Should You Buy or Build an IT Decision Makers Email List?

    Short answer

    Who the IT buyer really is by company size, why role rows rot, and how to build a list that stays under a 0.5 percent bounce rate

    Artem Smirnov
    Artem Smirnov

    Last updated · 13 min read

    Artem Smirnov in a dark suit against a charcoal studio backdrop, next to the line 'IT DECISION MAKER LISTS. The CIO on your list may have left'

    The CIO on your list may have left months ago. An IT decision makers list is a file of named people who approve or shape technology purchases: the CIO, the CTO, the IT director, the head of IT, or at a small company the owner. Roles change and the file does not.

    If you plan cold outreach, build that list for each campaign from a data platform. Filter it by the titles your niche really uses and by the technology each company runs. Then verify every address before the first send.

    Use a pre-built file only as a sample for testing a vendor, and keep it out of your sending tool. Gmail and Yahoo both tell senders not to buy addresses, and people change roles and employers, so a fixed file starts aging the day it is delivered.

    List building is part of the B2B lead generation work my team does for a client, and the client pays for data and tools directly, separate from our fee. Where I quote a vendor's price below, it is there to size the spend, and I recommend none of them.

    Is a bought IT list ever the right call?

    Build it if you have one clear offer and sending infrastructure that is ready. Buy only a small sample, and only to test a vendor.

    Pre-built broker fileData platform seatFreelancer listSelf-built from research
    FreshnessFixed on delivery day, ages from thenPulled at the moment you searchSource and date usually unknownAs fresh as your last research pass
    Title precisionThe broker's title mapYour own title filtersWhatever the freelancer typed inYour own titles, checked by hand
    Technographic filteringOnly if sold as a fieldOffered on many platformsRarelyPossible, slow by hand
    Legal paperworkAsk for a source record per rowPlatform terms plus your own lawful basisUsually noneYou record the source yourself
    Bounce riskUnknown until you verifyLower after your own verificationHighestLowest, slowest to build
    Cost predictabilityOne price up frontA monthly fee per userCheap up front, expensive in bouncesYour hours plus a seat

    Cross out the freelancer column first. In my experience, cheap lists from freelancers bring low open rates and high bounces, and you pay for it later in deliverability.

    Three decision rules:

    • One offer, one defined market, warmed sending: build the list.
    • Testing whether IT buyers in a segment exist at all: a small bought sample is fine, as a test.
    • A file with no record of where each row came from: do not send to it.

    For the wider argument across every kind of B2B file, read the general case for and against buying a B2B email list. The same sourcing and legal questions come up for a finance industry email list.

    Who is the IT decision maker in a company, by company size?

    The Bureau of Labor Statistics counts 685,800 computer and information systems manager jobs in the US in 2025. It says these managers may hold titles such as chief information officer, chief technology officer or MIS director. Their knowledge informs purchasing decisions, and they negotiate with vendors.

    O*NET is the Department of Labor's occupation database. It lists sample titles such as IT Director, IS Manager and MIS Director, and its tasks for the role include purchasing equipment and controlling the operational budget.

    Those titles map onto the shape of the company more than onto its industry. The table below is my own working rule of thumb, so check it against your own past deals.

    Company shapeWho usually decides on ITTitles to searchLeave out
    Small firm, no IT departmentOwner or founderOwner, Founder, Managing Director, CEOOffice manager, Assistant
    Mid-market, one IT leaderIT director or head of ITDirector of IT, Head of IT, IT Director, IS ManagerBare "Manager", Associate
    Enterprise, several IT functionsCIO or CTO, plus the VPs who run parts of ITCIO, CTO, Senior VP IT, VP of IT Strategy, VP Global IT OperationsJunior titles inside IT teams

    I start with a client's closed deals and ask one thing about each: which role made the final call? Those names show me the titles the niche really uses, and I search those instead of a generic "manager" label a database suggests.

    I also strip out Assistant, Associate and bare Manager titles before anything else happens. Those titles rarely belong to the person who signs off a purchase.

    One test per row: name the decision this person makes on your deal. If you cannot name one, delete the row.

    Does the IT buyer sit only in IT?

    Gartner surveyed 1,120 managers and above in late 2021. Business units outside IT paid for some or all of 74 percent of technology purchases, and IT alone covered only 26 percent. The data is from 2021 and covers technology purchases in general, so treat the exact split as dated.

    What you sell decides how it applies. For software and integrated solutions, funding by several departments plus IT was the most common setup. For hardware and for services, including managed services, IT-only funding was the most common.

    So let the offer set the shape of each account:

    • Software or an integrated solution: one IT title plus one budget owner per account, such as the head of finance or the head of the team that will use it.
    • Infrastructure, hardware or managed services: IT titles only.
    • Not sure who pays: look at the last 10 deals you closed and see who signed.

    How do you build an IT segment with technographic filters?

    Technographic data tells you which technology a company runs (its cloud, its software stack, its security tools), and firmographic data covers the basics such as industry, country and headcount. Use it when your offer replaces, connects to or services a specific technology.

