CISOs move more than their careers suggest. Follow five public trails to the current name, watch for buying signals like new hires, and verify every address.
The average CISO has nine years in the role. A single CISO seat at one company often lasts about two.
IANS and Artico Search report that CISOs average nine years in the role across their careers, and that nearly seven in ten are open to a move within a year. So the contact you want is a person who moves, not a seat that stays. Follow five public trails to the current name, watch for buying signals, and verify every address before you send. Last year's list is already out of date, so this guide shows how to rebuild it quickly.
Finding CISO contacts means identifying the person who leads information security at a target company, then confirming a deliverable work email or direct line. Because CISOs change employers often and titles vary, the work combines public disclosures, conference and press sources, and verification before outreach.
The CISO leads information security, but the title varies. Large companies use CISO or chief security officer. Mid-sized ones use VP of security or head of security. Smaller companies hand the job to an IT director. IANS found executive-level CISO titles are now the most common, so lead with the person who owns security decisions, not the label.
IANS also found that 64% of CISOs report into IT leadership and 36% report to business leaders such as the CEO, COO, general counsel, or chief risk officer. That tells you where to look for a second contact.
| Title | Typical at | Often reports to |
|---|---|---|
| CISO or chief security officer | Large and regulated companies | CIO, CEO, or risk leader |
| VP or head of security | Mid-sized companies | CIO or COO |
| Director of information security | Mid-market and smaller companies | IT leadership |
| IT director with security duties | Small companies | CEO or COO |
Match the title to the buyer, not the label, because a security tool can be bought by a CISO at one company and an IT director at the next. If your product touches infrastructure, read how to find CIO email addresses. If it supports engineering, see how to find CTO email addresses. For the full group, use the buying committee map.
Five trails work: cybersecurity governance disclosures in annual reports, conference programs, press and podcast appearances, professional profiles, and security job postings. For public companies, the annual report's cybersecurity section describes which management position handles cyber risk and its expertise. Cross-check every name against a second source and a date.
Work through them in order:
Start from the disclosed position, then find the human, because the filing tells you the role exists even when it won't name the person. For the same trail applied to finance, see how to find CFO email addresses.
Look for a new CISO, a material incident filing, a merger, a regulatory change, and signs of overload. Public companies file Form 8-K Item 1.05 within four business days of deciding an incident is material. IANS found 52% of CISOs say their scope is no longer fully manageable, which opens the door for tools that offload work.
Here's how to use each signal:
With nearly seven in ten CISOs open to a move within a year, treat every name as perishable and re-verify before each campaign. Pair a signal with a fresh name, such as a new CISO at a company that just reported an incident. That's the logic behind signal stacking.
Keep it short, specific, and evidence-based. Name one public fact about their company, describe one problem you solve in plain language, and offer a short document, not a demo. Don't use fear. Security leaders read vendor mail all day, and a calm, precise note stands out against alarmist ones.
Here's a starting template to adapt:
Subject: [Specific Task] for [Company]'s security team
Hi [First Name],
I noticed [Company] [Public Fact]. Security teams in that
position often spend time on [Task].
[Product] helps teams [Result] without [Common Cost]. I can
send a two-page summary and our security documentation.
Would that be useful?
[Your Name]
[Postal address] | Reply "no" to opt outOffer a two-page summary and your security documentation before you ask for a meeting. We haven't measured this template's reply rate, and you shouldn't assume one. Test it against your own list. Verify the address first with the three-gate method, because bounces to a security team's domain can be costly. In the US, the FTC says the law makes no exception for business-to-business email, so include a postal address and a working opt-out. For vendors who sell security, our guide to lead generation for cybersecurity companies covers the broader playbook, and healthcare sellers will find a related map in lead generation for healthcare IT.
The Disclosure-Trail Method says you find a CISO by following the company's own disclosures to the person: governance language in annual reports, incident notices, conference talks, and hiring posts. Start with what the company must say, then fill in the name from what the person chooses to say.
