Outbound by industry
Outbound for cybersecurity vendors
Security buyers are written to by every vendor they have ever evaluated. What gets read is a plain reason to write that the buyer can check in one click, and nothing that sounds like fear.
Who buys
The roles that sign, evaluate or veto when you sell as one of the cybersecurity vendors.
CISO or head of security
Owns the risk budget and the shortlist. Reads for proof and for tone: urgency and scare lines end the email.
Director of GRC or compliance
An audit date creates purchases. They respond to a specific framework gap, named plainly.
VP or director of engineering
Buys for developer-facing security (code scanning, secrets, cloud posture) and cares about how much it slows a release.
IT director at a mid-size company
No CISO at many mid-market firms: IT owns security by default and wants something a small team can run.
Which companies fit, and how to check
Four tests, each answerable from a public page before you spend anything on a contact.
| Test | Where to check it |
|---|---|
| It is audited or regulated | A trust or security page lists frameworks it is held to (SOC 2, ISO 27001, PCI) or customers who require them. |
| Security is a first hire, not an established team | The careers page has a first security engineer or a GRC analyst role open and no security leadership page. |
| It runs the stack your product protects | Job posts and docs name the cloud, identity provider or CI system your product plugs into. |
| It sells to customers who send security questionnaires | The site has enterprise pricing, a trust center or an SSO line: the buyer side will ask them for evidence. |
Public buying signals to look for
Dated, quotable events on the prospect’s own pages.
| Signal | Page | What it can mean |
|---|---|---|
| A new trust center or a framework badge | Trust or security page | They are in an audit cycle now. A Type I badge often means the next step is continuous monitoring. |
| A first security hire posted | Careers page | Budget exists and an owner is about to arrive. Write to the hiring manager, not the job ad. |
| A public incident or postmortem | Status page or blog | Quote what they published, never what you infer. Offer a specific thing, not a pitch. |
| A vulnerability disclosure or bug bounty page | security.txt or /security | They take outside reports seriously, which suggests process maturity and appetite for tooling. |
| Enterprise features gated behind a sales call (SSO, audit logs) | Pricing page | They are moving upmarket, where security reviews of them begin. |
What to say
- Name the exact page you read and what it says, then one narrow reason that matters to a security owner.
- State what you do not know: you read a public page, not their environment.
- Offer a small, checkable thing: a one-page note on a named framework gap.
What to avoid
- Fear lines about breaches or fines.
- Claiming you scanned their domain or found a weakness: that reads as a threat and may be unauthorized.
- Tracking pixels and image-heavy emails; security teams strip them and distrust them.
A sample email
Every fact about the prospect sits next to the quote and the page it came from.
Illustrative. Fernwood Payments (fernwoodpayments.example) is an invented company, and so is Sam at Harbor GRC. The pages quoted do not exist. The email goes to its Head of Security.
| What the email says | Quote on the page | Page (illustrative) |
|---|---|---|
| your trust page lists SOC 2 Type I | “Fernwood has completed a SOC 2 Type I examination.” | fernwoodpayments.example/trust |
| a Security Compliance Analyst role is open | “Security Compliance Analyst, remote, reporting to the Head of Security” | fernwoodpayments.example/careers |
Subject: SOC 2 Type I at Fernwood
Hi {{first_name}},
I read that your trust page lists SOC 2 Type I, and that a Security Compliance Analyst role is open on your careers page.
Teams in that spot usually spend the next months turning one audit date into evidence collected all year. We help with that part only.
Worth a short note on what the Type II gap usually is for a team your size? If not, no problem.
SamOutlevo adds your sender name, postal address and a one-click unsubscribe link under every email it sends.
How Outlevo would run it
- 1
Read your site
It reads your own pages and drafts who you sell to, starting from tests like “it is audited or regulated” and “security is a first hire, not an established team”.
- 2
Find and research
It finds companies that fit and reads each one’s own pages: trust or security page, careers page and status page or blog.
- 3
Write with quotes
Each email says only what a page said, such as “your trust page lists SOC 2 Type I”, with the quote and page kept beside it.
- 4
Send with limits
Addresses are verified, every email carries your opt-out line, and sending stops when bounces or complaints rise.
Go further
Selling to security leaders
The other side: the playbook for when you sell to this industry rather than from it.
Hiring signal
A cold email template for when a prospect posts a role that signals a need: quote the posting, connect it to the problem, offer a small first step.
To a security leader
A cold email template for a CISO or security leader: plain text, a verifiable fact from a public page, no fear, one small document offered.
Every template
Cold email and AI prompt templates, each with an example.
Questions
Can a security vendor send cold email without looking like a threat?
What should I check first on a prospect’s site when I sell as one of the cybersecurity vendors?
Outbound that quotes the prospect’s own pages
Outlevo reads your website, builds the ICP, researches each company and writes emails where every fact is quoted from its site.