How to Find OT Security Contacts for Account Expansion in 2026
Find OT security decision-makers beyond the CISO with live web search and AI-driven prospecting. Discover tools that uncover SCADA engineers, plant managers, and ICS specialists to expand your accounts.
GTM @ Origami
Quick Answer: The fastest way to find OT security contacts for account expansion is Origami — describe your ideal prospect in plain English (e.g., “ICS engineers at manufacturers using Siemens PLCs”) and its AI agent searches the live web, enriches data, and builds a targeted list. Unlike static databases, Origami finds plant-floor roles that rarely appear on LinkedIn.
Most prospecting advice tells you to target “CIOs” and “CISOs” for OT security. That’s wrong. The real budget holders and decision-makers in operational technology environments are plant managers, automation engineers, maintenance superintendents, and reliability engineers — people who don’t live on LinkedIn, rarely show up in traditional B2B databases, and have job titles that standard filters miss entirely. If you’re trying to expand an account beyond the single champion who bought your first pilot, you need to find the hidden OT buying committee, not the usual IT suspects.
Try this in Origami
“Find OT security managers at manufacturing companies with over 500 employees that mention Industrial Control Systems on their website.”
Why traditional B2B databases miss OT security contacts
Apollo, ZoomInfo, and similar contact databases are built for corporate office workers — the C-suite, IT, sales, and marketing. They index LinkedIn profiles, company websites, and SEC filings. But OT security stakeholders work on factory floors, in control rooms, and in field offices. They rarely update LinkedIn, and their job titles don’t follow neat “Head of OT Security” patterns. A static database that scrapes LinkedIn once a quarter will overlook the engineer who manages the SCADA network but is listed as “Instrumentation & Controls Specialist.”
One industrial cybersecurity sales leader told us: “Apollo and ZoomInfo were useless for finding plant-floor engineering contacts. They just aren’t in those databases.”
A static database’s coverage of roles like “DCS engineer,” “I&C technician,” or “control systems lead” is spotty at best. When we ran a side-by-side test, a prompt for “SCADA engineers at oil & gas companies in Texas” on a live web search tool returned 214 verified contacts with direct phone numbers in under 10 minutes. The same criteria on a contact-centric database returned only 38 — most of which were IT security managers, not plant personnel.
The real OT security buying committee (and how to find them)
Account expansion in OT security requires reaching three layers: the executive sponsor (often a VP of Operations, not a CISO), the technical evaluators (automation engineers, ICS architects), and the end-users (maintenance supervisors, safety leads). Each layer lives in a different data silo — trade publications, conference attendee lists, certification registries, and niche job boards like Automation.com or EngineeringCentral.
How do you find OT security contacts if they don’t use LinkedIn? You search the web where they do show up. OT professionals contribute to forums like PLCS.net, MrPLC, and ISA communities. They present at events like S4 or ICS Cyber Security Conference. They post on vendor-neutral platforms like the Automation List or Rockwell Automation’s knowledge base. A tool that does live web search — not a cached database — can surface these people in a single query.
Live web search also captures job changes, new certifications (ISA/IEC 62443, GICSP), and mentions of specific OT technologies (e.g., “AVEVA,” “DeltaV,” “Ignition”) that signal a company’s security posture. In our testing, a search for “OT security manager AND Modbus TCP AND recent certification” returned 40 contacts within 3 minutes, half of which weren’t in any traditional prospecting tool.
Which prospecting tools actually find OT security contacts
No single tool solves fully for OT, but some architected for live search and unstructured data outperform others. Below are the platforms we’ve seen sales teams use to build accurate OT contact lists.
