Who actually signs
At a manufacturer between two hundred and five thousand people, the signer is the VP of operations or the plant manager if the budget is operational, and the CISO or IT director if there is one and the budget is theirs. The two rarely agree on whose budget it is, which is the first thing to find out. The controls engineer is the person who knows every device on the floor and is either your best ally or the reason the assessment never gets scheduled.
At the smaller end there is no CISO. There is an IT manager who has been told the plant is now their problem, a controls engineer who has been told IT is now their problem, and a plant manager who wants neither of them to touch production.
The one sentence version
Your buyer is a plant or operations leader who has just connected the floor to something, has an IT security vendor who does not know what a controller is, and cannot take the line down to find out what is on the network.
The triggers, and where each one is visible
- Control system advisories. The federal cybersecurity agency publishes industrial control advisories naming vendors, product families and affected versions. A plant running the named controller has the vulnerability whether or not anyone there has read the advisory, and the controller vendors are visible in job posts and integrator case studies.
- Connectivity and modernization announcements. Smart factory, digital twin, cloud analytics, remote monitoring, predictive maintenance. Each one is a press release about connecting operational equipment to networks it was not designed for.
- Incidents in the sector. Ransomware at a manufacturer, a utility or a food processor is public within days, usually with the plant shutdown in the headline. Every peer in the sector reads the story and every board asks the question.
- Cyber insurance renewals. The questionnaire asks about segmentation and operational network monitoring, and the renewal date is on the CFO's calendar. Brokers are a channel, and the date is a trigger.
- OT security and IT OT convergence job posts. A manufacturer advertising for an OT security engineer has a mandate and no one to execute it. The role is rare and the posting stays open for months.
- Regulatory and sector pressure. Water systems are under federal and state programs to assess their systems, pipeline operators have security directives, and the electric sector has monitoring standards arriving. Each program names its population.
- Acquisitions. A new owner of a plant inherits its network and typically wants to know what is on it before integrating.
The advisories and the connectivity announcements are the two to build on. One tells you a specific device in their plant has a specific problem. The other tells you they just made it reachable.
Qualify in sixty seconds
- Is there an operational network with any connection to anything? A truly isolated plant is rare and usually not actually isolated, but a plant with no remote access, no cloud analytics and no vendor connections is a lower priority.
- Is there an in house OT security function? Almost never below a few thousand employees. An IT security team that has not been on the plant floor does not count.
- Is there a regulatory or contractual driver? A sector program, a customer requirement, an insurance question. Any of the three sets the urgency.
- Who owns the budget? Operations or IT. The answer decides who you write to and how, and it is usually findable from who is listed on the modernization announcement.
The angle that gets replies
Lead with a device on their floor and the fact that the assessment will not touch production. The plant manager's fear is not the attacker, it is the consultant who scans the network and stops the line. Address that in the first email and the rest of the conversation is possible.
Three openers you can adapt
- On an advisory naming their controller family"Last week's advisory covers the controller family your integrator's case study shows on the packaging lines, on firmware versions most plants have not moved off. The fix is usually not patching, which nobody does mid run, but making sure the affected units are not reachable from the business network. That is a passive check that touches nothing in production. Happy to send what it involves."
- On a connectivity announcement"Congratulations on the predictive maintenance rollout. Connecting the plant floor to the analytics platform usually means a path from the business network to the controllers exists that did not before, and the first thing to know is what is actually on the operational network, which most plants have never inventoried. A passive inventory runs for two weeks without touching a device. One page on how, attached to nothing."
- On a ransomware incident at a peer"The incident at the plant in the news last week reached the floor through a vendor's remote access account, which is the path in most of these. The question your board will ask is how many vendor connections reach your controllers and who owns each one. Most plants cannot answer it on the day. The answer takes about two weeks to build and does not require downtime."
Each one names a device or a path, promises no downtime, and gives a duration. That is the voice of someone who has been in a control room.
What not to send
- IT security vocabulary. Endpoints, zero trust, SIEM and phishing are words from the office network. Controllers, protocols, segmentation and remote access are the words from the floor.
- "We will scan your network." Active scanning can crash a controller, every plant that has experienced it remembers, and the phrase ends the email.
