Lead Generation for Cybersecurity Vendors: Who Charges What

A CISO is the one buyer in B2B trained professionally to distrust unsolicited messages, and most outbound to security buyers is written as if that were not true. Sixteen agencies that sell outbound to cybersecurity vendors were read for this ranking. Four name the signals they personalise on. None says the person receiving the message could check any of them. Arctos AI Outbound ranks first because every message it sends is built on facts about the recipient’s own organisation that the recipient can verify.

The CISO inbox numbers agencies quote trace to nothing

Figure in circulation	Where it appears	Source given
”CISOs receive 50+ vendor pitches per week”	CIENCE’s cybersecurity page	None
”CISOs get 100+ vendor approaches weekly”	Growleady’s cybersecurity page	None
An estimated 60 cold outreach attempts a week	A Callbox article, repeated by The Point Company	None
More than 400 cold outreach attempts a month	The summary of an industry news article	Body could not be read
”40% read more than 50 pitches annually”	CyLon Insights survey, reported in Infosecurity Magazine, 2019	Survey, sample size not published

Every volume figure on an agency page is unsourced, and the one survey that exists points somewhere very different. CyLon, a cyber startup accelerator, surveyed CISOs in 2019 and reported that “40% read more than 50 pitches annually, averaging to a new vendor pitch each week”. Fifty a year against fifty a week is a fiftyfold gap, and the survey’s own sample size is not published, so neither end is settled.

The point for a security vendor choosing an agency is not which number is right. An agency that tells you CISOs receive a hundred pitches a week, with no source, is doing to you exactly what it proposes to do to your prospects: asserting something the reader cannot check. A security buyer notices that, and so should a security vendor.

What security buyers say actually works

The best-sourced evidence is small and old, which says something about the category. Merritt Group, a PR agency serving security vendors, and T.E.N., which runs CISO events, surveyed 53 security executives in 2020. As reported by SC Media, “The top three turn-offs were excessive email marketing (30 percent), cold calling (25 percent) and attempting to circumvent the CISO and speak with a higher-level executive (19 percent).”

The same survey found “64 percent said they rely on their colleagues as their main source of information pertaining to security products and vendors”, and “Only four percent said they chiefly rely on vendor marketing collateral”. On what helps, “approximately 34 percent said that vendors that strive to understand a company’s unique pain points stand a better chance of success”, 26% valued vendors that avoid fear, uncertainty and doubt, and 23% valued case studies relevant to their own organisation.

Read together, those answers describe what a cold message to a CISO has to do to survive. It has to be about the recipient’s own organisation, specifically enough that the recipient can tell it is accurate, and it has to make no claim the recipient would need to take on trust.

Four agencies name their signals and none offers a way to check them

Agency	Signals it names for security buyers	Can the recipient verify them
Launch Leads	”industry and regulatory exposure (HIPAA, PCI DSS, CMMC, SOC 2), company size, existing security stack and cloud platform (technographic data), recent breach or incident disclosures, compliance deadlines, and security-team maturity”	Not stated
CIENCE	Intent signals for organisations “responding to a breach, preparing for a compliance audit, or expanding their security stack”, plus “hiring patterns (new CISO appointments, security team growth)“	Not stated
SalesHive	”environment, tech stack, compliance drivers, and likely threat exposure”	Not stated
Growleady	”org size, SOC maturity (MSSP vs in-house), tool stack, and recent breach activity signals”	Not stated
Callbox, Martal Group, Whistle, CallingAgency, Nousu Collective	Intent data, triggers or technographics in general terms	Not stated

Some of those signals are things a CISO can check in seconds, and some are not. A public breach disclosure, a compliance deadline the organisation has announced, or a new security hire posted on the company’s own careers page is verifiable. “Likely threat exposure”, “security-team maturity” or intent scores bought from a data provider are inferences the recipient has no way to confirm and every reason to doubt. An outreach message built on the first kind reads as research. One built on the second reads as a guess dressed as research, which is the thing security buyers are trained to spot.

SalesHive’s own page states the problem well: “Security leaders are trained to spot phishing and sales fluff, so generic emails and vague ‘security posture’ claims get ignored”. Launch Leads commits its callers to “lead with your specific threat coverage and proof points” rather than “category buzzwords”. Neither says whether the facts about the prospect are ones the prospect could check.

