How to Find Customers for a Cybersecurity Company: 7 Signals
The seven LinkedIn moments that show a company of 10 to 500 people is about to buy security work, the exact search and message for each, a week-one plan with a daily time budget, and when partners, communities and referrals beat outreach.
The fastest way to find customers for a cybersecurity company is to reach a business in the week it decides security can no longer wait, and that week is visible on LinkedIn: a first "security engineer" job post, a founder asking who does SOC 2 audits, an insurer demanding MFA before renewal, a new head of security announcing day one. Message the owner within a day with one observation and you are in the conversation before a shortlist exists. Below: seven signals, a week-one plan, and when partners win.
Why does the usual cybersecurity sales advice stall?
Most pages on how to find customers for a cybersecurity company give the same list: pick a vertical, offer a free assessment, post thought leadership, run webinars, go to RSA and BSides, find channel partners, ask for referrals. None of it is wrong. The problem is timing. Security is a grudge purchase for most companies under 500 people; nobody wakes up wanting a penetration test. They buy when something external forces the date: a customer's security questionnaire, an auditor, an insurer, an attacker, or a new hire who was brought in to fix exactly this.
Those forcing events are common and public. In the UK government's Cyber Security Breaches Survey 2025/2026, which surveyed 2,112 businesses between August and December 2025, 43% of businesses had identified a breach or attack in the previous twelve months, rising to 46% of small and 65% of medium businesses; 47% held some form of cyber insurance, only 30% had carried out a cyber risk assessment, and 25% had a formal incident response plan. The same survey found 44% of businesses had sought external information or guidance on cyber security in the past year, 58% of small and 71% of medium ones. That last figure is the market for a small security company: most mid-sized buyers are already asking someone, and the question is whether they ask you.
A buying signal is a public action that shows a company is in-market now. The trigger event lesson explains the idea in general. For security sellers the triggers are unusually visible, because the people who buy security at a company of 10 to 500 people are founders, CTOs, IT managers and the newly hired head of security, and all of them post about hiring, audits, insurance paperwork and incidents.
Where do cybersecurity customers show up on LinkedIn?
Each row is a moment you can find with a free LinkedIn account. The search column is what to type into the search bar before switching to the Posts tab (or the Jobs tab, where stated) and filtering to the past week. The message column quotes the signal and offers one scoped piece of work, not a service catalogue.
| Signal | Where | What it means | What to do |
|---|---|---|---|
| A first security job post at a company with no security team ("security engineer", "IT security manager", "head of information security", "GRC analyst", a CISO role at a company that never had one) | Jobs tab: "security engineer" or "information security manager", filtered to companies of roughly 50 to 500 people in your region or vertical; open the company page and check for an existing security title | Security now has a budget line and an owner, the hire takes months, and the audit, the questionnaire or the insurer that prompted the role will not wait | Message the CTO or founder: what a fractional or managed engagement covers while the role is open, and the option of staying on as the second pair of hands once the hire lands |
| A compliance or questionnaire deadline ("we need SOC 2 by Q2", "ISO 27001 certification", "a customer asked for our pen test report", "HIPAA audit", "NIS2 applies to us", "PCI DSS", "NIST 800-171 self-assessment") | Posts tab: "SOC 2" "we need" or "pen test" "customer asked" or "ISO 27001" certification "we" or "NIS2" "our company", past week | A third party has set a date and a checklist, and the company needs someone to own the list; the first vendor to map the gaps usually gets the engagement | Name the two controls that most often fail first against the standard they mentioned, and offer a fixed-scope gap assessment against that exact questionnaire or framework |
| A cyber insurance renewal ("our insurer wants MFA everywhere", "cyber insurance questionnaire", "renewal asked for EDR and offline backups") | Posts tab: "cyber insurance" renewal MFA or "cyber insurance" questionnaire "our" or insurer EDR backups "we", past week | The buyer has a deadline, a list of controls written by someone else, and a premium that depends on ticking them; this is the easiest security sale to scope | Offer to walk the questionnaire with them and quote the two or three controls as fixed projects; the renewal date is your close date |
