IT lead generation works when you reach the IT or security leader with a reason tied to a date they already own: a compliance deadline, an audit or their own first 90 days in the job. Generic “we help with IT and security” outreach goes to the same inbox as everyone else’s.
This playbook is for IT services firms, cybersecurity vendors and MSPs moving upmarket to companies with their own IT team. It covers who to target by company size, how many buyers there are, the compliance deadlines that create projects, other triggers, templates, a multi-threaded cadence, the metrics and the rules. If you sell managed IT to small businesses without an IT department, our MSP lead generation playbook fits better.
What is IT lead generation?
IT lead generation is how IT services firms, software vendors and cybersecurity companies find and start conversations with the people who own technology and security decisions: IT managers, IT directors, CIOs and CISOs. Cybersecurity lead generation is the same work aimed at security leaders, usually with a compliance or risk angle.
It differs from other B2B lead generation in two ways. IT buyers are hard to reach: Orum, a dialer company, reports from its platform data a connect rate of about 2.6 to 2.7% for IT leadership, against 7.8% for admin managers. And deals involve several people: Gartner research puts the buying group for a complex B2B solution at 6 to 10 decision makers.
Who to target: IT and security buyers by company size
Who owns IT changes with company size, so pick the size band first and the titles follow. Below about 50 employees there is often no IT person at all, which is MSP territory.
| Company size | Owns IT | Owns security | Signs |
|---|---|---|---|
| 51 to 200 employees | IT manager or IT director | The same person, or an outside provider | CFO or CEO |
| 201 to 1,000 | IT director, VP of IT | A first security hire | CFO, CIO |
| 1,001 and up | CIO, VP of infrastructure | CISO and a security team | CIO or CISO, with procurement |
Our IT decision makers email list guide breaks the titles down by size, and the CIO email list guide covers segments for the CIO title alone.
How many IT and security buyers are there in the US?
Over 209,000 IT decision makers and over 62,000 security leaders, by Scalelist’s count in September 2026. That is plenty; the constraint is relevance, not volume.
These are matching profiles, an upper bound, not verified contacts. For scale, the Bureau of Labor Statistics counts 670,570 computer and information systems manager jobs, a group that includes IT directors and IT managers, and 190,650 information security analyst jobs, the people who run security day to day (May 2025).
Compliance deadlines that create IT and security projects
A compliance deadline is the strongest IT buying trigger because it comes with a date, an owner and often an assessor. Three US rules have dates that matter to IT sellers in 2026 and beyond. This is a summary, not legal advice.
| Rule | Who it covers | What it requires | Who to call |
|---|---|---|---|
| CMMC (32 CFR part 170 and the DFARS rule) | Defense contractors and subcontractors that handle FCI or CUI | The CMMC level set in the contract, from a Level 1 self-assessment to a Level 3 government assessment | IT director, security lead, contracts manager |
| SEC cybersecurity disclosure | US public companies | Form 8-K Item 1.05 within four business days of finding an incident material; yearly 10-K disclosure of risk management and oversight | CISO, CFO, general counsel |
| NYDFS 23 NYCRR Part 500 | Firms licensed under New York’s Banking, Insurance or Financial Services Law | Multi-factor authentication for anyone accessing their systems and a documented asset inventory, due November 2025 | CISO, CIO, IT director |
CMMC for defense contractors
The Cybersecurity Maturity Model Certification (CMMC) program checks that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program rule took effect on December 16, 2024, and the rule that puts CMMC into Department of Defense contracts took effect on November 10, 2025.
The rollout is phased over three years: CMMC appears first in selected contracts, then in every contract involving FCI or CUI. DoD estimated it would reach 1,104 small entities in year one, 5,565 in year two and 18,554 in year three. Scalelist matches 1,047 IT and security leaders at US defense and aerospace companies with 11 to 500 employees.
SEC cybersecurity disclosure for public companies
Since December 2023 (June 2024 for smaller reporting companies), US public companies report a material cybersecurity incident on Form 8-K under Item 1.05 within four business days of deciding it is material. Their annual Form 10-K also describes how they assess and manage cyber risk, how the board oversees it and management’s role.
Read that 10-K section before you call: it tells you, in their own words, how the program is run and who owns it. Scalelist matches over 21,000 CISOs and security leaders at US companies with more than 1,000 employees.
New York DFS Part 500 for financial firms
New York’s cybersecurity regulation, 23 NYCRR Part 500, covers banks, insurers and other firms licensed under the state’s Banking, Insurance or Financial Services Law. Its November 2023 amendment gave them two years to use multi-factor authentication for anyone accessing their information systems and to keep a documented asset inventory.
That deadline passed in November 2025, so the angle now is keeping both current as systems, vendors and people change. Scalelist matches 1,704 CISOs, CIOs and IT directors at financial services, banking and insurance firms in New York.
Other triggers for IT and cybersecurity lead generation
Outside compliance, four events put IT and security on the agenda. Each one gives you a date and a first sentence.
