Cold email to CISOs: a playbook for skeptical buyers

A security leader may get a lot of vendor email and has good reason to read it with caution. Your message is one more thing arriving from outside the company, and the reader is trained to ask what could go wrong. Treat the email as a small security review you are about to fail or pass.

This guide covers how to write cold email to a CISO or a security team: what to prove, what to leave out, how to structure a short sequence, and what to check before anything sends. It sits next to the playbooks for VPs of Sales and developer tools. Those cover other roles. This one covers a reader whose job is to say no.

Who this is for

This is for founders, sales leads and marketers at companies that sell to security leaders. That includes CISOs, heads of security, security engineering managers and GRC leads. It also fits teams that sell something adjacent, such as IT tooling, data infrastructure or compliance services, where a security leader holds a veto.

It assumes you already know your product and have a rough idea of who buys it. If you are unsure which accounts fit, run the free ICP assessment first. It reads up to 5 public pages of a website and returns facts labeled as verified observations or AI inferences, plus up to 5 experimental segment hypotheses [[1]](#sources).

One point up front: this guide does not tell you which countries or regions to sell into. That is your decision. Outlevo asks which countries you sell into and never proposes markets [[2]](#sources).

Steps

1. Build a small, honest list

Start with accounts where a security leader plausibly owns the problem you solve. If you have past deals, import them from a CSV or your CRM and get a win/loss analysis that proposes ICP hypotheses [[3]](#sources). That analysis counts companies, not deals, and labels small samples: under 10 won companies is very low confidence [[2]](#sources). AI-proposed segments stay experimental until a person approves them [[2]](#sources). Do not treat a hypothesis as a finding.

2. Qualify each account with evidence

Write down why this account, in terms you could quote. Outlevo prices qualification at 3 credits and light qualification at 1 credit [[4]](#sources). Whatever tool you use, keep the same rule: a reason you cannot source does not go in the email.

3. Verify addresses before you send

Verify every address first. Email verification costs 1 credit in Outlevo [[4]](#sources). For background, see email verification and the glossary entry on deliverability. You can also see ZeroBounce pricing, plans and integrations.

4. Set up sending so it survives inspection

A security reader may check your domain. Make sure it holds up.

Before a Smartlead campaign sends in Outlevo, every mailbox must be connected and warmed up, and its domain must have SPF, DKIM and DMARC checked in the last 7 days [[5]](#sources).
A new managed mailbox sends nothing until it is warm: at least 14 days, usually about 3 weeks [[6]](#sources).

Plan the launch date around that warm-up. If you send from a separate domain, make the signature and the website match the sender's real name and company.

5. Write the first email

Use the structure in the examples below. Keep your control language to one line and link to a page for detail.

6. Keep a person in the reply loop

When someone replies with interest, Outlevo can answer with your Calendly or Cal.com link, with their name and email filled in. On autopilot the answer goes at once; otherwise it waits in Replies for you to send [[7]](#sources) [[8]](#sources). For this audience, a person reading the reply and answering it by hand is the safer setting. A reply from a security leader often contains a pointed question, and a booking link does not answer it.

7. Honor opt-outs fast

Treat every "no" and every unsubscribe as final. The rules for that are in the compliance section below.

What to expect on replies

Set expectations on volume. Belkins' 2026 study covers 7.5M B2B emails sent in 2025, with reply rate defined as replies divided by emails sent [[9]](#sources). It reports that 0.45% of cold emails get a reply, across industries [[10]](#sources). That is an all-industry figure, not a figure for security leaders. Do not build a forecast on it. Use it as a reminder that the list should be small, the targeting tight, and every send defensible.

Proof points that hold up

A skeptical buyer trusts claims they can check or that describe a control. They distrust adjectives. Lead with the second kind and keep the first kind out.

Controls

Describe what stops your product, or your outreach, from doing something it should not. Specific controls are more credible than "enterprise-grade security."

As an example of the form, here is how Outlevo's own controls are stated:

Nothing is sent outside a policy that a person approved [[11]](#sources).
Policies set who can be contacted, on which channels, how often and with what budget [[11]](#sources).
Kill switches pause a campaign, a channel or the whole workspace at once [[11]](#sources).

Write your own version of these in the same style. Name the control, say who owns it, and say what it prevents. If you cannot state a control without an adjective, you probably do not have one yet.

Audit trail

Security teams think in logs. If you can say what is recorded, you speak their language.

Outlevo checks every external action against the approved policy before it runs, and records it in a ledger [[11]](#sources). Staff support access is time-limited and appears in the customer's activity feed, with the reason and the number of changes made [[12]](#sources).

When you write about your own product, answer these in plain words: what is logged, who can see the log, and how long a person on your side can access customer data. Do not claim a log you cannot show.

Data handling

Say where the data sits and how it is protected, using only facts you can document.

Outlevo states that every customer table is protected by row-level security in the database, and that personal data such as email addresses is encrypted at the field level [[12]](#sources). Those are statements a security engineer can ask follow-up questions about, which is what makes them useful. A line like "we take privacy seriously" gives them nothing to ask.

Evidence about their company

If you mention something about the recipient's company, the claim has to be true and traceable. Outlevo's Readiness Card needs at least three observations, each with a source and a date [[13]](#sources). Facts read from a website are kept only when their quote is found on the page, and guesses are labeled as hypotheses, never presented as findings [[13]](#sources).

Copy that discipline by hand if you do not use the tool. Quote what is on their public page. If you are guessing, say you are guessing. A confident wrong claim about a security team's stack can cost you the reader's trust.

