Keepstage After-Show / Sample report / Cybersecurity

After-Show Report: Acme Ops, Q4 Product Live

What a webinar export becomes: follow-ups by lifecycle stage for sales, a ranked backlog with quotes for product, and drafted answers for your expert. This is the full report, with every section a client receives.

Webinar: Q4 Product Live: phishing triage, the SIEM feed and what’s next
Platform: Zoom Webinars · 60 min · 2 speakers
Date: Thursday 8 October 2026, 16:00–17:00 CET
Prepared: Thursday 15 October 2026
Data quality: A · n = 142 questions · 789 attendees

Download the PDF

Acme Ops is invented: cyber risk software for mid-size companies: security awareness training, phishing simulations, threat detection and vulnerability management, 180 employees, on HubSpot Marketing Hub Professional. People appear as invented first names with an initial.

01 · Executive summary

A native SIEM connector is the top ask, and six people with open deals asked questions.

789

attended

56% of 1,412 registered

142

questions

18 per 100 attendees

61%

answered live

87 of 142

104

people asked

13% of attendees

41 min

average watch time

of 60 · median 47

n = 1,412 registrants, 789 attendees, 142 questions · Source: Zoom Webinars attendee and Q&A reports. 12 Acme Ops employees excluded from every figure.

Five findings

A native SIEM connector is the top ask. 14 people asked to send reported phishing and user-risk scores straight to their SIEM (6 customers, 3 SQL, 5 leads), up from 9 in September. With n ≥ 10 it’s a pattern, not an anecdote. Next Act, item I-001
Six people with open deals asked questions. A task for each owner is drafted, with the question and a suggested answer. Northwind Retail sent 4 attendees, asked 5 questions and clicked “Book a demo”. Call Sheet
55 questions went unanswered live. They merge into 19 distinct questions: 11 drafted answers wait for your expert, and 8 (pricing, launch dates, legal) are left to you. Answers to approve
Five people asked for something that already exists. Developers can already get secure-coding labs instead of the general phishing course. That’s onboarding content, not roadmap. Item I-005
EU data residency is the top objection. 3 of the 9 objections, all from accounts with 200–999 employees, one of them with an open deal. Sales needs a written answer before the next webinar. Spotlight

Three recommendations

Take I-001 (SIEM connector) and I-002 (control mapping) to the next planning session, with the quotes and who asked.
Owners call the six open-deal askers this week, Northwind Retail first.
Before the next webinar: switch off anonymous questions in Zoom and publish the secure-coding path article.

In their words

“Every morning I copy the reported-phishing list into our SIEM by hand.”
Q-0044 · Customer · 200–999 employees

02 · Attendance and engagement

More than half of registrants came, and the demo held them.

56% of registrants attended. Viewers peaked at minute 10 and 418 were still there at the end of the Q&A (60% of the peak). Questions built through the demo and peaked in the first minutes of the Q&A.

From registration to action n = 1,412 registrants

Registered1,412
Attended78956% of registered
Asked a question10413% of attendees
Clicked a tracked link618% of attendees · 36 of them also asked

Stages are not strictly nested: 25 people clicked a link without asking anything, and they get their own Call Sheet cell.

Concurrent viewers, minute by minute n = 789 attendees · Source: Zoom attendee report (join and leave times)

Questions per 5 minutes n = 142

So what: viewers dipped at minute 25 and came back for the demo (640 → 655), the only rise after the first ten minutes, and questions peaked right after it. Next time, open the Q&A inside the demo instead of after it.

Engagement per block n = 142 questions · 71 clicks
Block	Avg viewers	Questions	Per 10 min	Link clicks
Welcome0′–5′ · Luis M. (moderator)	590	4	8.0	0
What shipped in Q35′–25′ · Ana R., Head of Product	675	38	19.0	0
Live demo: reported phishing, triage and the SIEM feed25′–40′ · Tom B., Solutions Engineer	628	47	31.3	38
Live Q&A40′–60′ · Ana R. and Tom B.	510	53	26.5	33

Tracked links posted in the chat 61 people · 71 clicks · Source: HubSpot tracked URLs
Link	Posted	People
Join the SIEM connector beta waitlist	16:31	38
Book a demo	16:42	19
Docs: control mapping for ISO 27001 and NIS2	16:47	14

Attendance and questions by lifecycle stage n = 1,412 registrants · HubSpot lifecycle stage on 8 Oct
Stage	Registered	Attended	Rate	Asked	% of attendees
Customer	318	212	67%	38	17.9%
Open opportunity	23	18	78%	6	33.3%
SQL	62	41	66%	9	22.0%
MQL	171	96	56%	22	22.9%
Lead / subscriber	693	358	52%	23	6.4%
No marketing consent	145	64	44%	6	9.4%
Total	1,412	789	56%	104	13.2%

So what: open opportunities came in the highest proportion (78%) and asked the most per head. Contacts without marketing consent came least, and get no commercial follow-up.

