13 Lead Generation Strategies Built for Cybersecurity Companies

79% of CISOs say peer recommendations are the most trusted source when evaluating security vendors.

That single number should change how you think about lead generation in cybersecurity.

It means the vendor discovery process doesn’t start on Google. It doesn’t start in your email sequence or at your RSA booth. It starts in an FS-ISAC member forum, a CISO roundtable Slack group, or a hallway conversation at Black Hat — before any RFP is written, before any formal evaluation begins. The best lead generation system in cybersecurity isn’t a cold email sequence. It’s being the company that gets mentioned when one CISO asks another who to call.

Most cybersecurity vendors haven’t built that system. They’re running generic B2B playbooks — ABM lists with no signal layer, LinkedIn sequences that don’t demonstrate any real context, cold email volume that CISOs filter in under two seconds. And they wonder why their pipeline is thin despite a market that’s growing from $213B in 2025 to a projected $244B in 2026.

The truth is: cybersecurity lead generation has specific mechanics that most sales teams ignore. CISOs allocate only 10-20% of their time to vendor interactions. That’s the entire window. Generic outbound volume doesn’t fit through it. But a compliance deadline they haven’t solved, a breach that just hit a company they know, or a peer mentioning your name at a conference? That fits. That converts.

Here are 13 strategies built for how cybersecurity companies actually sell — not generic B2B with “SIEM” swapped in.

In This Guide

What makes lead generation different for cybersecurity companies?

Cybersecurity buyers are among the most peer-driven, skepticism-hardened buyers in B2B. They’ve seen hundreds of vendors claim to solve the same problem. They’ve been burned by POCs that didn’t convert to production, by SLAs that looked great on paper and collapsed under real threat load, by vendors who disappeared after the contract was signed.

Trust is the primary purchase filter. And trust is built through community — through peer recommendations, Gartner Peer Insights reviews, ISAC working group contributions, and conference conversations — long before your first sales call.

43% of enterprise cybersecurity purchases involve six or more stakeholders. At companies over 1,000 employees, that jumps to 60%+ with six or more stakeholders in the decision, and nearly 30% report ten or more (ActualTech Media Cybersecurity Buyers Survey 2024). 58% of cybersecurity purchases take three or more months from initial evaluation to contract signature.

If you’re treating the CISO as the only contact, you’ve already lost most of those deals.

The buying committee looks like this:

Two roles that rarely get invited but kill deals quietly: SOC analysts and threat hunters (they’ll live in the tool daily; if they’ve used the competitor’s platform and prefer it, the CISO often defers) and cloud and DevSecOps engineers (for CNAPP and cloud security categories, strong informal influence on the final call).

Nearly 15% of corporate cybersecurity spending comes from outside the CISO’s budget — and non-CISO cyber spending is growing at 24% CAGR (Gartner). Business units outside IT are increasingly initiating security purchases. Add CTO and VP Engineering to ABM target lists for platform-level tools. The CISO isn’t the only door in.

The seasonal cadence matters too. Q1-Q2 is the highest-velocity purchasing window as new budgets open and post-RSA evaluations formalize. Q4 is planning season — that’s when next year’s security budget gets submitted and defended to the CFO and board. The conversations you have in Q4 determine whether you’re in the budget line for Q1.

Lead generation strategies for cybersecurity companies

1. Build ABM lists around CISO-led buying committees

ABM in cybersecurity isn’t “target big accounts.” It’s mapping the 5-7 stakeholders who touch every security purchase and sequencing outreach by role, not just by account — before your competitor does.

The CISO initiates and gates the evaluation, but the CFO releases budget (and gets involved above $100K), Procurement adds 30-60 days to every deal after technical selection, and the IT Director or SOC Lead has informal veto power over anything touching daily workflow. Build coverage across all of them before the formal evaluation opens.

List-building variables that matter for cybersecurity accounts specifically: company size (employee count determines endpoint volume and budget tier), compliance exposure (defense contractor means CMMC, healthcare means HIPAA, public company means SEC cyber disclosure requirements), tech stack signals (what EDR or SIEM they’re already running), and whether a CISO role exists or is currently vacant — both states generate pipeline, just through different plays.

Tools: 6sense (multi-stakeholder account tracking and intent scoring), ZoomInfo (CISO identification and direct dials), LinkedIn Sales Navigator (buying committee mapping and organizational structure), HG Insights (tech stack identification for gap targeting).

