[ Business value ]

Build a customer story with attributable evidence

A defensible customer story connects an approved claim to a comparable baseline, a documented intervention and a measured result. Keep failures, human effort and competing explanations in view.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Choose a precise outcome and measurement rule before selecting favorable examples.
  • Obtain permission for identity, quotations, supporting data and final context.
  • Include incomplete tasks, correction effort and changes in the observation population.
  • Avoid turning authentication measurements into unsupported revenue, security or delivery claims.
On this page

Begin with the claim you could defend

A useful customer story explains a specific change in a defined setting. It should let a reader understand the starting problem, what people and software did, what improved and what remains uncertain. It must not turn an attractive chart into a claim that one product caused every subsequent business result. This article is a method for preparing an attributable story, not an EmailAuth testimonial or an account of a real customer.

Write the proposed outcome in measurable terms before collecting favorable examples. Distinguish reduced investigation effort, fewer misconfigured legitimate senders, a changed authentication pass rate and increased customer response. Each needs different evidence. A report showing fewer DMARC failures cannot independently establish fewer phishing incidents, higher revenue or better inbox placement. Decide which claim is actually being evaluated and which claims will be omitted.

Obtain permission for the story and its evidence

Identify the organization that can authorize publication, the individual who may approve a quotation and the people allowed to review supporting records. Permission to process operational reports is not automatically permission to publish the customer's identity, logo, incidents or message details. Record the approved wording, audience, channels, review date and any expiration or withdrawal conditions. An anonymized story still needs a confidentiality review because combinations of details may identify the customer.

The FTC's endorsement guidance explains that endorsements must be truthful and material relationships may require disclosure. It also cautions that a generic results disclaimer does not resolve misleading implications about typical performance. These are United States advertising considerations, not a universal legal clearance. Ask the relevant reviewer about the intended markets and keep customer consent separate from factual substantiation.

Preserve a comparable baseline

Define the observation unit: a sender investigation, a domain onboarding task, a report-processing batch or a message population. Record the dates, inclusion rules, environment versions, sender mix, staffing, workload and available evidence. Keep unsuccessful and abandoned tasks in the dataset with their reasons. A baseline assembled only from difficult cases cannot fairly be compared with an intervention period containing only easy wins.

For authentication measurements, preserve reporting sources, periods, identifiers and filters. RFC 9990 describes duplicate and overlapping reports; a changed collector can alter apparent totals without changing mail behavior. Missing reporters, delayed delivery and new sender populations must be visible. Report counts and denominators together, and avoid treating an unobserved period as zero failures.

For labor measurements, include setup, training, review, corrections, escalation and maintenance. Separate hands-on time from elapsed time and waiting for another team. Document whether the same operators performed both periods and whether familiarity with the task could explain some improvement. A saved click is not automatically saved labor if a new review step consumes the time elsewhere.

Describe the intervention precisely

List the changes that occurred and when: authentication configuration, sender retirement, operator training, collector replacement, staffing changes or new approval procedures. Identify which actions the product performed, which the supplier's people performed and which the customer's team performed. Do not use a product name as a substitute for an intervention description.

DMARC's current specification supports a defined authentication outcome through aligned identifiers. That scope helps constrain the story. Successful alignment does not establish that recipients trusted a message, that the content was benign or that an account was uncompromised. Receiver behavior and the business environment can contribute to the observed result independently.

Where practical, agree on comparable tasks, an unchanged reference population or a staggered rollout before collecting the after-period data. These can help test alternative explanations, but do not label the result a controlled experiment unless the design actually supports that description. State the attribution limit plainly when several interventions happened together.

Calculate the result without hiding the work

Consider a wholly fictional benchmark of twenty equivalent sender investigations. The baseline requires 160 hands-on minutes. A proposed assisted method takes 100 minutes plus 35 minutes of review and correction, totaling 135. The difference is 25 minutes across the benchmark, not 60 minutes of net savings. These invented numbers illustrate accounting only; they are not customer or EmailAuth performance data.

If the assisted method fails to finish three cases, report that outcome and include the recovery effort under the predefined measurement rule. Show task-level variation rather than letting one average conceal exceptional cases. Explain any exclusions, changed definitions and unavailable measurements. An arithmetic improvement can coexist with weaker accuracy or increased operational risk, so acceptance should include quality as well as speed.

