No sending domains, no data, no campaigns on day 0. A six-layer, signal-driven system reaching CISOs across email and LinkedIn by day 27.
Elite US cybersecurity consultancy. Pen testing, firmware, hardware lab. World-class delivery, zero outbound.
Pipeline ran on referrals only, in an ultra-niche market of 500 to 800 real Tier 1 targets.
Six-layer system: ICP tiers, Clay enrichment, AI scoring, 6 buying signals, email + LinkedIn, full handoff.
Live in 27 days. 12 campaigns, 1.6% bounce, and a system the client's team now runs on its own.
Context
A fast-growing US cybersecurity consultancy specializing in penetration testing, embedded security, firmware reverse engineering, and hardware lab testing. Capabilities that fewer than a handful of firms worldwide can match, with a client roster of major enterprise technology companies.
Despite world-class technical work, they had no systematic outbound function. Pipeline relied entirely on referrals and inbound. They needed a full outbound engine built from scratch, fast, to open new enterprise conversations at scale.
Constraints
Architecture
One engine, six layers. Data flows left to right: a tiered target universe feeds a Clay enrichment engine, buying signals decide who gets contacted and with what message, and safety rails sit under everything before a single email leaves.
4 target tiers with distinct strategies, from high-touch Tier 1 (embedded and hardware, 500 to 800 companies) to programmatic Tier 3. 5 buyer personas with automated routing to the right campaign and sender. Deal sizes from $7K to $150K+.
~25,000 contacts in Clay, an 11-provider email waterfall, AI classification by primary attack surface (firmware, embedded, IoT, connected vehicles), and a name normalization engine that cleaned 127 edge cases out of 3,248 companies.
Lead scoring on persona match, email availability, signal strength, and campaign readiness. Batch assignment across 4 priority tiers with saturation protection: max 3 contacts per company, overflow to holding lists.
New security leadership, funding rounds, product launches, certification pursuits, government contracts, security incidents. Each signal feeds a dedicated campaign with signal-specific copy and timing.
12 email campaigns across 4 strategies (signal-triggered, deep personalization, volume A/B/C, competitive intel) plus LinkedIn across 4 sender personas, with splits for defense and space verticals.
Stop-for-company rules, 135+ entry DNC suppression, bounce monitoring, warmup tracking. Full documentation delivered: the client's team runs the system independently today.
Speed
First campaign live, from zero infrastructure
Full 6-signal architecture deployed
570 scored and batched leads pushed
3-variant volume test launched
Complete handoff documentation delivered
Results
| Everything the client owns today | |
|---|---|
| Contacts enriched & segmented | ~25,000 |
| Email campaigns built | 12 |
| LinkedIn campaigns (4 sender personas) | 5 |
| Buying signals automated | 6 |
| Sending domains configured | 6+ |
| Mailboxes warmed & active | 12+ |
| Companies in DNC suppression | 135+ |
Want numbers like these for your pipeline?
Book a 15-min callFit
Stack





See how a signal-based, multi-channel system gets built for your market, even if you have zero infrastructure today.
Book Your Free Strategy Call