Industry · Enterprise software

Cold email agency for enterprise software

GrowthPal runs outbound for enterprise software companies selling into a small, named universe of accounts. Lists are built account by account from filings, tender portals and org research rather than from a database filter. The usual fit bar is past 3M in ARR, an offer people already buy, a team ready to take calls, and roughly 30,000 reachable contacts. Many enterprise sellers sit below that last number, which changes the program and sometimes rules it out.

The buyer

Who you are really selling to

Role	What they care about	Where they pay attention	Best channel
The champion: a director or senior manager who owns the problem daily	Being right in front of their own executive. They write the business case, carry the deal internally, and absorb the political cost of being wrong about a vendor.	Anything that makes them look prepared in a meeting they have already been asked to lead.	Usually the right first recipient for cold email, ahead of the CIO. More pain, more time, more reason to answer a specific question about their own program.
The economic buyer: CIO, CTO, Chief Digital Officer or a line of business executive with budget	Whether this fits a program already funded and already named internally, total cost of ownership across a long horizon, and whether the vendor still exists at renewal.	Analyst reports, peer executives at comparable companies, conferences where they speak, and their own systems integrator.	Email that references a program they described publicly in an annual report, an earnings call or a conference talk. They forward more often than they reply, so write the first email to be forwardable.
The technical evaluator: enterprise architect or head of platform engineering	Fit with the existing reference architecture, what the product needs from identity, data and network, the migration path off the incumbent, and whether claims survive a real environment.	Documentation, architecture diagrams, standards bodies, and their own backlog.	Short and technical, with no adjectives. They read the docs before replying, so the docs are part of the email.
Security and third-party risk: CISO, head of vendor risk, TPRM analyst	Whether a vendor can complete an assessment without the deal stalling. Their work is a gate, not an opinion. They buy nothing and can stop everything.	Assessment frameworks, public registries, and whatever the vendor has already published.	Not a cold email target first. The move is to make this person's job easy before they are asked, so the champion can hand over the security questionnaire answers without a round trip.
Procurement, sourcing or category manager	Whether the purchase can be made at all under the organization's rules, whether a competitive process is required, whether an existing contract vehicle can be used, and supplier onboarding.	Policy, thresholds, the incumbent renewal date, and their own tender portal.	Rarely a cold recipient, but their constraints shape the first ask. Asking for a demo while a tender is already live is the wrong ask at the wrong moment.

Constraints

What makes outbound different here

The market is smaller than the test

A standard outbound program learns by sending one angle to thousands of people and retiring the losers. Against a few hundred accounts, the distance between a good angle and a lucky one is a handful of replies and cannot be told apart from noise. There is no honest way to call a winner from that sample, and anyone who offers one is selling.

What it decides: The size and pace of the first wave, and what counts as learning. The first wave is deliberately small, sent slowly enough that every reply is read individually. The reported output is which problem framing people recognize, the vocabulary they use for it, and which role answered first, not a winning variant with a confidence interval.

One contact per account is a wasted account

The buying committee spans a champion, an economic buyer, a technical evaluator, security and sourcing. If you email one person and hear nothing, you have not learned that the account is uninterested. You have learned that one person did not reply. A single-threaded deal also dies when that person changes job, which over a multi-quarter cycle is likely.

What it decides: The list schema and the send calendar. Every account carries two to four named roles with a dated source for each, and an account with one name is not ready to send. Each role gets different content aimed at what they own, spaced across weeks. Three near-identical emails landing in three colleagues' inboxes on the same morning is the fastest way to be discussed as a nuisance.

Security review is a gate operated by someone with no reason to hurry

An enterprise vendor assessment asks for a completed questionnaire, independent audit evidence, architecture and data flow documentation, and answers about your own suppliers. The Shared Assessments SIG is the common commercial questionnaire. The Cloud Security Alliance CAIQ is the open equivalent, submitted against the Cloud Controls Matrix, and submitted CAIQs become publicly available in the CSA STAR Registry. Higher education uses HECVAT. Public sector buyers in the US expect an Accessibility Conformance Report: Section508.gov recommends vendors generate one for any ICT marketed to the federal government and make it easy to find on their website. NIST SP 800-161 Rev. 1 is why the questions reach past you to your suppliers.