2. Thought leadership content that gets cited in CISO communities

The content that generates cybersecurity pipeline isn’t optimized for Google. It’s cited by the analyst writing for the FS-ISAC monthly digest, shared by the CISO at a company your prospect respects, and bookmarked by the threat hunter who influences every tooling decision.

79% of security leaders cite peer recommendations as their most trusted vendor information source (ISSA/ESG Security Professional Insights Survey). That means content that gets shared in peer channels — ISAC member forums, CISO roundtable Slack groups, LinkedIn CISO networks — is worth more than content that ranks on Page 1.

The formats that earn CISO-level trust: original threat research (not repurposed Gartner summaries), incident response case studies with specific attack chains, compliance implementation guides with actual implementation steps (not marketing PDFs), and technical detection engineering content written by people who’ve worked a SOC shift.

What doesn’t work: generic cybersecurity trend posts, “top 10 tips for CISOs,” anything that reads like it was written by someone who’s never had to explain a P0 incident to a board at 11pm.

Distribution that matters: get your best technical content cited in industry newsletters like tl;dr sec and Risky Business, contributed to ISAC working groups, and referenced in Gartner Peer Insights review comments. That’s the distribution channel CISOs actually use.

3. LinkedIn outreach built around peer context, not pitch sequences

CISOs allocate 10-20% of their time to vendor interactions (CSO Online, 2025). Vendors spend 90% of their time trying to reach them. The math only works if your message earns that remaining 20% — and generic pitch sequences don’t.

What earns attention from a CISO on LinkedIn: a mutual peer who connected you (“Sarah at [Company] mentioned you were evaluating XDR options”), a specific reference to their compliance posture (“I noticed you’re in the CMMC Phase 2 window — we’ve helped 12 defense contractors complete C3PAO assessments”), or a response to technical content they posted. Not “I help companies like yours with cybersecurity.”

The sequence structure that works for cybersecurity: connection request with specific context, Day 3 short message referencing their specific environment or compliance exposure, Day 7 value-add (a relevant case study or a threat intelligence piece, not a product brochure), Day 14 direct ask for a 15-minute conversation on a specific topic.

Contact IT Directors, SOC leads, and GRC leads before and alongside CISOs. These roles have higher response rates and create warm context for the CISO introduction.

Tools: LinkedIn Sales Navigator (filter by security titles, company size, and industry), Shield Analytics (track engagement and content performance), Dripify or Expandi (sequence automation with personalization compliance).

4. RSA Conference and Black Hat pipeline activation

RSA Conference (San Francisco, April) and Black Hat (Las Vegas, August) are not marketing events. For cybersecurity buyers, these are where shortlists get finalized.

RSA draws CISOs, security architects, and procurement decision-makers. Black Hat skews technical — SOC leaders, threat hunters, detection engineers. Different buyer audiences require different outreach approaches. A Black Hat-specific play that leads with detection engineering depth will land flat at an RSA CISO roundtable. Know which room you’re in.

Pre-conference (RSA: February-March, Black Hat: June-July): Pull attendee lists from conference mobile apps and exhibitor directories. Filter for CISO, VP Security, Director of Security Operations, and Head of GRC titles from your ICP accounts. Begin targeted outreach 3-4 weeks before the show — “We’ll both be at RSA and I’d like to set 15 minutes aside” converts higher than cold outreach at almost any other point in the year.

During: The hallway conversations at RSA are where shortlists get built. Booth traffic is secondary. Prioritize CISO executive roundtables (often invite-only — sponsors get access), after-hours dinners, and analyst briefings where procurement teams are present.

Post-conference (RSA: May, Black Hat: September): Buyers return with shortlists and competitive intelligence. This is the highest-response outreach window of the year. Follow up within 5 business days with a specific reference to a session or conversation. The longer you wait, the more the urgency dissipates.

SC World Awards and regional cybersecurity summits in Q3-Q4 create additional windows for vendors who can’t make the full RSA investment.

5. Free compliance gap assessments as lead magnets

A “free security assessment” says you want to sell something. A “CMMC Level 2 readiness assessment” says you understand they have a November 2026 deadline and might have a gap they haven’t quantified yet.

