Short answer
To sell to the C-suite, start from what each executive is accountable for and bring one specific, quantified idea tied to it. A public company's proxy statement lists the financial measures its executives are paid on. CFOs personally certify the financial reports, so they weigh risk, cash and payback. CIOs answer to the board for cybersecurity risk, including risk from vendors. Reach them through a sponsor, keep the ask small and lead with their numbers.
- A public company's proxy statement must list three to seven of the financial measures that most link executive pay to performance.
- The CEO and CFO sign certifications in every 10-K and 10-Q, so the CFO hears "risk to the numbers" before "upside".
- Annual reports must describe how the company oversees cyber risk from third-party service providers, which is why every new vendor gets a security review.
- Bring one page, one number and one decision. Executives give you minutes, not hours.
- Get in through a sponsor below the executive, with a point of view they can forward.
On this page
- What each executive answers for, and where to read it
- The CEO: read the proxy statement
- The CFO: how to sell to a CFO
- The CIO and CISO: expect the security review
- How to get the meeting
- Worked example: a SaaS seller and a medical device maker
- Common mistakes
- Self-check before an executive meeting
- Sources
- Questions people ask
This guide is for account executives, founders and sales leaders whose deals need a chief executive, chief financial officer or chief information officer to say yes. It shows where to find what each executive is accountable for, using public-company filings and the SEC rules behind them, how to get the meeting, what to bring, and a worked example. Private companies don't file these documents, but their executives answer for the same things, so the method still applies.
What each executive answers for, and where to read it
| Executive | What they answer for | Where it's written down | What to bring |
|---|---|---|---|
| Chief executive officer (CEO) | The company's strategy and the handful of results the board pays them for | Proxy statement (Form DEF 14A); 10-K business section and risk factors | Progress on one of those results, with a number |
| Chief financial officer (CFO) | Accurate financial reports, internal controls, cash, margin and guidance | Certifications filed with every 10-K and 10-Q; management's report on internal control; MD&A | Total cost, payback, cash timing and a downside case |
| Chief information officer (CIO) or chief information security officer (CISO) | Systems, data, security and the risk from vendors | The cybersecurity section of the 10-K; Form 8-K incident reports | Security evidence, integration effort, what you replace |
| Chief operating officer (COO) | Throughput, cost, quality and service levels | 10-K business section and MD&A | An operating metric you'll move and how you'll measure it |
| Chief revenue officer (CRO) | All revenue, from new bookings to renewals | Earnings releases and calls | Pipeline, conversion or retention impact; see the CRO guide |
The rest of this guide takes the three most common buyers in turn.
The CEO: read the proxy statement
A public company's annual proxy statement includes a Compensation Discussion and Analysis. SEC Regulation S-K Item 402(b) requires it to explain "what the compensation program is designed to reward" and, where material, "what specific items of corporate performance are taken into account." That's the board telling you, in writing, what the CEO is paid to achieve.
Item 402(v), added in September 2022, requires a pay versus performance section. It must include a "Tabular List" of "at least three, and up to seven" financial performance measures that, in the company's assessment, most closely link executive pay to performance, plus one Company-Selected Measure singled out as the most important. Smaller reporting companies may skip the list and the Company-Selected Measure, and emerging growth companies are exempt from the section altogether.
A real example: Stryker, the medical technology company, says in its proxy statement filed on 23 March 2026 that no 2025 bonus could be earned unless adjusted consolidated operating income reached about $5.21 billion, and ties the rest to sales on a constant-currency basis, adjusted operating income and adjusted earnings per share. A seller with nothing to say about sales growth, operating income or earnings per share isn't speaking to what Stryker's executives are measured on.
With a CEO, connect your offer to one of those measures in a sentence, with an estimate and a way to check it. Leave the product detail to the people below them.
The CFO: how to sell to a CFO
Two rules shape how a public-company CFO hears a pitch:
- They sign for the numbers. Exchange Act Rule 13a-14 requires each principal executive and principal financial officer to sign a certification filed with every 10-K and 10-Q, and nobody can sign it for them under a power of attorney.
