Cybersecurity buyers are skeptical by training, so the cold email that works cites a rule the company already has to follow, offers one concrete deliverable, and never hints that the recipient has been hacked. The sequence below has six emails across 21 days, each written to be sent as it stands once you swap in your details.
The sender is made up: Imani Okafor, who runs Northgate Security Advisors, a six-person consultancy in Columbus that does gap assessments and managed monitoring for tax preparers and mortgage brokers. Every name, firm and address below is fictional.
Why start from a rule and not a threat
The Federal Trade Commission's Safeguards Rule applies to "financial institutions" under FTC jurisdiction, and the FTC's own business guidance gives mortgage brokers, payday lenders and tax preparation firms as examples. Its requirements are specific. A covered business has to designate a Qualified Individual to run its security program, keep a written risk assessment, require multi-factor authentication, encrypt customer information on its systems and in transit, and either monitor continuously or run annual penetration testing, with vulnerability assessments including system-wide scans every six months. A notification event involving unencrypted information on at least 500 consumers has to be reported to the FTC no later than 30 days after discovery.
Size changes the list. Under 16 CFR 314.6, a business that holds customer information on fewer than 5,000 consumers does not have to meet the written risk assessment, the monitoring or testing schedule, the written incident response plan or the annual report to the board. Many small tax preparers sit under that line, so for them, lead with what applies at any size: the Qualified Individual, multi-factor authentication and encryption. The emails below say which items depend on the count.
A mortgage broker with six employees usually has no idea which of those items it covers. That gap is your opening. Tone it as help with paperwork, not a warning. The Bureau of Labor Statistics counted about 192,900 information security analysts in 2025, median pay $129,180 (May 2025), and a projected 21 percent growth to 2035, which tells you that the in-house version of this job is expensive and that most firms of this size will not hire it.
Day 1, Email 1: the checklist offer
Subject: The FTC Safeguards Rule at Bellmont Tax Group
Hi Gloria,
I'm Imani with Northgate Security Advisors in Columbus. We help tax preparers document what the FTC Safeguards Rule asks for: a named Qualified Individual, multi-factor authentication and encryption at any size, plus a written risk assessment and scheduled testing once a firm holds data on 5,000 or more clients.
I put together a one-page checklist that shows which of those apply to a six-person firm, which it already covers and which gaps are usually left. Want me to send it? You can answer it yourself in ten minutes.
Imani Okafor, Northgate Security Advisors, 300 Brightwater Ct, Columbus OH 43215. Reply "stop" and you will not hear from me again.
Why it works: it names a specific rule, says what the rule requires, and offers a document before a meeting. It does not say her firm is at risk. Skepticism has nothing to attack.
Day 4, Email 2: send the thing
Subject: Re: The FTC Safeguards Rule at Bellmont Tax Group
Gloria, in case it is easier to have it in hand, here is the checklist as plain text:
1. Who is the Qualified Individual? (Can be you.)
2. Is multi-factor authentication on for every system with client data?
3. Is client data encrypted on laptops and in email?
4. Roughly how many clients' records do you keep? At 5,000 or more, two more items apply:
5. Is there a written risk assessment, and when was it last updated?
6. When was the last vulnerability scan or penetration test?
If any answer is "not sure," that is a normal place to start. Imani
Why it works: you gave value before asking for a call. Many readers will never reply and will still remember who sent the checklist. Putting it in the body, not as an attachment, avoids spam filters and a security-minded reader's reluctance to open files.
Day 9, Email 3: a version for mortgage brokers
Subject: Safeguards Rule review, Larkspur Mortgage
Hi Tomas,
Mortgage brokers hold more sensitive data per client than almost anyone: tax returns, bank statements, Social Security numbers. That is one reason the FTC gives mortgage brokers as an example of a business the Safeguards Rule covers.
Northgate does a fixed-price gap review for brokers with under 25 staff, usually finished in two weeks, and the output is a written risk assessment, which the rule requires once a broker holds data on 5,000 or more people and which is the backbone of the program below that. Would a short call this week make sense?
Imani Okafor, 300 Brightwater Ct, Columbus OH 43215. Reply "stop" to be removed.
Why it works: it ties the firm's real data to the rule, and the offer is a defined project with a known end. Only write "fixed price" and "two weeks" if that is true for your firm.
Day 14, Email 4: the objection you will actually hear
Subject: "We already have an IT person"
Hi Tomas,
That is often the answer, and a good IT person is worth keeping. What we add is the part the rule asks for that IT people are usually not paid to write: the documented risk assessment and the annual test. I'm happy to work with your IT person directly.
Can I send over a sample of what the assessment looks like, with the client details removed? Imani, Northgate Security Advisors
Why it works: it answers the most common objection before it is spoken and offers to cooperate with the person who might feel threatened. Send this version when the first three have had no reply.
Day 18, Email 5: an annual date
Subject: Annual testing, Bellmont Tax Group
Gloria, filing season is the worst time to find a gap. If Bellmont keeps records on 5,000 or more clients, the Safeguards Rule asks for annual penetration testing unless you monitor continuously, and below that a test is still the quickest way to see where you stand. If you want it done before January, my calendar has two slots left in the next three weeks. Should I hold one?
Imani, 300 Brightwater Ct, Columbus OH 43215. Reply "stop" and I will not write again.
Why it works: the date comes from her own calendar, not from invented urgency. Do not say "limited slots" unless you really have two.
Day 21, Email 6: the close
Subject: Closing the loop
Gloria, I have written a few times about the Safeguards Rule. If the timing is wrong, I will stop. If someone else handles this, point me to them and I will write there. The checklist is yours either way. Imani
The sending numbers
Google's email sender guidelines tell senders to keep the spam rate reported in Postmaster Tools below 0.10 percent and never reach 0.30 percent. For a firm sending to a few hundred prospects, one spam complaint in a few hundred sends moves a percentage a long way, so the guard is a clean list and a small daily number: no more than 20 sends a day from one inbox. Because each prospect gets up to six messages over three weeks, a 20-a-day cap supports about 3 new prospects a day. Verify addresses before you send, and read cold email deliverability basics if you have not set up SPF, DKIM and DMARC.
Personalization that matters here
Use the rule, the business type and one fact from the firm's own site, such as the number of preparers on its team page or a line about secure client portals. Do not scan a prospect's systems without written permission, even from the outside, and never name a vulnerability you found. Mentioning one is a good way to be reported.
Legal notes for outbound security sales
The FTC's CAN-SPAM guide says there is no exception for business-to-business email, requires your valid postal address and a working opt-out, and allows 10 business days to honor one. Keep claims tied to what the FTC's guidance actually says. Telling a prospect "you are required to do X" is accurate only when X appears in the rule and the firm is covered. See is cold email legal for the full list.
For a founder who would rather spend the time on assessments than on follow-ups, Rocketship is an AI salesperson that researches each firm, sends from your own Gmail, follows up on a schedule you set and books the call; the comparison of AI SDR tools lays out what else is out there.