Compliance-framed assessments generate better leads than generic security hygiene assessments because they attract buyers with a budget mandate and a hard deadline — not buyers who are vaguely concerned about security. The buying cycle is already active. You’re just getting into it earlier.

The four highest-converting assessment formats for 2026:

• CMMC Level 2 readiness assessment — defense contractors with a November 2026 compliance deadline are in a procurement emergency if they haven’t started the C3PAO assessment process
• SOC 2 Type II gap analysis — growth-stage companies being asked for SOC 2 certification by enterprise prospects as a vendor risk requirement
• Cyber insurance renewal controls checklist — companies facing policy renewal with new carrier requirements around MFA, EDR, and PAM
• Zero trust maturity assessment — organizations responding to board-level directives to move toward ZTA

Gate the assessment behind a short form: name, email, company size, and one compliance question that segments the lead by urgency. Keep it under 5 fields. Every additional field drops completion by 10-15%.

Follow-up sequence: assessment results delivered within 24 hours, a personalized analysis email, then an offer for a 30-minute review call. Compliance assessment leads convert at 2-3x the rate of general content downloads because they have an active, funded problem they’re already trying to solve.

6. Multi-channel sequences timed to the CISO attention window

Never run a multi-channel sequence without a triggering signal. Cold volume sequences in cybersecurity have sub-2% response rates. Signal-triggered sequences run 8-15%. The message isn’t better. The timing is.

The sequence structure that works for cybersecurity:

• Day 1 email — specific trigger reference (compliance deadline, breach in their industry, leadership change, funding event) plus one relevant proof point
• Day 3 LinkedIn connection — with context from the email, not a generic request
• Day 5 phone call — reference the email and the trigger; ops and security leaders pick up more than most B2B buyers think
• Day 8 LinkedIn message — share a relevant case study or a threat advisory aligned to their sector
• Day 12 final email — direct ask with a specific time and specific topic, not a vague “would love to connect”

The personalization floor for cybersecurity: every touchpoint must reference the prospect’s specific security environment, compliance posture, or a recent event in their industry. “I help companies like yours” gets filtered before the CISO reads the second sentence.

Buying committee sequencing: CISO first (1-2 touchpoints to establish context), IT Director or SOC Lead next (operational rapport and a more technical conversation), GRC Lead or Compliance Officer if the trigger is compliance-driven. Coordinate touches across the committee in the same week — not sequentially over three months.

Tools: Outreach.io or Salesloft (sequence management), 6sense (account-level tracking across the full committee), Gong (call coaching for security-specific objections and CISO conversation patterns).

7. New CISO hire trigger outreach

Every new CISO is, functionally, a new prospect — regardless of whether the previous CISO knew your company. The incumbent vendor has no relationship advantage over you in weeks 1-12.

A new CISO spends their first 90 days auditing the existing security program and tooling. Most make at least one major vendor change in the first six months. The window is specific: weeks 1-5, the CISO is absorbing the organization. Weeks 6-12 is the audit phase — they’re evaluating what they inherited and identifying what needs to change. That is your outreach window. By week 16, their initial decisions have been made or deferred until the next budget cycle.

What the new CISO is evaluating: whether the current SIEM or SOAR setup matches the threat profile, whether MDR coverage is adequate, whether the compliance posture matches what the board was told, and whether any existing vendors are underperforming SLAs.

What the first outreach message should contain: a specific acknowledgment of the transition (without being sycophantic), one relevant proof point about a previous new CISO engagement, and a direct offer — “15 minutes to walk through what we’ve seen new security leaders prioritize in their first quarter.” No pitch. No product tour. Just the door.

How to monitor: LinkedIn job change alerts (free, manual), ZoomInfo intent signals combined with job change notifications, Bombora for account-level activity spikes concurrent with a leadership change, and Google Alerts for “[Company] appoints new CISO.”

The lower-competition play: Director of Security Operations, Head of Threat Intelligence, and VP of GRC hires signal active security program investment with far fewer vendors monitoring those signals. The outreach is easier. The meeting rate is higher.

8. Compliance deadline triggers: CMMC, SOC 2, and cyber insurance renewals

CMMC Phase 2 has a date: November 10, 2026. Every defense contractor in your ICP who isn’t already in a C3PAO assessment process has a funded, urgent problem. That’s not a warm account. That’s a fire.