| An incident at the company or at a peer ("we got phished", "a vendor invoice was spoofed", "ransomware hit our supplier", a public company's 8-K incident filing in your vertical) | Posts tab: phished "our team" or "invoice" spoofed "we" or ransomware "our supplier", past week; for public companies, SEC EDGAR filings under Form 8-K Item 1.05, then the LinkedIn company pages of their peers and suppliers | The cost of no security partner just became concrete, and the owner is telling the story in public, which means they are still inside the decision; a peer's breach opens the same window one step removed | Do not pitch into the incident post. Connect with a note that names one control that would have stopped it, and offer a 30-minute review of the three that matter most; for a peer breach, message the peers with "here is what this means for a company your size" |
| A funding round or a first enterprise deal ("we raised our Series A", "just signed our first Fortune 500 customer", "going upmarket", "procurement sent us a 200-question security review") | Posts tab: "we raised" security or "first enterprise customer" "we" or "security questionnaire" procurement "we", past week | Enterprise procurement will demand a SOC 2 report, a pen test and a policy set the company does not have, and the money to pay for them just arrived | Congratulate, then offer the one deliverable procurement will ask for first (usually a pen test report or a SOC 2 readiness plan) as a fixed-scope project timed to the deal |
| A new security leader ("excited to join X as CISO", "starting as head of security at", "first security hire at a scaleup") | Posts tab: "as CISO" "excited" OR "thrilled" OR "starting" or "head of security" "new role", past week; also "job changes" alerts on your saved leads | New security leaders assess the estate and buy in their first months, with a mandate and often a budget nobody has spent yet; they also do not yet have a vendor list | Congratulate without pitching, then two weeks later offer one thing a new leader needs: an independent external assessment they can show the board, or a pen test to baseline the estate |
| A public request for a provider ("anyone recommend a pen test firm?", "SOC 2 auditor recommendations", "MDR provider for a 60-person company", "who do you use for security awareness training?") | Posts tab: recommend "pen test" or "SOC 2" auditor recommend or "MDR" recommend "small", past week; also the comments under those posts, where other buyers add "following" | An open evaluation with a shortlist forming in the comments the same day | Answer in the thread with one useful question or point (scope, retest included or not, who holds the report), then connect with a note that quotes their post and offers a 20-minute scoping call |
Two filters keep the list honest. A signal older than two weeks is cold: the company has either picked someone or decided to live with it. And a post from another security vendor or an MSP asking "who needs a security review?" is not a buyer, however many comments it has. Reddit, Slack communities and X carry the same requests, and the Reddit method has the queries; treat them as manual channels, because Intentsly monitors LinkedIn only.
The incident and peer-breach rows have more volume than most sellers assume. Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, found that 31% of breaches now start with a software vulnerability, ahead of stolen credentials, and that 48% of all breaches involve ransomware. Verizon's companion 2026 Breach Impact Study, built on roughly 70,000 cyber insurance claims, puts the loss from a breach at more than 7% of annual revenue for the worst-hit 2.5% of small and medium businesses. Public companies have to say so out loud: since the SEC's 2023 rules, a material incident goes on Form 8-K Item 1.05 within four business days of the materiality decision, and each filing is a list of suppliers and peers who are about to be asked by their own boards whether it could happen to them.
Compliance deadlines move, so check the primary source before you quote one in a message. The US defense supply chain is the current example: the DoD CIO's CMMC page says Phase I self-assessment requirements remain in place while Phase II, due 10 November 2026, was suspended on 13 July 2026. A subcontractor posting about a NIST 800-171 self-assessment is still a buyer; name the requirement in force today.
How to find customers for a cybersecurity company by hand: a week-one plan
The plan takes about an hour a day with a free LinkedIn account. Sales Navigator makes the headcount and job-post steps faster but is not required.
- Day 1: write the one-sentence offer and list the voices. Pick the company type and the size, for example "SaaS companies of 30 to 200 people selling to enterprises, no security hire yet, need SOC 2 within a year". Then list ten people your buyers follow (auditors, cyber insurance brokers, security founders, CTOs who post about compliance) and five security firms that compete with you. The ideal customer profile lesson is the longer version of this step.
- Day 2: build the saved searches. Create the seven Posts-tab searches from the table with your region, vertical and framework words added, each filtered to the past week, plus one Jobs search for the first-security-hire roles. Bookmark them. The hiring-signals routine goes deeper on the job-post signal, the job-change guide covers the new-CISO signal, and the search operators guide explains the quoting rules.
