Five Public Signals That an MSSP Prospect Is Ready to Buy

Most cold outreach to security buyers fails for a boring reason. It's sent to the right kind of company at the wrong time.

A 200-person manufacturer with no security team is a good fit for an MSSP in January and in June. It only becomes a good conversation in the month something changes: a deadline lands, a person leaves, a customer starts asking questions. Outreach that arrives that month reads like help. Outreach that arrives in any other month reads like noise.

So the job isn't building a bigger list. It's spotting the change. These are the five signals I look for, in roughly the order they've been useful.

1. A security role that stays open

A company advertising for a CISO, a security manager or an "IT security lead" is telling you, in public, that it has a gap and knows it.

The ad on its own is interesting. The ad that's still up after a month is better. Security hiring is slow, and every week the role stays open, someone else is covering it on top of their real job. That person is usually the IT manager, and the IT manager is usually who you want to talk to.

Where it shows up: the company's own careers page first, then job boards. Careers pages are more reliable, because job boards repost and expire listings on their own schedule.

How to open: not with the gap. With the interim. "While the security manager role is open, who's covering monitoring?" is a question they can answer. "I noticed you don't have a security manager" is an accusation.

2. Regulation landing on them

NIS2, DORA for financial services, ISO 27001 demanded by a customer. When a company starts mentioning one of these in job ads, press releases or its own site, it's usually because a deadline has been set by somebody else.

Deadlines are the most reliable buying trigger there is, because they move the decision from "should we" to "by when".

Where it shows up: job descriptions ("experience with NIS2 readiness"), news, and the company's own pages about certifications or compliance.

How to open: ask about position, don't assert scope. Scope under NIS2 is genuinely fiddly and you'll get it wrong from the outside. "Most suppliers to hospitals we speak to are being asked for incident response evidence at renewal. Has that reached you yet?" can't be wrong.

3. A gap in the stack

Technology lookups and job descriptions leak a lot. A company hiring for "firewall administration" with a legacy product named in the ad. A cloud migration mentioned in three open roles. No sign of any endpoint protection worth the name.

This is the signal that maps most directly onto what you sell, which makes it tempting to lead with. Don't. Nobody likes being told their stack is weak by a stranger.

How to open: use it to choose which service to pitch, then lead with signal 1 or 2 if there is one. The stack gap is targeting information, not an opening line.

4. A change at the top of IT

A new CIO, IT director or head of infrastructure. New leaders review their vendors in their first year, and they're more open to a conversation in month two than in year three.

Where it shows up: company announcements, news, and the person's own profile. That last source is the one to be careful with, which I come back to below.

How to open: congratulate briefly, then offer something useful for someone new in the seat, such as a short list of what other IT leaders in their sector are being asked by auditors this year.

5. Their customers are asking

This one is the hardest to see and the most valuable when you do. A company that supplies a regulated sector suddenly mentions "supplier security questionnaires" in a job ad, or starts publishing a trust page. Its customers have started asking, and it doesn't have the answers yet.

That's the third-party risk angle, and it reaches a much bigger pool of companies than the regulation itself.

One rule for all five

Use a signal to be useful, never to frighten someone. "You could be next" is the line every security vendor has already used. A specific, dated observation plus a question they can answer in one sentence is what gets a reply.

And keep the hook about the company. Every signal above is a fact about an organisation: its hiring, its obligations, its technology, its customers. You still need a person to send it to, and you should know exactly where their details came from, but the reason you're writing should be something that changed at their company, not something you found about them. It reads as research rather than surveillance. I'll go into the data protection side properly in a few weeks.

Doing this every week

Spotting one signal by hand is easy. Spotting all five across a few thousand companies, every week, and noticing when a job ad crosses the one-month mark, is a system. You can build that system yourself, or have it built.

It's also exactly how we build the account lists for our done-for-you campaigns: companies showing these signals, each with its source and date, and a reason to reach out in the first line.