What it decides: What has to exist before week one, not what goes in the email. None of this belongs in cold copy. All of it belongs in the folder behind it, as links a champion can forward. The most common stall in this market is a champion who cannot answer their own security team.

Procurement sets the date, not the buyer

A large organization may be unable to buy without a competitive process, or may only be able to buy through a framework or an existing contract vehicle. The close date is usually tied to the incumbent contract's end and a budget cycle. By the time a tender is published, the requirement has normally been shaped by whoever was talking to the buyer months earlier.

What it decides: Which signals are worth building a list on, and what the first ask is. Tender portals get read backwards for award notices, incumbents and re-compete windows rather than forwards for live opportunities. The ask is sized to the stage: a question answerable in one line, a specific document, or an introduction to the colleague who writes the requirement.

You will be writing to these same people for years

With a large reachable market you can be wrong, rebuild and move on. Here the same person sees your next three campaigns over two years, and a bad first email is spent against the only market you will ever have.

What it decides: The quality bar and the retry rules. Tolerance for a mediocre email drops to zero, every account gets a written record of what was sent and when, and an account that said no gets a documented cooling period rather than a quiet re-add to the next campaign.

Signals

Buying triggers, and the angle each one earns

Trigger	How we find it	The angle it earns	Proof the email needs
A named initiative in a filing or on an earnings call	SEC EDGAR, which is free, public and full-text searchable, for the 10-K business description, risk factors and management's discussion. For non-US and unlisted groups, the investor relations site that hosts the annual report and the earnings webcast replay.	They have publicly committed to the outcome you sell, and named the program themselves.	The quarter, the speaker and the phrase, quoted accurately and without flattery.
An executive appointment into a role that owns your problem	Form 8-K Item 5.02 on EDGAR, which covers officer departures and appointments with a date attached, the annual DEF 14A proxy statement naming executive officers, and the company's own leadership page against an archived version.	A new executive reopens inherited systems and inherited vendors, and is the one person with permission to change a decade-old decision.	The person, the date, and what they built or changed at their previous employer.
A contract award notice revealing the incumbent and the term	Find a Tender and Contracts Finder in the UK, TED for the EU, SAM.gov and USAspending.gov in the US, plus state, municipal and public university procurement portals. Find a Tender's contracts search covers awarded agreements, active and expired.	The re-compete window, worked backwards from the stated term. For many accounts that window is the only moment they are reachable at all.	The incumbent, the term and the implied re-compete date, put as a question rather than an assertion.
The incumbent announces an end of support date or a forced migration	The incumbent vendor's own product lifecycle page, support policy page and release notes, all published and dated, plus partner and user group announcements.	The account has to do something by a date it did not choose, which is the cheapest reason a large organization ever has to look at an alternative.	The lifecycle date, cited from the incumbent's own page.
An acquisition or divestiture that forces systems integration	Form 8-K Item 2.01, completion of acquisition or disposition of assets, merger announcements, and the integration language in the following earnings call.	Two companies now run two of the same system, and someone has an integration deadline set by the deal rather than by IT.	The transaction, the close date, and which two systems now overlap.
A disclosed material weakness or control deficiency	Item 9A of the 10-K, internal control over financial reporting, with the auditor's attestation.	A control problem that reached a filing has an owner, a remediation plan and a deadline. If remediation needs software, the decision is already being made.	The filing and the fiscal year, handled with restraint. This is an embarrassing disclosure and the email must not read as if you enjoyed finding it.
A disclosed cybersecurity incident at the incumbent vendor	Form 8-K Item 1.05, added by the SEC's 2023 cybersecurity disclosure rules and effective from December 2023, plus the vendor's own incident page.	An incident at the incumbent reopens a vendor decision that had been closed. An incident at the account itself does not make them want a new vendor, so this trigger points at the incumbent.	The filing or the incumbent's own published statement. Never speculate, and never sell fear.
A security, accessibility or authorization status appears or changes	The CSA STAR Registry, which is publicly accessible and carries Level 1 self-assessments and Level 2 third-party audits, the FedRAMP Marketplace, and Accessibility Conformance Reports published on vendor sites.	On your own side, a new status opens accounts whose procurement rules previously excluded you. On the incumbent's side, a gap is the lever a champion uses internally.	The registry entry and its date.