- Days 3 to 5: thirty minutes of reading, thirty of replying. Run the searches, read the new posts, and for each real buyer do the "what to do" step from the table. Reply in public first, connect second. Send at most 15 connection requests and 15 messages a day; LinkedIn tolerates more, your acceptance rate does not.
- Day 6: follow up and find the budget owner. For every accepted connection with no reply, send one message that adds something: a question about which SOC 2 trust criteria they are scoping, a line about the insurer's control list they mentioned. Never "just checking in". Where the person who posted is an engineer rather than the CTO or founder, the decision-maker guide has the six steps to find who signs.
- Day 7: count. Signals found, replies, calls booked. Fewer than ten relevant posts in a week means the vertical or framework words are wrong, or your buyers do not post; widen the terms and add the Jobs tab before changing the niche.
Message template for the compliance-deadline signal, for copying:
Saw your post about needing SOC 2 before the [customer] deal
closes. The two criteria that usually hold up a first audit are
access reviews and vendor management, and both take longer than
the policy writing everyone budgets for. Happy to run a fixed-scope
readiness check against the trust criteria you are scoping, no
retainer attached.
A hypothetical example, to make the plan concrete: a twelve-person pentest and compliance firm in the Netherlands adds "NIS2", "ISO 27001" and "Dutch" to the seven searches and runs a Jobs search for "security officer" at companies of 50 to 500 people in Benelux. Its week-one list is compliance posts, a few insurance posts, one new-CISO announcement and one request for a pentest firm; the exact counts depend on how much the vertical posts. Finding the right fifteen people each day is where the hour goes; if you want that step done for you, the LinkedIn signals feature runs the same searches continuously and hands you the list already scored against your customer profile.
How does Intentsly do this for you?
The manual plan breaks at the point where your vertical produces more posts than one person can read, and the posts that matter are a day old by the time you find them. Intentsly runs the finding and the first conversation, on LinkedIn only.
| Signal from the table above | What Intentsly does |
|---|---|
| Compliance and questionnaire posts, insurance renewal posts, incident posts, funding and enterprise-deal posts, requests for a provider | Keyword post monitoring for the pain points, tools, frameworks and topics you set, in English, Romanian, German and Dutch |
| Buyers asking questions under auditors', insurance brokers' and security founders' posts | Post engagement monitoring: people who like, comment or share posts from the competitors and industry leaders you name |
| Early research on the security firms that compete with you | Competitor page follower and engager tracking, and hashtag engagement monitoring |
| Separating a buyer from another vendor, an MSP or a job seeker | Scoring against your ideal customer profile, so the list arrives prioritised |
| Finding the email for the follow-up, the proposal and the statement of work | Enrichment with verified emails, and export of leads and signals |
| Replying, holding the conversation, booking the scoping call | The AI SDR sends LinkedIn connection requests and messages, holds the conversation, and sends your Cal.com or Google Calendar link so the buyer books; HubSpot is the native CRM integration |
The limits are the same as the manual plan, stated plainly: up to 2 LinkedIn accounts per plan, a maximum of 30 messages and 30 connection requests per account per day, and Intentsly recommends 15. The AI SDR sends LinkedIn messages only; it does not send email. The job-post signal and the SEC filing check are best kept in your own routine: the first is not monitored, and the second lives outside LinkedIn.
What does this look like in practice?
We are not a security company, but we sold a new product into a crowded market the same way a small security firm sells into one: a buyer who distrusts vendors, many providers with the same brochure, and a short window when an outside event forces the decision. Launching an AI sales platform against outreach tools with bigger budgets, we pointed our own intent signals at founders complaining about cold outreach burnout and let the AI SDR handle replies and booking. The result was 14 qualified demos in 14 days with zero manual outreach, and a reply rate 4x our previous cold campaigns. Most of those leads came from signals caught in real time. The write-up is on the case studies page.
Across Intentsly customers in October 2026, agents find around 1,000 leads a month each, and accounts book 2 to 4 meetings a week on average. Those are typical figures, not guarantees; a vertical whose IT managers rarely post runs below them, and a security engagement takes more calls to close than a software demo, because the buyer has to trust you with access.
