Stop waiting for clients to find you

Stop waiting for clients to find you

Nearly every security researcher runs the same playbook: climb the contest leaderboard and wait. That only reaches projects who already know they need an audit. Most of them don't.

If you're a web3 security researcher waiting for clients to come to you, you're competing for the smallest slice of the market.

It's rarely that they can't afford one. Teams that skip an audit don't think they need one yet, or they believe their current version is safe. Meanwhile most auditors sit in the same box, grinding contest platforms and waiting for the leaderboard to send someone their way.

That box only reaches projects who already know they need security and have already been through several audits. Everyone else, which is most of the market, never enters your funnel.

Most protocols never get a real audit. Some skip it entirely. A growing number run the code through an AI pass and treat that as the audit. Neither group is on any contest platform's client list, and neither one is going to find you.

It helps to understand how they're thinking. Most teams treat security as a line in the budget, not as risk sitting on their books. They don't want to be secure, they want to be secure enough, and whatever gets them to enough for the least money wins. That's the whole reason an AI pass looks like a reasonable substitute for an audit.

Which tells you how to price. An offer that speaks to the financial side gets read, because that's the side they're already on. Pay-per-bug lands for exactly this reason: it costs nothing until it finds something, so there's no line in the budget to defend.

There's a second way in. Almost no independent auditor uses it, even though it's how most established security firms actually fill their pipeline.

Two ways to get clients

Within outbound, the channel matters more than people expect. Cold X or LinkedIn DMs are weak in practice. Unless you're already connected, your message lands in a request folder the recipient may never open. Cold email goes straight to the decision maker's inbox with no connection needed. That's the one that works.

Don't pick one. Run both. Inbound builds your reputation over years. Outbound fills your calendar this month.

What outbound actually looks like

A lot of things get tried before people land on this. It's the one that works, and it's simpler than it sounds:

1. Reach out directly to founders, HR, and decision makers. Cold email, not DM.
2. Get them on a call. Don't open with a pitch, open with a question. What security problems are they dealing with right now?
3. Solve it. Most of the time the problem is something any competent researcher can fix. It's rarely as exotic as people assume.

If you sound like you're selling, you've already failed. Focus on care and help, not the sale.

This works in any field, not just web3 security. It comes down to how you talk. The sale follows from being useful. It doesn't lead.

Where the list comes from

"Email the decision maker" assumes you have a list. You don't at first, you build it. Three stages, and there are tools for each one.

1. Source the companies.

DefiLlama (defillama.com) is the obvious place to start. You get protocol names, chains, TVL, and websites, and you can filter for the profile you want: newly listed protocols, small to mid TVL, chains you know well. Those are the ones most likely to have never been audited.

2. Find the decision maker.

Apollo (apollo.io) works two ways. Give it a company name and it returns the people inside, filtered by title: founder, CTO, head of engineering, HR. Or skip the company entirely and search by keyword, like "DeFi" or "web3", which pulls people across the whole space without you having to source the companies first. Apify (apify.com) covers what Apollo misses. Run scrapers against DefiLlama, project sites, team pages, or job boards to pull companies and names in bulk.

3. Get the email.

AnyMailFinder (anymailfinder.com) gets you the decision maker's email from just a website, so you can go straight from a protocol's domain to a person. It also works the other way, from a name plus a company name. Verification is the part that matters either way. Sending to addresses that bounce wrecks your domain reputation, and a burnt sending domain ends the whole operation no matter how good your template is.

Don't only target unaudited projects. Audited ones are worth your time too, and so are the ones running an AI audit, which is now most of them. Plenty of teams treat an AI pass as their main audit and stop there.

An existing report shouldn't stop you either. Protocols with nothing at all are rare, so if you filter for them you're filtering yourself down to almost nobody. What matters is whether you can add something on top of what they already have.

Writing the email

You have a list. Now the email. The formula I use is four moves in a fixed order: personalization, who I am and why I'm writing, why I'm worth trusting, then the offer. Each line buys you the next one.

Personalization goes first because it does the most work. The reader sees you did real research, and that buys you the few seconds you need for the rest. Campaigns without it don't work. It's most of the difference between a 0% and a 2% reply rate.

"Know this is a long shot" does more than it looks. It tells the reader you know you're a stranger in their inbox, which is the one thing a salesperson never admits. Same with "I'm kind of awkward on calls." A bit of friction reads as human. Polished copy reads as a campaign.

Give them two ways to say yes. "Send it over" or "let's chat" is a lower bar than "book a call". Some founders will never take a call with a stranger but will happily read a list of findings, and once they've read real findings on their own contracts the call happens on its own.

The PS tells them to go check you out. Telling someone to verify you is the opposite of what a scammer does, and in a space this full of scams that counts for a lot. It only works if there's something to find, so point at your contest profile, public findings, or GitHub.

Proof has to be real. The dollar figures are the strongest line in the email and the fastest way to ruin yourself if they're inflated. Use TVL you can source, name the firm only if you actually worked with them, and be precise about your role. "I contributed to audits at X" is fine and true. Implying you led them when you didn't is not. Every claim here is checkable on chain and every reputation is public, so one exaggeration ends the pipeline.

