CAIN-42 MCPGateWho buys KEYSTONE, and where to find them
The person who feels the pain is not always the person who pays. Know both.
The people you will talk to
| Role | What keeps them up at night | Say this to them |
|---|---|---|
| CTO / VP Engineering at a B2B software company | Deals stalled by security findings; senior engineers stuck proving fixes. | "We close findings with a re-runnable proof your customer accepts on the first try." |
| Head of Security / CISO | Can a fix be trusted? Was it AI-written? | "The AI never grades itself: a rule finds it, an independent test proves it, and the record is sealed." |
| Customer-facing security or trust lead | Answering customer security questionnaires and follow-ups. | "You can forward one zip file instead of a thread of screenshots." |
| Founder of a small AI-built product | Investors or first enterprise customers doubt the code. | "Show them proof, not promises." |
A good prospect looks like this
- Sells software to companies larger than itself.
- Has recently had a security review, pen test or customer finding.
- Uses AI coding assistants.
- Writes in Python (the detector is Python-focused today).
Trigger events: when to reach out
People buy when something just happened. Watch for these:
- They just received a pen-test report or a customer security finding.
- A big deal is waiting on a security review.
- They posted about "AI-written code" quality concerns.
- They are preparing for due diligence (fundraise or acquisition).
Where to find them
- LinkedIn: CTOs and heads of engineering at 20-200 person B2B software companies.
- Companies posting "security engineer" or "security questionnaire" job ads.
- Founders posting about their first enterprise customer.
- Existing audit clients: every audit finding is a KEYSTONE fix.
Who is not a buyer (save your time)
- Teams with no outside customers asking for proof.
- Code bases with no Python (the detector would see little).
- Anyone who wants a full security audit of everything (that is a different offer).
Qualify before you pitch
Five checks. Pursue when at least four are true; otherwise keep in touch and move on.
| Check | Pursue when | Ask |
|---|---|---|
| Need | They answer yes to at least two sizing questions (page 2). | How many security findings did you have to fix last quarter? |
| Budget | They can approve about $500 without a long purchasing process. | "Who signs off on a purchase of this size?" |
| Authority | You are talking to, or can reach, one of the roles in the table above. | "Who else would want to see this?" |
| Timing | One of the trigger events is happening in the next 60 days. | "Is there a date this needs to be solved by?" |
| Fit | They match most of the good-prospect list. | Tell me about the last security finding you had to fix. Who asked for it, and how did you show it was done? |
Search strings that find prospects
- LinkedIn or Google:
"security finding remediation"together with a role from the table above - LinkedIn or Google:
"pen test fix evidence"together with a role from the table above - LinkedIn or Google:
"AI code fix verification"together with a role from the table above - LinkedIn or Google:
"prove vulnerability fixed"together with a role from the table above
Research a prospect in ten minutes
- Website (2 min). What do they sell, and to whom? Do they mention AI agents, automation, an MCP server, a "trust" or "security" page?
- Careers page (2 min). Job ads tell you their problems: "AI platform engineer", "security questionnaire", "agent", "LLM", "SOC 2", "GRC".
- LinkedIn (3 min). Find the person in the right role (page 3 table). Read their last few posts. Note one thing they said in their own words.
- Public engineering traces (2 min). A GitHub organisation, an engineering blog, a status page or a listing in an MCP registry.
- Write one sentence (1 min). "I think [company] has [problem] because [evidence]." If you cannot write it, do not contact them yet.
A simple daily routine
- Outreach first, every day, before anything else: research and write to a handful of new, well-matched people. Quality beats volume; a personal message that names their real situation is worth twenty templates.
- Follow up on messages that are three days old, once. After two follow-ups with no answer, stop.
- Log everything in one sheet: date, company, person, role, what they said, offer, price, next step and date.
- End of week: count calls booked, proposals sent and payments received. That is the scoreboard.
Next: the sales conversation →
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.