How to Build a B2B Lead List for Cybersecurity (Buyers, Filters and Messaging)

Security purchases are signed by a CISO or a VP of IT, but they are judged by the engineers who run the tool. Your list needs both, with a different first line for each.

This guide picks the committee, finds it with LeadOcean filters, sizes the list with a free count and drafts the first message per role. It works whether you sell to security teams or to security vendors.

TL;DR

• Target three roles per account: the security lead who owns the budget, the practitioner who tests the tool and the IT or risk lead who can block it.
• Size first with a free count. On 2026-10-21, US-headquartered companies filed under Computer and Network Security held 19,432 mailable VPs and C-level people across 3,999 employers.
• The recipe takes about 45 minutes and spends about 30 records, so it fits inside the Free plan's 1,000.

Prerequisites

• A LeadOcean account on the Free plan. Sign up at app.leadocean.io, no card.
• An API key exported as $LEADOCEAN_API_KEY.
• curl and jq, or any HTTP client.
• Optional: the hosted MCP server at https://api.leadocean.io/mcp if you would rather run the counts from Claude.

Step 1: Pick the buying committee

A security deal rarely closes on one signature. Pick the roles before you touch a filter.

Company size changes the committee. At a 50-person company the CTO is also the CISO. At 1,000 people there is a security team, a risk team and a procurement process.

LeadOcean files security vendors under Computer and Network Security and Data Security Software Products. Look the exact strings up before you use them.

curl -s "https://api.leadocean.io/v1/enums/industry?q=security" \
  -H "x-api-key: $LEADOCEAN_API_KEY" | jq -r '.data.values[]'

On 2026-10-21 that returns five values, three of which cover guards and physical security systems. Leave those out unless you sell to them. Enum values are exact strings. The same lookup is free through the MCP tool leadocean_list_enum_values.

Step 2: Turn the committee into filters

Write the filters as flat JSON. Every filter is an array, even when it holds one value.

{
  "industry": ["Computer and Network Security", "Data Security Software Products"],
  "jobLevel": ["C-Team", "VP"],
  "hqCountry": ["US"]
}

That list targets people at security vendors. If you sell security to other companies, there is no "has a security team" industry. Filter by role instead, and use size to pick accounts that have one.

{
  "title": ["CISO", "Chief Information Security Officer"],
  "country": ["US"],
  "employeeRange": ["201-500", "501-1000", "1001-5000"]
}

Add keywords when an industry label is too narrow. The companyKeywords filter matches words in the employer's description, specialties and tags, so ["cybersecurity"] finds companies that the industry label alone misses. It applies when the matching companies number 50,000 or fewer. Check the effect with a count before you rely on it.

Run one list per role. Mixing a CISO and a security engineer into one sequence gives you a message that fits neither.

Exclude what you cannot sell to. Add excludeTitle values such as ["intern", "assistant"] and set excludeCompanyName for competitors and existing customers.

Step 3: Split by company size and sub-market

Security is not one market. A managed detection provider, an identity vendor and a compliance tool sell to different people at different sizes.

Split the list on three axes before you write anything:

• Headcount. Use employeeRange. Under 200 people, the buyer is a CTO or head of IT. From 201 to 1,000, a first security hire or small team exists. Above 1,000, expect a CISO, a GRC function and a procurement review.
• Function. Use jobFunction set to Information Technology for security leads and Engineering for builders. Use Legal or Finance & Accounting for risk and compliance gatekeepers.
• Region. Use hqCountry for the account and country for the person. A European CISO and a US CISO answer different regulations, so write them separate lines.

Count each cut with leadocean_count_leads (Step 4) before you commit. If a segment holds under a few hundred people, merge it with its neighbour. A list that small cannot support its own sequence.

Technology filters help when you sell an integration. The technologies and technologyCategories filters read what is detected on a company's website, for example the Security category. They cover about 7.8M crawled companies, so a missing match does not prove a company lacks the tool.

Step 4: Size the list with a free count

Count before you pull. A count costs no records and can run as often as you like.

curl -s "https://api.leadocean.io/v1/people/search?count=true" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "title": ["CISO", "Chief Information Security Officer"],
    "country": ["US"],
    "employeeRange": ["201-500", "501-1000", "1001-5000"],
    "limit": 1
  }' | jq '.meta'

count=true goes in the query string. The JSON body rejects unknown fields. The response has no rows, only meta.total (capped at 100,000) and meta.countOnly: true.