- A new CIO or CISO. New leaders review vendors and build a plan in their first months. Scalelist matches 1,021 US security leaders who started a new role in the last 3 months.
- A platform in their stack. Job titles often name the systems a company runs; our guide to technographic data shows how to search for them.
- An acquisition. Two IT estates have to become one: identity, email, networks and security tools. Here is how to find companies that were just acquired.
- IT and security hiring. A job post for a security analyst or an IT director names a gap the team cannot fill yet.
Our guide to sales trigger events shows how to turn each one into a weekly routine.
Email and call templates for IT and security buyers
IT and security buyers answer outreach that names their environment and their deadline. The examples use Nina Patel, an account executive at Bastion Point Security, a fictional cybersecurity services firm in Arlington, Virginia.
CMMC email to a defense subcontractor
Hi Greg,
CMMC started phasing into DoD contracts in November 2025. From late 2028 it will be in every contract that involves FCI or CUI.
If Corbin Precision handles CUI, the open question is usually [which level you need and whether current controls pass].
We run [a two-week gap assessment against that level]. Is that on your plan this year?
Nina Patel, Bastion Point Security, +1 555 0152
- It states the date and the condition, so Greg can answer in one line.
- The first step has a scope and an end.
Call opener to a new CISO
Congratulations on the CISO role at Crestline Health.
In your first 90 days, are you building the roadmap you'll take to the board, or inheriting one?
We help public healthcare companies with [the incident materiality process behind an 8-K]. Is that on your list, or already settled?
- The first question is about her plan, not your product.
- “Already settled” is an easy exit, which makes a real answer more likely.
Part 500 email to a New York insurer
Hi Omar,
Since November 2025, Part 500 has asked New York insurers for a documented asset inventory and multi-factor authentication for anyone accessing their systems.
The hard part is usually [keeping the inventory current as laptops, cloud apps and vendors change]. We [automate that with a monthly report].
Worth 15 minutes to compare notes with how Hudson Mutual does it today?
Nina
- It assumes compliance, then offers help keeping it, which is respectful.
- “Compare notes” is a low-commitment ask.
Email to a VP of IT after an acquisition
Hi Carlos,
Congratulations on closing the Harlan Freight acquisition.
Merging identity and email is usually the first job, and [the security tools] come right after.
We have run [that consolidation for logistics companies your size], with a plan your team owns.
Who is leading the IT integration: you, or someone on the Harlan side?
Nina
- The acquisition is public, dated and specific to them.
- The last question finds the integration owner in either company.
A three-thread cadence for IT deals
IT deals need more than one contact, so run one cadence across three people over 15 business days: the IT owner, the security lead and the person who signs or owns compliance. Lead with email, because IT leaders rarely pick up an unknown number.
Still call. In RAIN Group’s buyer survey (2018), 54% of technology buyers said they prefer to be contacted by phone, compared with 40% in financial services. For a Part 500 list, lean a little more on email.
Metrics to track for IT lead generation
Track IT lead generation by rule segment and by thread. A deal with one contact stalls the day that person goes quiet.
| Metric | How to calculate | What it tells you |
|---|---|---|
| Segment coverage | Accounts contacted / accounts in each rule segment | Whether you are working the whole list |
| Contacts engaged per account | People who replied or took a call, per account | Whether you are multi-threaded |
| Conversations per 100 dials | Conversations / dials × 100 | Number quality for a hard-to-reach persona |
| Scoping calls per 10 conversations | Scoping calls / conversations × 10 | Whether the rule or trigger angle works |
| Days from trigger to first touch | First touch date minus trigger date | Speed on new CISOs and acquisitions |
| Security review pass rate | Deals past review / deals entering review | Whether your own documentation is ready |
Common challenges and how to fix them
IT leaders do not answer the phone
Email first with the rule, then call the direct mobile at a different time of day. If the IT director stays silent, the security lead is often easier to reach.
Every vendor says “compliance”
Name the rule, the date, the specific control and what you deliver. “A gap assessment against CMMC Level 2” beats “compliance solutions”.
Security review slows the deal
Send your own security documentation before it is requested, and ask early who in procurement needs to see it.
The rule does not apply to them
Segment the list by rule before writing a word. A defense list, a public company list and a New York financial list each get their own message.
Best practices
- One rule or trigger per list, and one message per list.
- Three threads per account: IT owner, security lead, signer.
- A first step with a scope and an end date: a gap assessment, a scoping call, a written plan.
- Read the 10-K cybersecurity section before calling a public company.
- Rebuild new-leader lists every month.
Rules for IT and cybersecurity outreach
A live sales call to a business is generally exempt from the National Do Not Call Registry under the FTC’s Telemarketing Sales Rule, but the rule’s ban on misrepresentation still applies to business calls. Never imply a requirement or deadline that does not apply to the company. This is a summary, not legal advice.
- CAN-SPAM applies to business email. Include your postal address and an opt-out, and honor opt-outs within 10 business days.
