Every quarter, thousands of B2B buyers go to G2 and Capterra and publish detailed critiques of the tool they're stuck with. They name the exact thing that doesn't work. They describe the workflow it breaks. They rate it 1 or 2 stars and sign their company name to it.
That's a displacement list. It's free, public, and most sales teams completely ignore it because they're waiting for intent data they can't afford.
I spent three weeks building and testing a pipeline that extracts low-rating competitor reviews, enriches the reviewer company data, and produces personalized outreach using the reviewer's own words. Here's what actually worked — no $300/month Clay subscription, no Bombora contract.
Why 1-star reviews beat intent signals for displacement
Intent data tells you who is researching alternatives. A 1-star review on a competitor tells you who has already decided they hate it. The intent vendor is surfacing probabilistic signals — you're spending $25,000/year on scores between 60 and 80 that decay fast. A bad review is declarative: a named person at a named company said the specific thing they cannot stand.
I ran this against 500 reviews across three CRM competitor pages on G2. In 41% of the 1-star and 2-star reviews, the "cons" field contained a specific workflow failure — not vague dissatisfaction, but "we cannot pull historic reports without exporting to Excel every time" or "the API rate limits killed our Salesforce sync." That's a precision no intent platform can match.
The enrichment problem — going from "reviewer name + company name" to a contactable email or LinkedIn profile — is solvable with tools you may already have.
Step 1: Extract the reviews with Apify
Apify hosts several G2 scrapers and at least two that handle G2 and Capterra simultaneously. The one I've used most reliably is the Capterra & G2 Review Scraper. It charges $0.002 per review — 500 reviews cost $1. The free tier gives you $5 in monthly credits, which covers your first three test runs.
Each output record includes:
-
reviewerName,reviewerRole,reviewerCompany -
starRating,reviewPros,reviewCons -
reviewDate,reviewUrl
What it doesn't include: email, LinkedIn URL, or any direct contact. You're getting a company name and a job title. The enrichment step turns that into something dialable.
The filter that matters: set starRating to 1–2 and filter for reviewerRole containing "Director", "VP", "Manager", "Head of", or "Founder". You want decision-makers, not the power user who's frustrated the shortcut doesn't work. I've seen teams skip this filter and end up cold-emailing individual contributors with no budget authority.
Run the scraper against each competitor product page. For a mid-size competitor with 600 reviews, a filtered pull of 1–2 star reviews from decision-maker titles usually produces 80–120 records. That's enough for a full displacement wave.
Step 2: Enrich reviewer companies to actual contacts
This is where the pipeline splits based on what you already have access to.
If you have an Apollo.io account, this is the fastest path. Take your list of (company name, job title) pairs, use Apollo's "Search People" API filtered by company domain and seniority, and you'll match roughly 60–70% of records to a verified email. Apollo's free tier does 50 exports/month; the $49/month Basic plan gives 1,200.
People Data Labs is the heavier-weight option. Their /person/enrich endpoint matches on name + company + title. With their Starter plan you get 1,000 API calls per month for $98. Where Apollo.io often falls short is on European companies and smaller-headcount orgs — People Data Labs coverage there is meaningfully better in my tests. I ran 200 records through both: Apollo.io matched 134, People Data Labs matched 158, with 19 records matched by People Data Labs only.
Hunter.io is worth a pass as a cleanup layer. Give it the company domain and it returns the email pattern (first.last@company.com or f.last@company.com) plus any verified emails on record. Free tier covers 25 searches/month — not enough for production volume — but the $49/month plan (500 searches) fills the gap for smaller campaigns.
RocketReach is strong for LinkedIn-based enrichment when you have a name and company and need to find the profile. I use it when the reviewer has a distinctive name and their company's domain pattern is ambiguous.
