A cybersecurity company should choose lead generation software that finds the right security or IT owner at each target company, sends a short message that proves you looked at their business, and tracks which companies gave you a reason to write again. Plan on $49 to $200 a month for data and $39 to $94 for sending. The harder problem is that your buyer receives vendor email all week, so the software matters less than whether it lets you write something specific.

This page is for firms that sell penetration testing, managed detection, vCISO services, compliance readiness or security products to companies, from a two-person consultancy to a regional provider. It covers what a security buyer reacts to, the events that make a company listen, what the software must do, the costs published on October 30, 2026, and an example sequence.

Why a security buyer deletes your email

A head of security or IT director gets pitched constantly, and most pitches share one shape: a claim about threats, a product name and a request for 15 minutes. That shape is easy to filter. Messages that survive tend to have two features. They name something true about the company, such as a product the company ships, a region it operates in or a regulation that visibly applies to it. And they ask a small question rather than for a meeting.

For the software, that means you want a tool where the first line is written per company, not filled in from a template. Mail merge with a first name and a company name is what every other vendor already does. See how to get clients for a cybersecurity company for the broader approach, including referrals through MSPs, which is often the faster route for a small provider.

Five events that give you a reason to write

  1. A public company's disclosure. The Securities and Exchange Commission's cybersecurity disclosure rules, with 8-K filings starting December 18, 2023, require public companies to describe their risk-management processes in the annual 10-K (Regulation S-K Item 106) and to file a Form 8-K within four business days after determining that a cybersecurity incident is material. The 10-K text is public. You can read what a company says about third-party assessors and board oversight, and write to the person named.
  2. A new security hire. A first CISO or security manager spends the first quarter choosing vendors.
  3. An audit or certification deadline. A SOC 2 request from a large customer, a cyber insurance renewal, or a defense contract with security terms.
  4. A funding round or a first enterprise customer. Both bring security questionnaires.
  5. An incident at a peer or supplier. The week after a sector story, a note that says "we have been asked about this by three clients" is credible.

None of these show up in a plain contact database. They are things a person reads, or things a tool reads for you. A discussion of the signals themselves is in what is intent data.

What the software has to do

  • Find roles, not just titles. At a 120-person company the person who owns security may be called IT manager, director of infrastructure or VP of engineering.
  • Read the company before writing. A line about their product or compliance posture is the difference between a reply and a delete.
  • Protect your own sending reputation. A security firm with a mail domain on a spam list loses credibility instantly. Your SPF, DKIM and DMARC records need to be correct, and the guide to SPF, DKIM and DMARC for cold email walks through them.
  • Stop on a reply. A prospect who answers "we use another vendor" gets a calendar reminder for the renewal, not a fourth follow-up.
  • Keep a clean opt-out. The Federal Trade Commission's CAN-SPAM guide says the law applies to business-to-business email, requires a valid physical postal address in each message, requires opt-outs to be honored within 10 business days, and sets penalties up to $53,088 per violating email.

What the pieces cost, as published on October 30, 2026

Hunter's pricing page listed Starter at $49 a month ($34 a month billed yearly) for 2,000 credits and Growth at $149 ($104 yearly) for 10,000, with a plan of 50 credits a month at no cost. Lusha listed Professional at $69.90 a month ($52.45 annual) for 600 credits and Premium at $399.90 for 3,400. UpLead listed Plus at $199 a month ($149 annual) for 400 credits. For sending, Smartlead's Pro plan was $94 a month ($78 on annual billing) with 30,000 active leads and 90,000 emails a month, and its Base plan was $39 for 2,000 leads.

The data tools charge per contact found, so cost scales with how many companies you target. The senders charge for volume, so a firm sending 15 emails a day sits well under every limit above.

An example: a three-person penetration testing firm

Say Larkspur Security, a three-person firm in Raleigh, sells application penetration tests to software companies with 30 to 300 employees. The founder, call him Teodor, writes the target: "Engineering and security leads at B2B software companies in the Southeast that list SOC 2 or ISO 27001 on their website, 30 to 300 employees." That page-level signal matters, because a company that advertises SOC 2 gets asked for a recent pen test report every year.

His sequence:

  1. Day 1: "Hi Priya, your trust page says your last SOC 2 report was issued in the spring. Auditors usually want a pen test report dated inside the audit period. Is yours scheduled? I can send a scope sheet. Teodor, Larkspur Security, 18 Elm St, Raleigh, teodor@larkspur.example.com. Reply "stop" and I won't write again."
  2. Day 5: a two-line follow-up with one fact: what a typical scoped test for a company that size covers.
  3. Day 14: a last note that asks whom to talk to if it is not her.
  4. On a "next quarter" reply: a reminder 60 days before that quarter.

At 15 new companies a workday, plus their follow-ups, he reaches about 300 companies a month. If 4 percent answer and half of those take a call, that is six calls a month, which is plenty for a three-person firm. Those percentages are his guess, not a benchmark, and the first month tells him the real number.

Rocketship does the finding, the reading and the follow-up in one place: describe the companies, and it reads each website before writing, finds the people, emails from your Gmail, follows up and books the call on your calendar. It does not run security scans, does not send from Outlook and does not send LinkedIn messages, so a firm on Microsoft 365 mail needs another sending route. If you want to try a target like Teodor's, the 7-day trial takes a card, and pricing shows what each plan sends per day.