Peek inside

Example angles we would test

Examples of angles to race in this market, not results. Each one is a hypothesis with its proof assembled before a single send.

You named a consolidation program on your last earnings call, and the systems you listed do not talk to each other yet.

Proof it needs: The quarter, the speaker and the exact phrase from the transcript or the annual report.
The ask: Who owns the integration piece of that program.

Your incumbent published an end of support date, so you have a migration to run whether or not you change vendor.

Proof it needs: The incumbent's own product lifecycle page, with the date.
The ask: Whether the migration is a lift and shift or a reconsideration.

A contract you awarded is coming up for re-compete, and the requirement was written around a product that has changed since.

Proof it needs: The contract award notice from the portal it was published on, with the stated term.
The ask: When the requirement gets rewritten, and who writes it.

You closed an acquisition and now run two of the same system inside one company.

Proof it needs: The Form 8-K Item 2.01 filing and the close date.
The ask: Who carries the integration deadline.

A new CIO arrived and inherited a decision nobody has reopened in a decade.

Proof it needs: The Item 5.02 filing or the appointment announcement, plus what they changed at their last employer.
The ask: What is on the first hundred day list.

You are hiring for a role that exists only because the current system cannot do something.

Proof it needs: The job posting, quoted, naming the system it asks the hire to operate.
The ask: Whether the plan is to hire around the gap or to replace it.

Your disclosed remediation plan has a deadline and nothing tooled behind it yet.

Proof it needs: The Item 9A disclosure in the annual filing.
The ask: What the remediation depends on.

Your incumbent disclosed an incident, so your security team has to re-review them anyway.

Proof it needs: The incumbent's own disclosure or filing, never an inference.
The ask: Whether the re-review is a formality or an opening.

Evaluations keep stalling at the security questionnaire rather than at the product.

Proof it needs: Nothing public. Used only where a prior conversation exists, never as a cold opener.
The ask: What the assessment asked for that stopped it last time.

Nobody outside the current shortlist ever gets to shape the requirement for this category.

Proof it needs: The pattern across that buyer's past notices on the portal, read as a sequence.
The ask: Who to talk to before the next requirement is written.

The list

How the list gets built in this market

There is no list to buy here. The universe is small, largely known, and assembled by hand: account selection first, then org mapping, then verification. If a database returns forty thousand rows for a market with six hundred real buyers, the filter is wrong, not the market.

Public financial and corporate disclosure

SEC EDGAR, free and public, holding millions of filings with full text search. The 10-K for the business description, risk factors and management's discussion. The DEF 14A for named executive officers. The 8-K for dated events.
Investor relations sites for annual reports and earnings webcast replays, including non-US and unlisted groups that publish voluntarily.
National company registries, such as Companies House in the UK, to confirm the legal entity behind a trading name before a cold email goes out.
Industry regulator registers and license lists, which in a licensed market are often the only complete census of the industry that exists.

Procurement and tender data

Find a Tender, which replaced TED in the UK on 31 December 2020, publishing above threshold notices across the UK outside Scotland and, for procurements started from 24 February 2025, below threshold notices too. Notice search works without signing in.
Contracts Finder, for contracts with UK government and its agencies, with higher value contracts going to Find a Tender and separate portals in Scotland, Wales and Northern Ireland.
TED for EU-wide notices.
SAM.gov for US federal contracting opportunities and entity information, and USAspending.gov for award history.
State, municipal, school district and public university procurement portals, frequently the richest source of incumbent and renewal data for a single software category.