- Fear built on famous attacks. The plant manager has heard the names. A note that leads with them is a note that has nothing specific to say about their plant.
- "Zero trust for your factory." A slogan from a vendor deck, and the plant manager can tell.
The objection you will hit
Our IT security firm covers it. Ask whether they have been on the plant floor and whether they know what protocols the controllers speak. The IT firm's tools assume they can scan, patch and reboot, and none of those is acceptable on a running line. The priorities are inverted too: IT protects data, operations protects availability. A firm that has not internalized that will recommend things the plant cannot do, and the plant will stop listening.
The second is we are air gapped. Usually believed and rarely true. Vendor remote access, a laptop that moves between networks, a USB drive, a cellular modem an integrator left behind. The passive inventory finds the gap without arguing about it, which is why it is the first engagement.
The third is we cannot take the plant down. Correct, and nothing in the assessment requires it. Passive monitoring, configuration review and interviews with the controls engineer produce the inventory and the risk picture without touching a device. Say that in the first sentence of every conversation.
Deal shape
- Passive asset inventory and risk assessment for one site: commonly $25K to $80K, and the engagement that opens most relationships.
- Segmentation design between business and operational networks: $30K to $100K, with implementation by the plant's integrator or your team.
- Program build to the industrial security standard, including policies, remote access governance and incident response for the floor: $75K to $250K.
- Continuous monitoring retainer: $5K to $20K a month per site, and the reason a client acquired at the assessment stays for years.
- Signer: VP Operations, plant manager, CISO or IT director depending on budget ownership. Cycle: two to six months, and weeks after an incident in the sector.
The passive inventory is the funnel. It requires no downtime, it is priced so a plant manager can approve it from an operational budget, and it produces the first complete list of what is on the floor that the company has ever had, which is the segmentation project.
A cadence you can actually run
- Weekly, pull control system advisories and note the vendor and product families. Match them against plants whose controller vendors are visible in job posts and integrator case studies.
- Weekly, pull connectivity, smart factory and remote monitoring announcements at manufacturers in your sectors.
- Weekly, pull sector incidents and write to the peers, not the victim.
- Monthly, pull OT security job posts and acquisitions of plants.
- Qualify against the four checks, with the budget owner question first. One message per account, naming the device or the path and promising no downtime. Fifteen to twenty accounts a week is a full program.
- Three touches over two weeks, then stop. The next advisory naming their controller is a fresh reason to write.
The advisory names the controller and the press release names the connection. The consultancies that grow are the ones who write the week both are public, with no downtime in the first sentence.
The sending mechanics most people get wrong
Everything above is about who and what. This is about how, and it is where most outbound in this niche quietly dies. Seven rules. None of them are optional.
1.Three to five sentences. That is the whole email.
Your reader is on a phone between meetings. One observable fact about their company, one consequence they have not thought about, one specific thing you would do. Anything past five sentences is a memo, and memos get archived unread.
2.Lead with a technical differentiator that turns into a number.
The messages that work best name something concrete you do differently and translate it into time or money saved. In this niche the differentiator is the passive method. A consultancy that has never caused a production incident during an assessment, and can say how many sites it has inventoried without touching a device, has the number every plant manager is silently asking for. The second is floor time: state how many years your assessors spent as controls or process engineers before they were security people.
Most services firms do not have a technical differentiator, and pretending to have one reads as exactly that. The substitute is a verticalized case study: a company like theirs, what you did, what happened, in one sentence. For this niche the line is: a 600 person food processor, passive inventory of two plants in three weeks with no downtime, 40 percent more devices found than the controls team believed were on the network, eleven vendor remote access paths reduced to two through a single governed gateway, insurance renewal completed with segmentation answered yes. The device count and the path reduction are what the reader will check.
3.Ten to twenty emails a day per mailbox. Not a hundred.
Sender reputation is scored per mailbox and per sending domain. One inbox pushing a hundred cold emails a day looks like exactly what it is, and the penalty lands on the domain, which means it lands on your client correspondence too.
