Who actually signs
At a hardware, space, drone, semiconductor or defense software startup between ten and two hundred people, the signer is the CEO or COO, and the person who will end up as the company's empowered official under the regulations is usually the COO or general counsel, whether they know it yet or not. There is no compliance department. There is often nobody who has read the regulations.
The champion is whoever just hit the wall: the head of engineering who wants to hire a brilliant candidate on a visa, the business development lead who just got a flow down clause from a prime, or the founder who received a questionnaire from a government customer asking for a registration number the company does not have.
The one sentence version
Your buyer is a technical founder who has just won a government award or is about to hire a foreign national, and who does not know those two facts are related.
The triggers, and where each one is visible
- Government contract and SBIR awards. Department of Defense awards, including SBIR and STTR, are public on SAM.gov and USAspending with the company, agency, amount and date. A first defense award carries flow down clauses that make the company responsible for export control compliance whether or not the prime ever mentions it.
- Job posts requiring US persons. A company posting its first role that says "must be a US person" or names ITAR in the description has just realized it is regulated. Boards are full of these and each one is dated.
- Defense and space funding. Rounds at drone, satellite, autonomy, propulsion and defense software companies fund exactly the engineering that creates controlled technical data. Form D filings and the usual databases surface them.
- Entity List and sanctions changes. Additions to the restricted party lists are published in the Federal Register. Every addition is a supply chain and customer screening event for companies that sell or buy in the affected sector.
- International hiring and expansion. A defense adjacent startup opening an office abroad, or advertising engineering roles in another country, has created a technical data transfer problem it will discover at the first design review.
- Prime contractor relationships announced. A subcontract or teaming agreement with a major prime is a press release, and the prime's flow down requirements arrive with the contract.
The job post is the trigger to build on. It is a company announcing, in its own words, that it has just become aware of the rules. Nobody else is reading job boards for that sentence.
Qualify in sixty seconds
- Is the product or its technical data plausibly on the munitions list or the commerce control list? Space, defense, drones, night vision, encryption, semiconductors, advanced materials. If the answer is obviously no, the conversation is a short one about screening.
- Are there foreign nationals on the engineering team, or is the company hiring them? The team page and the job posts answer this. Yes means a deemed export problem exists today.
- Is there a government contract or a prime relationship? Flow down means the obligation is contractual as well as regulatory, and the prime will audit.
- Does the company ship or share anything abroad? Customers, suppliers, contract manufacturers, cloud regions. A founder who says no usually means physical shipments, and technical data in a shared drive is the answer they have not considered.
The angle that gets replies
Lead with the thing they have not connected. The reader thinks export controls are about shipping boxes to other countries. The angle is that the rules are about information, people and cloud accounts, and their company has all three.
Three openers you can adapt
- On a first US persons job post"Saw the propulsion engineer role went up with the US person requirement. That is usually the week a company discovers the rules apply to it. The next question is whether the existing CAD and test data are stored somewhere a non US person could reach, which is the part most teams have not looked at. Two paragraphs on how we check, attached."
- On a first DoD SBIR award"Congratulations on the Phase I. The award agreement flows down export control obligations that the program office will not explain and the prime will audit. The first decision is jurisdiction, meaning whether the work sits under ITAR or EAR, and it changes everything after it. That determination is about two weeks. Here is what it covers."
- On a space startup hiring abroad"You opened engineering roles in Toronto in August. For a company building what you build, sharing technical data with that team is an export, and it can be done lawfully with the right authorization and a technology control plan. Without them it cannot. Happy to send the outline of the plan."
Each one takes a fact from the reader's own hiring page and connects it to a rule they did not know applied. That connection is the whole value of the first email.
What not to send
- "ITAR certified" or "ITAR compliant software." There is no certification. Companies register and comply. The phrase is the single fastest way to be identified as someone who has not read the regulations.
- Penalty figures in the opener. The penalties are real and large, and every vendor leads with them. The reader has learned to delete on sight.
