## 1. Target context summary **Account:** Series A B2B SaaS company in the United States, moving from SMB customers into enterprise accounts. **Buyer:** COO. **Trigger:** The company announced a Series A round and posted a role for its first Head of Security. **Likely business pressure:** Enterprise deals are creating more security questionnaire and audit evidence demands, which are slowing larger sales opportunities. **Relevant offer:** A 30-day SOC 2 readiness sprint to organize controls, evidence owners, and audit preparation workflows. **Assumption before using it:** The company is either pursuing SOC 2 or preparing for enterprise security reviews where SOC 2-style evidence organization would be useful. The prompt does not state that SOC 2 is already required by a customer or auditor. --- ## 2. Best outreach angle tied to the trigger The strongest angle is: **“Your Series A and first Head of Security hire suggest enterprise readiness is becoming operationally important. Before the new security leader inherits scattered evidence requests, we can help organize controls, owners, and audit workflows in a 30-day SOC 2 readiness sprint.”** This connects the trigger to the COO’s likely priority: keeping enterprise sales moving while the company builds its security function. It avoids implying they are failing or behind. It also positions the offer as helpful prep, not a heavy compliance overhaul. --- # 3. Five-email sequence ## Email 1 — Trigger + operational pain **Timing:** Day 1 **Subject:** Series A security readiness **Body:** Hi {{First Name}}, Congrats on the Series A. I saw {{Company}} is also hiring its first Head of Security. That combination usually means enterprise readiness is moving from “important” to “operationally urgent.” For SaaS teams moving upmarket, security questionnaires and audit evidence requests can start slowing larger opportunities before the security function is fully staffed. We help SaaS teams run a **30-day SOC 2 readiness sprint** to organize controls, evidence owners, and audit prep workflows. We’ve helped three SaaS teams organize audit evidence and reduce last-minute compliance work before enterprise reviews. **CTA:** Would it be useful to compare what enterprise-ready evidence ownership could look like before the Head of Security starts? --- ## Email 2 — Head of Security transition angle **Timing:** Day 3 **Subject:** Before your Head of Security starts **Body:** Hi {{First Name}}, Following up because the first Head of Security hire is a key moment. One issue we often see at this stage: the new security leader inherits scattered questionnaire answers, control notes, screenshots, and unclear evidence owners. That creates extra work right when enterprise buyers are asking for faster security review turnaround. Our 30-day SOC 2 readiness sprint is designed to get the basics organized before that handoff: * controls mapped * evidence owners identified * audit prep workflows clarified * enterprise review materials easier to find **CTA:** Open to a short conversation on whether this would help reduce friction in current or upcoming enterprise reviews? --- ## Email 3 — COO business impact angle **Timing:** Day 7 **Subject:** Security reviews slowing deals **Body:** Hi {{First Name}}, For a COO, the compliance issue is not just “security paperwork.” It becomes a revenue operations issue when enterprise security reviews slow down larger opportunities. The usual bottlenecks are practical: * who owns each piece of evidence * where current evidence lives * what still needs to be created * how to avoid last-minute audit prep That is the focus of our 30-day SOC 2 readiness sprint: organizing the work so sales, ops, and security are not scrambling when enterprise requests come in. **CTA:** Would it be worth discussing whether {{Company}} has any evidence gaps that could slow enterprise reviews this quarter? --- ## Email 4 — Practical workflow angle **Timing:** Day 12 **Subject:** Evidence ownership map **Body:** Hi {{First Name}}, A simple way to reduce security review drag is to create an evidence ownership map before requests pile up. For each control or questionnaire area, the team knows: * the owner * the evidence source * the current status * what needs cleanup before audit or customer review That is one of the core outputs of our 30-day SOC 2 readiness sprint. It is not meant to replace your future Head of Security. It is meant to give them a cleaner starting point and help the business respond to enterprise requests with less scrambling. **CTA:** Should I send over a lightweight outline of what the 30-day sprint covers? --- ## Email 5 — Proof + soft close **Timing:** Day 18 **Subject:** Worth a look? **Body:** Hi {{First Name}}, I know this may not be the top priority today. The reason I reached out is that {{Company}} has two signals that usually make security readiness more urgent: 1. moving into enterprise accounts after a Series A 2. hiring the first Head of Security We’ve helped three SaaS teams organize audit evidence and reduce last-minute compliance work before enterprise reviews. No promise that the same approach is right for {{Company}}, but the 30-day sprint may be useful if evidence requests are already slowing larger opportunities. **CTA:** Worth a 15-minute conversation, or better to reconnect after the Head of Security is in seat? --- # 4. Two alternative subject lines 1. **Enterprise security review prep** 2. **Audit evidence before enterprise deals stall** --- # 5. Polite break-up email **Timing:** Day 25 **Subject:** Close the loop? **Body:** Hi {{First Name}}, I’ll close the loop here. I reached out because {{Company}}’s Series A and first Head of Security opening suggest enterprise security readiness may be becoming more important. The specific area we help with is a 30-day SOC 2 readiness sprint: organizing controls, evidence owners, and audit prep workflows so enterprise reviews are less reactive. No worries if this is not a priority right now. **CTA:** Should I leave this alone, or would it be useful to revisit when the Head of Security role is filled? --- # 6. Relevance and spam-risk check ## Relevance check This sequence is relevant because it ties directly to the provided trigger: * **Series A:** suggests growth expectations and a move toward larger customers. * **First Head of Security role:** suggests the company is formalizing security ownership. * **Expansion from SMB to enterprise:** increases the likelihood of more security questionnaires and evidence requests. * **COO buyer:** frames compliance as operational friction and revenue-cycle risk, not just a security task. * **Offer fit:** the 30-day SOC 2 readiness sprint directly addresses controls, evidence owners, and audit prep workflows. ## Spam-risk check The sequence avoids high-risk claims such as: * “We guarantee SOC 2 readiness.” * “We can get you SOC 2 certified in 30 days.” * “Your current process is broken.” * “Your enterprise deals are at risk.” * “We helped companies just like {{Company}} achieve specific metrics.” The copy also avoids invented customer names, unsupported metrics, and exaggerated outcomes. The proof is limited to the provided claim: helping three SaaS teams organize audit evidence and reduce last-minute compliance work before enterprise reviews. ## Suggested personalization guardrails Use only publicly available or provided information: * Series A announcement * Head of Security job opening * company stage * buyer role * enterprise expansion context Do not mention private CRM notes, customer names, sales call details, support tickets, or internal deal information unless the recipient has clearly provided consent or the data is appropriate to use.