    1. Lookalikes. Write down your current and past clients and what they share: industry, country, headcount band, the systems they ran.
    2. Firmographic filters. Turn those traits into filters. Keep the headcount range tight enough that one buying process fits all of it.
    3. Technographic filter. Keep the companies that run the technology you replace or plug into, and drop the rest.
    4. Titles. Pull people using the company-shape table above. Take one IT title per account, plus a budget owner if you sell software.
    5. Verification. Run every address through a verifier before it enters a campaign.
    6. Suppression. Remove past opt-outs, objectors, current clients and open deals.

    Technographics tell you which companies to look at, but not who to email. A company running exactly the right stack can still put the wrong human on your list, so take the titles from your closed deals and use the stack only to choose companies.

    Signals have limits in a small market. I use intent data when the total addressable market is large. Say 2,000 companies fit your market and only about 10 of them show any intent signal. There, I skip the signals and put the work into an offer that fits all 2,000.

    A tight technographic filter can shrink a market the same way. If it leaves you with 40 companies, loosen it and let the offer do the narrowing. With 40 accounts, whoever happens to be busy, not ready or uninterested this month decides your result. Volume negates luck.

    When the market is large, my first list has at least 20,000 contacts. In my campaigns, booking 30 to 35 sales calls a month takes reaching at least 10,000 people every month.

    Why do IT contact rows go stale?

    The BLS projects about 53,500 openings a year for computer and information systems managers. Many of them come from replacing people who move to other occupations or leave the labor force. Set against the jobs total, that is roughly 1 opening for every 13 jobs, every year.

    Treat that ratio as a rough signal of churn in the role, nothing more. Openings also include new positions from growth. And the count misses people who take the same job at a different company, which breaks a row on your list just as surely.

    Vendor pages repeat one annual decay percentage, usually without a source. The post on the decay rate everyone quotes traces it to where it started.

    So re-verify or rebuild any IT segment in the days before each campaign launches, whatever date the vendor printed on the file.

    This is not legal advice. The rules bite when you use the data, so read each row as a rule about your first email. Correct at the time of writing; the ICO is revising its B2B page for the Data (Use and Access) Act, so the UK rows may shift.

    MarketWhat the official source saysWhat it means for a bought IT list
    UKThe ICO says marketing emails to corporate bodies need no consent under PECR, the UK's e-privacy rules, but must identify you and give a working opt-out address. For sole traders and some partnerships you need consent or the soft opt-in (details you got through a sale or negotiation, with an easy way to refuse). A named work address is personal data under UK GDPR, so a bought list needs a lawful basis and privacy information within one month.Find the sole traders in the file and treat them separately. Tell each contact where their data came from.
    UK, objectionsThe ICO says an objection to marketing cannot be refused for any reason, and it advises keeping a suppression list instead of deleting details.Keep the minimum details of every objector so they never return in the next bought file.
    EUThe GDPR treats any information about an identifiable person as personal data (Art. 4(1)). Legitimate interests is one lawful basis (Art. 6(1)(f)). You must tell the person where their data came from at the latest at your first communication (Art. 14). It also covers non-EU sellers offering services to people in the Union (Art. 3(2)(a)).Your first email has to say where the address came from. A broker who cannot give you a source per row leaves you unable to say it. National e-privacy rules sit on top in some countries, so check the country before you send.
    USThe FTC says CAN-SPAM applies to mail between businesses just as it does to consumer mail. Opt-outs must be honored within 10 business days. The FTC guide puts the maximum penalty at $53,088 per violating email.Every message needs your real identity, a valid postal address and a working opt-out. Hiring someone else to send does not move the legal responsibility.
    CanadaThe CRTC says CASL penalties for a business reach $10,000,000 per violation.Take Canadian advice on consent before emailing anyone in Canada from a bought file.

    Mailbox providers add their own rules on top of the law. Gmail requires SPF or DKIM for every sender and asks for reported spam below 0.10 percent, never reaching 0.3 percent, and Yahoo sets the same ceiling.

    My team's campaigns go mostly into the USA, the UK and Europe, and we hold ourselves to stricter rules than the legal minimum. In Germany, Austria and the Czech Republic we send IT buyers no cold email without a compliant basis, and use LinkedIn instead.

    What does an IT decision makers list cost, and what do the accuracy claims mean?

    These prices come from each vendor's own page. They are vendor-published and nobody has audited them.

    What you buyPublished price, at the time of writingNote
    Pre-built US IT decision maker file, 90,903 contacts$5,999, one time, from UpLeadThe delivered total may differ by 4 percent in either direction
    Pre-built worldwide IT file, 148,882 contacts$6,999, one time, same UpLead pageThe delivered total may differ by 6 percent
    Starter US file, 935 contacts$399, one time, same UpLead pageAbout $0.43 per contact
    Data platform, entry paid plan$37.45 a month billed annually or $49.90 monthly, 400 credits a month, on Lusha StarterYou pay for credits and still do the targeting
    Email finder, entry paid planEUR 34 a month billed yearly or EUR 49 monthly, 2,000 credits a month, on Hunter StarterFinds and verifies addresses for names you supply
    Enterprise data platformNo list price; ZoomInfo quotes through its sales teamPrice depends on features, licenses and credit use

    One-time files look cheap per row. What you buy is rows frozen on the delivery date. A credit plan lets you pull the rows in the week you send.

