Cybersecurity cold calling scripts for reaching CISOs and IT leaders
Security leaders get a steady stream of vendor outreach, and much of it leans on fear: breach headlines, alarming statistics, and claims that one tool will stop every attack. As a result, many CISOs and IT directors tune out cold calls entirely. The calls that earn a second conversation are calm, specific, and respect the prospect's expertise. They reference something real about the company, ask how the team handles one particular problem, and accept that the answer may be 'We've got it covered.'
Who you're calling
CISOs, heads of security, IT directors, and security engineering managers at mid-market and enterprise companies, plus IT managers who own security at smaller firms. They care about reducing real risk with a small team, getting through audits and customer security reviews, keeping alert noise manageable, and not adding another tool nobody has time to run. They're tired of fear-based pitches, vendors who don't know their stack, breach-of-the-week openers, and claims that a product will make them fully secure.
Work it out from your own connect and meeting rates with the free cold call calculator.
Script 1
Trigger-based call to a CISO
Use when: You've seen a specific public signal, such as a new security leader, job posts for security engineers, a new regulation in their industry, or an expansion into a regulated market.
- You
Hi [Name], it's [Your Name] from [Company]. This is a cold call, so I'll be quick. I noticed [Trigger, e.g. you're hiring several security engineers], and teams in that spot often run into [Problem, e.g. more alerts than the team can review]. Can I ask one question to see if that's true for you?
- Prospect
If this is about another tool, we have plenty. My team can't run what we already own.
- You
That's honest, and it's actually what I wanted to ask about. How much of your team's week goes to triaging alerts versus the work you hired them for?
- Prospect
Too much. Probably half the week for some of my analysts.
- You
That's a lot of their time. Is it mostly false positives, or real alerts that just take a long time to investigate?
- Prospect
Both. But mostly noise from tools that were never tuned.
- You
Got it. I won't tell you we make that disappear. What we do is [Specific Capability, in one sentence]. I can show you how it works with a stack like yours in 20 minutes, or send a short write-up first. If it doesn't fit, I'll tell you. Which would you prefer?
- Prospect
Send the write-up. If it's not marketing fluff, I'll look.
- You
Fair. It'll be one page, written for practitioners. Is there anyone on your team, like whoever runs your security operations, who should see it too?
- Prospect
Copy [Colleague Name]. She runs the SOC.
- You
Will do. I'll send it today and follow up next [Day].
Script 2
IT director without a security team
Use when: You're calling an IT director or manager at a mid-size company who owns security alongside everything else, often without a dedicated security team.
- You
Hi [Name], this is [Your Name] with [Company]. I work with IT teams at [Industry] companies around your size, where security is one of many hats. Is that how it works for you, or do you have a dedicated security team?
- Prospect
It's me and two others for everything, security included. And I don't have time for a pitch.
- You
Understood, I'll keep it short. When a customer or your insurer sends you a security questionnaire, who fills it out?
- Prospect
Me, mostly. Our cyber insurance renewal had a long one this year.
- You
Those can take a while. Did any sections take much longer than the rest?
- Prospect
The [Section, e.g. access control] section took forever. We got the renewal, but it took a lot of back and forth.
- You
That's useful to know, and I don't need any details about your setup. Would it help if I sent a short checklist of the [Section] questions insurers and customers commonly ask, so you can see where you stand before the next renewal? If it looks like something we can help with, we can talk after that.
- Prospect
Yeah, send it. No promises.
- You
None expected. I'll email it today and check in after you've had a chance to look. When's your next renewal, roughly?
- Prospect
[Month].
- You
Thanks, [Name]. I'll make a note to check back well before then.
Script 3
Competitive renewal
Use when: The prospect uses a competing product, a renewal is likely coming up, and you want to be considered without criticizing the incumbent.
- You
Hi [Name], it's [Your Name] at [Company]. I understand you're using [Competitor Product] for [Category]. I'm not calling to criticize it. Teams often look at options around renewal time, and I wanted to ask how it's working for you before yours comes up.
- Prospect
It's fine. Switching security tools is a huge project, so we're not looking.
- You
That's a real concern. Migrations take time and carry risk. On a scale of one to ten, how well does it do what you bought it for?
- Prospect
A seven. Detection's fine. Reporting is painful, and the price went up last year.
- You
Thanks, that's helpful. When does your contract renew?
