Ripples in the Pond: 10 Signals Your Startup Has Real Interest (And How We Measure Ours)

Most startup advice about traction metrics is about what you can count. MRR. Signups. Churn. Conversion rate. DAU. The dashboards are beautiful. The numbers are precise. And if you're a seed-stage company selling to security professionals, intelligence analysts, and federal buyers — the numbers are almost entirely useless.

Here's why: our audience doesn't run JavaScript.

DugganUSA runs a threat intelligence platform. We serve a STIX feed to consumers in 46 countries. We publish a blog with 1,700+ posts. We operate a searchable archive of 400,000 Epstein DOJ documents and 1 million IOCs. Our Cloudflare layer sees 18,000+ page views a week. Our GA4 — which requires JavaScript to fire — sees 644.

That's a 97% dark traffic ratio. Ninety-seven percent of our audience is invisible to every analytics tool that requires a browser to cooperate.

So how do you know if a startup is working when you can't see 97% of the people using it?

You read the ripples.

---

1. Your Content Shows Up in Enterprise Tooling

This week, 17 sessions came from statics.teams.cdn.office.net — Microsoft Teams. Someone copied a DugganUSA link into a corporate Teams channel. Four more came from jira.cs.sys — someone's internal Jira instance. Two from crm.innodisk.com — a Taiwanese industrial SSD manufacturer's CRM.

These aren't clicks from social media. These are evidence that your content has entered enterprise workflows. When a security analyst pastes your blog post into a Jira ticket as supporting evidence, you've gone from "content" to "reference material." Nobody tracks this in a funnel. It's the highest-quality signal you can get.

2. Competitors Start Reading You

Five sessions this week from archon.ti.qianxin-inc.cn — QiAnXin's internal threat research platform. QiAnXin is China's largest private cybersecurity firm. Two sessions from virustotal.com — someone on VirusTotal linked to our IOC analysis.

When competitors allocate analyst time to reading your output, you've crossed the line from "noise" to "signal" in the market. No dashboard measures this. Your referrer logs do.

3. Government Finds You Without Being Asked

Stafford, Virginia — home to the FBI Academy at Quantico, Marine Corps Base Quantico, and DEA facilities. Three sessions. Chantilly, Virginia — NRO headquarters and the densest cluster of cleared contractors in America. One session. Norfolk, Virginia — home to Fleet Cyber Command and NAVCYBERFOR. One session. Tampa, Florida — CENTCOM and SOCOM at MacDill Air Force Base. One session, five page views.

We have never done outbound sales to the federal government. We have no lobbyist. We have no BD rep working the Beltway. These visits came from organic discovery, AI referrals, and word of mouth. When the defense and intelligence community reads your threat intel blog without being invited, that's a demand signal no accelerator pitch deck can manufacture.

4. AI Models Recommend You to Humans

Twenty-nine sessions from chatgpt.com this month, averaging 228 seconds each. Six from claude.ai. Two from Perplexity. People are asking AI models questions like "where can I find threat intel on Iranian APTs" or "who has searchable Epstein files" and the models are answering with our URLs.

This is the compounding flywheel that most startups haven't figured out yet. Your content trains the index. The index sends the visitor. The visitor validates the content. The model weights update. The next query sends two visitors.

If you're not measuring AI-referred traffic as its own channel, you're missing the fastest-growing acquisition source that exists right now.

5. Researchers Stay for an Hour

One session from datasetsearch.research.google.com — Google's Dataset Search. Session duration: 3,223 seconds. That's 53 minutes. One person found our structured data through Google's research index and spent nearly an hour reading.

You can't buy that engagement. You can't growth-hack it. You earn it by having data worth studying. One 53-minute session from a researcher who found you through Google Dataset Search is worth more than 10,000 impressions on LinkedIn.

6. The Product Sells Itself at 2 AM

A user registered via Stripe, auto-provisioned to our starter tier, and ran 9 queries — all without a single human interaction. No demo call. No sales email. No onboarding meeting. Someone found the pricing page, decided the product was worth paying for, entered their card, and started using it.

This is the signal every investor asks about: "Does it sell without you in the room?" When the answer is yes at 2 AM on a Tuesday, the funnel is working even if the numbers are small.

7. A Newsletter Operator Registers for Free

Bob Gourley registered for a free API key this month. He runs OODA Loop — a cybersecurity and national security newsletter that reaches federal CISOs and defense decision-makers. One query so far.

The query count doesn't matter. The who matters. One newsletter mention from the right person reaches an audience you couldn't buy with $50,000 in LinkedIn ads. Track your registrations by influence, not volume.

8. Your Brand Becomes a Search Term

Google Search Console shows 15 clicks on the query "dugganusa" in the last 30 days, with a 39.5% click-through rate at position 1.1. People are typing our name into Google. Not "threat intelligence platform." Not "Epstein files search." Our name.

Brand search is the canary in the coal mine for product-market fit. When strangers type your company name into a search engine, they heard about you somewhere and came looking on purpose. Track this number monthly. It's more honest than any NPS score.

9. The Geographic Long Tail Fills In

140 distinct US cities showed up in our GA4 this week. Bozeman, Montana. Fargo, North Dakota. Natchez, Mississippi. Leakesville, Mississippi. Uniontown, Alabama — population 1,798, one user, 32 page views.

When your traffic starts appearing in places you've never marketed to, you're past the "friends and family" phase. Organic discovery doesn't cluster in your home city. It sprays across the country in a pattern that looks like noise but is actually reach.

10. The Audience Composition Is the Signal

Ninety-seven percent of our visitors block JavaScript. They browse with NoScript, use curl, access our STIX feed via automated tooling, or run hardened government workstations that strip tracking by policy. They will never show up in GA4. They will never click a cookie banner. They will never convert through a traditional funnel.

And they are exactly the right audience.

If your product serves security professionals, intelligence analysts, or anyone who takes operational security seriously — your invisible traffic IS your traction metric. The fact that they're invisible means they're real. A consumer clicking through Instagram has GA4 running, cookies accepted, and a retargeting pixel firing. A NAVCYBERFOR analyst reading your threat intel from a SIPR-adjacent workstation has none of that.

The dark traffic ratio isn't a measurement gap. It's a qualification filter.

---

What Ripples Don't Tell You

Ripples tell you interest exists. They don't tell you the interest will convert.

We have 44 registered API users. Eight of them are active with 8 SIEM integrators who registered but never fired a single query. We have $45 in monthly recurring revenue. The funnel is narrow.

But the pond is alive. Federal corridor traffic. Competitor recon. AI model referrals. Enterprise tooling citations. Self-serve Stripe conversions. A 53-minute research session from Google Dataset Search. A newsletter operator who reaches the people we want to sell to.

The mistake most founders make is measuring the funnel and ignoring the ripples. The funnel tells you how the pipe performs. The ripples tell you whether the stone hit the right body of water.

Ours did. Now we need to widen the pipe.

— Patrick