29 sales meetings.
32 more companies interested in follow-up.

Building a new source of B2B sales conversations.

Cybersecurity is a difficult service to sell through a first call. A company may already have a firewall, endpoint protection, backups and an IT provider. Getting a meeting depends on reaching the person responsible and finding something they actually want to discuss.

The results above come from a VEXY cybersecurity calling campaign. The following sections explain how to approach conversations about security audits, penetration testing and infrastructure projects.

The caller’s job is to understand the situation, identify a relevant need and arrange a conversation with the provider’s specialists. A technical assessment belongs in that next conversation.

A defined account list before the first call.

The campaign list contained 2,063 unique companies. A useful cybersecurity account profile focuses on businesses with substantial IT infrastructure, sensitive or business-critical data, and an internal IT team or external IT provider.

Relevant sectors can include manufacturing, industrial businesses, warehouse and logistics operators, agriculture, food production, and businesses operating larger office or commercial facilities. Each account still needs to match the agreed IT profile; its industry alone is not enough.

For each company, the research identifies the likely owner of IT or security, checks their role and finds an available business phone number. The primary contacts are:

• IT directors and IT managers
• CTOs and security managers
• Owners and executives who oversee IT decisions

Existing customers, duplicates and companies outside the agreed profile are excluded. Where the first contact is not responsible for security, the caller asks who owns that area and records the referral.

7,835 attempts means working the list more than once.

A list of 2,063 companies is not 2,063 conversations. Some calls reach reception, some go unanswered, and others end with a request to call back. The campaign recorded 7,835 attempts, averaging 3.80 attempts per company.

1. Agree on the reason for calling.

Before outreach, the provider and calling team agree on the target profile, services to introduce, qualification criteria and available meeting times. The opening focuses on a specific subject, such as a planned security review, rather than a long list of services.

2. Reach the person who owns the decision.

The caller confirms the contact’s responsibilities before discussing a project. Reception calls are used to establish the right route into the account. A switchboard connection or a conversation with the wrong person is not counted as a decision-maker conversation.

3. Use retries and scheduled callbacks.

Retries should be spread across different business days and calling windows in the contact’s local time zone. Requested callbacks are logged with the agreed time. A clear decline ends the sequence; it does not trigger more calls.

4. Review what the calls are telling us.

A weekly review checks contact accuracy, the reasons for rejection and the projects prospects mention. If calls repeatedly reach the wrong role, the contact list is corrected. If the opening is too broad, it is narrowed to a service the provider can actually deliver.

Those attempts produced conversations with relevant decision-makers at 481 unique companies. Repeat conversations with the same company do not increase that count.

“We already have security covered.”

This is a common objection in cybersecurity outreach. An existing provider may be doing a good job, and there is no reason to suggest otherwise. The useful question is whether the company has upcoming work that needs additional expertise.

The conversation explores whether the company is planning a security audit, arranging penetration testing, changing its infrastructure, strengthening monitoring, reviewing endpoint protection, preparing for new security requirements or checking its current setup.

A question such as “Do you have any security reviews or infrastructure changes planned over the next six months?” gives the contact something specific to answer. When there is no relevant project or interest, the call ends without pressing for a meeting.

“We have an internal IT team.”

The caller asks whether that team handles specialist security work itself or brings in outside support for particular projects. An audit or penetration test can be a reason to talk without replacing the internal team.

“We’re not looking at this right now.”

The next question is about timing: is the project off the agenda, or is it scheduled for a later quarter? If the contact shares a future review date and wants another conversation then, that date is recorded for follow-up.

“Send me an email.”

The caller asks what information would be useful and what it relates to. A request for a general brochure is not treated as a qualified opportunity. If the contact wants details about a specific service for a planned project, the notes capture that context and the agreed next step.

A meeting needs a reason.

Before booking, the caller checks that the company fits the account profile, the contact is responsible for the subject, and there is a specific need or planned project to discuss.

Useful questions include “Who would be involved in reviewing this?”, “When are you planning to look at it?” and “What would you want to cover with the specialist?” The caller records what the prospect says, including details that still need to be confirmed.

The campaign resulted in 29 booked meetings. A booking is an agreed next conversation, not proof that the meeting took place, became a sales opportunity or generated revenue.

The sales team gets the context, too.

Once the contact agrees, the caller arranges a time with the relevant salesperson and confirms who is attending and what the discussion will cover.

The meeting brief includes the company, the contact’s role, the current setup as described on the call, the project or need, the expected timing and any open questions. The brief distinguishes confirmed information from assumptions.

That gives the salesperson a starting point. They can prepare for the subject the prospect raised and use the meeting to explore requirements in more detail.

32 interested companies need a later next step.

Not every relevant conversation leads to an immediate meeting. Alongside the 29 bookings, 32 separate companies expressed interest in further contact.

Follow-up can suit contacts with a project planned for a later period, a request for service-specific information, or an internal decision still pending. Their records should include the reason for interest, the agreed action and a follow-up date where one is available.

They stay in a separate follow-up list. They are not added to the meeting count, and interest alone does not make them qualified sales opportunities.

What the numbers tell us.

The funnel contains 61 positive responses: 29 booked meetings and 32 contacts interested in further communication. The 29 bookings represent 6.03% of the 481 companies with a relevant decision-maker conversation. The positive-response rate is 12.68% (61 ÷ 481).

Those figures use conversations as their denominator. Against all 7,835 call attempts, the booking rate is 0.37%. Showing both makes the amount of calling work visible.

For a cybersecurity provider, the next question is whether the meetings are useful: did the right person attend, was there a real project to discuss, and did the sales team agree on a next step? Attendance, sales opportunities and revenue are separate outcomes and are not included in these figures.

A meeting about a planned penetration test or security audit gives the sales team a specific discussion to prepare for. That is the purpose of the targeting, questions and handoff described here.