Enquirer Consulting Group

Reachable Buyer Map

Prepared for Stephen Gatchell · BigID · August 2026
In enterprise data security, first contact usually happens through analyst shortlists, partner introductions and the event circuit. Those channels reach the organizations that are already in a buying cycle, and they are quiet about everything else. This map is everything else, across the United States. The regulated organizations that hold the kind of data a discovery and classification platform is built to find, who signs inside each one, and roughly how many of them are on public record.
Large employers, every industry
The workforce data estate. Every one of these organizations holds personal records on thousands of people across systems that were bought separately and joined later.
Who decides: chief information security officer, chief privacy officer, head of data governance, general counsel.
11,000 to 11,500
US employers with 1,000 or more people on a filed benefit plan; roughly 2,350 of them carry 5,000 or more
Healthcare delivery
The largest regulated data estate in the country by organization count, and the most fragmented. Records move between organizations by design, which is what makes discovery and classification a standing problem rather than a project.
Who decides: chief information security officer, privacy officer, chief compliance officer, chief information officer.
roughly 1.9 million
US healthcare organizations holding a national provider registration; about 13,400 of them are general acute care hospitals
Health plans and payer entities
Claims data at population scale, held by organizations that are already audited on how they hold it. The compliance calendar here is external, which makes the timing of a conversation easier to read than in most segments.
Who decides: chief information security officer, chief compliance officer, privacy officer, head of data management.
11,000 to 12,000
US entities registered as health maintenance, preferred provider, point of service or exclusive provider organizations, combined
Federal contractors and grantees
Every one of these is registered by name, with a published renewal date. Controlled-information handling requirements flow down by contract to the part of this population that touches it, and they arrive as a deadline rather than a preference.
Who decides: chief information security officer, compliance lead, contracts director, IT director.
795,000 to 800,000
entities actively registered to receive US federal awards, excluding those that opted out of public display
Drug and device manufacturers
Regulated product data, clinical data and intellectual property in the same estate, usually across a plant network that grew by acquisition. Small by count, and unusually high-consequence per account.
Who decides: chief information security officer, head of quality and compliance, intellectual property counsel, R and D data owner.
22,500 to 23,000
US establishments on the federal device and drug establishment registers, combined
Law firms and corporate legal
The estate where the data belongs to somebody else. Privilege and client confidentiality make discovery a client-facing obligation, not only an internal one, which changes who inside the firm cares about it.
Who decides: managing partner, general counsel, director of information governance, chief information officer.
roughly 1.37 million licensed attorneys
the firm layer is not enumerated in any single public register, so this segment is built by firm size and practice area rather than bought as a list

Where the openings are

1
The reachable band is far smaller than the market. Roughly 143,000 US employers file a large benefit plan. About 11,000 to 11,500 of them carry 1,000 or more people, and roughly 2,350 carry 5,000 or more. That last band is small enough to work name by name inside a year, which changes what a channel has to do: it has to reach every one of them properly, not reach as many as possible.
2
The buying seat is newer than the buying company. Data protection officer, head of data governance, AI risk lead. Those titles are recent, they turn over, and a new one reopens the shortlist within weeks of arriving. Company-level targeting cannot see that. Role-level targeting is built for it.
3
The federal segment carries a public clock. Every active federal registration has a published expiration date, on roughly 800,000 organizations, in the open, updated monthly. It is one of the few timing signals in enterprise security that does not need to be inferred, and almost nobody works it.
4
The regulated segments are countable and the rest is not. Healthcare, payers, federal awardees and life sciences all sit in public registers, which is why a full universe can be built rather than sampled. The unregulated enterprise does not, which is why lists sold into this market keep returning the same few thousand logos to everyone who buys them.
Built from public federal registers: healthcare and life sciences registrations current to the July 2026 national files, federal award registrations from the July 2026 monthly extract, and employer benefit plan filings for the 2024 filing year. The attorney figure is the national bar count published for 2025. Counts are banded deliberately. A registration is a filing, not always a distinct organization, and entities that opted out of public display are absent from the federal figure. It describes the market rather than your business, and there is nothing to buy at the end of it.
ENQUIRER CONSULTING GROUP
enquirerconsulting.com