CMMC Phase 2 (November 2026):

All DoD contractors must have C3PAO-assessed CMMC Level 2 status by November 10, 2026 to be eligible for new contract awards. Contractors who haven’t begun the assessment process are in a procurement emergency — the assessment itself takes 3-6 months, and the C3PAO bottleneck (shortage of certified assessors) becomes acute in Q3 2026.

Q1-Q2 2026 is the active outreach window. ICP filter: defense contractors, aerospace/defense primes and subcontractors, government IT providers. Searchable via SAM.gov, USASpending.gov, and LinkedIn with defense or DoD sector filters. If their NIST 800-171 self-assessment score is available in the Supplier Performance Risk System (SPRS), use it. An honest outreach that names specific POA&M gaps will get a reply. A generic “we do CMMC compliance” pitch won’t.

SOC 2 audit windows:

Companies pursuing SOC 2 Type I or Type II enter a 3-6 month implementation and audit cycle. Security tooling decisions — SIEM, access control, logging, vulnerability management — are made in the 60-90 days before the audit engagement starts.

How to find companies in the SOC 2 window: job postings for “information security manager,” “compliance engineer,” or “SOC 2 readiness consultant” combined with a growth signal (Series B+, new enterprise sales hires, press releases about enterprise customers). Pair with 6sense topic intent for SOC 2-related research activity.

Cyber insurance renewals:

Carriers now require specific controls as conditions of coverage: phishing-resistant MFA, EDR, PAM, and incident response plans. A renewal becomes a procurement trigger for any controls gap. The frame that works: “Is your current security stack aligned with what your carrier requires at renewal?” — it’s a funded, deadline-driven conversation, not a generic security pitch.

9. Industry breach monitoring as a pipeline trigger

The best time to reach a CISO who wasn’t ready to talk is 72 hours after a breach hits a company they know.

When a named company in a prospect’s vertical suffers a publicized breach, the CISO’s leadership chain immediately asks: “Could this happen to us?” Security budgets loosen. Vendor evaluations accelerate. The window is 2-4 weeks post-announcement — after that, urgency fades until the next incident.

The breach doesn’t have to hit your prospect directly. If a healthcare system suffers a ransomware attack, every other mid-sized health system in your ICP is now having a board conversation about their security posture. Target those companies in the 72-hour window.

How to frame the outreach: don’t reference the victim company by name. That reads as ambulance chasing and will kill the conversation before it starts. Lead with the pattern: “Three healthcare organizations have disclosed ransomware incidents in the last 60 days. Here’s what they had in common — and what we’re seeing the affected organizations prioritize in their response programs.”

How to monitor: Recorded Future, SecurityTrails, and BreachAware surface breach announcements in near real-time. Set up Google Alerts for “[industry sector] breach” and “[industry sector] ransomware.” Subscribe to sector-specific ISAC alerts for your core ICP verticals.

Dead lead revival via breach: cold accounts that went dark after a previous sequence frequently re-engage when a breach hits their sector. Filter your dead pipeline by industry vertical and trigger a re-engagement sequence within 48 hours of a relevant announcement. The response rate on reactivated cold pipeline via breach trigger consistently runs 2-4x higher than standard re-engagement cadences.

10. Security job posting signals as buying intent

When a company posts for a “Splunk engineer” they’re not advertising a job opening. They’re announcing a budget allocation.

Security job postings are among the clearest buying intent signals in the industry. A company hiring a SIEM engineer, SOC analyst, or threat hunter is in an active tooling investment — they’re either deploying a new platform or replacing an existing one. The hiring decision often precedes the vendor selection by weeks.

What specific postings signal:

• SIEM engineer posting — active SIEM evaluation or deployment in progress
• “CrowdStrike administrator” or “Splunk engineer” — committed to a specific platform (either expansion opportunity or competitive displacement window)
• “SOC analyst” plus “threat hunter” simultaneously — building or scaling a SOC program; likely MDR or MSSP evaluation underway
• “GRC manager” or “compliance engineer” — compliance investment cycle in progress; SOC 2, CMMC, or FedRAMP pursuit likely
• “CISO” — leadership transition window (see Strategy #7)

A single job posting is a weak signal. The stack that matters: a company posting 3+ security roles simultaneously, combined with a recent funding event or growth announcement, combined with G2 comparison activity in the security category — that’s a high-confidence buy signal. Route it to an SDR within 48 hours, not at the next sprint review.

