How to Research a Private Company: A 2026 Playbook

TL;DR

• Private companies file almost nothing publicly in the US, so you rebuild the picture from registries, job ads, hiring patterns, vendor footprints, and people — not from financial statements.
• Start with the free layer (state registry, company website, LinkedIn, job boards, news) before you spend a credit on a paid database. It answers 60-70% of qualifying questions.
• Non-US companies are far easier: UK Companies House, and most EU registries publish filed accounts you can read for free.
• Headcount growth, open roles, and tech stack changes are the three strongest revenue proxies you can observe from the outside.
• Research is only useful if it ends in a conversation. Convert findings into a named contact and a verified email before you close the tab.

You have a target account. It's private, venture-backed or bootstrapped, and there is no 10-K to read. Your CRM says "Unknown" under employee count and your manager wants a point of view by Friday.

The good news: private companies leak. They leak through job postings, state filings, trademark applications, employee LinkedIn profiles, procurement portals, podcast interviews, and the JavaScript on their marketing site. This is a walkthrough of how to assemble those leaks into something you can actually act on.

What does "researching a private company" actually mean?#

It means answering four questions well enough to decide whether and how to engage:

1. Scale — How many employees, roughly what revenue band, how many locations?
2. Trajectory — Growing, flat, or shrinking? Hiring or quiet-cutting?
3. Structure — Who owns it? Any parent, PE sponsor, or recent acquisition?
4. People — Who owns the problem you solve, and who signs?

Everything below feeds one of those four buckets. If a source doesn't move one of them, skip it — you can burn a full day on interesting-but-useless trivia about a 40-person company.

The trap most people fall into is treating research as a completeness exercise. It isn't. It's a decision-support exercise. You need enough to write a first line that proves you looked, and enough to pick the right person to send it to.

)

What are the free sources you should always check first?#

Do these in order. Each one takes two to eight minutes and most accounts are qualified or disqualified before you reach step five.

1. The company's own website — Read the careers page, the customers page, and the footer. The careers page tells you what they're building next. The customers page tells you who they sell to (segment, geography, deal size). The footer tells you legal entity name, which is what you'll search in registries.
2. State or national business registry — In the US, every state's Secretary of State has a free entity search: incorporation date, registered agent, officers, and status. Delaware tells you little; California, New York, Texas, and Florida tell you more. Outside the US, UK Companies House publishes filed accounts, director names, birthdates, and shareholding — for free.
3. LinkedIn company page + people search — Headcount is self-reported but the "people" tab is not. Filter by function to see how many engineers versus salespeople they actually have. A 200-person company with 4 AEs and 90 engineers is a very different buyer than the reverse.
4. Job boards — Open roles are the highest-signal free data on the internet. A new "Director of RevOps" posting means budget was approved and a tool stack decision is coming. Roles listed by city reveal office footprint. Salary bands (required by law in several US states now) reveal seniority mix and comp philosophy.
5. News, podcasts, and press releases — Founders say things on podcasts they'd never put in a press release. Search the founder's name plus "podcast" and skim the transcript for numbers: ARR, customer counts, headcount targets.
6. Trademark and patent databases — USPTO filings show product names before launch. A trademark filed six months ago for a product that isn't on the site yet is a roadmap leak.

That sequence gets you scale, trajectory, and structure. People — the fourth bucket — is where free sources start to thin out, and where a dedicated email finder earns its keep.

Which paid data sources are worth the money?#

Paid tools split into three categories, and confusing them wastes budget. Firmographic databases sell you the company record. Contact databases sell you the person record. Financial-intelligence platforms sell you estimated or filed financials. Most teams need two of the three, not all of them.

The practical rule: buy contact data monthly, buy firmographic data seasonally, and only buy financial-intelligence data if you sell into finance, procurement, or credit-sensitive deals.

BookYourData and similar list vendors are worth a look when you need a pre-built segment fast rather than a per-company lookup — different job, different tool. For per-account work where you already know the domain, a domain search is faster and cheaper than buying a list you'll only use 3% of.

How do you estimate revenue for a company that doesn't publish it?#

You triangulate. No single method is reliable, but three methods that agree are usually within a band you can quote out loud.

Method 1 — Revenue per employee. Take verified headcount and multiply by an industry benchmark. B2B SaaS runs roughly $150K-$250K per employee at scale, lower for early-stage. Services firms run $120K-$180K. Marketplaces are wildly different — don't apply SaaS multiples to them. This gets you an order of magnitude, not a number.

Method 2 — Funding-implied burn. If a company raised a $20M Series A eighteen months ago and has grown from 40 to 110 people, you can back into a burn rate and infer they're either at meaningful revenue or about to raise again. Either state is a buying signal, for different reasons.

Method 3 — Customer-count math. If the pricing page says $500/mo and the customers page claims "over 2,000 teams," you have a rough ARR floor. Public pricing plus public logos is the most underused estimation tool in B2B.

Method 4 — Filed accounts, where they exist. If the target has a UK, Irish, Dutch, or German subsidiary, that entity files accounts. A US company's UK subsidiary revenue tells you something about the global figure, especially if you know their typical regional split.

