How to Sell to CISOs: Reaching Security Leaders by Phone

How to Sell to CISOs: A B2B Playbook for Cybersecurity Vendors

Reviewed and updated October 2026, leads with how to reach CISOs by phone (gatekeepers, timing, openers and calling their team), then covers the CISO buyer persona, how CISOs evaluate and purchase security solutions, trust-building, buying committee navigation, and the most common mistakes vendors make.

TL;DR: Selling to CISOs is not the same as selling to other C-suite executives. CISOs are technically deep, professionally paranoid, overwhelmed by vendor noise, and accountable for outcomes that are asymmetric, one failure can end a career while a hundred successes go unnoticed. Most vendors fail because they sell to CISOs the way they sell to CMOs or CIOs. This playbook covers what actually works, starting with the part most vendors skip: getting a CISO on the phone. It is drawn from years of running phone-led sales development programmes for cybersecurity vendors.

Every cybersecurity vendor wants to sell to CISOs. Very few know how.

The average CISO fields hundreds of vendor outreach messages every month. Their LinkedIn inbox is a wall of connection requests from SDRs at endpoint protection, SIEM, identity, cloud security, and managed detection companies. Their email is worse, a relentless barrage of "quick question" subject lines, AI-generated personalisation that is obviously AI-generated, and invitations to webinars that promise to reveal "the future of zero trust." Industry benchmarks suggest most cold outreach is ignored entirely, and CISOs sit at the most filtered end of that distribution.

CISOs have developed extremely effective filters for this noise. They can spot a sales pitch in the first three words of a message. They share bad outreach examples in private Slack communities. They warn each other about aggressive vendors. And they have a long memory, a single tone-deaf email from your SDR can put your company on a mental blocklist that persists for years.

And yet CISOs are buying. Enterprise security budgets are growing faster than almost any other category of IT spending. CISOs are actively looking for solutions to real problems. The disconnect is not that they do not want to hear from vendors, it is that most vendors do not know how to talk to them. A researched phone call from someone who understands their world cuts through in a way another email does not.

This playbook is built from direct experience running phone-only SDR programmes for cybersecurity vendors. It covers how to reach CISOs by phone, the CISO persona, how they actually buy, outreach that works (and outreach that guarantees you get ignored), building genuine trust, navigating the buying committee around the CISO, and the mistakes I see vendors making repeatedly.

How to Reach CISOs by Phone

Most vendors give up on calling CISOs because the first few attempts go nowhere. The ones who book meetings treat it as a system: the right people, the right times, and a reason for every call.

Getting past the gatekeeper

Many CISOs, particularly in enterprise, have an executive assistant or a team that screens calls. Treat the assistant as an ally, not an obstacle. Be honest about who you are and why you are calling, give them the one-sentence reason the call matters to the CISO, and ask the best way to get time in the diary. Assistants often know which director owns the problem you are calling about, which is frequently a better first conversation anyway.

Timing the call

CISOs spend most of the working day in meetings. Early morning and late afternoon, before and after the meeting blocks, are when senior leaders are most likely to pick up their own phone. Vary the time of day across attempts rather than calling at the same slot each time, and expect several attempts before a live conversation.

Openers that earn 30 seconds

The first 20 seconds decide the call. Lead with a specific, verifiable observation about their environment, then ask permission to continue:

"Hi [Name], it's [SDR] from [Company]. I noticed you're hiring a detection engineering lead, which usually means the SOC is maturing. That's exactly the problem we work on. Have you got 30 seconds for me to explain why I called, and you can tell me if it's relevant?"

Openers that reference a regulatory deadline, a public incident in their industry, or a talk they gave work the same way, as long as the detail is real and specific. Generic openers about "the evolving threat landscape" end the call. Our cold calling scripts cover the full call structure after the opener.

Voicemails

Most attempts go to voicemail. Keep it to 20 seconds: who you are, the specific trigger, and one line on why it might matter. Do not pitch. A good voicemail makes the next call warmer even if the CISO never calls back.

Calling the team first

Security architects, engineering directors and SOC managers are more reachable than the CISO and drive technical evaluations. A conversation with a director that ends in "you should talk to the CISO about this" is a stronger route in than ten unanswered calls to the CISO's mobile.

