Short answer: Start by mapping who owns security at each target account. Large US companies usually have a Chief Information Security Officer (CISO) with directors and managers below. Mid-size companies may have a VP or Director of Security, and smaller companies may give security to the CTO, CIO or IT Director. Build lists by company size and industry, find and verify contact details, and write outreach that is precise, low-hype and respectful. Security leaders are heavily prospected, so relevance matters more than volume.
Why security leaders are hard to reach
CISOs and security leaders get a large volume of vendor outreach. Many are skeptical of cold messages, and some deliberately keep contact details private. Their teams are also trained to spot phishing, so sloppy emails with odd links or urgent requests can backfire. The goal is fewer, better-targeted messages.
Step 1: Map security titles by company size
| Company size | Who usually owns security |
|---|---|
| Enterprise | CISO, Deputy CISO, VP Security, Directors of Security Operations, GRC, Identity and Application Security |
| Mid-market | VP or Director of Security, Head of Information Security, Security Engineering Manager |
| SMB and startups | CTO, CIO, IT Director, VP Engineering, sometimes a first security hire |
Also note adjacent roles that influence purchases:
- Security architects and engineers who run evaluations
- GRC, risk and compliance leaders
- IT and infrastructure leaders
- Procurement and legal for contract review
Step 2: Choose your target segments
Security priorities differ by industry. Highly regulated sectors such as financial services, healthcare, insurance and government contractors often have mature security teams and formal review. SaaS and tech companies may prioritize security to win enterprise customers. Pick segments where your product addresses a clear problem.
Useful filters:
- Industry and regulatory exposure
- Headcount and growth
- Location, for example New York, the Bay Area, the Washington, DC region, Boston, Austin and Atlanta
- Signals such as new security job postings, a new CISO hire or public compliance commitments you can verify
Step 3: Build the contact list
- Search professional networks for security titles at target accounts
- Check company pages, conference speaker lists and industry community rosters for security leaders
- Confirm each person is current at the company
- Map two to four people per account, such as the CISO, a director and a hands-on evaluator
Step 4: Find and verify contact details
- Use a contact finder you have tested on a sample of security leaders
- Verify work emails and pilot-send small batches
- Dial-test direct numbers carefully
- Remove contacts who have changed roles; security leadership turnover is common
- Track the source of every contact
Because security teams filter aggressively, deliverability matters. Use clean sending domains, avoid link-heavy emails and keep formatting simple.
Step 5: Write outreach that earns trust
- Lead with a specific, relevant problem rather than fear-based messaging
- Avoid exaggerated threat claims and buzzwords
- Do not include attachments or unexpected links in a first email
- Mention a credible reason for reaching out, such as a public initiative or new hire
- Offer something useful, such as a short technical note or peer discussion
Consider reaching an evaluator or director first; they may pull in the CISO if there is real fit.
Step 6: Measure and refine
Track usable contact rate, bounces, replies and meetings by segment and title. Security leaders may respond less often, so judge success on meeting quality and pipeline rather than reply volume alone.
Compliance (high level)
Follow CAN-SPAM for commercial email: accurate sender details, a physical address and a working opt-out. For calls or texts to mobile numbers, consider TCPA and do-not-call rules. Applicable state privacy laws may also matter. Honor opt-outs quickly; security leaders notice.
Common mistakes
- Using fear, uncertainty and doubt as the main message
- Sending emails that look like phishing
- Targeting only the CISO and ignoring evaluators
- Ignoring that smaller companies may not have a security leader at all
- Sending high volume with low relevance
Where PeakAI fits
PeakAI is a contact finder with a Chrome extension that finds phone numbers, work emails and personal emails from professional profiles, drawing on global sources, with bulk export and integrations. After you map security titles at your US target accounts, use PeakAI or another tested finder to pull contacts, then verify before outreach. Run the same sample through each candidate tool and compare usable contacts and workflow fit. Check thepeakai.com for current features, coverage and pricing.
FAQ
Who handles security at a company without a CISO?
Usually the CTO, CIO, IT Director or VP Engineering. Some startups hire a first security engineer or lead who reports to engineering.
Should I email the CISO or a security director first?
Both can work. Directors and architects often run evaluations, and they may bring in the CISO if the fit is real.
Why do my emails to security leaders get filtered?
Security teams use strict filters. Keep emails plain, avoid attachments and heavy links, and send from properly authenticated domains.
What messaging works with security buyers?
Specific, credible messages tied to a real problem. Avoid hype and fear-based claims.
How often do security leaders change jobs?
Turnover is common in security leadership, so re-verify contacts before each campaign.
