with the skill
# Fix delivery first, then the copy
A 2% open rate almost never means the subject line is bad. It usually means your emails are landing in spam or being rejected. A 0% reply rate on top of that points the same way: most CTOs probably never saw the email. (Open rates are unreliable anyway, so treat it as a symptom, not a metric.) Rewriting the copy won't help until you've checked these:
1. **Sending domain.** Are you sending from your primary domain? Move to secondary domains (like `getyourco.com`) with SPF, DKIM, and DMARC set up, and 3-4 weeks of warmup.
2. **List quality.** Verify every address right before upload. Enterprise lists often have lots of catch-all domains and stale contacts. Keep bounces under 2%.
3. **Tracking.** Turn off open and click tracking. The pixel is a spam signal.
4. **Email format.** Plain text only, no links in the first email, no images, under about 80 words.
5. **Volume.** Keep it to 20-30 sends per mailbox per day.
6. **Placement test.** Run a seed test (GlockApps, MailReach, or your sender's built-in test) before relaunching.
Also, enterprise CTOs often sit behind strict filters like Microsoft 365 with Defender, so authentication and plain text matter even more for this audience.
# The email
I'm assuming developer-focused training (secure coding, threat modeling), since that's what a CTO usually owns. If you sell general employee awareness training, the CISO or head of security is usually the real buyer, and that's worth testing.
**Subject:** secure coding
> Hi {{first_name}},
Show the rest (45 more lines)
>
> {{Company}} is hiring {{number}} engineers this quarter. When teams grow that fast, secure-code review habits rarely keep pace, and the gaps tend to surface in pen tests or audits.
>
> We run hands-on secure coding workshops for engineering teams. {{Similar company}} cut critical pen test findings by {{X}}% in two quarters.
>
> Worth sending the outline?
>
> {{Your name}}
> {{Company, postal address}}
> If this isn't relevant, reply "no" and I won't follow up.
**The opener is a placeholder for a real signal.** Pick one per segment and swap it in:
- Hiring surge (job postings)
- A new compliance deadline (DORA, NIS2, SOC 2, PCI)
- A breach or incident at a competitor
- A recent acquisition (integrating codebases)
If you can't find a real signal for an account, use a segment-level opener instead of faking one: "Engineering orgs above 500 devs usually find secure-code review habits don't scale with headcount."
**Other subject lines to test:** `pen test findings`, `audit prep`, `engineering onboarding`
# Follow-ups
Each one adds something new. Send them as replies in the same thread.
**Day 3, new angle:**
> One thing we see often: most critical findings trace back to the same 3-4 vulnerability classes in each codebase. We start workshops with your own pen test results, so engineers fix what's actually hitting you. Want the outline?
**Day 8, proof:**
> {{Similar company}} had {{situation}}. We ran {{format}} for {{number}} engineers over {{time}}, and {{specific result}}. Happy to share how it was structured if useful.
**Day 15, breakup:**
> I'll assume the timing's off and leave it here. If secure coding training becomes a priority, just reply and I'll send the outline. Good luck with the {{hiring/audit/etc.}}.
After the breakup, don't contact them again.
# What would make this stronger
- A real result with a number from a similar enterprise customer (I left placeholders, so don't send any invented stats)
- Which training you actually sell (developers, all employees, or executives and tabletop exercises), since that changes the buyer and the pain point
- Your list source and sending setup, so I can help you spot where deliverability is breaking
- Whether CTOs are the right title. For enterprise, a VP Engineering, CISO, or Director of AppSec often owns the budget, and CTOs get 300+ emails a day.
**Stop rule:** after the fixes, if you still see a reply rate under 1% after 300+ sends, the targeting or the offer is wrong, and more volume will make it worse.