How to sell to Heads of People at Cybersecurity companies
Heads of People in cybersecurity companies are primarily measured on employee retention rates. They respond positively to outreach that acknowledges the unique challenge of maintaining talent in a high-pressure environment where compliance and security are paramount. Demonstrating an understanding of their specific compliance training needs can prompt engagement.
Written and maintained by the SoloRiff team, who build outbound software and run outbound with it. The figures below are our own: we measured 569 cybersecurity company domains over public DNS on 2026-09-03. Last updated 2026-09-03.
What actually hurts
- high employee turnover
- inadequate compliance training
- burnout from security pressures
- difficulty attracting top talent
The playbook
- 01
Identify companies with recent SOC 2 audits
Use industry reports or news articles to find cybersecurity firms that have recently completed SOC 2 audits. These companies are likely focused on compliance and may need to enhance their training programs for employees to meet ongoing requirements.
- 02
Segment by workforce size and turnover rates
Filter your list to include cybersecurity companies with over 100 employees and turnover rates exceeding 15%. These organizations often struggle with retaining talent and may be more receptive to solutions aimed at improving employee engagement and compliance training.
- 03
Craft messaging around compliance training gaps
When reaching out, specifically mention the challenges associated with compliance training in cybersecurity. Highlight how your insights can help address the high stakes of employee training to ensure adherence to security protocols and reduce risk.
- 04
Follow up after industry events
Monitor industry events, such as cybersecurity conferences, and follow up with attendees shortly after. Reference specific discussions or trends from the event, showing you understand the current challenges and can provide relevant solutions.
- 05
Address objections about budget constraints
Prepare to counter objections regarding budget limitations by providing examples of cost-effective solutions that have led to measurable retention improvements in similar organizations. Tailor your conversation to emphasize ROI and long-term benefits.
Can cybersecurity companies even receive your mail?
We measured the DNS of 569 cybersecurity companies, sampled evenly across company sizes, to see how many authenticate their own email. It matters in both directions: a domain that does not authenticate is a domain whose team is used to mail going missing — and if your own domain is in the gap, yours is the mail going missing.
Publishes a DMARC policy of quarantine or reject — the domain actually asks receivers to act on failures.
The gap is the finding: 30.3% of 1–10-person companies against 91.3% of the largest — 61 points apart. Small companies are where the unauthenticated domains are, and small companies are who most cold outreach is aimed at.
Where does your domain sit?
Same three lookups, run live against your domain. Nothing is stored and nothing is emailed to you.
How this was measured
Company domains were sampled within employee-count bands, then queried over public DNS for SPF (TXT at the apex), DMARC (TXT at _dmarc.) and MX. One domain per company, deduplicated. Anyone can reproduce any single row of this with dig.
DKIM is deliberately absent. A DKIM key lives under a selector that cannot be enumerated from outside the domain, so a company with flawless DKIM under a name we did not guess would be counted as having none. That would measure our guess list, not the industry.
Domains with no MX record are excluded rather than counted as failures — parked and redirect-only domains would otherwise drag every figure down and make the result an artefact of the sample.
Sampled within bands, so this describes the population of companies, not of employees: a 10-person company counts once, as does a 10,000-person one. Each band is at least 60 domains; bands below that are not published. Figures are percentages of the sample, not of the whole industry, and we publish no company names — only counts.
Measured 2026-09-03. Re-measured monthly.
The full census across every industry — sortable, with sample sizes, free to reuse under CC BY 4.0.
Subject lines that fit
- Improving compliance training
- Retention strategies for cybersecurity
- Addressing talent challenges
Questions
- Why do Heads of People in cybersecurity ignore outreach about talent solutions?
- Heads of People in cybersecurity often receive numerous outreach messages. If the messaging does not directly address their specific compliance and retention challenges, it can be easily overlooked. Tailoring communication to their unique pain points is crucial for engagement.
- What compliance-related challenges do Heads of People face?
- Heads of People in cybersecurity face the challenge of ensuring that all employees are adequately trained in compliance protocols. This includes keeping up with evolving regulations and ensuring that training programs are engaging and effective to prevent lapses in security.
- How can outreach resonate with cybersecurity talent leaders?
- Outreach can resonate with cybersecurity talent leaders by focusing on the unique pressures they face, such as high turnover rates and the need for specialized training. Demonstrating an understanding of these issues and offering tailored solutions can capture their attention.
- What objections do Heads of People commonly raise?
- Common objections include concerns about budget constraints and skepticism about the effectiveness of new training solutions. Addressing these objections with data-driven insights and case studies from similar organizations can help alleviate their concerns.
Or have it run itself
SoloRiff does every step above on its own — finds the companies, finds the people, writes each of them individually, and handles the replies. Drop your URL and watch it work before you sign up for anything.
Try it on your site