Our Work: Onapsis
A cybersecurity company solving the last major unsolved problem in enterprise security — for an audience that didn't yet know the problem existed.
Our Work: Onapsis
A cybersecurity company solving the last major unsolved problem in enterprise security — for an audience that didn't yet know the problem existed.
The Organization
Onapsis provides cybersecurity solutions specifically for business-critical applications — the SAP and Oracle ERP systems that sit at the core of virtually every major enterprise. These systems process an estimated $16 trillion in transactions daily. They contain an organization's most sensitive financial, operational, and personnel data. And for most of their history, they were architected without security in mind — protected only by the outer perimeter defenses that, as cloud adoption and application integration accelerated, were rapidly becoming insufficient. Onapsis was founded to address exactly that gap.
The Communication Problem
Enterprise cybersecurity is a crowded, sophisticated market. CISOs, CIOs, and Chief Risk Officers are not naive about security — they're among the most informed technology leaders in any organization. The problem Onapsis faced was specific and counterintuitive: the executives most responsible for protecting these systems had been trained to think about security at the perimeter. Firewalls, intrusion prevention, network monitoring. The ERP applications themselves — the crown jewels, as one of Onapsis's board members described them — sat inside that perimeter and were largely assumed to be safe.
They weren't. Nation-states had been targeting SAP and Oracle systems for years. US-CERT had issued warnings. The threat was real and documented. But the gap between what the security community knew and what the average CISO had internalized was significant — and until that gap closed, Onapsis couldn't have a productive sales conversation with the people who needed their product most.
Before Onapsis could sell protection, they needed their audience to understand the risk. That required communication that could make an abstract, technically complex threat feel concrete, urgent, and directly relevant to the executive watching it — in the time it takes to watch a short video.
The Thinking
SVG's work with Onapsis began with a thought leadership video featuring Chris Smith, who mapped the gap between ERP operations teams focused on uptime and security teams focused on perimeter defense — and explained why the crown jewels of every enterprise were sitting unprotected inside a hardened outer shell. Getting that interview right required SVG to understand the threat landscape well enough to ask questions that would surface the argument in a form a CISO could immediately recognize as relevant to their own organization. That depth of subject matter preparation was the foundation everything else was built on.
From there, the strategy expanded. Onapsis had built a remarkable network of advisors and board members — people whose names and track records commanded immediate respect in the C-suite. Dave DeWalt had joined the board specifically because he saw the scale of the dislocation between the threat to business-critical applications and the available defenses. Gerhard Eschelbeck had served as Chief Information Security Officer at Google. Their voices, speaking directly and unscripted about why they had chosen to align with Onapsis, carried more persuasive weight than any product demo or white paper could. A CISO watching Dave DeWalt explain why he had invested in this specific space — not cybersecurity generally, but business-critical application security specifically — would absorb the threat framing as a natural consequence of understanding why someone of his stature found it compelling.
The DeWalt engagement produced something SVG hadn't been commissioned to deliver. Reviewing the raw interview footage in post-production, the editors recognized that DeWalt's explanation of the threat landscape — the gap between the outer perimeter defenses enterprises relied on and the unprotected crown jewels sitting inside them — was a standalone communication asset that addressed Onapsis's most persistent sales challenge: getting CISOs to recognize a risk category they hadn't been trained to worry about. SVG proposed a second video. Onapsis approved it. One interview became two strategically distinct pieces of communication.
The internal sales kick-off videos served a different but complementary purpose — building internal conviction at the same moments Onapsis was scaling external credibility. The 2019 kick-off traced the company's history from founding through a major competitive acquisition, giving the sales team a narrative arc that connected where they had come from to where they were going.
The Work
A multi-year engagement beginning in 2018 with a thought leadership video featuring Chris Smith mapping the gap between ERP operations and enterprise security. From there the relationship expanded: a video press release in 2019 announcing the addition of former Google CISO Gerhard Eschelbeck to the Onapsis Board of Directors, shot with a Sony Venice camera and Steadicam at the Onapsis Boston office; a board appointment video and a standalone thought leadership video featuring cybersecurity investor Dave DeWalt — two pieces produced from a single interview after SVG identified the second communication opportunity in post-production; a Chief Revenue Officer announcement video; and internal annual sales kick-off videos for 2019 and 2020, including a 2019 piece tracing Onapsis's growth from its founding through a major competitive acquisition.
The Signal
The combination of videos SVG produced for Onapsis tells a specific story about where the company was at that moment: scaling fast, bringing in recognized external validators, and needing to communicate credibility simultaneously to the market and to its own team.
The board appointment video format — a press release brought to life through conversation rather than statement — reflects an understanding that institutional credibility in cybersecurity travels through people, not announcements. A written press release says Gerhard Eschelbeck joined the board. A video lets a prospective customer watch him explain, in his own words, why business-critical application security is the next major frontier in enterprise defense. Those are different communications entirely. The first informs. The second persuades.
The decision to propose a second DeWalt video — unprompted, after reviewing raw footage — is the clearest signal of how SVG was operating inside this relationship. Not executing a brief, but paying close enough attention to what was in the footage to recognize when something more valuable than what had been asked for was sitting right there.