Response time matters here. A company posting a SIEM engineer role today will likely make a vendor selection within 60-90 days. Outreach in the first two weeks has 3-4x higher response rates than outreach at week eight. The signal decays fast.

Data sources: LinkedIn Talent Insights (monitor target accounts for security hiring surges), ZoomInfo intent (job posting alerts combined with company activity signals), Bombora (topic surge for security categories), job board aggregators for real-time monitoring.

11. Gartner Peer Insights and G2 buyer intent monitoring

By the time a CISO sends you an RFP, they’ve already compared you to three competitors on Gartner Peer Insights. The review site isn’t the end of the buyer journey. It’s the middle.

Gartner Peer Insights and G2 aren’t just review sites in cybersecurity — they’re primary shortlisting tools. The CISO’s researcher checks these before any vendor gets a call. Vendors with fewer than 20 Peer Insights reviews or a 4.0 rating on G2 are effectively invisible to many enterprise buyers. Vendors with strong Peer Insights profiles receive exposure to a 24% larger Gartner client audience year-over-year.

How buyer intent data works on these platforms: G2 Buyer Intent and Gartner Digital Markets intent data surface anonymous company-level activity. A company comparing three EDR products on Gartner Peer Insights is in active vendor evaluation — route that signal to an SDR within 48 hours.

The review profile strategy: building your Gartner Peer Insights and G2 review profiles is both a pipeline asset and an active lead gen activity. Every customer conversation is a review request opportunity. Treat it as a pipeline play, not a marketing afterthought.

Combining intent layers: a company showing review site comparison activity, plus a recent security job posting, plus CISO LinkedIn activity about a specific tool gap — that account is ready for a direct outreach conversation, not a nurture sequence. Stack the signals before you assign the touchpoint tier.

TrustRadius and Capterra also matter for mid-market security buyers. The enterprise buyer skews Gartner and G2.

12. Champion tracking: when your CISO moves, your pipeline moves with them

When a CISO or VP of Security who was a customer — or a close prospect — moves to a new organization, they carry vendor trust with them.

Response rates on outreach to a moved CISO champion run 40-60% versus 5-15% for cold outreach. The champion already ran you through a mental evaluation. They know your capabilities, your limitations, and your people. The new organization is their first opportunity to build the security program they actually want — and they’ll call vendors they trust.

What to send within the first two weeks of a job change: a short, direct congratulations message that references the previous relationship and opens the door — “Congrats on the move to [Company]. Would love to find 15 minutes to catch up on what we’ve been building since we last spoke.” No pitch. No ask to be evaluated. Just the door.

How to monitor: LinkedIn alerts for job changes by title (“CISO,” “VP of Security,” “Director of Security Operations”), Sales Navigator’s Champions feature (tracks contacts across companies), Bombora champion tracking for account-level activity signals.

The secondary play: when a CISO leaves a customer account, two opportunities open simultaneously. The departed CISO is now a champion in a new organization. The incoming CISO (Strategy #7) is a new prospect at the original account. Both movements generate pipeline. Most teams catch one and miss the other.

13. Respond to every security inbound within 5 minutes

The average cybersecurity vendor responds to inbound inquiries in 42+ hours. The benchmark is 5 minutes.

That’s not a lead quality problem. That’s a speed problem — and it’s measurable pipeline loss.

Leads contacted within 5 minutes of form submission qualify at 21x the rate of leads contacted within 30 minutes (Bridge Group). In a market where enterprise security purchases involve shortlisting 3-5 vendors simultaneously, the first vendor to respond frames the evaluation criteria. If you respond in 4 hours and a competitor responds in 10 minutes, the competitor has already set the agenda for the bake-off.

Where cybersecurity inbound comes from: compliance assessment completions (Strategy #5), webinar registrations and post-webinar content downloads, RSA or conference follow-up form fills, pricing page visits identified via website visitor identification tools, and direct inbound RFP requests.

What “5-minute response” means in practice: not a sales pitch. A specific acknowledgment, a calendar link for a 20-minute conversation, and one relevant proof point from their industry segment or compliance category. The goal is establishing that a human is available now — not tomorrow, not after the next stand-up.