The FTC substantiation policy calls for an adequate basis before objective advertising claims are distributed. A quotation expressing satisfaction does not supply missing measurement evidence. Match each public sentence to the underlying record, approved interpretation and authorized attribution.

Publish the bounded story or keep it as a method

A strong final narrative identifies the starting condition, intervention, observation window, sample, measured outcome, effort, exceptions and limits. Put important qualifications beside the claim they constrain. Use only quotations approved in their final context; do not turn a cautious observation into a broad endorsement through editing or headlines.

Retain the evidence package under agreed access and retention controls, and assign someone to revisit the story after product or customer circumstances change. Later corrections should update the claim and its approval record, not quietly leave an obsolete success statement in circulation. No customer has been contacted or represented in this guide.

The exact commissioning gate is still open: A repeatable before-and-after task benchmark with failures, human effort and attribution limits. Customer consent, a documented intervention and approved quotations are also required. Until those artifacts exist, publish no purported customer success story from this material; the useful deliverable is the verification method and its explicitly fictional worked calculation.

[ Takeaway ]

If the customer evidence and permissions are missing, publish a verification method rather than a purported success story.

[ By role ]

What this means for you

Choose your role for practical next steps.

Customer marketing

Keep permission attached to the claim

A publishable story needs both accurate evidence and authorization to identify and quote the customer.

Next steps

  1. Record the approved identity, logo, quotation, audience and review date.
  2. Preserve qualifications in headlines and shortened versions.
  3. Reconfirm claims when the product or customer circumstances materially change.

Analytics and operations

Make the comparison reproducible

A favorable average cannot compensate for an undefined baseline or missing cases.

Next steps

  1. Fix the observation unit, denominator and inclusion rules before measurement.
  2. Preserve task-level results, report provenance and operator effort.
  3. Document co-occurring changes and alternative explanations.

Legal and customer approver

Review what the story implies

The wording may imply broader or more typical results than the underlying evidence supports.

Next steps

  1. Review the complete narrative and disclosure placement for intended markets.
  2. Confirm customer authorization separately from substantiation.
  3. Withhold unsupported claims even if a quotation sounds enthusiastic.

[ FAQs ]

Frequently asked questions

Can we reuse a testimonial already on a vendor website?

Not as proof of your new claim or as evidence of permission to republish it. Obtain approved wording, attribution and supporting records for the intended story and audience.

What makes a before-and-after comparison comparable?

Use the same task definition, inclusion rules and measurement method, and disclose differences in staffing, sender mix, product configuration or workload. Record exclusions before deciding which outcomes look favorable.

Should unsuccessful automated tasks be omitted from time savings?

No. Report their number and outcome, and include recovery effort under the predefined measurement rule. A faster result that leaves more work unfinished may not represent an improvement.

Does a lower DMARC failure count prove a product prevented phishing?

No. DMARC measures authenticated identifier alignment in its protocol scope. Counts can change with traffic, reporting coverage or configuration, and do not independently measure phishing incidents.

How should duplicate reports affect the baseline?

Retain report identifiers, periods and provenance, then apply a documented reconciliation rule consistently to both periods. Otherwise changed collection can manufacture an apparent trend.

Is a results-may-vary footnote sufficient for exceptional results?

The FTC guidance warns that generic disclaimers do not resolve misleading typical-result implications. Relevant advertising review must assess the actual claim and audience; this is not legal clearance.

What does the fictional twenty-task calculation demonstrate?

It shows that 100 minutes plus 35 minutes of review is 135 minutes, so the difference from 160 minutes is 25. It supplies no real customer performance evidence or guaranteed saving.

What remains open before this is a customer story?

A repeatable before-and-after benchmark including failures, human effort and attribution limits, together with consent, documented intervention and approved quotations. No customer has been contacted or represented here.

[ Sources ]

Sources

  1. FTC Endorsement Guides What People Are Asking
  2. FTC Policy Statement Regarding Advertising Substantiation
  3. RFC 9989: Domain-Based Message Authentication Reporting and Conformance
  4. RFC 9990: DMARC Aggregate Reporting

[ Glossary ]

Glossary

Baseline
The defined starting measurement and conditions against which a later observation is compared.
Intervention
The documented configuration, process, staffing or tool changes introduced during the assessment.
Attribution limit
The boundary on how confidently an observed change can be assigned to a particular intervention.
Denominator
The population or task count used to interpret a measured rate or average.
Material connection
A relationship that may affect how an audience evaluates an endorsement and may need disclosure under applicable guidance.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base