Attendees by company size n = 789 · from the email domain and HubSpot company

Attendees by company size
Category	Bar	Value
1–49 employees		118 15%
50–199		241 31%
200–999		287 36%
1,000+		97 12%
Unknown (personal email)		46 6%

Attendees by role n = 789 · HubSpot job title, grouped

Attendees by role
Category	Bar	Value
IT and security managers		281 36%
Security engineers and SOC analysts		152 19%
GRC, risk and compliance		118 15%
CISO and executive		71 9%
IT operations		64 8%
Other		58 7%
Unknown		45 6%

Most upvoted questions Zoom upvotes
Id	Question	Upvotes	Status
Q-0031	“Can reported phishing and user-risk scores go straight into our SIEM, not as a CSV once a day?”SQL with an open deal · 200–999 employees	23	Answered live · 00:44
Q-0058	“Can I export training and simulation results mapped to ISO 27001 and NIS2 controls?”MQL · 200–999 employees	17	Answered live · 00:47
Q-0071	“Half of what users report is newsletters. Can those be filtered before they reach my analysts?”Customer · 200–999 employees	14	Unanswered → draft D-02
Q-0063	“Does SCIM remove a leaver from training and simulations the same day they leave?”Open opportunity · 200–999 employees	12	Answered in writing
Q-0089	“When someone reports a phish, can you pull the same email from every inbox, or is that still manual?”MQL · 50–199 employees	9	Unanswered → draft D-04

03 · Cues · early access

23 moments when an owner could have stepped in while the account was still watching.

Cues are live sales alerts: the account owner gets a message in Slack while the account is still in the session. They need the event to run on Keepstage Live, which sees questions and clicks as they happen. This webinar ran on Zoom Webinars, so nothing was sent during the show. Below are the alerts Cues would have posted, replayed from the timestamps in the export.

16:07Target accounts watching (digest)
4 target accounts are watching: Northwind Retail (4), Halcyon Freight (6), Fernhill (2), Corva Health (5).
To
#event-leads
Suggested action
Owners stay on; the moderator watches for their questions.
16:33Open deal · high-intent click
Priya S. (open deal) asked about sending reported phishing to the SIEM and clicked Book a demo. Still watching.
To
Luis M., deal owner
Suggested action
Answer in the Q&A that the SIEM connector beta waitlist is open; call Northwind Retail tomorrow.
16:38Pricing intent
J. Ortega · Fernhill (MQL, target account) asked whether SCIM is included in the Standard plan.
To
Sara K., owner
Suggested action
Don’t quote prices in the chat; offer a call with the plan comparison.
16:44Competitor mention · existing customer
M. Lund · Brightline (customer, renewal in 60 days) asked how the content library compares with Competitor A.
To
Dan P., CSM (customer route on for this webinar)
Suggested action
CSM check-in this week, with the secure-coding path and the SIEM connector beta.
16:49Flagged by the moderator
K. Adeyemi · Halcyon Freight (lead) asked about piloting simulations in one region with 600 warehouse staff.
To
#event-leads
Suggested action
Assign an owner and propose a pilot call.

Alerts by trigger n = 23 · replayed, not sent

Cues alerts by trigger
Category	Bar	Value
Target accounts watching (digests)		3
Open deal or SQL activity		6
Pricing intent		5
High-intent click		4
Competitor mention		3
Flagged by the moderator		2

Rules: at most one immediate alert per contact and trigger; target-account digests every 10 minutes; more than 30 alerts in an hour switch to a digest. Companies come from the email domain and your target-account list, never from IP addresses. Alerts carry the minimum: name, company, topic.

Example · Acme Ops (fictional data) · Names are invented and shortened.

04 · Spotlight · what your market asked

SIEM and SOAR integrations drew the most questions; phishing simulations drew the warmest.