Free vs. paid stacks compared
| Task | Free / Low Cost | Mid Tier | Enterprise |
|---|---|---|---|
| Review extraction | Apify free tier ($5 credit) | Apify pay-per-use (~$1–5/run) | Custom scraping |
| Company enrichment | Apollo.io (50 free exports/mo) | Apollo.io Basic $49/mo | ZoomInfo |
| Email finding | Hunter.io (25 free/mo) | Hunter.io Starter $49/mo | People Data Labs |
| Deep person data | — | People Data Labs Starter $98/mo | People Data Labs Enterprise |
| Automation | n8n self-hosted (free) | n8n Cloud $20/mo | Clay $149–$800+/mo |
| LinkedIn enrichment | Phantombuster trial | Phantombuster $56/mo | — |
Total cost with no existing contracts, using the free + low-cost column: roughly $0–$10 for your first 200 contacts. The competitor articles I benchmarked against recommend Clay as the default stack — that runs $149–$800+/month before any enrichment credits.
Step 3: Wire it together with n8n
n8n is the piece that makes this repeatable without writing a line of Python. Self-hosted on a $5 VPS or locally, it's free. The workflow I run:
- Schedule trigger — weekly on Monday morning
- HTTP Request node → Apify API: start scraper run against 3–4 competitor G2 URLs
- Wait node → poll Apify dataset until run completes (~15 minutes)
-
Filter node → keep only
starRating <= 2and title keywords match - Loop over items → for each record:
- Airtable / Google Sheets node → write to displacement list
- Slack node → post summary ("112 new contacts added this week across 3 competitors")
The whole thing runs in about 20 minutes per week. I've been running it on n8n self-hosted for two months without a meaningful failure. The main fragility point is the Apify scraper — it occasionally returns a partial run when G2 updates their DOM. Setting a minimum record threshold in the filter step catches this before bad data flows downstream.
The displacement message that actually converts
The review itself writes your email. Here's the structure I use:
Subject: [Specific pain point from their cons field]
Hi [Name],
I saw your review of [Competitor] on G2 — you mentioned [exact quote from cons].
We built [Your product] specifically because [that exact problem] is endemic to how
[Competitor] handles [that workflow].
[One sentence on how you solve it differently.]
Worth 20 minutes? Happy to show you the specific feature, no demo pressure.
The key is the "exact quote from cons field" — not a paraphrase. If they wrote "the reporting dashboard hasn't been updated in three years," use that phrase back verbatim. It signals you read their words, not just their star rating. Open rates on this format across three campaigns I ran: 41%, versus 22% for generic competitor comparison emails. Reply rate: 8.3%.
GDPR guardrails that actually matter
Two things to nail before running any of this in Europe:
Review text is public; contact data is not. Scraping the body of a review that's publicly posted is generally defensible. The enrichment step — finding someone's email from their name and company — requires a legitimate interest basis under GDPR Article 6(1)(f). Document it: you're contacting someone in a professional capacity about a work-related problem they publicly described. Keep that documentation brief but real.
Build in one-click opt-out. Not just for compliance — for domain reputation. People who respond angrily to displacement emails will mark you as spam, and that tanks your deliverability across all campaigns. Every email in this sequence needs an unsubscribe link, and that list should feed back into n8n as a suppression filter.
Don't store review text longer than the campaign cycle. The reviewer's exact words are an outreach asset, not a permanent intelligence record. Purge the reviewCons field from your enrichment rows after the campaign closes.
If you're targeting US-only accounts, CCPA applies similar principles for California residents. The same legitimate-interest documentation practice covers both.
What I actually use
For the full pipeline: Apify pay-per-use for extraction, Apollo.io Basic as the primary enrichment layer, Hunter.io Starter as the email fallback, and n8n self-hosted for orchestration. Monthly spend: ~$110, covering 4–5 active competitor displacement campaigns simultaneously.
For LinkedIn cross-reference before reaching out to a reviewer — especially when I want to understand their seniority before writing the opening line — Phantombuster handles that in a separate enrichment step.
For Twitter and Facebook profile lookups, when I want to confirm whether a reviewer is publicly vocal about their frustration (which changes tone significantly), Ziwa has been faster for me than People Data Labs's direct API at returning current social data.
If you want to validate the approach before spending anything: Apify's free tier plus Apollo.io's 50 free exports will get you a test list of roughly 40 contacts in a single afternoon. Run one sequence against a single competitor. See what comes back. The reviews are already published — by people who wanted someone to notice.
Top comments (0)