The CISO Persona: A Deep-Dive

You cannot sell effectively to someone you do not understand. And most cybersecurity vendors do not understand CISOs nearly as well as they think they do.

What CISOs actually care about

The CISO role has evolved dramatically over the past decade. A modern CISO is not just a technologist, they are a business executive who happens to have deep technical expertise. Their priorities, roughly in order, look like this:

1. Not being the reason the company makes headlines. This is not cynical, it is rational. A data breach or ransomware incident can cost a CISO their job, their reputation, and increasingly their personal legal exposure. After the SEC's action against the SolarWinds CISO, the stakes of the role became viscerally real to every security leader in the industry. Risk reduction is not an abstract concept to CISOs. It is career preservation.

2. Maintaining and growing board confidence. CISOs report to the board more frequently than ever. They need to articulate security posture, risk exposure, and programme progress in business terms. A CISO who cannot translate technical risk into language the board understands will not last long in the role, regardless of how good their security programme is.

3. Doing more with the same (or shrinking) budget. Despite overall security spending increases, individual CISOs often face budget pressure. They are expected to cover an expanding attack surface, cloud, remote work, supply chain, AI-enabled threats, without proportional budget increases. Consolidation and efficiency are constant themes.

4. Hiring and retaining talent. The cybersecurity skills shortage is not a talking point, it is a daily operational reality. CISOs are running teams with chronic understaffing and burnout. Any solution that requires significant headcount to operate is a hard sell. Any solution that reduces the burden on their existing team is immediately interesting.

5. Compliance and regulatory readiness. NIS2, DORA, SEC disclosure rules, industry-specific regulations, the compliance landscape is expanding rapidly, and vendors selling into these buyers should expect serious scrutiny of their own data handling and compliance posture. CISOs who fail to meet regulatory requirements face personal liability in some jurisdictions. Compliance is not optional and is often the budget trigger for new purchases.

6. Proving the value of security investment. CISOs are increasingly asked to justify their budgets with metrics. Proving that security investment is delivering measurable risk reduction, and communicating that proof to non-technical stakeholders, is a persistent challenge.

CISO pain points that create buying triggers

Understanding priorities is one thing. Understanding the specific pain points that cause a CISO to actually start evaluating new solutions is where deals begin.

Alert fatigue and operational overload. Security teams are drowning in alerts, most of which are false positives. If your solution genuinely reduces the signal-to-noise ratio, that is a pain point CISOs feel acutely every day.

Visibility gaps. Most CISOs know they have blind spots, assets they cannot see, configurations they cannot validate, lateral movement they cannot detect. The anxiety of not knowing what you do not know is a powerful motivator.

Tool sprawl. The average enterprise security stack contains 60-80 tools. Many overlap. Many do not integrate well. Consolidation is not just a budget exercise, it is an operational necessity.

Incident response readiness. CISOs know that breach is a matter of "when," not "if." The fear of being caught unprepared during an active incident keeps them up at night.

What CISOs hate about vendor interactions

This section might be the most important in the entire playbook. If you understand what CISOs despise, you can avoid the landmines that kill deals before they start.

Fear-based selling. "The threat landscape is evolving faster than ever." "Hackers are getting more sophisticated." "You cannot afford to be complacent." CISOs hear this from every vendor, every day. It is insulting, they understand the threat landscape better than your sales team does. Fear-based messaging implies they are not doing their job.

Feature dumps. Listing every capability of your platform in the first meeting or email. CISOs do not care about your feature list. They care about whether you solve a specific problem they have. Leading with features signals that you do not understand their environment well enough to know which features matter.

Fake urgency. "I have a special pricing offer that expires Friday." "Our CEO is in town next week and has one slot open." CISOs see through manufactured urgency immediately. It destroys trust and makes your company look desperate.

Claiming to be the only solution. CISOs know the competitive landscape better than most vendors realise. If you claim to be the only company that does X, they will mentally list three competitors who also do X, and they will question your honesty.

Asking for time without giving value. "Can I get 15 minutes on your calendar to learn about your security challenges?" Why would a CISO give you 15 minutes of their time so that you can learn things? The value exchange has to be in their favour from the first interaction.

Not knowing their environment. If your SDR pitches an endpoint protection solution to a CISO who just completed a three-year Crowdstrike deployment, you have wasted their time and revealed that you did no research. CISOs talk to each other. This kind of mistake spreads.

