Find someone's email address - how?

honestly, sometimes just ask. a short linkedin message saying what it's about gets you an address more often than you'd expect, and the conversation starts with them having agreed to it. also if you're emailing anyone in the uk or eu, a named work address counts as personal data, so have a reason for contacting them you'd be comfortable explaining.

Work out the company's pattern rather than hunting for the one person. Find anyone there whose address is already public - a press release, a job ad, a commit in a repo, a PDF sitting on their own site - and you usually have the format for everybody else. first.last, f.last, just the first name, there are not many variants. Then verify before you send, because bounces on cold outreach damage your sending reputation. The thing that catches people out is a catch-all domain: the mail server accepts every address you test, so the verifier cheerfully tells you an address is valid when nobody is behind it.