Introduction
Everybody sells intent data today. And the most popular signal is this one: "the company is hiring a security engineer, call them, they have a project."
We applied that logic for months with a cybersecurity software vendor we work with. The numbers were bad: over two months, fewer than five meetings came from signals alone, and nearly ten signals were rejected for every one we kept.
Instead of generating more signals, we broke down the ones that were useless. Here is what we learned.
The Hiring Signal: Compelling on Paper, Weak in Practice
The reasoning sounds logical: a company hiring in security is investing in security. In reality, two things break that reasoning.
Large enterprises hire continuously. Above 10,000 employees, one more job posting tells you nothing. Major banks recruit security profiles year-round. Your signal is not detecting a project; it is detecting an HR function running on autopilot.
The role being hired matters more than the hiring itself. A security engineer replacing someone who left is maintenance. A Head of Security or CISO joining is a change in direction. Both surface as the same signal.
Our rule since then: we filter out hiring signals from companies with more than 10,000 employees, and we only keep a hiring signal if it involves a security leadership role.
The Signals That Actually Open Conversations
1. A New CISO or a CISO Changing Roles
This is by far the strongest signal. A new CISO takes stock of the existing setup, questions what is in place, and allocates their first budgets. That is the moment when they are most open to a conversation.
A common mistake: a detection window that is too short. A CISO signs nothing in their first 30 days. We now test a window of six to ten months after the start date, to cover the period when they are building their roadmap.
2. The Content of the Job Posting, Not the Posting Itself
A job posting, read carefully, is a public brief. When a company writes that it is looking for someone to "maintain ISO 27001 certification" or "manage HDS compliance," it is telling you exactly what problem keeps them up at night.
We therefore filter postings on keywords that reveal a pain point: governance, certification, compliance, CISO. The posting is no longer a growth signal; it becomes a direct call argument.
3. Requests for Proposals
Low volume, high intent. An RFP published in your space is a budgeted project with a timeline. A dedicated monitoring setup will not deliver dozens of leads, but the ones it surfaces are worth stopping for.
4. Followers of Your LinkedIn Page: Keep Perspective
On paper, a prospect following your page is a warm lead. In cybersecurity, very few CISOs subscribe to vendor pages. The signal exists, but it is too rare to feed a team.
The CISO Is Non-Negotiable
On this account, one finding reframed everything: no deal was signed without the CISO being involved.
The direct consequence: a signal on an account with no identified CISO is worthless. Yet when we looked at the database, hundreds of targeted accounts had no usable contact, and manual enrichment was taking around twenty minutes per contact.
Before buying another signals tool, make sure you know how to reach the right person at the accounts surfacing. A signal without contact data is information, not an opportunity.
A Few Relevant Leads Beat a Lot of Hiring Leads
The cybersecurity market is not infinite. The volume of truly actionable signals is limited by the size of the market, not by the power of your tool.
That is why we use signals to prioritize, not to fill a pipeline. Accounts with strong signals go to the front of the queue. The rest of the volume comes from calls on targeted lists, with no specific signal, worked with the right pitch.
Our Sorting Framework
| Signal | What It Actually Means | What We Do with It |
|---|---|---|
| Hiring at a company with more than 10,000 employees | Nothing; the company hires continuously | Filtered out |
| Hiring a security engineer | Replacement or operational reinforcement | Low priority |
| New CISO or Head of Security joining | New decision-maker, new roadmap | Maximum priority for six to ten months |
| Job posting mentioning ISO 27001, HDS, governance, certification | A specific, documented problem | Direct call argument |
| RFP in your space | Budgeted project with a deadline | Immediate action |
| Subscription to your LinkedIn page | Possible interest, very low volume | Bonus, not a source |
In Summary
The hiring signal is the most widely sold because it is the easiest to produce, not because it is the most useful. In cybersecurity, what opens a conversation is a new decision-maker, a problem spelled out in writing, or a budgeted project. And none of that matters if you cannot reach the CISO.
If you want to know which signals genuinely deserve your SDRs' attention in your market, let's talk about your situation.