How CISOs Actually Buy

The CISO buying process is different from how most B2B sales methodologies assume buyers behave. Wider research, including the Salesforce State of Sales report, shows enterprise buyers increasingly demand consultative selling, deep personalisation, and rigorous proof, and CISOs sit at the extreme end of that spectrum. Understanding the actual process is essential.

The trigger

CISOs do not wake up one morning and decide to evaluate vendors. Something triggers the buying process:

• A breach or near-miss that exposed a gap
• A regulatory requirement with a compliance deadline
• A board directive following an industry incident
• A renewal coming up on an existing tool they are unhappy with
• Budget approval for a project that was previously unfunded
• A new strategic initiative (cloud migration, zero trust programme, M&A integration)
• Input from their team about operational pain

The trigger matters because it shapes the entire evaluation. A CISO buying under regulatory pressure has different criteria than one buying after a breach. Your outreach and messaging should reflect the trigger if you can identify it.

The research phase

Before a CISO talks to any vendor, they have already done extensive research. They have:

• Asked peers in their private networks (CISO communities, Slack groups, advisory boards) what they use and recommend
• Read analyst reports from firms like Forrester, Gartner, and IDC but filtered them through their own scepticism about analyst methodologies
• Reviewed technical content, blog posts, conference talks, GitHub repositories, threat research, from potential vendors
• Talked to their team about what they have heard, tested, or evaluated in previous roles

By the time a CISO takes a meeting, they typically know more about your product than your SDR does. They are meeting you to validate hypotheses, not to be educated. This has a critical implication: your company's research, reputation and market presence do much of the selling before any conversation happens, and your SDR's job is to open the door with a credible reason to talk.

The evaluation

CISO evaluations are thorough, technical, and long. Expect 3-9 months for anything above $100K ACV. The evaluation typically includes:

Technical proof of concept. CISOs will not buy based on demos alone. They want to see your product in their environment, against their data, facing their threats. If your product cannot survive a real-world POC, no amount of sales skill will save the deal.

Security review of the vendor. CISOs will evaluate your security posture before buying from you. If you are selling security and your own house is not in order, weak SOC 2, publicly exposed infrastructure, the deal is dead.

Reference calls. Not the curated references you provide. CISOs will reach out through their own networks to find customers who are not on your reference list. What those customers say matters more than any case study.

Total cost of ownership analysis. CISOs calculate not just license cost but operational cost, FTEs to deploy and maintain, integration costs, and renewal pricing.

The decision

The final decision is almost never the CISO's alone. Even when the CISO has clear authority over the security budget, they typically seek consensus or at least non-objection from multiple stakeholders. The decision is made when enough people in the buying committee feel comfortable and the CISO can confidently defend the choice to the board if questioned.

Outreach That Works (and Outreach That Does Not)

This is where most cybersecurity vendors get it wrong. They apply generic B2B outreach playbooks to a buyer persona that rejects generic outreach categorically.

What does not work

Templated emails and LinkedIn pitches. "I noticed [company name] was mentioned in [recent news]. As the CISO, you are probably thinking about..." This template is visible from space. CISOs get dozens of these per week and delete them unread.

Scripted calls that sound scripted. A caller reading a generic pitch is as easy to spot as a template email. Script the structure and the opener, not every word.

Asking for a meeting before earning it. Ask for 30 seconds first, then for the meeting once you have shown the call is relevant.

Calling without a reason. Persistence only works when each attempt has a specific reason behind it. Ten identical calls in a week shows your SDR is following a list, not a plan.

Irrelevant case studies. "We helped a retail company reduce MTTD by 60%." The CISO at a financial services firm does not care. Relevance is not optional, it is the minimum bar.

What actually works

Leading with original insight. Share something the CISO does not already know, a specific finding from your threat research team, a trend you are seeing in their industry, a technical analysis of a recent attack vector that is relevant to their environment. If your first call teaches them something, they will remember you.

Referencing specific, verifiable context. "I saw your talk at RSA on supply chain risk management" is good only if you actually watched the talk and can reference a specific point they made. "I noticed you are hiring for a detection engineering lead, which often signals a shift toward building a more mature SOC capability" is the kind of observation that demonstrates genuine research.