- They report on controls. Regulation S-K Item 308 requires management's annual assessment of internal control over financial reporting, and management can't call controls effective if there's a material weakness.
So a CFO weighs risk to accuracy, cash and predictability before upside. Build your case in their terms:
| What the CFO asks | What to bring |
|---|---|
| What does it cost, all in? | Subscription, implementation, internal staff time and any exit cost |
| When do we get the money back? | Payback in months, using their numbers where you can |
| What if it works half as well? | A downside case that still makes sense, or an honest no |
| When does cash go out? | Payment terms that match their budget cycle |
| Does it touch financial reporting or controls? | Which systems and data it changes, and who signs off |
Ask how they'll account for the purchase rather than telling them; capitalizing or expensing a cost is the CFO's call. Even at a private company, the CFO usually owns the budget calendar, so learn when next year's budget is set and get your case in before then.
The CIO and CISO: expect the security review
Regulation S-K Item 106, adopted in 2023, requires a public company's annual report to describe its processes for managing material cybersecurity risks, including "whether the registrant has processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider," and how the board oversees those risks. Form 8-K Item 1.05 requires disclosure of a material cybersecurity incident, generally within four business days of the company deciding it's material.
Your product is a third-party service provider. Every vendor with access to the company's systems or data adds to the risk the CIO and CISO report on, so expect a security questionnaire before any contract. Have these ready before the first technical meeting:
- An independent assurance report, typically a SOC 2 examination, which covers security, availability, processing integrity, confidentiality or privacy
- What data you'd hold, where it's stored and who can access it
- How you'd connect to their systems, and the effort their team would need to put in
- Which existing tools or contracts you'd replace, since consolidation is usually welcome
How to get the meeting
- Find a sponsor. A director or VP who owns the problem can tell you whether the executive cares, and can carry your one page into their next one-to-one.
- Earn the right with a point of view. One specific observation about their business that the executive hasn't heard from their own team.
- Ask for 20 minutes and one decision. "Is this worth a pilot?" is a decision. "Learn about our platform" isn't.
- Use a peer. If you have a CEO, CFO or CTO, ask them to send the note. Executives answer executives.
- Time it. Budget season and the weeks after an earnings call, when priorities have just been stated in public, are the best moments.
Researching each executive's priorities across a list of accounts takes hours. Bebop researches each account and writes a playbook with who to talk to, what's happening at the company and the angle to open with, which you can check against the filings yourself.
For: [name, title] | From: [your name] via [sponsor's name] Date: [date] WHAT WE NOTICED [One sentence on their stated priority, with the source: e.g. "Your proxy statement ties 2025 bonuses to adjusted operating income."] THE OPPORTUNITY [One sentence on the problem, in their numbers: e.g. "Complaint handling costs about $2.7M a year in staff time."] WHAT WE'D CHANGE AND HOW YOU'D KNOW [The result, the measure and the time frame: e.g. "Cut handling time by 30%, measured on 90 days of tickets."] COST AND PAYBACK [All-in first-year cost; payback in months; the downside case] RISK AND WHAT IT NEEDS FROM YOU [Security review, data, integration, people's time] THE DECISION WE'RE ASKING FOR [e.g. "Approve a 90-day pilot in one division, starting [date]."]
Worked example: a SaaS seller and a medical device maker
Illustrative example. The companies, people and numbers are invented to show the method.
Northlake (northlake.example) sells complaint-handling software. Its target, Corvane Medical (corvane.example), is a public maker of infusion pumps. The AE spends an hour on Corvane's filings and finds:
| Source | What it says | What it means |
|---|---|---|
| Proxy, pay versus performance list | Organic revenue growth, adjusted operating margin, free cash flow | Margin and cash are in the CEO's and CFO's pay |
| 10-K risk factors | Product complaints and recalls could harm revenue and reputation | Complaint handling is a board-level risk |
| 10-K cybersecurity section | The CISO reports to the audit committee quarterly | Security review will be formal, and the CISO matters |
| Careers page | Hiring eight complaint analysts | The current process doesn't scale |
The VP of quality becomes the sponsor. Together they estimate the cost the CFO cares about: 12,000 complaints a year × 3.5 hours × $65 an hour = $2.73M in staff time. If the software cuts handling time by 30%, that saves about $819K a year. The price is $300K a year plus $150K to implement, so the net saving is $519K a year, the implementation pays back in about 3.5 months ($150K ÷ $43K a month) and the first year nets $369K. At half the expected improvement (15%), the saving is about $410K, still above the subscription.