- Assuming everything is ITAR. Most of what startups build is EAR, and a note that treats a commercial drone company as a munitions manufacturer reads as uninformed.
- "We help companies navigate complex export regulations." Every firm in the space says exactly this sentence. It contains no information about the reader.
The objection you will hit
We are not exporting anything. This is the objection in nearly every first conversation, and it is wrong in a specific, checkable way. Sharing controlled technical data with a non US person inside the United States is an export. Storing it in a cloud region abroad is an export. Emailing a drawing to a supplier overseas is an export. The founder who says the company does not export usually has all three happening this week.
The second is our prime handles it. The prime handles its own compliance and flows the obligation down by contract. The subcontractor holds the obligation, and the prime's audit will be the first time the subcontractor finds out what that means.
The third is we will just not hire foreign nationals. Fine, until the best candidate for a critical role is not a US person, which happens at every hardware startup eventually. And the EAR rules apply to the rest of the business regardless. A technology control plan lets the company hire the person. Refusing to hire is the expensive option.
Deal shape
- Jurisdiction and classification determination: commonly $5K to $20K. Small, fast, and the engagement every other one depends on.
- Compliance program build, including registration, policies, screening and training: $25K to $75K.
- Technology control plan for foreign national employees: $10K to $25K, and often the engagement that gets a stalled hire unblocked.
- License and authorization applications: $5K to $15K each.
- Voluntary self disclosure support after a violation: $50K to $200K, closing in days.
- Ongoing advisory retainer: $3K to $8K a month for screening, classification of new products and training refreshes.
- Signer: CEO or COO. Cycle: three to ten weeks, and days after a violation or a blocked hire.
The classification engagement is the whole funnel. It is small enough that a founder signs it without a committee, and it produces a written finding that says exactly what the company now has to do, which is the program build.
A cadence you can actually run
- Weekly, pull new DoD and DoD adjacent awards on SAM.gov and USAspending, filtered to companies under two hundred people.
- Weekly, pull job posts containing US person requirements or ITAR at companies with no visible compliance function.
- Weekly, pull defense, space, drone and semiconductor funding, and check each company's careers page for international roles.
- Monthly, review restricted party list additions for sectors your clients sell into.
- Qualify against the four checks. One message per account, connecting their own hiring or award to the rule they have not seen. Fifteen to twenty accounts a week is a full program.
- Three touches over two weeks, then stop. The next award or the next international hire is a fresh reason to write.
The company announces it is regulated on its own careers page. The consultants who grow are the ones reading that page the week it changes.
The sending mechanics most people get wrong
Everything above is about who and what. This is about how, and it is where most outbound in this niche quietly dies. Seven rules. None of them are optional.
1.Three to five sentences. That is the whole email.
Your reader is on a phone between meetings. One observable fact about their company, one consequence they have not thought about, one specific thing you would do. Anything past five sentences is a memo, and memos get archived unread.
2.Lead with a technical differentiator that turns into a number.
The messages that work best name something concrete you do differently and translate it into time or money saved. In this niche the differentiator is jurisdiction work. A consultant who has made classification determinations in the client's specific product category, and can say how many, has a credential that the general trade compliance firms cannot claim. The second is the technology control plan: state how many foreign national hires you have unblocked and how long the plan took.
Most services firms do not have a technical differentiator, and pretending to have one reads as exactly that. The substitute is a verticalized case study: a company like theirs, what you did, what happened, in one sentence. For this niche the line is: a 30 person satellite components startup, first DoD SBIR in March, classified as EAR rather than ITAR in two weeks, technology control plan in place by May, two engineers hired on visas that quarter who would otherwise have been declined. The jurisdiction outcome and the hire count are what the reader will check.
3.Ten to twenty emails a day per mailbox. Not a hundred.
Sender reputation is scored per mailbox and per sending domain. One inbox pushing a hundred cold emails a day looks like exactly what it is, and the penalty lands on the domain, which means it lands on your client correspondence too.
