Cold email templates for cybersecurity vendors

Cold email to security teams has a problem no other segment has: your recipient is professionally suspicious, and they frequently administer the email gateway that decides whether you arrive. A CISO who finds your message manipulative does not just delete it. They report it, and sometimes they block your domain for the whole organisation.

So the rules tighten. No fear-based framing, no implied knowledge of their systems, no attachment, one link at most, and nothing that resembles the phishing patterns their own awareness training teaches staff to spot. The templates below are built around those constraints.

The one mistake that ends the conversation

Do not imply you scanned, probed or discovered something about their infrastructure. "We noticed your SPF record is misconfigured" or "our scan found three exposed endpoints" reads, to a security professional, as unsolicited reconnaissance. Even when the data is genuinely public, the framing suggests otherwise, and some recipients treat it as a reportable incident.

If you want to reference something public, say *where it is public from* in the same sentence. "Your published DMARC policy is at p=none" is a statement about a public DNS record and you should say so. The difference between citing public data and implying a scan is one clause, and it is the difference between a reply and a block.

1. The published-signal email

Subject: your public DMARC policy

Hi Rae — your DMARC record at acme.com is published at p=none,
which is public DNS, and that's where most domains stall before
enforcement.

We handle the reporting side so teams can get to p=reject without
breaking payroll or the CRM's mail.

Worth 15 minutes, or is enforcement already on someone's plate?

— Sam, MailPilot team

Sentence one names a public record *and* says it is public, which removes the reconnaissance implication. It also describes a stall rather than a failure, so it does not accuse anyone of negligence. Sentence two names the real blocker — breaking internal mail — which is the thing that actually keeps teams at p=none and signals that you have done this before. The ask has an exit.

2. The peer-practice email

Subject: how similar-size teams staff 24/7 triage

Hi Dev — most security teams around 40 people hit the same wall
on out-of-hours triage: either someone's phone buzzes at 3am or
alerts wait until morning.

We cover the overnight window with a named analyst rather than a
shared queue.

Should I send a one-page summary of how the handoff works?

— Sam, MailPilot team
https://example.com/overnight-triage

No claim about their environment at all, which is the safest opening when you have no public signal. It works because the problem is narrow and recognisably true for the stated team size. The ask is for a document, not a call, which converts better and demands less trust.

3. The compliance-deadline email

Subject: evidence collection before the next audit cycle

Hi Priya — teams going through a second SOC 2 cycle usually find
evidence collection, not controls, is what eats the quarter.

We pull the evidence continuously so the audit window is a review
instead of a scramble.

Is the next cycle this half? Happy to be told it's handled.

— Sam, MailPilot team

Deadlines motivate security buyers, but only real ones. Note that this references *their* audit cadence generically rather than claiming to know their dates. No urgency manufactured, no countdown, no "limited time" — all of which read as marketing manipulation to this audience specifically.

4. The displacement email

Subject: moving off an agent-based scanner

Hi Marco — teams replacing an agent-based scanner usually get
stuck on the asset inventory, not the deployment.

We import the existing inventory so coverage reporting doesn't
reset to zero on cutover.

Is a review on the roadmap this half?

— Sam, MailPilot team

It names a migration problem instead of attacking the incumbent, which is both more useful and less likely to get forwarded to the incumbent's account manager. Never disparage a named competitor in cold email to this segment; the buyer probably chose that tool and the message insults them by implication.

Deliverability rules for this audience

• Authentication has to be perfect. SPF, DKIM and DMARC all passing, DKIM aligned to your sending domain. A security buyer may well check your headers, and failing authentication while selling security ends the conversation on its own.
• No attachments, ever. A document from an unknown sender is the exact thing their training says not to open, and gateways strip it anyway.
• One bare link, or none. Click-tracking redirects look like the link-obfuscation their filters are tuned to catch. If you can send a clean URL on your own domain, do.
• Plain text, no images. A designed template contradicts a personal message, and image fetches from unknown domains get blocked in this segment more than any other.
• No urgency language or fake threads. A deceptive subject line is a CAN-SPAM violation and this audience reports it rather than deleting it.
• A real postal address and a working opt-out. At bulk volumes, List-Unsubscribe with an HTTPS URL and a mailto plus List-Unsubscribe-Post: List-Unsubscribe=One-Click. Google asks bulk senders to keep reported spam under 0.3%, and this segment reports more readily than most.
• Separate outreach domain, properly warmed. A corporate gateway block is organisation-wide; you want it to land on an outreach domain, not the one carrying your support and billing mail.

What not to do

Do not use fear. "Companies like yours are breached every 11 seconds" is the most-sent and least-effective opening in this market.

Do not include a scan result, a score or a graded report unless the recipient asked for it. Unsolicited assessments of someone's security posture are offensive to the person responsible for it.

Do not name-drop a breach, theirs or anyone's, as a hook.

Do not send to a `security@` or `abuse@` alias. Those are reporting inboxes staffed by people whose job includes blocking senders, and mail to a role account is also a bounce and complaint risk.

Do not use a lookalike domain. Selling security from a near-miss of your own brand name, registered last month with privacy-masked WHOIS, is the pattern their awareness training describes.

Do not follow up more than twice. In this segment the third bump is where the report comes from.

Where MailPilot fits

Selling to people who run mail gateways means your own sending has to be defensible. MailPilot checks SPF, DKIM and DMARC on every sending domain, warms each mailbox over OAuth on Gmail and Outlook or over SMTP/IMAP for SendGrid, Amazon SES, Mailgun, Postmark and custom SMTP, measures real inbox placement per provider through a seed-inbox network, and tracks per-mailbox reputation daily — so you know your authentication is clean before a CISO reads your headers.