Each question is classified by intent and topic, and duplicates are merged. SIEM and SOAR integrations (23) and phishing simulations (22) lead the topics; phishing simulations has the highest share of positive questions. The tone is about the question text, never about the person.

What people asked for n = 142 questions, by intent · 211 messages, 69 were greetings, thanks or off-topic

Questions by intent
Category	Bar	Value
Feature request		44 31%
How-to or “does it exist?”		29 20%
Integration		20 14%
Problem		13 9%
Pricing or plan		11 8%
Roadmap or dates		10 7%
Objection		9 6%
Competitor		6 4%

Topics, with the tone of the questions n = 142 · negative 24 · neutral 87 · positive 31
Topic	Questions	Negative	Neutral	Positive
SIEM and SOAR integrations	23	5	14	4
Phishing simulations	22	2	12	8
Training content and skills	21	4	11	6
Threat detection	19	3	12	4
Board and compliance reporting	15	1	11	3
Identity, SSO and SCIM	14	3	9	2
Vulnerability management	10	3	5	2
Frameworks and audits	9	2	6	1
Data handling and residency	5	1	4	0
Other	4	0	3	1

Objections n = 9 · normalised
Objection	Questions	Who	Suggested response
User data and reported emails have to stay in the EU	3	2 MQL · 1 open deal · all 200–999 employees	Security to confirm the hosting region in writing; sales links the trust page and the DPA.
Phishing simulations will annoy staff and flood the helpdesk	2	2 leads · 50–199 employees	Send the guide for a staged first campaign and the helpdesk FAQ.
Contractors shouldn’t cost a full licence	2	1 SQL · 1 MQL	Pricing topic: the owner answers on a call, not by email.
Our works council has to approve phishing simulations	2	2 customers · 1,000+ employees	Send the data-processing summary and the simulation policy template, and offer a session for the works council.

Competitor mentions n = 6
Named	Questions	Compared on
Competitor A	3	A security awareness suite: size of the content library, industry benchmarks
Competitor B	2	An email security gateway with built-in training: reported-phish triage
An in-house tool	1	A yearly slide-deck course and a manual phishing test

Competitor names are replaced in this sample. A real report shows the names your audience used, next to their questions.

Buying signals 29 people with at least one
Signal	People	Who
Clicked “Book a demo”	19	4 SQL · 7 MQL · 5 leads · 3 customers
Asked a pricing or plan question	9	11 questions · 2 open deals · 2 SQL
Asked about a pilot, rollout or go-live date	6	1 open deal · 2 SQL · 3 leads
Asked about a security questionnaire or works-council approval	3	1 open deal · 2 MQL

People asking for the SIEM connector item I-001 · last four webinars · stable item id

Top accounts by engagement company from the email domain · 46 personal-email attendees not included
#	Account	Attendees	Questions	Clicks	Avg min	What they cared about	Owner	Score
1	Northwind RetailOpen deal · SQL	4	5	3	54	SIEM connector, clicked Book a demo	Luis M.	91
2	Halcyon FreightLead · target account	6	3	2	49	Pilot in one region	Unassigned	84
3	FernhillMQL · target account	2	3	1	51	Control mapping, SCIM on the Standard plan	Sara K.	77
4	BrightlineCustomer · renewal in 60 days	3	2	0	44	Compared with Competitor A	Dan P. (CSM)	72
5	Corva HealthMQL	5	1	2	38	EU data residency	Sara K.	66
6	Pinecrest UtilitiesCustomer	3	2	1	47	False positives in reported phishing	Dan P. (CSM)	61
7	Oakridge FacilitiesSQL	2	2	1	52	Auto-quarantine of reported phishing	Luis M.	58
8	Tidewater LogisticsLead	4	0	1	31	Watched most of it, no questions	Unassigned	52

Score = event score (0–100) from transparent weights: attendance minutes, questions, high-intent clicks and target-account status. It ranks this list; it never changes a lifecycle stage.

Compared with your previous webinars same taxonomy, stable item ids
Webinar	Attendees	Questions	Per 100	Asked for the SIEM connector
JuneSpring release	612	88	14.4	5
JulyVulnerability prioritisation preview	655	97	14.8	7
SeptemberPhishing simulations: what’s new	702	113	16.1	9
OctoberQ4 Product Live	789	142	18.0	14

So what: the SIEM connector grew from 5 to 14 people in four webinars (1.6× September), while questions per 100 attendees rose from 14.4 to 18.0.

05 · Next Act · product roadmap from audience questions

Twelve items, and the first three come with open deals attached.