If the math says you need more volume, the answer is more mailboxes on more warmed sending domains, separate from the domain you invoice from. It is never more volume per mailbox. Fifteen to twenty accounts a week at three touches is nine to twelve emails a day, one warmed mailbox. This niche runs steadily rather than in spikes, so a second mailbox is rarely needed.
4.Write ten versions of every step and test them.
Versions A through J, not A and B. Rotate subject lines and bodies. You learn which angle is actually working instead of guessing, and there is a second reason that matters more: identical bodies going out over and over is one of the patterns postmaster tools flag. Variation is a deliverability tool as much as a testing one.
Subject line seeds for this niche, each of which should become several variants: "the US person role", "your Phase I", "the Toronto roles". Lower case, no punctuation tricks, and nothing that would look odd in a reply from a colleague.
5.Stop at three.
Most replies arrive on the first and second email. The third is already thin. Every touch past that raises the odds the whole thread gets classified as spam, and that classification follows the mailbox to the next person you write to. The long cadence is over. Three touches, each with something new in it, then leave them alone for ninety days.
6.Know what good looks like.
A one percent reply rate with a quarter of those replies positive is a healthy trigger based program. Anyone quoting you double digit reply rates is counting out of office messages or selling a course.
7.LinkedIn Sales Navigator is not optional.
Every other data source tells you who held a title at some point. Sales Navigator tells you who holds it today, because the person maintains it themselves. That is the difference between a three percent bounce rate and a fifteen percent one, and bounces are scored against the mailbox the same way spam complaints are. Verify the name there before anything goes out.
It is also the cheapest trigger detector you will own. The job change filter surfaces people who arrived in a role in the last ninety days, which is the moment they have budget and no incumbent. The posted recently filter surfaces companies talking about the exact problem you solve. Account lists with headcount growth alerts tell you who is scaling before the press release does. For this niche the saved search is headcount 10 to 200 in aerospace, defense, drones, space, semiconductors and advanced materials, titles CEO, COO, General Counsel, VP Engineering and Head of People, with a keyword alert on ITAR and US person across job listings and posts. The job listing alert is the trigger itself. SAM.gov and USAspending supply the awards.
Use it for the research and the verification, not for the message. InMail reply rates are a fraction of email, and the person who replies to a thoughtful email is the same person who ignores a connection request with a pitch attached. Pull the work email from a data provider once Navigator has confirmed the person is real and current.
None of this is specific to your niche. All of it is specific to whether anyone ever reads the angle you spent an hour getting right.
If you would rather not run it yourself
That is what we do. ExpertLayer runs this exact loop for expert led firms: the weekly award and job post pull, the qualification, the angle per account connecting their own hiring to the rule, the sending across warmed mailboxes, and the reply reading. You take the conversations and do the classification and program work.
The first step is free and it is the same research described above. Send us your website and we will come back with 10 companies that hit these triggers right now, with the award or posting, the contact, and the opening line for each.
Questions from people running this
Most of my prospects insist they do not export anything. How do I get past that?+
By not arguing about the word export. Ask instead whether anyone on the engineering team is not a US person, and whether the CAD files live in a cloud account that anyone outside the country could reach. Both are exports under the rules, and the founder who says no to the first question almost never says no to the second.
ITAR or EAR first?+
Jurisdiction first, which is the classification engagement, and it is the right opener because it is small, fast, and settles which regime the company is actually in. Half the companies that believe they are ITAR are EAR, and a meaningful number that believe they are unregulated are on the munitions list.
Should I sell the cyber requirements alongside export controls?+
As a second conversation. The defense contractor cyber certification program is real and current, but it is a different buyer inside the company and a different kind of work. Mention that you can introduce someone if it comes up. Do not lead with it to a founder who has not classified their product yet.
Is a company with a voluntary self disclosure a good client?+
The best client you will have that year and the most demanding. The work is urgent, the budget exists because the alternative is worse, and the company will need you for the remediation program after the disclosure. Price it as the emergency it is.