Write the estimate as a band with a stated method — "$18M-$25M ARR, based on 120 employees at SaaS-median revenue per head" — not as a fake-precise number. Anyone senior will respect the band and distrust the precision.

What signals tell you a private company is ready to buy?#

Scale tells you if they can afford you. Signals tell you if now is the moment.

• New executive hire in the function you sell to. A new VP of Sales rebuilds the stack within 90 days. This is the single highest-conversion trigger in outbound.
• Job postings that mention your category. "Experience with outbound sequencing tools required" in a job ad means they either have one or are about to buy one.
• Funding round in the last 6 months. Money is allocated within two quarters of close, and headcount plans are already written.
• Tech-stack change. A site that swapped from one analytics vendor to another is in an active procurement cycle and other contracts are likely up too.
• Office or market expansion. A new city on the careers page means new compliance, new tooling, new local vendors.
• Leadership departure. The opposite signal, and worth respecting — deals stall when your champion's boss leaves.

Track these per account rather than per contact. A single account with three simultaneous signals deserves more effort than thirty accounts with one each.

)

How do you turn research into a contact you can actually reach?#

This is where most research dies. You've built a beautiful account brief and you have no way to reach the person named in it.

The workflow that works:

1. Identify the role, not the person, first. Decide you need the Head of Demand Gen. Then find who holds it. Doing it the other way round means you contact whoever is easiest to find, which is usually the wrong person.
2. Confirm the corporate domain. Companies that rebranded often have two domains, and the old one still resolves. Use the domain that appears in employee LinkedIn profiles and the careers page, not the one in the Google snippet.
3. Resolve the email pattern. Most companies use one of six patterns. A company email pattern check identifies which, and from there you can construct addresses across the whole org chart.
4. Verify before sending. Guessed addresses bounce, bounces damage sender reputation, and damaged reputation ruins the next 500 sends. Run every address through an email verifier — the cost per check is trivial compared to a burned domain.
5. Handle catch-all domains deliberately. Many private companies run catch-all servers that accept everything, so standard verification returns "unknown." A dedicated catch-all check is the only way to separate real mailboxes from accepted-but-dead addresses.
6. Enrich the record. Title, seniority, tenure, location, and phone turn a bare address into something your sequencing and routing rules can use. Push it into your CRM at this step, not later.

For accounts where you need coverage across an entire buying committee, a bulk email finder run against the domain beats manual lookups by an order of magnitude in time spent.

What are the legal and ethical limits?#

Public-record research is legal. Scraping behind a login, buying data of unclear provenance, or contacting people who've opted out is not — and in some jurisdictions carries real penalties.

Under GDPR, B2B contact data can be processed under legitimate interest, but you owe the recipient a clear opt-out, a stated source, and deletion on request. Under CAN-SPAM in the US, the bar is lower but the unsubscribe requirement is absolute. Under CCPA/CPRA, California residents can demand to know where you got their data — which means "a list I bought once" is not a defensible answer.

Practical guardrails:

• Prefer vendors that document data sources and honor suppression requests.
• Keep a record of where each contact came from, at the record level.
• Never use personal email addresses for B2B outreach when a corporate one exists.
• Respect a "do not contact" immediately and globally, not just in the tool that received it.

HubSpot's guidance on GDPR-compliant prospecting is a reasonable plain-English starting point if your legal team hasn't written internal rules yet.

How long should researching one private company take?#

Match depth to deal size. A rough budget:

Under $5K ACV, deep research is a losing trade — automate the lookup and spend your time on volume and message quality instead. Above $100K, the research is the differentiator, and the account brief is what gets you the second meeting.

The mistake teams make is applying the $100K process to $5K accounts, running out of hours, and concluding that research doesn't work.

What does a finished account brief look like?#

Keep it to one screen. Anything longer doesn't get read, including by you, three weeks later.

• Entity: legal name, HQ, incorporation date, parent/sponsor if any
• Scale: headcount (verified, not self-reported), revenue band with stated method
• Trajectory: headcount 12 months ago vs today, open roles count
• Stack: relevant vendors detected, contract-renewal guesses
• Signals: the two or three triggers that made this account timely
• People: three named contacts with verified emails and one phone
• Angle: one sentence on why you're reaching out now

That last line is the whole point. Everything above it exists to make it specific and true.

Where should you start?#

Start free, start narrow, and stop when the account is qualified or disqualified — not when you run out of tabs. Registry, website, LinkedIn, job boards, news. Then decide whether the account justifies paid enrichment.

When it does, the bottleneck is almost never finding the company — it's reaching the right person inside it. That's the step where guessed addresses bounce and good research quietly turns into nothing.

Run your shortlist through Tomba Email Finder to turn the names in your brief into verified, deliverable addresses. The free tier gives you 25 searches a month to test it against accounts you already know, and paid plans start at $49/mo on Starter — full Tomba pricing is public if you want to compare against what you're paying today.

Related guides#

• Arounddeal vs Privco 2026: B2B Data Platforms Compared
• B2B Company Data in 2026: Sources, Accuracy & How to Use It
• CB Insights Pricing, Reviews, Pros and Cons (2026 Guide)
• B2B Lead Generation UK: The 2026 Playbook That Works