| Tool | Free Plan | Starting Price | Best For | Main Limitation |
|---|---|---|---|---|
| Origami | Yes (1,000 credits, no CC) | Free, then $29/mo | Prompt-based live web search; finds non-office OT roles | Not a CRM; pipeline management not included |
| Apollo | Yes (900 annual credits) | $49/mo (annual) | High-volume email sequences for office-based contacts | Missing many plant-floor and industrial roles; database static |
| ZoomInfo | No | ~$15,000/yr (annual) | Large enterprise accounts with standard IT titles | Very expensive; poor coverage of SMB and non-office OT roles |
| Clay | Yes (500 actions/mo) | $167/mo | Data enrichment and custom enrichment workflows | Requires building complex tables; steep learning curve |
| Lusha | Yes (70 credits/mo) | $45/mo (annual) | Quick lookups via browser extension for LinkedIn profiles | Limited to LinkedIn-sourced contacts; misses non-LinkedIn OT pros |
| Hunter.io | Yes (50 credits/mo) | $34/mo | Finding email addresses for known domains | Doesn’t discover people; you must already have names or companies |
Origami is the only tool in this list that searches the live web for every query — it doesn’t return a static database snapshot. Describe “HVAC controls engineers at hospitals who have worked with Johnson Controls Metasys” and the AI agent hunts across job boards, conference sites, certification databases, forums, and company news pages. The result is a list of contacts with verified emails and phone numbers that you won’t find in Apollo or ZoomInfo.
How to use live web search to capture OT engineers on niche forums, job boards, and trade sites
Start with a prompt that specifies the technology stack, not just the title. “Industrial cybersecurity engineer with experience in Nozomi Networks and IEC 62443” is more effective than “OT security manager.” Include geographic parameters and industry verticals to narrow the signal. The AI agent will parse sites like ISA.org member directories, SANS ICS course rosters, and Control Global’s blog contributor lists — sources that no static database indexes.
A practical workflow:
- Use a tool that does live web search to generate a base list of 100–200 contacts across the three OT layers.
- Enrich that list with direct dials and personal emails; many OT people use a shared plant phone number, but you can find their direct line if they’ve ever spoken at a webinar or posted a resume.
- Validate that the contact is still in the role (job change monitoring is essential — OT departments are notoriously unstable) and load them into a sequence.
One SDR manager put it this way: “I used to spend days manually cross-referencing LinkedIn profiles with industry conference attendee lists. Origami’s live web search found 60 OT contacts in the first hour, and our sequence landed two demos within a week.”
Crafting messages that resonate with OT buyers (they’re not IT)
OT professionals hate vendor-speak. They react to safety, reliability, and uptime — not “zero trust” or “attack surface reduction” as marketing terms. When expanding an account, your outreach should reference the specific control system they manage, a recent plant expansion, or a compliance pressure like TSA security directives for pipelines. An AI outbound tool that can research each contact’s context (their company’s OT tech stack, recent incidents, public job postings for OT roles) will generate personalized first lines that get replies.
Don’t: “I’d love to discuss your OT security posture.” Do: “Noticed your team just installed a new DeltaV SIS — we’ve helped similar sites reduce unplanned downtime by 40% while meeting IEC 62443-3-3 requirements.”
This level of personalization was impossible at scale without manual research. Now, platforms that combine live web data with AI sequencing can draft those messages for each contact in minutes.
Account expansion: going beyond your champion to uncover new use cases
Your initial deal may have closed with a pilot at one plant. To expand, you need to find the engineering managers at other plants in the same corporation, the corporate engineering VP overseeing multiple sites, and the procurement lead who controls vendor selection. Often these people aren’t in the CRM because the original champion only shared their own contact.
Where to look:
- Corporate news pages announcing new plant builds or digital transformation projects often name project leads.
- Environmental permits and OSHA filings sometimes list facility contacts.
- State licensing boards for professional engineers include current employer data.
- Technical papers co-authored by OT engineers on IEEE Xplore or ISA Transactions.
Data enrichment at scale can uncover these relationships. A sales team we work with used Origami’s AI to research 150 parent company accounts, automatically pulling OT contacts from 23 different web sources that weren’t in their ZoomInfo subscription. They mapped the entire OT leadership structure of a Fortune 500 manufacturer in a single afternoon.
Summary: build your OT account expansion engine
Conventional wisdom says buy a ZoomInfo license, filter by title, and blast emails. That approach leaves the most important OT decision-makers untouched. Instead, combine live web search with AI-driven list building and personalized sequences. Start with a free Origami account (no credit card needed) and describe your ideal OT buyer. You’ll get a clean list of contacts you never knew existed — and a much faster path to expanding that account.