Enterprise RevOps does not buy a cold-email tool. It buys a revenue platform and treats every additional sender as a risk to data hygiene, domain reputation and security. Gartner made this official in December 2025 with its first Magic Quadrant for Revenue Action Orchestration, a category that merges sales engagement, revenue intelligence and sales force automation. The vendors are consolidating to match: Clari and Salesloft merged in December 2025.
For a new cold-email platform, this buyer is hard to win directly. But it is the buyer who decides whether the volume tools their SDR teams quietly use (In-house SDR teams) survive the next audit.
Who they are
- Title: VP or Director of Revenue Operations, Sales Ops, GTM Systems; sometimes a GTM engineering team (GTM engineers).
- Mandate: CRM integrity (Salesforce is the system of record), forecast accuracy, tool spend per rep, and compliance with security and privacy policies.
- Scale signal: ZoomInfo reports 1,891 customers paying $100K+ a year and 76% of its ACV from "upmarket" accounts in Q2 2026. That is a rough proxy for the number of enterprise GTM orgs with real budgets.
How they buy
| Step | What happens | Why it kills volume tools |
|---|---|---|
| Analyst shortlist | Gartner RAO MQ, peer references | Instantly and Smartlead are not in the category |
| Security review | SOC 2 Type II, pen test, SSO/SAML, SCIM, DPA, sub-processors, OAuth scopes | Agency-first tools often lack the paperwork or the SAML/SCIM tier |
| Data protection | DPA, data residency, transfer mechanisms (GDPR and ePrivacy) | Smartlead processes EU data across the US, Australia, Europe and India (per Instantly, a competitor) |
| CRM integration | Salesforce managed package, field mapping, activity logging | Webhook-only sync is rejected |
| Commercials | Annual or multi-year, MSA, uplift caps, notice periods | Monthly self-serve SaaS looks like shadow IT |
Between 8 and 18 August 2025, attackers used stolen OAuth tokens from the Salesloft Drift integration to export data from numerous corporate Salesforce instances, looking for AWS keys, Snowflake tokens and passwords. Google's guidance afterwards was to treat all Drift-connected tokens as compromised and to enforce minimal scopes and IP restrictions on Connected Apps. Since then, every sales tool that asks for Salesforce or Google Workspace OAuth faces a harder review. This hurts incumbents with sprawling integrations. It also hurts any newcomer that asks for broad mailbox scopes. See OAuth verification and the end of basic auth.
What they pay
| Line item | Typical figure (2026) | Source |
|---|---|---|
| Sales stack per rep, enterprise | $2,500–4,000+/yr | Prospeo estimate |
| Outreach contract | Median $45,600/yr; range $8,620–214,450 | Vendr |
| Outreach onboarding | $5,000–25,000+ | Vendr |
| Salesloft contract | Median $30,760/yr; 5–8% annual uplifts | 11x citing Vendr |
| Clari + Salesloft, 50 seats, 3 years | $220K–400K TCO | revenue.io (competitor) |
| ZoomInfo | ~$15K–40K+/yr | Prospeo estimate |
| HubSpot Enterprise seat | Custom + $3,500 onboarding | HubSpot |
AI is moving into consumption pricing. Outreach blends seats with 10k–100k AI credits per tier. HubSpot charges $1 per qualified lead for its Prospecting Agent. Apollo reports daily credit consumption up nearly 10x in 2026. RevOps now has to forecast credit burn as well as seats.
How they treat cold-email volume
Enterprise suites send from reps' corporate mailboxes at low volume by design. Outreach customers contacted 29 million prospects in 2025 across 6,000+ customers, roughly 400 per customer per month (our arithmetic). HubSpot caps sequences at 500–1,000 per seat per day, all on the primary domain. For RevOps, volume is not the goal. Protecting the corporate domain's reputation (Reputation and blocklists, Google and Yahoo sender rules) and keeping opt-outs consistent across tools is.
Where volume does happen, it happens one of three ways:
- Through an agency. Outsourced outbound (Lead-gen agencies) on the agency's domains and tools. This keeps the risk off the balance sheet.
- Through an AI SDR vendor, increasingly on outcome-based or usage contracts (AI SDR layer, 11x, Artisan).
- Through shadow IT: an SDR leader's credit-card Instantly or Smartlead account on lookalike domains (In-house SDR teams).
The third path is widely discussed in practitioner content, but we found no data on how often enterprise RevOps discovers or sanctions it.
Pain points
- Consolidation pressure with integration debt. The Clari + Salesloft combination runs two engagement products and two conversation-intelligence products, with only initial integration shipped by mid-2026 (competitor claim). Drift was sunset in March 2026.
- Data decay and shelfware. ZoomInfo's net revenue retention fell to 89%, which says customers are cutting seats and credits.
- Pipeline pressure. Sales leadership wants more top-of-funnel than governed tools produce. RevOps carries the risk when someone routes around them.
- Agent governance. Outreach sells an "AI Control Hub" because RevOps now has to govern what autonomous agents send. Salesforce's own outbound agent, Hunter, reaches general availability in November 2026 with Apollo as data partner.
We could not find a credible count of companies with a dedicated RevOps function or of enterprise sales-engagement seats. ZoomInfo's $100K+ customer count is the best public proxy we found.
What this means for an entrant
- Do not lead with this buyer. Sales cycles, security reviews and analyst shortlists favour suites. Win In-house SDR teams and GTM engineers first and arrive at RevOps with usage already inside the account.
- Make the shadow-IT audit pass. Plan for the day RevOps discovers you: SSO/SAML, SCIM, audit logs, a Salesforce-native activity sync, global suppression shared with Outreach or Salesloft, and a SOC 2 Type II report. Instantly claims SOC 2 attestation and Salesforge shows a SOC 2 badge, so this is table stakes by 2027, not a differentiator.
- Turn security into a wedge after Drift. Minimal OAuth scopes, no stored long-lived tokens where avoidable, EU data residency (an advantage for a German founder; see Germany and GDPR and ePrivacy) and a public trust centre win reviews that agency-first tools fail.
- Position as the governed volume layer, not a suite replacement. "We send the cold top-of-funnel from isolated domains, and Outreach or Salesloft handles everything after the reply." That keeps the primary domain clean and fits the RAO platform rather than fighting it.
- Offer an agent-safe sending API. As Salesforce Hunter, HubSpot's Prospecting Agent and Outreach's agents scale, RevOps will want one controlled pipe for machine-sent email, with rate limits, suppression and placement monitoring. See API, webhooks and MCP and Inbox placement testing.