- Mobiles need care. Autodialed or prerecorded telemarketing calls to mobiles need prior express written consent under the Telephone Consumer Protection Act (TCPA). Dial by hand and honor do-not-call requests.
- EU contacts bring in the GDPR, including an unconditional right to object to direct marketing.
State rules and sources are in our B2B cold calling laws guide.
What to look for in a lead generation tool for IT sellers
- IT and security titles, industry, state and company size in one description.
- Time in role, to find new CIOs and CISOs.
- Direct mobiles, because IT leaders rarely answer a desk line.
- Verified emails with a status.
- A free count per segment before you pay.
- Push to HubSpot or your sequencer.
Thinking of buying a list instead? Read B2B email lists: build or buy, and the lead list guide for the full build.
How Scalelist helps IT and cybersecurity sellers
Scalelist, an AI Lead Finder, turns one plain-English sentence into a list of people with verified work emails and mobile numbers. It shows what it understood and how many people match before you spend a credit.
Paste one sentence per segment into Scalelist’s Lead Finder:
CISOs and heads of information security at US companies with more than 1,000 employees
CISOs, CIOs and IT directors at banks, insurers and financial services firms in New York
IT directors and IT managers at US companies with 201 to 1,000 employees
CISOs and security directors in the US who started in the last 3 months
Credits are charged only when something is found: 1 per lead, 1 per email, 20 per mobile, and 0 for a miss. The 1,047 defense and aerospace IT leaders with emails cost at most 2,094 credits, and mobiles for your top 100 add 2,000. That fits the Scaler 5K plan at 199 USD a month (see all plans).
Emails come back Valid, Risky or Not found, and Scalelist finds and verifies contact details on demand rather than serving a pre-compiled list. MSPs moving upmarket can see more on Scalelist for MSPs and IT service providers.
Size each IT and security segment for free, then pay only for the emails and mobiles found.
Describe your buyer in one sentenceLead generation playbooks for other industries
The same method with different buyers is in our SaaS lead generation playbook, our consulting lead generation guide and our manufacturing lead generation playbook.
FAQ
What is IT lead generation?
IT lead generation is how IT services firms, software vendors and cybersecurity companies find and start conversations with IT managers, IT directors, CIOs and CISOs. It works best when each list is built around a trigger with a date, such as a compliance deadline, a new security leader or an acquisition, and when each account has more than one contact.
What is cybersecurity lead generation?
Cybersecurity lead generation is IT lead generation aimed at security leaders: CISOs, heads of information security and security directors. The strongest angles are rules with dates, such as CMMC for defense contractors, the SEC’s incident disclosure rule for public companies and New York’s Part 500 for financial firms. Check that a rule applies before you mention it.
How do IT services companies get clients?
They pick a segment where a deadline or change creates IT work, build a list of the IT owner, the security lead and the signer at each account, and run an email-first cadence with calls to direct mobiles. Referrals and partners help, but a trigger-based list is the part you can schedule every week.
Who should you target when selling IT services?
Target by company size. At 51 to 200 employees, the IT manager or director, with the CFO or CEO signing. At 201 to 1,000, the IT director and the first security hire. Above 1,000, the CIO and the CISO, with procurement involved. Below about 50 employees, sell to the owner as an MSP would.
Is it legal to cold call IT decision makers?
Generally yes, in the US, for live calls to a business. B2B sales calls are mostly exempt from the National Do Not Call Registry, but autodialed or prerecorded calls to mobiles need prior express written consent under the TCPA, and misrepresentation is never allowed. Email must follow CAN-SPAM. This is not legal advice.
How much does an IT lead list cost with Scalelist?
Counting the list is free. You pay 1 credit per lead, 1 per email and 20 per mobile, only when found. A list of 1,047 IT and security leaders at defense and aerospace companies with emails costs at most 2,094 credits, and mobiles for the top 100 add 2,000, within the 199 USD Scaler 5K plan. New accounts get 20 free credits.
Sources
- Orum: Admin cold call playbook (connect rates by persona)
- Gartner: The B2B buying journey (archived January 2023)
- RAIN Group: Top Performance in Sales Prospecting (2018)
- BLS OEWS: computer and information systems managers, May 2025 (API series)
- BLS OEWS: information security analysts, May 2025 (API series)
- Federal Register: Cybersecurity Maturity Model Certification (CMMC) Program, final rule (2024)
- Federal Register: DFARS, assessing contractor implementation of cybersecurity requirements, final rule (2025)
- SEC: cybersecurity risk management and incident disclosure rules (press release 2023-139)
- SEC: Form 8-K and General Instructions (PDF)
- NYDFS: Second Amendment to 23 NYCRR Part 500 (text)
- FTC: CAN-SPAM Act compliance guide for business
- 16 CFR 310.6, Telemarketing Sales Rule exemptions
- 47 CFR 64.1200, TCPA delivery restrictions
- EDPB Guidelines 1/2024 on legitimate interest (PDF)
- Scalelist people count (POST /api/v1/people/count), queried 28 September 2026, 0 credits.
