How do you find CISO and security leader contacts?

What does a security leader own

A security leader owns the organisation's information risk: the security programme, its controls, incident response and the evidence that auditors, regulators and customers ask for. CISOs answer to the board for risk rather than technology, and spend much of their time on governance, supplier risk and reporting.

In a buying group they play two parts. They are the buyer for security products, and a reviewer for almost everything else, because any supplier that touches company data passes through their third-party risk process.

Which titles cover head of security contacts

Search the CISO title together with the security titles smaller organisations use, and know who owns security where there is no dedicated leader.

Seniority separates the decision owner from the specialists, and keywords such as cloud security or governance match the part of the programme your product supports.

• Large and regulated organisations: chief information security officer, chief security officer, deputy CISO.
• Mid-sized organisations: head of information security, head of cyber security, information security manager.
• Smaller organisations: IT security manager or security architect, or a CTO, CIO or IT manager with security in their remit.
• Specialists: head of security operations, governance, risk and compliance lead, security engineering lead.

Which triggers make security leaders open to a conversation

Regulation, audits and change open a conversation, because each creates work a security leader must finish by a date.

A breach in the news is not a good trigger. Writing to a company about its own incident, or using another firm's incident to frighten, reads as opportunistic and costs you the trust you need.

• NIS2 in the EU, which widened the sectors and company sizes with cyber security duties and holds management responsible.
• DORA, which sets ICT risk rules for EU financial entities and shapes how they manage technology suppliers.
• A certification audit, a cyber insurance renewal or a large customer asking for security evidence.
• A newly appointed security leader, a cloud migration or a merger that brings in new systems.

How to reach a CISO without fear claims

Reach a CISO with a short message that names one control or obligation, says what your product does about it and offers evidence they can check. Security leaders discount urgency, invented threat figures and promises of total protection, because they know none of them hold. Precision works instead: the duty in a regulation you help with, the audit evidence your product produces, or the integration with a tool they already run.

Offer documentation, a sample report or a session with one of your engineers rather than a sales demo. Expect to be checked as you are read: a consistent sender domain, a clear company address and an honest account of your own security posture are part of the message.

What GDPR means for outreach to security leaders

B2B outreach to a security leader's work email can rely on legitimate interest, and they will expect your handling of their data to be exemplary. Keep the record small, store it securely, set a retention period and delete it when the purpose ends. Tell them where you got their details and make opting out easy and final.

Never use contact details taken from breach dumps or leaked lists, whatever the context; processing them is unlawful and tells a security buyer everything about you. In the UK, PECR rules apply to the email as well. Check your own position with an adviser.