75 of the 142 questions map to 12 product items. The other 67 are how-to questions answered live, pricing and dates: they go to the Call Sheet and the answers, not the backlog. Each item links to its source questions, so any number can be traced to the original question.

I-001 · priority 82 · Planned

Native SIEM connector for reported phishing and user risk

14 people · 19 questions · 6 customers · 3 SQL · 5 leads

“Can reported phishing and user-risk scores go straight into our SIEM, not as a CSV once a day?”
Q-0031 · SQL with an open deal · 200–999 employees

“Every morning I copy the reported-phishing list into our SIEM by hand.”
Q-0044 · Customer · 200–999 employees

“Will the SIEM connector also trigger our SOAR playbooks?”
Q-0102 · Lead · 50–199 employees

Suggested owner: PM, Integrations

I-002 · priority 64 · Planned

Training evidence mapped to ISO 27001, NIST and NIS2 controls

9 people · 9 questions · 4 customers · 1 open deal · 2 SQL · 2 MQL

“Can I export training and simulation results mapped to ISO 27001 and NIS2 controls?”
Q-0058 · MQL · 200–999 employees

“Our auditor wants evidence per control, not a completion percentage.”
Q-0077 · Customer · 1,000+ employees

Suggested owner: PM, Compliance

I-003 · priority 55 · Planned

Same-day deprovisioning through SCIM

7 people · 9 questions · 2 customers · 2 open deals · 1 SQL · 2 MQL

“Does SCIM remove a leaver from training and simulations the same day they leave?”
Q-0063 · Open opportunity · 200–999 employees

Suggested owner: PM, Platform and security

Next Act backlog 12 items from 75 of 142 questions · ranked by priority
#	Item	People	Questions	Who asked	Open deals	Status	Jun → Oct	Priority	Suggested owner	Quote
01	Native SIEM connector for reported phishing and user riskI-001 · Feature request · SIEM and SOAR integrations	14pattern	19	6 customers · 3 SQL · 5 leads	1	Planned	5 → 7 → 9 → 14	82	PM, Integrations	“Can reported phishing and user-risk scores go straight into our SIEM, not as a CSV once a day?” Q-0031
02	Training evidence mapped to ISO 27001, NIST and NIS2 controlsI-002 · Feature request · Frameworks and audits	9signal	9	4 customers · 1 open deal · 2 SQL · 2 MQL	1	Planned	3 → 4 → 6 → 9	64	PM, Compliance	“Can I export training and simulation results mapped to ISO 27001 and NIS2 controls?” Q-0058
03	Same-day deprovisioning through SCIMI-003 · Feature request · Identity, SSO and SCIM	7signal	9	2 customers · 2 open deals · 1 SQL · 2 MQL	2	Planned	4 → 5 → 5 → 7	55	PM, Platform and security	“Does SCIM remove a leaver from training and simulations the same day they leave?” Q-0063
04	Auto-quarantine of reported phishing across inboxesI-004 · Integration · Threat detection	6signal	8	1 customer · 1 SQL · 2 MQL · 2 leads	–	New	0 → 2 → 3 → 6	49	PM, Detection	“When someone reports a phish, can you pull the same email from every inbox, or is that still manual?” Q-0089
05	Secure-coding path for developersI-005 · How-to · Training content and skills	5signal	5	3 customers · 2 leads	–	Exists	1 → 2 → 4 → 5	41	Customer education	“Can developers get secure-coding labs instead of the general phishing course?” Q-0095
06	Fewer false positives in reported-phishing triageI-006 · Problem · Threat detection	5signal	6	2 customers · 1 MQL · 2 leads	–	New	2 → 2 → 3 → 5	38	PM, Detection	“Half of what users report is newsletters. Can those be filtered before they reach my analysts?” Q-0071
07	Risk dashboards scoped per country or business unitI-007 · Feature request · Board and compliance reporting	4anecdotal	4	2 customers · 1 SQL · 1 MQL	–	New	0 → 1 → 2 → 4	27	PM, Reporting	“Can each country’s IT lead see only their own users’ risk scores?” Q-0083
08	Critical-vulnerability alerts per team channelI-008 · Integration · Vulnerability management	4anecdotal	4	1 customer · 3 MQL	–	New	1 → 1 → 2 → 4	25	PM, Integrations	“Can critical vulnerabilities go to each team’s own Slack or Teams channel, with the asset owner tagged?” Q-0112
09	Quarterly board report templateI-009 · Feature request · Board and compliance reporting	3anecdotal	3	2 customers · 1 lead	–	Planned	2 → 3 → 3 → 3	19	PM, Reporting	Summary only: no single question says it best
10	EU data residencyI-010 · Objection · Data handling and residency	3anecdotal	3	1 open deal · 2 MQL	1	New	0 → 0 → 1 → 3	17	Security, with sales	“Where are our users’ data and reported emails stored? Our regulator expects them to stay in the EU.” Q-0120
11	Higher API rate limitsI-011 · Integration · SIEM and SOAR integrations	3anecdotal	3	1 customer · 2 SQL	–	New	0 → 1 → 1 → 3	14	PM, Integrations	Summary only: no single question says it best
12	Import our own training modules (SCORM)I-012 · Feature request · Training content and skills	2anecdotal	2	2 leads	–	New	0 → 0 → 0 → 2	11	PM, Training content	Summary only: no single question says it best

