How to Sell to a CISO (and Size the List First)

TL;DR

• A CISO buys to reduce risk they can explain to the board and to auditors. Sell evidence and a small first step, not a feature list.
• Count first, send second. On 2026-10-21 LeadOcean showed 16,954 mailable people titled "CISO" or "Chief Information Security Officer" worldwide, 8,648 of them in the US.
• The recipe takes about 25 minutes and spends about 26 LeadOcean records. Every count is free.

Prerequisites

• A free LeadOcean account and an API key from app.leadocean.io. Free gives you 1,000 records for life, no card, 5 requests a second.
• The key in your shell as $LEADOCEAN_API_KEY.
• curl and jq.
• Optional: Claude or any MCP client connected to https://api.leadocean.io/mcp, which has 13 tools including free counts.

What a CISO actually cares about

A CISO is judged on what does not happen. A breach, a failed audit or an outage lands on their desk first, so every email you send gets read as a possible new risk.

They care about four things, in this order.

1. Risk reduction. Which real threat or control gap does this close? Name it in plain terms.
2. Proof. Audit evidence, architecture detail and a clear answer on where data goes. A CISO will ask for these before a call.
3. Fit with the stack. Another tool means another agent, another integration and another thing to patch. Say what it replaces or plugs into.
4. Workload. Security teams are small. Anything that adds alerts or review work needs to say how it removes more than it adds.

They do not respond to fear-based copy. They write that copy for a living.

What kills the deal

CISOs say no for predictable reasons. Answer them in the first email, not the third.

• "Send it to my team." Good. Write a note the security engineer can forward, with the risk named and a date.
• "We have a tool for that." Do not argue. Ask what it does not cover and when the contract renews.
• "We need a security review first." Offer the review pack up front: architecture, data flow and access model.
• "Can you prove it?" Bring evidence you have. Never quote a result or a certification you cannot show.

Where a CISO sits in the buying committee

A CISO is usually a veto holder, not the budget owner. They can stop a purchase on risk grounds even when everyone else wants it.

Three roles show up around them:

• The CIO or CTO often owns the budget and the security team reports into or beside them.
• The functional owner (marketing, engineering or recruiting) wants the tool and needs the CISO to clear it. See how to sell to a VP of Marketing, how to sell to a VP of Engineering and how to sell to a recruiter.
• The security engineer or architect runs the technical review and writes the recommendation.

Write to the CISO as someone who will ask one question: "What new risk does this create, and how do I know?" Give your champion the answer in one paragraph.

Step 1: Count CISOs by country (free)

Start with a count. It spends zero records and tells you whether the segment is worth a campaign.

leadocean_count_leads counts mailable people by default (verified, catch_all_valid and catch_all addresses). Run it from any MCP client:

{
  "tool": "leadocean_count_leads",
  "arguments": {
    "title": ["CISO", "Chief Information Security Officer"],
    "country": ["US"]
  }
}

Repeat with GB, DE and IN, or omit country for the worldwide figure. Title search matches job-title keywords, so "Head of Security" or "VP Information Security" will not be in this count. Run them as separate counts.

Step 2: Read the count for each country

Put the counts in one table before you pick a market. These ran on 2026-10-21, filtered by the two titles above and the default mailable email statuses.

Two things to read from this. The US holds 51% of the worldwide mailable list (8,648 of 16,954). And the mailable column is well under half of everyone matching, which is why you count mailable before you plan volume.

The list is small. A global CISO campaign is about 17,000 named people, and a single country is a few hundred. Write each email by hand, not from a template with a merge field.

Step 3: Pull a sample from your best region

Pull 25 rows from the region you picked. This spends 25 records. Search is a flat JSON body, filters are arrays, and limit runs from 1 to 100.

curl -s -X POST https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": ["CISO", "Chief Information Security Officer"],
    "country": ["GB"],
    "emailStatus": ["verified"],
    "limit": 25
  }' | jq '.data[] | {name: .profile_data.profile_full_name, person_id: .meta.source_ids.person_id}'

Add a company-size filter next if you sell to one segment, for example "employeeRange": ["1001-5000"]. Page with the cursor value from meta. One search pages to 10,000 rows, so narrow the filters instead of walking the whole index.

