Playbook · outreach

Outreach — the list, the sequence, the call

100 personalized messages a week, five touches, one CTA. Name the trigger, not the product.

The buyer

A company shipping AI agents or MCP servers, with a real trigger: a security questionnaire, a blocked enterprise deal, a launch, an incident, or an audit. Not “companies interested in AI.”

Where to find them

• The official MCP server registry and awesome-mcp-servers lists.
• Y Combinator and AI-agent startups; the company directory can be filtered.
• Launch posts on Hacker News, Product Hunt, X, and LinkedIn.
• Companies that publish an AI-agent security page or a trust center.
• Your own inbound: anyone who downloaded the verifier or asked for a sample.

The 5-touch sequence

1. Day 1 — the trigger email. Name their blocked deal, offer the sample or the pack.
2. Day 4 — the free proof. “I’ll run a free 20-minute test against your public agent and send what I find.”
3. Day 8 — the public teardown. Share the signed bundle and the verifier you published.
4. Day 14 — the guarantee. “If the bundle doesn’t verify, you don’t pay.”
5. Day 21 — the close or the break-up. “Should I close the file, or is this worth 15 minutes?”

Write it now

The call script

1. “What did they ask you to prove?”
2. “What happens to the deal if you can’t?”
3. “Who signs off on $1,500?”
4. “Can you share the questionnaire and the repo this week?”
5. “I’ll send the sample bundle today. You run the verifier before you pay.”

Follow-up rules

• One CTA per message. Never stack.
• Reply to every reply within two hours.
• Never send a claim you cannot verify.
• Log every send and every reply in the scoreboard.

What not to say

• “We’re the only ones.” You are not; say what is different.
• “We passed the soak.” You did not; say what is true.
• “Unhackable”, “guaranteed safe”, “SOC 2”, “certified”. Never.