How we score

priority = reach × segment weight × urgency × confidence, scaled to 0–100. Reach counts people, not mentions, with a log correction so one loud account can’t dominate.

Segment weights: customer 1.0 · open deal 1.0 · SQL 0.8 · MQL 0.6 · lead 0.4 · unknown 0.3. Urgency: blocking 1.0 · important 0.7 · curiosity 0.4. Confidence: reviewed by a person 1.0. All weights are yours to change.

Evidence labels: fewer than 5 people = anecdotal · 5–9 = signal · 10 or more = pattern.

“They don’t know it exists”

5 people asked for Secure-coding path for developers, which already exists. That isn’t a roadmap item: it’s a help article, an onboarding email and a line in the next webinar. The people who asked are in a HubSpot list (ks_requested_items contains I-005), so you can tell them directly.

Before the readout, your PM writes down their own top 5, then marks each item as known, new and actionable, or not relevant. The board goes to your PM’s tool as a CSV; HubSpot only stores who asked what.

06 · Call Sheet · follow-ups by lifecycle stage

Owners get 28 tasks, not a spreadsheet. Everything else waits, switched off, for your review.

Every registrant sits in one cell: their lifecycle stage in HubSpot crossed with what they did in the webinar. Each cell gets one action. Open deals never get an automatic email: their owner gets a task with the question and a suggested answer. Keepstage never sends anything; your HubSpot does, once you switch it on.

The Call Sheet matrix: lifecycle stage × what they did n = 1,412 registrants · each person sits in one cell
Stage	Asked, unanswered	Asked, answered	Clicked, didn’t ask	Attended, silent	No-show
Customer318 registered	15Answer email · CS ticket if a problem	23Recap with the minute	9CSM task: expansion	165“What’s new for you”	106Replay for customers
Open opportunity23 registered	3Owner task + deal note	3Owner task + deal note	0Urgent owner task	12Deal note	5Deal note
SQL62 registered	4Owner task · email after 48 h	5Owner task · email after 48 h	4Urgent owner task + meeting link	28Owner email template	21Owner email template
MQL171 registered	8Answer email + walkthrough	14Answer email + walkthrough	7Walkthrough invite + SDR task	67Replay + top 3 moments	75Replay + top 3 moments
Lead / subscriber693 registered	8Answer + article	15Answer + article	5Walkthrough invite	330Article from the session	335Replay + next webinar
No marketing consent145 registered	3Answer only	3Answer only	0Nothing sent	58Nothing sent	81Nothing sent

Consent check, per registrant n = 1,412 · from HubSpot subscription types on 8 Oct and the registration notice

Green 1,237 answer to their own question, customer communications or marketing opt-in
Amber 36 sales tasks for deals and SQLs already in conversation, no automatic email
Red 139 no basis for a commercial follow-up: nothing is sent

Acme Ops’ registration notice on 8 Oct said: “We use the questions you ask and the sessions you attend to improve our product and to tailor follow-ups.” That covers aggregate product analysis and follow-ups to opted-in contacts. This check is orientative; your lawyer confirms it.