Other ways to find cybersecurity customers, and when they beat signals
Signals produce conversations with strangers. Three other routes earn their place, and for most small security companies one of them comes first.
MSPs, auditors, insurance brokers and law firms as referral partners beat signals when you sell a defined service to a defined company size. An MSP sees every client fail an insurance questionnaire and does not want to own the pen test; an auditor sees every readiness gap; a broker sees every renewal that comes back half empty; a privacy lawyer gets the call after the incident. Each of them wants a security firm to hand the problem to. The cost is that they also hear from your competitors, which is why most firms run partnerships and signal outreach together. The MSP page describes the partner's side of this.
Practitioner communities and local events beat signals for a product company whose buyers are security engineers rather than founders, because engineers evaluate in public and distrust outreach. The Cyber Building Blocks newsletter, the one first-hand page ranking for this query, puts the author's own estimates at around $500 a month plus $500 to $1,000 per meeting for matchmaking marketplaces and $10,000 to $20,000 for a local event sponsorship, against about thirty minutes a day for building in public; one founder's figures, not a survey. Showing up at BSides without a booth and answering questions where your buyers already are costs time and nothing else.
Referrals from the first clients beat signals for the first client, almost always. The company whose audit you passed, or the CTO you helped through a questionnaire, already trusts you and has peers facing the same deadline. Ask after every delivered report. The ceiling arrives when that network has been asked once; the plan above is what you run when it has. Cold lists are the one tactic signals replace outright: every company with a laptop could use security work in theory, which is why a scraped list converts so badly, and a post says which of them has a deadline this month. The B2B SaaS page covers the buyer on the other side of the enterprise-deal signal, and the solutions index covers other business types.
The next step is to check whether your buyers talk in public. Try the AI shows matching companies for your vertical and framework with no account, which is the quickest test of whether the week-one plan is worth your hour a day. If it is, the Buying Signal Playbook lists the 12 signals worth chasing and the 8 to ignore, with a script for each.
FAQ
How do cybersecurity consultants get their first clients?
Usually from a former employer, a colleague's company or an MSP that needs a pen test or a compliance project it cannot staff. Ask those three groups for one scoped project, not a retainer. Run the week-one plan from day one in parallel, so that when the network has been asked, companies that posted a compliance deadline or an insurance renewal this week are already in conversation with you.
Who buys cybersecurity at a small company?
At most companies under a few hundred people, the founder or CTO signs and the IT manager or lead engineer evaluates; a CISO title is rare. As the company grows, the first security hire appears, and that person becomes both your buyer and your competitor for budget. Message the person who posted the signal, then use their company page to find who signs; the two are often different people.
How long is the cybersecurity sales cycle for a small firm?
A deadline-driven project (insurance renewal, SOC 2 readiness, a pen test for procurement) can close in weeks because a third party set the date. A retainer or managed service takes a quarter or more, and most companies budget security annually; the Cyber Builders summary of the 2024 Cybersecurity Buyers Report puts most prospects in a six to twelve month cycle and 86% on annual budgets. Lead with the project, and let the retainer follow.
Does a free security assessment work for getting clients?
It works when it is scoped against something the buyer already has to answer: their insurer's questionnaire, a customer's security review, a specific framework. A generic "free scan" attracts curiosity, not budget, and costs you staff time. Offer the assessment only to companies that posted one of the seven signals, and name the questionnaire or standard in the offer.
Should a cybersecurity company pick an industry niche?
Yes, but pick it from where the signals are. A vertical with a regulator or a standard (healthcare, finance, defense supply chain, SaaS selling to enterprises) produces more compliance and questionnaire posts and lets you reuse one gap-assessment template across clients. If your region is small, pick a company size and a framework rather than an industry, and let the saved searches tell you which industry posts most.
Is LinkedIn worth it for selling cybersecurity services?
For companies of 10 to 500 people, yes, because the buyers are founders, CTOs and IT managers who post about hiring, audits and incidents, and the new security leaders who announce their start date. For large enterprises, less so: the CISO rarely posts a need, and the route is partners, analysts and procurement. Run the searches for two weeks and count before deciding; the count tells you more than any article.