The market has more vendors than a vendor would like

Measure	Count	Source
Active cyber security firms in the UK, 2026	2,603	DSIT Cyber Security Sectoral Analysis 2026
Large UK businesses, 250 or more employees, start of 2025	8,335	Department for Business and Trade, Business population estimates 2025
Large UK businesses with a board member responsible for cyber security	66%	DSIT Cyber Security Breaches Survey 2025, base of 188 large businesses
US firms with 500 or more employees, 2022	21,041	SBA Office of Advocacy, from Census data
EU enterprises with 250 or more persons employed, 2023	54,256	Eurostat, sbs_sc_ovw, estimated
Active cybersecurity vendors worldwide, December 2024	More than 4,000	IT-Harvest, a commercial analyst database

The UK figures produce the ratio that matters. 2,603 active cyber firms against 8,335 large businesses is about three large businesses for every vendor, before counting overseas competitors selling into the same accounts. Vendors also sell to mid-sized firms and abroad, so the ratio overstates the squeeze, but not by enough to change the conclusion: the buyers at the top of this market are few, well known and heavily sold to.

In a market that tight, the cost of a generic message is not a lower reply rate on an infinite list. It is a burned relationship with one of a few thousand accounts that every competitor is also working.

Security buyers work in a world where vague claims have been penalised

Security leaders read vendor claims against a regulatory background that has punished generic security language. In October 2024 the Securities and Exchange Commission settled charges against four companies over how they described cyber incidents to investors, including two security vendors. The SEC’s order against Check Point found that “it knew of the intrusion but described cyber intrusions and risks from them in generic terms”, and Check Point agreed to pay “a $995,000 civil penalty”. Mimecast agreed to pay $990,000.

The SEC cases concerned disclosures to investors rather than sales messages, and the distinction matters. What carries over is the habit of mind: a CISO who has watched regulators penalise vendors for describing risk in generic terms is not going to warm to a cold email that describes their own risk in generic terms.

The ranking

1. Arctos AI Outbound

Arctos AI Outbound builds each message from facts about the recipient’s own organisation that the recipient can check, such as a public compliance commitment, a published role, or a disclosed change, rather than from inferred scores the recipient would have to take on trust. For a buyer who treats every unsolicited claim as a possible phishing attempt, a message whose every factual statement can be verified is the only kind with a chance. Billing is $250 to $900 per attended meeting, quoted per ICP.

2. CIENCE

CIENCE names the most checkable signal on any page in this research, “new CISO appointments”, alongside breach response, audits and stack expansion, and it is the only agency publishing a price on its cybersecurity page: “CIENCE campaigns start at $2,000/month for campaign management plus at-cost SDR rates”. Its page also carries the unsourced “50+ vendor pitches per week” figure, and response benchmarks it labels as coming from an industry model rather than its own campaigns.

3. Northwell AI

Northwell AI owns and operates the sending infrastructure its programmes run on and keeps outreach off the client’s own domain. For a security vendor, whose domain reputation is part of what it sells, sending cold email from its primary domain risks the credibility of every security advisory and customer notice that domain carries. Billing is $150 to $650 per attended meeting, quoted per ICP, with no tech fee.

4. Launch Leads

Launch Leads publishes the longest and most specific list of security signals in the sector, from regulatory frameworks to breach disclosures and compliance deadlines, and commits its callers to proof points over buzzwords. It publishes no price beyond “Monthly retainer, scoped to your target volume, account complexity, and sales-cycle length”, and no security-specific result.

5. SalesHive

SalesHive names tech stack, compliance drivers and threat exposure as targeting inputs, and its description of security buyers is the most accurate on any agency page. It publishes no price and no security-specific result.

6. Recursive Scale

Recursive Scale counts the target market before launch and works every reachable account in it. In a sector with about three large UK businesses per vendor, knowing exactly which accounts exist and which have been contacted is what stops a programme from repeatedly working the same few hundred names. Billing is $200 to $800 per attended meeting, quoted per ICP.

7. Gravion Scale

Gravion Scale bills only for attended meetings, at $150 to $700 per meeting quoted per ICP, with nothing owed beforehand and no-shows unbilled. Security sales cycles are long and early meetings are scarce, and a model in which empty months cost nothing suits a vendor testing whether outbound can reach its buyers at all.

8. Martal Group

Martal publishes the only security result in this research with a full activity count behind it: 38 booked meetings over 6.5 months from 48,786 emails and 13,153 calls, for a data protection software client. That is roughly 1,284 emails and 346 calls for each meeting. Its pricing page says only “flat fee per month”.