Segments, messages and what lands in HubSpot 19 segments · 18 active lists · 9 email templates · 5 workflows, all switched off · every list is named “[After-Show] Q4 Product Live · …”
Segment	Contacts	Action	Message angle	Template	HubSpot list	Workflow	Consent
CustomerAsked, unanswered	15	Email with the approved answer; 3 product problems open a support ticket	“You asked about … — here’s the answer.”	T1 Answer to your question	… · Customer · Asked, unanswered	WF1 Answer to your question OFF	GreenAnswer to their own question
CustomerAsked, answered live	23	Email with the minute in the recording and the help article	“Your question, answered at minute …”	T2 Answered live	… · Customer · Asked, answered live	WF2 Answered-live recap OFF	GreenAnswer to their own question
CustomerClicked, didn’t ask	9	Task for the CSM: expansion conversation	—	—	… · Customer · Clicked, didn’t ask	Owner task after your OK	AmberSales task, existing customer
CustomerAttended, silent	165	“What’s new for you”: the three changes that matter to security teams already on Acme Ops	“Three things from Thursday that change your phishing triage.”	T3 What’s new for customers	… · Customer · Attended, silent	WF3 Recap and replay OFF	GreenCustomer communications subscription
CustomerNo-show	106	Replay with chapters for customers	“The 12 minutes worth watching.”	T4 Replay for customers	… · Customer · No-show	WF3 Recap and replay OFF	GreenCustomer communications subscription
Open opportunityAsked	6	Task for the deal owner with the question and a suggested answer, plus a deal note. No automatic email	—	—	… · Open opportunity · Asked	Owner task after your OK	AmberSales task for a deal in conversation
Open opportunityAttended or no-show	17	Deal note only (“attended, 47 min” or “registered, didn’t attend”)	—	—	… · Open opportunity · Attended or no-show	Deal note	AmberSales task for a deal in conversation
SQLAsked	9	Owner task; the answer goes by email only if the owner hasn’t acted in 48 h	“Following up on your question from Thursday.”	T5 Owner follow-up	… · SQL · Asked	WF4 SQL fallback after 48 h OFF	GreenMarketing opt-in
SQLClicked, didn’t ask	4	Urgent owner task with the owner’s meeting link	—	—	… · SQL · Clicked, didn’t ask	Owner task after your OK	AmberSales task
SQLAttended silent or no-show	49	Owner email from a template, with the replay and one resource	“The part of the session about the SIEM feed.”	T5 Owner follow-up	… · SQL · Attended silent or no-show	Sent by the owner	GreenMarketing opt-in
MQLAsked	22	Email with the answer and a walkthrough invitation	“Your question, and a 20-min walkthrough if useful.”	T1 Answer to your question	… · MQL · Asked	WF1 Answer to your question OFF	GreenMarketing opt-in
MQLClicked, didn’t ask	7	Walkthrough invitation by email and a task for the SDR	“You looked at the demo: want a walkthrough?”	T6 Walkthrough invitation	… · MQL · Clicked, didn’t ask	WF5 High-intent walkthrough OFF	GreenMarketing opt-in
MQLAttended silent or no-show	142	Replay and the top 3 moments	“The 3 moments people asked about most.”	T7 Replay and top 3 moments	… · MQL · Attended silent or no-show	WF3 Recap and replay OFF	GreenMarketing opt-in
Lead / subscriberAsked	23	Email with the answer and one article on the topic	“Your question, answered.”	T1 Answer to your question	… · Lead / subscriber · Asked	WF1 Answer to your question OFF	GreenMarketing opt-in
Lead / subscriberClicked, didn’t ask	5	Walkthrough invitation by email	“You looked at the demo: want a walkthrough?”	T6 Walkthrough invitation	… · Lead / subscriber · Clicked, didn’t ask	WF5 High-intent walkthrough OFF	GreenMarketing opt-in
Lead / subscriberAttended silent	330	Nurture: an article written from the session	“What 142 questions told us about triaging reported phishing.”	T8 Article from the session	… · Lead / subscriber · Attended silent	WF3 Recap and replay OFF	GreenMarketing opt-in
Lead / subscriberNo-show	335	Replay and an invitation to the next webinar	“You missed it. Here’s the replay, and the next date.”	T9 Next webinar invitation	… · Lead / subscriber · No-show	WF3 Recap and replay OFF	GreenMarketing opt-in
No marketing consentAsked	6	The answer to their own question, nothing else	“You asked about … — here’s the answer.”	T1 Answer to your question	… · No marketing consent · Asked	WF1 Answer to your question OFF	GreenAnswer only
No marketing consentAttended silent or no-show	139	Nothing is sent. Counted here so you know who was left out	—	—	—	—	RedNo basis for a commercial follow-up

HubSpot dry run: what will be written

Contacts updated: 1,412
Contacts with a question written: 104
Properties (ks_): 15
Active lists: 18
Email templates (drafts): 9
Workflows: 5 · all OFF
Owner tasks: 28 for 7 owners · after your OK
Deal notes: 23
Support tickets: 3 customer problems
Excluded: 12 Acme Ops employees · 139 without consent · 9 anonymous questions

Never touched: lifecycle stage, lead status, contact owner, deal stages and consents. On HubSpot Starter you get the properties, lists and templates, and send by hand.