The subject line should look like it came from a friend or someone in their family. "{{firstName}}, q" works because nobody in marketing abbreviates "question" down to one letter. It reads like a person typing fast on their phone to someone they already know. "{{firstName}}?" does the same thing. Both sit in the inbox looking like a text message rather than a campaign.

The subject line has exactly one job, which is getting the email opened. Anything that looks like it was written by a marketing team fails at it. Do whatever it takes, even if it feels a bit hacky.

Sign off with a short, casual signature.

What it looks like filled in

Here's one I actually sent, placeholders swapped for the real thing:

Most people stop at a compliment. "Love what you're building" fits any protocol on any chain, so it proves nothing. A number like TVL is better, it shows you opened their page. Best is a detail that points at why you're writing: the line above gives the number, the chain and the missing audit link in one sentence, and everything after it answers a question they're already asking.

Same with the proof line. 3 criticals and 5 highs in a named protocol, which anyone can verify.

Leave the typos in. That email has several, and it still reads as a working auditor who fired off a note between tasks. A version with perfect grammar and a tidy sign-off would read as a template, which is exactly what you're trying not to be.

Don't copy this one

Use the structure, write your own words. If a hundred auditors send the email above, it stops working for all of them.

Then keep changing it. Every 30 emails or so, look at your reply rate and change one thing: the offer, the PS, the first line, the close. Change one at a time or you won't know what moved the number. Play with it. The template isn't something you write once, it's something you keep tuning while the campaign runs.

Cut it as short as you can without losing the value. Every extra letter is working against you. Nobody opens a cold email hoping for paragraphs, and a long one gets skimmed and closed before it reaches your offer.

Follow-ups

Start with two emails total: the offer, then one short reminder that reads like a real person wrote it on their phone. Bullet points help it look shorter. Restate the offer in case they missed the first one. Don't add a third until you've run the campaign for a week and confirmed a reply rate around 2% or better. Every extra follow-up on a campaign that isn't working just raises your odds of getting marked as spam.

Test two sequences at once

Run two versions per segment, each built on a different offer. The time passes either way, so you may as well come out of it knowing which offer your market responds to.

"Write the template yourself, in your own imperfect voice. A human email with bad grammar beats an AI email with perfect grammar every time."

The example above breaks a few writing rules on purpose. A sentence fragment, an admission of awkwardness, an aside in brackets. Those are the signals that tell a reader a human typed it. It isn't that AI writes badly. Prompted well it writes fine. The problem is that after a few years of automated content everywhere, readers have gotten very sensitive to the smell of it, and if your email reads as AI then every hour you spent on the list and the setup is gone in the first two seconds.

Where AI does belong

Everything except the personalization line is a template. The case study, the offer, the close, the PS: you write those once, in your own words, and the only thing that changes between sends is the target's name. That part never touches AI.

The {{personalization}} line is different. You can't research a thousand protocols by hand, and AI is genuinely good at this now. Point it at the protocol and let it write that one line.

The catch is that you have to stop it writing in its own voice. Give it hard rules: one sentence, facts only, no adjectives, no compliments, no "love what you're building", lowercase if that's how you write. Pull the number or the detail from the source, don't editorialize on it. Then read twenty of the outputs before you send anything. If they all open the same way, tighten the rules and run them again.

Sending

Load the sequences into a cold email platform. Instantly (instantly.ai) is the one I'd point you at, since it handles the sending accounts, the warmup, the follow-up timing, and the A/B split between your two sequences, but any of them will do. Whatever you use, check the formatting before you send anything. Strip the HTML, kill the styled fonts, make it look like plain text someone typed.

Send Monday through Saturday, roughly 7am to 7pm in your prospect's timezone, not yours. Web3 teams are spread across every timezone there is, so segment your list by region instead of putting everyone on one schedule.

The one problem everyone hits

Most people won't reply the first time. That isn't a sign the approach is broken, it's how cold outreach works everywhere. You fix it with volume, not with a cleverer opening line.

Think in thousands. Send 1,000 emails before you decide anything about whether this works. Most people send 10, get nothing, and conclude the whole approach is broken. At a 2% reply rate, 10 emails is expected to return zero. You learned nothing except that you didn't send enough.

And 1,000 is on the low side. There are thousands of protocols out there, across every chain, most of them unaudited or audited by a model. The list is not your constraint. Your sending capacity is.

Which is why you have to automate it. Nobody writes 1,000 emails by hand, especially not while doing actual audit work. Put the automation on the infrastructure: list building, enrichment, sending, scheduling, and the personalization line under the rules above. The template stays yours.

The takeaway

The researchers who are busiest right now aren't always the highest ranked. They're the ones who reach out. Most of the field is waiting behind a leaderboard for an already audited minority to notice them, while the rest of the market sits there unaudited and reachable by one direct email.

Try both paths. If you're only doing inbound, you're leaving the larger half of the market untouched.

One last thing: this is a blog post, not a setup guide. Every tool here has its own docs, and AI will walk you through any of them faster than I can in a few paragraphs. You still have to do your own research. What I've tried to give you is the part you won't find written down anywhere else.

—

This started as a Discord post. After it went up a number of auditors DMed asking how the process works, and several set up calls to go through it. Happy to go deeper on templates, call structure, or the automation setup in a follow-up.