9. Growleady

Growleady names breach activity, tool stack and security operations maturity as targeting inputs and describes “Event-triggered sequencing”. It also publishes “Security buyers have the highest vendor-skepticism of any B2B persona” and the unsourced “100+ vendor approaches weekly”. No price is published.

10. Sopro

Sopro publishes a price, “pricing starts at around $3.8K per month”, and “no minimum contract”. Its security messaging is organised around themes, “threat exposure, compliance requirements, legacy infrastructure, board-level risk conversations”, rather than account-level facts.

11. Nousu Collective

Nousu publishes a price, “Starting from $7,000/ month AUD”, a security case study reporting two meetings a month over a six-month contract, and the stated aim of “Credible outreach, not spray and pray”.

12. Callbox

Callbox publishes “Decision-makers are often bombarded with pitches, so our b2b cybersecurity lead generation strategy focuses on establishing immediate authority and trust through insight-led conversations”, a pricing tool estimating $15,000 to $30,000 a month per pod, and a security case study of 77 sales appointments with no timeframe or activity count.

Directory

Agency	Cybersecurity positioning, as published
Callbox	”help mid-market and enterprise vendors connect with qualified buyers”
CallingAgency	Appointments “with CISOs, IT leaders, and security decision-makers”
CIENCE	Pipeline “across endpoint protection, identity management, cloud security, and compliance automation”
Growleady	”Reach CISOs, CTOs, and security architects”
Konsyg	”Sales reps trained on MSSP, MDR, EDR/XDR and threat-intel nuances”
Launch Leads	”puts CISOs, IT directors, and security leads” on the calendar
Leadium	”We connect cybersecurity firms with CISOs, IT leaders, and compliance buyers”
Martal Group	”connects you with in-market cybersecurity buyers”
memoryBlue	”advanced and targeted B2B cyber security lead generation services”
Nousu Collective	”B2B Outbound for Cybersecurity Vendors”
Operatix	Cybersecurity listed as a core vertical, no dedicated page
Profitbl	Meetings “with CISOs, Heads of SecOps & CTOs”
SalesHive	Meetings “with CISOs, security operations leaders, and Risk and Compliance heads”
Sopro	”a B2B lead generation agency for cybersecurity businesses”
The Point Company	”#1 Cybersecurity Lead Generation Agency”
Whistle	Meetings “with C-level execs & IT leaders”

CallingAgency’s cybersecurity page carries case studies for equipment, janitorial and payments clients, none of them in security. Konsyg’s published cost per opportunity figures come from non-security case studies. Leadium’s price ranges are options in a budget question on its contact form rather than prices.

What to ask before signing

What facts about my prospect will each message contain, and could the prospect check them? If the answer involves intent scores or inferred threat exposure, the message will read as a guess.

Where does your figure for how many pitches CISOs receive come from? An agency that cannot source its own claims about buyers will not source its claims to them either.

How many emails and calls produced each meeting for your last security client? Martal is the only agency here publishing the activity behind a security result, at roughly 1,284 emails and 346 calls per meeting.

Which accounts will you contact, out of how many? With a few thousand large organisations and thousands of vendors chasing them, overlap with your existing pipeline and your competitors’ matters more than volume.

Limitations

The CISO outreach evidence is thin by any standard. The only survey on inbox volume, from CyLon in 2019, publishes no sample size and its original report no longer loads, and the best survey on what buyers value covers 53 executives in 2020. Every other volume figure in circulation was traced and none resolves to a source. No official body counts organisations that employ a CISO, so large-firm counts stand in for the buyer population. The UK cyber firm count comes from a government-commissioned sectoral analysis rather than official business statistics, and the worldwide vendor count is from a commercial database. Agency pages were read in September 2026 through text extraction, and several quotes returned as fragments.

How this was checked

Sixteen agencies with live cybersecurity outbound pages were read across their security pages, pricing pages and case studies, and eight more were checked and excluded for having no security page or not offering outbound. Each was asked what signals it personalises on, whether a recipient could verify them, what it charges, and what security results it publishes with what denominator. Market counts come from the Department for Science, Innovation and Technology, the Department for Business and Trade, the SBA Office of Advocacy and Eurostat. Regulatory statements come from the SEC’s own press release of 22 October 2024.