Properties on each contact

ks_last_eventQ4 Product Live · 2026-10-08
ks_attendanceattended / no-show
ks_minutes_watchedfrom the Zoom attendee report
ks_top_blockblock they stayed longest in
ks_question_texttheir question, verbatim
ks_question_intentfeature request, how-to, pricing…
ks_question_topicSIEM, phishing simulations, SCIM…
ks_question_statusanswered live / drafted / left to expert
ks_answer_textonly after your expert approves
ks_answer_urlminute in the recording or help article
ks_event_scoretransparent weights, shown below
ks_followup_segmentthe Call Sheet cell
ks_requested_itemsNext Act item ids, e.g. I-001
ks_source_platformzoom_webinars
ks_data_qualityA

Example · Acme Ops (fictional data) · List, template and workflow names as they would appear in HubSpot.

07 · Answers to approve

11 drafted answers for your expert, and 8 questions we leave to you.

55 questions went unanswered live; merged, they are 19 distinct questions. Each draft is written from your recording and help center, cites its source and is kept under 80 words. Nothing is written to ks_answer_text or sent until your expert approves it. Pricing, launch dates, promises and legal topics never get a draft.

How these were made: software drafts each answer from the recording and the help center; a person at Keepstage checks every draft and its source; your expert approves, edits or rejects it.

D-01 · Q-0095Draft · waiting for your expert

“Can developers get secure-coding labs instead of the general phishing course?”

5 people · 3 customers, 2 leads

Yes. Assign the Secure coding path to a group in Training → Paths: developers get hands-on labs on injection, authentication and secrets handling instead of the general course, and their results show in the same reports.

Sources: Help center: “Training paths by role” · Recording 00:36:10
Confidence: High

D-02 · Q-0071Draft · waiting for your expert

“Half of what users report is newsletters. Can those be filtered before they reach my analysts?”

3 people · 2 customers, 1 lead

Partly. In Settings → Reported emails, turn on bulk-mail rules: messages from known newsletter and marketing senders are tagged “bulk” and closed with a thank-you to the reporter, so your analysts see the rest. We’ve passed your use case to the product team.

Sources: Help center: “Triage rules for reported emails” · Recording 00:29:40
Confidence: Medium
Check: Mentions the product team: check the wording

D-03 · Q-0083Draft · waiting for your expert

“Can each country’s IT lead see only their own users’ risk scores?”

2 people · 1 SQL, 1 customer

Yes. Give each IT lead the Regional admin role and limit it to their country’s user group: they see risk scores, training and simulation results for those users only.

Sources: Help center: “Roles and permissions”
Confidence: Medium

D-04 · Q-0089Draft · waiting for your expert

“When someone reports a phish, can you pull the same email from every inbox, or is that still manual?”

4 people · 2 MQL, 1 SQL, 1 lead

Today an analyst removes a reported email from every inbox with one action in the triage view, after reviewing it. Automatic removal without that review isn’t available.

Sources: Help center: “Removing a reported email from all inboxes” · Recording 00:51:05
Confidence: High
Check: Don’t add a date: item I-004 is on the backlog

D-05 · Q-0118Draft · waiting for your expert

“How do I keep the security team out of phishing simulations without removing them from reports?”

2 people · 2 customers

Add the security team to an exclusion group in Simulations → Audiences. They won’t receive simulated phishing, but they stay in training assignments and in every report.

Sources: Help center: “Excluding users from simulations”
Confidence: High

Showing 5 of 11 drafts. In a real delivery they arrive in an Answers-to-approve sheet, sorted by confidence, one row per question.