The CFO sees one page: the margin link, the arithmetic, the downside case and a request for a 90-day pilot in one plant. The CISO gets the SOC 2 report and a data-flow diagram the same week, before anyone asks.
Common mistakes
- Pitching features. Executives delegate evaluation. Your job is to show why it's worth evaluating.
- An ROI you can't defend. One inflated assumption and the CFO discounts the whole case.
- Going around your sponsor. You might get the meeting once, and lose the deal and the sponsor.
- Asking for an hour. Ask for 20 minutes with a decision at the end.
- Treating the C-suite as one buyer. The CEO, CFO and CIO want different things from the same deal.
Self-check before an executive meeting
- You can name the measures their pay depends on, or for a private company, the priorities they've stated publicly.
- Your opening line uses one of those measures, not your product name.
- Your numbers use their figures where possible, and you've written a downside case.
- Security documents are ready before they're requested.
- You know the single decision you're asking for, and what happens next if they say yes.
Next step: map who else signs off on the deal with the economic buyer guide.
Sources
- 17 CFR 229.402, Item 402 Executive compensation, Electronic Code of Federal Regulations, accessed 26 October 2026
- 17 CFR 240.13a-14, Certification of disclosure in annual and quarterly reports, Electronic Code of Federal Regulations, accessed 26 October 2026
- 17 CFR 229.308, Item 308 Internal control over financial reporting, Electronic Code of Federal Regulations, accessed 26 October 2026
- 17 CFR 229.106, Item 106 Cybersecurity, Electronic Code of Federal Regulations, accessed 26 October 2026
- SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, U.S. Securities and Exchange Commission, 26 July 2023
- Stryker Corporation proxy statement (Form DEF 14A), U.S. Securities and Exchange Commission (EDGAR), 23 March 2026
- SOC 2 and the SOC suite of services, AICPA & CIMA, accessed 26 October 2026
Written by the Bebop team at Blackpearl Group. Last updated .
Questions people ask
How do you sell to C-level executives?
Start with what the executive is accountable for, not your product. Read the company's proxy statement and annual report to find the measures they're paid on and the risks they've disclosed, then bring one specific, quantified idea tied to one of them. Get introduced by a sponsor who owns the problem, ask for 20 minutes and a single decision, and have the detail ready for their team.
How do you sell to a CFO?
Show the all-in cost, the payback period, when cash goes out and what happens if the result is half what you expect. CFOs of public companies sign certifications on every 10-K and 10-Q and report on internal controls, so they weigh risk and predictability heavily. Use their own figures where possible, ask how they'd account for the purchase, and get your case in before the budget is set.
What do CEOs care about most?
The few results their board pays them for. At a public company, the proxy statement spells these out: the compensation discussion explains what the pay program rewards, and the pay versus performance section lists three to seven of the most important financial measures. Common ones are revenue growth, operating income or margin, earnings per share, cash flow and shareholder return.
What does a CIO look for in a vendor?
Evidence that you won't add risk, plus a clear view of the work involved. Public companies must describe in their annual report how they oversee cybersecurity risks from third-party service providers, so CIOs and CISOs usually run a formal security review. Expect a questionnaire, have an independent assurance report such as a SOC 2 ready, and explain your data handling and integration effort plainly.
How do you get a meeting with a C-level executive?
Usually through someone below them. Find a director or VP who owns the problem, help them see the business case, and ask them to introduce you or carry a one-page brief into their next meeting. A note from your own executive to theirs also works. Time it for budget season or just after an earnings call, when priorities have been stated publicly.