Engaging through their team first. Security engineers and architects are more accessible than the CISO and drive technical evaluations. When your champion brings your name up in a team meeting, that is warmer than any cold call to the CISO. Our cybersecurity SDR playbook covers this approach in detail.

Providing value before asking for anything. Invite them to a private, vendor-neutral roundtable with other CISOs. Share an early copy of a threat research report. Offer a free assessment that delivers genuine value whether or not they buy. The best first interaction is one where the CISO gets something useful and you ask for nothing.

Warm introductions through peers. A single introduction from a CISO they trust is worth more than any amount of cold outreach. The LinkedIn Sales Solutions blog has covered repeatedly how referred and warmly introduced buyers convert at multiples of cold counterparts, and the effect is amplified in tight-knit communities like security. Invest heavily in relationships with existing CISO customers and ask them for introductions when appropriate, not as a quota-driven exercise, but as a genuine connection between peers.

Timing outreach to triggers. If a company just received new regulatory requirements or hired a new CISO, your call has a reason to exist. Trigger-based calls convert at dramatically higher rates. Our cybersecurity SDR playbook covers how to build a trigger-based call list.

Building Trust With CISOs

Trust is the single most important variable in selling to CISOs. More important than features, pricing, or analyst ratings. A CISO will pay more for a vendor they trust and reject a cheaper option from a vendor they do not. Here is how trust is built, and how it is destroyed.

How trust is built

Technical credibility. Your company needs to demonstrate genuine security expertise. This means publishing original threat research, contributing to open source security tools, presenting technical content at practitioner conferences (not just vendor-sponsored events), and having security experts on staff who the CISO community recognises and respects.

Transparency about limitations. Nothing builds trust faster than a vendor honestly saying, "That is not something our product does well. Here is what we are great at, and here is where you would need a complementary solution." CISOs are experts at detecting spin. When they encounter honesty about limitations, it makes everything else you say more credible.

Consistency over time. Trust is built through months of consistent behaviour, showing up at community events, publishing useful content, responding to incidents with helpful analysis rather than opportunistic marketing, and treating prospects the same whether or not they are likely to buy this quarter.

Respecting their time. Show up prepared. Do not repeat information they have told you. Do not ask discovery questions you could have answered with basic research. Send agendas before meetings. Follow up with concise summaries, not recaps padded with marketing materials.

Protecting their information. During evaluations, CISOs share sensitive information about their environment. If that information appears in your marketing or in a conversation with their peers, the relationship is over permanently. Confidentiality is sacred.

Having practitioners who speak their language. Your SEs need to be technically credible. A CISO who asks a deep question and gets a shallow response will lose confidence in your entire company.

How trust is destroyed

Overpromising during the sales cycle. Saying your product does something it does not, or will do something by a date it will not, is the fastest path to a churned customer and a CISO who tells everyone in their network to avoid you.

Post-sale neglect. Many vendors pour resources into the pre-sale experience and disappear after the contract is signed. Because CISOs change companies every 2-4 years, the CISO you neglected at Company A will remember when evaluating vendors at Company B.

Exploiting incidents. Sending fear-based marketing within hours of a major breach is seen as ambulance chasing and is deeply offensive to practitioners personally affected by these incidents.

Being dishonest about your own security incidents. If your company has a breach and you handle it with anything less than complete transparency, you will lose the trust of the CISO community permanently.

For a real-world example of trust built through disciplined, security-savvy outbound over time, see our Versa Networks case study, where consistent, technically credible outreach broke into a security-conscious buying committee.

What CISOs Read Before They Take Your Call

CISOs research vendors extensively before engaging, so whatever your company has published shapes the conversation before your SDR dials. Original threat research, honest technical deep-dives and genuine regulatory analysis build credibility; gated PDFs with thin value, product marketing dressed up as thought leadership, and content that talks down to security practitioners erode it. For the SDR, the practical use is simple: give each caller one specific, relevant finding to reference on the call. That is a far stronger opener than offering to send a link.

Navigating the Buying Committee Around the CISO

Even when the CISO is your primary buyer, they do not make the decision alone. Selling to CISOs means selling to the committee around them, and each member has different concerns, influence, and potential to accelerate or kill your deal.

