How to run a cold email campaign for a cybersecurity consultancy

Who should you contact?

Start with security leaders preparing a procurement review. This defines a possible account segment, not a purchased list or permission to contact every person in it.

Check the existing environment, internal expertise, procurement process and change window.

• Include an account only when its public activity relates to a public security leadership hire.
• Before proposing delivery, resolve this question: Who can authorize access and define which assets are out of scope?
• Exclude accounts when you cannot provide a scoped security assessment proposal with explicit authorization boundaries, when the relevant work is outside your service area or qualifications, or when the company has declined contact.

What makes the timing relevant?

Research a public security leadership hire. Look for the organization's own announcement, current job description, project page or procurement notice. Keep the exact URL, publication date and a short note about the observable fact.

Separate observation from inference. The event may justify a question; it does not establish budget, dissatisfaction with an incumbent or a commitment to buy.

Check whether the initiative is still active and whether the recipient owns it. A third-party directory or an old announcement is a lead for research, not sufficient evidence by itself.

• Observed: a dated source describes a public security leadership hire.
• Hypothesis: the organization may find a scoped security assessment proposal with explicit authorization boundaries useful.
• Unresolved: Who can authorize access and define which assets are out of scope?

What should the first offer contain?

Propose a scoped security assessment proposal with explicit authorization boundaries. Keep the initial output small enough for the buyer to evaluate before committing to a larger engagement.

Use the qualification question to define scope: Who can authorize access and define which assets are out of scope? If the answer changes feasibility, timing or responsibilities, resolve it before pricing.

Bring a redacted delivery example, relevant qualifications and a clear statement of scope. If you have no comparable client result, show a clearly labeled sample and describe its limitations.

• State what the proposed scoped security assessment proposal with explicit authorization boundaries will include, the information you need and who will review it.
• Identify exclusions, assumptions and the next decision. Do not imply that a discovery document includes implementation, regulated advice or certification.
• For the first conversation, request only the information needed to establish fit. Arrange an appropriate secure process for confidential material later.

A worked cold email example

Fictional scenario: an organization in the segment “security leaders preparing a procurement review” publishes a notice about a public security leadership hire. Alex and Morgan are invented people; no campaign or customer outcome is being reported.

The draft below is a writing example, not a send-ready message. Replace the fictional sender and event with verified facts, add your real business identity and required postal/contact details, and check the applicable outreach rules. Do not send it unchanged.

Subject: Scoped security assessment proposal with explicit authorization boundaries

Hi Alex,

I noticed the public notice about a public security leadership hire. Is your team responsible for the next steps?

I’m Morgan at Example Partner, a cybersecurity consultancy. We could prepare a scoped security assessment proposal with explicit authorization boundaries to help you evaluate the scope.

One question before proposing work: Who can authorize access and define which assets are out of scope?

Would an outline be useful? If another team owns this, I would appreciate being pointed to the right role.

Morgan
Example Partner (fictional business)

If this is not relevant, let me know and I will not follow up.

How to follow up without repeating the pitch

If a further message is appropriate, clarify one component of a scoped security assessment proposal with explicit authorization boundaries rather than asking whether the recipient read the first email. A useful follow-up resolves scope or ownership.

For example: “To keep the proposed scope relevant, could you clarify: Who can authorize access and define which assets are out of scope? If this is not your team's responsibility, I can close the enquiry.”

If the reply is “we already have a provider,” ask whether an additional scoped review is wanted; do not invent a failure by the incumbent. If the reply is “not now,” ask permission before arranging future contact. Honor a decline or opt-out without another sales follow-up.

What should you measure?

Use scoped technical discovery conversations as the sector-level outcome, but define a qualified response for this campaign as a reply from the relevant owner that discusses a scoped security assessment proposal with explicit authorization boundaries and helps resolve: Who can authorize access and define which assets are out of scope?

Track delivered messages, qualified replies, referrals, objections, opt-outs and delivery failures separately. Qualified reply rate = qualified replies ÷ delivered messages. An open is not proof of interest.

Build a small research cohort before choosing sending volume. Review the actual replies and fit errors; change one variable at a time. There is no universal reply-rate target or sending volume established by this guide.

Do not imply a breach, vulnerability or outage without evidence, or scan systems without permission.

Questions to resolve before launching

Sources and scope

These references support sending requirements and sector context. They do not validate the campaign hypothesis or predict results. US and UK guidance is labeled; check the rules and professional requirements for your actual location.

• NIST: Cybersecurity Framework

  A framework for organizing cybersecurity risk discussions; it does not certify a provider.

• FTC: CAN-SPAM compliance guide (US)

  US commercial email rules; business-to-business email is not automatically exempt.

• ICO: business-to-business marketing (UK)

  UK recipient type, personal data and electronic marketing rules. Public contact information alone does not establish permission.

• Google: email sender guidelines

  Authentication, message formatting and sender requirements for personal Gmail recipients.

Reference links checked 27 October 2026. Review current source guidance before using it.