Step 4: Enrich one record to read the career history

Before you write, read one profile. Person enrich returns career history: past roles, education, certifications and awards. Past employers carry no company_id yet.

Enrich takes exactly one of linkedin_url, email, phone or person_id. Use the person_id a step 3 row carries at meta.source_ids.person_id.

curl -s -X POST https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_3", "reveal_email": true}' \
  | jq '.data.resume_data.experiences[0:3], .data.resume_data.certifications'

This costs one record. A person we hold nothing for returns a 404 and costs nothing.

Look at the path. A CISO who came up through engineering reads architecture and tooling first. One who came from audit or risk reads controls and evidence. A certification on the profile tells you which vocabulary they use.

Step 5: Size the people around the CISO

A CISO rarely decides alone, so count the people around them too. Run the same free count for jobFunction: ["Information Technology"] with jobLevel: ["VP"] or ["Director"], and compare it with the CISO count.

{
  "tool": "leadocean_count_leads",
  "arguments": {
    "jobFunction": ["Information Technology"],
    "jobLevel": ["VP", "Director"],
    "country": ["GB"],
    "facets": false
  }
}

A high ratio means you can multi-thread: write to a security director and an IT leader in the same week, with the same risk named in both emails. A low ratio means the CISO is often the only name on record, so write to them directly and keep the ask small.

Counts with jobLevel or jobFunction are free and spend no records. Label each one by what you filtered, because a mailable count is not a count of everyone.

Step 6: Write the first line

The first line must show you know the job. Pick one angle and keep the email under 90 words.

1. Risk: "Your team still reviews {task} by hand. We close that gap without a new agent. Want the architecture note?"
2. Proof: "I can send the data-flow diagram and access model before we talk. Which would help your review?"
3. Stack: "This plugs into {tool} through its API and replaces nothing you run today."
4. Territory: "I counted {N} security leaders at companies like {Acme}. Want the list and the method?"

The territory line works because it is checkable. You ran a free count, so the number is real. Send it with the count and the date.

These are starting points from how the segment is shaped, not measured results. Do not claim a reply rate you have not measured. Test two angles on 100 contacts each and keep the winner.

Step 7: Save the list as a CSV

When the sample converts, export the list. Bulk CSV export is not on the Free plan. Solo includes it, and Agency exports 50k rows a file. The ceiling is 50,000 rows a request and 500,000 a day.

curl -s -X POST https://api.leadocean.io/v1/exports \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ciso-list",
    "filters": {
      "title": ["CISO", "Chief Information Security Officer"],
      "country": ["GB"],
      "emailStatus": ["verified"]
    },
    "limit": 5000
  }'

Search filters go inside filters, and limit sets the row count. Poll GET /v1/exports/{id} until the file is ready.

You can build the same export in the app at app.leadocean.io. The Exports page has a filter builder, a column picker and a price preview before you download.

What you get

The count in step 1, run on 2026-10-21 with the two titles and country: ["GB"], returned:

{
  "total": 693,
  "totalIsExact": true,
  "totalAll": 1748,
  "distinctCompanies": 538,
  "credits": 0
}

total is the mailable count. totalAll is everyone matching without the email filter. The call cost no records.

A search row follows the response shape from the API reference, shown here with placeholder values. Rows carry no addresses; enrich by person_id for those.

{
  "success": true,
  "data": [
    {
      "profile_data": { "profile_full_name": "Jane Doe", "profile_headline": "Chief Information Security Officer at Acme" },
      "contact_data": {
        "has_email": true,
        "email_status": "verified",
        "email_type": "work",
        "contact_current_experiences": [
          { "job_title": "Chief Information Security Officer", "company_name": "Acme", "company_domain": "acme.com" }
        ]
      },
      "meta": { "source_ids": { "person_id": "1234567890", "person_group_id": "1234567890" } }
    }
  ],
  "meta": { "count": 1, "nextCursor": "..." }
}

Troubleshooting

FAQ