Org mapping for the buying committee

Leadership and team pages, with archived versions used to establish tenure.
Conference speaker rosters and session abstracts, which name the exact person who owns a program at director level, where filings stop.
User group and partner community pages for the incumbent product, which name the people who administer it.
Published customer stories on the incumbent vendor's own site, which name the account, the system and sometimes the executive quoted.
Patent assignee and inventor data, for engineering organizations.
LinkedIn for role and tenure verification by hand. LinkedIn prohibits scrapers, bots and automation extensions under its User Agreement and warns that accounts using them may be restricted, so it is a place to read, never a place to harvest.

Incumbent and technology signals

Integration and partner directories of the systems of record the account already runs, which list certified partners and sometimes named customers.
The incumbent vendor's product lifecycle and support policy pages, for forced migration dates.
Cloud marketplace listings, which show how a vendor expects to be bought.
The account's own job postings, which name the systems a role must operate more precisely than most databases do.
The CSA STAR Registry and the FedRAMP Marketplace, for the assurance posture of both your prospects and their incumbents.

How a row gets verified

Account qualification: does this account have the problem, at a size where the product is the right shape. On a market of a few hundred, an unqualified row is not noise, it is a measurable share of everything you have.
Committee completeness: at least two and preferably three named roles per account, each with a dated source for the role. An account with one name goes back rather than out.
Trigger currency: the signal is dated and younger than the buying cycle. For a named program, the window is the program's own timeline, not the filing date.
Technical deliverability: syntax, domain MX record, catch-all detection and a verification pass. Large enterprise mail estates are often catch-all, so a separate and slower segment is the norm here rather than the exception.
Suppression and conflict: existing customers, prior opt-outs, do-not-contact entries, accounts already owned by your named-account reps, and any account where contact during a live procurement would break the buyer's own rules.

What makes a bad list here

Any filter that returns more rows than the market actually contains. The count itself is the tell.
Industry code plus a headcount band, which in this market returns mostly subsidiaries, holding entities and shared service centers rather than the organization that buys.
One contact per account, which cannot survive a job change and teaches you nothing when it goes quiet.
Role catch-alls such as info@ and procurement@, which in a large organization route to a shared service desk that forwards nothing.
A list of job titles with no account thesis behind it.
Accounts whose incumbent contract was awarded recently, where no amount of good writing changes the answer for years.
Rows pulled from a conference attendee list with no evidence the person still holds the role.
Any account where contacting a named person during a live tender would breach the buyer's published rules on supplier contact.

The actual document

A targeting brief for enterprise software, in full

GrowthPal fills in the document below before a single row is built, and publishes it whole rather than as a screenshot, because the shape of it is the argument. In a market of a few hundred accounts, the brief is most of the work.

Field	What goes in it
The universe, counted	How many accounts exist in the world for this product, written as a number with the reasoning behind it. Everything else on this page changes depending on whether that number is three hundred or thirty thousand.
Account thesis	Why this specific account has the problem, at a size where the product is the right shape. One or two sentences that could not be written about the account next to it.
Trigger and source URL	The dated event that earns the email, with the public page it was read from: the earnings call phrase, the Item 5.02 filing, the contract award notice, the incumbent's end of support date.
Incumbent and renewal position	Who they bought last time, when the term ends, and the implied re-compete window. An account that just signed a long term goes into a dated watch list, not into this campaign.
Committee map	Two to four named roles with a dated source each: the champion who owns the problem, the economic buyer, the technical evaluator, and where relevant the sourcing manager. One name is not a map.
Thread plan	What each role receives, in what order, and how many days apart. Different content per role. Never the same email with the name changed, because they talk to each other.
Procurement constraint	Whether a competitive process is required, whether a framework or existing contract vehicle applies, and whether a published notice restricts supplier contact while it is live.
Assessment readiness	Which artifacts a champion can be handed today: the completed questionnaire, audit evidence, data flow documentation, the Accessibility Conformance Report. Listed as links, because a gap here stalls the deal later.
The first ask	Smaller than a demo. A question answerable in one line, a specific document, or an introduction to the person who writes the requirement.
What would tell us this is wrong	Written down before sending, and written per segment rather than per message, because the sample is too small to retire an angle on reply counts. A hypothesis with no failure condition teaches you nothing.