Left to your expert: no draft written

Pricing (4)
- “Is SCIM included in the Standard plan?” Q-0066
- “Do contractors and shared mailboxes count as licensed users?” Q-0091
- “Is there a discount for schools or non-profits?” Q-0108
- “What does the Enterprise plan add on top of Standard?” Q-0127
Launch dates (3)
- “When does the SIEM connector leave beta?” Q-0057
- “Will the SIEM connector also trigger our SOAR playbooks?” Q-0102
- “When will auto-quarantine of reported phishing be available?” Q-0130
Legal and security (1)
- “Where are our users’ data and reported emails stored? Our regulator expects them to stay in the EU.” Q-0120

08 · Method and data quality

Data quality A: a full After-Show, with nine questions we couldn’t follow up.

Full After-Show. Every attributed question is matched to a person, their lifecycle stage, owner and open deal.

Grades: A full After-Show · B roadmap complete, follow-ups by attendance only · C aggregate insights only.

What we received, and what it made possible
Source	Contains	Enables
Zoom attendee report	Registrants, join and leave times	Attendance by stage, minutes watched, the viewers curve
Zoom Q&A report	Question, asker email, time, status, upvotes	Next Act, Call Sheet, answers
Chat file	Messages with time	Greetings vs questions, link context
Recording	Video file	Minutes for answers given live, sources for drafts
HubSpot, read-only	Lifecycle stage, owner, open deals, subscription types	The Call Sheet rows and the consent check
Registration notice	Privacy text as it was on 8 Oct	What each follow-up can be based on

What we couldn’t do

9 questions were asked anonymously: they count in Next Act but get no personal follow-up.
46 attendees used a personal email address: no company, so they’re not in the account view.
1 message was excluded because it contained personal details about someone else.
Clicks exist only for the 3 tracked links posted in the chat; other links weren’t measured.
Zoom poll results weren’t in the export, so polls aren’t in this report.

Next time, in Zoom Webinars

Switch off anonymous questions in Zoom’s Q&A settings.
Post links as HubSpot tracked URLs.
Export the poll report with the other files.
Keep the registration notice: it already covers product analysis and tailored follow-ups.

Privacy, before any software reads a question

Each person becomes a pseudonymous id (a keyed hash of the email, with a key unique to Acme Ops). Names and emails stay in a separate table that only the HubSpot write step reads.
Emails, phone numbers and links are removed from question text on our side before classification.
Quotes carry a segment, never a name: “Customer · 200–999 employees”.
Acme Ops is the controller; Keepstage is the processor under a DPA signed before any data arrives. Source files are deleted at the end of the agreed retention period, with a written deletion statement.

How the numbers and quotes are checked

Software groups duplicate questions and suggests intent, topic and tone. A person reviewed all 142 classifications and every merge, and changed 13.
Every figure comes from a saved query over the export, and each number in the text is checked against it before delivery.
A quote appears only if it matches the original question exactly. Summaries are labelled as summaries.
Every chart and table states its n and its source.

Not in this report, on purpose

No company identification from IP addresses.
No enrichment of individual people, and nothing taken from LinkedIn.
No emotion or personality analysis of attendees: tone is about the question text.
No data from any other Keepstage client.
No revenue attribution: the report shows signals and tasks, not closed deals.
No emails sent by Keepstage, ever.

With Keepstage Live, every question has an author, and Cues reach owners during the show.

09 · Next steps

What Acme Ops does this week, in HubSpot and outside it.

Your product expert
Approves, edits or rejects the 11 drafts, and writes the 8 answers left to them.
Approved answers are written to ks_answer_text
Your HubSpot admin
Reads the dry-run preview and replies OK.
Properties, 18 lists and 9 templates are written; 28 owner tasks are created
Sales owners
Work the 6 open-deal tasks first, Northwind Retail first, then the 13 SQL tasks.
Deal notes already carry the question
Marketing
Reviews the templates and switches the workflows on one at a time, WF1 first.
Nothing sends until a workflow is on
Customer success
Publishes the secure-coding path article and checks in with Brightline.
Tell the 5 people who asked (list for I-005)
Product
Writes their own top 5, compares it with Next Act, and imports the CSV into their tool.
I-001 and I-002 to the next planning session
Everyone
Joins the 30-min readout on Tuesday 20 October.
Marketing, product and sales in one call

Prepared by Keepstage After-Show · Sample report · Acme Ops is a fictional company; all data is invented.

Want this for your last webinar?

Tell us which platform you use and how often you run webinars. Twenty minutes, no slides. You get a fixed quote within 24 hours of the call.

Request a 20-min call

Not ready to share personal data? Start with a free Questions-only snapshot: send the questions column, no names or emails, and get the top 10 asks within 48 hours.