Security is the one product where the sales email itself can be the worst advertisement. A message that opens with "Your company is at risk of a devastating breach" looks like phishing, reads like phishing, and in many inboxes goes straight to spam. The people who buy security from outsiders are the ones who can tell the difference between a threat and a sales tactic, and they do not hire the sender.

To get clients for a cybersecurity company, write the way a good advisor talks: calm, specific, and useful. This is how to pick the right small clients, what to offer first, and how to keep your emails out of the junk folder.

Why a small firm hires a security provider

Most small firms don't buy security because they're afraid. They buy it because someone else forces the question. A cyber insurance application asks about multi-factor authentication and backups. A client sends a security questionnaire before signing. A regulator or an auditor asks for a written policy. An employee clicked a link last month and everyone is a little jumpy.

Those moments are your triggers. They are also why regulated firms are the best targets: they have outside pressure that makes the budget appear. Clinics and dental practices handle patient information under HIPAA. Accountants and tax preparers have federal rules on safeguarding client data. Law firms have ethical duties around confidentiality and often face client questionnaires. Financial advisors, insurance agencies and some nonprofits face similar demands.

Your pitch isn't "you might get hacked." It's "you're going to be asked about this, and here's how to have good answers ready."

Find regulated small firms by name

Pick one or two types, learn their rules, and become the person who speaks their language. A provider that says "I work with dental practices on HIPAA security risk assessments" will outsell a generalist.

Build a list of 50 firms in a region with 10 to 100 employees. Note who handles IT today: an in-house person, a local IT company, or nobody. Firms with an IT provider may want a second opinion or someone who specializes in compliance; firms with nobody are the easiest to help. The person to write to is usually the owner, the practice manager or the office manager.

If you'd rather not build the list by hand, Rocketship lets you describe the firm type, size and location in plain English, previews 25 by name before you use a credit, and adds the ones you choose to your pipeline. Launch includes 50 leads a month, and the credits cover verifying contacts.

The offer: a plain-language risk check

Make your first step a short assessment that someone without a technical background can understand. Not a 60-page report. A one-page summary with five to eight findings, each in a sentence, each ranked, each with a next step.

For a dental office, it could cover: who has access to patient records, whether email and the practice management system use multi-factor authentication, how backups are made and when they were last tested, whether laptops are encrypted, and whether staff have had any security training. For a law firm: how documents are shared with clients, who can access the file server, and how departing employees are removed.

Decide ahead of time whether this first step is free or a small fixed fee, and exactly what's included. A 90-minute check with a one-page summary is a fair scope. Anything more starts to be consulting work, and that should have a price.

A first email to an owner or office manager

Write it as if you're sending it to a neighbor. No jargon, no acronyms the reader didn't use first, no alarms.

Subject: Security questions from your insurance renewal

Hi Nadia, many dental practices are being asked about multi-factor authentication and backups when they renew their cyber insurance this year. I help small practices get those answers in order. I can do a 90-minute review of how your office handles patient data and send you a one-page summary of what's in good shape and what to fix first. Would that be useful before your next renewal?

Owen Park, Beacon Security, 18 Canal St, Suite 400, Pittsburgh. Reply "stop" to opt out.

Include your physical address and an unsubscribe line, since US commercial email rules require them. Keep the subject line honest: it should say what the email is about.

Scare tactics that get you marked as spam

Fear-based language is the easiest way to damage your sending reputation. Subject lines like "URGENT: your data may be exposed" get flagged by recipients and by filters. Once enough recipients mark your messages as spam, your domain's reputation drops, and even your good emails stop arriving. For a security company, that's a double failure.

Some habits help:

  • Use a separate sending domain or mailbox for outreach, not your main business domain, and keep your volume low while it warms up: 20 to 50 a day.
  • Make sure the basics of email authentication (SPF, DKIM and DMARC) are set up correctly on any domain you send from. You'll look silly if your own records are wrong.
  • No attachments or shortened links in first emails.
  • Avoid words like "urgent," "breach," "hacked" and "act now" in subject lines.

More detail is in cold email deliverability basics and cold email that isn't spam.

Two follow-ups, then a polite close, for security buyers

Two follow-ups are enough. The second, five days after the first, can share something concrete: "Three questions cyber insurers are asking dental practices this year" with a short list. The third, a week later, closes politely. A security buyer who feels pressured will not trust you with their data.

If your lists came from a database, check the contact data before you send. A bounce rate above a few percent hurts your reputation, and lead data you can check before paying explains how to test a sample first. Rocketship's AI workers send from your own Gmail at a modest pace and stop on bounces and opt-outs, and they read the replies, answer, and book the call on their own.

Book the assessment call and show up prepared

Before the call, look at the firm's website, email setup and public footprint. You can see whether their domain has email authentication records, whether their website uses HTTPS, and what software they run if it's visible. Write down two or three observations, but don't present them as a scare. Present them as "here's what I noticed, and here's what I'd like to confirm."

During the call, ask what's been asked of them (by insurers, clients, regulators), what they have in place, and what worries them. End with a date for the assessment. Then deliver the summary within two business days of the visit; speed here earns the right to do the follow-on work.

A realistic month: 50 firms emailed, 4 replies, 2 assessments, 1 ongoing engagement. A managed security package at $1,200 a month for a 30-person firm is $14,400 a year. One client covers a lot of outreach.

More for security providers: IT companies and web agencies

Many security buyers also use a general IT provider, and how an IT company gets clients covers that side. If you build software and sites, see getting clients for a web development agency. The AI workers page shows what handles the sending.

Careful, low-volume outreach is the only kind that works in security, and it's tedious to keep up. Rocketship finds the buyers, emails them from your own Gmail, follows up, and books the meeting on its own. Plans that get you customers start at $24.99 a month (Launch), and every monthly plan starts with a 7-day free trial, card required. Answering your existing number is included; a dedicated line is $5 a month.