We publish the brief rather than a dashboard screenshot because a screenshot proves a number and a brief proves a method. In this market there is no number big enough to prove anything, which makes the method the only honest thing to show.

Process

How the engagement runs

Three stages and nine steps, the same ones in every market: build the list from public sources, race message angles against it, scale the one that wins. The nine steps from kickoff to booked meetings are written out in full.

What changes for this market

Week one is account selection, not list building. We agree the universe in writing: how many accounts exist, which are already owned by your reps, which are in an active procurement where contact is restricted, and which are out because their incumbent contract was awarded too recently. On a market this size that document is short enough to read in a meeting and important enough to argue about.
The same week we check the folder behind the campaign: the completed security questionnaire, the audit evidence, the architecture and data flow documentation, and an Accessibility Conformance Report where you sell to public bodies. If those do not exist, we say so before sending rather than after a champion asks for them.
List building is org mapping by hand. Every account carries two to four named roles with a dated public source for each, plus the trigger and the URL it was read from. An account with one name does not ship. Rows come from filings, investor relations sites, tender portals, conference rosters and the incumbent's own customer pages, not from a database filter.
The send calendar is paced against the committee and the procurement cycle rather than against weekly volume. Roles on the same account are reached days apart with different content, never the same email with the name changed. The first ask is answerable in one line, and sequences stay short because this market remembers everything you send it.

Proof

What GrowthPal has published

GrowthPal takes on outbound engagements in this market, and the method above is the one it runs here. The published record below is the whole company record, across every client.

What was published	What the figure counts	Source
A study of 412 campaigns across 47 companies over 18 months: campaigns scoring above 0.7 on the composite message-market fit score averaged an 11.4 percent reply rate, against 1.1 percent for campaigns below 0.3. Volume, warm-up and time of day explained less than 8 percent of the variance.	Total reply rate, measured against messages in those campaigns. This is a different measure from interested replies per contact and the two must never be compared on the same page.	Read it
4M+ cold emails sent for 40+ B2B companies	Emails sent, cumulative across all clients. Not one campaign.	Read it

How these are counted

An interested reply means a human reply expressing interest in continuing the conversation. Out-of-office messages, unsubscribes, referrals to someone else and automated responses are not counted. A figure measured against contacts reached and a figure measured against emails sent are different measures: the column above says which each one is, and we do not convert between them or add them together.

The full counting method, and what an interested reply is.

On an industry-specific result. GrowthPal has published no client outcome in enterprise software, and a market this size would not produce a publishable rate anyway, so this page offers the method instead: how accounts get selected, which public sources the committee is mapped from, and the angles we would test first.

