How to sell to IT Directors at Cybersecurity companies
IT Directors in cybersecurity are primarily measured on their organization’s incident response time. They respond to threats quickly and effectively, so they appreciate outreach that highlights specific solutions for reducing response times or improving compliance with security standards like SOC 2. Understanding their pain points means showing familiarity with their security protocols and the latest threats they face.
Written and maintained by the SoloRiff team, who build outbound software and run outbound with it. The figures below are our own: we measured 569 cybersecurity company domains over public DNS on 2026-09-03. Last updated 2026-09-03.
What actually hurts
- slow incident response times
- inadequate compliance measures
- staff burnout from constant threats
- budget constraints for security tools
The playbook
- 01
Identify recent data breaches in the industry
Research cybersecurity news to find any recent data breaches affecting companies similar to your target. Use sources like CyberScoop or Krebs on Security. Mention these breaches in your outreach to demonstrate awareness of their current challenges and establish relevance.
- 02
Highlight solutions for compliance gaps
Look for companies struggling with compliance, particularly those that have recently announced audits or compliance failures. Tailor your messaging to emphasize how your solution can help them meet SOC 2 requirements, thus reducing their risk exposure and improving their standing with stakeholders.
- 03
Leverage security conference attendance
Check if your target IT Directors are attending upcoming cybersecurity conferences or webinars. Use platforms like Eventbrite or LinkedIn Events. Reference the event in your outreach to create a connection and suggest a brief discussion during or after the event.
- 04
Address common objections about budget
Prepare to tackle budget-related objections by gathering data on the cost of breaches in their sector. Be ready to present a cost-benefit analysis that shows how investing in your solution can save them money in the long run, particularly in avoiding compliance fines or breach costs.
- 05
Set a follow-up timeline after initial outreach
Plan to follow up within 5 business days after your initial outreach. Use email tracking tools to see if your email was opened. If they engaged but didn’t respond, reference their interest in your follow-up to encourage a conversation.
Can cybersecurity companies even receive your mail?
We measured the DNS of 569 cybersecurity companies, sampled evenly across company sizes, to see how many authenticate their own email. It matters in both directions: a domain that does not authenticate is a domain whose team is used to mail going missing — and if your own domain is in the gap, yours is the mail going missing.
Publishes a DMARC policy of quarantine or reject — the domain actually asks receivers to act on failures.
The gap is the finding: 30.3% of 1–10-person companies against 91.3% of the largest — 61 points apart. Small companies are where the unauthenticated domains are, and small companies are who most cold outreach is aimed at.
Where does your domain sit?
Same three lookups, run live against your domain. Nothing is stored and nothing is emailed to you.
How this was measured
Company domains were sampled within employee-count bands, then queried over public DNS for SPF (TXT at the apex), DMARC (TXT at _dmarc.) and MX. One domain per company, deduplicated. Anyone can reproduce any single row of this with dig.
DKIM is deliberately absent. A DKIM key lives under a selector that cannot be enumerated from outside the domain, so a company with flawless DKIM under a name we did not guess would be counted as having none. That would measure our guess list, not the industry.
Domains with no MX record are excluded rather than counted as failures — parked and redirect-only domains would otherwise drag every figure down and make the result an artefact of the sample.
Sampled within bands, so this describes the population of companies, not of employees: a 10-person company counts once, as does a 10,000-person one. Each band is at least 60 domains; bands below that are not published. Figures are percentages of the sample, not of the whole industry, and we publish no company names — only counts.
Measured 2026-09-03. Re-measured monthly.
The full census across every industry — sortable, with sample sizes, free to reuse under CC BY 4.0.
Subject lines that fit
- Improving your incident response
- Addressing compliance gaps
- Cybersecurity threats you should know
Questions
- Why do IT Directors in cybersecurity ignore sales emails?
- IT Directors often receive numerous sales emails that don’t address their specific challenges. If the outreach lacks a clear understanding of the cybersecurity landscape or fails to mention relevant industry incidents, they are likely to ignore it. Customization and relevance are key to grabbing their attention.
- What common challenges do IT Directors face in cybersecurity?
- IT Directors frequently deal with rapid technological changes, evolving compliance requirements, and the constant threat of cyberattacks. They also struggle with ensuring their teams are not overwhelmed by alerts and incidents, which can lead to burnout and decreased productivity.
- How can I make my outreach more relevant to IT Directors?
- To make your outreach relevant, focus on recent industry incidents, compliance issues, or specific challenges they face. Tailor your messaging to show how your solution directly addresses these pain points, making it clear that you understand their unique environment and needs.
- What is the best way to follow up with IT Directors?
- The best way to follow up is to reference any previous engagement or specific content they interacted with. Timing is also crucial; following up within a week of your initial outreach is ideal. Keep the follow-up concise, reiterating your value proposition and suggesting a brief call.
Or have it run itself
SoloRiff does every step above on its own — finds the companies, finds the people, writes each of them individually, and handles the replies. Drop your URL and watch it work before you sign up for anything.
Try it on your site