New AI Answers: get named when buyers ask ChatGPT, Perplexity and Gemini who to hire. Watch 77-second video

October 22, 2026 · LegalBriefsUSA

Cybersecurity Lead Generation in 2026: Security Budgets Grew 5% on Average and 0% at the Median, So Your Outbound Has to Win a Reallocation

Cybersecurity lead generation in 2026 sells into security budgets that grew 5% on average and 0% at the median, with 55% of CISOs reporting flat or declining budgets in the IANS Research and Artico Search 2026 benchmark. Total spending is still rising, to a forecast $240 billion this year, so the money exists. It is moving between line items, not growing inside most of them.

That changes what outbound to security buyers has to do. A cold email to a CISO is not asking for new money; it is asking the reader to take money away from something already funded. This piece sits in our vertical outbound playbooks hub, next to the same analysis for SaaS companies at each ARR stage and MSPs and IT service providers, many of whom resell the security products covered here. Every external figure below is linked and dated.

How much are security buyers actually spending in 2026?

More in total, less per team. Gartner forecasts worldwide information security spending at $239.8 billion in 2026, up 12.5% from $213 billion in 2025. Inside individual companies the picture is flatter: IANS and Artico Search found average budget growth of 5% in 2026, a median of zero, 45% of organizations with no increase and 10% with a cut.

Measure Figure Source
Worldwide security spending, 2026 forecast $239.8 billion, up 12.5% Gartner
Security software, 2026 forecast $121.2 billion Gartner
Security services, 2026 forecast $92.8 billion Gartner
Average security budget growth, 2026 5% IANS and Artico Search
Median security budget growth, 2026 0% IANS and Artico Search
CISOs with flat or declining budgets 55% IANS and Artico Search
CISOs naming AI for security the top use of new budget 69% IANS and Artico Search
CISOs expecting a budget increase in 2027 64% IANS and Artico Search
Security budget as a share of IT spend, 2025 10.9%, down from 11.9% IANS and Artico Search
Gartner forecast released 29 July 2025. IANS 2026 figures as reported by TechTarget on 16 September 2026 and on the IANS blog on 30 September 2026; the 2025 share of IT spend is from the IANS release of 5 August 2025, a survey of 587 CISOs. All checked 22 October 2026.

Two numbers in that table should shape every campaign. First, 69% of CISOs say AI for security is where net-new dollars go, followed by SecOps automation at 51% and zero trust at 45%, per the IANS blog. If your product touches one of those, say so in the first line. If it does not, your email is competing for a share of a budget that did not grow.

Second, 64% expect their budget to rise in 2027, and the planning for that happens now. A security leader reading your email in late October is often drafting next year’s request. A message that hands them a quantified line item, with a cost and the risk it retires, is more useful to them this month than at any other point in the year.

Who actually buys from a cybersecurity vendor?

At companies large enough to have one, the CISO, and usually inside IT. IANS and Artico Search found 64% of CISOs report to IT leadership and 36% to a business leader such as the CEO, COO or general counsel. Below the size where a dedicated security leader exists, the buyer is the IT director, the CIO, or the owner, and often an MSP buying on their behalf.

The same January 2026 IANS release, built on 662 CISOs surveyed April to November 2025, adds three facts worth building a list around. Executive-level CISO titles at large enterprises rose from 33% in 2023 to 47% in 2025. CISOs average nine years in the role, usually across several organizations. And nearly seven in ten say they are open to a career move within the next year.

That last figure is the trigger most vendors underuse. A CISO who just changed companies inherits a stack they did not choose and a mandate to assess it. We put recent security leadership changes at the top of every cybersecurity list we build, ahead of company size or industry, because the timing does more work than the targeting.

The other underused trigger is staffing. In the 2025 IANS data, only 11% of CISOs said their teams were adequately staffed. A product that removes analyst hours is easier to fund from a headcount gap than from a tools budget, so job postings for security roles are a reason to email, not just a sign of growth.

Does cold outreach work on CISOs?

It works when it is specific, and it fails at volume. Security leaders are among the most heavily prospected buyers in B2B; a 2026 GovInfoSecurity column by security practitioner Ian Thornton-Trump puts it at more than 400 cold outreach attempts a month, which is one practitioner’s estimate rather than a survey. Generic sequences disappear into that pile. A short note that names a specific gap in the reader’s environment still gets read.

Published reply rates for technology sellers sit below the all-industry average. Mailshake’s 2026 benchmarks put SaaS and technology at 1.5% to 3% for an average campaign and 5% or more for the top 10%, against a 3.43% all-industry average attributed to Instantly. No major benchmark we found breaks cybersecurity out on its own, so treat the technology band as the closest published reference.

Segment Below average Average Good Top 10%
SaaS and technology reply rate Under 1.5% 1.5% to 3% 3% to 5% 5% or more
All industries, 2026 average 3.43%
Mailshake, cold email benchmarks 2026, published 5 March 2026 and modified 9 March 2026, checked 22 October 2026. Mailshake does not disclose the sample behind the vertical table, and no cybersecurity-specific row is published, so this is a published range rather than a measured benchmark for security vendors.