The security engineering team

These are the people who will evaluate your product technically. They will run the POC, stress test integrations, and form strong opinions about whether your product is worth deploying. If the security engineers do not like your product, the CISO will not buy it, no matter how compelling your business case is.

How to engage them: Technical content, hands-on lab environments, open documentation, responsive engineering support during evaluations. Do not try to sell to them. Let your product speak through the technical evaluation.

The SOC and operations team

If your product impacts day-to-day security operations, the SOC team has significant influence. They care about usability, alert quality, integration with existing workflows, and whether your product will add to or reduce their workload.

How to engage them: Demonstrate the operational experience. Show real-world workflows, not scripted demos. Address alert fatigue directly. Let them talk to SOC analysts at your existing customers.

The CFO and finance team

For significant purchases, the CFO or finance team will be involved. They care about total cost of ownership, contract flexibility, and measurable return on investment. The CISO needs to make the business case to finance, so equipping the CISO with financial justification is part of selling to them.

How to engage them: Provide clear ROI frameworks, TCO comparisons, and risk quantification that the CISO can present to finance. Make the financial case easy for the CISO to make internally.

The CIO, IT operations, legal, and procurement

The CIO influences technology decisions that impact infrastructure, and misalignment between the CISO and CIO can stall deals. Ensure your product fits the broader IT architecture. Legal and procurement get involved late but can introduce significant delays, have clean contracts ready, be transparent about data handling, and anticipate common legal questions before they slow the process.

The internal champion

The most important person in the buying committee is often not the most senior. Your internal champion, usually a director-level security leader or senior architect, attends the meetings the CISO skips, pushes evaluations forward when they stall, and argues on your behalf internally.

How to engage them: Treat them as a partner. Give them the materials and arguments they need to sell internally. Help them look good. Never go around them to the CISO, that betrayal will kill their willingness to support you.

Common Mistakes Cybersecurity Vendors Make When Selling to CISOs

Mistake 1: Treating the CISO as a single buyer

Selling to the CISO as an individual rather than selling to the CISO and their buying committee is the single most common mistake. Sales coverage from the HubSpot Sales Blog and others has repeatedly pointed out that enterprise B2B deals now routinely involve six to ten stakeholders, and security deals usually sit at the higher end of that range. Even if the CISO loves your product, they cannot force adoption against the resistance of their team, the objections of finance, or the concerns of legal. A deal that is sold to the CISO alone is a deal that stalls at the finish line.

Mistake 2: Leading with product instead of problem

Your first conversation should not be about your product. It should be about their environment, their challenges, and their priorities. A CISO who feels understood is a CISO who is willing to hear about your solution. A CISO who feels pitched is a CISO who is looking for the door. Train your SDR team to lead with problem-first calls.

Mistake 3: Underestimating the CISO's technical depth

Many sales teams assume the CISO is a business buyer and save technical depth for the SE call. Modern CISOs, especially those who came up through technical roles, are deeply technical. They will ask questions that reveal whether your sales team actually understands the product and the problem space. If your AE cannot handle technical questions gracefully, you will lose credibility in the first meeting.

Mistake 4: Ignoring the CISO's team

Focusing exclusively on the CISO while ignoring the security architects, engineers, and analysts who report to them is a critical error. These practitioners drive technical evaluations, influence the CISO's opinion, and determine post-sale adoption success. A vendor who engages the whole team wins over a vendor who only talks to the boss.

Mistake 5: Using generic case studies

Telling a CISO in financial services about your success with a retail customer is barely better than having no case study at all. CISOs care about relevance, same industry, similar scale, comparable regulatory environment, analogous threat profile. If you do not have a relevant case study, be honest about it rather than stretching an irrelevant one.

Mistake 6: Failing to follow through on commitments

If you say you will send the technical documentation by Thursday, send it by Wednesday. If you say your product supports a specific integration, prove it in the POC. CISOs track commitments meticulously, and every broken promise, no matter how small, erodes trust. In a role where trust is everything, this is fatal.

Mistake 7: Pushing too hard on timeline

Pressuring a CISO to accelerate their evaluation timeline or make a decision before they are ready will backfire. CISOs are methodical buyers who need to do thorough due diligence. Manufactured urgency does not just fail to accelerate, it actively slows deals down because the CISO interprets the pressure as a red flag.