Honestly

Who this is not for

A market far below the fit bar, where an agency adds a layer and nothing else. The bar is roughly 30,000 reachable contacts, and plenty of enterprise sellers have a few hundred accounts. If that is you, and your own people already have relationships at most of them, the right answer is a named-account motion run in-house, with research support at most. We will say so on the call rather than sell you a program. Outbound built for a market this size is a research operation with an email channel attached, and if you already have the relationships, you already have the harder half.
You want a message validated statistically. Against a few hundred accounts, the difference between a good angle and a lucky one is a handful of replies. No test design fixes that. If your board wants a reply rate with a confidence interval before committing, this market cannot give you one, and the program will disappoint whatever it produces.
You want volume rather than a program. If the thing being bought is more sends per week, a tool does that cheaper, and here it would spend your entire market in a fortnight. The work that moves results is account selection, org mapping, and sequencing touches against the committee and the procurement calendar.
The security and legal artifacts do not exist yet. If there is no completed questionnaire, no audit evidence and no data flow documentation to hand a champion, deals will stall at the security review regardless of how good the outreach is. Build that folder first. Outbound that creates interest you cannot survive a vendor assessment with is worse than no outbound.
No one ready to take the calls. Replies arrive within days of the first sends, and in this market the first reply is often a technical evaluator with a precise question. If nobody owns the follow-up inside a day, the interest goes cold, and you cannot simply email the next five thousand people instead.

Questions

Answered straight

Our total market is about four hundred accounts. You ask for 30,000 contacts. Why are we talking?

Because the bar describes the standard program, and the standard program is not what a four hundred account market needs. The bar exists because testing needs volume to separate a message that works from one that got lucky. At this size there is no honest test, so the work changes shape: fewer accounts, far more research per account, several roles on each, and learning read from what people actually say. If you already have relationships at most of those accounts, we will tell you to run it in-house.

Can you test a message against a market this small?

Not statistically. What is possible is a structured first wave: a small set of accounts, two or three angles each tied to a different public trigger, sent slowly enough that every reply gets read individually. The output is not a winning variant with a confidence interval. It is a clearer picture of which problem framing people recognize, the vocabulary they use for it, and which role on the committee answers first. That is useful, and it is a different claim.

Why is one contact per account not enough?

The person who replies almost never signs, and the person who signs rarely replies to anyone. A single-threaded deal also dies when that one person moves, which over a multi-quarter cycle is likely. Multi-threading means two to four named roles per account, each getting different content aimed at what they own, spaced across weeks. The same email sent to three colleagues on the same morning gets forwarded with a sarcastic comment attached, and that account is then closed to you.

Does cold email help at all when procurement controls the timeline?

It does not shorten procurement. It changes where you are standing when procurement starts. The requirement in a published tender was usually shaped months earlier by whoever was in the room. Outbound here is about being in that earlier conversation, which is why the signals worth building on are contract end dates, named programs and executive appointments rather than anything about this week.

Should we respond to the RFPs we find on tender portals?

Usually not cold. A specification you had no part in shaping is often written around an incumbent, and responding costs real time. The portals are more valuable read backwards: a contract award notice names the incumbent and the term, which implies the re-compete window, which tells you when a conversation is worth starting. Treat them as a targeting input and a dated map of who buys what, not as a pipeline source.

Will the security review kill this before we get anywhere?

It kills deals where the champion cannot answer their own security team. The fix sits before the campaign: have the completed questionnaire, the audit evidence, the architecture and data flow documentation and, if you sell to public bodies, an Accessibility Conformance Report ready as links. The Shared Assessments SIG, the CSA CAIQ published in the STAR Registry and HECVAT in higher education exist so you answer once and reuse it. None of it goes in a cold email. All of it sits in the folder behind it.

Why do you not use funding announcements as a trigger here?

Your buyers are not funded, they are budgeted. A large manufacturer, a bank or a public agency does not raise rounds, and a round at a smaller target says almost nothing about whether the specific program you sell into got approved. The events that matter are disclosure events and procurement events: a named initiative on an earnings call, an officer appointment under Item 5.02, an acquisition, a contract award notice with an end date, a disclosed material weakness. Our SaaS page covers funding triggers, where they do work.

With only a few hundred accounts, what counts as progress?

First sends land two to four weeks after kickoff, once the infrastructure is warmed. In a normal market a winning message is usually identified by week eight. Here, week eight gives you conversation quality and a read on whether the account selection was right, not a validated message. The early number worth watching is the share of selected accounts where you reached a second role on the committee, because that predicts a deal in this market and it is measurable at this size.