The buyer’s preference sits behind those numbers. Gartner’s March 2026 sales survey of 646 B2B buyers found 67% prefer a rep-free buying experience and 45% used AI during a recent purchase. A security leader who would rather research alone is not refusing to buy; they are refusing to be sold to before they have decided the problem is real. Outbound that leads with evidence, a short teardown, a benchmark, a finding from their own public footprint, fits that preference. Outbound that leads with a demo request does not.

Title seniority matters too. Published data on reply rate by job title shows the most senior readers are not the most responsive, which we break down in cold email reply rate by job title. For security, that usually means running the CISO and the security architect or director below them as parallel threads, with different messages, rather than sending the same email up and down the org chart.

What should a cybersecurity outbound email say?

One specific problem, one piece of evidence, and one low-cost next step. Fear is the default in this category and it is the reason most security email is ignored: the reader manages breach risk every day and does not need a stranger to describe it. Specific, verifiable relevance is the opposite of what the other 400 emails do.

The structure we use for security buyers is four lines long:

Three things to leave out. Breach statistics from vendor reports the reader has already seen. Named customer logos you do not have written permission to use, which a security buyer will check. And any claim about a regulation or deadline you have not verified against the regulator’s own page that week; to a compliance-minded reader, one wrong date ends the conversation.

What is one new cybersecurity customer worth against the cost of outbound?

Usually more than a year of the program. Annual contract values for security products vary too widely for any single published median to be reliable, so the table below runs the arithmetic at four contract sizes against twelve months of a $1,500 or $3,500 retainer. At a $30,000 annual contract, one closed customer covers a full year of email-only outbound with room to spare.

Annual contract value Customers to cover $18,000 a year Customers to cover $42,000 a year
$15,000 1.2 2.8
$30,000 0.6 1.4
$60,000 0.3 0.7
$120,000 0.15 0.35
Our arithmetic on first-year revenue, not margin or lifetime value. $18,000 and $42,000 are twelve months of the $1,500 Launch and $3,500 Growth retainers. Contract values are illustrative, not a published benchmark.

The constraint is time, not math. Enterprise security deals involve procurement, security review of the vendor itself, and often a proof of concept, so a meeting booked in month one rarely closes inside a quarter. We lay out the realistic sequence from first send to first closed deal in how long outbound takes to work. Judge a security program at 90 days on held meetings with the right titles and opportunities opened, not on signed revenue.

What do cybersecurity lead generation agencies charge?

None of the five we checked publishes a price. Sopro, Callbox, Ironpaper, WebFX and Martal Group all market cybersecurity lead generation, and every one routes pricing to a call or a proposal request. The only cost range in circulation is Martal’s own estimate for cybersecurity marketing agencies of roughly $5,000 to $25,000 or more a month, which covers broader marketing programs, not outbound alone.

Agency Price published on its own site What the page does publish
Sopro None on its cybersecurity page; G2 states pricing is not listed by the vendor 48 cybersecurity businesses served; 346 leads for one client in 12 months
Callbox None; pricing “varies depending on your campaign scope” Company-wide scale claims and review ratings, no cybersecurity-specific terms
Ironpaper None; “Request A Proposal” No price, minimum or contract term
WebFX None on its cybersecurity lead generation page Agency-wide experience and lead volume claims
Martal Group None; “tiered pricing based on your campaign scope and team size” Plans typically include a dedicated SDR and weekly reporting; no term stated
LeadButton $1,500 a month email only, $3,500 a month email plus LinkedIn, Scale custom Monthly billing, no minimum term
Claims limited to what each agency publishes on its own site or a review platform, checked 22 October 2026. Martal’s security lead generation page was published 18 August 2023 and modified 6 April 2026. Martal’s cybersecurity marketing agency roundup, published 10 July 2026 and modified 14 July 2026, is the source of the $5,000 to $25,000 a month range; that is Martal’s estimate, not a price any listed agency publishes.

There is an irony here that a security buyer will notice. The category sells transparency, verifiable controls and evidence over assertion, and the agencies selling into it will not state a monthly fee. Before any first call, ask for the price in writing, the minimum term, who owns the sending domains and inboxes at the end, and how prospect data is stored. A security vendor should hold its outbound partner to the same vendor review it faces from its own customers.

How LeadButton handles this

We build cybersecurity lists around timing rather than firmographics: security leaders new in role, open security headcount, announced platform migrations and AI rollouts, inside the company size and stack your product actually fits. Sequences run the CISO and the director or architect below them as separate threads with separate messages, lead with checkable evidence instead of breach fear, and ask for something the reader can say yes to without a demo. For vendors selling through MSPs, we run the channel list as its own campaign.

Launch is $1,500 a month for fully managed email outreach, including the prospect list, sending infrastructure, domain warming and weekly reporting. Growth is $3,500 a month and adds LinkedIn, which matters in a category where buyers check the sender before they read the email. Scale is custom. Billing is monthly with no minimum term, and the full breakdown is on the LeadButton pricing page.

Sources

Leave a Reply

Back home

Discover more from LeadButton

Subscribe now to keep reading and get access to the full archive.

Continue reading