"CISOs leave a paper trail on purpose. Follow it before you guess an address."
Start with the required disclosure, the one the company can't skip. It tells you the role exists and sometimes who holds it. Then add voluntary sources: a conference talk, a trade-press interview, a podcast. Those confirm the name and add a date. Third, check the date against any job-change signal. Fourth, verify the address.
Say you're building a list of 100 public companies. The disclosure step gets you a role for most of them in an afternoon. The name step takes longer, but it's far more accurate than starting with a database export from last year. And because the trail is public, you can show your work if a prospect asks how you found them.
The method also tells you when to stop. If you can't find a name from two sources, don't guess. Use a verified contact source, or try the IT leader as a second route, then come back when a job-change signal appears.
You've followed the trail for forty companies and found thirty names. The last step is where lists go to die: "Half my list bounced and now my domain is flagged." Security teams notice, and so do spam filters.
InboundLabs is a sales intelligence platform with a database of 280M verified B2B contacts. Filter by industry, headcount, region, and title to find CISOs, security leaders, and IT directors at the companies on your list. You get buyer intent signals layered on firmographic data and 98% email deliverability on verified contacts. You also get verified direct dials, not switchboard numbers, for the leaders you'd rather call. Test your title list on a small pull first. Monthly plans, no annual lock-in, and it's free to start, no credit card required.
See how InboundLabs finds verified contacts instantly → inboundlabs.app
CISOs move more than their careers suggest, so your list needs to follow people, not seats. Use annual report disclosures to confirm the role, conferences and press to confirm the person, and job-change signals to confirm the date. Verify every address, offer a short document, and skip the fear. Pick ten target companies this week, read their cybersecurity disclosures, and write down who holds the job.
Read the cybersecurity section of the company's annual report, which describes the management position responsible for cyber risk and its expertise. Some filings name the person. Then confirm the name through conference programs, press interviews, or a professional profile, and check that the date is recent.
Estimates vary. Cybersecurity Ventures puts large-enterprise CISO tenure at roughly 18 to 26 months, while a Hitch Partners survey cited by Expert Insights says 39 months. IANS reports CISOs average nine years in the role across their careers. Verify the current name before each campaign.
CISO or chief security officer at large companies, VP or head of security at mid-sized ones, and director of information security or IT director at smaller ones. IANS found executive-level titles are now the most common. Match the title to the person who owns your problem, not the label.
It's the SEC requirement for public companies to disclose material cybersecurity incidents, generally within four business days of determining materiality. A filing is a public, dated event that can open a conversation about security help. Use it respectfully, and never as a pressure tactic.
It depends on what you sell. IANS found 64% of CISOs report into IT leadership, so a CIO may influence or own the budget. For security products, start with the CISO and bring in the CIO when infrastructure or cost is involved. Multithread both contacts.
In the US, CAN-SPAM applies to business email, so include a postal address, honest headers, and a working opt-out honored within 10 business days. Rules vary by country. This isn't legal advice, so check the laws where your recipients live before you send.
LSI keywords: CISO contacts, chief security officer, cybersecurity disclosure, Form 8-K Item 1.05, security leaders, IT director, conference programs, job change alerts, CISO tenure, verified contacts, buying committee
The average school district uses 2,982 edtech tools a year, so your product has to be a swap, not an add-on. Here's who buys, when budgets move, and how to build a verified list.
Events companies sell to attendees, exhibitors and sponsors, and corporate buyers. Build the exhibitor list first, and pitch it on cost per qualified lead.
Selling into a franchise system means one yes from headquarters or hundreds from owners. Learn what FDD Items 2, 8, and 20 reveal, and decide which path comes first.
Healthcare IT deals stall when the CISO or privacy officer shows up in month nine. Map the vetoes first, time outreach to public events, and verify every contact.
Get $25 worth of verified contact lookups for $4 your first month. Not blown away? Cancel in one click.