Cybersecurity Cold Call Script

Opener

[First name], [your name] at [company]. I'm a security vendor and you get fifty of these a week, so I won't quote a breach statistic at you. I've got one specific question about how you're handling [control area] with [tool or architecture you can see they use], and if it's covered, I'll be off the phone in 30 seconds.

Security leaders hang up on fear. Declining to use it, and naming a tool or architecture you have actually identified, tells them this is not an SDR sequence.

Reason for the call

I'm calling because teams running [tool or architecture] usually hit [specific gap: an integration that doesn't cover a particular asset class, a visibility blind spot in a specific environment, an audit control that the tool doesn't natively evidence]. I've seen it at [reference company type] twice this quarter and both of them thought it was covered until an auditor or a red team found it.

A specific, technical gap in a named tool is the only kind of claim a security professional will engage with. Attributing the discovery to an auditor or red team keeps it factual rather than alarmist.

Value hook

What we do is [one precise sentence]. For [reference customer or type], that meant [specific operational result: alert volume on a class of events down, time to evidence a control for an audit cut, a particular coverage gap closed without adding another agent]. I'm not going to tell you it replaces anything in your stack; it fills one specific gap, and if you don't have that gap, you don't need us.

Security buyers are exhausted by vendors who claim to replace three tools. Positioning narrowly, around one gap, is more credible and matches how security budgets actually get spent.

Qualifying question

Can I ask how you're evidencing [control] today: is it native in [tool], a manual process, or a gap you're aware of? And is [framework or audit: SOC 2, ISO 27001, a cyber insurance questionnaire, a customer security review] driving any of your priorities this year?

The control question gets a technical answer; the framework question tells you whether there is a deadline. Security spend follows audits and customer reviews more than it follows threats.

Handling the first pushback

Understood, and I'd assume your stack is deliberate. I'm not asking you to add a tool. I'm asking whether [gap] is actually covered or whether it's assumed covered, because those are different and the second one is what shows up in audits. If you can tell me it's evidenced today, that's a complete answer and I'll go. If you're not certain, I'd offer to show you how [reference] found out.

'We have that covered' is the standard pushback. Distinguishing between covered and assumed-covered is a precise, respectful challenge that a security professional will engage with.

Close

I'd suggest 25 minutes with you or your architect, no slides, where I walk through how [reference] evidenced [control] and you tell me whether it maps to your environment. I'll send a two-paragraph summary beforehand so you can kill the meeting if it's not relevant. Would [day] at [time] or [day] at [time] be better?

No slides, an architect in the room, and a written pre-read they can use to cancel: this is how security leaders prefer to evaluate, and offering it signals you respect their time.

"We already have a tool for that."

Most teams do, and the question is whether it's covering [specific scope] or just the parts it's good at. Can I ask which tool? If it's [tool], the gap I'd check is [specific]. If it's covered there, you're in good shape and I'll leave you alone. If not, it's worth knowing before an auditor finds it.

"We get fifty vendor calls a week and we are not adding anything to the stack."

I'd feel the same way. I'm not asking you to add anything. The one useful thing I can leave you with is the specific gap in [tool] I mentioned; you can check it yourself with your team in ten minutes. If it's a gap, you'll know what to do about it, with or without us.

"Our budget is committed for the year."

Understood, and most security budgets are set by Q1. What usually unlocks mid-year spend is an audit finding, a customer security review or an insurance renewal. If [framework] is coming up, would it be worth a conversation now so you've got evidence ready, rather than a finding you have to remediate under pressure?

"Send me a whitepaper and I will have my team review it."

I'll send something short, not a whitepaper. Before I do: is [gap] something your team has already assessed, or would this be new? If it's been assessed and closed, I'll send nothing and stop calling. If it hasn't, a 25-minute call with your architect would get to an answer faster than a document in a queue.