Tools: Chili Piper (automated meeting routing and instant scheduling links), Clearbit Reveal or 6sense (identify the company from anonymous website visits and trigger immediate outreach), Slack alerts for form submissions, and a designated inbound owner with authority to respond during business hours.

How much does cybersecurity lead generation cost in-house vs. outsourced?

Most cybersecurity companies build in-house SDR capacity when they hit a pipeline problem and want to own the solution. I understand the instinct. The problem is the math — and in cybersecurity, the ramp problem is worse than in most verticals.

An SDR selling into security needs to hold a credible conversation with a CISO about SIEM architecture, understand the difference between MDR and MSSP service models, know what CMMC Phase 2 actually requires, and be able to discuss SOC 2 audit timelines without sounding like they Googled it that morning. That knowledge takes 3-4 months to build. You’re paying full salary while pipeline output is at 40-50% of capacity.

Then the average SDR leaves at 14-16 months. If yours walks at month 10, you start over — same hiring cost, same ramp, same 3-4 months of slow output. The CISO-specific knowledge they built is gone.

Here’s what an internal SDR setup actually costs over six months in cybersecurity:

An outsourced program running all 13 of these strategies costs $40,000-$55,000 for six months. No ramp time. No turnover risk. Execution starts in week one with reps who’ve already had hundreds of CISO conversations.

For a detailed look at how to evaluate outsourced providers for cybersecurity pipeline, see How to Choose a Cybersecurity Lead Generation Provider.

What metrics matter for cybersecurity lead generation?

If you’re tracking leads generated and deals closed and nothing in between, the middle of your pipeline is a black box. That’s where most cybersecurity vendors are leaking.

If your contact rate is low, your list is wrong or your data is stale. If your meeting rate is fine but close rate is poor, you’re booking unqualified meetings — likely reaching the CISO without coverage on the CFO and Compliance Officer who have equal veto power. Each metric points to a specific break in the system. Fix the break, not the symptom.

Frequently asked questions about cybersecurity lead generation

How long does it take to see results from cybersecurity lead generation?

Signal-triggered programs — new CISO hires, compliance deadlines, breach monitoring — reach qualified pipeline faster than cold prospecting: typically 45 to 75 days when trigger event monitoring is running from week one. Cold outreach into accounts with no signal takes 90 to 120 days because you’re building awareness before any buying intent exists. Programs launched during high-signal windows — Q1-Q2 post-RSA, or ahead of a compliance deadline — compress that timeline considerably.

What is the best channel for cybersecurity lead generation?

Multi-channel sequences — email, phone, and LinkedIn in a coordinated sequence — outperform any single channel by 3-5x on response rates. But channel matters less than timing. Signal-triggered outreach (new CISO hire, compliance deadline, breach in their vertical) runs 8-15% response rates. Generic cold outreach runs below 2%. Fix the signal layer before optimizing the channel mix.

How is cybersecurity lead generation different from general B2B lead generation?

CISOs are among the hardest buyers to reach in B2B — they allocate only 10-20% of their time to vendor interactions and rely on peer networks rather than vendor outreach for shortlisting. The buying committee is larger (6+ stakeholders at enterprise companies) and the decision cycle runs 3+ months. Most importantly, trust is built through community — ISAC working groups, Gartner Peer Insights, conference conversations — long before any RFP is written. Generic B2B playbooks fail because they ignore this trust infrastructure entirely.

What does a cybersecurity lead generation outsourced program cost?

A fully managed outsourced cybersecurity lead generation program typically runs $40,000 to $55,000 over six months — compared to $95,000 to $128,000 for an equivalent in-house SDR build when you account for salary, recruiting, tools, and the extended 3-4 month ramp period that cybersecurity domain complexity adds. For a full evaluation framework, see How to Choose a Cybersecurity Lead Generation Provider.

What should you do this week?

Stop auditing the strategy and go find the break in your system.

Pull your last 60 days of outbound. How many accounts had a trigger event — a new CISO hire, a compliance deadline, a breach in their sector — before first contact? How many inbound leads were responded to within 5 minutes? How many open deals include contacts at more than two roles in the buying committee?

Most cybersecurity companies have at least five of these thirteen strategies completely missing from their pipeline motion. Some are missing nine.

You can build this system internally over 18 months. Or you can plug into one that’s already running.

Is your current outreach built around the signals that actually move a CISO, or built around the volume that their inbox was designed to filter out?