SDX StudioFree template
MSSP cold email (permission-first)
The cold email that works for MSSPs names one public reason the prospect might need help now, asks permission before pitching, and asks for a one-word reply. Here are the two emails I’d start from, with the merge fields and the reasoning.
Use it when you have a list of companies with a real signal (an open security role, a missing DMARC policy, a new compliance deadline) and need first-touch copy.
How to use it
- Only send it where you can fill [signal] with something true and specific. No signal, no email: pick a different account.
- Send from a secondary domain that’s been warmed for at least two weeks, never from your main domain.
- Leave out links, images and tracking pixels in email 1. They cost you inbox placement and don’t earn replies.
The template
Subject: [signal topic], [company] Hi [first name], Saw [signal, e.g. the security engineer role you posted on 3 November]. That usually means someone is covering security on top of a day job until the hire lands. No pitch without your permission, so a quick question first. We run [service, e.g. 24/7 monitoring] for [peer type, e.g. 50 to 200 person logistics firms] while they hire, so nights and weekends aren't on one person. Worth a short note on how that works? A "yes" is enough. [Your name]
Hi [first name], One more thing, then I'll leave it. [One proof line, e.g. A firm your size cut alert backlog from 3 days to same-day in the first month.] If the timing's wrong, a "not now" helps too, and I won't follow up. [Your name]
Why it’s written this way
- The signal goes first. It’s the only line that proves you looked at their company. Everything after it reads as relevant because of it.
- Asking permission lowers the cost of replying. A one-word "yes" is easier to send than "book a call". You earn the meeting in the second message, not the first.
- Two emails, not seven. Most replies come from the first two touches. Past that you’re mostly collecting spam complaints, which hurt every later campaign from that domain.
Read more
More free templates are on the templates page.
Questions about this template.
How long should an MSSP cold email be?
Under 90 words for the first email. Security leaders read on their phone between incidents. If it needs scrolling, it gets archived.
Should the first cold email include a link or a calendar?
No. Links in a first touch hurt deliverability and turn a low-effort reply into a high-effort decision. Send the link after they say yes.
What counts as a good signal for an MSSP cold email?
Something public, recent and tied to a security gap: an open security role, a domain with no enforced DMARC policy, a compliance deadline that applies to them, or a recent breach in their supply chain.
Turn this into pipeline.
Reading about demand doesn’t book meetings. A 30-minute call gets you an honest read on whether 10 qualified meetings is realistic in your market, and a written scope if it is.
Book a no-pressure callShort of 10 qualified meetings in the 60-day campaign? You get your money back. You only pay for meetings that happen, and you decide what counts.