If the math says you need more volume, the answer is more mailboxes on more warmed sending domains, separate from the domain you invoice from. It is never more volume per mailbox. Fifteen to twenty accounts a week at three touches is nine to twelve emails a day, one warmed mailbox. A major advisory on a widely deployed controller family can justify writing to every plant running it that week, which is when the second mailbox is used.
4.Write ten versions of every step and test them.
Versions A through J, not A and B. Rotate subject lines and bodies. You learn which angle is actually working instead of guessing, and there is a second reason that matters more: identical bodies going out over and over is one of the patterns postmaster tools flag. Variation is a deliverability tool as much as a testing one.
Subject line seeds for this niche, each of which should become several variants: "last week's advisory on your controllers", "the predictive maintenance rollout", "the vendor remote access question". Lower case, no punctuation tricks, and nothing that would look odd in a reply from a colleague.
5.Stop at three.
Most replies arrive on the first and second email. The third is already thin. Every touch past that raises the odds the whole thread gets classified as spam, and that classification follows the mailbox to the next person you write to. The long cadence is over. Three touches, each with something new in it, then leave them alone for ninety days.
6.Know what good looks like.
A one percent reply rate with a quarter of those replies positive is a healthy trigger based program. Anyone quoting you double digit reply rates is counting out of office messages or selling a course.
7.LinkedIn Sales Navigator is not optional.
Every other data source tells you who held a title at some point. Sales Navigator tells you who holds it today, because the person maintains it themselves. That is the difference between a three percent bounce rate and a fifteen percent one, and bounces are scored against the mailbox the same way spam complaints are. Verify the name there before anything goes out.
It is also the cheapest trigger detector you will own. The job change filter surfaces people who arrived in a role in the last ninety days, which is the moment they have budget and no incumbent. The posted recently filter surfaces companies talking about the exact problem you solve. Account lists with headcount growth alerts tell you who is scaling before the press release does. For this niche the saved search is headcount 200 to 5,000 in manufacturing, food and beverage, chemicals, water utilities and energy, titles VP Operations, Plant Manager, CISO, IT Director and Controls Engineer, with the job change alert on for the security titles and a keyword alert on OT security, ICS and the names of the major controller vendors across job listings. Navigator confirms the person and often reveals the controller vendor. The advisories, the trade press and the incident reports are the source.
Use it for the research and the verification, not for the message. InMail reply rates are a fraction of email, and the person who replies to a thoughtful email is the same person who ignores a connection request with a pitch attached. Pull the work email from a data provider once Navigator has confirmed the person is real and current.
None of this is specific to your niche. All of it is specific to whether anyone ever reads the angle you spent an hour getting right.
If you would rather not run it yourself
That is what we do. ExpertLayer runs this exact loop for expert led firms: the weekly advisory and announcement pull, the controller vendor matching, the qualification with the budget question first, the angle per account naming the device, the sending across warmed mailboxes, and the reply reading. You take the conversations and run the assessment.
The first step is free and it is the same research described above. Send us your website and we will come back with 10 companies that hit these triggers right now, with the advisory or announcement, the contact, and the opening line for each.
Questions from people running this
Manufacturers or utilities?+
Manufacturers, for a boutique, because the buyer is a plant manager who can sign and the trigger is a connectivity project they announced themselves. Utilities are regulated, procured and slow, and the small ones that most need help have the least budget. Water systems are the exception worth watching, because state programs are funding assessments and the systems have no one to run them.
The government advisories name specific controllers. Is that too technical an opener?+
It is exactly the right level, because it proves you looked at their plant. A plant that runs a named controller family and reads a note that names it, the advisory number and the affected firmware versions is reading a note from someone who has walked a plant floor. The IT security vendors do not know what a controller is.
How do I avoid being lumped in with the IT security firm they already have?+
By never using their vocabulary and by leading with the thing they get wrong: active scanning. An IT security tool pointed at an operational network can crash a controller, and every plant that has had that happen remembers it. A note that opens with passive discovery and no touching of production is a note from a different discipline.
Is cyber insurance really a trigger?+
The renewal questionnaire now asks about segmentation between business and operational networks at most manufacturers, and a no answer changes the premium or the coverage. The renewal date is known to the CFO and the broker, and a note timed to it lands on a desk that has just been asked the question.