    The same costs per contact and per seat, in more detail, are in what B2B contact data costs.

    The same pre-built list page promises a 95 percent data accuracy guarantee and labels its data 100 percent verified. It describes no method, sample or audit behind either figure. Treat both as marketing until your own verification run agrees.

    SMTP validation only shows that a mail server accepted the address at the moment it was checked. It cannot tell you whether the person still holds the job.

    Before you pay, run a short test:

    1. Ask for a sample from your exact segment, with your titles and your company shape.
    2. Run it through your own verifier and note the bounce result.
    3. Check 20 rows against each person's current LinkedIn profile.
    4. If titles or employers are wrong on more than a few, walk away, whatever the verifier said.

    How do you check an IT list before the first send?

    Checks 1 to 7 happen on the file before it touches your sending tool. Checks 8 and 9 are campaign setup, done before launch. Fix each failure before you move to the next. Check 10 happens on the first send.

    1. Every title matches the company-shape table for that account.
    2. Assistant, Associate and bare Manager titles are gone.
    3. Each account has one person per role, so nobody gets the same email twice.
    4. The technographic filter is applied, if your offer depends on a technology.
    5. The whole file was re-verified in the days before launch.
    6. Catch-all addresses, where the server accepts anything, are flagged and either sent in a small separate batch or dropped.
    7. Your suppression list is loaded and matched against the file.
    8. Every message carries your identity and a working opt-out.
    9. SPF and DKIM are set on every sending domain.
    10. Send a small first batch, and pause the campaign if bounces reach 0.5 percent.

    Before anything goes out, my team pushes the whole IT file through NeverBounce or DeBounce, and an address that fails never gets a message.

    Once you are sending, Yahoo's complaint feedback loop reports each spam complaint so you can suppress that person. It only accepts DKIM-signed mail, one more reason for check 9.

    When a campaign to IT buyers goes quiet, I open the list and look at the sender before I change a word of the copy. No copy can make up for a poor list or a weak sender. The same message can pull a 2 percent reply rate for one company and 7.5 percent for another. The words are identical. The sender is not.

    Polish the subject line all you want. The wrong people still will not answer. Here is more on why a quiet campaign usually traces back to the list.

    In our campaigns, reply rates usually sit around 1 percent, and often 0.5 percent once a campaign sends thousands of emails a day. Booked meetings usually come from 10 to 50 percent of replies. These are ranges, never a promise.

    Take a worked example, as an illustration only: 4,000 contacts at a 1 percent reply rate bring about 40 replies over the campaign, and 10 to 50 percent of those turn into roughly 4 to 20 booked meetings.

    Many IT files also ship with direct dials. My team does no cold calling with them; we work through email and LinkedIn, and a phone call only enters as an optional add-on for someone on a warm list who has already answered us. The rates above are email and LinkedIn numbers.

    Build the list for each campaign. Verify it in the days right before launch. If a list does not work with small numbers, it will never work with big numbers. Fix the file first. Then scale.

    Not sure which IT titles actually sign for what you sell? Book a call and name your last three buyers. I will help you turn them into a title list.

    Questions founders ask about IT decision maker lists

    Is there a free IT decision makers email list worth using?

    Free files passed around online rarely say where the rows came from or when they were last checked, so I would not load one. Free tiers are more useful: at the time of writing Lusha's free plan gave up to 40 credits a month and Hunter's 50. Enough to test a segment, too few to run a campaign.

    Do data vendors refund bounced IT contacts?

    Policies differ, so ask before you pay and get the answer in writing. Even where a vendor credits failed rows, the credit does nothing for your sending reputation. If bounces already hurt your domain, no refund covers that. Verify the file yourself first, then claim credits for whatever your verifier rejects.

    Can I email info@ or it@ addresses instead of named people?

    The ICO treats a generic address such as info@company.com as not personal data under UK GDPR, while a named address is personal data. PECR still requires your identity and an opt-out in the message. The real problem is reach. A shared IT inbox is read by whoever monitors it that week, rarely the person holding the budget.

    Should security leaders be on an IT decision makers list?

    Only when your offer is a security product or touches compliance, and only after your past deals show that a CISO or head of security signed. Adding them to a general IT campaign adds contacts to each account without adding a buyer. Give security its own segment and its own message, and keep one owner per role.

    Want to get more B2B clients for your business?

    I help B2B companies book 10 to 100+ qualified sales calls per month with outbound. Let's see if it fits yours.

    Artem Smirnov
    Artem Smirnov

    I help B2B companies book qualified sales calls with cold email and LinkedIn outbound.