How it works
1. Source
Five public feeds, each on its own clock, write into a single prospects table.
| Feed | What it gives | Pulled |
|---|---|---|
| State attorney general breach lists and the federal health breach portal | Organizations that filed a breach notification, with the filing date and regulator | Daily |
| Federal award data | Small businesses that won a defense prime contract or subcontract | Weekly |
| Job boards | First security hires and long-open security roles at companies with no security team | Daily |
| SEC Form D filings plus job ads | Funded software companies whose postings now mention SOC 2 or security questionnaires | Weekly |
| State licence registers | New mortgage, lending, insurance, and advisory licences under state cybersecurity rules | Weekly |
Each row stores the organization, its domain, headcount band, sector, the trigger type, the trigger date, and the one public fact the opening line will cite.
2. Qualify
Nothing is enriched until a row clears these checks.
- Size. 25 to 1,000 employees, the band where one executive signs for security.
- Sector fit. The sector matches the firm’s practice areas and certifications.
- Freshness. The trigger is dated inside its window, 30 to 90 days by source.
- Coverage. The organization has no managed security provider named in its public filings or careers pages.
- Exclusions. Absent from the client, open-proposal, and suppression tables.
Rows that fail on size alone move to a watch table, since a 20-person contractor that wins a second award often crosses the line within a year.
3. Enrich
Which seat to find depends on who owns security at that size.
| Organization type | The seat |
|---|---|
| Company with a new security posting | The hiring manager named in the post, usually the CTO or CIO |
| Defense contractor under 200 staff | The owner, the president, or the contracts manager |
| Software company after a funding round | The CTO or the VP of engineering |
| Lender, insurer, or advisory firm | The chief compliance officer or the COO |
| Organization with a breach notice | The general counsel, the COO, or the head of IT |
Hunter resolves the email from name and domain, BetterContact verifies it, and a failed lookup drops one rung down the title list for that organization type.
4. Outreach
Four emails and one LinkedIn touch across 17 days, each built from a locked template for the trigger type.
The model writes the opening two sentences only, drawing on the trigger record and the firm’s own credential sheet.
Three things the model may never do:
- Mention a breach detail beyond the public filing date and regulator.
- Claim a certification, accreditation, or authorization the firm does not hold.
- Imply any look at the prospect’s systems, networks, or exposed services.
Every sequence ends in the same ask: a 20-minute scoping call.
5. Book and track
A webhook receives replies and a classifier sorts them into eight routes.
- A scoping request. Pauses the sequence, sends the intake form and a booking link, alerts the practice lead in Slack, and opens a CRM opportunity.
- A completed intake form. Builds a branded scoping proposal from the environment size, the frameworks in play, and the deadline, returned inside 15 minutes.
- A change at a watched organization. Watched records are re-read weekly, and a second award, a filed assessment date, or a reposted role requeues the row.
Lead sources for cybersecurity firms
1. Breach notification filings
This trigger carries a date the organization cannot ignore, because a notice to a regulator starts a clock with insurers, auditors, and customers.
Roughly a dozen state attorneys general publish breach notices online, and the federal health breach portal lists every covered entity reporting 500 or more affected records.
The slice worth an email:
- Size. 25 to 1,000 employees, below the size where an incident response retainer is standard.
- Timing. Filed inside the last 45 days.
- Sector. Health, legal, finance, education, manufacturing, and professional services, where follow-up audits are routine.
- Status. No named forensic firm in the notice text, since a named firm usually carries the remediation too.
The need after a notice is concrete: a post-incident assessment, policy work, and evidence for the cyber insurer’s renewal questionnaire.
Highest intent of the five sources, with an estimated 60 to 110 qualifying notices a month across the published lists.
2. Defense contract awards
A small business that wins its first defense contract handling controlled unclassified information inherits a CMMC obligation along with the work.
Federal award data names the recipient, the awarding office, the value, the date, and the classification codes, and subcontract reports add the firms one tier down.
Three conditions make an award worth an email:
- First award. The recipient has no defense prime award in the prior 24 months.
- Value. $250,000 or more, which usually brings the controlled data clauses with it.
- Headcount. Under 500 employees, so no internal compliance department exists yet.
A defense supplier facing a Level 2 assessment needs a gap assessment, a system security plan, and remediation before a certified assessor arrives.
Second highest intent, with an estimated 70 to 120 rows a month nationally.
3. First security hires
A company posting its first security role has decided to spend on security and has not yet chosen how.
The first CISO, security engineer, or GRC analyst posting at a company with no prior security titles marks a program being built from nothing.
A role still open after 60 days is the stronger signal. It is the moment a vCISO retainer or a managed detection service fills the gap faster than a hire.
An Apify job-board actor pulls postings by title list, returning the company, title, date, location, and the frameworks named in the description.
Medium to high intent and the largest source, at an estimated 120 to 200 rows a month.
4. Funded software companies meeting SOC 2 demand
Enterprise customers ask a growing software vendor for a SOC 2 report, and the vendor usually finds out during a deal.
The system joins two public records:
- The funding event. An SEC Form D filed in the last 90 days by a company in a software or data industry code.
