ingested, per-endpoint) match how this segment buys and budgets? Or are we asking them to absorb a metric that breaks their procurement model?
10. Support match. Does our support tier, SLA, and CSM coverage match what this segment will need at their scale and regulatory posture? Or are we entering accounts we cannot retain at our target gross retention number?
11. Reference availability. Do we have referenceable customers in this segment at the right scale and regulatory profile, or will every deal require us to invent the reference story?
12. The honest TAM question. If we removed every account our sellers cannot reach, our channel cannot serve, our pricing breaks for, and our support cannot retain — what is the real serviceable addressable market in this segment, and is anyone leadership-side willing to say it out loud?

How to read the output

If you have Evidence-backed answers on more than nine of twelve, you have a real ICP and the rest of the chapter's tools will work. Build the buying permissions map next.

If you have Evidence-backed answers on six to nine, you have a partial ICP. The unanswered questions are your research backlog for the quarter. Do not ratify the ICP at QBR yet. The risk of spray-and-pray is high.

If you have Evidence-backed answers on fewer than six, you do not have an ICP. You have a hypothesis. The honest move is to say so internally and invest a quarter in evidence work — win/loss program, analyst inquiry review, primary research — before ratifying anything downstream. Most security companies are in this category and do not know it.

A specific watch-out: if every customer-side question is Evidence-backed and every company-side question is Guessing, you have produced a wish-list ICP. If every company-side question is Evidence-backed and every customer-side question is Guessing, you have produced an available-bias ICP — a description of the customers you already serve, dressed as strategy. Both fail. The dual constraint is what keeps you out of either trap.