For the company side, GET /v1/companies/count takes the company-search filters and returns an exact total with breakdowns by industry, headcount band, HQ country and HQ state. Use it to see where the accounts sit before you pick a region.

Step 5: Pull a 25-row test batch

Pull a small batch first. Read the titles. If half of them are the wrong role, tighten the filters before you spend more.

curl -s "https://api.leadocean.io/v1/people/search" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "title": ["CISO", "Chief Information Security Officer"],
    "country": ["US"],
    "employeeRange": ["201-500", "501-1000", "1001-5000"],
    "limit": 25
  }' > batch.json

jq '.data | length' batch.json

A page of 25 is 25 records. Page with cursor from meta.nextCursor when you want more. One search pages to 10,000 rows, and the last page carries meta.depthCapped: true. Narrow the filters instead of walking further.

Each row carries an email status. Send to verified and catch_all_valid. Read the status before you send, because LeadOcean does not credit back bounces.

Step 6: Enrich the champions you will contact

Enrich only the people you will contact. Enrich takes exactly one of linkedin_url, email, phone or person_id.

curl -s -X POST "https://api.leadocean.io/v1/people/enrich" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_SEARCH", "reveal_email": true}'

Enrich also returns career history in resume_data: past roles, education, certifications and publications, each when held. Security people often list certifications. A named credential or a past incident-response role gives you a better opener than a job title. An enrichment that finds nothing is a 404 and costs nothing.

For a phone number, call GET /v2/people/phone. A v2 contact call costs one record even when it finds nothing.

Step 7: Write messages that fit the buyer

Security buyers get a lot of vendor mail and read little of it. Open with a specific problem, not a claim that you are different.

Keep claims you can prove. Do not cite a customer, a breach or a result you cannot show. Security buyers check claims, and they distrust fear-based copy.

Sequence by role, not by company. Send the practitioner a note about the technical fit. Send the CISO a note about risk and budget. When one replies, you can name the others at the account.

Timing matters. Security teams are busy after a public incident in their sector, before audit season and around budget planning. Send in the quiet weeks after those, and do not reference a specific breach in the first email.

A three-line email works better than a pitch. One line on their situation, one on what you do, one question.

Write each cut as its own filter file so the counts and pulls stay repeatable:

mkdir -p lists
cat > lists/ciso-midmarket-us.json <<'JSON'
{"title":["CISO","Chief Information Security Officer"],"country":["US"],"employeeRange":["201-500","501-1000","1001-5000"],"limit":1}
JSON
cat > lists/it-leads-small-us.json <<'JSON'
{"jobFunction":["Information Technology"],"jobLevel":["C-Team","VP","Director"],"country":["US"],"employeeRange":["51-200"],"limit":1}
JSON

Subject: Evidence collection at Acme

Jane, pulling audit evidence by hand takes your team away from
the work it was hired for. We automate that step.
Worth a short look, or is audit prep not on your list this quarter?

The names above are placeholders. Replace them with the fields from your batch.

Step 8: Export the full list

When the test batch reads right, export the rest. Bulk CSV export is not on Free; it comes with Solo at $97 a month and with Agency at $497 a month. On Free, page the search endpoint inside your 1,000 records.

curl -s -X POST "https://api.leadocean.io/v1/exports" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "name": "us-ciso-midmarket",
    "filters": {
      "title": ["CISO", "Chief Information Security Officer"],
      "country": ["US"],
      "employeeRange": ["201-500", "501-1000", "1001-5000"]
    },
    "limit": 3389
  }'

An export takes up to 50,000 rows a request and 500,000 a day. The app at app.leadocean.io has an Exports page with a filter builder, a column picker and the record price before you start.

What you get

These are free counts from the LeadOcean MCP tools on 2026-10-21. They count mailable people (verified, catch_all_valid or catch_all email), not everyone.

Without the email condition, the first filter matches 54,504 people and the third matches 6,367. The gap is people with no usable address.

The shape of one search row follows (response shape from the API reference, placeholder values).

{
  "success": true,
  "data": [
    {
      "profile_data": {
        "profile_full_name": "Jane Doe",
        "profile_headline": "CISO at Acme"
      },
      "contact_data": {
        "has_email": true,
        "email_status": "verified",
        "contact_current_experiences": [{
          "job_title": "CISO",
          "company_name": "Acme",
          "company_domain": "acme.com"
        }]
      }
    }
  ],
  "meta": { "count": 1, "limit": 25, "credits": 1, "nextCursor": "CURSOR", "depthCapped": false }
}

Troubleshooting

FAQ