How do I automate personalized outreach without sending generic spam?
Security buyers get more cold email than almost anyone. Automation should make outreach more relevant, not more frequent.
- Can AI write our cold emails?
- How do we personalize at scale?
- What are the rules for cold email?
Automate the research and the scheduling, not the judgment. Use AI to gather a real reason to write for each account, draft a short message that refers to it and let a person edit and approve before sending. Keep volumes low, send from properly authenticated domains and follow CASL in Canada and CAN-SPAM in the US. Stop after a few touches.
What to automate and what to keep human
| Step | Automate | Human |
|---|---|---|
| Account research and timing signal | Yes | Review top accounts |
| First draft of the message | Yes | Edit and approve |
| Sending and scheduling | Yes | Set limits |
| Replies and conversations | Route and summarize | Respond |
Follow the rules
In Canada, CASL requires consent for commercial electronic messages, with some narrow exceptions, plus sender identification and an unsubscribe option. Cold email to Canadian recipients is much more restricted than in the US. In the US, CAN-SPAM requires accurate headers, a physical address and opt-out. Gmail also requires authentication, and bulk senders must keep spam complaints below 0.3%. This is general information, so confirm your approach with a lawyer.
Keep volume low
Fifty well-researched messages a week beat five thousand generic ones, and protect your domain's reputation.
How we look at it at ShoutEx
We set up research, drafting and sequencing in your CRM, with a review step before anything is sent. Our ABM and email guide covers targeting.
- Fully automated AI emails with no review.
- Fake personalization such as "loved your recent post".
- High-volume sends from your main domain.
- Ignoring CASL for Canadian recipients.
- A real reason to write each time.
- Human-approved drafts.
- Authenticated, monitored sending.
- A short sequence that stops.
What buyers and practitioners say
Here is what the rule makers and practitioners say.
Gmail requires SPF, DKIM and DMARC for bulk senders, one-click unsubscribe for marketing mail, and a spam rate kept below 0.3%.
Read Google's FAQ →CASL requires consent, identification and an unsubscribe mechanism in commercial electronic messages.
Read the CRTC overview →Security leaders describe the volume of vendor email they receive and what makes them reply: relevance, brevity and no fake familiarity.
Browse the threads →Community summaries describe recurring themes in public threads, not individual posts. Vendor pages describe vendor claims, so test them on your own calls.
Read next
Go deeper in the ShoutEx guides, or check the sources behind this answer.
We'll set up research-driven outreach with a human review step.
Book a call →Follow-up questions
Can we cold email in Canada?
CASL is strict. Some business-to-business messages may fit exceptions, but get advice before running cold campaigns to Canadian recipients.
Should we use a separate domain?
Many teams send outreach from a separate, authenticated domain to protect their main one.
Does LinkedIn outreach work better?
For some buyers, yes. The same rules apply: relevance and low volume.