A GC is three hours into the worst call of his career, with no security firm on retainer, searching for a name at 2 a.m. Somewhere else, a risk manager is deciding right now whether the firm on his K&R policy actually does this work.

Two different people need your firm, and they arrive on two different clocks. One is a risk manager renewing a K&R policy next quarter, deciding whether the firm named in the binder actually does response work or just adjusts claims after the fact.

The other is a general counsel at 2 a.m., three hours into the worst call of his career, with no existing relationship and no time to build one, searching for a name because his company never thought this would happen to them. Both are real buyers. They do not find your firm the same way.

This practice runs on two clocks, not one

The risk manager can be identified before anything happens. Security directors at multinationals, NGO operations leads with field presence in high-risk regions, family office principals, insurance brokers who place K&R coverage: these are known roles at known firms with known exposure, reachable by name before an incident, the way outbound correspondence has always worked in this practice.

The general counsel three hours into a live incident cannot be identified before it happens, because there is no name to write to. Nobody knows in advance which company's executive will be taken. The moment the event occurs, whoever is handling it behaves exactly like any other incident-driven searcher: they open a browser, at whatever hour it is, and type the only words they know. That is a Visibility Program buyer, not an outbound one, and treating this practice as purely one channel or the other misses half of it.

The outbound side: reaching the buyer before the event

ROI Wire builds named lists of security directors, risk managers, NGO operations leads, family office principals, and the insurance brokers who place their coverage, filtered by region and industry exposure rather than pulled from a generic security-vendor database.

A sequence of letters and emails, each addressed to a named individual, opens with the specific gap between general security coverage and the extraction event itself, not a sales pitch. A physical letter follows, signed, plain envelope, timed to arrive as a second, deliberate touch. The phone call that eventually follows references both by date, because the recipient has already been addressed by name three times before anyone calls.

This works because the buyer's need is real before the event: a policy renewal, a board mandate after a competitor's incident, a new region opening up. It does not work as the whole strategy, because it only reaches people already inside a knowable role at a knowable firm, and it never reaches the buyer who has no idea this is a standalone service until the day they need it.

The search side: being found in the first hours, without ever writing in

ROI Wire never writes to a company mid-crisis. There is no ethical version of a cold letter arriving at a firm whose executive was taken this week, and a program that did that would deserve every bit of the reputational damage it caused.

What runs instead is visibility: Google ads built around the specific terms a GC or a family office types in the first hours, kidnap ransom response firm, hostage negotiation consultant, executive kidnapping crisis management, not one generic "security services" campaign competing for unrelated traffic. A web presence that reads as a crisis response specialist, not a general security contractor, so the click holds instead of bouncing to whichever firm has the loudest ad.

LinkedIn placements reach the insurance brokers who place K&R coverage and the crisis consultants who get called first, run as paid placements only, never InMail, connection-request sequences, or direct messages. A broker who trusts your firm still checks whether you have a real web presence before recommending you mid-underwriting, and a thin page loses that referral as fast as it would a cold search.

Objections we hear

Our broker already has a firm on the policy. Some do. Many policies name a firm that adjusts claims, not one that runs live negotiation and extraction, and the gap only becomes visible during an actual incident, which is a bad time to discover it.

We've never had an incident, why market this now. That is exactly the point of the outbound side: the risk manager who has never had an incident is precisely who correspondence reaches before the need is urgent, while search exists for the buyer who did not have that luxury.

Marketing this feels like advertising a worst case. The correspondence speaks to risk management and duty of care, language a security director already uses internally. The search side only appears to someone already typing the words, not someone browsing for a scare.

What ROI Wire does not touch

Your firm's operational work, the intelligence, the negotiation, the extraction, the medical and psychological support, is yours alone. We do not request details of past incidents, ask for client names, or seek access to your operational protocols. We build the lists, write the correspondence, run the ads, and report on opens, replies, clicks, and meetings booked. We do not report on your client conversations or your operational outcomes. The wall is clean.

How this is billed

The outbound side runs on a revenue share or a retainer, whichever fits your cash flow and sales capacity, negotiated per engagement rather than published as a flat rate. The search side is Visibility Program work: you pay ad spend directly to Google and LinkedIn, and ROI Wire bills a retainer that scales with that spend, not a percentage of closed engagements. A landing page may be included at no cost; a full website build is always quoted separately.

Most firms in this vertical need both. The outbound program builds the relationships that convert before an event happens. The search program makes sure your name is the one that surfaces when someone with no relationship needs it in the first hour.

Who this fits, and who it does not

This fits firms with real capability in intelligence, negotiation, extraction, and post-incident support, willing to invest in the pre-incident relationship-building the outbound side requires, and willing to commit to a six-to-ten week runway before the first meetings appear. First meetings that come faster than that are usually the wrong meetings with the wrong buyers.

It does not fit a firm that only wants to be called after an event occurs with no interest in the pre-incident conversation, and it does not fit a firm unwilling to pay for vertical-specific list building and trained phone follow-up. The detail in the correspondence and the specificity of the search terms are the credibility. A generic security-vendor pitch is interchangeable with any other security firm. This is not.