Do I need to upload a list of contacts?

No. You paste your website and the agent finds matching companies and decision-makers itself, verifying each email address before anything is sent.

Does it send from my own domain?

No. Outreach is sent from warmed lookalike domains we operate on your behalf, so your real domain's email deliverability is never put at risk.

Prepaid credits, no subscription. Sending an email costs about $0.03 and verifying a contact about $0.01. New accounts start with $30 in credits.

Is cold email legal in the EU?

Business-to-business outreach is permitted in most EU countries under legitimate interest, provided the message is relevant to the recipient's role and opting out is easy. Pipestork includes a one-click unsubscribe and a postal address in every email, and blocks countries that require prior consent, including Germany, Austria, Italy and Switzerland.

Should I email the CISO or the IT Director?

Below roughly 1,000 employees, the IT Director, because the CISO usually does not exist and mis-titled email is an obvious tell. Above that, the CISO for strategy-led propositions and the IT Director for anything operational.

Do free security assessments still convert?

Rarely as an opener. The offer is now so common that it reads as a lead-generation device rather than a gift. A specific, dated obligation with a small next step outperforms it consistently.

Cold email by industry · cybersecurity

Cold email for cybersecurity vendors and MSSPs

No buyer in B2B is emailed more often, or more badly, than a CISO. They receive the same three emails every week: a breach statistic, a vague claim about their attack surface, and an offer of a free assessment. All three are pattern-matched and deleted in under a second. What still works in this vertical is narrow and unglamorous: arrive on a date that already mattered to them.

Who you are actually selling to

CISO / Head of Security: Owns the risk and the roadmap, but at most companies under 1,000 people this role does not exist and you are looking for the IT Director instead. Emailing a CISO who does not exist is the most common targeting error here.
IT Director / Head of Infrastructure: The real buyer in the mid-market. Judges you on operational burden — who runs it, who gets paged — long before features.
Head of Risk or Compliance: Right target when the driver is an audit or a regulation rather than a threat. Speaks in obligations and deadlines, not in attack vectors.

The trigger worth waiting for

A date somebody else set: a cyber-insurance renewal, an audit window, a customer security questionnaire they have to pass, or a regulation landing on their sector. These beat every threat-based opener because the deadline is real, dated, and already on the buyer's calendar — you are not creating urgency, you are arriving inside somebody else's.

What works

+Naming the obligation rather than the threat. "Your insurer will ask about MFA coverage at renewal" is a conversation; "attacks are up 38%" is not.
+Being specific about who operates it. Mid-market security buyers are short-staffed, and "we run it, you get a named analyst" answers the question they were going to ask third.
+Referencing something public and checkable — a certification they advertise, a sector framework they are bound by, a job posting for a security role they cannot fill.
+Offering the smallest possible next step. A 20-minute technical call with an engineer converts better than a demo, because the buyer expects to be sold to and instead gets to ask questions.

What fails

−Breach statistics and industry fear numbers. Every competitor opens this way, so the pattern itself now signals a mass send.
−Unsolicited "we scanned your perimeter and found issues" emails. Beyond the legal risk, it reads as hostile and the buyer's first instinct is to complain, not to reply.
−Acronym stacking — XDR, ZTNA, SASE, CNAPP in one paragraph. It signals that the sender does not know which problem the reader actually has.
−Emailing the CEO to go over the CISO's head. It routes straight back down with the relationship already damaged.

A worked opener

Subject

before your cyber renewal

Body

Most insurers now ask for MFA coverage across remote access and admin accounts before they quote, and a partial rollout is where renewals get repriced. We run that gap assessment for mid-market teams in a week, and hand you the evidence pack the insurer asks for rather than a report. No agents to deploy. Worth a look before your renewal date?

Why it works: It leads with an obligation the reader already has on a date they already know, describes the deliverable in the form the buyer needs it, pre-empts the deployment objection in four words, and asks for interest rather than a meeting.

Compliance notes

Ordinary B2B, with one hard line specific to this vertical: never run a scan, probe or credential check against a prospect's infrastructure to source an opener. Depending on the jurisdiction that can be unauthorised access regardless of intent, and it is the fastest way to turn a prospect into a complainant. Observations from public sources — job posts, certifications, published policies — are fine.

Questions

Should I email the CISO or the IT Director?: Below roughly 1,000 employees, the IT Director, because the CISO usually does not exist and mis-titled email is an obvious tell. Above that, the CISO for strategy-led propositions and the IT Director for anything operational.
Do free security assessments still convert?: Rarely as an opener. The offer is now so common that it reads as a lead-generation device rather than a gift. A specific, dated obligation with a small next step outperforms it consistently.

Have the agents do this for you

Everything on this page is what a good cybersecurity campaign needs someone to work out. Pipestork works it out from your website — the profile, the companies, the decision-makers, the sequences — and sends from warmed mailboxes, not your domain.

Try it with $30 in credits →