- Prospect
End of [Quarter]. Procurement will start pushing in a couple of months.
- You
Got it. I'll be straight with you: if a seven is good enough and the price is manageable, staying is a reasonable decision. If you'd like a comparison before procurement starts, I can put together [Comparison, e.g. how our reporting works and what a migration would actually involve], so you have something concrete to decide on or negotiate with. Would that be useful?
- Prospect
Maybe. Don't send me a feature checklist, though.
- You
I won't. It'll focus on reporting and migration effort, the two things you mentioned. Could we put 30 minutes on the calendar a few weeks before procurement starts?
- Prospect
Send me something first. Then we'll see.
- You
That works. I'll send it by [Day] and follow up the week after.
Voicemail script
Hi [Name], it's [Your Name] with [Company]. I'm calling because [Trigger, e.g. you're growing the security team], and I had one question about how your team handles [Problem]. No breach stories, I promise. I'll send a short note by email so you can reply if it's relevant. My number is [Phone]. Again, [Your Name], [Company], [Phone].
When someone else answers
Assistants and IT help desks field a lot of vendor calls, and some companies route all vendor contact through procurement. Be honest and specific: 'Hi, this is [Your Name] with [Company]. I'm a vendor, and I'm trying to reach [Name] about how the team handles [Problem]. What's the best way to get a few minutes with them, or is there someone else who owns that area?' Never claim to be calling about an incident, an audit, a password reset, or an existing account. Security teams are trained to flag exactly that kind of pretext.
Cybersecurity objections and responses
- "We already have a tool for that."
- Most teams do, and I'm not assuming yours isn't working. How well does it cover [Specific Problem]? If the answer is 'well,' I'll leave you alone. If there's a gap, it might be worth 20 minutes.
- "We don't have the people to run another tool."
- That's an honest answer, and a common one. If adding something means more work for your team, it probably isn't worth it. The only reason to talk is if it would take work off their plate, and I'd want to show that with your team's input, not just claim it.
- "Send me your security documentation first."
- Of course, that's the right order. I'll send [Documentation, e.g. our security overview and what we can share under NDA] today. Who on your team reviews vendor security, so it goes to the right person?
- "We're locked into a contract."
- Understood. When does it come up for renewal? I'd rather send something useful a few months before then than call you in the middle of it.
- "Every vendor says they stop breaches."
- You're right to be skeptical. No product stops every attack, and I won't claim ours does. What I can show you is exactly what it does and doesn't cover, so you can judge it against the risks you care about.
More responses in the objection library.
Tips for this industry
- Skip the breach headlines. Security leaders hear fear-based pitches all the time, and a calm, specific question stands out more than another alarming statistic.
- Know their environment before you dial: industry, size, cloud provider, and public signals like job posts. Asking a CISO which cloud they use is a question you could have answered yourself.
- Ask about operational pain, like alert volume, time spent on questionnaires, or tool sprawl, rather than threats. That's where your product either saves the team time or doesn't.
- Offer a practitioner-level write-up instead of a demo. Many security leaders want to read before they meet, and a one-page technical summary respects that.
- Expect a security review and say you're ready for it. Having your documentation prepared shows you understand how security teams buy.
- Practice with an AI CISO who says 'We have plenty of tools' and 'My team can't run what we own.' Rehearsing those answers out loud keeps you from falling back on a feature list.
Questions
How do you cold call a CISO?
Briefly and specifically. Reference a real signal about the company, ask one question about a problem you can actually help with, and offer something easy to say yes to, like a short write-up. Avoid fear-based openers and claims that your product will make them fully secure.
Should cybersecurity sales calls mention recent breaches?
Usually not as an opener. Security leaders already know about the breaches, and using them to create urgency tends to feel manipulative. If a specific incident is genuinely relevant to their industry, mention it factually and move quickly to a question about their situation.
Should I call the CISO or the IT director?
At larger companies, the CISO or head of security sets strategy, while security engineering and security operations managers feel the day-to-day pain. At smaller companies, the IT director often owns security along with everything else. Match the conversation to what that person actually deals with.
What if a prospect asks for security documentation on the first call?
Treat it as a good sign: they're checking whether you're a serious option. Send what your company has approved for sharing, offer a call with your security team, and never overstate the audits, certifications, or controls you have.
More scripts
Make the script sound like you
Practice it against AI prospects until it flows. 250 free credits, about 25 minutes of practice, no card.