Mistake 8: Neglecting post-sale experience

The deal is not done when the contract is signed. CISOs talk to each other, they change companies, and they have long memories. A CISO who had a great buying experience but a terrible implementation experience will not be a reference, will not renew, and will actively warn peers away from your company. The post-sale experience is your most powerful sales tool for the next deal.

---

Selling to CISOs FAQss

How do I get a meeting with a CISO?

Call with a specific reason. Time calls to triggers like regulatory deadlines, new security hires or recent incidents in their industry, open with a verifiable observation about their environment, and ask for 30 seconds before asking for a meeting. Work with the executive assistant rather than around them, call early or late in the day, and call the CISO's directors and architects as well as the CISO. Warm introductions from other CISOs convert best when you have them.

What is the CISO buyer persona?

The modern CISO buyer persona is a senior executive who combines deep technical expertise with business acumen. Their primary concerns are risk reduction, board communication, operational efficiency, regulatory compliance, and talent management. They are professionally sceptical, overwhelmed by vendor noise, influenced heavily by peer recommendations, and methodical in their evaluation process. They make purchasing decisions based on trust, technical proof, peer validation, and total cost of ownership rather than marketing claims or feature comparisons.

How long does a sales cycle with a CISO typically take?

Enterprise sales cycles involving CISOs typically range from 3-9 months, with larger deals extending to 12 months or longer. The cycle includes independent research, proof-of-concept testing, vendor security review, peer reference checking, business case development, and procurement review. Attempting to compress this timeline with sales pressure usually backfires.

What content works best for building trust with CISOs?

Technical depth matters more than quantity. CISOs value original research, threat analysis, architecture documentation, and honest comparisons over marketing-heavy content. Content that acknowledges trade-offs and limitations is more persuasive than content that claims perfection. For an SDR, whatever your company has published becomes the credible reason for a call, so give your callers one specific, relevant finding to reference rather than a link to send.

How do I build trust with CISOs as a vendor?

Trust is built through technical credibility, transparency about product limitations, consistency over time, respecting the CISO's time, protecting sensitive information shared during evaluations, and having practitioners on your team who speak the CISO's language. Trust is destroyed by overpromising, post-sale neglect, exploiting security incidents for marketing purposes, and dishonesty about your own security posture. Trust takes months to build and seconds to destroy with CISOs.

Should I target the CISO directly or their team first?

In most cases, engaging the CISO's team first is more effective than targeting the CISO directly. Security engineers, architects, and directors are more accessible, more willing to engage with vendors, and heavily influence the CISO's purchasing decisions. Building a champion within the team who brings your name to the CISO organically is a higher-probability path than repeated cold calls to the CISO alone. The exception is when you have a warm introduction or a highly specific, trigger-based reason to contact the CISO directly.

What are the biggest mistakes when selling to CISOs?

The most common mistakes include treating the CISO as a single buyer instead of engaging the full buying committee, leading with product instead of problem, underestimating the CISO's technical depth, ignoring the security team, using irrelevant case studies, failing to follow through on commitments, applying artificial timeline pressure, and neglecting post-sale experience. Most stem from applying generic B2B sales tactics to a persona that rejects generic approaches.

How important are peer references when selling to CISOs?

Peer references are the single most influential factor in CISO purchasing decisions. CISOs trust their peers far more than vendors, analysts, or marketing materials. They actively seek references outside your curated list through private communities and personal connections. A single negative peer reference can kill a deal regardless of technical evaluation results. Investing in customer advocacy and post-sale excellence is the highest-ROI activity because every satisfied CISO customer becomes a reference for future deals.

---

Selling to CISOs requires a different playbook

Selling to CISOs is not a variation of selling to other C-suite executives. It is a different discipline that requires technical credibility, patience, genuine value creation, and a deep understanding of the security leader's world.

The vendors who succeed are the ones who call with a real reason, engage the full buying committee, build genuine relationships with the security community, and treat every conversation as an opportunity to build or erode trust.

If you are a cybersecurity vendor looking to build a sales development programme that reaches CISOs effectively, explore our SDR agency, where Australian-based SDRs run phone-only campaigns for security vendors, or the deeper cybersecurity SDR strategies breakdown. In the CISO community, reputation is everything, and you only get one chance to build it.