How to Reach CISOs and Security Practitioners: Routes Compared

No route reaches CISOs alone. LinkedIn is the only one where an advertiser can pick job title and seniority, from $10 a day, and it publishes no performance benchmark. Security newsletters sell on reader mixes they state themselves, from $1,950 for a CloudSecList slot to custom proposals elsewhere. In a 2026 survey of 320 security decision-makers, peer recommendations ranked first at 55%. Every figure below was read on 11 November 2026.

Published and updated 11 November 2026. Each price and figure was read on the seller's own page that day.

Dupple publishes Techpresso, AIpresso, Devshot, Cyberpresso, Finpresso and MarketingShot, and sells sponsorships in them. Dupple publishes this guide, so read the Dupple row as a seller's view. Dupple's rates are in the media kit and are not repeated here.

Routes at a glance

Table: eleven routes to security buyers and what each publishes, sources read 11 November 2026. Confirm current terms with each seller.

Sources read 11 November 2026: LinkedIn targeting help and budget guide, TLDR InfoSec, tl;dr sec, CloudSecList, SANS newsletters, Risky.Biz, Informa TechTarget, NetLine, G2 plans and Gartner Peer Insights. These are sellers' descriptions, not audited audiences.

What security buyers say influences them

A June 2026 study by NOLA Marketing and the Ponemon Institute surveyed 320 enterprise cybersecurity decision-makers at mid- to large-enterprise organizations. Peer recommendations ranked highest as a discovery channel, at 55%, and research and survey reports had the strongest direct impact on a purchase, at 46% (study write-up). A marketing firm co-ran the study, and the page read gives no fielding dates or margin of error. Taken at face value, a paid slot is one way buyers hear of a vendor, and routes that produce recommendations and original research may count for as much. That is a reading of one survey, not a finding about any channel below.

Choosing by job title: LinkedIn

LinkedIn is the one route in this table that targets a person's declared job. Its help page defines Job Title as "the position of a member account within their organization", Job Function as "common tasks or activities undertaken within a job position" and Job Seniority as "the rank or level of influence of a member account's current role". An ad set needs at least 300 member accounts. The minimum daily budget is $10 for any ad format, the minimum lifetime budget for a new campaign is $100, and LinkedIn suggests $25 a day for new advertisers and $50 to $100 for existing ones.

LinkedIn's pages read here publish no click-through rate, no cost per click and no count of security professionals. Agency benchmarks circulate, but none could be checked against LinkedIn's own pages, so none is used. A title or seniority facet is declared by the member, and a director at a software company is not necessarily a security buyer, so the facets narrow the audience without confirming a purchase role.

Choosing by reader: security newsletters

The cybersecurity newsletter list compares ten of them reader by reader. Four facts matter for route planning. CloudSecList is the only one to print a price: $1,950 for a single slot, with preferential rates for four or more. tl;dr sec says about 5% of readers click at least one link in an issue, and that sponsor links draw 60 to 100 clicks at the low end, many 100 to 200, and 500 to 750 at best. TLDR InfoSec states a 43% open rate and no click rate. SANS prints subscriber counts for NewsBites (387,000) and @RISK (260,000) and nothing on price or rates.

The publishers' own numbers disagree in places. tl;dr sec says "more than 120,000" subscribers in its sponsor section and more than 90,000 elsewhere on the same page. SANS says "over 700,000" across its newsletters, while NewsBites and @RISK add up to 647,000. CloudSecList states a click-through of about 30% and also says it does not track individual open and click rates, only global anonymised ones, and its open rate read about 50% on 4 November and about 40% on 11 November. These gaps are a reason to ask every seller for a send-level report with clicks and engaged company domains before booking.