What to leave out of the first email

Cut these from the first touch:

Fear. Breach headlines, "your attack surface is exposed" and countdown language read as manipulation to this audience.
Claims about their security posture. Unless you have their written permission, say nothing about weaknesses you think you found. Outside scanning of a target without consent is a bad way to introduce yourself.
Certifications you do not hold, and logos you cannot name. A buyer can ask for the report. A made-up reference ends the thread.
Statistics without a source and a date. Any number in your email should come with where it is from.
Attachments and tracking-heavy formatting. A plain text email with one link is easier to trust than a designed one with images.
A calendar link as the only ask. Offer something smaller first, such as a one-page description of how your product handles data.
Superlatives. "Leading," "powerful" and "advanced" tell the reader nothing and mark you as a vendor to filter.
Fake familiarity. Do not write "I saw you are passionate about security." Say what you actually read.

Keep the email short enough to read on a phone in one pass. One idea, one proof point, one small ask.

A short sequence structure

A sequence is the ordered set of messages one lead receives; the glossary entry on sequence has the basics. For a skeptical buyer, keep it short and make each touch add something different. Do not repeat the first email with "bumping this."

Touch 1: the plain intro. Who you are, one specific reason you wrote, one control or data-handling fact, one small ask.

Touch 2: the evidence. A few days later, send a follow-up that gives the buyer something to check: a link to your security page, a short description of what you log, or a sourced fact about their field. No pressure language.

Touch 3 (optional): the LinkedIn note. If you use LinkedIn, Outlevo sends a connection invitation with a note of at most 300 characters, then one message after the person accepts; a reply stops that lead's emails [[14]](#sources). Send the invitation from your own account. Each person connects their own LinkedIn account [[14]](#sources). Outlevo never sees or stores your LinkedIn password [[14]](#sources). Automatic sending comes with Growth and Managed, or with a LinkedIn seat on Builder; otherwise the invitations and messages are drafted for you to send by hand [[14]](#sources).

Touch 4: the close. A final short email that says you will stop writing and leaves one useful link. Then stop.

Example copy

These are templates. Replace every placeholder with something true and sourced. Do not copy the proof lines unless they describe your own product.

First email

Subject: Question about {{specific thing on their site}}

Hi {{first name}},

I'm {{name}} at {{company}}. I read {{quoted line from their public page}} and wondered how your team handles {{specific problem}}.

We {{one plain sentence on what you do}}. Our controls are documented here: {{link}}. It covers what we log, who at our company can reach customer data, and how that access is recorded.

Would a short written summary of how we handle data be useful? If not, tell me and I'll stop.

{{name}}

{{title, company, real address}}

{{unsubscribe link}}

Second email

Subject: Re: Question about {{specific thing on their site}}

{{first name}}, one addition. Questions we usually get from security teams are answered here: {{link}}. It covers {{item}}, {{item}} and {{item}}.

If someone else owns this, a name is enough and I'll write to them instead.

LinkedIn note

Hi {{first name}}, I wrote to you about {{topic}}. No pitch here. Happy to connect if it's relevant.

Final email

{{first name}}, I'll stop here so I don't clutter your inbox. The documentation stays at {{link}} if it's ever useful.

The pattern: a quoted reason for writing, a checkable control, a way out, and no pressure. The ask in every message is smaller than a call.

Compliance basics for security audiences

Security and legal readers know these rules, and a mistake here is a quick reason to distrust you. This is not legal advice; check your own situation with counsel.

US. The FTC states: "The law makes no exception for business-to-business email." [[15]](#sources)
Mailbox providers. Google's sender guidelines say: "Marketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body." [[16]](#sources) Yahoo's sender best practices say: "Honor unsubscribes within 2 days" [[17]](#sources).
EU. GDPR Article 6(1)(f) allows processing that is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party" [[18]](#sources). Recital 47 adds: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." [[19]](#sources)
UK. The ICO says: "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." [[20]](#sources)

If you track website visitors to decide who to contact, note how Outlevo's script behaves: it looks up the organization behind a visitor's network, such as their employer, and never identifies a person or sets a cookie [[21]](#sources). Browsers that send Do Not Track or Global Privacy Control, and automated browsers, send nothing at all [[21]](#sources). A security reader who checks your site will care about that.

What to check

Run this list before the first send.

Sender. The name, title and company on the email match a real person with a real page. The sending domain passes SPF, DKIM and DMARC.
Claims. Every statement about the recipient's company is quoted from a public page or labeled as a guess.
Controls. Each control you name exists, has an owner and can be shown in a document.
Numbers. Every statistic has a source and a date. Delete the ones without.
Ask. The first email asks for something small and gives an easy way to say no.
Opt-out. There is a visible unsubscribe link, and a process to honor it within 2 days [[17]](#sources).
List. Addresses are verified and the list is small enough that you can read each row.
Approvals. If you run outreach with Outlevo, remember that nothing is sent outside a policy that a person approved [[11]](#sources). Review that policy, including who can be contacted and how often, before you launch [[11]](#sources).
Kill switch. You know who can pause a campaign, a channel or the whole workspace, and how [[11]](#sources).
Reply handling. A named person reads and answers every reply, especially the hard questions.
Audit. You can say what is recorded about each send. Outlevo records every external action in a ledger [[11]](#sources).

If you integrate sending with other tools, the same discipline applies to webhooks. Outlevo signs each delivery with an HMAC-SHA256 of the body and a timestamp [[22]](#sources). That is worth mentioning if a technical reader asks how your systems pass data around.

Next step

Write one first email and one follow-up, then test them against the "What to check" list. Start with a short list of accounts you can describe with sourced facts. Run the free ICP assessment on your own site to see which facts it labels as verified observations and which as AI inferences [[1]](#sources). Plans start free; Builder is USD 29 per month with 320 credits a month [[4]](#sources). For details on how outreach is governed, read how Outlevo works and the security page.