- The demand signal. A job ad at the same company mentioning SOC 2, ISO 27001, or security questionnaires.
When both appear, a readiness assessment and an audit partner introduction are timely.
Medium intent, with an estimated 60 to 110 rows a month.
5. Newly licensed regulated firms
State regulators now attach cybersecurity rules to financial licences, and a firm licensed this month has the obligation from day one.
| Register | Who appears | The rule that follows |
|---|---|---|
| NMLS Consumer Access | New mortgage and consumer lending companies | FTC Safeguards Rule written program and annual board reporting |
| New York financial services licensee search | New lenders, money transmitters, and insurers | NYDFS Part 500 program, CISO designation, and annual certification |
| State insurance department agency lists | New insurance agencies | State insurance data security law, where adopted |
These rows fill the sending schedule between higher-intent triggers, at an estimated 80 to 140 a month.
ICP definition
Filter logic the workflow applies.
What starts a row
| Filter | Rule |
|---|---|
| Breach notice | Filed with a state attorney general or the federal health breach portal inside 45 days |
| Defense award | First defense prime or subcontract in 24 months, valued at $250,000 or more |
| Security posting | CISO, head of security, security engineer, security analyst, or GRC title, posted inside 30 days |
| First-hire flag | No security title at the company in the prior 12 months of postings |
| Long-open flag | The same security role still listed 60 days or more after first sighting |
| Funding and demand | Form D in a software or data industry code inside 90 days, plus a job ad naming SOC 2, ISO 27001, or security questionnaires |
| New licence | Company licence issued inside 60 days on a monitored state or federal register |
What keeps a row
| Filter | Rule |
|---|---|
| Headcount | 25 to 1,000 employees, or 10 to 1,000 for defense award rows |
| Sector | Matches a practice area in the firm profile, so a firm without health experience drops health rows |
| Incumbent check | No managed security or forensic provider named in the notice, the filing, or the careers page |
| Exclusions | Domain absent from the client, open-proposal, and suppression tables on a 365-day window |
| Duplicate guard | One live row per organization on a 180-day window, however many triggers fire |
| Assessor conflict | Defense rows drop when the firm is the organization’s certified assessor, current or planned |
| Volume cap | 15 rows per parent organization a year |
Outreach sequence
The five steps
| Step | Day | Channel | Goal |
|---|---|---|---|
| 1 | 0 | Opener citing the filing, the award, the posting, or the licence; offer a 20-minute scoping call | |
| 2 | 3 | Send the credential sheet: certifications held, frameworks delivered, a redacted sample report page, and insurance limits | |
| 3 | 7 | Connection request with a one-line note tied to the trigger | |
| 4 | 12 | Send the fixed-scope first engagement: deliverables, duration, and a price band | |
| 5 | 17 | Breakup offering a free 45-minute tabletop exercise or an incident contact card |
Example step 1 (defense award trigger)
Subject: The [agency] award and CMMC
Hi [First name], congratulations on the [agency] contract awarded on [date]. Awards in that category usually carry the controlled data clauses, which puts a CMMC Level 2 assessment on the calendar.
We have taken [N] defense suppliers of your size through gap assessment and system security plan work, and none needed a second attempt.
Worth 20 minutes to map what yours would involve?
Expected reply rate
| Row type | Expected reply rate |
|---|---|
| Breach notice rows | 3 to 6% |
| Defense award rows | 3 to 5% |
| First security hire rows | 2 to 4% |
| Funding and SOC 2 rows | 2 to 5% |
| New licence rows | 1 to 3% |
The 2 to 5% headline is an estimate for a warmed domain writing to owners, CTOs, and compliance officers.
Specificity decides more than copy in this market.
A buyer receives several security pitches a week, and the only one read is the one naming a deadline the buyer already knows about.
Stack and running costs
| Tool | Purpose | Monthly |
|---|---|---|
| n8n Cloud | Orchestration | $24 |
| State breach lists and the federal health breach portal | Breach notification filings | $0 |
| Federal award data and SEC EDGAR | Defense awards and Form D filings | $0 |
| State and NMLS licence registers | New regulated financial licences | $0 |
| Apify | Job boards, list scraping, domain resolution, people search | $39 |
| Hunter | Decision-maker email finding | $34 |
| BetterContact | Waterfall enrichment + verification | $15 |
| Instantly | Sending + warmup | $37 |
| Claude API | Opening lines, LinkedIn notes, reply classification | $11 |
| SourceToDocs (Starter) | Branded scoping proposal generation | $19 |
| Sending domain | Deliverability | $1 |
| Supabase (free tier) | Prospects, firm profile, catalogue, snapshots, suppression | $0 |
| Total | ~$180 |
SourceToDocs is built by 2V Automation, the team behind this library.
Why the timing data costs nothing
Every trigger in this system is a record that a regulator or agency is required to publish.
- Breach notices. State statutes in a dozen states require the attorney general to post them, and the federal health portal lists every large health breach by law.
- Awards and filings. Federal award data and Form D filings are public by statute and free to query.
- Where the money goes. Enrichment, verification, sending, and the proposal document, which is where the work sits.
Intent-data platforms selling security research signals start around $15,000 a year and still carry no deadline.