Choosing by lead: syndication and intent

Informa TechTarget says it holds "2.5M+ permissioned, GDPR-compliant cybersecurity contacts" and that "24,000+ CISOs engage with us over 120 days". Its audience job levels run from C-Suite/VP to Staff/Practitioner with no percentages, and the page read gives no price. NetLine sells leads in a bidding marketplace "starting at $14 per lead", and its spec page adds charges per filter and per custom question. A hundred leads at the floor would cost $1,400, but the floor is not a price for security titles, and the price for those is not published.

Choosing by recommendation: review sites

G2 has a free plan to claim a profile and collect reviews, and a Starter plan at $299 a month or $2,999 a year, which the page defines as for businesses of 1 to 100 employees, with year 2 rising to $599 a month or $6,000 a year. Gartner Peer Insights is described by Gartner as a "Complimentary Self-Service Platform" with full complimentary use for clients and non-clients. Toolradar's catalog gives a sense of coverage: of 740 published security tools on 5 November 2026, G2 is a recorded review source for 386, Capterra for 148, SourceForge for 75, Trustpilot for 46 and PeerSpot for 20. Those are tools with a recorded source, not reviewers, and sources overlap (snapshot and method).

Events and podcasts: nothing usable here

RSA Conference, Black Hat and CISO Series are well known to security marketers. On 11 November 2026 our tools could not open their organisers' pages (the sites returned an access error), so no price, attendance or seniority figure from them is used. Risky Business says its weekly audience of "more than 25,000" covers all its products together and does not split it by show. A vendor weighing these routes needs to ask each organiser for its current prospectus and for how seniority was counted.

Where Dupple fits, and what it cannot claim

Our data, verified November 2026: Cyberpresso has 29,000+ subscribers as of November 8, 2026, and Dupple sells Primary Ads and Dedicated Sends in it, a Primary Ad in Techpresso, and post-signup offers paid per click or per lead in the Offer Network (Cyberpresso page, security leaders page). Our four-row route audit lists what is not established for each: no verified CISO-only delivery or current slot availability for a Cyberpresso Primary Ad, no verified job titles for a Dedicated Send, no verified security occupation for every Techpresso reader, and no transfer of post-signup targeting to a whole newsletter send.

The sign-up quiz has no security option, so the role mix is thin. Of 220 engaged Cyberpresso readers matched to the quiz in the week to 5 November 2026, 35 (15.9%) named engineering and 44 (20.0%) chose "other"; the remaining 64.1% sit in groups under 30 respondents each, so no CISO or security share can be stated (Cyberpresso file, method). The lead generation guide explains what the quiz can and cannot show for security vendors, and the cybersecurity sector page covers the formats.

Worked scenario: a cloud security vendor with $10,000 for a quarter

Using only printed prices, a vendor could run LinkedIn for a month at the suggested $50 to $100 a day, which is $1,500 to $3,000, buy two CloudSecList slots for $3,900, and pay the $14 floor for 100 NetLine leads, $1,400. That is $6,800 to $8,300 and leaves $1,700 to $3,200 for a route that quotes on request, such as TLDR InfoSec, tl;dr sec, SANS or Dupple. The arithmetic says nothing about which route works. Pick one outcome, such as qualified meetings, give each route its own UTM tags, and ask every seller for engaged company domains so clicks can be matched to target accounts. The sponsorship ROI guide covers the measurement.

What we could not verify

• No independent benchmark of CISO reach by route turned up in the sources read on 11 November 2026. The one buyer survey used was co-run by a marketing firm, with 320 respondents and no stated margin of error.
• Every newsletter figure is the publisher's own and none is audited; several conflict, as noted above.
• RSA Conference, Black Hat and CISO Series pages could not be opened, so nothing about them is claimed.
• LinkedIn publishes no click-through or cost-per-click figure on the pages read.
• The prices printed in the sources read are few: CloudSecList's slot, G2 Starter, the NetLine lead floor, LinkedIn's budget minimums and Gartner Peer Insights at no cost. Every other route quotes on request or publishes nothing.
• Dupple's route audit describes routes, not results, and its quiz holds no security option.

FAQ